From 12b4eb4d044adfb5fe977c6aa5ef5ba4d1f6fa4e Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Sun, 8 Apr 2018 17:31:55 +0800
Subject: [PATCH] migrate kernel package to support 4.14.32

---
 include/netfilter.mk                          |    27 +-
 package/kernel/ath10k-ct/Makefile             |    25 +-
 ...te-user-space-firmware-loading-again.patch |    36 -
 .../patches/040-remove_last_rx_usage.patch    |    10 +
 .../kernel/gpio-nct5104d/src/gpio-nct5104d.c  |     6 +-
 package/kernel/kmod-sched-cake/Makefile       |     6 +-
 .../ltq-adsl-mei/src/ifxmips_mei_interface.h  |     4 +
 package/kernel/lantiq/ltq-adsl/Makefile       |     6 +-
 .../patches/020-not-leak-cflags.patch         |    32 +
 .../ltq-adsl/patches/100-dsl_compat.patch     |   109 +-
 .../ltq-adsl/patches/120-platform.patch       |    14 +-
 .../ltq-adsl/patches/130-linux3.8.patch       |    38 +-
 .../ltq-adsl/patches/140-linux_3.18.patch     |     2 +-
 .../lantiq/ltq-atm/src/ifxmips_atm_core.h     |     2 +
 package/kernel/lantiq/ltq-atm/src/ltq_atm.c   |   155 +-
 .../kernel/lantiq/ltq-deu/src/ifxmips_aes.c   |     8 +-
 .../kernel/lantiq/ltq-deu/src/ifxmips_arc4.c  |     8 +-
 .../kernel/lantiq/ltq-deu/src/ifxmips_des.c   |     8 +-
 .../kernel/lantiq/ltq-deu/src/ifxmips_deu.h   |    28 +-
 .../lantiq/ltq-deu/src/ifxmips_deu_dma.h      |     5 +
 .../kernel/lantiq/ltq-deu/src/ifxmips_md5.c   |     8 +-
 .../lantiq/ltq-deu/src/ifxmips_md5_hmac.c     |     8 +-
 .../kernel/lantiq/ltq-deu/src/ifxmips_sha1.c  |     8 +-
 .../lantiq/ltq-deu/src/ifxmips_sha1_hmac.c    |     8 +-
 package/kernel/lantiq/ltq-ifxos/Makefile      |     5 +-
 .../ltq-ifxos/patches/002-fix-compile.patch   |    22 +
 .../lantiq/ltq-ifxos/patches/020-no-O3.patch  |    19 +
 ...ion-failure-from-inclusion-of-wrong-.patch |     5 -
 .../lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c     |    13 +-
 .../lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c     |    12 +
 package/kernel/lantiq/ltq-tapi/Makefile       |     4 +-
 .../ltq-tapi/patches/010-fix-compile.patch    |    22 +
 .../patches/020-not-leak-cflags.patch         |    27 +
 .../lantiq/ltq-tapi/patches/100-ifxmips.patch |     2 +-
 .../ltq-tapi/patches/200-linux-37.patch       |    14 +-
 .../ltq-tapi/patches/300-linux-310.patch      |     8 +-
 package/kernel/lantiq/ltq-vdsl-mei/Makefile   |     6 +-
 .../patches/001-fix-compile.patch             |    44 +
 .../patches/020-not-leak-cflags.patch         |    21 +
 .../ltq-vdsl-mei/patches/100-compat.patch     |     2 +-
 package/kernel/lantiq/ltq-vdsl/Makefile       |     8 +-
 .../ltq-vdsl/patches/001-fix-compile.patch    |    12 +
 .../patches/020-not-leak-cflags.patch         |    32 +
 package/kernel/lantiq/ltq-vmmc/Makefile       |     4 +-
 .../patches/020-not-leak-cflags.patch         |    19 +
 package/kernel/leds-apu2/src/leds-apu2.c      |     5 +-
 package/kernel/linux/modules/can.mk           |   191 +-
 package/kernel/linux/modules/crypto.mk        |   752 +-
 package/kernel/linux/modules/firewire.mk      |    30 +-
 package/kernel/linux/modules/fs.mk            |   162 +-
 package/kernel/linux/modules/hwmon.mk         |   235 +-
 package/kernel/linux/modules/i2c.mk           |   132 +-
 package/kernel/linux/modules/iio.mk           |    15 +
 package/kernel/linux/modules/leds.mk          |     2 +-
 package/kernel/linux/modules/netdevices.mk    |    12 +-
 package/kernel/linux/modules/netfilter.mk     |   149 +-
 package/kernel/linux/modules/netsupport.mk    |    53 +-
 package/kernel/linux/modules/other.mk         |    64 +-
 package/kernel/linux/modules/sound.mk         |    16 +
 package/kernel/linux/modules/spi.mk           |    16 -
 package/kernel/linux/modules/usb.mk           |    64 +-
 package/kernel/linux/modules/video.mk         |    13 +-
 package/kernel/mac80211/Makefile              |     6 +-
 .../files/lib/netifd/wireless/mac80211.sh     |    12 +-
 .../mac80211/files/lib/wifi/mac80211.sh       |     2 +-
 ...h => 081-ath10k-calibration-variant.patch} |     0
 ...-IEs-for-variant-before-falling-back.patch |   237 +
 ...10k-fix-build-errors-with-CONFIG_PM.patch} |     0
 ...-free-requested-but-not-started-TX-.patch} |     0
 ...-drop-frames-appearing-to-be-from-us.patch |    25 +
 ...mac-handle-FWHALT-mailbox-indication.patch |    60 +
 ...-packet-filtering-in-promiscuous-mod.patch |   133 +
 ...leanup-brcmf_cfg80211_escan-function.patch |   131 +
 ...cs_to_jiffies-instead-of-calculation.patch |    31 +
 ...rid-of-brcmf_cfg80211_escan-function.patch |    83 +
 ...-of-struct-brcmf_cfg80211_info-activ.patch |    86 +
 ...e-configuration-of-probe-request-IEs.patch |    55 +
 ...15-brcmfmac-add-CLM-download-support.patch |   434 +
 ...driver-unbind-order-of-the-sdio-func.patch |    37 +
 ...fmac-Avoid-build-error-with-make-W-1.patch |    33 +
 ...-load-error-for-legacy-chips-when-us.patch |    40 +
 ...al-scan-support-under-a-separate-co.patch} |     0
 ...ral-scan-support-under-a-separate-c.patch} |     0
 ....16-ath9k-discard-undersized-packets.patch |    25 +
 ...ameter-order-in-brcmf_sdiod_f0_write.patch |    39 +
 ...r-sizes-on-hardware-are-not-dependen.patch |   105 +
 ...ac-Split-brcmf_sdiod_regrw_helper-up.patch |   179 +
 ...ean-up-brcmf_sdiod_set_sbaddr_window.patch |    62 +
 ...16-0005-brcmfmac-Remove-dead-IO-code.patch |    91 +
 ...brcmfmac-Remove-bandaid-for-SleepCSR.patch |    61 +
 ...fmac-Remove-brcmf_sdiod_request_data.patch |   344 +
 ...brcmfmac-Fix-asymmetric-IO-functions.patch |    28 +
 ...0009-brcmfmac-Remove-noisy-debugging.patch |    53 +
 ...0010-brcmfmac-Rename-bcmerror-to-err.patch |    58 +
 ...Split-brcmf_sdiod_buffrw-function-up.patch |   143 +
 ...espace-fixes-in-brcmf_sdiod_send_buf.patch |    34 +
 ...003-brcmfmac-Clarify-if-using-braces.patch |    36 +
 ...replace-old-IO-functions-with-simple.patch |   831 ++
 ...c-Tidy-register-definitions-a-little.patch |    59 +
 ...brcmfmac-Remove-brcmf_sdiod_addrprep.patch |   190 +
 ...unnecessary-call-to-brcmf_sdiod_set_.patch |    32 +
 ...v4.16-0008-brcmfmac-Cleanup-offsetof.patch |   134 +
 ...16-0009-brcmfmac-Remove-unused-macro.patch |    26 +
 ...repeated-calls-to-brcmf_chip_get_cor.patch |   128 +
 ...rge-buffer-size-of-caps-to-512-bytes.patch |    44 +
 ...16-0001-brcmfmac-Remove-r-w-_sdreg32.patch |   227 +
 ...name-buscore-to-core-for-consistency.patch |    33 +
 ...se-the-value-of-sbwad-in-use-for-som.patch |    82 +
 ...rectly-handle-accesses-to-SDIO-func0.patch |    45 +
 ...mac-Remove-func0-from-function-array.patch |   111 +
 ...ficient-and-slightly-easier-to-read-.patch |    40 +
 ...-function-index-with-function-pointe.patch |   347 +
 ...8-brcmfmac-Clean-up-interrupt-macros.patch |    53 +
 ...-43455-save-restore-SR-feature-if-FW.patch |    27 +
 ...1-brcmfmac-Remove-array-of-functions.patch |  1043 ++
 ...ment-block-in-brcmf_sdio_buscore_rea.patch |    31 +
 ...brcmf_sdiod_buff_-read-write-functio.patch |   137 +
 ...oing-memory-allocator-than-allocator.patch |    59 +
 ...EEE80211_TX_STATUS_HEADROOM-up-to-mu.patch |    26 +
 ...ames-with-unexpected-DS-bits-from-fa.patch |    21 +
 ...80211-support-AP-4-addr-mode-fast-rx.patch |    25 +
 ...-fast-rx-with-incompatible-PS-capabi.patch |    53 +
 ...-support-station-4-addr-mode-fast-rx.patch |    34 +
 ...7-mac80211-support-A-MSDU-in-fast-rx.patch |   256 +
 ...bcdc-dcmd-api-does-not-return-value-.patch |    68 +
 ...rate-firmware-errors-from-i-o-errors.patch |   186 +
 ...possibility-to-obtain-firmware-error.patch |    92 +
 ...P_DEVICE-ethernet-address-generation.patch |    64 +
 ...ter-Access-Point-Protocol-packets-by.patch |   157 +
 ...-brcmfmac-Fix-check-for-ISO3166-code.patch |    29 +
 ...-reset-AHB-WMAC-interface-on-AR91xx.patch} |     0
 ...hw-issue-external-reset-for-QCA955x.patch} |     0
 ...tral-scan-enable-bit-on-trigger-for.patch} |     0
 ...eriodic-and-nf-calibation-at-the-sa.patch} |     0
 ...9k-force-rx_clear-when-disabling-rx.patch} |     0
 ...tries-for-powersave-response-frames.patch} |     0
 ...rpret-requested-txpower-in-EIRP-dom.patch} |     0
 ...211-add-hdrlen-to-ieee80211_tx_data.patch} |     0
 ...0211-add-NEED_ALIGNED4_SKBS-hw-flag.patch} |     0
 ...-Enable-STBC-and-LDPC-for-VHT-Rates.patch} |     0
 ...ta-bit-in-PS-buffered-frame-release.patch} |     0
 ...tially-stale-EOSP-status-bit-in-int.patch} |     0
 ... 362-ath9k-report-tx-status-on-EOSP.patch} |     0
 ...ix-block-ack-window-tracking-issues.patch} |     0
 ...ix-channel-maximum-power-level-test.patch} |     0
 ...ower-reduction-for-US-regulatory-do.patch} |     0
 ...ta-flag-for-buffered-multicast-pack.patch} |     0
 ...able-wake_tx_queue-for-older-device.patch} |     0
 ...fix-recent-bandwidth-conversion-bug.patch} |     0
 ...e-only-1Mbps-for-basic-rates-in-mesh.patch |    55 +
 ...l-remove-unnecessary-debugfs-cleanup.patch |   150 +
 ...l-merge-with-minstrel_ht-always-enab.patch |   576 +
 ...trel-reduce-minstrel_mcs_groups-size.patch |   358 +
 ...l-fix-using-short-preamble-CCK-rates.patch |    31 +
 ...tect-queue-draining-by-rcu_read_lock.patch |    43 +
 ...rel-fix-CCK-rate-group-streams-value.patch |    20 +
 ...l-fix-sampling-reporting-of-CCK-rate.patch |    58 +
 ...l-do-not-sample-rates-3-times-slower.patch |    40 +
 ...ory-accounting-with-A-MSDU-aggregati.patch |    58 +
 .../patches/402-ath_regd_optional.patch       |    26 +-
 .../patches/406-ath_relax_default_regd.patch  |     2 +-
 .../522-mac80211_configure_antenna_gain.patch |     2 +-
 ...-register-wiphy-s-during-module_init.patch |     2 +-
 ...und-bug-with-some-inconsistent-BSSes.patch |     2 +-
 ...62-brcmfmac-Disable-power-management.patch |     2 +-
 ...e-internal-roaming-engine-by-default.patch |     2 +-
 package/kernel/mt76/Makefile                  |     6 +-
 package/kernel/mwlwifi/Makefile               |    50 +-
 package/kernel/wrt55agv2-spidevs/Makefile     |    37 -
 package/kernel/wrt55agv2-spidevs/src/Kconfig  |     3 -
 package/kernel/wrt55agv2-spidevs/src/Makefile |     1 -
 .../wrt55agv2-spidevs/src/wrt55agv2_spidevs.c |   114 -
 target/linux/ipq40xx/Makefile                 |    21 +
 .../ipq40xx/base-files/etc/board.d/01_leds    |    38 +
 .../ipq40xx/base-files/etc/board.d/02_network |    52 +
 .../base-files/etc/board.d/03_gpio_switches   |    17 +
 target/linux/ipq40xx/base-files/etc/diag.sh   |    43 +
 .../etc/hotplug.d/firmware/11-ath10k-caldata  |   164 +
 target/linux/ipq40xx/base-files/etc/inittab   |     4 +
 .../lib/preinit/05_set_iface_mac_ipq40xx.sh   |    14 +
 .../base-files/lib/upgrade/openmesh.sh        |   110 +
 .../base-files/lib/upgrade/platform.sh        |    69 +
 target/linux/ipq40xx/config-4.14              |   489 +
 .../arch/arm/boot/dts/qcom-ipq4018-a42.dts    |   237 +
 .../arm/boot/dts/qcom-ipq4018-fritz4040.dts   |   322 +
 .../arm/boot/dts/qcom-ipq4018-rt-ac58u.dts    |   314 +
 .../boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts    |    21 +
 .../arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi  |   177 +
 .../arch/arm/boot/dts/qcom-ipq4019-bus.dtsi   |  1142 ++
 .../arch/arm/boot/dts/qcom-ipq4028-wpj428.dts |   291 +
 .../arm/boot/dts/qcom-ipq4029-gl-b1300.dts    |   310 +
 .../arch/arm/boot/dts/qcom-ipq4029-mr33.dts   |   402 +
 target/linux/ipq40xx/image/Makefile           |   147 +
 ...-cpu-operating-points-for-cpufreq-su.patch |    77 +
 ...ndard-large-page-OOB-layout-when-usi.patch |    47 +
 ...ual-return-values-for-the-erase-hook.patch |    48 +
 ...am-Process-multiple-pending-descript.patch |   395 +
 ...d-command-elements-in-BAM-transactio.patch |    89 +
 ...pport-for-command-descriptor-formati.patch |   201 +
 ...-several-helpers-to-do-common-NAND-o.patch |  1586 +++
 ...rivers-to-explicitly-send-READ-PROG-.patch |    94 +
 ...-Add-a-NULL-check-for-devm_kasprintf.patch |    26 +
 ...le-Add-cpuidle-support-for-QCOM-cpus.patch |    29 +
 .../069-arm-boot-add-dts-files.patch          |    27 +
 .../070-qcom-spm-fix-probe-order.patch        |    16 +
 ...s-ipq4019-Add-a-few-peripheral-nodes.patch |   188 +
 .../102-ARM-dts-ipq4019-fix-PCI-range.patch   |    23 +
 ...nd-add-Winbond-manufacturer-and-chip.patch |    38 +
 ...use-v2-of-the-kpss-bringup-mechanism.patch |   109 +
 ...-USB-nodes-to-ipq4019-SoC-device-tre.patch |   130 +
 ...307-ARM-qcom-Add-IPQ4019-SoC-support.patch |    35 +
 .../310-msm-adhoc-bus-support.patch           | 11026 ++++++++++++++++
 ...dd-quirk-to-autoload-ubi-on-rt-ac58u.patch |    29 +
 ...4019-needs-rfs-vlan_tag-callbacks-in.patch |    53 +
 .../700-net-add-qualcomm-mdio-and-phy.patch   |  2690 ++++
 .../701-dts-ipq4019-add-mdio-node.patch       |    52 +
 ...702-dts-ipq4019-add-PHY-switch-nodes.patch |    46 +
 ...add-qualcomm-essedma-ethernet-driver.patch |  4578 +++++++
 ...ts-ipq4019-add-ethernet-essedma-node.patch |    92 +
 .../patches-4.14/712-mr33-essedma.patch       |   340 +
 ...19-Add-IPQ4019-USB-HS-SS-PHY-drivers.patch |   429 +
 ...r-qca-ipq4019-dwc3-in-dwc3-of-simple.patch |    25 +
 .../850-soc-add-qualcomm-syscon.patch         |   177 +
 ...4019-ap-dk01-add-tcsr-config-to-dtsi.patch |    42 +
 ...-dk01-remove-spi-chip-node-from-dtsi.patch |    17 +
 ...9-ap-dk01.1-c1-add-spi-and-ram-nodes.patch |   115 +
 ...9-ap-dk01.1-c1-add-compatible-string.patch |    10 +
 .../ipq40xx/patches-4.14/900-clk-fix.patch    |   111 +
 target/linux/ipq40xx/profiles/00-default.mk   |     9 +
 target/linux/ipq806x/modules.mk               |    32 -
 target/linux/omap24xx/modules.mk              |     2 +-
 231 files changed, 37800 insertions(+), 1381 deletions(-)
 delete mode 100644 package/kernel/ath10k-ct/patches/130-ath10k-activate-user-space-firmware-loading-again.patch
 create mode 100644 package/kernel/broadcom-wl/patches/040-remove_last_rx_usage.patch
 create mode 100644 package/kernel/lantiq/ltq-adsl/patches/020-not-leak-cflags.patch
 create mode 100644 package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch
 create mode 100644 package/kernel/lantiq/ltq-ifxos/patches/020-no-O3.patch
 create mode 100644 package/kernel/lantiq/ltq-tapi/patches/010-fix-compile.patch
 create mode 100644 package/kernel/lantiq/ltq-tapi/patches/020-not-leak-cflags.patch
 create mode 100644 package/kernel/lantiq/ltq-vdsl-mei/patches/001-fix-compile.patch
 create mode 100644 package/kernel/lantiq/ltq-vdsl-mei/patches/020-not-leak-cflags.patch
 create mode 100644 package/kernel/lantiq/ltq-vdsl/patches/001-fix-compile.patch
 create mode 100644 package/kernel/lantiq/ltq-vdsl/patches/020-not-leak-cflags.patch
 create mode 100644 package/kernel/lantiq/ltq-vmmc/patches/020-not-leak-cflags.patch
 rename package/kernel/mac80211/patches/{937-ath10k-calibration-variant.patch => 081-ath10k-calibration-variant.patch} (100%)
 create mode 100644 package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
 rename package/kernel/mac80211/patches/{318-ath10k-fix-build-errors-with-CONFIG_PM.patch => 300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch} (100%)
 rename package/kernel/mac80211/patches/{320-mac80211-properly-free-requested-but-not-started-TX-.patch => 301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch} (100%)
 create mode 100644 package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
 create mode 100644 package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
 create mode 100644 package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
 create mode 100644 package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
 create mode 100644 package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
 rename package/kernel/mac80211/patches/{321-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch => 308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch} (100%)
 rename package/kernel/mac80211/patches/{321-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch => 309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch} (100%)
 create mode 100644 package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
 create mode 100644 package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
 create mode 100644 package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
 create mode 100644 package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
 create mode 100644 package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
 create mode 100644 package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
 create mode 100644 package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
 create mode 100644 package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
 create mode 100644 package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
 create mode 100644 package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
 create mode 100644 package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
 create mode 100644 package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
 create mode 100644 package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
 create mode 100644 package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
 create mode 100644 package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
 rename package/kernel/mac80211/patches/{300-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch => 350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch} (100%)
 rename package/kernel/mac80211/patches/{301-ath9k_hw-issue-external-reset-for-QCA955x.patch => 351-ath9k_hw-issue-external-reset-for-QCA955x.patch} (100%)
 rename package/kernel/mac80211/patches/{302-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch => 352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch} (100%)
 rename package/kernel/mac80211/patches/{303-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch => 353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch} (100%)
 rename package/kernel/mac80211/patches/{304-ath9k-force-rx_clear-when-disabling-rx.patch => 354-ath9k-force-rx_clear-when-disabling-rx.patch} (100%)
 rename package/kernel/mac80211/patches/{305-ath9k-limit-retries-for-powersave-response-frames.patch => 355-ath9k-limit-retries-for-powersave-response-frames.patch} (100%)
 rename package/kernel/mac80211/patches/{306-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch => 356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch} (100%)
 rename package/kernel/mac80211/patches/{307-mac80211-add-hdrlen-to-ieee80211_tx_data.patch => 357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch} (100%)
 rename package/kernel/mac80211/patches/{308-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch => 358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch} (100%)
 rename package/kernel/mac80211/patches/{309-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch => 359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch} (100%)
 rename package/kernel/mac80211/patches/{310-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch => 360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch} (100%)
 rename package/kernel/mac80211/patches/{311-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch => 361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch} (100%)
 rename package/kernel/mac80211/patches/{312-ath9k-report-tx-status-on-EOSP.patch => 362-ath9k-report-tx-status-on-EOSP.patch} (100%)
 rename package/kernel/mac80211/patches/{313-ath9k-fix-block-ack-window-tracking-issues.patch => 363-ath9k-fix-block-ack-window-tracking-issues.patch} (100%)
 rename package/kernel/mac80211/patches/{314-ath9k_hw-fix-channel-maximum-power-level-test.patch => 364-ath9k_hw-fix-channel-maximum-power-level-test.patch} (100%)
 rename package/kernel/mac80211/patches/{315-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch => 365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch} (100%)
 rename package/kernel/mac80211/patches/{316-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch => 366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch} (100%)
 rename package/kernel/mac80211/patches/{317-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch => 367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch} (100%)
 rename package/kernel/mac80211/patches/{319-ath10k-fix-recent-bandwidth-conversion-bug.patch => 368-ath10k-fix-recent-bandwidth-conversion-bug.patch} (100%)
 create mode 100644 package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
 create mode 100644 package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
 create mode 100644 package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
 create mode 100644 package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
 create mode 100644 package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
 create mode 100644 package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
 create mode 100644 package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
 create mode 100644 package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
 create mode 100644 package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
 create mode 100644 package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
 delete mode 100644 package/kernel/wrt55agv2-spidevs/Makefile
 delete mode 100644 package/kernel/wrt55agv2-spidevs/src/Kconfig
 delete mode 100644 package/kernel/wrt55agv2-spidevs/src/Makefile
 delete mode 100644 package/kernel/wrt55agv2-spidevs/src/wrt55agv2_spidevs.c
 create mode 100644 target/linux/ipq40xx/Makefile
 create mode 100755 target/linux/ipq40xx/base-files/etc/board.d/01_leds
 create mode 100755 target/linux/ipq40xx/base-files/etc/board.d/02_network
 create mode 100755 target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
 create mode 100755 target/linux/ipq40xx/base-files/etc/diag.sh
 create mode 100644 target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
 create mode 100644 target/linux/ipq40xx/base-files/etc/inittab
 create mode 100644 target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
 create mode 100644 target/linux/ipq40xx/base-files/lib/upgrade/openmesh.sh
 create mode 100644 target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
 create mode 100644 target/linux/ipq40xx/config-4.14
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-a42.dts
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-fritz4040.dts
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-bus.dtsi
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts
 create mode 100644 target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-mr33.dts
 create mode 100644 target/linux/ipq40xx/image/Makefile
 create mode 100644 target/linux/ipq40xx/patches-4.14/017-qcom-ipq4019-add-cpu-operating-points-for-cpufreq-su.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/030-mtd-nand-Use-standard-large-page-OOB-layout-when-usi.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/031-mtd-nand-use-usual-return-values-for-the-erase-hook.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/040-dmaengine-qcom-bam-Process-multiple-pending-descript.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/050-0002-mtd-nand-qcom-add-command-elements-in-BAM-transactio.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/050-0003-mtd-nand-qcom-support-for-command-descriptor-formati.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/050-0004-mtd-nand-provide-several-helpers-to-do-common-NAND-o.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/050-0005-mtd-nand-force-drivers-to-explicitly-send-READ-PROG-.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/050-0006-mtd-nand-qcom-Add-a-NULL-check-for-devm_kasprintf.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/059-ARM-cpuidle-Add-cpuidle-support-for-QCOM-cpus.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/070-qcom-spm-fix-probe-order.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/101-ARM-dts-ipq4019-Add-a-few-peripheral-nodes.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/102-ARM-dts-ipq4019-fix-PCI-range.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/104-mtd-nand-add-Winbond-manufacturer-and-chip.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/305-qcom-ipq4019-use-v2-of-the-kpss-bringup-mechanism.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/306-qcom-ipq4019-add-USB-nodes-to-ipq4019-SoC-device-tre.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/307-ARM-qcom-Add-IPQ4019-SoC-support.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/310-msm-adhoc-bus-support.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/400-mtd-ubi-add-quirk-to-autoload-ubi-on-rt-ac58u.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/605-net-IPQ4019-needs-rfs-vlan_tag-callbacks-in.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/700-net-add-qualcomm-mdio-and-phy.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/701-dts-ipq4019-add-mdio-node.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/702-dts-ipq4019-add-PHY-switch-nodes.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/710-net-add-qualcomm-essedma-ethernet-driver.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/711-dts-ipq4019-add-ethernet-essedma-node.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/712-mr33-essedma.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/820-qcom-ipq4019-Add-IPQ4019-USB-HS-SS-PHY-drivers.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/830-usb-dwc3-register-qca-ipq4019-dwc3-in-dwc3-of-simple.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/850-soc-add-qualcomm-syscon.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/864-03-dts-ipq4019-ap-dk01-add-tcsr-config-to-dtsi.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/864-05-dts-ipq4019-ap-dk01-remove-spi-chip-node-from-dtsi.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/864-07-dts-ipq4019-ap-dk01.1-c1-add-spi-and-ram-nodes.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/864-08-dts-ipq4019-ap-dk01.1-c1-add-compatible-string.patch
 create mode 100644 target/linux/ipq40xx/patches-4.14/900-clk-fix.patch
 create mode 100644 target/linux/ipq40xx/profiles/00-default.mk

diff --git a/include/netfilter.mk b/include/netfilter.mk
index 616425cb0..c4e43a84a 100644
--- a/include/netfilter.mk
+++ b/include/netfilter.mk
@@ -30,9 +30,10 @@ endef
 # core
 
 # kernel only
+$(eval $(if $(NF_KMOD),$(call nf_add,NF_REJECT,CONFIG_NF_REJECT_IPV4, $(P_V4)nf_reject_ipv4),))
+
 $(eval $(if $(NF_KMOD),$(call nf_add,NF_IPT,CONFIG_IP_NF_IPTABLES, $(P_V4)ip_tables),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NF_IPT,CONFIG_NETFILTER_XTABLES, $(P_XT)x_tables),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NF_IPT,CONFIG_NF_REJECT_IPV4, $(P_V4)nf_reject_ipv4),))
 
 $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_NETFILTER_XTABLES, $(P_XT)xt_tcpudp),))
 $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_FILTER, $(P_V4)iptable_filter),))
@@ -85,6 +86,10 @@ $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_RECENT, $(P_X
 
 $(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_CONNMARK, $(P_XT)xt_CONNMARK)))
 
+#conntrack-label
+
+$(eval $(call nf_add,IPT_CONNTRACK_LABEL,CONFIG_NETFILTER_XT_MATCH_CONNLABEL, $(P_XT)xt_connlabel))
+
 # extra
 
 $(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_MATCH_ADDRTYPE, $(if $(NF_KMOD),$(P_XT)xt_addrtype,$(P_XT)ipt_addrtype)))
@@ -138,12 +143,15 @@ $(eval $(call nf_add,IPT_IPSEC,CONFIG_IP_NF_MATCH_AH, $(P_V4)ipt_ah))
 $(eval $(call nf_add,IPT_IPSEC,CONFIG_NETFILTER_XT_MATCH_ESP, $(P_XT)xt_esp))
 $(eval $(call nf_add,IPT_IPSEC,CONFIG_NETFILTER_XT_MATCH_POLICY, $(P_XT)xt_policy))
 
+# flow offload support
+$(eval $(call nf_add,IPT_FLOW,CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD, $(P_XT)xt_FLOWOFFLOAD))
 
 # IPv6
 
 # kernel only
+$(eval $(if $(NF_KMOD),$(call nf_add,NF_REJECT6,CONFIG_NF_REJECT_IPV6, $(P_V6)nf_reject_ipv6),))
+
 $(eval $(if $(NF_KMOD),$(call nf_add,NF_IPT6,CONFIG_IP6_NF_IPTABLES, $(P_V6)ip6_tables),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NF_IPT6,CONFIG_NF_REJECT_IPV6, $(P_V6)nf_reject_ipv6),))
 
 $(eval $(if $(NF_KMOD),$(call nf_add,NF_CONNTRACK6,CONFIG_NF_DEFRAG_IPV6, $(P_V6)nf_defrag_ipv6),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NF_CONNTRACK6,CONFIG_NF_CONNTRACK_IPV6, $(P_V6)nf_conntrack_ipv6),))
@@ -338,14 +346,22 @@ $(eval $(if $(NF_KMOD),$(call nf_add,NFT_CORE,CONFIG_NFT_CHAIN_ROUTE_IPV6, $(P_V
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_CORE,CONFIG_NFT_REDIR, $(P_XT)nft_redir, ge 3.19.0),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_CORE,CONFIG_NFT_QUOTA, $(P_XT)nft_quota, ge 4.9.0),))
 
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_ARP,CONFIG_NF_TABLES_ARP, $(P_V4)nf_tables_arp),))
+
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_BRIDGE,CONFIG_NF_TABLES_BRIDGE, $(P_EBT)nf_tables_bridge),))
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_BRIDGE,CONFIG_NFT_BRIDGE_META, $(P_EBT)nft_meta_bridge),))
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_BRIDGE,CONFIG_NFT_BRIDGE_REJECT, $(P_EBT)nft_reject_bridge),))
+
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_NAT, $(P_XT)nft_nat),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_CHAIN_NAT_IPV4, $(P_V4)nft_chain_nat_ipv4),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_REDIR_IPV4, $(P_V4)nft_redir_ipv4, ge 3.19.0),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_REDIR_IPV6, $(P_V6)nft_redir_ipv6, ge 3.19.0),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_CHAIN_NAT_IPV6, $(P_V6)nft_chain_nat_ipv6),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_MASQ, $(P_XT)nft_masq),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_MASQ_IPV4, $(P_V4)nft_masq_ipv4),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_MASQ_IPV6, $(P_V6)nft_masq_ipv6),))
+
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_REDIR_IPV6, $(P_V6)nft_redir_ipv6, ge 3.19.0),))
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_CHAIN_NAT_IPV6, $(P_V6)nft_chain_nat_ipv6),))
+$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_MASQ_IPV6, $(P_V6)nft_masq_ipv6),))
+
 
 # userland only
 IPT_BUILTIN += $(NF_IPT-y) $(NF_IPT-m)
@@ -356,6 +372,7 @@ IPT_BUILTIN += $(IPT_CONNTRACK-y)
 IPT_BUILTIN += $(IPT_CONNTRACK_EXTRA-y)
 IPT_BUILTIN += $(IPT_EXTRA-y)
 IPT_BUILTIN += $(IPT_FILTER-y)
+IPT_BUILTIN += $(IPT_FLOW-y) $(IPT_FLOW-m)
 IPT_BUILTIN += $(IPT_IPOPT-y)
 IPT_BUILTIN += $(IPT_IPRANGE-y)
 IPT_BUILTIN += $(IPT_CLUSTER-y)
diff --git a/package/kernel/ath10k-ct/Makefile b/package/kernel/ath10k-ct/Makefile
index fe094e76a..1725bb7d1 100644
--- a/package/kernel/ath10k-ct/Makefile
+++ b/package/kernel/ath10k-ct/Makefile
@@ -8,19 +8,19 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/greearb/ath10k-ct.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2017-06-13
-PKG_SOURCE_VERSION:=bded1823912549017d819d1796273b3134c3de20
-PKG_MIRROR_HASH:=616174650e12a82edb6b6bd18ac186e2c6a48fdad0082df9d2011ab20940814b
-
-PKG_MAINTAINER:=Ben Greear <greearb@candelatech.com>
-PKG_BUILD_PARALLEL:=1
-PKG_EXTMOD_SUBDIRS:=ath10k
+PKG_SOURCE_DATE:=2018-03-16
+PKG_SOURCE_VERSION:=30827f7d5b9841905c4efe918da2d95fc518c921
+PKG_MIRROR_HASH:=aac023d7f9b09becf27058b1d09ae6d068b14bb6f10c5b5a248c7ee5ecff04dc
 
 # Build the 4.13 ath10k-ct driver version.  Other options are "-4.9", or
 # leave un-defined for 4.7 kernel.  Probably this should match as closely as
 # possible to whatever mac80211 backports version is being used.
 CT_KVER="-4.13"
 
+PKG_MAINTAINER:=Ben Greear <greearb@candelatech.com>
+PKG_BUILD_PARALLEL:=1
+PKG_EXTMOD_SUBDIRS:=ath10k$(CT_KVER)
+
 STAMP_CONFIGURED_DEPENDS := $(STAGING_DIR)/usr/include/mac80211-backport/backport/autoconf.h
 
 include $(INCLUDE_DIR)/kernel.mk
@@ -29,11 +29,12 @@ include $(INCLUDE_DIR)/package.mk
 define KernelPackage/ath10k-ct
   SUBMENU:=Wireless Drivers
   TITLE:=ath10k-ct driver optimized for CT ath10k firmware
-  DEPENDS:=+kmod-mac80211 +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT @PCI_SUPPORT +kmod-hwmon-core
+  DEPENDS:=+kmod-mac80211 +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT +kmod-hwmon-core
   FILES:=\
 	$(PKG_BUILD_DIR)/ath10k$(CT_KVER)/ath10k_pci.ko \
 	$(PKG_BUILD_DIR)/ath10k$(CT_KVER)/ath10k_core.ko
   AUTOLOAD:=$(call AutoProbe,ath10k_pci)
+  PROVIDES:=kmod-ath10k
 endef
 
 NOSTDINC_FLAGS = \
@@ -50,9 +51,11 @@ ifdef CONFIG_PACKAGE_MAC80211_MESH
 endif
 
 CT_MAKEDEFS += CONFIG_ATH10K=m CONFIG_ATH10K_PCI=m
-# No AHB support enabled yet.  Could conditionally enable it later.
-#CT_MAKEDEFS += CONFIG_ATH10K_AHB=y
-#NOSTDINC_FLAGS += -DCONFIG_ATH10K_AHB
+
+# This AHB logic is needed for IPQ4019 radios
+CT_MAKEDEFS += CONFIG_ATH10K_AHB=m
+NOSTDINC_FLAGS += -DCONFIG_ATH10K_AHB
+
 NOSTDINC_FLAGS += -DSTANDALONE_CT
 
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
diff --git a/package/kernel/ath10k-ct/patches/130-ath10k-activate-user-space-firmware-loading-again.patch b/package/kernel/ath10k-ct/patches/130-ath10k-activate-user-space-firmware-loading-again.patch
deleted file mode 100644
index dc02a9d6e..000000000
--- a/package/kernel/ath10k-ct/patches/130-ath10k-activate-user-space-firmware-loading-again.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From c0cc00f250e19c717fc9cdbdb7f55aaa569c7498 Mon Sep 17 00:00:00 2001
-From: Hauke Mehrtens <hauke@hauke-m.de>
-Date: Thu, 24 Aug 2017 23:06:41 +0200
-Subject: [PATCH] ath10k: activate user space firmware loading again
-
-In commit 9f5bcfe93315 ("ath10k: silence firmware file probing
-warnings") the firmware loading was changed from request_firmware() to
-request_firmware_direct() to silence some warnings in case it fails.
-request_firmware_direct() directly searches in the file system only and
-does not send a hotplug event to user space in case it could not find
-the firmware directly.
-In LEDE we use a user space script to extract the calibration data from
-the flash memory which gets triggered by the hotplug event. This way the
-firmware gets extracted from some vendor specific partition when the
-driver requests this firmware. This mechanism does not work any more
-after this change.
-
-Fixes: 9f5bcfe93315 ("ath10k: silence firmware file probing warnings")
-Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
-Cc: Michal Kazior <michal.kazior@tieto.com>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- ath10k-4.13/core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/ath10k-4.13/core.c
-+++ b/ath10k-4.13/core.c
-@@ -556,7 +556,7 @@ static const struct firmware *ath10k_fet
- 		dir = ".";
- 
- 	snprintf(filename, sizeof(filename), "%s/%s", dir, file);
--	ret = request_firmware_direct(&fw, filename, ar->dev);
-+	ret = request_firmware(&fw, filename, ar->dev);
- 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot fw request '%s': %d\n",
- 		   filename, ret);
- 
diff --git a/package/kernel/broadcom-wl/patches/040-remove_last_rx_usage.patch b/package/kernel/broadcom-wl/patches/040-remove_last_rx_usage.patch
new file mode 100644
index 000000000..9f4b0b01b
--- /dev/null
+++ b/package/kernel/broadcom-wl/patches/040-remove_last_rx_usage.patch
@@ -0,0 +1,10 @@
+--- broadcom-wl-5.10.56.27.3/driver/wl_linux.c.orig	2018-01-13 18:25:14.944667645 +0100
++++ broadcom-wl-5.10.56.27.3/driver/wl_linux.c	2018-01-13 18:25:25.836667888 +0100
+@@ -2762,7 +2762,6 @@
+ 	bcopy(oskb->data + D11_PHY_HDR_LEN, pdata, oskb->len - D11_PHY_HDR_LEN);
+ 
+ 	skb->dev = wl->monitor;
+-	skb->dev->last_rx = jiffies;
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+ 	skb_reset_mac_header(skb);
+ #else
diff --git a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
index 1ad1a6b10..c139cf8d2 100644
--- a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
+++ b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
@@ -35,7 +35,8 @@
 #define SIO_LOCK_KEY		0xAA	/* Key to disable Super-I/O */
 
 #define SIO_NCT5104D_ID					0x1061	/* Chip ID */
-#define SIO_PCENGINES_APU_NCT5104D_ID	0xc452	/* Chip ID */
+#define SIO_PCENGINES_APU_NCT5104D_ID1	0xc452	/* Chip ID */
+#define SIO_PCENGINES_APU_NCT5104D_ID2	0xc453	/* Chip ID */
 
 enum chips { nct5104d };
 
@@ -350,7 +351,8 @@ static int __init nct5104d_find(int addr, struct nct5104d_sio *sio)
 	devid = superio_inw(addr, SIO_CHIPID);
 	switch (devid) {
 	case SIO_NCT5104D_ID:
-	case SIO_PCENGINES_APU_NCT5104D_ID:
+	case SIO_PCENGINES_APU_NCT5104D_ID1:
+	case SIO_PCENGINES_APU_NCT5104D_ID2:
 		sio->type = nct5104d;
 		/* enable GPIO0 and GPIO1 */
 		superio_select(addr, SIO_LD_GPIO);
diff --git a/package/kernel/kmod-sched-cake/Makefile b/package/kernel/kmod-sched-cake/Makefile
index f9bcd65f1..2156eee0e 100644
--- a/package/kernel/kmod-sched-cake/Makefile
+++ b/package/kernel/kmod-sched-cake/Makefile
@@ -13,9 +13,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/dtaht/sch_cake.git
-PKG_SOURCE_DATE:=2018-01-07
-PKG_SOURCE_VERSION:=568ed96467f41aad37556b0db11fc008e05941e9
-PKG_MIRROR_HASH:=8f3f962824826d07b1029379d91e01bf97fe0bfce1233af5cfa7a54cb1c3632c
+PKG_SOURCE_DATE:=2018-03-19
+PKG_SOURCE_VERSION:=0afc1bee4e9fc5d75668cb10254ab5d2d02f0098
+PKG_MIRROR_HASH:=b8ac95753d05ff602282ed5a799f9c953f60decebc5720ee8f0101344a5acfc4
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/kernel/lantiq/ltq-adsl-mei/src/ifxmips_mei_interface.h b/package/kernel/lantiq/ltq-adsl-mei/src/ifxmips_mei_interface.h
index 1098b2b79..dc9f1c241 100644
--- a/package/kernel/lantiq/ltq-adsl-mei/src/ifxmips_mei_interface.h
+++ b/package/kernel/lantiq/ltq-adsl-mei/src/ifxmips_mei_interface.h
@@ -111,7 +111,11 @@ static inline long
 ugly_hack_sleep_on_timeout(wait_queue_head_t *q, long timeout)
 {
 	unsigned long flags;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,13,0))
+	wait_queue_entry_t wait;
+#else
 	wait_queue_t wait;
+#endif
 
 	init_waitqueue_entry(&wait, current);
 
diff --git a/package/kernel/lantiq/ltq-adsl/Makefile b/package/kernel/lantiq/ltq-adsl/Makefile
index b6f1c8a96..0fbda34ff 100644
--- a/package/kernel/lantiq/ltq-adsl/Makefile
+++ b/package/kernel/lantiq/ltq-adsl/Makefile
@@ -10,15 +10,15 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-adsl
 PKG_VERSION:=3.24.4.4
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_SOURCE:=drv_dsl_cpe_api_danube-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/ltq-dsl-$(BUILD_VARIANT)/drv_dsl_cpe_api-$(PKG_VERSION)
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
 PKG_HASH:=eb2ed59715d3bf4e8a1460bbbe2f1660039e0a9f9d72afb1b2b16590094eb33c
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
-PKG_USE_MIPS16:=0
 PKG_CHECK_FORMAT_SECURITY:=0
+PKG_ASLR_PIE:=0
 PKG_FIXUP:=autoreconf
 
 include $(INCLUDE_DIR)/package.mk
@@ -83,8 +83,6 @@ CONFIGURE_ARGS += \
 EXTRA_CFLAGS += -DDEBUG
 endif
 
-EXTRA_CFLAGS = -fno-pic -mno-abicalls -mlong-calls -G 0
-
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include/adsl
 	$(CP) $(PKG_BUILD_DIR)/src/include/drv_dsl_cpe_*.h $(1)/usr/include/adsl/
diff --git a/package/kernel/lantiq/ltq-adsl/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-adsl/patches/020-not-leak-cflags.patch
new file mode 100644
index 000000000..b3f20dbbb
--- /dev/null
+++ b/package/kernel/lantiq/ltq-adsl/patches/020-not-leak-cflags.patch
@@ -0,0 +1,32 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -253,10 +253,7 @@ else
+ drv_dsl_cpe_api_common_mod_cflags =
+ endif
+ 
+-drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB \
+-    -pipe -Wall -Wformat -Wimplicit -Wunused -Wswitch -Wcomment -Winline \
+-    -Wuninitialized -Wparentheses -Wsign-compare -Wreturn-type \
+-    -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common
++drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB
+ 
+ if DSL_DBG_MAX_LEVEL_SET
+ drv_dsl_cpe_api_common_cflags += -DDSL_DBG_MAX_LEVEL=$(DSL_DBG_MAX_LEVEL_PRE)
+@@ -266,7 +263,7 @@ endif
+ drv_dsl_cpe_api_target_cflags = $(ADD_DRV_CFLAGS)
+ 
+ # compile cflags
+-drv_dsl_cpe_api_compile_cflags = $(EXTRA_DRV_CFLAGS)
++drv_dsl_cpe_api_compile_cflags =
+ 
+ if !KERNEL_2_6
+ # the headerfile of linux kernels 2.6.x contain to much arithmetic
+@@ -314,7 +311,7 @@ drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SO
+ 	@echo -e "# drv_dsl_cpe_api: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo -e "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo -e "$(subst .ko,,$@)-y := $(drv_dsl_cpe_api_OBJS)"	>> $(PWD)/Kbuild
+-	@echo -e "EXTRA_CFLAGS := $(CFLAGS) -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
++	@echo -e "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/lantiq/ltq-adsl/patches/100-dsl_compat.patch b/package/kernel/lantiq/ltq-adsl/patches/100-dsl_compat.patch
index f2ed230bd..431ccb6eb 100644
--- a/package/kernel/lantiq/ltq-adsl/patches/100-dsl_compat.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/100-dsl_compat.patch
@@ -1,7 +1,5 @@
-Index: drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_device_danube.h
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/include/drv_dsl_cpe_device_danube.h	2009-05-12 20:02:16.000000000 +0200
-+++ drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_device_danube.h	2012-11-29 19:47:21.060210322 +0100
+--- a/src/include/drv_dsl_cpe_device_danube.h
++++ b/src/include/drv_dsl_cpe_device_danube.h
 @@ -24,7 +24,7 @@
     #include "drv_dsl_cpe_simulator_danube.h"
  #else
@@ -11,10 +9,8 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_device_danube.h
  #endif /* defined(DSL_CPE_SIMULATOR_DRIVER) && defined(WIN32)*/
  
  #define DSL_MAX_LINE_NUMBER 1
-Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/common/drv_dsl_cpe_os_linux.c	2009-07-13 11:33:43.000000000 +0200
-+++ drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c	2012-11-29 19:46:32.700209112 +0100
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
 @@ -11,6 +11,7 @@
  #ifdef __LINUX__
  
@@ -23,7 +19,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  
  #include "drv_dsl_cpe_api.h"
  #include "drv_dsl_cpe_api_ioctl.h"
-@@ -34,9 +35,13 @@
+@@ -34,9 +35,13 @@ static const char* dsl_cpe_api_version =
  static DSL_ssize_t DSL_DRV_Write(DSL_DRV_file_t *pFile, const DSL_char_t * pBuf,
                                   DSL_DRV_size_t nSize, DSL_DRV_offset_t * pLoff);
  
@@ -38,7 +34,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  static int DSL_DRV_Open(DSL_DRV_inode_t * ino, DSL_DRV_file_t * fil);
  
  static int DSL_DRV_Release(DSL_DRV_inode_t * ino, DSL_DRV_file_t * fil);
-@@ -72,7 +77,11 @@
+@@ -72,7 +77,11 @@ static struct file_operations dslCpeApiO
     open:    DSL_DRV_Open,
     release: DSL_DRV_Release,
     write:   DSL_DRV_Write,
@@ -50,7 +46,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     poll:    DSL_DRV_Poll
  };
  #else
-@@ -168,10 +177,17 @@
+@@ -168,10 +177,17 @@ static DSL_ssize_t DSL_DRV_Write(DSL_DRV
     \return  Success or failure.
     \ingroup Internal
  */
@@ -68,7 +64,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  {
     DSL_int_t nErr=0;
     DSL_boolean_t bIsInKernel;
-@@ -216,16 +232,7 @@
+@@ -216,16 +232,7 @@ static DSL_int_t DSL_DRV_Ioctls(DSL_DRV_
           }
        }
     }
@@ -86,7 +82,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     if ( (_IOC_TYPE(nCommand) == DSL_IOC_MAGIC_CPE_API) ||
          (_IOC_TYPE(nCommand) == DSL_IOC_MAGIC_CPE_API_G997) ||
          (_IOC_TYPE(nCommand) == DSL_IOC_MAGIC_CPE_API_PM) ||
-@@ -1058,6 +1065,7 @@
+@@ -1058,6 +1065,7 @@ static void DSL_DRV_DebugInit(void)
  /* Entry point of driver */
  int __init DSL_ModuleInit(void)
  {
@@ -94,7 +90,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     DSL_int_t i;
  
     printk(DSL_DRV_CRLF DSL_DRV_CRLF "Infineon CPE API Driver version: %s" DSL_DRV_CRLF,
-@@ -1104,7 +1112,8 @@
+@@ -1104,7 +1112,8 @@ int __init DSL_ModuleInit(void)
     }
  
     DSL_DRV_DevNodeInit();
@@ -104,35 +100,44 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     return 0;
  }
  
-Index: drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_linux.h
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/include/drv_dsl_cpe_os_linux.h	2009-07-03 17:04:51.000000000 +0200
-+++ drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_linux.h	2012-11-29 19:47:23.092210377 +0100
-@@ -17,17 +17,17 @@
+--- a/src/include/drv_dsl_cpe_os_linux.h
++++ b/src/include/drv_dsl_cpe_os_linux.h
+@@ -16,18 +16,18 @@
+    extern "C" {
  #endif
  
- #include <asm/ioctl.h>
+-#include <asm/ioctl.h>
 -#include <linux/autoconf.h>
-+#include <generated/autoconf.h>
  #include <linux/module.h>
  #include <linux/kernel.h>
  #include <linux/init.h>
  #include <linux/ctype.h>
  #include <linux/version.h>
  #include <linux/spinlock.h>
--
 +#include <linux/sched.h>
  
- #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,17))
+-
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,17))
 -   #include <linux/utsrelease.h>
-+   #include <generated/utsrelease.h>
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
++#include <linux/utsrelease.h>
++#else
++#include <generated/utsrelease.h>
  #endif
  
  #include <linux/types.h>
-Index: drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h	2012-11-29 19:47:54.972211177 +0100
+@@ -39,7 +39,8 @@
+ #include <linux/delay.h>
+ #include <linux/poll.h>
+ #include <asm/uaccess.h>
+-#include <linux/smp_lock.h>
++//#include <linux/smp_lock.h>
++#include <asm/ioctl.h>
+ 
+ #ifdef INCLUDE_DSL_CPE_API_IFXOS_SUPPORT
+ /** IFXOS includes*/
+--- /dev/null
++++ b/src/ifxmips_mei_interface.h
 @@ -0,0 +1,702 @@
 +/******************************************************************************
 +
@@ -838,7 +843,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h
 +#endif //IFXMIPS_MEI_H
 --- a/configure.in
 +++ b/configure.in
-@@ -310,7 +310,7 @@
+@@ -310,7 +310,7 @@ dnl Set kernel build path
  AC_ARG_ENABLE(kernelbuild,
      AC_HELP_STRING(--enable-kernel-build=x,Set the target kernel build path),
      [
@@ -847,7 +852,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h
              AC_SUBST([KERNEL_BUILD_PATH],[$enableval])
          else
              AC_MSG_ERROR([The kernel build directory is not valid or not configured!])
-@@ -333,12 +333,12 @@
+@@ -333,12 +333,12 @@ AC_ARG_ENABLE(ifxos-include,
              echo Set the lib_ifxos include path $enableval
              AC_SUBST([IFXOS_INCLUDE_PATH],[$enableval])
          else
@@ -862,7 +867,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h
          AC_SUBST([IFXOS_INCLUDE_PATH],[$DEFAULT_IFXOS_INCLUDE_PATH])
      ]
  )
-@@ -1702,73 +1702,73 @@
+@@ -1702,73 +1702,73 @@ dnl Set the configure params for dist ch
  AC_SUBST([DISTCHECK_CONFIGURE_PARAMS],[$CONFIGURE_OPTIONS])
  
  AC_CONFIG_COMMANDS_PRE([
@@ -1005,7 +1010,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h
  AC_CONFIG_FILES([Makefile src/Makefile])
 --- a/src/Makefile.am
 +++ b/src/Makefile.am
-@@ -303,7 +303,7 @@
+@@ -300,7 +300,7 @@ if KERNEL_2_6
  drv_dsl_cpe_api_OBJS = "$(subst .c,.o,$(filter %.c,$(drv_dsl_cpe_api_SOURCES)))"
  
  drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SOURCES)
@@ -1014,52 +1019,18 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/ifxmips_mei_interface.h
  	if test ! -e common/drv_dsl_cpe_api.c ; then \
  		echo "copy source files (as links only!)"; \
  		for f in $(filter %.c,$(drv_dsl_cpe_api_SOURCES)); do \
-@@ -311,10 +311,10 @@
+@@ -308,10 +308,10 @@ drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SO
  			cp -s $(addprefix @abs_srcdir@/,$$f) $(PWD)/`dirname $$f`/ ; \
  		done \
  	fi
 -	@echo -e "# drv_dsl_cpe_api: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
 -	@echo -e "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
 -	@echo -e "$(subst .ko,,$@)-y := $(drv_dsl_cpe_api_OBJS)"	>> $(PWD)/Kbuild
--	@echo -e "EXTRA_CFLAGS := $(CFLAGS) -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
+-	@echo -e "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
 +	@echo "# drv_dsl_cpe_api: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
 +	@echo "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
 +	@echo "$(subst .ko,,$@)-y := $(drv_dsl_cpe_api_OBJS)"	>> $(PWD)/Kbuild
-+	@echo "EXTRA_CFLAGS := $(CFLAGS) -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
++	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
  	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
  
  clean-generic:
---- a/src/include/drv_dsl_cpe_os_linux.h
-+++ b/src/include/drv_dsl_cpe_os_linux.h
-@@ -16,8 +16,6 @@
-    extern "C" {
- #endif
- 
--#include <asm/ioctl.h>
--#include <generated/autoconf.h>
- #include <linux/module.h>
- #include <linux/kernel.h>
- #include <linux/init.h>
-@@ -26,8 +24,10 @@
- #include <linux/spinlock.h>
- #include <linux/sched.h>
- 
--#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,17))
--   #include <generated/utsrelease.h>
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
-+#include <linux/utsrelease.h>
-+#else
-+#include <generated/utsrelease.h>
- #endif
- 
- #include <linux/types.h>
-@@ -39,7 +39,8 @@
- #include <linux/delay.h>
- #include <linux/poll.h>
- #include <asm/uaccess.h>
--#include <linux/smp_lock.h>
-+//#include <linux/smp_lock.h>
-+#include <asm/ioctl.h>
- 
- #ifdef INCLUDE_DSL_CPE_API_IFXOS_SUPPORT
- /** IFXOS includes*/
diff --git a/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch b/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch
index 48c7581e4..20c1ccf47 100644
--- a/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch
@@ -1,7 +1,5 @@
-Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/common/drv_dsl_cpe_os_linux.c	2012-12-07 21:22:58.020256076 +0100
-+++ drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c	2012-12-07 21:31:13.156268489 +0100
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
 @@ -12,6 +12,7 @@
  
  #define DSL_INTERN
@@ -10,7 +8,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  
  #include "drv_dsl_cpe_api.h"
  #include "drv_dsl_cpe_api_ioctl.h"
-@@ -1063,7 +1064,7 @@
+@@ -1063,7 +1064,7 @@ static void DSL_DRV_DebugInit(void)
  #endif
  
  /* Entry point of driver */
@@ -19,7 +17,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  {
     struct class *dsl_class;
     DSL_int_t i;
-@@ -1117,7 +1118,7 @@
+@@ -1117,7 +1118,7 @@ int __init DSL_ModuleInit(void)
     return 0;
  }
  
@@ -28,7 +26,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  {
     printk("Module will be unloaded"DSL_DRV_CRLF);
  
-@@ -1132,7 +1133,7 @@
+@@ -1132,7 +1133,7 @@ void __exit DSL_ModuleCleanup(void)
                 (DSL_uint8_t**)&g_BndFpgaBase);
  #endif /* defined(INCLUDE_DSL_CPE_API_VINAX) && defined(INCLUDE_DSL_BONDING)*/
  
@@ -37,7 +35,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  }
  
  #ifndef _lint
-@@ -1148,8 +1149,30 @@
+@@ -1148,8 +1149,30 @@ module_param(debug_level, byte, 0);
  MODULE_PARM_DESC(debug_level, "set to get more (1) or fewer (4) debug outputs");
  #endif /* #ifndef DSL_DEBUG_DISABLE*/
  
diff --git a/package/kernel/lantiq/ltq-adsl/patches/130-linux3.8.patch b/package/kernel/lantiq/ltq-adsl/patches/130-linux3.8.patch
index bf758e0a9..3e2d8dcc2 100644
--- a/package/kernel/lantiq/ltq-adsl/patches/130-linux3.8.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/130-linux3.8.patch
@@ -1,7 +1,5 @@
-Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/common/drv_dsl_cpe_os_linux.c	2013-03-14 11:44:50.318326078 +0100
-+++ drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c	2013-03-14 11:46:08.562329425 +0100
+--- a/src/common/drv_dsl_cpe_os_linux.c
++++ b/src/common/drv_dsl_cpe_os_linux.c
 @@ -11,6 +11,7 @@
  #ifdef __LINUX__
  
@@ -10,7 +8,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  #include <linux/device.h>
  #include <linux/platform_device.h>
  
-@@ -40,7 +41,7 @@
+@@ -40,7 +41,7 @@ static DSL_ssize_t DSL_DRV_Write(DSL_DRV
  static DSL_int_t DSL_DRV_Ioctls(DSL_DRV_inode_t * pINode, DSL_DRV_file_t * pFile,
                           DSL_uint_t nCommand, unsigned long nArg);
  #else
@@ -19,7 +17,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
                           DSL_uint_t nCommand, unsigned long nArg);
  #endif
  static int DSL_DRV_Open(DSL_DRV_inode_t * ino, DSL_DRV_file_t * fil);
-@@ -184,7 +185,7 @@
+@@ -184,7 +185,7 @@ static DSL_int_t DSL_DRV_Ioctls(DSL_DRV_
     DSL_uint_t nCommand,
     unsigned long nArg)
  #else
@@ -28,7 +26,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     DSL_DRV_file_t * pFile,
     DSL_uint_t nCommand,
     unsigned long nArg)
-@@ -521,9 +522,9 @@
+@@ -521,9 +522,9 @@ DSL_void_t* DSL_IoctlMemCpyTo(
     - IFX_SUCCESS on success
     - IFX_ERROR on error
  */
@@ -40,7 +38,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     DSL_int32_t retVal          = -1;
  #ifndef _lint
  
-@@ -546,30 +547,6 @@
+@@ -546,30 +547,6 @@ DSL_DRV_STATIC DSL_int32_t DSL_DRV_Kerne
        (DSL_NULL, "ENTER - Kernel Thread Startup <%s>" DSL_DRV_CRLF,
          pThrCntrl->thrParams.pName));
  
@@ -71,7 +69,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
     /*DSL_DRV_ThreadPriorityModify(pThrCntrl->nPriority);*/
  
     pThrCntrl->thrParams.bRunning = 1;
-@@ -639,9 +616,7 @@
+@@ -639,9 +616,7 @@ DSL_int32_t DSL_DRV_ThreadInit(
           init_completion(&pThrCntrl->thrCompletion);
  
           /* start kernel thread via the wrapper function */
@@ -82,7 +80,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  
           pThrCntrl->bValid = DSL_TRUE;
  
-@@ -1064,12 +1039,12 @@
+@@ -1064,12 +1039,12 @@ static void DSL_DRV_DebugInit(void)
  #endif
  
  /* Entry point of driver */
@@ -97,7 +95,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
        &(dsl_cpe_api_version[4]));
  
     DSL_DRV_MemSet( ifxDevices, 0, sizeof(DSL_devCtx_t) * DSL_DRV_MAX_DEVICE_NUMBER );
-@@ -1118,7 +1093,7 @@
+@@ -1118,7 +1093,7 @@ static int __devinit ltq_adsl_probe(stru
     return 0;
  }
  
@@ -106,7 +104,7 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  {
     printk("Module will be unloaded"DSL_DRV_CRLF);
  
-@@ -1163,7 +1138,7 @@
+@@ -1163,7 +1138,7 @@ MODULE_DEVICE_TABLE(of, ltq_adsl_match);
  
  static struct platform_driver ltq_adsl_driver = {
  	.probe = ltq_adsl_probe,
@@ -115,11 +113,9 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c
  	.driver = {
  		.name = "adsl",
  		.owner = THIS_MODULE,
-Index: drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_lint_map.h
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/include/drv_dsl_cpe_os_lint_map.h	2009-02-24 21:44:54.000000000 +0100
-+++ drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_lint_map.h	2013-03-14 11:44:50.330326079 +0100
-@@ -247,7 +247,7 @@
+--- a/src/include/drv_dsl_cpe_os_lint_map.h
++++ b/src/include/drv_dsl_cpe_os_lint_map.h
+@@ -247,7 +247,7 @@ typedef struct
     DSL_DRV_ThreadFunction_t  pThrFct;
  
     /** Kernel thread process ID */
@@ -128,11 +124,9 @@ Index: drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_lint_map.h
  
     /** requested kernel thread priority */
     DSL_int32_t             nPriority;
-Index: drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_linux.h
-===================================================================
---- drv_dsl_cpe_api-3.24.4.4.orig/src/include/drv_dsl_cpe_os_linux.h	2013-03-14 11:44:50.298326077 +0100
-+++ drv_dsl_cpe_api-3.24.4.4/src/include/drv_dsl_cpe_os_linux.h	2013-03-14 11:44:50.330326079 +0100
-@@ -288,7 +288,7 @@
+--- a/src/include/drv_dsl_cpe_os_linux.h
++++ b/src/include/drv_dsl_cpe_os_linux.h
+@@ -288,7 +288,7 @@ typedef struct
     DSL_DRV_ThreadFunction_t  pThrFct;
  
     /** Kernel thread process ID */
diff --git a/package/kernel/lantiq/ltq-adsl/patches/140-linux_3.18.patch b/package/kernel/lantiq/ltq-adsl/patches/140-linux_3.18.patch
index 1d1e5669a..668732ff0 100644
--- a/package/kernel/lantiq/ltq-adsl/patches/140-linux_3.18.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/140-linux_3.18.patch
@@ -1,6 +1,6 @@
 --- a/src/include/drv_dsl_cpe_os_linux.h
 +++ b/src/include/drv_dsl_cpe_os_linux.h
-@@ -214,12 +214,25 @@ static inline int dsl_mutex_lock(struct 
+@@ -214,12 +214,25 @@ static inline int dsl_mutex_lock(struct
  #define DSL_DRV_MUTEX_LOCK(id)               down_interruptible(&(id))
  #define DSL_DRV_MUTEX_UNLOCK(id)             up(&(id))
  #endif
diff --git a/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_core.h b/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_core.h
index 2f754c982..398be7d82 100644
--- a/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_core.h
+++ b/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_core.h
@@ -43,6 +43,7 @@ struct ltq_atm_ops {
 	void (*fw_ver)(unsigned int *major, unsigned int *minor);
 };
 
+#include <linux/atomic.h>
 #include <lantiq_atm.h>
 
 /*
@@ -195,6 +196,7 @@ struct connection {
 	volatile struct tx_descriptor *tx_desc;
 	unsigned int tx_desc_pos;
 	struct sk_buff **tx_skb;
+	spinlock_t lock;
 
 	unsigned int aal5_vcc_crc_err; /* number of packets with CRC error */
 	unsigned int aal5_vcc_oversize_sdu; /* number of packets with oversize error */
diff --git a/package/kernel/lantiq/ltq-atm/src/ltq_atm.c b/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
index a08fa22ce..a8f787fdc 100644
--- a/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
+++ b/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
@@ -19,6 +19,8 @@
 ** HISTORY
 ** $Date        $Author         $Comment
 ** 07 JUL 2009  Xu Liang        Init Version
+**
+** Copyright 2017 Alexander Couzens <lynxis@fe80.eu>
 *******************************************************************************/
 
 #define IFX_ATM_VER_MAJOR               1
@@ -189,8 +191,6 @@ struct sk_buff* atm_alloc_tx(struct atm_vcc *, unsigned int);
 static inline void atm_free_tx_skb_vcc(struct sk_buff *, struct atm_vcc *);
 static inline struct sk_buff *get_skb_rx_pointer(unsigned int);
 static inline int get_tx_desc(unsigned int);
-static struct sk_buff* skb_duplicate(struct sk_buff *);
-static struct sk_buff* skb_break_away_from_protocol(struct sk_buff *);
 
 /*
  *  mailbox handler and signal function
@@ -444,6 +444,9 @@ static int ppe_open(struct atm_vcc *vcc)
 	/*  set htu entry   */
 	set_htu_entry(vpi, vci, conn, vcc->qos.aal == ATM_AAL5 ? 1 : 0, 0);
 
+	*MBOX_IGU1_ISRC |= (1 << (conn + FIRST_QSB_QID + 16));
+	*MBOX_IGU1_IER |= (1 << (conn + FIRST_QSB_QID + 16));
+
 	ret = 0;
 
 PPE_OPEN_EXIT:
@@ -511,14 +514,17 @@ static int ppe_send(struct atm_vcc *vcc, struct sk_buff *skb)
 	int ret;
 	int conn;
 	int desc_base;
+	int byteoff;
+	int required;
+	/* the len of the data without offset and header */
+	int datalen;
+	unsigned long flags;
 	struct tx_descriptor reg_desc = {0};
-	struct sk_buff *new_skb;
+	struct tx_inband_header *header;
 
 	if ( vcc == NULL || skb == NULL )
 		return -EINVAL;
 
-	skb_get(skb);
-	atm_free_tx_skb_vcc(skb, vcc);
 
 	conn = find_vcc(vcc);
 	if ( conn < 0 ) {
@@ -532,31 +538,28 @@ static int ppe_send(struct atm_vcc *vcc, struct sk_buff *skb)
 		goto PPE_SEND_FAIL;
 	}
 
-	if ( vcc->qos.aal == ATM_AAL5 ) {
-		int byteoff;
-		int datalen;
-		struct tx_inband_header *header;
+	byteoff = (unsigned int)skb->data & (DATA_BUFFER_ALIGNMENT - 1);
+	required = sizeof(*header) + byteoff;
+	if (!skb_clone_writable(skb, required)) {
+		int expand_by = 0;
+		int ret;
 
-		byteoff = (unsigned int)skb->data & (DATA_BUFFER_ALIGNMENT - 1);
-		if ( skb_headroom(skb) < byteoff + TX_INBAND_HEADER_LENGTH )
-			new_skb = skb_duplicate(skb);
-		else
-			new_skb = skb_break_away_from_protocol(skb);
-		if ( new_skb == NULL ) {
-			pr_err("either skb_duplicate or skb_break_away_from_protocol fail\n");
-			ret = -ENOMEM;
-			goto PPE_SEND_FAIL;
+		if (skb_headroom(skb) < required)
+			expand_by = required - skb_headroom(skb);
+
+		ret = pskb_expand_head(skb, expand_by, 0, GFP_ATOMIC);
+		if (ret) {
+			printk("pskb_expand_head failed.\n");
+			atm_free_tx_skb_vcc(skb, vcc);
+			return ret;
 		}
-		dev_kfree_skb_any(skb);
-		skb = new_skb;
+	}
 
-		datalen = skb->len;
-		byteoff = (unsigned int)skb->data & (DATA_BUFFER_ALIGNMENT - 1);
+	datalen = skb->len;
+	header = (void *)skb_push(skb, byteoff + TX_INBAND_HEADER_LENGTH);
 
-		skb_push(skb, byteoff + TX_INBAND_HEADER_LENGTH);
-
-		header = (struct tx_inband_header *)skb->data;
 
+	if ( vcc->qos.aal == ATM_AAL5 ) {
 		/*  setup inband trailer    */
 		header->uu   = 0;
 		header->cpi  = 0;
@@ -576,23 +579,9 @@ static int ppe_send(struct atm_vcc *vcc, struct sk_buff *skb)
 		reg_desc.byteoff = byteoff;
 		reg_desc.iscell  = 0;
 	} else {
-		/*  if data pointer is not aligned, allocate new sk_buff    */
-		if ( ((unsigned int)skb->data & (DATA_BUFFER_ALIGNMENT - 1)) != 0 ) {
-			pr_err("skb->data not aligned\n");
-			new_skb = skb_duplicate(skb);
-		} else
-			new_skb = skb_break_away_from_protocol(skb);
-		if ( new_skb == NULL ) {
-			pr_err("either skb_duplicate or skb_break_away_from_protocol fail\n");
-			ret = -ENOMEM;
-			goto PPE_SEND_FAIL;
-		}
-		dev_kfree_skb_any(skb);
-		skb = new_skb;
-
 		reg_desc.dataptr = (unsigned int)skb->data >> 2;
 		reg_desc.datalen = skb->len;
-		reg_desc.byteoff = 0;
+		reg_desc.byteoff = byteoff;
 		reg_desc.iscell  = 1;
 	}
 
@@ -600,23 +589,25 @@ static int ppe_send(struct atm_vcc *vcc, struct sk_buff *skb)
 	reg_desc.c = 1;
 	reg_desc.sop = reg_desc.eop = 1;
 
+	spin_lock_irqsave(&g_atm_priv_data.conn[conn].lock, flags);
 	desc_base = get_tx_desc(conn);
 	if ( desc_base < 0 ) {
+		spin_unlock_irqrestore(&g_atm_priv_data.conn[conn].lock, flags);
 		pr_debug("ALLOC_TX_CONNECTION_FAIL\n");
 		ret = -EIO;
 		goto PPE_SEND_FAIL;
 	}
-
-	if ( vcc->stats )
-		atomic_inc(&vcc->stats->tx);
-	if ( vcc->qos.aal == ATM_AAL5 )
-		g_atm_priv_data.wtx_pdu++;
-
 	/*  update descriptor send pointer  */
 	if ( g_atm_priv_data.conn[conn].tx_skb[desc_base] != NULL )
 		dev_kfree_skb_any(g_atm_priv_data.conn[conn].tx_skb[desc_base]);
 	g_atm_priv_data.conn[conn].tx_skb[desc_base] = skb;
 
+	spin_unlock_irqrestore(&g_atm_priv_data.conn[conn].lock, flags);
+
+	if ( vcc->stats )
+		atomic_inc(&vcc->stats->tx);
+	if ( vcc->qos.aal == ATM_AAL5 )
+		g_atm_priv_data.wtx_pdu++;
 	/*  write discriptor to memory and write back cache */
 	g_atm_priv_data.conn[conn].tx_desc[desc_base] = reg_desc;
 	dma_cache_wback((unsigned long)skb->data, skb->len);
@@ -821,7 +812,11 @@ struct sk_buff* atm_alloc_tx(struct atm_vcc *vcc, unsigned int size)
 		return NULL;
 	}
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,13,0))
+	refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+#else
 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+#endif
 
 	return skb;
 }
@@ -862,42 +857,40 @@ static inline int get_tx_desc(unsigned int conn)
 	return desc_base;
 }
 
-static struct sk_buff* skb_duplicate(struct sk_buff *skb)
+static void free_tx_ring(unsigned int queue)
 {
-	struct sk_buff *new_skb;
+	unsigned long flags;
+	int i;
+	struct connection *conn = &g_atm_priv_data.conn[queue];
+	struct sk_buff *skb;
 
-	new_skb = alloc_skb_tx(skb->len);
-	if ( new_skb == NULL )
-		return NULL;
+	if (!conn)
+		return;
 
-	skb_put(new_skb, skb->len);
-	memcpy(new_skb->data, skb->data, skb->len);
+	spin_lock_irqsave(&conn->lock, flags);
 
-	return new_skb;
+	for (i = 0; i < dma_tx_descriptor_length; i++) {
+		if (conn->tx_desc[i].own == 0 && conn->tx_skb[i] != NULL) {
+			skb = conn->tx_skb[i];
+			conn->tx_skb[i] = NULL;
+			atm_free_tx_skb_vcc(skb, ATM_SKB(skb)->vcc);
+		}
+	}
+	spin_unlock_irqrestore(&conn->lock, flags);
 }
 
-static struct sk_buff* skb_break_away_from_protocol(struct sk_buff *skb)
+static void mailbox_tx_handler(unsigned int queue_bitmap)
 {
-	struct sk_buff *new_skb;
+	int i;
+	int bit;
 
-	if ( skb_shared(skb) ) {
-		new_skb = skb_clone(skb, GFP_ATOMIC);
-		if ( new_skb == NULL )
-			return NULL;
-	} else
-		new_skb = skb_get(skb);
+	/* only get valid queues */
+	queue_bitmap &= g_atm_priv_data.conn_table;
 
-	skb_dst_drop(new_skb);
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-	nf_conntrack_put(new_skb->nfct);
-	new_skb->nfct = NULL;
-  #ifdef CONFIG_BRIDGE_NETFILTER
-	nf_bridge_put(new_skb->nf_bridge);
-	new_skb->nf_bridge = NULL;
-  #endif
-#endif
-
-	return new_skb;
+	for ( i = 0, bit = 1; i < MAX_PVC_NUMBER; i++, bit <<= 1 ) {
+		if (queue_bitmap & bit)
+			free_tx_ring(i);
+	}
 }
 
 static inline void mailbox_oam_rx_handler(void)
@@ -1050,12 +1043,22 @@ static inline void mailbox_aal_rx_handler(void)
 
 static void do_ppe_tasklet(unsigned long data)
 {
+	unsigned int irqs = *MBOX_IGU1_ISR;
 	*MBOX_IGU1_ISRC = *MBOX_IGU1_ISR;
-	mailbox_oam_rx_handler();
-	mailbox_aal_rx_handler();
+
+	if (irqs & (1 << RX_DMA_CH_AAL))
+		mailbox_aal_rx_handler();
+	if (irqs & (1 << RX_DMA_CH_OAM))
+		mailbox_oam_rx_handler();
+
+	/* any valid tx irqs */
+	if ((irqs >> (FIRST_QSB_QID + 16)) & g_atm_priv_data.conn_table)
+		mailbox_tx_handler(irqs >> (FIRST_QSB_QID + 16));
 
 	if ((*MBOX_IGU1_ISR & ((1 << RX_DMA_CH_AAL) | (1 << RX_DMA_CH_OAM))) != 0)
 		tasklet_schedule(&g_dma_tasklet);
+	else if (*MBOX_IGU1_ISR >> (FIRST_QSB_QID + 16)) /* TX queue */
+		tasklet_schedule(&g_dma_tasklet);
 	else
 		enable_irq(PPE_MAILBOX_IGU1_INT);
 }
@@ -1512,6 +1515,7 @@ static inline int init_priv_data(void)
 	p_tx_desc = (volatile struct tx_descriptor *)((((unsigned int)g_atm_priv_data.tx_desc_base + DESC_ALIGNMENT - 1) & ~(DESC_ALIGNMENT - 1)) | KSEG1);
 	ppskb = (struct sk_buff **)(((unsigned int)g_atm_priv_data.tx_skb_base + 3) & ~3);
 	for ( i = 0; i < MAX_PVC_NUMBER; i++ ) {
+		spin_lock_init(&g_atm_priv_data.conn[i].lock);
 		g_atm_priv_data.conn[i].tx_desc = &p_tx_desc[i * dma_tx_descriptor_length];
 		g_atm_priv_data.conn[i].tx_skb  = &ppskb[i * dma_tx_descriptor_length];
 	}
@@ -1799,7 +1803,6 @@ static int ltq_atm_probe(struct platform_device *pdev)
 	int ret;
 	int port_num;
 	struct port_cell_info port_cell = {0};
-	int i, j;
 	char ver_str[256];
 
 	match = of_match_device(ltq_atm_match, &pdev->dev);
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
index b51cf4702..6c8d065d8 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
@@ -885,12 +885,12 @@ struct crypto_alg ifxdeu_ctr_rfc3686_aes_alg = {
 };
 
 
-/*! \fn int __init ifxdeu_init_aes (void)
+/*! \fn int ifxdeu_init_aes (void)
  *  \ingroup IFX_AES_FUNCTIONS
  *  \brief function to initialize AES driver   
  *  \return ret 
 */                                 
-int __init ifxdeu_init_aes (void)
+int ifxdeu_init_aes (void)
 {
     int ret = -ENOSYS;
 
@@ -952,11 +952,11 @@ aes_err:
     return ret;
 }
 
-/*! \fn void __exit ifxdeu_fini_aes (void)
+/*! \fn void ifxdeu_fini_aes (void)
  *  \ingroup IFX_AES_FUNCTIONS
  *  \brief unregister aes driver   
 */                                 
-void __exit ifxdeu_fini_aes (void)
+void ifxdeu_fini_aes (void)
 {
     crypto_unregister_alg (&ifxdeu_aes_alg);
     crypto_unregister_alg (&ifxdeu_ecb_aes_alg);
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_arc4.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_arc4.c
index d0818dd0c..9faad9401 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_arc4.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_arc4.c
@@ -343,11 +343,11 @@ static struct crypto_alg ifxdeu_ecb_arc4_alg = {
         }
 };
 
-/*! \fn int __init ifxdeu_init_arc4(void)
+/*! \fn int ifxdeu_init_arc4(void)
     \ingroup IFX_ARC4_FUNCTIONS
     \brief initialize arc4 driver    
 */                                 
-int __init ifxdeu_init_arc4(void)
+int ifxdeu_init_arc4(void)
 {
     int ret = -ENOSYS;
 
@@ -376,11 +376,11 @@ ecb_arc4_err:
 
 }
 
-/*! \fn void __exit ifxdeu_fini_arc4(void)
+/*! \fn void ifxdeu_fini_arc4(void)
     \ingroup IFX_ARC4_FUNCTIONS
     \brief unregister arc4 driver   
 */                                 
-void __exit ifxdeu_fini_arc4(void)
+void ifxdeu_fini_arc4(void)
 {
         crypto_unregister_alg (&ifxdeu_arc4_alg);
         crypto_unregister_alg (&ifxdeu_ecb_arc4_alg);
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
index 5b73b6a28..beb67075e 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
@@ -682,11 +682,11 @@ struct crypto_alg ifxdeu_cbc_des3_ede_alg = {
         }
 };
 
-/*! \fn int __init ifxdeu_init_des (void)
+/*! \fn int ifxdeu_init_des (void)
  *  \ingroup IFX_DES_FUNCTIONS
  *  \brief initialize des driver      
 */                                 
-int __init ifxdeu_init_des (void)
+int ifxdeu_init_des (void)
 {
     int ret = -ENOSYS;
 
@@ -761,11 +761,11 @@ cbc_des3_ede_err:
 
 }
 
-/*! \fn void __exit ifxdeu_fini_des (void)
+/*! \fn void ifxdeu_fini_des (void)
  *  \ingroup IFX_DES_FUNCTIONS
  *  \brief unregister des driver    
 */                                 
-void __exit ifxdeu_fini_des (void)
+void ifxdeu_fini_des (void)
 {
         crypto_unregister_alg (&ifxdeu_des_alg);
         crypto_unregister_alg (&ifxdeu_ecb_des_alg);
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.h b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.h
index c842d64c1..8045c2081 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.h
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.h
@@ -108,23 +108,23 @@
  */
 
 
-int __init ifxdeu_init_des (void);
-int __init ifxdeu_init_aes (void);
-int __init ifxdeu_init_arc4 (void);
-int __init ifxdeu_init_sha1 (void);
-int __init ifxdeu_init_md5 (void);
-int __init ifxdeu_init_sha1_hmac (void);
-int __init ifxdeu_init_md5_hmac (void);
+int ifxdeu_init_des (void);
+int ifxdeu_init_aes (void);
+int ifxdeu_init_arc4 (void);
+int ifxdeu_init_sha1 (void);
+int ifxdeu_init_md5 (void);
+int ifxdeu_init_sha1_hmac (void);
+int ifxdeu_init_md5_hmac (void);
 int __init lqdeu_async_aes_init(void);
 int __init lqdeu_async_des_init(void);
 
-void __exit ifxdeu_fini_des (void);
-void __exit ifxdeu_fini_aes (void);
-void __exit ifxdeu_fini_arc4 (void);
-void __exit ifxdeu_fini_sha1 (void);
-void __exit ifxdeu_fini_md5 (void);
-void __exit ifxdeu_fini_sha1_hmac (void);
-void __exit ifxdeu_fini_md5_hmac (void);
+void ifxdeu_fini_des (void);
+void ifxdeu_fini_aes (void);
+void ifxdeu_fini_arc4 (void);
+void ifxdeu_fini_sha1 (void);
+void ifxdeu_fini_md5 (void);
+void ifxdeu_fini_sha1_hmac (void);
+void ifxdeu_fini_md5_hmac (void);
 void __exit ifxdeu_fini_dma(void);
 void __exit lqdeu_fini_async_aes(void);
 void __exit lqdeu_fini_async_des(void);
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_dma.h b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_dma.h
index fde7a900b..b64d74776 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_dma.h
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_dma.h
@@ -39,6 +39,7 @@
 #include <asm/byteorder.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/version.h>
 
 // must match the size of memory block allocated for g_dma_block and g_dma_block2
 #define DEU_MAX_PACKET_SIZE    (PAGE_SIZE >> 1)
@@ -53,7 +54,11 @@ typedef struct ifx_deu_device {
 	int recv_count;
 	int packet_size;
 	int packet_num;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,13,0))
+	wait_queue_entry_t wait;
+#else
 	wait_queue_t wait;
+#endif
 } _ifx_deu_device;
 
 extern _ifx_deu_device ifx_deu[1];
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c
index 47e1f4933..55cea1cce 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_md5.c
@@ -276,11 +276,11 @@ static struct shash_alg ifxdeu_md5_alg = {
     }
 };
 
-/*! \fn int __init ifxdeu_init_md5 (void)
+/*! \fn int ifxdeu_init_md5 (void)
  *  \ingroup IFX_MD5_FUNCTIONS
  *  \brief initialize md5 driver   
 */                                 
-int __init ifxdeu_init_md5 (void)
+int ifxdeu_init_md5 (void)
 {
     int ret = -ENOSYS;
 
@@ -298,12 +298,12 @@ md5_err:
     return ret;
 }
 
-/*! \fn void __exit ifxdeu_fini_md5 (void)
+/*! \fn void ifxdeu_fini_md5 (void)
   * \ingroup IFX_MD5_FUNCTIONS
   * \brief unregister md5 driver   
 */                  
                
-void __exit ifxdeu_fini_md5 (void)
+void ifxdeu_fini_md5 (void)
 {
     crypto_unregister_shash(&ifxdeu_md5_alg);
 
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_md5_hmac.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_md5_hmac.c
index ef2f6aa76..46797c972 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_md5_hmac.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_md5_hmac.c
@@ -352,11 +352,11 @@ static struct shash_alg ifxdeu_md5_hmac_alg = {
         }
 };
 
-/*! \fn int __init ifxdeu_init_md5_hmac (void)
+/*! \fn int ifxdeu_init_md5_hmac (void)
  *  \ingroup IFX_MD5_HMAC_FUNCTIONS
  *  \brief initialize md5 hmac driver   
 */                                 
-int __init ifxdeu_init_md5_hmac (void)
+int ifxdeu_init_md5_hmac (void)
 {
 
     int ret = -ENOSYS;
@@ -375,11 +375,11 @@ md5_hmac_err:
     return ret;
 }
 
-/** \fn void __exit ifxdeu_fini_md5_hmac (void)
+/** \fn void ifxdeu_fini_md5_hmac (void)
  *  \ingroup IFX_MD5_HMAC_FUNCTIONS
  *  \brief unregister md5 hmac driver   
 */                                 
-void __exit ifxdeu_fini_md5_hmac (void)
+void ifxdeu_fini_md5_hmac (void)
 {
     crypto_unregister_shash(&ifxdeu_md5_hmac_alg);
 }
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c
index 147157464..968dc6fb6 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1.c
@@ -266,11 +266,11 @@ static struct shash_alg ifxdeu_sha1_alg = {
 };
 
 
-/*! \fn int __init ifxdeu_init_sha1 (void)
+/*! \fn int ifxdeu_init_sha1 (void)
  *  \ingroup IFX_SHA1_FUNCTIONS
  *  \brief initialize sha1 driver    
 */                                 
-int __init ifxdeu_init_sha1 (void)
+int ifxdeu_init_sha1 (void)
 {
     int ret = -ENOSYS;
 
@@ -288,11 +288,11 @@ sha1_err:
     return ret;
 }
 
-/*! \fn void __exit ifxdeu_fini_sha1 (void)
+/*! \fn void ifxdeu_fini_sha1 (void)
  *  \ingroup IFX_SHA1_FUNCTIONS
  *  \brief unregister sha1 driver   
 */                                 
-void __exit ifxdeu_fini_sha1 (void)
+void ifxdeu_fini_sha1 (void)
 {
     crypto_unregister_shash(&ifxdeu_sha1_alg);
 
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c
index 7287a82f5..791b96675 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_sha1_hmac.c
@@ -342,11 +342,11 @@ static struct shash_alg ifxdeu_sha1_hmac_alg = {
 };
 
 
-/*! \fn int __init ifxdeu_init_sha1_hmac (void)
+/*! \fn int ifxdeu_init_sha1_hmac (void)
  *  \ingroup IFX_SHA1_HMAC_FUNCTIONS
  *  \brief initialize sha1 hmac driver    
 */                                 
-int __init ifxdeu_init_sha1_hmac (void)
+int ifxdeu_init_sha1_hmac (void)
 {
     int ret = -ENOSYS;
 
@@ -365,11 +365,11 @@ sha1_err:
     return ret;
 }
 
-/*! \fn void __exit ifxdeu_fini_sha1_hmac (void)
+/*! \fn void ifxdeu_fini_sha1_hmac (void)
  *  \ingroup IFX_SHA1_HMAC_FUNCTIONS
  *  \brief unregister sha1 hmac driver    
 */                                 
-void __exit ifxdeu_fini_sha1_hmac (void)
+void ifxdeu_fini_sha1_hmac (void)
 {
 
     crypto_unregister_shash(&ifxdeu_sha1_hmac_alg);
diff --git a/package/kernel/lantiq/ltq-ifxos/Makefile b/package/kernel/lantiq/ltq-ifxos/Makefile
index a0891be3e..4771fda20 100644
--- a/package/kernel/lantiq/ltq-ifxos/Makefile
+++ b/package/kernel/lantiq/ltq-ifxos/Makefile
@@ -8,7 +8,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=lib_ifxos
 PKG_VERSION:=1.5.19
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_SOURCE_URL:=https://github.com/xdarklight/$(PKG_NAME)/archive/v$(PKG_VERSION)
@@ -17,8 +17,7 @@ PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=GPL-2.0 BSD-2-Clause
 PKG_LICENSE_FILES:=LICENSE
 
-
-PKG_USE_MIPS16:=0
+PKG_ASLR_PIE:=0
 PKG_FIXUP:=autoreconf
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch b/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch
new file mode 100644
index 000000000..38722290d
--- /dev/null
+++ b/package/kernel/lantiq/ltq-ifxos/patches/002-fix-compile.patch
@@ -0,0 +1,22 @@
+--- a/src/linux/ifxos_linux_copy_user_space_drv.c
++++ b/src/linux/ifxos_linux_copy_user_space_drv.c
+@@ -29,7 +29,7 @@
+ #ifdef MODULE
+    #include <linux/module.h>
+ #endif
+-#include <asm/uaccess.h>
++#include <linux/uaccess.h>
+ 
+ #include "ifx_types.h"
+ #include "ifxos_rt_if_check.h"
+--- a/src/linux/ifxos_linux_socket_drv.c
++++ b/src/linux/ifxos_linux_socket_drv.c
+@@ -25,7 +25,7 @@
+ #endif
+ #include <linux/in.h>
+ #include <linux/net.h>
+-#include <asm/uaccess.h>
++#include <linux/uaccess.h>
+ 
+ #include "ifx_types.h"
+ #include "ifxos_rt_if_check.h"
diff --git a/package/kernel/lantiq/ltq-ifxos/patches/020-no-O3.patch b/package/kernel/lantiq/ltq-ifxos/patches/020-no-O3.patch
new file mode 100644
index 000000000..d2e816f5c
--- /dev/null
+++ b/package/kernel/lantiq/ltq-ifxos/patches/020-no-O3.patch
@@ -0,0 +1,19 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -45,8 +45,6 @@ endif !HAVE_GCC
+ 
+ if ENABLE_DEBUG
+ used_gcc_cflags += -O1 -g
+-else
+-used_gcc_cflags += -O3
+ endif
+ 
+ AM_CFLAGS = \
+@@ -92,7 +90,6 @@ endif
+ drvifxos_additional_cflags=\
+ 	-DLINUX \
+ 	-D__LINUX__ \
+-	-O \
+ 	-D__KERNEL__ \
+ 	-DMODULE \
+ 	-DEXPORT_SYMTAB
diff --git a/package/kernel/lantiq/ltq-ifxos/patches/200-Fix-app-compilation-failure-from-inclusion-of-wrong-.patch b/package/kernel/lantiq/ltq-ifxos/patches/200-Fix-app-compilation-failure-from-inclusion-of-wrong-.patch
index dee3482e4..5d661db86 100644
--- a/package/kernel/lantiq/ltq-ifxos/patches/200-Fix-app-compilation-failure-from-inclusion-of-wrong-.patch
+++ b/package/kernel/lantiq/ltq-ifxos/patches/200-Fix-app-compilation-failure-from-inclusion-of-wrong-.patch
@@ -37,8 +37,6 @@ Ref: https://bugs.lede-project.org/index.php?do=details&task_id=1196
  src/Makefile.am | 6 +-----
  1 file changed, 1 insertion(+), 5 deletions(-)
 
-diff --git a/src/Makefile.am b/src/Makefile.am
-index f95668f..d232e7f 100644
 --- a/src/Makefile.am
 +++ b/src/Makefile.am
 @@ -14,11 +14,7 @@ lib_LIBRARIES = libifxos.a
@@ -54,6 +52,3 @@ index f95668f..d232e7f 100644
  
  if HAVE_GCC
  
--- 
-1.8.3.1
-
diff --git a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
index f764eba1f..43e171a2b 100644
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
@@ -128,7 +128,9 @@ static int ptm_stop(struct net_device *);
   static unsigned int ptm_poll(int, unsigned int);
   static int ptm_napi_poll(struct napi_struct *, int);
 static int ptm_hard_start_xmit(struct sk_buff *, struct net_device *);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0))
 static int ptm_change_mtu(struct net_device *, int);
+#endif
 static int ptm_ioctl(struct net_device *, struct ifreq *, int);
 static void ptm_tx_timeout(struct net_device *);
 
@@ -247,7 +249,9 @@ static struct net_device_ops g_ptm_netdev_ops = {
     .ndo_start_xmit      = ptm_hard_start_xmit,
     .ndo_validate_addr   = eth_validate_addr,
     .ndo_set_mac_address = eth_mac_addr,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0))
     .ndo_change_mtu      = ptm_change_mtu,
+#endif
     .ndo_do_ioctl        = ptm_ioctl,
     .ndo_tx_timeout      = ptm_tx_timeout,
 };
@@ -285,6 +289,10 @@ static void ptm_setup(struct net_device *dev, int ndev)
 
     /*  hook network operations */
     dev->netdev_ops      = &g_ptm_netdev_ops;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0))
+    /* Allow up to 1508 bytes, for RFC4638 */
+    dev->max_mtu         = ETH_DATA_LEN + 8;
+#endif
     netif_napi_add(dev, &g_ptm_priv_data.itf[ndev].napi, ptm_napi_poll, 25);
     dev->watchdog_timeo  = ETH_WATCHDOG_TIMEOUT;
 
@@ -459,7 +467,7 @@ PTM_HARD_START_XMIT_FAIL:
     g_ptm_priv_data.itf[ndev].stats.tx_dropped++;
     return NETDEV_TX_OK;
 }
-
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0))
 static int ptm_change_mtu(struct net_device *dev, int mtu)
 {
 	/* Allow up to 1508 bytes, for RFC4638 */
@@ -468,6 +476,7 @@ static int ptm_change_mtu(struct net_device *dev, int mtu)
         dev->mtu = mtu;
         return 0;
 }
+#endif
 
 static int ptm_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
@@ -654,7 +663,9 @@ static INLINE int mailbox_rx_irq_handler(unsigned int ch)   //  return: < 0 - de
             skb->dev = g_net_dev[ndev];
             skb->protocol = eth_type_trans(skb, skb->dev);
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,11,0))
             g_net_dev[ndev]->last_rx = jiffies;
+#endif
 
             netif_rx_ret = netif_receive_skb(skb);
 
diff --git a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
index 4e10d72fe..9cfeefd80 100644
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
@@ -74,7 +74,9 @@ static int ptm_stop(struct net_device *);
   static unsigned int ptm_poll(int, unsigned int);
   static int ptm_napi_poll(struct napi_struct *, int);
 static int ptm_hard_start_xmit(struct sk_buff *, struct net_device *);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0))
 static int ptm_change_mtu(struct net_device *, int);
+#endif
 static int ptm_ioctl(struct net_device *, struct ifreq *, int);
 static void ptm_tx_timeout(struct net_device *);
 
@@ -115,7 +117,9 @@ static struct net_device_ops g_ptm_netdev_ops = {
     .ndo_start_xmit      = ptm_hard_start_xmit,
     .ndo_validate_addr   = eth_validate_addr,
     .ndo_set_mac_address = eth_mac_addr,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0))
     .ndo_change_mtu      = ptm_change_mtu,
+#endif
     .ndo_do_ioctl        = ptm_ioctl,
     .ndo_tx_timeout      = ptm_tx_timeout,
 };
@@ -141,6 +145,10 @@ static void ptm_setup(struct net_device *dev, int ndev)
     netif_carrier_off(dev);
 
     dev->netdev_ops      = &g_ptm_netdev_ops;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0))
+    /* Allow up to 1508 bytes, for RFC4638 */
+    dev->max_mtu         = ETH_DATA_LEN + 8;
+#endif
     netif_napi_add(dev, &g_ptm_priv_data.itf[ndev].napi, ptm_napi_poll, 16);
     dev->watchdog_timeo  = ETH_WATCHDOG_TIMEOUT;
 
@@ -218,7 +226,9 @@ static unsigned int ptm_poll(int ndev, unsigned int work_to_do)
             skb->dev = g_net_dev[0];
             skb->protocol = eth_type_trans(skb, skb->dev);
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,11,0))
             g_net_dev[0]->last_rx = jiffies;
+#endif
 
             netif_receive_skb(skb);
 
@@ -367,6 +377,7 @@ PTM_HARD_START_XMIT_FAIL:
     return 0;
 }
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,10,0))
 static int ptm_change_mtu(struct net_device *dev, int mtu)
 {
 	/* Allow up to 1508 bytes, for RFC4638 */
@@ -375,6 +386,7 @@ static int ptm_change_mtu(struct net_device *dev, int mtu)
         dev->mtu = mtu;
         return 0;
 }
+#endif
 
 static int ptm_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
diff --git a/package/kernel/lantiq/ltq-tapi/Makefile b/package/kernel/lantiq/ltq-tapi/Makefile
index be7fd2aa0..171103350 100644
--- a/package/kernel/lantiq/ltq-tapi/Makefile
+++ b/package/kernel/lantiq/ltq-tapi/Makefile
@@ -10,14 +10,14 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=drv_tapi
 PKG_VERSION:=3.13.0
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE:=drv_tapi-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 PKG_HASH:=109374d52872716570fca3fef3b93c9a93159a804dfd42484b19152b825af5c0
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
-PKG_USE_MIPS16:=0
+PKG_ASLR_PIE:=0
 PKG_CHECK_FORMAT_SECURITY:=0
 PKG_FIXUP:=autoreconf
 
diff --git a/package/kernel/lantiq/ltq-tapi/patches/010-fix-compile.patch b/package/kernel/lantiq/ltq-tapi/patches/010-fix-compile.patch
new file mode 100644
index 000000000..051e25d3a
--- /dev/null
+++ b/package/kernel/lantiq/ltq-tapi/patches/010-fix-compile.patch
@@ -0,0 +1,22 @@
+--- a/src/drv_tapi_linux.c
++++ b/src/drv_tapi_linux.c
+@@ -54,6 +54,10 @@
+    #include <linux/workqueue.h>        /* LINUX 2.6 We need work_struct */
+    #include <linux/device.h>
+    #include <linux/sched.h>
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0))
++   #include <linux/sched/signal.h>
++   #include <linux/sched/types.h>
++#endif
+    #undef   CONFIG_DEVFS_FS
+    #ifndef UTS_RELEASE
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
+@@ -184,7 +188,7 @@ MODULE_PARM_DESC(block_egress_tasklet, "
+ MODULE_PARM_DESC(block_ingress_tasklet, "block the execution of the ingress tasklet, i.e. force to use the RT kernel thread");
+ 
+ /** The driver callbacks which will be registered with the kernel*/
+-static struct file_operations tapi_fops = {0};
++static struct file_operations tapi_fops;
+ 
+ /* ============================= */
+ /* Global function definition    */
diff --git a/package/kernel/lantiq/ltq-tapi/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-tapi/patches/020-not-leak-cflags.patch
new file mode 100644
index 000000000..e1aac21f9
--- /dev/null
+++ b/package/kernel/lantiq/ltq-tapi/patches/020-not-leak-cflags.patch
@@ -0,0 +1,27 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -122,13 +122,9 @@ endif
+ 
+ ## flags for the driver
+ if USE_MODULE
+-drv_tapi_CFLAGS = -DLINUX -D__KERNEL__ -DMODULE -Wno-format -DEXPORT_SYMTAB $(AM_CFLAGS)
++drv_tapi_CFLAGS = -DLINUX -D__KERNEL__ -DMODULE -DEXPORT_SYMTAB $(AM_CFLAGS)
+ else
+-drv_tapi_CFLAGS = -DLINUX -D__KERNEL__ -Wno-format -DEXPORT_SYMTAB $(AM_CFLAGS)
+-endif
+-
+-if KERNEL_2_6
+-drv_tapi_CFLAGS += -fno-common
++drv_tapi_CFLAGS = -DLINUX -D__KERNEL__ -DEXPORT_SYMTAB $(AM_CFLAGS)
+ endif
+ 
+ 
+@@ -165,7 +161,7 @@ drv_tapi.ko: $(drv_tapi_SOURCES) $(EXTRA
+ 	@echo "# drv_tapi: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo "$(subst .ko,,$@)-y := $(drv_tapi_OBJS)"	>> $(PWD)/Kbuild
+-	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H  $(CFLAGS) $(drv_tapi_CFLAGS) $(INCLUDES)"	>> $(PWD)/Kbuild
++	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H  $(drv_tapi_CFLAGS) $(INCLUDES)"	>> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/lantiq/ltq-tapi/patches/100-ifxmips.patch b/package/kernel/lantiq/ltq-tapi/patches/100-ifxmips.patch
index a9c0d8116..f56587d06 100644
--- a/package/kernel/lantiq/ltq-tapi/patches/100-ifxmips.patch
+++ b/package/kernel/lantiq/ltq-tapi/patches/100-ifxmips.patch
@@ -1,6 +1,6 @@
 --- a/src/drv_tapi_linux.c
 +++ b/src/drv_tapi_linux.c
-@@ -552,7 +552,7 @@ static ssize_t ifx_tapi_write (struct fi
+@@ -556,7 +556,7 @@ static ssize_t ifx_tapi_write (struct fi
     IFX_uint8_t         *pData;
     IFX_size_t           buf_size;
  #endif /* TAPI_PACKET */
diff --git a/package/kernel/lantiq/ltq-tapi/patches/200-linux-37.patch b/package/kernel/lantiq/ltq-tapi/patches/200-linux-37.patch
index 9d7428df0..fd6133eec 100644
--- a/package/kernel/lantiq/ltq-tapi/patches/200-linux-37.patch
+++ b/package/kernel/lantiq/ltq-tapi/patches/200-linux-37.patch
@@ -10,7 +10,7 @@
  #include <asm/io.h>
  
  #ifdef LINUX_2_6
-@@ -65,7 +67,9 @@
+@@ -69,7 +71,9 @@
  #else
     #include <linux/tqueue.h>
     #include <linux/sched.h>
@@ -20,7 +20,7 @@
  #endif /* LINUX_2_6 */
  
  #include "drv_tapi.h"
-@@ -133,8 +137,13 @@
+@@ -137,8 +141,13 @@ static ssize_t ifx_tapi_write(struct fil
                                size_t count, loff_t * ppos);
  static ssize_t ifx_tapi_read(struct file * filp, char *buf,
                                size_t length, loff_t * ppos);
@@ -34,7 +34,7 @@
  static unsigned int ifx_tapi_poll (struct file *filp, poll_table *table);
  
  #ifdef CONFIG_PROC_FS
-@@ -218,7 +227,11 @@
+@@ -222,7 +231,11 @@ IFX_return_t TAPI_OS_RegisterLLDrv (IFX_
     IFX_char_t   *pRegDrvName = IFX_NULL;
     IFX_int32_t ret = 0;
  
@@ -46,7 +46,7 @@
     {
  #ifdef MODULE
        tapi_fops.owner =    THIS_MODULE;
-@@ -226,7 +239,11 @@
+@@ -230,7 +243,11 @@ IFX_return_t TAPI_OS_RegisterLLDrv (IFX_
        tapi_fops.read =     ifx_tapi_read;
        tapi_fops.write =    ifx_tapi_write;
        tapi_fops.poll =     ifx_tapi_poll;
@@ -58,7 +58,7 @@
        tapi_fops.open =     ifx_tapi_open;
        tapi_fops.release =  ifx_tapi_release;
     }
-@@ -881,8 +898,13 @@
+@@ -885,8 +902,13 @@ static IFX_uint32_t ifx_tapi_poll (struc
     - 0 and positive values - success
     - negative value - ioctl failed
  */
@@ -72,7 +72,7 @@
  {
     TAPI_FD_PRIV_DATA_t *pTapiPriv;
     IFX_TAPI_ioctlCtx_t  ctx;
-@@ -3721,7 +3743,9 @@
+@@ -3725,7 +3747,9 @@ IFX_void_t TAPI_OS_ThreadKill(IFXOS_Thre
              kernel lock (lock_kernel()). The lock must be
              grabbed before changing the terminate
              flag and released after the down() call. */
@@ -83,7 +83,7 @@
           mb();
  #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
           kill_proc(pThrCntrl->tid, SIGKILL, 1);
-@@ -3729,8 +3753,10 @@
+@@ -3733,8 +3757,10 @@ IFX_void_t TAPI_OS_ThreadKill(IFXOS_Thre
           kill_pid(find_vpid(pThrCntrl->tid), SIGKILL, 1);
  #endif
           /* release the big kernel lock */
diff --git a/package/kernel/lantiq/ltq-tapi/patches/300-linux-310.patch b/package/kernel/lantiq/ltq-tapi/patches/300-linux-310.patch
index ac72515ee..2da1719a1 100644
--- a/package/kernel/lantiq/ltq-tapi/patches/300-linux-310.patch
+++ b/package/kernel/lantiq/ltq-tapi/patches/300-linux-310.patch
@@ -1,8 +1,6 @@
-Index: drv_tapi-3.13.0/src/drv_tapi_linux.c
-===================================================================
---- drv_tapi-3.13.0.orig/src/drv_tapi_linux.c	2013-09-05 22:28:16.868419283 +0200
-+++ drv_tapi-3.13.0/src/drv_tapi_linux.c	2013-09-05 22:32:37.396425814 +0200
-@@ -93,6 +93,8 @@
+--- a/src/drv_tapi_linux.c
++++ b/src/drv_tapi_linux.c
+@@ -97,6 +97,8 @@
  #include "drv_tapi_announcements.h"
  #endif /* TAPI_ANNOUNCEMENTS */
  
diff --git a/package/kernel/lantiq/ltq-vdsl-mei/Makefile b/package/kernel/lantiq/ltq-vdsl-mei/Makefile
index 96bbc98c7..9597de007 100644
--- a/package/kernel/lantiq/ltq-vdsl-mei/Makefile
+++ b/package/kernel/lantiq/ltq-vdsl-mei/Makefile
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-vdsl-vr9-mei
 PKG_VERSION:=1.5.17.6
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_BASE_NAME:=drv_mei_cpe
 PKG_SOURCE:=$(PKG_BASE_NAME)-$(PKG_VERSION).tar.gz
@@ -19,10 +19,10 @@ PKG_HASH:=94f6904364348b7f74087e721968abc28b2564fb9bd8899aa930d36490387662
 PKG_FIXUP:=autoreconf
 PKG_FLAGS:=nonshared
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
-PKG_USE_MIPS16:=0
 PKG_LICENSE:=GPL-2.0 BSD-2-Clause
 PKG_LICENSE_FILES:=LICENSE
 
+PKG_ASLR_PIE:=0
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -65,7 +65,7 @@ CONFIGURE_ARGS += \
 	--enable-error_print \
 	--enable-ifxos-include="-I$(STAGING_DIR)/usr/include/ifxos/" \
 	--enable-ifxos-library="-L$(STAGING_DIR)/usr/lib" \
-	--enable-add_drv_cflags="-DMEI_DRV_ATM_PTM_INTERFACE_ENABLE=1 -fno-pic -mlong-calls -O2 -g0" \
+	--enable-add_drv_cflags="-DMEI_DRV_ATM_PTM_INTERFACE_ENABLE=1" \
 	--enable-linux-26 \
 	--enable-kernelbuild="$(LINUX_DIR)" \
 	--enable-drv_test_appl=yes \
diff --git a/package/kernel/lantiq/ltq-vdsl-mei/patches/001-fix-compile.patch b/package/kernel/lantiq/ltq-vdsl-mei/patches/001-fix-compile.patch
new file mode 100644
index 000000000..6d3e182ec
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-mei/patches/001-fix-compile.patch
@@ -0,0 +1,44 @@
+--- a/src/drv_mei_cpe_linux.h
++++ b/src/drv_mei_cpe_linux.h
+@@ -31,6 +31,9 @@
+ #include <linux/module.h>
+ 
+ #include <linux/sched.h>
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0))
++#include <linux/sched/signal.h>
++#endif
+ #include <linux/interrupt.h>
+ #include <linux/version.h>
+ #include <linux/crc32.h>
+@@ -121,7 +124,11 @@ typedef int (*MEI_RequestIrq_WrapLinux_t
+ /**
+    Function typedef for the Linux free_irq()
+ */
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,12,0))
++typedef const void *(*MEI_FreeIrq_WrapLinux_t)( unsigned int usedIrq,
++#else
+ typedef void (*MEI_FreeIrq_WrapLinux_t)( unsigned int usedIrq,
++#endif
+                                            void *usedDevId );
+ 
+ 
+--- a/src/drv_mei_cpe_linux.c
++++ b/src/drv_mei_cpe_linux.c
+@@ -129,7 +129,7 @@ static int MEI_module_init(void);
+ #endif
+ 
+ #if (MEI_DRV_LKM_ENABLE == 1) && (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+-static void __exit MEI_module_exit(void);
++static void MEI_module_exit(void);
+ #else
+ static void MEI_module_exit(void);
+ #endif
+@@ -2188,7 +2188,7 @@ static int MEI_module_init (void)
+    Called by the kernel.
+ */
+ #if (MEI_DRV_LKM_ENABLE == 1) && (MEI_SUPPORT_DEVICE_VR10_320 != 1)
+-static void __exit MEI_module_exit (void)
++static void MEI_module_exit (void)
+ #else
+ static void MEI_module_exit (void)
+ #endif
diff --git a/package/kernel/lantiq/ltq-vdsl-mei/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vdsl-mei/patches/020-not-leak-cflags.patch
new file mode 100644
index 000000000..31dbba37b
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-mei/patches/020-not-leak-cflags.patch
@@ -0,0 +1,21 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -213,8 +213,7 @@ drv_mei_cpe_common_cflags = $(AM_CFLAGS)
+ else
+ 
+ drv_mei_cpe_common_cflags = \
+-	$(AM_CFLAGS) -D__KERNEL__ -DLINUX -D__linux__ -DMODULE -DEXPORT_SYMTAB \
+-	-pipe -Wimplicit -Wunused -Wuninitialized -Wsign-compare -Wstrict-aliasing
++	-D__KERNEL__ -DLINUX -D__linux__ -DMODULE -DEXPORT_SYMTAB
+ 
+ endif
+ 
+@@ -354,7 +353,7 @@ drv_mei_cpe.ko: $(drv_mei_cpe_SOURCES)
+ 	@echo -e "# drv_mei_cpe: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo -e "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo -e "$(subst .ko,,$@)-y := $(drv_mei_cpe_OBJS)"	>> $(PWD)/Kbuild
+-	@echo -e "EXTRA_CFLAGS := $(CFLAGS) $(drv_mei_cpe_CFLAGS) -I@abs_srcdir@ -I@abs_srcdir@/auto_header $(IFXOS_INCLUDE_PATH)" >> $(PWD)/Kbuild
++	@echo -e "EXTRA_CFLAGS := $(drv_mei_cpe_CFLAGS) -I@abs_srcdir@ -I@abs_srcdir@/auto_header $(IFXOS_INCLUDE_PATH)" >> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/lantiq/ltq-vdsl-mei/patches/100-compat.patch b/package/kernel/lantiq/ltq-vdsl-mei/patches/100-compat.patch
index 10122fe73..e9584098e 100644
--- a/package/kernel/lantiq/ltq-vdsl-mei/patches/100-compat.patch
+++ b/package/kernel/lantiq/ltq-vdsl-mei/patches/100-compat.patch
@@ -10,7 +10,7 @@
  
 --- a/src/drv_mei_cpe_linux.h
 +++ b/src/drv_mei_cpe_linux.h
-@@ -57,12 +57,6 @@
+@@ -60,12 +60,6 @@
  #include <linux/poll.h>
  #include <linux/types.h>
  
diff --git a/package/kernel/lantiq/ltq-vdsl/Makefile b/package/kernel/lantiq/ltq-vdsl/Makefile
index 3b085ed8a..cf3711beb 100644
--- a/package/kernel/lantiq/ltq-vdsl/Makefile
+++ b/package/kernel/lantiq/ltq-vdsl/Makefile
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-vdsl-vr9
 PKG_VERSION:=4.17.18.6
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_BASE_NAME:=drv_dsl_cpe_api
 PKG_SOURCE:=$(PKG_BASE_NAME)_vrx-$(PKG_VERSION).tar.gz
@@ -19,8 +19,8 @@ PKG_HASH:=b4966a60653acc49254b168c6cc9c49eb36c54548e763617788aa4f252a29f21
 PKG_LICENSE:=GPL-2.0 BSD-2-Clause
 PKG_LICENSE_FILES:=LICENSE
 
-
-PKG_USE_MIPS16:=0
+PKG_ASLR_PIE:=0
+PKG_FIXUP:=autoreconf
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
@@ -42,8 +42,6 @@ define Package/ltq-vdsl-vr9/description
 		- VRX200 Family
 endef
 
-EXTRA_CFLAGS = -fno-pic -mno-abicalls -mlong-calls -G 0
-
 MAKE_FLAGS += \
 	SHELL="$(BASH)"
 
diff --git a/package/kernel/lantiq/ltq-vdsl/patches/001-fix-compile.patch b/package/kernel/lantiq/ltq-vdsl/patches/001-fix-compile.patch
new file mode 100644
index 000000000..1355a1a79
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl/patches/001-fix-compile.patch
@@ -0,0 +1,12 @@
+--- a/src/include/drv_dsl_cpe_os_linux.h
++++ b/src/include/drv_dsl_cpe_os_linux.h
+@@ -33,6 +33,9 @@
+ #endif
+ 
+ #include <linux/sched.h>
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0))
++#include <linux/sched/signal.h>
++#endif
+ 
+ #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
+    #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,17))
diff --git a/package/kernel/lantiq/ltq-vdsl/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vdsl/patches/020-not-leak-cflags.patch
new file mode 100644
index 000000000..96e69acca
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl/patches/020-not-leak-cflags.patch
@@ -0,0 +1,32 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -244,10 +244,7 @@ else
+ drv_dsl_cpe_api_common_mod_cflags =
+ endif
+ 
+-drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB \
+-    -pipe -Wall -Wformat -Wimplicit -Wunused -Wswitch -Wcomment -Winline \
+-    -Wuninitialized -Wparentheses -Wsign-compare -Wreturn-type \
+-    -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common
++drv_dsl_cpe_api_common_cflags = -DLINUX -D__LINUX__ -D__KERNEL__ -DEXPORT_SYMTAB
+ 
+ if DSL_DBG_MAX_LEVEL_SET
+ drv_dsl_cpe_api_common_cflags += -DDSL_DBG_MAX_LEVEL=$(DSL_DBG_MAX_LEVEL_PRE)
+@@ -257,7 +254,7 @@ endif
+ drv_dsl_cpe_api_target_cflags = $(ADD_DRV_CFLAGS)
+ 
+ # compile cflags
+-drv_dsl_cpe_api_compile_cflags = $(EXTRA_DRV_CFLAGS)
++drv_dsl_cpe_api_compile_cflags =
+ 
+ if !KERNEL_2_6
+ # the headerfile of linux kernels 2.6.x contain to much arithmetic
+@@ -311,7 +308,7 @@ drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SO
+ 	@echo -e "# drv_dsl_cpe_api: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo -e "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo -e "$(subst .ko,,$@)-y := $(drv_dsl_cpe_api_OBJS)"	>> $(PWD)/Kbuild
+-	@echo -e "EXTRA_CFLAGS := $(CFLAGS) -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
++	@echo -e "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/lantiq/ltq-vmmc/Makefile b/package/kernel/lantiq/ltq-vmmc/Makefile
index e42d5c071..e44b509b2 100644
--- a/package/kernel/lantiq/ltq-vmmc/Makefile
+++ b/package/kernel/lantiq/ltq-vmmc/Makefile
@@ -10,14 +10,14 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=drv_vmmc
 PKG_VERSION:=1.9.0
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_HASH:=707f515eb727c032418c4da67d7e86884bb56cdc2a606e8f6ded6057d8767e57
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
-PKG_USE_MIPS16:=0
+PKG_ASLR_PIE:=0
 PKG_CHECK_FORMAT_SECURITY:=0
 PKG_FIXUP:=autoreconf
 
diff --git a/package/kernel/lantiq/ltq-vmmc/patches/020-not-leak-cflags.patch b/package/kernel/lantiq/ltq-vmmc/patches/020-not-leak-cflags.patch
new file mode 100644
index 000000000..1a79daae2
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vmmc/patches/020-not-leak-cflags.patch
@@ -0,0 +1,19 @@
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -224,7 +224,6 @@ install-exec-hook: $(bin_PROGRAMS)
+ 
+ # Extra rule for linux-2.6 kernel object
+ if KERNEL_2_6
+-drv_vmmc_CFLAGS += -fno-common
+ drv_vmmc_OBJS = "$(subst .c,.o, $(drv_vmmc_SOURCES) $(nodist_drv_vmmc_SOURCES))"
+ 
+ drv_vmmc.ko: $(drv_vmmc_SOURCES) $(EXTRA_DIST)
+@@ -239,7 +238,7 @@ drv_vmmc.ko: $(drv_vmmc_SOURCES) $(EXTRA
+ 	@echo "# drv_vmmc: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo "$(subst .ko,,$@)-y := $(drv_vmmc_OBJS)"	>> $(PWD)/Kbuild
+-	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H  $(CFLAGS) $(drv_vmmc_CFLAGS) $(INCLUDES)"	>> $(PWD)/Kbuild
++	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_vmmc_CFLAGS) $(INCLUDES)"	>> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
diff --git a/package/kernel/leds-apu2/src/leds-apu2.c b/package/kernel/leds-apu2/src/leds-apu2.c
index 4ea552cf5..2fefa857c 100644
--- a/package/kernel/leds-apu2/src/leds-apu2.c
+++ b/package/kernel/leds-apu2/src/leds-apu2.c
@@ -335,7 +335,10 @@ static int __init gpio_apu2_init (void)
 	if (!board_name \
 			|| !board_vendor \
 			|| strcasecmp(board_vendor, "PC Engines") \
-			|| (strcasecmp(board_name, "apu2") && strcasecmp(board_name, "apu3"))) {
+			|| (strcasecmp(board_name, "apu2") \
+				&& strcasecmp(board_name, "apu3") \
+				&& strcasecmp(board_name, "PC Engines apu2") \
+				&& strcasecmp(board_name, "PC Engines apu3"))) {
 		err = -ENODEV;
 		goto exit;
 	}
diff --git a/package/kernel/linux/modules/can.mk b/package/kernel/linux/modules/can.mk
index 5529fe02e..925de4d8a 100644
--- a/package/kernel/linux/modules/can.mk
+++ b/package/kernel/linux/modules/can.mk
@@ -47,22 +47,6 @@ define AddDepends/can
 endef
 
 
-define KernelPackage/can-raw
-  TITLE:=Raw CAN Protcol
-  KCONFIG:=CONFIG_CAN_RAW
-  FILES:=$(LINUX_DIR)/net/can/can-raw.ko
-  AUTOLOAD:=$(call AutoProbe,can-raw)
-  $(call AddDepends/can)
-endef
-
-define KernelPackage/can-raw/description
- The raw CAN protocol option offers access to the CAN bus via
- the BSD  socket API.
-endef
-
-$(eval $(call KernelPackage,can-raw))
-
-
 define KernelPackage/can-bcm
   TITLE:=Broadcast Manager CAN Protcol
   KCONFIG:=CONFIG_CAN_BCM
@@ -80,6 +64,74 @@ endef
 $(eval $(call KernelPackage,can-bcm))
 
 
+define KernelPackage/can-c-can
+  TITLE:=BOSCH C_CAN/D_CAN drivers
+  KCONFIG:=CONFIG_CAN_C_CAN
+  FILES:=$(LINUX_DIR)/drivers/net/can/c_can/c_can.ko
+  AUTOLOAD:=$(call AutoProbe,c_can)
+  $(call AddDepends/can)
+endef
+
+define KernelPackage/can-c-can/description
+ This driver adds generic support for the C_CAN/D_CAN chips.
+endef
+
+$(eval $(call KernelPackage,can-c-can))
+
+
+define KernelPackage/can-c-can-pci
+  TITLE:=PCI Bus based BOSCH C_CAN/D_CAN driver
+  KCONFIG:=CONFIG_CAN_C_CAN_PCI
+  DEPENDS:=kmod-can-c-can @PCI_SUPPORT
+  FILES:=$(LINUX_DIR)/drivers/net/can/c_can/c_can_pci.ko
+  AUTOLOAD:=$(call AutoProbe,c_can_pci)
+  $(call AddDepends/can)
+endef
+
+define KernelPackage/can-c-can-pci/description
+ This driver adds support for the C_CAN/D_CAN chips connected
+ to the PCI bus.
+endef
+
+$(eval $(call KernelPackage,can-c-can-pci))
+
+
+define KernelPackage/can-c-can-platform
+  TITLE:=Platform Bus based BOSCH C_CAN/D_CAN driver
+  KCONFIG:=CONFIG_CAN_C_CAN_PLATFORM
+  DEPENDS:=kmod-can-c-can +!LINUX_3_18:kmod-regmap
+  FILES:=$(LINUX_DIR)/drivers/net/can/c_can/c_can_platform.ko
+  AUTOLOAD:=$(call AutoProbe,c_can_platform)
+  $(call AddDepends/can)
+endef
+
+define KernelPackage/can-c-can-platform/description
+ This driver adds support for the C_CAN/D_CAN chips connected
+ to the "platform bus" (Linux abstraction for directly to the
+ processor attached devices) which can be found on various
+ boards from ST Microelectronics (http://www.st.com) like the
+ SPEAr1310 and SPEAr320 evaluation boards & TI (www.ti.com)
+ boards like am335x, dm814x, dm813x and dm811x.
+endef
+
+$(eval $(call KernelPackage,can-c-can-platform))
+
+
+define KernelPackage/can-flexcan
+  TITLE:=Support for Freescale FLEXCAN based chips
+  KCONFIG:=CONFIG_CAN_FLEXCAN
+  FILES:=$(LINUX_DIR)/drivers/net/can/flexcan.ko
+  AUTOLOAD:=$(call AutoProbe,flexcan)
+  $(call AddDepends/can,@TARGET_imx6)
+endef
+
+define KernelPackage/can-flexcan/description
+ Freescale FLEXCAN CAN bus controller implementation.
+endef
+
+$(eval $(call KernelPackage,can-flexcan))
+
+
 define KernelPackage/can-gw
   TITLE:=CAN Gateway/Router
   KCONFIG:=CONFIG_CAN_GW
@@ -95,20 +147,20 @@ endef
 $(eval $(call KernelPackage,can-gw))
 
 
-define KernelPackage/can-vcan
-  TITLE:=Virtual Local CAN Interface (vcan)
-  KCONFIG:=CONFIG_CAN_VCAN
-  FILES:=$(LINUX_DIR)/drivers/net/can/vcan.ko
-  AUTOLOAD:=$(call AutoProbe,vcan)
+define KernelPackage/can-raw
+  TITLE:=Raw CAN Protcol
+  KCONFIG:=CONFIG_CAN_RAW
+  FILES:=$(LINUX_DIR)/net/can/can-raw.ko
+  AUTOLOAD:=$(call AutoProbe,can-raw)
   $(call AddDepends/can)
 endef
 
-define KernelPackage/can-vcan/description
- Similar to the network loopback devices, vcan offers a
- virtual local CAN interface.
+define KernelPackage/can-raw/description
+ The raw CAN protocol option offers access to the CAN bus via
+ the BSD  socket API.
 endef
 
-$(eval $(call KernelPackage,can-vcan))
+$(eval $(call KernelPackage,can-raw))
 
 
 define KernelPackage/can-slcan
@@ -128,19 +180,20 @@ endef
 $(eval $(call KernelPackage,can-slcan))
 
 
-define KernelPackage/can-flexcan
-  TITLE:=Support for Freescale FLEXCAN based chips
-  KCONFIG:=CONFIG_CAN_FLEXCAN
-  FILES:=$(LINUX_DIR)/drivers/net/can/flexcan.ko
-  AUTOLOAD:=$(call AutoProbe,flexcan)
-  $(call AddDepends/can,@TARGET_imx6)
+define KernelPackage/can-usb-8dev
+  TITLE:=8 devices USB2CAN interface
+  KCONFIG:=CONFIG_CAN_8DEV_USB
+  FILES:=$(LINUX_DIR)/drivers/net/can/usb/usb_8dev.ko
+  AUTOLOAD:=$(call AutoProbe,usb_8dev)
+  $(call AddDepends/can,+kmod-usb-core)
 endef
 
-define KernelPackage/can-flexcan/description
- Freescale FLEXCAN CAN bus controller implementation.
+define KernelPackage/can-usb-8dev/description
+ This driver supports the USB2CAN interface
+ from 8 devices (http://www.8devices.com).
 endef
 
-$(eval $(call KernelPackage,can-flexcan))
+$(eval $(call KernelPackage,can-usb-8dev))
 
 
 define KernelPackage/can-usb-ems
@@ -207,71 +260,19 @@ endef
 $(eval $(call KernelPackage,can-usb-peak))
 
 
-define KernelPackage/can-usb-8dev
-  TITLE:=8 devices USB2CAN interface
-  KCONFIG:=CONFIG_CAN_8DEV_USB
-  FILES:=$(LINUX_DIR)/drivers/net/can/usb/usb_8dev.ko
-  AUTOLOAD:=$(call AutoProbe,usb_8dev)
-  $(call AddDepends/can,+kmod-usb-core)
-endef
-
-define KernelPackage/can-usb-8dev/description
- This driver supports the USB2CAN interface
- from 8 devices (http://www.8devices.com).
-endef
-
-$(eval $(call KernelPackage,can-usb-8dev))
-
-
-define KernelPackage/can-c-can
-  TITLE:=BOSCH C_CAN/D_CAN drivers
-  KCONFIG:=CONFIG_CAN_C_CAN
-  FILES:=$(LINUX_DIR)/drivers/net/can/c_can/c_can.ko
-  AUTOLOAD:=$(call AutoProbe,c_can)
+define KernelPackage/can-vcan
+  TITLE:=Virtual Local CAN Interface (vcan)
+  KCONFIG:=CONFIG_CAN_VCAN
+  FILES:=$(LINUX_DIR)/drivers/net/can/vcan.ko
+  AUTOLOAD:=$(call AutoProbe,vcan)
   $(call AddDepends/can)
 endef
 
-define KernelPackage/can-c-can/description
- This driver adds generic support for the C_CAN/D_CAN chips.
+define KernelPackage/can-vcan/description
+ Similar to the network loopback devices, vcan offers a
+ virtual local CAN interface.
 endef
 
-$(eval $(call KernelPackage,can-c-can))
+$(eval $(call KernelPackage,can-vcan))
 
 
-define KernelPackage/can-c-can-platform
-  TITLE:=Platform Bus based BOSCH C_CAN/D_CAN driver
-  KCONFIG:=CONFIG_CAN_C_CAN_PLATFORM
-  DEPENDS:=kmod-can-c-can +!LINUX_3_18:kmod-regmap
-  FILES:=$(LINUX_DIR)/drivers/net/can/c_can/c_can_platform.ko
-  AUTOLOAD:=$(call AutoProbe,c_can_platform)
-  $(call AddDepends/can)
-endef
-
-define KernelPackage/can-c-can-platform/description
- This driver adds support for the C_CAN/D_CAN chips connected
- to the "platform bus" (Linux abstraction for directly to the
- processor attached devices) which can be found on various
- boards from ST Microelectronics (http://www.st.com) like the
- SPEAr1310 and SPEAr320 evaluation boards & TI (www.ti.com)
- boards like am335x, dm814x, dm813x and dm811x.
-endef
-
-$(eval $(call KernelPackage,can-c-can-platform))
-
-
-define KernelPackage/can-c-can-pci
-  TITLE:=PCI Bus based BOSCH C_CAN/D_CAN driver
-  KCONFIG:=CONFIG_CAN_C_CAN_PCI
-  DEPENDS:=kmod-can-c-can @PCI_SUPPORT
-  FILES:=$(LINUX_DIR)/drivers/net/can/c_can/c_can_pci.ko
-  AUTOLOAD:=$(call AutoProbe,c_can_pci)
-  $(call AddDepends/can)
-endef
-
-define KernelPackage/can-c-can-pci/description
- This driver adds support for the C_CAN/D_CAN chips connected
- to the PCI bus.
-endef
-
-$(eval $(call KernelPackage,can-c-can-pci))
-
diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index bc56b3cc1..2ea2d2c0e 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -20,6 +20,19 @@ define AddDepends/crypto
   DEPENDS+= $(1)
 endef
 
+
+define KernelPackage/crypto-acompress
+  TITLE:=Asynchronous Compression operations
+  HIDDEN:=1
+  KCONFIG:=CONFIG_CRYPTO_ACOMP2
+  FILES:=$(LINUX_DIR)/crypto/crypto_acompress.ko
+  AUTOLOAD:=$(call AutoLoad,09,crypto_acompress)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-acompress))
+
+
 define KernelPackage/crypto-aead
   TITLE:=CryptoAPI AEAD support
   KCONFIG:= \
@@ -33,108 +46,136 @@ endef
 $(eval $(call KernelPackage,crypto-aead))
 
 
-define KernelPackage/crypto-hash
-  TITLE:=CryptoAPI hash support
-  KCONFIG:=CONFIG_CRYPTO_HASH
-  FILES:=$(LINUX_DIR)/crypto/crypto_hash.ko
-  AUTOLOAD:=$(call AutoLoad,02,crypto_hash,1)
+define KernelPackage/crypto-authenc
+  TITLE:=Combined mode wrapper for IPsec
+  DEPENDS:=+kmod-crypto-manager +!LINUX_3_18:kmod-crypto-null
+  KCONFIG:=CONFIG_CRYPTO_AUTHENC
+  FILES:=$(LINUX_DIR)/crypto/authenc.ko
+  AUTOLOAD:=$(call AutoLoad,09,authenc)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-hash))
+$(eval $(call KernelPackage,crypto-authenc))
 
 
-define KernelPackage/crypto-manager
-  TITLE:=CryptoAPI algorithm manager
-  DEPENDS:=+kmod-crypto-aead +kmod-crypto-hash +kmod-crypto-pcompress
-  KCONFIG:= \
-	CONFIG_CRYPTO_MANAGER \
-	CONFIG_CRYPTO_MANAGER2
-  FILES:=$(LINUX_DIR)/crypto/cryptomgr.ko
-  AUTOLOAD:=$(call AutoLoad,09,cryptomgr,1)
+define KernelPackage/crypto-cbc
+  TITLE:=Cipher Block Chaining CryptoAPI module
+  DEPENDS:=+kmod-crypto-manager
+  KCONFIG:=CONFIG_CRYPTO_CBC
+  FILES:=$(LINUX_DIR)/crypto/cbc.ko
+  AUTOLOAD:=$(call AutoLoad,09,cbc)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-manager))
+$(eval $(call KernelPackage,crypto-cbc))
 
 
-define KernelPackage/crypto-pcompress
-  TITLE:=CryptoAPI Partial (de)compression operations
-  KCONFIG:= \
-	CONFIG_CRYPTO_PCOMP=y \
-	CONFIG_CRYPTO_PCOMP2
-  FILES:=$(LINUX_DIR)/crypto/pcompress.ko
-  AUTOLOAD:=$(call AutoLoad,09,pcompress)
+define KernelPackage/crypto-ccm
+ TITLE:=Support for Counter with CBC MAC (CCM)
+ DEPENDS:=+kmod-crypto-ctr +kmod-crypto-aead
+ KCONFIG:=CONFIG_CRYPTO_CCM
+ FILES:=$(LINUX_DIR)/crypto/ccm.ko
+ AUTOLOAD:=$(call AutoLoad,09,ccm)
+ $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-ccm))
+
+
+define KernelPackage/crypto-cmac
+  TITLE:=Support for Cipher-based Message Authentication Code (CMAC)
+  DEPENDS:=+kmod-crypto-hash
+  KCONFIG:=CONFIG_CRYPTO_CMAC
+  FILES:=$(LINUX_DIR)/crypto/cmac.ko
+  AUTOLOAD:=$(call AutoLoad,09,cmac)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-pcompress))
+$(eval $(call KernelPackage,crypto-cmac))
 
 
-define KernelPackage/crypto-user
-  TITLE:=CryptoAPI userspace interface
-  DEPENDS:=+kmod-crypto-hash +kmod-crypto-manager
-  KCONFIG:= \
-	CONFIG_CRYPTO_USER_API \
-	CONFIG_CRYPTO_USER_API_HASH \
-	CONFIG_CRYPTO_USER_API_SKCIPHER
-  FILES:= \
-	$(LINUX_DIR)/crypto/af_alg.ko \
-	$(LINUX_DIR)/crypto/algif_hash.ko \
-	$(LINUX_DIR)/crypto/algif_skcipher.ko
-  AUTOLOAD:=$(call AutoLoad,09,af_alg algif_hash algif_skcipher)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-user))
-
-
-define KernelPackage/crypto-wq
-  TITLE:=CryptoAPI work queue handling
-  KCONFIG:=CONFIG_CRYPTO_WORKQUEUE
-  FILES:=$(LINUX_DIR)/crypto/crypto_wq.ko
-  AUTOLOAD:=$(call AutoLoad,09,crypto_wq)
-  $(call AddDepends/crypto)
-endef
-$(eval $(call KernelPackage,crypto-wq))
-
-define KernelPackage/crypto-rng
-  TITLE:=CryptoAPI random number generation
-  DEPENDS:=+kmod-crypto-hash +kmod-crypto-hmac +kmod-crypto-sha256
-  KCONFIG:= \
-	CONFIG_CRYPTO_DRBG \
-	CONFIG_CRYPTO_DRBG_HMAC=y \
-	CONFIG_CRYPTO_DRBG_HASH=n \
-	CONFIG_CRYPTO_DRBG_MENU \
-	CONFIG_CRYPTO_JITTERENTROPY \
-	CONFIG_CRYPTO_RNG2
-  FILES:= \
-	$(LINUX_DIR)/crypto/drbg.ko@ge4.2 \
-	$(LINUX_DIR)/crypto/jitterentropy_rng.ko@ge4.2 \
-	$(LINUX_DIR)/crypto/krng.ko@lt4.2 \
-	$(LINUX_DIR)/crypto/rng.ko
-  AUTOLOAD:=$(call AutoLoad,09,drbg@ge4.2 jitterentropy_rng@ge4.2 krng@lt4.2 rng)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-rng))
-
-
-define KernelPackage/crypto-rsa
-  TITLE:=RSA algorithm
-  DEPENDS:=@!LINUX_3_18 +kmod-crypto-manager
-  KCONFIG:= CONFIG_CRYPTO_RSA
+define KernelPackage/crypto-crc32
+  TITLE:=CRC32 CRC module
+  DEPENDS:=+kmod-crypto-hash
+  KCONFIG:=CONFIG_CRYPTO_CRC32
   HIDDEN:=1
-  FILES:= \
-	$(LINUX_DIR)/lib/asn1_decoder.ko \
-	$(LINUX_DIR)/lib/mpi/mpi.ko \
-	$(LINUX_DIR)/crypto/akcipher.ko \
-	$(LINUX_DIR)/crypto/rsa_generic.ko
-  AUTOLOAD:=$(call AutoLoad,10,rsa_generic)
+  FILES:=$(LINUX_DIR)/crypto/crc32_generic.ko@ge4.9
+  AUTOLOAD:=$(call AutoLoad,04,crc32_generic@ge4.9,1)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-rsa))
+$(eval $(call KernelPackage,crypto-crc32))
+
+
+define KernelPackage/crypto-crc32c
+  TITLE:=CRC32c CRC module
+  DEPENDS:=+kmod-crypto-hash
+  KCONFIG:=CONFIG_CRYPTO_CRC32C
+  FILES:=$(LINUX_DIR)/crypto/crc32c_generic.ko
+  AUTOLOAD:=$(call AutoLoad,04,crc32c_generic,1)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-crc32c))
+
+
+define KernelPackage/crypto-ctr
+  TITLE:=Counter Mode CryptoAPI module
+  DEPENDS:=+kmod-crypto-manager +kmod-crypto-seqiv +kmod-crypto-iv
+  KCONFIG:=CONFIG_CRYPTO_CTR
+  FILES:=$(LINUX_DIR)/crypto/ctr.ko
+  AUTOLOAD:=$(call AutoLoad,09,ctr)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-ctr))
+
+
+define KernelPackage/crypto-cts
+  TITLE:=Cipher Text Stealing CryptoAPI module
+  DEPENDS:=+kmod-crypto-manager
+  KCONFIG:=CONFIG_CRYPTO_CTS
+  FILES:=$(LINUX_DIR)/crypto/cts.ko
+  AUTOLOAD:=$(call AutoLoad,09,cts)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-cts))
+
+
+define KernelPackage/crypto-deflate
+  TITLE:=Deflate compression CryptoAPI module
+  DEPENDS:=+kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +LINUX_4_14:kmod-crypto-acompress
+  KCONFIG:=CONFIG_CRYPTO_DEFLATE
+  FILES:=$(LINUX_DIR)/crypto/deflate.ko
+  AUTOLOAD:=$(call AutoLoad,09,deflate)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-deflate))
+
+
+define KernelPackage/crypto-des
+  TITLE:=DES/3DES cipher CryptoAPI module
+  KCONFIG:=CONFIG_CRYPTO_DES
+  FILES:=$(LINUX_DIR)/crypto/des_generic.ko
+  AUTOLOAD:=$(call AutoLoad,09,des_generic)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-des))
+
+
+define KernelPackage/crypto-ecb
+  TITLE:=Electronic CodeBook CryptoAPI module
+  DEPENDS:=+kmod-crypto-manager
+  KCONFIG:=CONFIG_CRYPTO_ECB
+  FILES:=$(LINUX_DIR)/crypto/ecb.ko
+  AUTOLOAD:=$(call AutoLoad,09,ecb)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-ecb))
 
 
 define KernelPackage/crypto-ecdh
@@ -150,21 +191,6 @@ endef
 $(eval $(call KernelPackage,crypto-ecdh))
 
 
-define KernelPackage/crypto-iv
-  TITLE:=CryptoAPI initialization vectors
-  DEPENDS:=+kmod-crypto-manager +kmod-crypto-rng +kmod-crypto-wq
-  KCONFIG:= CONFIG_CRYPTO_BLKCIPHER2
-  HIDDEN:=1
-  FILES:= \
-	$(LINUX_DIR)/crypto/eseqiv.ko@lt4.9 \
-	$(LINUX_DIR)/crypto/chainiv.ko@lt4.9
-  AUTOLOAD:=$(call AutoLoad,10,eseqiv chainiv)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-iv))
-
-
 define KernelPackage/crypto-echainiv
   TITLE:=Encrypted Chain IV Generator
   DEPENDS:=+kmod-crypto-aead
@@ -177,51 +203,73 @@ endef
 $(eval $(call KernelPackage,crypto-echainiv))
 
 
-define KernelPackage/crypto-seqiv
-  TITLE:=CryptoAPI Sequence Number IV Generator
-  DEPENDS:=+kmod-crypto-aead +kmod-crypto-rng
-  KCONFIG:=CONFIG_CRYPTO_SEQIV
-  FILES:=$(LINUX_DIR)/crypto/seqiv.ko
-  AUTOLOAD:=$(call AutoLoad,09,seqiv)
+define KernelPackage/crypto-fcrypt
+  TITLE:=FCRYPT cipher CryptoAPI module
+  KCONFIG:=CONFIG_CRYPTO_FCRYPT
+  FILES:=$(LINUX_DIR)/crypto/fcrypt.ko
+  AUTOLOAD:=$(call AutoLoad,09,fcrypt)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-seqiv))
+$(eval $(call KernelPackage,crypto-fcrypt))
 
 
-define KernelPackage/crypto-hw-talitos
-  TITLE:=Freescale integrated security engine (SEC) driver
-  DEPENDS:=+kmod-crypto-manager +kmod-crypto-hash +kmod-random-core +kmod-crypto-authenc +kmod-crypto-des
-  KCONFIG:= \
-	CONFIG_CRYPTO_HW=y \
-	CONFIG_CRYPTO_DEV_TALITOS \
-	CONFIG_CRYPTO_DEV_TALITOS1=y \
-	CONFIG_CRYPTO_DEV_TALITOS2=y
-  FILES:= \
-	$(LINUX_DIR)/drivers/crypto/talitos.ko
-  AUTOLOAD:=$(call AutoLoad,09,talitos)
+define KernelPackage/crypto-gcm
+  TITLE:=GCM/GMAC CryptoAPI module
+  DEPENDS:=+kmod-crypto-ctr +kmod-crypto-ghash +kmod-crypto-null
+  KCONFIG:=CONFIG_CRYPTO_GCM
+  FILES:=$(LINUX_DIR)/crypto/gcm.ko
+  AUTOLOAD:=$(call AutoLoad,09,gcm)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-hw-talitos))
+$(eval $(call KernelPackage,crypto-gcm))
 
 
-define KernelPackage/crypto-hw-padlock
-  TITLE:=VIA PadLock ACE with AES/SHA hw crypto module
-  DEPENDS:=+kmod-crypto-manager
-  KCONFIG:= \
-	CONFIG_CRYPTO_HW=y \
-	CONFIG_CRYPTO_DEV_PADLOCK \
-	CONFIG_CRYPTO_DEV_PADLOCK_AES \
-	CONFIG_CRYPTO_DEV_PADLOCK_SHA
-  FILES:= \
-	$(LINUX_DIR)/drivers/crypto/padlock-aes.ko \
-	$(LINUX_DIR)/drivers/crypto/padlock-sha.ko
-  AUTOLOAD:=$(call AutoLoad,09,padlock-aes padlock-sha)
+define KernelPackage/crypto-gf128
+  TITLE:=GF(2^128) multiplication functions CryptoAPI module
+  KCONFIG:=CONFIG_CRYPTO_GF128MUL
+  FILES:=$(LINUX_DIR)/crypto/gf128mul.ko
+  AUTOLOAD:=$(call AutoLoad,09,gf128mul)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-hw-padlock))
+$(eval $(call KernelPackage,crypto-gf128))
+
+
+define KernelPackage/crypto-ghash
+  TITLE:=GHASH digest CryptoAPI module
+  DEPENDS:=+kmod-crypto-gf128 +kmod-crypto-hash
+  KCONFIG:=CONFIG_CRYPTO_GHASH
+  FILES:=$(LINUX_DIR)/crypto/ghash-generic.ko
+  AUTOLOAD:=$(call AutoLoad,09,ghash-generic)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-ghash))
+
+
+define KernelPackage/crypto-hash
+  TITLE:=CryptoAPI hash support
+  KCONFIG:=CONFIG_CRYPTO_HASH
+  FILES:=$(LINUX_DIR)/crypto/crypto_hash.ko
+  AUTOLOAD:=$(call AutoLoad,02,crypto_hash,1)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-hash))
+
+
+define KernelPackage/crypto-hmac
+  TITLE:=HMAC digest CryptoAPI module
+  DEPENDS:=+kmod-crypto-hash +kmod-crypto-manager
+  KCONFIG:=CONFIG_CRYPTO_HMAC
+  FILES:=$(LINUX_DIR)/crypto/hmac.ko
+  AUTOLOAD:=$(call AutoLoad,09,hmac)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-hmac))
 
 
 define KernelPackage/crypto-hw-ccp
@@ -272,93 +320,54 @@ endef
 $(eval $(call KernelPackage,crypto-hw-hifn-795x))
 
 
-define KernelPackage/crypto-authenc
-  TITLE:=Combined mode wrapper for IPsec
-  DEPENDS:=+kmod-crypto-manager +!LINUX_3_18:kmod-crypto-null
-  KCONFIG:=CONFIG_CRYPTO_AUTHENC
-  FILES:=$(LINUX_DIR)/crypto/authenc.ko
-  AUTOLOAD:=$(call AutoLoad,09,authenc)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-authenc))
-
-define KernelPackage/crypto-cbc
-  TITLE:=Cipher Block Chaining CryptoAPI module
+define KernelPackage/crypto-hw-padlock
+  TITLE:=VIA PadLock ACE with AES/SHA hw crypto module
   DEPENDS:=+kmod-crypto-manager
-  KCONFIG:=CONFIG_CRYPTO_CBC
-  FILES:=$(LINUX_DIR)/crypto/cbc.ko
-  AUTOLOAD:=$(call AutoLoad,09,cbc)
+  KCONFIG:= \
+	CONFIG_CRYPTO_HW=y \
+	CONFIG_CRYPTO_DEV_PADLOCK \
+	CONFIG_CRYPTO_DEV_PADLOCK_AES \
+	CONFIG_CRYPTO_DEV_PADLOCK_SHA
+  FILES:= \
+	$(LINUX_DIR)/drivers/crypto/padlock-aes.ko \
+	$(LINUX_DIR)/drivers/crypto/padlock-sha.ko
+  AUTOLOAD:=$(call AutoLoad,09,padlock-aes padlock-sha)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-cbc))
+$(eval $(call KernelPackage,crypto-hw-padlock))
 
-define KernelPackage/crypto-ctr
-  TITLE:=Counter Mode CryptoAPI module
-  DEPENDS:=+kmod-crypto-manager +kmod-crypto-seqiv +kmod-crypto-iv
-  KCONFIG:=CONFIG_CRYPTO_CTR
-  FILES:=$(LINUX_DIR)/crypto/ctr.ko
-  AUTOLOAD:=$(call AutoLoad,09,ctr)
+
+define KernelPackage/crypto-hw-talitos
+  TITLE:=Freescale integrated security engine (SEC) driver
+  DEPENDS:=+kmod-crypto-manager +kmod-crypto-hash +kmod-random-core +kmod-crypto-authenc +kmod-crypto-des
+  KCONFIG:= \
+	CONFIG_CRYPTO_HW=y \
+	CONFIG_CRYPTO_DEV_TALITOS \
+	CONFIG_CRYPTO_DEV_TALITOS1=y \
+	CONFIG_CRYPTO_DEV_TALITOS2=y
+  FILES:= \
+	$(LINUX_DIR)/drivers/crypto/talitos.ko
+  AUTOLOAD:=$(call AutoLoad,09,talitos)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-ctr))
+$(eval $(call KernelPackage,crypto-hw-talitos))
 
-define KernelPackage/crypto-ccm
- TITLE:=Support for Counter with CBC MAC (CCM)
- DEPENDS:=+kmod-crypto-ctr +kmod-crypto-aead
- KCONFIG:=CONFIG_CRYPTO_CCM
- FILES:=$(LINUX_DIR)/crypto/ccm.ko
- AUTOLOAD:=$(call AutoLoad,09,ccm)
- $(call AddDepends/crypto)
-endef
 
-$(eval $(call KernelPackage,crypto-ccm))
-
-define KernelPackage/crypto-pcbc
-  TITLE:=Propagating Cipher Block Chaining CryptoAPI module
-  DEPENDS:=+kmod-crypto-manager
-  KCONFIG:=CONFIG_CRYPTO_PCBC
-  FILES:=$(LINUX_DIR)/crypto/pcbc.ko
-  AUTOLOAD:=$(call AutoLoad,09,pcbc)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-pcbc))
-
-define KernelPackage/crypto-crc32c
-  TITLE:=CRC32c CRC module
-  DEPENDS:=+kmod-crypto-hash
-  KCONFIG:=CONFIG_CRYPTO_CRC32C
-  FILES:=$(LINUX_DIR)/crypto/crc32c_generic.ko
-  AUTOLOAD:=$(call AutoLoad,04,crc32c_generic,1)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-crc32c))
-
-define KernelPackage/crypto-crc32
-  TITLE:=CRC32 CRC module
-  DEPENDS:=+kmod-crypto-hash
-  KCONFIG:=CONFIG_CRYPTO_CRC32
+define KernelPackage/crypto-iv
+  TITLE:=CryptoAPI initialization vectors
+  DEPENDS:=+kmod-crypto-manager +kmod-crypto-rng +kmod-crypto-wq
+  KCONFIG:= CONFIG_CRYPTO_BLKCIPHER2
   HIDDEN:=1
-  FILES:=$(LINUX_DIR)/crypto/crc32_generic.ko@ge4.9
-  AUTOLOAD:=$(call AutoLoad,04,crc32_generic@ge4.9,1)
+  FILES:= \
+	$(LINUX_DIR)/crypto/eseqiv.ko@lt4.9 \
+	$(LINUX_DIR)/crypto/chainiv.ko@lt4.9
+  AUTOLOAD:=$(call AutoLoad,10,eseqiv chainiv)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-crc32))
-
-define KernelPackage/crypto-des
-  TITLE:=DES/3DES cipher CryptoAPI module
-  KCONFIG:=CONFIG_CRYPTO_DES
-  FILES:=$(LINUX_DIR)/crypto/des_generic.ko
-  AUTOLOAD:=$(call AutoLoad,09,des_generic)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-des))
+$(eval $(call KernelPackage,crypto-iv))
 
 
 define KernelPackage/crypto-kpp
@@ -373,120 +382,18 @@ endef
 $(eval $(call KernelPackage,crypto-kpp))
 
 
-define KernelPackage/crypto-acompress
-  TITLE:=Asynchronous Compression operations
-  HIDDEN:=1
-  KCONFIG:=CONFIG_CRYPTO_ACOMP2
-  FILES:=$(LINUX_DIR)/crypto/crypto_acompress.ko
-  AUTOLOAD:=$(call AutoLoad,09,crypto_acompress)
+define KernelPackage/crypto-manager
+  TITLE:=CryptoAPI algorithm manager
+  DEPENDS:=+kmod-crypto-aead +kmod-crypto-hash +kmod-crypto-pcompress
+  KCONFIG:= \
+	CONFIG_CRYPTO_MANAGER \
+	CONFIG_CRYPTO_MANAGER2
+  FILES:=$(LINUX_DIR)/crypto/cryptomgr.ko
+  AUTOLOAD:=$(call AutoLoad,09,cryptomgr,1)
   $(call AddDepends/crypto)
 endef
 
-$(eval $(call KernelPackage,crypto-acompress))
-
-
-define KernelPackage/crypto-deflate
-  TITLE:=Deflate compression CryptoAPI module
-  DEPENDS:=+kmod-lib-zlib-inflate +kmod-lib-zlib-deflate +LINUX_4_14:kmod-crypto-acompress
-  KCONFIG:=CONFIG_CRYPTO_DEFLATE
-  FILES:=$(LINUX_DIR)/crypto/deflate.ko
-  AUTOLOAD:=$(call AutoLoad,09,deflate)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-deflate))
-
-
-define KernelPackage/crypto-fcrypt
-  TITLE:=FCRYPT cipher CryptoAPI module
-  KCONFIG:=CONFIG_CRYPTO_FCRYPT
-  FILES:=$(LINUX_DIR)/crypto/fcrypt.ko
-  AUTOLOAD:=$(call AutoLoad,09,fcrypt)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-fcrypt))
-
-define KernelPackage/crypto-ecb
-  TITLE:=Electronic CodeBook CryptoAPI module
-  DEPENDS:=+kmod-crypto-manager
-  KCONFIG:=CONFIG_CRYPTO_ECB
-  FILES:=$(LINUX_DIR)/crypto/ecb.ko
-  AUTOLOAD:=$(call AutoLoad,09,ecb)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-ecb))
-
-define KernelPackage/crypto-cts
-  TITLE:=Cipher Text Stealing CryptoAPI module
-  DEPENDS:=+kmod-crypto-manager
-  KCONFIG:=CONFIG_CRYPTO_CTS
-  FILES:=$(LINUX_DIR)/crypto/cts.ko
-  AUTOLOAD:=$(call AutoLoad,09,cts)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-cts))
-
-
-define KernelPackage/crypto-hmac
-  TITLE:=HMAC digest CryptoAPI module
-  DEPENDS:=+kmod-crypto-hash +kmod-crypto-manager
-  KCONFIG:=CONFIG_CRYPTO_HMAC
-  FILES:=$(LINUX_DIR)/crypto/hmac.ko
-  AUTOLOAD:=$(call AutoLoad,09,hmac)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-hmac))
-
-
-define KernelPackage/crypto-cmac
-  TITLE:=Support for Cipher-based Message Authentication Code (CMAC)
-  DEPENDS:=+kmod-crypto-hash
-  KCONFIG:=CONFIG_CRYPTO_CMAC
-  FILES:=$(LINUX_DIR)/crypto/cmac.ko
-  AUTOLOAD:=$(call AutoLoad,09,cmac)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-cmac))
-
-
-define KernelPackage/crypto-gcm
-  TITLE:=GCM/GMAC CryptoAPI module
-  DEPENDS:=+kmod-crypto-ctr +kmod-crypto-ghash +kmod-crypto-null
-  KCONFIG:=CONFIG_CRYPTO_GCM
-  FILES:=$(LINUX_DIR)/crypto/gcm.ko
-  AUTOLOAD:=$(call AutoLoad,09,gcm)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-gcm))
-
-
-define KernelPackage/crypto-gf128
-  TITLE:=GF(2^128) multiplication functions CryptoAPI module
-  KCONFIG:=CONFIG_CRYPTO_GF128MUL
-  FILES:=$(LINUX_DIR)/crypto/gf128mul.ko
-  AUTOLOAD:=$(call AutoLoad,09,gf128mul)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-gf128))
-
-
-define KernelPackage/crypto-ghash
-  TITLE:=GHASH digest CryptoAPI module
-  DEPENDS:=+kmod-crypto-gf128 +kmod-crypto-hash
-  KCONFIG:=CONFIG_CRYPTO_GHASH
-  FILES:=$(LINUX_DIR)/crypto/ghash-generic.ko
-  AUTOLOAD:=$(call AutoLoad,09,ghash-generic)
-  $(call AddDepends/crypto)
-endef
-
-$(eval $(call KernelPackage,crypto-ghash))
+$(eval $(call KernelPackage,crypto-manager))
 
 
 define KernelPackage/crypto-md4
@@ -532,6 +439,138 @@ endef
 $(eval $(call KernelPackage,crypto-michael-mic))
 
 
+define KernelPackage/crypto-misc
+  TITLE:=Other CryptoAPI modules
+  DEPENDS:=+kmod-crypto-manager
+  KCONFIG:= \
+	CONFIG_CRYPTO_ANUBIS \
+	CONFIG_CRYPTO_BLOWFISH \
+	CONFIG_CRYPTO_CAMELLIA \
+	CONFIG_CRYPTO_CAST5 \
+	CONFIG_CRYPTO_CAST6 \
+	CONFIG_CRYPTO_FCRYPT \
+	CONFIG_CRYPTO_KHAZAD \
+	CONFIG_CRYPTO_SERPENT \
+	CONFIG_CRYPTO_TEA \
+	CONFIG_CRYPTO_TGR192 \
+	CONFIG_CRYPTO_TWOFISH \
+	CONFIG_CRYPTO_TWOFISH_COMMON \
+	CONFIG_CRYPTO_TWOFISH_586 \
+	CONFIG_CRYPTO_WP512
+  FILES:= \
+	$(LINUX_DIR)/crypto/anubis.ko \
+	$(LINUX_DIR)/crypto/camellia_generic.ko \
+	$(LINUX_DIR)/crypto/cast_common.ko \
+	$(LINUX_DIR)/crypto/cast5_generic.ko \
+	$(LINUX_DIR)/crypto/cast6_generic.ko \
+	$(LINUX_DIR)/crypto/khazad.ko \
+	$(LINUX_DIR)/crypto/tea.ko \
+	$(LINUX_DIR)/crypto/tgr192.ko \
+	$(LINUX_DIR)/crypto/twofish_common.ko \
+	$(LINUX_DIR)/crypto/wp512.ko \
+	$(LINUX_DIR)/crypto/twofish_generic.ko \
+	$(LINUX_DIR)/crypto/blowfish_common.ko \
+	$(LINUX_DIR)/crypto/blowfish_generic.ko \
+	$(LINUX_DIR)/crypto/serpent_generic.ko
+  $(call AddDepends/crypto)
+endef
+
+ifndef CONFIG_TARGET_x86_64
+  define KernelPackage/crypto-misc/x86
+    FILES+=$(LINUX_DIR)/arch/x86/crypto/twofish-i586.ko
+  endef
+endif
+
+$(eval $(call KernelPackage,crypto-misc))
+
+
+define KernelPackage/crypto-null
+  TITLE:=Null CryptoAPI module
+  KCONFIG:=CONFIG_CRYPTO_NULL
+  FILES:=$(LINUX_DIR)/crypto/crypto_null.ko
+  AUTOLOAD:=$(call AutoLoad,09,crypto_null)
+  $(call AddDepends/crypto, +kmod-crypto-hash)
+endef
+
+$(eval $(call KernelPackage,crypto-null))
+
+
+define KernelPackage/crypto-pcbc
+  TITLE:=Propagating Cipher Block Chaining CryptoAPI module
+  DEPENDS:=+kmod-crypto-manager
+  KCONFIG:=CONFIG_CRYPTO_PCBC
+  FILES:=$(LINUX_DIR)/crypto/pcbc.ko
+  AUTOLOAD:=$(call AutoLoad,09,pcbc)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-pcbc))
+
+
+define KernelPackage/crypto-pcompress
+  TITLE:=CryptoAPI Partial (de)compression operations
+  KCONFIG:= \
+	CONFIG_CRYPTO_PCOMP=y \
+	CONFIG_CRYPTO_PCOMP2
+  FILES:=$(LINUX_DIR)/crypto/pcompress.ko
+  AUTOLOAD:=$(call AutoLoad,09,pcompress)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-pcompress))
+
+
+define KernelPackage/crypto-rsa
+  TITLE:=RSA algorithm
+  DEPENDS:=@!LINUX_3_18 +kmod-crypto-manager
+  KCONFIG:= CONFIG_CRYPTO_RSA
+  HIDDEN:=1
+  FILES:= \
+	$(LINUX_DIR)/lib/asn1_decoder.ko \
+	$(LINUX_DIR)/lib/mpi/mpi.ko \
+	$(LINUX_DIR)/crypto/akcipher.ko \
+	$(LINUX_DIR)/crypto/rsa_generic.ko
+  AUTOLOAD:=$(call AutoLoad,10,rsa_generic)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-rsa))
+
+
+define KernelPackage/crypto-rng
+  TITLE:=CryptoAPI random number generation
+  DEPENDS:=+kmod-crypto-hash +kmod-crypto-hmac +kmod-crypto-sha256
+  KCONFIG:= \
+	CONFIG_CRYPTO_DRBG \
+	CONFIG_CRYPTO_DRBG_HMAC=y \
+	CONFIG_CRYPTO_DRBG_HASH=n \
+	CONFIG_CRYPTO_DRBG_MENU \
+	CONFIG_CRYPTO_JITTERENTROPY \
+	CONFIG_CRYPTO_RNG2
+  FILES:= \
+	$(LINUX_DIR)/crypto/drbg.ko@ge4.2 \
+	$(LINUX_DIR)/crypto/jitterentropy_rng.ko@ge4.2 \
+	$(LINUX_DIR)/crypto/krng.ko@lt4.2 \
+	$(LINUX_DIR)/crypto/rng.ko
+  AUTOLOAD:=$(call AutoLoad,09,drbg@ge4.2 jitterentropy_rng@ge4.2 krng@lt4.2 rng)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-rng))
+
+
+define KernelPackage/crypto-seqiv
+  TITLE:=CryptoAPI Sequence Number IV Generator
+  DEPENDS:=+kmod-crypto-aead +kmod-crypto-rng
+  KCONFIG:=CONFIG_CRYPTO_SEQIV
+  FILES:=$(LINUX_DIR)/crypto/seqiv.ko
+  AUTOLOAD:=$(call AutoLoad,09,seqiv)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-seqiv))
+
+
 define KernelPackage/crypto-sha1
   TITLE:=SHA1 digest CryptoAPI module
   DEPENDS:=+kmod-crypto-hash
@@ -607,62 +646,6 @@ endef
 $(eval $(call KernelPackage,crypto-sha512))
 
 
-define KernelPackage/crypto-misc
-  TITLE:=Other CryptoAPI modules
-  DEPENDS:=+kmod-crypto-manager
-  KCONFIG:= \
-	CONFIG_CRYPTO_ANUBIS \
-	CONFIG_CRYPTO_BLOWFISH \
-	CONFIG_CRYPTO_CAMELLIA \
-	CONFIG_CRYPTO_CAST5 \
-	CONFIG_CRYPTO_CAST6 \
-	CONFIG_CRYPTO_FCRYPT \
-	CONFIG_CRYPTO_KHAZAD \
-	CONFIG_CRYPTO_SERPENT \
-	CONFIG_CRYPTO_TEA \
-	CONFIG_CRYPTO_TGR192 \
-	CONFIG_CRYPTO_TWOFISH \
-	CONFIG_CRYPTO_TWOFISH_COMMON \
-	CONFIG_CRYPTO_TWOFISH_586 \
-	CONFIG_CRYPTO_WP512
-  FILES:= \
-	$(LINUX_DIR)/crypto/anubis.ko \
-	$(LINUX_DIR)/crypto/camellia_generic.ko \
-	$(LINUX_DIR)/crypto/cast_common.ko \
-	$(LINUX_DIR)/crypto/cast5_generic.ko \
-	$(LINUX_DIR)/crypto/cast6_generic.ko \
-	$(LINUX_DIR)/crypto/khazad.ko \
-	$(LINUX_DIR)/crypto/tea.ko \
-	$(LINUX_DIR)/crypto/tgr192.ko \
-	$(LINUX_DIR)/crypto/twofish_common.ko \
-	$(LINUX_DIR)/crypto/wp512.ko \
-	$(LINUX_DIR)/crypto/twofish_generic.ko \
-	$(LINUX_DIR)/crypto/blowfish_common.ko \
-	$(LINUX_DIR)/crypto/blowfish_generic.ko \
-	$(LINUX_DIR)/crypto/serpent_generic.ko
-  $(call AddDepends/crypto)
-endef
-
-ifndef CONFIG_TARGET_x86_64
-  define KernelPackage/crypto-misc/x86
-    FILES+=$(LINUX_DIR)/arch/x86/crypto/twofish-i586.ko
-  endef
-endif
-
-$(eval $(call KernelPackage,crypto-misc))
-
-
-define KernelPackage/crypto-null
-  TITLE:=Null CryptoAPI module
-  KCONFIG:=CONFIG_CRYPTO_NULL
-  FILES:=$(LINUX_DIR)/crypto/crypto_null.ko
-  AUTOLOAD:=$(call AutoLoad,09,crypto_null)
-  $(call AddDepends/crypto, +kmod-crypto-hash)
-endef
-
-$(eval $(call KernelPackage,crypto-null))
-
-
 define KernelPackage/crypto-test
   TITLE:=Test CryptoAPI module
   KCONFIG:=CONFIG_CRYPTO_TEST
@@ -673,6 +656,34 @@ endef
 $(eval $(call KernelPackage,crypto-test))
 
 
+define KernelPackage/crypto-user
+  TITLE:=CryptoAPI userspace interface
+  DEPENDS:=+kmod-crypto-hash +kmod-crypto-manager
+  KCONFIG:= \
+	CONFIG_CRYPTO_USER_API \
+	CONFIG_CRYPTO_USER_API_HASH \
+	CONFIG_CRYPTO_USER_API_SKCIPHER
+  FILES:= \
+	$(LINUX_DIR)/crypto/af_alg.ko \
+	$(LINUX_DIR)/crypto/algif_hash.ko \
+	$(LINUX_DIR)/crypto/algif_skcipher.ko
+  AUTOLOAD:=$(call AutoLoad,09,af_alg algif_hash algif_skcipher)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-user))
+
+
+define KernelPackage/crypto-wq
+  TITLE:=CryptoAPI work queue handling
+  KCONFIG:=CONFIG_CRYPTO_WORKQUEUE
+  FILES:=$(LINUX_DIR)/crypto/crypto_wq.ko
+  AUTOLOAD:=$(call AutoLoad,09,crypto_wq)
+  $(call AddDepends/crypto)
+endef
+$(eval $(call KernelPackage,crypto-wq))
+
+
 define KernelPackage/crypto-xts
   TITLE:=XTS cipher CryptoAPI module
   DEPENDS:=+kmod-crypto-gf128 +kmod-crypto-manager
@@ -683,3 +694,4 @@ define KernelPackage/crypto-xts
 endef
 
 $(eval $(call KernelPackage,crypto-xts))
+
diff --git a/package/kernel/linux/modules/firewire.mk b/package/kernel/linux/modules/firewire.mk
index 18b531a29..1e2d94272 100644
--- a/package/kernel/linux/modules/firewire.mk
+++ b/package/kernel/linux/modules/firewire.mk
@@ -22,6 +22,22 @@ endef
 $(eval $(call KernelPackage,firewire))
 
 
+define KernelPackage/firewire-net
+  SUBMENU:=$(FIREWIRE_MENU)
+  TITLE:=Support for IP networking over FireWire
+  DEPENDS:=kmod-firewire
+  KCONFIG:=CONFIG_FIREWIRE_NET
+  FILES:=$(LINUX_DIR)/drivers/firewire/firewire-net.ko
+  AUTOLOAD:=$(call AutoProbe,firewire-net)
+endef
+
+define KernelPackage/firewire-net/description
+ Kernel support for IPv4 over FireWire
+endef
+
+$(eval $(call KernelPackage,firewire-net))
+
+
 define KernelPackage/firewire-ohci
   SUBMENU:=$(FIREWIRE_MENU)
   TITLE:=Support for OHCI-1394 controllers
@@ -58,17 +74,3 @@ endef
 $(eval $(call KernelPackage,firewire-sbp2))
 
 
-define KernelPackage/firewire-net
-  SUBMENU:=$(FIREWIRE_MENU)
-  TITLE:=Support for IP networking over FireWire
-  DEPENDS:=kmod-firewire
-  KCONFIG:=CONFIG_FIREWIRE_NET
-  FILES:=$(LINUX_DIR)/drivers/firewire/firewire-net.ko
-  AUTOLOAD:=$(call AutoProbe,firewire-net)
-endef
-
-define KernelPackage/firewire-net/description
- Kernel support for IPv4 over FireWire
-endef
-
-$(eval $(call KernelPackage,firewire-net))
diff --git a/package/kernel/linux/modules/fs.mk b/package/kernel/linux/modules/fs.mk
index f75758557..8dca0f96f 100644
--- a/package/kernel/linux/modules/fs.mk
+++ b/package/kernel/linux/modules/fs.mk
@@ -7,25 +7,6 @@
 
 FS_MENU:=Filesystems
 
-define KernelPackage/fs-fscache
-  SUBMENU:=$(FS_MENU)
-  TITLE:=General filesystem local cache manager
-  DEPENDS:=
-  KCONFIG:=\
-	CONFIG_FSCACHE=m \
-	CONFIG_FSCACHE_STATS=y \
-	CONFIG_FSCACHE_HISTOGRAM=n \
-	CONFIG_FSCACHE_DEBUG=n \
-	CONFIG_FSCACHE_OBJECT_LIST=n \
-	CONFIG_CACHEFILES=y \
-	CONFIG_CACHEFILES_DEBUG=n \
-	CONFIG_CACHEFILES_HISTOGRAM=n
-  FILES:=$(LINUX_DIR)/fs/fscache/fscache.ko
-  AUTOLOAD:=$(call AutoLoad,29,fscache)
-endef
-
-$(eval $(call KernelPackage,fs-fscache))
-
 define KernelPackage/fs-9p
   SUBMENU:=$(FS_MENU)
   TITLE:=Plan 9 Resource Sharing Support
@@ -45,6 +26,7 @@ endef
 
 $(eval $(call KernelPackage,fs-9p))
 
+
 define KernelPackage/fs-afs
   SUBMENU:=$(FS_MENU)
   TITLE:=Andrew FileSystem client
@@ -142,6 +124,7 @@ endef
 
 $(eval $(call KernelPackage,fs-configfs))
 
+
 define KernelPackage/fs-cramfs
   SUBMENU:=$(FS_MENU)
   TITLE:=Compressed RAM/ROM filesystem support
@@ -158,6 +141,23 @@ endef
 
 $(eval $(call KernelPackage,fs-cramfs))
 
+
+define KernelPackage/fs-efivarfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=efivar filesystem support
+  KCONFIG:=CONFIG_EFIVAR_FS
+  FILES:=$(LINUX_DIR)/fs/efivarfs/efivarfs.ko
+  DEPENDS:=@(x86_64||x86)
+  AUTOLOAD:=$(call Autoload,90,efivarfs)
+endef
+
+define KernelPackage/fs-efivarfs/description
+  Kernel module to support efivarfs file system mountpoint.
+endef
+
+$(eval $(call KernelPackage,fs-efivarfs))
+
+
 define KernelPackage/fs-exportfs
   SUBMENU:=$(FS_MENU)
   TITLE:=exportfs kernel server support
@@ -220,19 +220,24 @@ endef
 $(eval $(call KernelPackage,fs-f2fs))
 
 
-define KernelPackage/fuse
+define KernelPackage/fs-fscache
   SUBMENU:=$(FS_MENU)
-  TITLE:=FUSE (Filesystem in Userspace) support
-  KCONFIG:= CONFIG_FUSE_FS
-  FILES:=$(LINUX_DIR)/fs/fuse/fuse.ko
-  AUTOLOAD:=$(call AutoLoad,80,fuse)
+  TITLE:=General filesystem local cache manager
+  DEPENDS:=
+  KCONFIG:=\
+	CONFIG_FSCACHE=m \
+	CONFIG_FSCACHE_STATS=y \
+	CONFIG_FSCACHE_HISTOGRAM=n \
+	CONFIG_FSCACHE_DEBUG=n \
+	CONFIG_FSCACHE_OBJECT_LIST=n \
+	CONFIG_CACHEFILES=y \
+	CONFIG_CACHEFILES_DEBUG=n \
+	CONFIG_CACHEFILES_HISTOGRAM=n
+  FILES:=$(LINUX_DIR)/fs/fscache/fscache.ko
+  AUTOLOAD:=$(call AutoLoad,29,fscache)
 endef
 
-define KernelPackage/fuse/description
- Kernel module for userspace filesystem support
-endef
-
-$(eval $(call KernelPackage,fuse))
+$(eval $(call KernelPackage,fs-fscache))
 
 
 define KernelPackage/fs-hfs
@@ -284,6 +289,21 @@ endef
 $(eval $(call KernelPackage,fs-isofs))
 
 
+define KernelPackage/fs-jfs
+  SUBMENU:=$(FS_MENU)
+  TITLE:=JFS filesystem support
+  KCONFIG:=CONFIG_JFS_FS
+  FILES:=$(LINUX_DIR)/fs/jfs/jfs.ko
+  AUTOLOAD:=$(call AutoLoad,30,jfs,1)
+  $(call AddDepends/nls)
+endef
+
+define KernelPackage/fs-jfs/description
+ Kernel module for JFS support
+endef
+
+$(eval $(call KernelPackage,fs-jfs))
+
 define KernelPackage/fs-minix
   SUBMENU:=$(FS_MENU)
   TITLE:=Minix filesystem support
@@ -335,37 +355,6 @@ endef
 
 $(eval $(call KernelPackage,fs-nfs))
 
-define KernelPackage/fs-nfs-v3
-  SUBMENU:=$(FS_MENU)
-  TITLE:=NFS3 filesystem client support
-  DEPENDS:=+kmod-fs-nfs
-  FILES:= \
-	$(LINUX_DIR)/fs/nfs/nfsv3.ko
-  AUTOLOAD:=$(call AutoLoad,41,nfsv3)
-endef
-
-define KernelPackage/fs-nfs-v3/description
- Kernel module for NFS v3 client support
-endef
-
-$(eval $(call KernelPackage,fs-nfs-v3))
-
-define KernelPackage/fs-nfs-v4
-  SUBMENU:=$(FS_MENU)
-  TITLE:=NFS4 filesystem client support
-  DEPENDS:=+kmod-fs-nfs
-  KCONFIG:= \
-	CONFIG_NFS_V4=y
-  FILES:= \
-	$(LINUX_DIR)/fs/nfs/nfsv4.ko
-  AUTOLOAD:=$(call AutoLoad,41,nfsv4)
-endef
-
-define KernelPackage/fs-nfs-v4/description
- Kernel module for NFS v4 support
-endef
-
-$(eval $(call KernelPackage,fs-nfs-v4))
 
 define KernelPackage/fs-nfs-common
   SUBMENU:=$(FS_MENU)
@@ -413,6 +402,40 @@ endef
 $(eval $(call KernelPackage,fs-nfs-common-rpcsec))
 
 
+define KernelPackage/fs-nfs-v3
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS3 filesystem client support
+  DEPENDS:=+kmod-fs-nfs
+  FILES:= \
+	$(LINUX_DIR)/fs/nfs/nfsv3.ko
+  AUTOLOAD:=$(call AutoLoad,41,nfsv3)
+endef
+
+define KernelPackage/fs-nfs-v3/description
+ Kernel module for NFS v3 client support
+endef
+
+$(eval $(call KernelPackage,fs-nfs-v3))
+
+
+define KernelPackage/fs-nfs-v4
+  SUBMENU:=$(FS_MENU)
+  TITLE:=NFS4 filesystem client support
+  DEPENDS:=+kmod-fs-nfs
+  KCONFIG:= \
+	CONFIG_NFS_V4=y
+  FILES:= \
+	$(LINUX_DIR)/fs/nfs/nfsv4.ko
+  AUTOLOAD:=$(call AutoLoad,41,nfsv4)
+endef
+
+define KernelPackage/fs-nfs-v4/description
+ Kernel module for NFS v4 support
+endef
+
+$(eval $(call KernelPackage,fs-nfs-v4))
+
+
 define KernelPackage/fs-nfsd
   SUBMENU:=$(FS_MENU)
   TITLE:=NFS kernel server support
@@ -532,17 +555,18 @@ endef
 $(eval $(call KernelPackage,fs-xfs))
 
 
-define KernelPackage/fs-jfs
+define KernelPackage/fuse
   SUBMENU:=$(FS_MENU)
-  TITLE:=JFS filesystem support
-  KCONFIG:=CONFIG_JFS_FS
-  FILES:=$(LINUX_DIR)/fs/jfs/jfs.ko
-  AUTOLOAD:=$(call AutoLoad,30,jfs,1)
-  $(call AddDepends/nls)
+  TITLE:=FUSE (Filesystem in Userspace) support
+  KCONFIG:= CONFIG_FUSE_FS
+  FILES:=$(LINUX_DIR)/fs/fuse/fuse.ko
+  AUTOLOAD:=$(call AutoLoad,80,fuse)
 endef
 
-define KernelPackage/fs-jfs/description
- Kernel module for JFS support
+define KernelPackage/fuse/description
+ Kernel module for userspace filesystem support
 endef
 
-$(eval $(call KernelPackage,fs-jfs))
+$(eval $(call KernelPackage,fuse))
+
+
diff --git a/package/kernel/linux/modules/hwmon.mk b/package/kernel/linux/modules/hwmon.mk
index ed05caeb7..e6dfa73de 100644
--- a/package/kernel/linux/modules/hwmon.mk
+++ b/package/kernel/linux/modules/hwmon.mk
@@ -29,21 +29,6 @@ define AddDepends/hwmon
   DEPENDS:=kmod-hwmon-core $(1)
 endef
 
-define KernelPackage/hwmon-vid
-  TITLE:=VID/VRM/VRD voltage conversion module.
-  KCONFIG:=CONFIG_HWMON_VID
-  FILES:=$(LINUX_DIR)/drivers/hwmon/hwmon-vid.ko
-  AUTOLOAD:=$(call AutoLoad,41,hwmon-vid)
-  $(call AddDepends/hwmon,)
-endef
-
-define KernelPackage/hwmon-vid/description
- VID/VRM/VRD voltage conversion module for hardware monitoring
-endef
-
-$(eval $(call KernelPackage,hwmon-vid))
-
-
 define KernelPackage/hwmon-adt7410
   TITLE:=ADT7410 monitoring support
   KCONFIG:= \
@@ -78,6 +63,21 @@ endef
 $(eval $(call KernelPackage,hwmon-adt7475))
 
 
+define KernelPackage/hwmon-gpiofan
+  TITLE:=Generic GPIO FAN support
+  KCONFIG:=CONFIG_SENSORS_GPIO_FAN
+  FILES:=$(LINUX_DIR)/drivers/hwmon/gpio-fan.ko
+  AUTOLOAD:=$(call AutoLoad,60,gpio-fan)
+  $(call AddDepends/hwmon,+kmod-i2c-core +PACKAGE_kmod-thermal:kmod-thermal)
+endef
+
+define KernelPackage/hwmon-gpiofan/description
+  Kernel module for GPIO controlled FANs
+endef
+
+$(eval $(call KernelPackage,hwmon-gpiofan))
+
+
 define KernelPackage/hwmon-ina209
   TITLE:=INA209 monitoring support
   KCONFIG:=CONFIG_SENSORS_INA209
@@ -93,21 +93,6 @@ endef
 $(eval $(call KernelPackage,hwmon-ina209))
 
 
-define KernelPackage/hwmon-nct6775
-  TITLE:=NCT6106D/6775F/6776F/6779D/6791D/6792D/6793D and compatibles monitoring support
-  KCONFIG:=CONFIG_SENSORS_NCT6775
-  FILES:=$(LINUX_DIR)/drivers/hwmon/nct6775.ko
-  AUTOLOAD:=$(call AutoProbe,nct6775)
-  $(call AddDepends/hwmon,@PCI_SUPPORT @TARGET_x86 +kmod-hwmon-vid)
-endef
-
-define KernelPackage/hwmon-nct6775/description
- Kernel module for NCT6106D/6775F/6776F/6779D/6791D/6792D/6793D thermal monitor chip
-endef
-
-$(eval $(call KernelPackage,hwmon-nct6775))
-
-
 define KernelPackage/hwmon-ina2xx
   TITLE:=INA2XX monitoring support
   KCONFIG:=CONFIG_SENSORS_INA2XX
@@ -137,6 +122,7 @@ endef
 
 $(eval $(call KernelPackage,hwmon-it87))
 
+
 define KernelPackage/hwmon-lm63
   TITLE:=LM63/64 monitoring support
   KCONFIG:=CONFIG_SENSORS_LM63
@@ -211,6 +197,7 @@ endef
 
 $(eval $(call KernelPackage,hwmon-lm90))
 
+
 define KernelPackage/hwmon-lm92
   TITLE:=LM92 monitoring support
   KCONFIG:=CONFIG_SENSORS_LM92
@@ -225,6 +212,7 @@ endef
 
 $(eval $(call KernelPackage,hwmon-lm92))
 
+
 define KernelPackage/hwmon-lm95241
   TITLE:=LM95241 monitoring support
   KCONFIG:=CONFIG_SENSORS_LM95241
@@ -239,6 +227,7 @@ endef
 
 $(eval $(call KernelPackage,hwmon-lm95241))
 
+
 define KernelPackage/hwmon-ltc4151
   TITLE:=LTC4151 monitoring support
   KCONFIG:=CONFIG_SENSORS_LTC4151
@@ -253,19 +242,51 @@ endef
 
 $(eval $(call KernelPackage,hwmon-ltc4151))
 
-define KernelPackage/hwmon-sht21
-  TITLE:=Sensiron SHT21 and compat. monitoring support
-  KCONFIG:=CONFIG_SENSORS_SHT21
-  FILES:=$(LINUX_DIR)/drivers/hwmon/sht21.ko
-  AUTOLOAD:=$(call AutoProbe,sht21)
-  $(call AddDepends/hwmon,+kmod-i2c-core)
+
+define KernelPackage/hwmon-nct6775
+  TITLE:=NCT6106D/6775F/6776F/6779D/6791D/6792D/6793D and compatibles monitoring support
+  KCONFIG:=CONFIG_SENSORS_NCT6775
+  FILES:=$(LINUX_DIR)/drivers/hwmon/nct6775.ko
+  AUTOLOAD:=$(call AutoProbe,nct6775)
+  $(call AddDepends/hwmon,@PCI_SUPPORT @TARGET_x86 +kmod-hwmon-vid)
 endef
 
-define KernelPackage/hwmon-sht21/description
- Kernel module for Sensirion SHT21 and SHT25 temperature and humidity sensors chip
+define KernelPackage/hwmon-nct6775/description
+ Kernel module for NCT6106D/6775F/6776F/6779D/6791D/6792D/6793D thermal monitor chip
 endef
 
-$(eval $(call KernelPackage,hwmon-sht21))
+$(eval $(call KernelPackage,hwmon-nct6775))
+
+
+define KernelPackage/hwmon-pc87360
+  TITLE:=PC87360 monitoring support
+  KCONFIG:=CONFIG_SENSORS_PC87360
+  FILES:=$(LINUX_DIR)/drivers/hwmon/pc87360.ko
+  AUTOLOAD:=$(call AutoProbe,pc87360)
+  $(call AddDepends/hwmon,@TARGET_x86 +kmod-hwmon-vid)
+endef
+
+define KernelPackage/hwmon-pc87360/description
+ Kernel modules for PC87360 chips
+endef
+
+$(eval $(call KernelPackage,hwmon-pc87360))
+
+
+define KernelPackage/hwmon-pwmfan
+  TITLE:=Generic PWM FAN support
+  KCONFIG:=CONFIG_SENSORS_PWM_FAN
+  FILES:=$(LINUX_DIR)/drivers/hwmon/pwm-fan.ko
+  AUTOLOAD:=$(call AutoLoad,60,pwm-fan)
+  $(call AddDepends/hwmon, +PACKAGE_kmod-thermal:kmod-thermal)
+endef
+
+define KernelPackage/hwmon-pwmfan/description
+  Kernel module for PWM controlled FANs
+endef
+
+$(eval $(call KernelPackage,hwmon-pwmfan))
+
 
 define KernelPackage/hwmon-sch5627
   TITLE:=SMSC SCH5627 monitoring support
@@ -283,66 +304,20 @@ endef
 
 $(eval $(call KernelPackage,hwmon-sch5627))
 
-define KernelPackage/hwmon-pc87360
-  TITLE:=PC87360 monitoring support
-  KCONFIG:=CONFIG_SENSORS_PC87360
-  FILES:=$(LINUX_DIR)/drivers/hwmon/pc87360.ko
-  AUTOLOAD:=$(call AutoProbe,pc87360)
-  $(call AddDepends/hwmon,@TARGET_x86 +kmod-hwmon-vid)
+
+define KernelPackage/hwmon-sht21
+  TITLE:=Sensiron SHT21 and compat. monitoring support
+  KCONFIG:=CONFIG_SENSORS_SHT21
+  FILES:=$(LINUX_DIR)/drivers/hwmon/sht21.ko
+  AUTOLOAD:=$(call AutoProbe,sht21)
+  $(call AddDepends/hwmon,+kmod-i2c-core)
 endef
 
-define KernelPackage/hwmon-pc87360/description
- Kernel modules for PC87360 chips
+define KernelPackage/hwmon-sht21/description
+ Kernel module for Sensirion SHT21 and SHT25 temperature and humidity sensors chip
 endef
 
-$(eval $(call KernelPackage,hwmon-pc87360))
-
-
-define KernelPackage/hwmon-w83627hf
-  TITLE:=Winbond W83627HF monitoring support
-  KCONFIG:=CONFIG_SENSORS_W83627HF
-  FILES:=$(LINUX_DIR)/drivers/hwmon/w83627hf.ko
-  AUTOLOAD:=$(call AutoLoad,50,w83627hf)
-  $(call AddDepends/hwmon,@TARGET_x86 +kmod-hwmon-vid)
-endef
-
-define KernelPackage/hwmon-w83627hf/description
-  Kernel module for the Winbond W83627HF chips.
-endef
-
-$(eval $(call KernelPackage,hwmon-w83627hf))
-
-
-define KernelPackage/hwmon-w83627ehf
-  TITLE:=Winbond W83627EHF/EHG/DHG/UHG, W83667HG monitoring support
-  KCONFIG:=CONFIG_SENSORS_W83627EHF
-  FILES:=$(LINUX_DIR)/drivers/hwmon/w83627ehf.ko
-  AUTOLOAD:=$(call AutoProbe,w83627ehf)
-  $(call AddDepends/hwmon,@TARGET_x86 +kmod-hwmon-vid)
-endef
-
-define KernelPackage/hwmon-w83627ehf/description
- Kernel module for Winbond W83627EHF/EHG/DHG/UHG and W83667HG thermal monitor chip
- Support for NCT6775F and NCT6776F has been removed from this driver in favour of
- using the nct6775 driver to handle those chips.
-endef
-
-$(eval $(call KernelPackage,hwmon-w83627ehf))
-
-
-define KernelPackage/hwmon-w83793
-  TITLE:=Winbond W83793G/R monitoring support
-  KCONFIG:=CONFIG_SENSORS_W83793
-  FILES:=$(LINUX_DIR)/drivers/hwmon/w83793.ko
-  AUTOLOAD:=$(call AutoProbe,w83793)
-  $(call AddDepends/hwmon,+kmod-i2c-core +kmod-hwmon-vid)
-endef
-
-define KernelPackage/hwmon-w83793/description
-  Kernel module for the Winbond W83793G and W83793R chips.
-endef
-
-$(eval $(call KernelPackage,hwmon-w83793))
+$(eval $(call KernelPackage,hwmon-sht21))
 
 
 define KernelPackage/hwmon-tmp102
@@ -390,31 +365,65 @@ endef
 $(eval $(call KernelPackage,hwmon-tmp421))
 
 
-define KernelPackage/hwmon-gpiofan
-  TITLE:=Generic GPIO FAN support
-  KCONFIG:=CONFIG_SENSORS_GPIO_FAN
-  FILES:=$(LINUX_DIR)/drivers/hwmon/gpio-fan.ko
-  AUTOLOAD:=$(call AutoLoad,60,gpio-fan)
-  $(call AddDepends/hwmon,+kmod-i2c-core +PACKAGE_kmod-thermal:kmod-thermal)
+define KernelPackage/hwmon-vid
+  TITLE:=VID/VRM/VRD voltage conversion module.
+  KCONFIG:=CONFIG_HWMON_VID
+  FILES:=$(LINUX_DIR)/drivers/hwmon/hwmon-vid.ko
+  AUTOLOAD:=$(call AutoLoad,41,hwmon-vid)
+  $(call AddDepends/hwmon,)
 endef
 
-define KernelPackage/hwmon-gpiofan/description
-  Kernel module for GPIO controlled FANs
+define KernelPackage/hwmon-vid/description
+ VID/VRM/VRD voltage conversion module for hardware monitoring
 endef
 
-$(eval $(call KernelPackage,hwmon-gpiofan))
+$(eval $(call KernelPackage,hwmon-vid))
 
 
-define KernelPackage/hwmon-pwmfan
-  TITLE:=Generic PWM FAN support
-  KCONFIG:=CONFIG_SENSORS_PWM_FAN
-  FILES:=$(LINUX_DIR)/drivers/hwmon/pwm-fan.ko
-  AUTOLOAD:=$(call AutoLoad,60,pwm-fan)
-  $(call AddDepends/hwmon, +PACKAGE_kmod-thermal:kmod-thermal)
+define KernelPackage/hwmon-w83627ehf
+  TITLE:=Winbond W83627EHF/EHG/DHG/UHG, W83667HG monitoring support
+  KCONFIG:=CONFIG_SENSORS_W83627EHF
+  FILES:=$(LINUX_DIR)/drivers/hwmon/w83627ehf.ko
+  AUTOLOAD:=$(call AutoProbe,w83627ehf)
+  $(call AddDepends/hwmon,@TARGET_x86 +kmod-hwmon-vid)
 endef
 
-define KernelPackage/hwmon-pwmfan/description
-  Kernel module for PWM controlled FANs
+define KernelPackage/hwmon-w83627ehf/description
+ Kernel module for Winbond W83627EHF/EHG/DHG/UHG and W83667HG thermal monitor chip
+ Support for NCT6775F and NCT6776F has been removed from this driver in favour of
+ using the nct6775 driver to handle those chips.
 endef
 
-$(eval $(call KernelPackage,hwmon-pwmfan))
+$(eval $(call KernelPackage,hwmon-w83627ehf))
+
+
+define KernelPackage/hwmon-w83627hf
+  TITLE:=Winbond W83627HF monitoring support
+  KCONFIG:=CONFIG_SENSORS_W83627HF
+  FILES:=$(LINUX_DIR)/drivers/hwmon/w83627hf.ko
+  AUTOLOAD:=$(call AutoLoad,50,w83627hf)
+  $(call AddDepends/hwmon,@TARGET_x86 +kmod-hwmon-vid)
+endef
+
+define KernelPackage/hwmon-w83627hf/description
+  Kernel module for the Winbond W83627HF chips.
+endef
+
+$(eval $(call KernelPackage,hwmon-w83627hf))
+
+
+define KernelPackage/hwmon-w83793
+  TITLE:=Winbond W83793G/R monitoring support
+  KCONFIG:=CONFIG_SENSORS_W83793
+  FILES:=$(LINUX_DIR)/drivers/hwmon/w83793.ko
+  AUTOLOAD:=$(call AutoProbe,w83793)
+  $(call AddDepends/hwmon,+kmod-i2c-core +kmod-hwmon-vid)
+endef
+
+define KernelPackage/hwmon-w83793/description
+  Kernel module for the Winbond W83793G and W83793R chips.
+endef
+
+$(eval $(call KernelPackage,hwmon-w83793))
+
+
diff --git a/package/kernel/linux/modules/i2c.mk b/package/kernel/linux/modules/i2c.mk
index 14c5b6448..4cf37dae0 100644
--- a/package/kernel/linux/modules/i2c.mk
+++ b/package/kernel/linux/modules/i2c.mk
@@ -24,10 +24,6 @@ I2C_CORE_MODULES:= \
   CONFIG_I2C:drivers/i2c/i2c-core \
   CONFIG_I2C_CHARDEV:drivers/i2c/i2c-dev
 
-ifeq ($(CONFIG_OF),y)
-  I2C_CORE_MODULES+=CONFIG_OF_I2C:drivers/of/of_i2c@lt3.12
-endif
-
 define KernelPackage/i2c-core
   $(call i2c_defaults,$(I2C_CORE_MODULES),51)
   TITLE:=I2C support
@@ -104,43 +100,6 @@ endef
 
 $(eval $(call KernelPackage,i2c-gpio))
 
-I2C_TINY_USB_MODULES:= \
-  CONFIG_I2C_TINY_USB:drivers/i2c/busses/i2c-tiny-usb
-
-define KernelPackage/i2c-tiny-usb
-  $(call i2c_defaults,$(I2C_TINY_USB_MODULES),59)
-  TITLE:=I2C Tiny USB adaptor
-  DEPENDS:=@USB_SUPPORT kmod-i2c-core +kmod-usb-core
-endef
-
-define KernelPackage/i2c-tiny-usb/description
- Kernel module for the I2C Tiny USB adaptor developed
- by Till Harbaum (http://www.harbaum.org/till/i2c_tiny_usb)
-endef
-
-$(eval $(call KernelPackage,i2c-tiny-usb))
-
-
-I2C_PIIX4_MODULES:= \
-  CONFIG_I2C_PIIX4:drivers/i2c/busses/i2c-piix4
-
-define KernelPackage/i2c-piix4
-  $(call i2c_defaults,$(I2C_PIIX4_MODULES),59)
-  TITLE:=Intel PIIX4 and compatible I2C interfaces
-  DEPENDS:=@PCI_SUPPORT @TARGET_x86 kmod-i2c-core
-endef
-
-define KernelPackage/i2c-piix4/description
- Support for the Intel PIIX4 family of mainboard I2C interfaces,
- specifically Intel PIIX4, Intel 440MX, ATI IXP200, ATI IXP300,
- ATI IXP400, ATI SB600, ATI SB700/SP5100, ATI SB800, AMD Hudson-2,
- AMD ML, AMD CZ, Serverworks OSB4, Serverworks CSB5,
- Serverworks CSB6, Serverworks HT-1000, Serverworks HT-1100 and
- SMSC Victory66.
-endef
-
-$(eval $(call KernelPackage,i2c-piix4))
-
 
 I2C_I801_MODULES:= \
   CONFIG_I2C_I801:drivers/i2c/busses/i2c-i801
@@ -167,22 +126,6 @@ endef
 $(eval $(call KernelPackage,i2c-i801))
 
 
-I2C_SMBUS_MODULES:= \
-  CONFIG_I2C_SMBUS:drivers/i2c/i2c-smbus
-
-define KernelPackage/i2c-smbus
-  $(call i2c_defaults,$(I2C_SMBUS_MODULES),58)
-  TITLE:=SMBus-specific protocols helper
-  DEPENDS:=kmod-i2c-core
-endef
-
-define KernelPackage/i2c-smbus/description
- Support for the SMBus extensions to the I2C specification.
-endef
-
-$(eval $(call KernelPackage,i2c-smbus))
-
-
 I2C_MUX_MODULES:= \
   CONFIG_I2C_MUX:drivers/i2c/i2c-mux
 
@@ -213,6 +156,22 @@ endef
 
 $(eval $(call KernelPackage,i2c-mux-gpio))
 
+
+I2C_MUX_PCA9541_MODULES:= \
+  CONFIG_I2C_MUX_PCA9541:drivers/i2c/muxes/i2c-mux-pca9541
+
+define KernelPackage/i2c-mux-pca9541
+  $(call i2c_defaults,$(I2C_MUX_PCA9541_MODULES),51)
+  TITLE:=Philips PCA9541 I2C mux/switches
+  DEPENDS:=kmod-i2c-mux
+endef
+
+define KernelPackage/i2c-mux-pca9541/description
+ Kernel modules for PCA9541 I2C bus mux/switching devices
+endef
+
+$(eval $(call KernelPackage,i2c-mux-pca9541))
+
 I2C_MUX_PCA954x_MODULES:= \
   CONFIG_I2C_MUX_PCA954x:drivers/i2c/muxes/i2c-mux-pca954x
 
@@ -229,17 +188,58 @@ endef
 $(eval $(call KernelPackage,i2c-mux-pca954x))
 
 
-I2C_MUX_PCA9541_MODULES:= \
-  CONFIG_I2C_MUX_PCA9541:drivers/i2c/muxes/i2c-mux-pca9541
+I2C_PIIX4_MODULES:= \
+  CONFIG_I2C_PIIX4:drivers/i2c/busses/i2c-piix4
 
-define KernelPackage/i2c-mux-pca9541
-  $(call i2c_defaults,$(I2C_MUX_PCA9541_MODULES),51)
-  TITLE:=Philips PCA9541 I2C mux/switches
-  DEPENDS:=kmod-i2c-mux
+define KernelPackage/i2c-piix4
+  $(call i2c_defaults,$(I2C_PIIX4_MODULES),59)
+  TITLE:=Intel PIIX4 and compatible I2C interfaces
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86 kmod-i2c-core
 endef
 
-define KernelPackage/i2c-mux-pca9541/description
- Kernel modules for PCA9541 I2C bus mux/switching devices
+define KernelPackage/i2c-piix4/description
+ Support for the Intel PIIX4 family of mainboard I2C interfaces,
+ specifically Intel PIIX4, Intel 440MX, ATI IXP200, ATI IXP300,
+ ATI IXP400, ATI SB600, ATI SB700/SP5100, ATI SB800, AMD Hudson-2,
+ AMD ML, AMD CZ, Serverworks OSB4, Serverworks CSB5,
+ Serverworks CSB6, Serverworks HT-1000, Serverworks HT-1100 and
+ SMSC Victory66.
 endef
 
-$(eval $(call KernelPackage,i2c-mux-pca9541))
+$(eval $(call KernelPackage,i2c-piix4))
+
+
+I2C_SMBUS_MODULES:= \
+  CONFIG_I2C_SMBUS:drivers/i2c/i2c-smbus
+
+define KernelPackage/i2c-smbus
+  $(call i2c_defaults,$(I2C_SMBUS_MODULES),58)
+  TITLE:=SMBus-specific protocols helper
+  DEPENDS:=kmod-i2c-core
+endef
+
+define KernelPackage/i2c-smbus/description
+ Support for the SMBus extensions to the I2C specification.
+endef
+
+$(eval $(call KernelPackage,i2c-smbus))
+
+
+
+I2C_TINY_USB_MODULES:= \
+  CONFIG_I2C_TINY_USB:drivers/i2c/busses/i2c-tiny-usb
+
+define KernelPackage/i2c-tiny-usb
+  $(call i2c_defaults,$(I2C_TINY_USB_MODULES),59)
+  TITLE:=I2C Tiny USB adaptor
+  DEPENDS:=@USB_SUPPORT kmod-i2c-core +kmod-usb-core
+endef
+
+define KernelPackage/i2c-tiny-usb/description
+ Kernel module for the I2C Tiny USB adaptor developed
+ by Till Harbaum (http://www.harbaum.org/till/i2c_tiny_usb)
+endef
+
+$(eval $(call KernelPackage,i2c-tiny-usb))
+
+
diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index 8990e5481..c35ccca1b 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -52,6 +52,21 @@ endef
 
 $(eval $(call KernelPackage,iio-ad799x))
 
+define KernelPackage/iio-mxs-lradc
+  SUBMENU:=$(IIO_MENU)
+  DEPENDS:=@TARGET_mxs +kmod-iio-core
+  TITLE:=Freescale i.MX23/i.MX28 LRADC ADC driver
+  KCONFIG:= \
+	CONFIG_MXS_LRADC_ADC
+  FILES:=$(LINUX_DIR)/drivers/iio/adc/mxs-lradc-adc.ko
+  AUTOLOAD:=$(call AutoLoad,56,mxs-lradc-adc)
+endef
+
+define KernelPackage/iio-mxs-lradc/description
+ Support for Freescale's i.MX23/i.MX28 SoC internal Low-Resolution ADC
+endef
+
+$(eval $(call KernelPackage,iio-mxs-lradc))
 
 define KernelPackage/iio-dht11
   SUBMENU:=$(IIO_MENU)
diff --git a/package/kernel/linux/modules/leds.mk b/package/kernel/linux/modules/leds.mk
index 51002fb3d..7019f0477 100644
--- a/package/kernel/linux/modules/leds.mk
+++ b/package/kernel/linux/modules/leds.mk
@@ -32,7 +32,7 @@ define KernelPackage/ledtrig-heartbeat
   AUTOLOAD:=$(call AutoLoad,50,ledtrig-heartbeat)
 endef
 
-define KernelPackage/ledtrig-gpio/description
+define KernelPackage/ledtrig-heartbeat/description
  Kernel module that allows LEDs to blink like heart beat
 endef
 
diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index a9740ef35..edc982d3c 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -519,9 +519,9 @@ $(eval $(call KernelPackage,e1000e))
 define KernelPackage/igb
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) 82575/82576 PCI-Express Gigabit Ethernet support
-  DEPENDS:=@PCI_SUPPORT +kmod-i2c-core +kmod-i2c-algo-bit +kmod-ptp
+  DEPENDS:=@PCI_SUPPORT +kmod-i2c-core +kmod-i2c-algo-bit +kmod-ptp +kmod-hwmon-core
   KCONFIG:=CONFIG_IGB \
-    CONFIG_IGB_HWMON=n \
+    CONFIG_IGB_HWMON=y \
     CONFIG_IGB_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/igb/igb.ko
   AUTOLOAD:=$(call AutoLoad,35,igb)
@@ -539,7 +539,7 @@ define KernelPackage/igbvf
   TITLE:=Intel(R) 82576 Virtual Function Ethernet support
   DEPENDS:=@PCI_SUPPORT @TARGET_x86 +kmod-i2c-core +kmod-i2c-algo-bit +kmod-ptp
   KCONFIG:=CONFIG_IGBVF \
-    CONFIG_IGB_HWMON=n \
+    CONFIG_IGB_HWMON=y \
     CONFIG_IGB_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/igbvf/igbvf.ko
   AUTOLOAD:=$(call AutoLoad,35,igbvf)
@@ -555,10 +555,10 @@ $(eval $(call KernelPackage,igbvf))
 define KernelPackage/ixgbe
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) 82598/82599 PCI-Express 10 Gigabit Ethernet support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core
   KCONFIG:=CONFIG_IXGBE \
     CONFIG_IXGBE_VXLAN=n \
-    CONFIG_IXGBE_HWMON=n \
+    CONFIG_IXGBE_HWMON=y \
     CONFIG_IXGBE_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
   AUTOLOAD:=$(call AutoLoad,35,ixgbe)
@@ -577,7 +577,7 @@ define KernelPackage/ixgbevf
   DEPENDS:=@PCI_SUPPORT +kmod-ixgbe
   KCONFIG:=CONFIG_IXGBEVF \
     CONFIG_IXGBE_VXLAN=n \
-    CONFIG_IXGBE_HWMON=n \
+    CONFIG_IXGBE_HWMON=y \
     CONFIG_IXGBE_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
   AUTOLOAD:=$(call AutoLoad,35,ixgbevf)
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index f45845750..f296a9096 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -11,13 +11,39 @@ NF_KMOD:=1
 include $(INCLUDE_DIR)/netfilter.mk
 
 
+define KernelPackage/nf-reject
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter IPv4 reject support
+  KCONFIG:= \
+	CONFIG_NETFILTER=y \
+	CONFIG_NETFILTER_ADVANCED=y \
+	$(KCONFIG_NF_REJECT)
+  FILES:=$(foreach mod,$(NF_REJECT-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT-m)))
+endef
+
+$(eval $(call KernelPackage,nf-reject))
+
+
+define KernelPackage/nf-reject6
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter IPv6 reject support
+  KCONFIG:= \
+	CONFIG_NETFILTER=y \
+	CONFIG_NETFILTER_ADVANCED=y \
+	$(KCONFIG_NF_REJECT6)
+  DEPENDS:=@IPV6
+  FILES:=$(foreach mod,$(NF_REJECT6-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT6-m)))
+endef
+
+$(eval $(call KernelPackage,nf-reject6))
+
+
 define KernelPackage/nf-ipt
   SUBMENU:=$(NF_MENU)
   TITLE:=Iptables core
-  KCONFIG:= \
-  	CONFIG_NETFILTER=y \
-	CONFIG_NETFILTER_ADVANCED=y \
-	$(KCONFIG_NF_IPT)
+  KCONFIG:=$(KCONFIG_NF_IPT)
   FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
 endef
@@ -31,7 +57,7 @@ define KernelPackage/nf-ipt6
   KCONFIG:=$(KCONFIG_NF_IPT6)
   FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
-  DEPENDS:=+kmod-nf-ipt +kmod-nf-conntrack6
+  DEPENDS:=+kmod-nf-ipt
 endef
 
 $(eval $(call KernelPackage,nf-ipt6))
@@ -44,7 +70,7 @@ define KernelPackage/ipt-core
   KCONFIG:=$(KCONFIG_IPT_CORE)
   FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
-  DEPENDS:=+kmod-nf-ipt
+  DEPENDS:=+kmod-nf-reject +kmod-nf-ipt
 endef
 
 define KernelPackage/ipt-core/description
@@ -94,7 +120,7 @@ define KernelPackage/nf-nat
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter NAT
   KCONFIG:=$(KCONFIG_NF_NAT)
-  DEPENDS:=+kmod-nf-conntrack +kmod-nf-ipt
+  DEPENDS:=+kmod-nf-conntrack
   FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
 endef
@@ -106,7 +132,7 @@ define KernelPackage/nf-nat6
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter IPV6-NAT
   KCONFIG:=$(KCONFIG_NF_NAT6)
-  DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-ipt6 +kmod-nf-nat
+  DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-nat
   FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
 endef
@@ -114,6 +140,23 @@ endef
 $(eval $(call KernelPackage,nf-nat6))
 
 
+define KernelPackage/nf-flow
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter flowtable support
+  KCONFIG:= \
+	CONFIG_NETFILTER_INGRESS=y \
+	CONFIG_NF_FLOW_TABLE \
+	CONFIG_NF_FLOW_TABLE_HW
+  DEPENDS:=+kmod-nf-conntrack @!LINUX_3_18 @!LINUX_4_4 @!LINUX_4_9
+  FILES:= \
+	$(LINUX_DIR)/net/netfilter/nf_flow_table.ko \
+	$(LINUX_DIR)/net/netfilter/nf_flow_table_hw.ko
+  AUTOLOAD:=$(call AutoProbe,nf_flow_table nf_flow_table_hw)
+endef
+
+$(eval $(call KernelPackage,nf-flow))
+
+
 define AddDepends/ipt
   SUBMENU:=$(NF_MENU)
   DEPENDS+= +kmod-ipt-core $(1)
@@ -161,6 +204,21 @@ endef
 
 $(eval $(call KernelPackage,ipt-conntrack-extra))
 
+define KernelPackage/ipt-conntrack-label
+  TITLE:=Module for handling connection tracking labels
+  KCONFIG:=$(KCONFIG_IPT_CONNTRACK_LABEL)
+  FILES:=$(foreach mod,$(IPT_CONNTRACK_LABEL-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_LABEL-m)))
+  $(call AddDepends/ipt,+kmod-ipt-conntrack)
+endef
+
+define KernelPackage/ipt-conntrack-label/description
+ Netfilter (IPv4) module for handling connection tracking labels
+ Includes:
+ - connlabel
+endef
+
+$(eval $(call KernelPackage,ipt-conntrack-label))
 
 define KernelPackage/ipt-filter
   TITLE:=Modules for packet content inspection
@@ -179,6 +237,17 @@ endef
 $(eval $(call KernelPackage,ipt-filter))
 
 
+define KernelPackage/ipt-offload
+  TITLE:=Netfilter routing/NAT offload support
+  KCONFIG:=CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD
+  FILES:=$(foreach mod,$(IPT_FLOW-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FLOW-m)))
+  $(call AddDepends/ipt,+kmod-nf-flow)
+endef
+
+$(eval $(call KernelPackage,ipt-offload))
+
+
 define KernelPackage/ipt-ipopt
   TITLE:=Modules for matching/changing IP packet options
   KCONFIG:=$(KCONFIG_IPT_IPOPT)
@@ -447,10 +516,9 @@ $(eval $(call KernelPackage,ipt-nfqueue))
 define KernelPackage/ipt-debug
   TITLE:=Module for debugging/development
   KCONFIG:=$(KCONFIG_IPT_DEBUG)
-  DEFAULT:=n
   FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
-  $(call AddDepends/ipt)
+  $(call AddDepends/ipt,+kmod-ipt-raw +IPV6:kmod-ipt-raw6)
 endef
 
 define KernelPackage/ipt-debug/description
@@ -478,7 +546,7 @@ $(eval $(call KernelPackage,ipt-led))
 
 define KernelPackage/ipt-tproxy
   TITLE:=Transparent proxying support
-  DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-ip6tables
+  DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +IPV6:kmod-ip6tables
   KCONFIG:= \
   	CONFIG_NETFILTER_XT_MATCH_SOCKET \
   	CONFIG_NETFILTER_XT_TARGET_TPROXY
@@ -637,7 +705,7 @@ $(eval $(call KernelPackage,ipt-extra))
 define KernelPackage/ip6tables
   SUBMENU:=$(NF_MENU)
   TITLE:=IPv6 modules
-  DEPENDS:=+kmod-nf-ipt6 +kmod-ipt-core +kmod-ipt-conntrack
+  DEPENDS:=+kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
   KCONFIG:=$(KCONFIG_IPT_IPV6)
   FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
@@ -876,16 +944,12 @@ $(eval $(call KernelPackage,ipt-rpfilter))
 define KernelPackage/nft-core
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables support
-  DEPENDS:=+kmod-nfnetlink +kmod-nf-conntrack6 +kmod-nf-ipt +kmod-nf-ipt6
+  DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +kmod-nf-reject6 +kmod-nf-conntrack6
   FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
   KCONFIG:= \
-	CONFIG_NETFILTER=y \
-	CONFIG_NETFILTER_ADVANCED=y \
 	CONFIG_NFT_COMPAT=n \
 	CONFIG_NFT_QUEUE=n \
-	CONFIG_NF_TABLES_ARP=n \
-	CONFIG_NF_TABLES_BRIDGE=n \
 	$(KCONFIG_NFT_CORE)
 endef
 
@@ -896,10 +960,36 @@ endef
 $(eval $(call KernelPackage,nft-core))
 
 
+define KernelPackage/nft-arp
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables ARP table support
+  DEPENDS:=+kmod-nft-core
+  FILES:=$(foreach mod,$(NFT_ARP-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_ARP-m)))
+  KCONFIG:=$(KCONFIG_NFT_ARP)
+endef
+
+$(eval $(call KernelPackage,nft-arp))
+
+
+define KernelPackage/nft-bridge
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables bridge table support
+  DEPENDS:=+kmod-nft-core
+  FILES:=$(foreach mod,$(NFT_BRIDGE-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_BRIDGE-m)))
+  KCONFIG:= \
+	CONFIG_NF_LOG_BRIDGE=n \
+	$(KCONFIG_NFT_BRIDGE)
+endef
+
+$(eval $(call KernelPackage,nft-bridge))
+
+
 define KernelPackage/nft-nat
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables NAT support
-  DEPENDS:=+kmod-nft-core +kmod-nf-nat +kmod-nf-nat6
+  DEPENDS:=+kmod-nft-core +kmod-nf-nat
   FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
   KCONFIG:=$(KCONFIG_NFT_NAT)
@@ -908,14 +998,33 @@ endef
 $(eval $(call KernelPackage,nft-nat))
 
 
+define KernelPackage/nft-offload
+  SUBMENU:=$(NF_MENU)
+  TITLE:=Netfilter nf_tables routing/NAT offload support
+  DEPENDS:=+kmod-nf-flow +kmod-nft-nat
+  KCONFIG:= \
+	CONFIG_NF_FLOW_TABLE_INET \
+	CONFIG_NF_FLOW_TABLE_IPV4 \
+	CONFIG_NF_FLOW_TABLE_IPV6 \
+	CONFIG_NFT_FLOW_OFFLOAD
+  FILES:= \
+	$(LINUX_DIR)/net/netfilter/nf_flow_table_inet.ko \
+	$(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko \
+	$(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko \
+	$(LINUX_DIR)/net/netfilter/nft_flow_offload.ko
+  AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4 nf_flow_table_ipv6 nft_flow_offload)
+endef
+
+$(eval $(call KernelPackage,nft-offload))
+
+
 define KernelPackage/nft-nat6
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables IPv6-NAT support
-  DEPENDS:=+kmod-nft-core +kmod-nf-nat6
+  DEPENDS:=+kmod-nft-nat +kmod-nf-nat6
   FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
   KCONFIG:=$(KCONFIG_NFT_NAT6)
 endef
 
 $(eval $(call KernelPackage,nft-nat6))
-
diff --git a/package/kernel/linux/modules/netsupport.mk b/package/kernel/linux/modules/netsupport.mk
index c63ab2b6d..ff7672063 100644
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@@ -42,28 +42,6 @@ endef
 $(eval $(call KernelPackage,atmtcp))
 
 
-define KernelPackage/appletalk
-  SUBMENU:=$(NETWORK_SUPPORT_MENU)
-  TITLE:=Appletalk protocol support
-  KCONFIG:= \
-	CONFIG_ATALK \
-	CONFIG_DEV_APPLETALK \
-	CONFIG_IPDDP \
-	CONFIG_IPDDP_ENCAP=y \
-	CONFIG_IPDDP_DECAP=y
-  FILES:= \
-	$(LINUX_DIR)/net/appletalk/appletalk.ko \
-	$(LINUX_DIR)/drivers/net/appletalk/ipddp.ko
-  AUTOLOAD:=$(call AutoLoad,40,appletalk ipddp)
-endef
-
-define KernelPackage/appletalk/description
- Kernel module for AppleTalk protocol.
-endef
-
-$(eval $(call KernelPackage,appletalk))
-
-
 define KernelPackage/bonding
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Ethernet bonding driver
@@ -127,13 +105,14 @@ endef
 
 $(eval $(call KernelPackage,vxlan))
 
+
 define KernelPackage/geneve
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Generic Network Virtualization Encapsulation (Geneve) support
   DEPENDS:= \
-	kmod-iptunnel \
-	kmod-udptunnel4 \
-	IPV6:kmod-udptunnel6
+	+kmod-iptunnel \
+	+kmod-udptunnel4 \
+	+IPV6:kmod-udptunnel6
   KCONFIG:=CONFIG_GENEVE
   FILES:= \
 	$(LINUX_DIR)/net/ipv4/geneve.ko@le4.1 \
@@ -148,6 +127,7 @@ endef
 
 $(eval $(call KernelPackage,geneve))
 
+
 define KernelPackage/capi
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=CAPI (ISDN) Support
@@ -455,6 +435,28 @@ endef
 $(eval $(call KernelPackage,sit))
 
 
+define KernelPackage/fou
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=FOU and GUE decapsulation
+  DEPENDS:= \
+	+kmod-iptunnel \
+	+kmod-udptunnel4 \
+	+IPV6:kmod-udptunnel6
+  KCONFIG:= \
+	CONFIG_NET_FOU \
+	CONFIG_NET_FOU_IP_TUNNELS=y
+  FILES:=$(LINUX_DIR)/net/ipv4/fou.ko
+  AUTOLOAD:=$(call AutoProbe,fou)
+endef
+
+define KernelPackage/fou/description
+ Kernel module for FOU (Foo over UDP) and GUE (Generic UDP Encapsulation) tunnelling.
+ Requires Kernel 3.18 or newer.
+endef
+
+$(eval $(call KernelPackage,fou))
+
+
 define KernelPackage/ip6-tunnel
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=IP-in-IPv6 tunnelling
@@ -750,6 +752,7 @@ define KernelPackage/sched
 	CONFIG_NET_SCH_DSMARK \
 	CONFIG_NET_SCH_FIFO \
 	CONFIG_NET_SCH_GRED \
+	CONFIG_NET_SCH_MULTIQ \
 	CONFIG_NET_SCH_PRIO \
 	CONFIG_NET_SCH_RED \
 	CONFIG_NET_SCH_SFQ \
diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index 973e4f3e2..4aee820c9 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -55,6 +55,7 @@ define KernelPackage/bluetooth
 	CONFIG_BT_HCIUART_BCM=n \
 	CONFIG_BT_HCIUART_INTEL=n \
 	CONFIG_BT_HCIUART_H4 \
+	CONFIG_BT_HCIUART_NOKIA=n \
 	CONFIG_BT_HIDP \
 	CONFIG_HID_SUPPORT=y
   $(call AddDepends/rfkill)
@@ -226,7 +227,7 @@ $(eval $(call KernelPackage,gpio-dev))
 define KernelPackage/gpio-mcp23s08
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Microchip MCP23xxx I/O expander
-  DEPENDS:=@GPIO_SUPPORT +PACKAGE_kmod-i2c-core:kmod-i2c-core
+  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core
   KCONFIG:=CONFIG_GPIO_MCP23S08
   FILES:=$(LINUX_DIR)/drivers/gpio/gpio-mcp23s08.ko
   AUTOLOAD:=$(call AutoLoad,40,gpio-mcp23s08)
@@ -285,18 +286,53 @@ endef
 $(eval $(call KernelPackage,gpio-pcf857x))
 
 
-define KernelPackage/lp
+define KernelPackage/ppdev
   SUBMENU:=$(OTHER_MENU)
-  TITLE:=Parallel port and line printer support
+  TITLE:=Parallel port support
   KCONFIG:= \
 	CONFIG_PARPORT \
-	CONFIG_PRINTER \
 	CONFIG_PPDEV
   FILES:= \
 	$(LINUX_DIR)/drivers/parport/parport.ko \
-	$(LINUX_DIR)/drivers/char/lp.ko \
 	$(LINUX_DIR)/drivers/char/ppdev.ko
-  AUTOLOAD:=$(call AutoLoad,50,parport lp ppdev)
+  AUTOLOAD:=$(call AutoLoad,50,parport ppdev)
+endef
+
+$(eval $(call KernelPackage,ppdev))
+
+
+define KernelPackage/parport-pc
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Parallel port interface (PC-style) support
+  DEPENDS:=+kmod-ppdev
+  KCONFIG:= \
+	CONFIG_KS0108=n \
+	CONFIG_PARPORT_PC \
+	CONFIG_PARPORT_1284=y \
+	CONFIG_PARPORT_PC_FIFO=y \
+	CONFIG_PARPORT_PC_PCMCIA=n \
+	CONFIG_PARPORT_PC_SUPERIO=y \
+	CONFIG_PARPORT_SERIAL=n \
+	CONFIG_PARIDE=n \
+	CONFIG_SCSI_IMM=n \
+	CONFIG_SCSI_PPA=n
+  FILES:= \
+	$(LINUX_DIR)/drivers/parport/parport_pc.ko
+  AUTOLOAD:=$(call AutoLoad,51,parport_pc)
+endef
+
+$(eval $(call KernelPackage,parport-pc))
+
+
+define KernelPackage/lp
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Parallel port line printer device support
+  DEPENDS:=+kmod-ppdev
+  KCONFIG:= \
+	CONFIG_PRINTER
+  FILES:= \
+	$(LINUX_DIR)/drivers/char/lp.ko
+  AUTOLOAD:=$(call AutoLoad,52,lp)
 endef
 
 $(eval $(call KernelPackage,lp))
@@ -619,6 +655,22 @@ endef
 $(eval $(call KernelPackage,mtdoops))
 
 
+define KernelPackage/mtdram
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Test MTD driver using RAM
+  KCONFIG:=CONFIG_MTD_MTDRAM \
+    CONFIG_MTDRAM_TOTAL_SIZE=4096 \
+    CONFIG_MTDRAM_ERASE_SIZE=128
+  FILES:=$(LINUX_DIR)/drivers/mtd/devices/mtdram.ko
+endef
+
+define KernelPackage/mtdram/description
+  Test MTD driver using RAM
+endef
+
+$(eval $(call KernelPackage,mtdram))
+
+
 define KernelPackage/serial-8250
   SUBMENU:=$(OTHER_MENU)
   TITLE:=8250 UARTs
diff --git a/package/kernel/linux/modules/sound.mk b/package/kernel/linux/modules/sound.mk
index faee1f367..177140e0f 100644
--- a/package/kernel/linux/modules/sound.mk
+++ b/package/kernel/linux/modules/sound.mk
@@ -135,6 +135,22 @@ endef
 $(eval $(call KernelPackage,sound-seq))
 
 
+define KernelPackage/sound-ens1371
+  TITLE:=(Creative) Ensoniq AudioPCI 1371
+  KCONFIG:=CONFIG_SND_ENS1371
+  DEPENDS:=@PCI_SUPPORT +kmod-ac97
+  FILES:=$(LINUX_DIR)/sound/pci/snd-ens1371.ko
+  AUTOLOAD:=$(call AutoLoad,36,snd-ens1371)
+  $(call AddDepends/sound)
+endef
+
+define KernelPackage/sound-ens1371/description
+ support for (Creative) Ensoniq AudioPCI 1371 chips
+endef
+
+$(eval $(call KernelPackage,sound-ens1371))
+
+
 define KernelPackage/sound-i8x0
   TITLE:=Intel/SiS/nVidia/AMD/ALi AC97 Controller
   DEPENDS:=+kmod-ac97
diff --git a/package/kernel/linux/modules/spi.mk b/package/kernel/linux/modules/spi.mk
index 1c2a789fe..01dc7dc7e 100644
--- a/package/kernel/linux/modules/spi.mk
+++ b/package/kernel/linux/modules/spi.mk
@@ -43,22 +43,6 @@ endef
 $(eval $(call KernelPackage,spi-bitbang))
 
 
-define KernelPackage/spi-gpio-old
-  SUBMENU:=$(SPI_MENU)
-  TITLE:=Old GPIO based bitbanging SPI controller (DEPRECATED)
-  DEPENDS:=@GPIO_SUPPORT +kmod-spi-bitbang
-  KCONFIG:=CONFIG_SPI_GPIO_OLD
-  FILES:=$(LINUX_DIR)/drivers/spi/spi_gpio_old.ko
-  AUTOLOAD:=$(call AutoProbe,spi_gpio_old)
-endef
-
-define KernelPackage/spi-gpio-old/description
- This package contains the GPIO based bitbanging SPI controller driver
-endef
-
-$(eval $(call KernelPackage,spi-gpio-old))
-
-
 define KernelPackage/spi-gpio
   SUBMENU:=$(SPI_MENU)
   TITLE:=GPIO-based bitbanging SPI Master
diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index 7db23862b..be638520a 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -64,19 +64,6 @@ define KernelPackage/usb-phy-nop
   $(call AddDepends/usb)
 endef
 
-define KernelPackage/usb-musb-tusb6010
-  TITLE:=Support for TUSB 6010
-  KCONFIG:=CONFIG_USB_MUSB_TUSB6010
-  DEPENDS:=@TARGET_omap24xx
-  $(call AddDepends/usb)
-endef
-
-define KernelPackage/usb-musb-tusb6010/description
-  TUSB6010 support
-endef
-
-$(eval $(call KernelPackage,usb-musb-tusb6010))
-
 define KernelPackage/usb-phy-nop/description
   Support for USB NOP transceiver
 endef
@@ -84,6 +71,25 @@ endef
 $(eval $(call KernelPackage,usb-phy-nop))
 
 
+define KernelPackage/usb-phy-qcom-dwc3
+  TITLE:=DWC3 USB QCOM PHY driver
+  DEPENDS:=@TARGET_ipq40xx||@TARGET_ipq806x +kmod-usb-dwc3-of-simple
+  KCONFIG:= CONFIG_PHY_QCOM_DWC3
+  FILES:= \
+    $(LINUX_DIR)/drivers/phy/phy-qcom-dwc3.ko@lt4.13 \
+    $(LINUX_DIR)/drivers/phy/qualcomm/phy-qcom-dwc3.ko@ge4.13
+  AUTOLOAD:=$(call AutoLoad,45,phy-qcom-dwc3,1)
+  $(call AddDepends/usb)
+endef
+
+define KernelPackage/usb-phy-qcom-dwc3/description
+ This driver provides support for the integrated DesignWare
+ USB3 IP Core within the QCOM SoCs.
+endef
+
+$(eval $(call KernelPackage,usb-phy-qcom-dwc3))
+
+
 define KernelPackage/usb-gadget
   TITLE:=USB Gadget support
   KCONFIG:=CONFIG_USB_GADGET
@@ -200,6 +206,7 @@ $(eval $(call KernelPackage,usb-gadget-mass-storage))
 define KernelPackage/usb-uhci
   TITLE:=Support for UHCI controllers
   KCONFIG:= \
+	CONFIG_USB_PCI=y \
 	CONFIG_USB_UHCI_ALT \
 	CONFIG_USB_UHCI_HCD
   FILES:=$(LINUX_DIR)/drivers/usb/host/uhci-hcd.ko
@@ -249,7 +256,9 @@ $(eval $(call KernelPackage,usb-ohci,1))
 define KernelPackage/usb-ohci-pci
   TITLE:=Support for PCI OHCI controllers
   DEPENDS:=@PCI_SUPPORT +kmod-usb-ohci
-  KCONFIG:=CONFIG_USB_OHCI_HCD_PCI
+  KCONFIG:= \
+	CONFIG_USB_PCI=y \
+	CONFIG_USB_OHCI_HCD_PCI
   FILES:=$(LINUX_DIR)/drivers/usb/host/ohci-pci.ko
   AUTOLOAD:=$(call AutoLoad,51,ohci-pci,1)
   $(call AddDepends/usb)
@@ -337,7 +346,9 @@ $(eval $(call KernelPackage,usb2))
 define KernelPackage/usb2-pci
   TITLE:=Support for PCI USB2 controllers
   DEPENDS:=@PCI_SUPPORT +kmod-usb2
-  KCONFIG:=CONFIG_USB_EHCI_PCI
+  KCONFIG:= \
+	CONFIG_USB_PCI=y \
+	CONFIG_USB_EHCI_PCI
   FILES:=$(LINUX_DIR)/drivers/usb/host/ehci-pci.ko
   AUTOLOAD:=$(call AutoLoad,42,ehci-pci,1)
   $(call AddDepends/usb)
@@ -354,6 +365,7 @@ define KernelPackage/usb-dwc2
   TITLE:=DWC2 USB controller driver
   DEPENDS:=+USB_GADGET_SUPPORT:kmod-usb-gadget
   KCONFIG:= \
+	CONFIG_USB_PCI=y \
 	CONFIG_USB_DWC2 \
 	CONFIG_USB_DWC2_PCI \
 	CONFIG_USB_DWC2_PLATFORM \
@@ -398,6 +410,23 @@ endef
 $(eval $(call KernelPackage,usb-dwc3))
 
 
+define KernelPackage/usb-dwc3-of-simple
+  TITLE:=DWC3 USB simple OF driver
+  DEPENDS:=@TARGET_ipq40xx||@TARGET_ipq806x +kmod-usb-dwc3
+  KCONFIG:= CONFIG_USB_DWC3_OF_SIMPLE
+  FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-of-simple.ko
+  AUTOLOAD:=$(call AutoLoad,53,dwc3-of-simple,1)
+  $(call AddDepends/usb)
+endef
+
+define KernelPackage/usb-dwc3-of-simple/description
+ This driver provides generic platform glue for the integrated DesignWare
+ USB3 IP Core.
+endef
+
+
+$(eval $(call KernelPackage,usb-dwc3-of-simple))
+
 define KernelPackage/usb-acm
   TITLE:=Support for modems/isdn controllers
   KCONFIG:=CONFIG_USB_ACM
@@ -1512,6 +1541,7 @@ define KernelPackage/usb3
 	+TARGET_bcm53xx:kmod-usb-bcma \
 	+TARGET_bcm53xx:kmod-phy-bcm-ns-usb3
   KCONFIG:= \
+	CONFIG_USB_PCI=y \
 	CONFIG_USB_XHCI_HCD \
 	CONFIG_USB_XHCI_PCI \
 	CONFIG_USB_XHCI_PLATFORM \
@@ -1533,7 +1563,9 @@ $(eval $(call KernelPackage,usb3))
 
 define KernelPackage/usb-net2280
   TITLE:=Support for NetChip 228x PCI USB peripheral controller
-  KCONFIG:= CONFIG_USB_NET2280
+  KCONFIG:= \
+	CONFIG_USB_PCI=y \
+	CONFIG_USB_NET2280
   DEPENDS:=@PCI_SUPPORT +kmod-usb-gadget
   FILES:=$(LINUX_DIR)/drivers/usb/gadget/udc/net2280.ko
   AUTOLOAD:=$(call AutoLoad,46,net2280)
diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 8f0f0dc9e..f76618055 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -204,6 +204,7 @@ define KernelPackage/drm-imx
   DEPENDS:=@TARGET_imx6 +kmod-drm +kmod-fb +kmod-fb-cfb-copyarea +kmod-fb-cfb-imgblt +kmod-fb-cfb-fillrect +kmod-fb-sys-fops
   KCONFIG:=CONFIG_DRM_IMX \
 	CONFIG_DRM_FBDEV_EMULATION=y \
+	CONFIG_DRM_FBDEV_OVERALLOC=100 \
 	CONFIG_IMX_IPUV3_CORE \
 	CONFIG_RESET_CONTROLLER=y \
 	CONFIG_DRM_IMX_IPUV3 \
@@ -223,7 +224,6 @@ define KernelPackage/drm-imx
   FILES:= \
 	$(LINUX_DIR)/drivers/gpu/drm/imx/imxdrm.ko \
 	$(LINUX_DIR)/drivers/gpu/ipu-v3/imx-ipu-v3.ko \
-	$(LINUX_DIR)/drivers/gpu/drm/imx/imx-ipuv3-crtc.ko \
 	$(LINUX_DIR)/drivers/video/fbdev/core/syscopyarea.ko \
 	$(LINUX_DIR)/drivers/video/fbdev/core/sysfillrect.ko \
 	$(LINUX_DIR)/drivers/video/fbdev/core/sysimgblt.ko \
@@ -242,10 +242,11 @@ define KernelPackage/drm-imx-hdmi
   TITLE:=Freescale i.MX HDMI DRM support
   DEPENDS:=+kmod-sound-core kmod-drm-imx
   KCONFIG:=CONFIG_DRM_IMX_HDMI \
-	CONFIG_DRM_DW_HDMI_AHB_AUDIO
+	CONFIG_DRM_DW_HDMI_AHB_AUDIO \
+	CONFIG_DRM_DW_HDMI_I2S_AUDIO
   FILES:= \
-	$(LINUX_DIR)/drivers/gpu/drm/bridge/dw-hdmi.ko \
-	$(LINUX_DIR)/drivers/gpu/drm/bridge/dw-hdmi-ahb-audio.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/bridge/synopsys/dw-hdmi.ko \
+	$(LINUX_DIR)/drivers/gpu/drm/bridge/synopsys/dw-hdmi-ahb-audio.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/imx/dw_hdmi-imx.ko
   AUTOLOAD:=$(call AutoLoad,05,dw-hdmi dw-hdmi-ahb-audio.ko dw_hdmi-imx)
 endef
@@ -267,7 +268,9 @@ define KernelPackage/drm-imx-ldb
 	CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0=n \
 	CONFIG_DRM_PANEL_LG_LG4573=n \
 	CONFIG_DRM_PANEL_LD9040=n \
-	CONFIG_DRM_PANEL_S6E8AA0=n
+	CONFIG_DRM_PANEL_LVDS=n \
+	CONFIG_DRM_PANEL_S6E8AA0=n \
+	CONFIG_DRM_PANEL_SITRONIX_ST7789V=n
   FILES:=$(LINUX_DIR)/drivers/gpu/drm/imx/imx-ldb.ko \
 	$(LINUX_DIR)/drivers/gpu/drm/panel/panel-simple.ko
   AUTOLOAD:=$(call AutoLoad,05,imx-ldb)
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index cf17c9f4f..22ed84139 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=mac80211
 
 PKG_VERSION:=2017-11-01
-PKG_RELEASE:=2
+PKG_RELEASE:=4
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 PKG_HASH:=8437ab7886b988c8152e7a4db30b7f41009e49a3b2cb863edd05da1ecd7eb05a
 
@@ -1584,7 +1584,7 @@ config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
 config-$(call config_package,ath9k) += ATH9K
 config-$(call config_package,ath9k-common) += ATH9K_COMMON
 config-$(CONFIG_TARGET_ar71xx) += ATH9K_AHB
-config-$(CONFIG_TARGET_ipq806x) += ATH10K_AHB
+config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
 config-$(CONFIG_PCI) += ATH9K_PCI
 config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
 config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
@@ -1821,7 +1821,7 @@ define KernelPackage/cfg80211/install
 	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
 	$(INSTALL_BIN) ./files/lib/netifd/wireless/mac80211.sh $(1)/lib/netifd/wireless
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/ieee80211
-	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/00-wifi-detect
+	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/10-wifi-detect
 endef
 
 define KernelPackage/ipw2100/install
diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
index cdc155405..bf9d52ae4 100644
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -629,17 +629,11 @@ mac80211_setup_vif() {
 
 	case "$mode" in
 		mesh)
-			# authsae or wpa_supplicant
 			json_get_vars key
 			if [ -n "$key" ]; then
-				if [ -e "/lib/wifi/authsae.sh" ]; then
-					. /lib/wifi/authsae.sh
-					authsae_start_interface || failed=1
-				else
-					wireless_vif_parse_encryption
-					freq="$(get_freq "$phy" "$channel")"
-					mac80211_setup_supplicant_noctl || failed=1
-				fi
+				wireless_vif_parse_encryption
+				freq="$(get_freq "$phy" "$channel")"
+				mac80211_setup_supplicant_noctl || failed=1
 			else
 				json_get_vars mesh_id mcast_rate
 
diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
index 354077733..22a00a592 100644
--- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
@@ -116,7 +116,7 @@ detect_mac80211() {
 			set wireless.radio${devidx}.hwmode=11${mode_band}
 			${dev_id}
 			${ht_capab}
-			set wireless.radio${devidx}.disabled=1
+			set wireless.radio${devidx}.disabled=0
 
 			set wireless.default_radio${devidx}=wifi-iface
 			set wireless.default_radio${devidx}.device=radio${devidx}
diff --git a/package/kernel/mac80211/patches/937-ath10k-calibration-variant.patch b/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
similarity index 100%
rename from package/kernel/mac80211/patches/937-ath10k-calibration-variant.patch
rename to package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
diff --git a/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch b/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
new file mode 100644
index 000000000..cac396aec
--- /dev/null
+++ b/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
@@ -0,0 +1,237 @@
+From: Thomas Hebb <tommyhebb@gmail.com>
+Subject: [PATCH] ath10k: search all IEs for variant before falling back
+Date: Wed, 21 Feb 2018 11:43:39 -0500
+
+commit f2593cb1b291 ("ath10k: Search SMBIOS for OEM board file
+extension") added a feature to ath10k that allows Board Data File
+(BDF) conflicts between multiple devices that use the same device IDs
+but have different calibration requirements to be resolved by allowing
+a "variant" string to be stored in SMBIOS [and later device tree, added
+by commit d06f26c5c8a4 ("ath10k: search DT for qcom,ath10k-calibration-
+variant")] that gets appended to the ID stored in board-2.bin.
+
+This original patch had a regression, however. Namely that devices with
+a variant present in SMBIOS that didn't need custom BDFs could no longer
+find the default BDF, which has no variant appended. The patch was
+reverted and re-applied with a fix for this issue in commit 1657b8f84ed9
+("search SMBIOS for OEM board file extension").
+
+But the fix to fall back to a default BDF introduced another issue: the
+driver currently parses IEs in board-2.bin one by one, and for each one
+it first checks to see if it matches the ID with the variant appended.
+If it doesn't, it checks to see if it matches the "fallback" ID with no
+variant. If a matching BDF is found at any point during this search, the
+search is terminated and that BDF is used. The issue is that it's very
+possible (and is currently the case for board-2.bin files present in the
+ath10k-firmware repository) for the default BDF to occur in an earlier
+IE than the variant-specific BDF. In this case, the current code will
+happily choose the default BDF even though a better-matching BDF is
+present later in the file.
+
+This patch fixes the issue by first searching the entire file for the ID
+with variant, and searching for the fallback ID only if that search
+fails. It also includes some code cleanup in the area, as
+ath10k_core_fetch_board_data_api_n() no longer does its own string
+mangling to remove the variant from an ID, instead leaving that job to a
+new flag passed to ath10k_core_create_board_name().
+
+I've tested this patch on a QCA4019 and verified that the driver behaves
+correctly for 1) both fallback and variant BDFs present, 2) only fallback
+BDF present, and 3) no matching BDFs present.
+
+Fixes: 1657b8f84ed9 ("ath10k: search SMBIOS for OEM board file extension")
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 134 ++++++++++++++++++---------------
+ 1 file changed, 72 insertions(+), 62 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1129,14 +1129,61 @@ out:
+ 	return ret;
+ }
+ 
++static int ath10k_core_search_bd(struct ath10k *ar,
++				 const char *boardname,
++				 const u8 *data,
++				 size_t len)
++{
++	size_t ie_len;
++	struct ath10k_fw_ie *hdr;
++	int ret = -ENOENT, ie_id;
++
++	while (len > sizeof(struct ath10k_fw_ie)) {
++		hdr = (struct ath10k_fw_ie *)data;
++		ie_id = le32_to_cpu(hdr->id);
++		ie_len = le32_to_cpu(hdr->len);
++
++		len -= sizeof(*hdr);
++		data = hdr->data;
++
++		if (len < ALIGN(ie_len, 4)) {
++			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
++				   ie_id, ie_len, len);
++			return -EINVAL;
++		}
++
++		switch (ie_id) {
++		case ATH10K_BD_IE_BOARD:
++			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
++							    boardname);
++			if (ret == -ENOENT)
++				/* no match found, continue */
++				break;
++
++			/* either found or error, so stop searching */
++			goto out;
++		}
++
++		/* jump over the padding */
++		ie_len = ALIGN(ie_len, 4);
++
++		len -= ie_len;
++		data += ie_len;
++	}
++
++out:
++	/* return result of parse_bd_ie_board() or -ENOENT */
++	return ret;
++}
++
+ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
+ 					      const char *boardname,
++					      const char *fallback_boardname,
+ 					      const char *filename)
+ {
+-	size_t len, magic_len, ie_len;
+-	struct ath10k_fw_ie *hdr;
++	size_t len, magic_len;
+ 	const u8 *data;
+-	int ret, ie_id;
++	int ret;
+ 
+ 	ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
+ 							ar->hw_params.fw.dir,
+@@ -1174,69 +1221,23 @@ static int ath10k_core_fetch_board_data_
+ 	data += magic_len;
+ 	len -= magic_len;
+ 
+-	while (len > sizeof(struct ath10k_fw_ie)) {
+-		hdr = (struct ath10k_fw_ie *)data;
+-		ie_id = le32_to_cpu(hdr->id);
+-		ie_len = le32_to_cpu(hdr->len);
+-
+-		len -= sizeof(*hdr);
+-		data = hdr->data;
+-
+-		if (len < ALIGN(ie_len, 4)) {
+-			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
+-				   ie_id, ie_len, len);
+-			ret = -EINVAL;
+-			goto err;
+-		}
++	/* attempt to find boardname in the IE list */
++	ret = ath10k_core_search_bd(ar, boardname, data, len);
+ 
+-		switch (ie_id) {
+-		case ATH10K_BD_IE_BOARD:
+-			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
+-							    boardname);
+-			if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') {
+-				/* try default bdf if variant was not found */
+-				char *s, *v = ",variant=";
+-				char boardname2[100];
+-
+-				strlcpy(boardname2, boardname,
+-					sizeof(boardname2));
+-
+-				s = strstr(boardname2, v);
+-				if (s)
+-					*s = '\0';  /* strip ",variant=%s" */
+-
+-				ret = ath10k_core_parse_bd_ie_board(ar, data,
+-								    ie_len,
+-								    boardname2);
+-			}
++	/* if we didn't find it and have a fallback name, try that */
++	if (ret == -ENOENT && fallback_boardname)
++		ret = ath10k_core_search_bd(ar, fallback_boardname, data, len);
+ 
+-			if (ret == -ENOENT)
+-				/* no match found, continue */
+-				break;
+-			else if (ret)
+-				/* there was an error, bail out */
+-				goto err;
+-
+-			/* board data found */
+-			goto out;
+-		}
+-
+-		/* jump over the padding */
+-		ie_len = ALIGN(ie_len, 4);
+-
+-		len -= ie_len;
+-		data += ie_len;
+-	}
+-
+-out:
+-	if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) {
++	if (ret == -ENOENT) {
+ 		ath10k_err(ar,
+ 			   "failed to fetch board data for %s from %s/%s\n",
+ 			   boardname, ar->hw_params.fw.dir, filename);
+ 		ret = -ENODATA;
+-		goto err;
+ 	}
+ 
++	if (ret)
++		goto err;
++
+ 	return 0;
+ 
+ err:
+@@ -1245,12 +1246,12 @@ err:
+ }
+ 
+ static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
+-					 size_t name_len)
++					 size_t name_len, bool with_variant)
+ {
+ 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
+ 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
+ 
+-	if (ar->id.bdf_ext[0] != '\0')
++	if (with_variant && ar->id.bdf_ext[0] != '\0')
+ 		scnprintf(variant, sizeof(variant), ",variant=%s",
+ 			  ar->id.bdf_ext);
+ 
+@@ -1276,17 +1277,26 @@ out:
+ 
+ static int ath10k_core_fetch_board_file(struct ath10k *ar)
+ {
+-	char boardname[100];
++	char boardname[100], fallback_boardname[100];
+ 	int ret;
+ 
+-	ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname));
++	ret = ath10k_core_create_board_name(ar, boardname,
++					    sizeof(boardname), true);
+ 	if (ret) {
+ 		ath10k_err(ar, "failed to create board name: %d", ret);
+ 		return ret;
+ 	}
+ 
++	ret = ath10k_core_create_board_name(ar, fallback_boardname,
++					    sizeof(boardname), false);
++	if (ret) {
++		ath10k_err(ar, "failed to create fallback board name: %d", ret);
++		return ret;
++	}
++
+ 	ar->bd_api = 2;
+ 	ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
++						 fallback_boardname,
+ 						 ATH10K_BOARD_API2_FILE);
+ 	if (!ret)
+ 		goto success;
diff --git a/package/kernel/mac80211/patches/318-ath10k-fix-build-errors-with-CONFIG_PM.patch b/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
similarity index 100%
rename from package/kernel/mac80211/patches/318-ath10k-fix-build-errors-with-CONFIG_PM.patch
rename to package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
diff --git a/package/kernel/mac80211/patches/320-mac80211-properly-free-requested-but-not-started-TX-.patch b/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/320-mac80211-properly-free-requested-but-not-started-TX-.patch
rename to package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
diff --git a/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch b/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
new file mode 100644
index 000000000..839e92788
--- /dev/null
+++ b/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
@@ -0,0 +1,25 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 4 Jan 2018 15:51:53 +0100
+Subject: [PATCH] mac80211: mesh: drop frames appearing to be from us
+
+If there are multiple mesh stations with the same MAC address,
+they will both get confused and start throwing warnings.
+
+Obviously in this case nothing can actually work anyway, so just
+drop frames that look like they're from ourselves early on.
+
+Reported-by: Gui Iribarren <gui@altermundi.net>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc
+ 		}
+ 		return true;
+ 	case NL80211_IFTYPE_MESH_POINT:
++		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
++			return false;
+ 		if (multicast)
+ 			return true;
+ 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch b/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
new file mode 100644
index 000000000..b8f3be1c8
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
@@ -0,0 +1,60 @@
+From 2fd3877b5bb7d39782c3205a1dcda02023b8514a Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:31 +0100
+Subject: [PATCH] brcmfmac: handle FWHALT mailbox indication
+
+The firmware uses a mailbox to communicate to the host what is going
+on. In the driver we validate the bit received. Various people seen
+the following message:
+
+ brcmfmac: brcmf_sdio_hostmail: Unknown mailbox data content: 0x40012
+
+Bit 4 is cause of this message, but this actually indicates the firmware
+has halted. Handle this bit by giving a more meaningful error message.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -260,10 +260,11 @@ struct rte_console {
+ #define I_HMB_HOST_INT	I_HMB_SW3	/* Miscellaneous Interrupt */
+ 
+ /* tohostmailboxdata */
+-#define HMB_DATA_NAKHANDLED	1	/* retransmit NAK'd frame */
+-#define HMB_DATA_DEVREADY	2	/* talk to host after enable */
+-#define HMB_DATA_FC		4	/* per prio flowcontrol update flag */
+-#define HMB_DATA_FWREADY	8	/* fw ready for protocol activity */
++#define HMB_DATA_NAKHANDLED	0x0001	/* retransmit NAK'd frame */
++#define HMB_DATA_DEVREADY	0x0002	/* talk to host after enable */
++#define HMB_DATA_FC		0x0004	/* per prio flowcontrol update flag */
++#define HMB_DATA_FWREADY	0x0008	/* fw ready for protocol activity */
++#define HMB_DATA_FWHALT		0x0010	/* firmware halted */
+ 
+ #define HMB_DATA_FCDATA_MASK	0xff000000
+ #define HMB_DATA_FCDATA_SHIFT	24
+@@ -1094,6 +1095,10 @@ static u32 brcmf_sdio_hostmail(struct br
+ 			  offsetof(struct sdpcmd_regs, tosbmailbox));
+ 	bus->sdcnt.f1regdata += 2;
+ 
++	/* dongle indicates the firmware has halted/crashed */
++	if (hmb_data & HMB_DATA_FWHALT)
++		brcmf_err("mailbox indicates firmware halted\n");
++
+ 	/* Dongle recomposed rx frames, accept them again */
+ 	if (hmb_data & HMB_DATA_NAKHANDLED) {
+ 		brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
+@@ -1151,6 +1156,7 @@ static u32 brcmf_sdio_hostmail(struct br
+ 			 HMB_DATA_NAKHANDLED |
+ 			 HMB_DATA_FC |
+ 			 HMB_DATA_FWREADY |
++			 HMB_DATA_FWHALT |
+ 			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
+ 		brcmf_err("Unknown mailbox data content: 0x%02x\n",
+ 			  hmb_data);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch b/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
new file mode 100644
index 000000000..901663193
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
@@ -0,0 +1,133 @@
+From 6c219b0088158da839a5be63c5b3d96c145501d2 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:32 +0100
+Subject: [PATCH] brcmfmac: disable packet filtering in promiscuous mode
+
+Disable arp and nd offload to allow all packets sending to host.
+
+Reported-by: Phil Elwell <phil@raspberrypi.org>
+Tested-by: Phil Elwell <phil@raspberrypi.org>
+Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 41 ----------------------
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 38 ++++++++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
+ 3 files changed, 39 insertions(+), 41 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -472,47 +472,6 @@ send_key_to_dongle(struct brcmf_if *ifp,
+ 	return err;
+ }
+ 
+-static s32
+-brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
+-{
+-	s32 err;
+-	u32 mode;
+-
+-	if (enable)
+-		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
+-	else
+-		mode = 0;
+-
+-	/* Try to set and enable ARP offload feature, this may fail, then it  */
+-	/* is simply not supported and err 0 will be returned                 */
+-	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
+-	if (err) {
+-		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
+-			  mode, err);
+-		err = 0;
+-	} else {
+-		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
+-		if (err) {
+-			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
+-				  enable, err);
+-			err = 0;
+-		} else
+-			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
+-				  enable, mode);
+-	}
+-
+-	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
+-	if (err) {
+-		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
+-			  enable, err);
+-		err = 0;
+-	} else
+-		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
+-			  enable, mode);
+-
+-	return err;
+-}
+-
+ static void
+ brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
+ {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -71,6 +71,43 @@ struct brcmf_if *brcmf_get_ifp(struct br
+ 	return ifp;
+ }
+ 
++void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
++{
++	s32 err;
++	u32 mode;
++
++	if (enable)
++		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
++	else
++		mode = 0;
++
++	/* Try to set and enable ARP offload feature, this may fail, then it  */
++	/* is simply not supported and err 0 will be returned                 */
++	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
++	if (err) {
++		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
++			  mode, err);
++	} else {
++		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
++		if (err) {
++			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
++				  enable, err);
++		} else {
++			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
++				  enable, mode);
++		}
++	}
++
++	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
++	if (err) {
++		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
++			  enable, err);
++	} else {
++		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
++			  enable, mode);
++	}
++}
++
+ static void _brcmf_set_multicast_list(struct work_struct *work)
+ {
+ 	struct brcmf_if *ifp;
+@@ -134,6 +171,7 @@ static void _brcmf_set_multicast_list(st
+ 	if (err < 0)
+ 		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
+ 			  err);
++	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
+ }
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -203,6 +203,7 @@ int brcmf_netdev_wait_pend8021x(struct b
+ /* Return pointer to interface name */
+ char *brcmf_ifname(struct brcmf_if *ifp);
+ struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
++void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
+ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
+ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
+ 			      bool is_p2pdev, const char *name, u8 *mac_addr);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
new file mode 100644
index 000000000..ffd2db762
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
@@ -0,0 +1,131 @@
+From 8c6efda22f5f9f73fc948f517424466be01ae84d Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:33 +0100
+Subject: [PATCH] brcmfmac: cleanup brcmf_cfg80211_escan() function
+
+The function brcmf_cfg80211_escan() was always called with a non-null
+request parameter and null pointer for this_ssid parameter. Clean up
+the function removing the dead code path.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 76 ++++------------------
+ 1 file changed, 11 insertions(+), 65 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1072,18 +1072,10 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ 
+ static s32
+ brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
+-		     struct cfg80211_scan_request *request,
+-		     struct cfg80211_ssid *this_ssid)
++		     struct cfg80211_scan_request *request)
+ {
+-	struct brcmf_if *ifp = vif->ifp;
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+-	struct cfg80211_ssid *ssids;
+-	u32 passive_scan;
+-	bool escan_req;
+-	bool spec_scan;
+ 	s32 err;
+-	struct brcmf_ssid_le ssid_le;
+-	u32 SSID_len;
+ 
+ 	brcmf_dbg(SCAN, "START ESCAN\n");
+ 
+@@ -1101,8 +1093,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 			  cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+-	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
+-		brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
++	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
++		brcmf_err("Connecting: status (%lu)\n", vif->sme_state);
+ 		return -EAGAIN;
+ 	}
+ 
+@@ -1110,63 +1102,17 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+ 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+ 
+-	escan_req = false;
+-	if (request) {
+-		/* scan bss */
+-		ssids = request->ssids;
+-		escan_req = true;
+-	} else {
+-		/* scan in ibss */
+-		/* we don't do escan in ibss */
+-		ssids = this_ssid;
+-	}
+-
+ 	cfg->scan_request = request;
+ 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+-	if (escan_req) {
+-		cfg->escan_info.run = brcmf_run_escan;
+-		err = brcmf_p2p_scan_prep(wiphy, request, vif);
+-		if (err)
+-			goto scan_out;
+-
+-		err = brcmf_do_escan(vif->ifp, request);
+-		if (err)
+-			goto scan_out;
+-	} else {
+-		brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
+-			  ssids->ssid, ssids->ssid_len);
+-		memset(&ssid_le, 0, sizeof(ssid_le));
+-		SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
+-		ssid_le.SSID_len = cpu_to_le32(0);
+-		spec_scan = false;
+-		if (SSID_len) {
+-			memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
+-			ssid_le.SSID_len = cpu_to_le32(SSID_len);
+-			spec_scan = true;
+-		} else
+-			brcmf_dbg(SCAN, "Broadcast scan\n");
+ 
+-		passive_scan = cfg->active_scan ? 0 : 1;
+-		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
+-					    passive_scan);
+-		if (err) {
+-			brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
+-			goto scan_out;
+-		}
+-		brcmf_scan_config_mpc(ifp, 0);
+-		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
+-					     sizeof(ssid_le));
+-		if (err) {
+-			if (err == -EBUSY)
+-				brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
+-					  ssid_le.SSID);
+-			else
+-				brcmf_err("WLC_SCAN error (%d)\n", err);
++	cfg->escan_info.run = brcmf_run_escan;
++	err = brcmf_p2p_scan_prep(wiphy, request, vif);
++	if (err)
++		goto scan_out;
+ 
+-			brcmf_scan_config_mpc(ifp, 1);
+-			goto scan_out;
+-		}
+-	}
++	err = brcmf_do_escan(vif->ifp, request);
++	if (err)
++		goto scan_out;
+ 
+ 	/* Arm scan timeout timer */
+ 	mod_timer(&cfg->escan_timeout, jiffies +
+@@ -1191,7 +1137,7 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 	if (!check_vif_up(vif))
+ 		return -EIO;
+ 
+-	err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
++	err = brcmf_cfg80211_escan(wiphy, vif, request);
+ 
+ 	if (err)
+ 		brcmf_err("scan error (%d)\n", err);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch b/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
new file mode 100644
index 000000000..c2e3cba52
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
@@ -0,0 +1,31 @@
+From df2d8388bc96c0f29d27d121f2a4cd054f8b3900 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:34 +0100
+Subject: [PATCH] brcmfmac: use msecs_to_jiffies() instead of calculation using
+ HZ
+
+Minor cleanup using provided macro to convert milliseconds interval
+to jiffies in brcmf_cfg80211_escan().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1115,8 +1115,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 		goto scan_out;
+ 
+ 	/* Arm scan timeout timer */
+-	mod_timer(&cfg->escan_timeout, jiffies +
+-			BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
++	mod_timer(&cfg->escan_timeout,
++		  jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
+ 
+ 	return 0;
+ 
diff --git a/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
new file mode 100644
index 000000000..575ffb018
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
@@ -0,0 +1,83 @@
+From 588378f15cff285ac81c929239ccba01d7f71d50 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:35 +0100
+Subject: [PATCH] brcmfmac: get rid of brcmf_cfg80211_escan() function
+
+The function brcmf_cfg80211_escan() is only called by brcmf_cfg80211_scan()
+so there is no reason to split in two function especially since the latter
+does not do an awful lot.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 34 +++++++---------------
+ 1 file changed, 10 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1071,13 +1071,16 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ }
+ 
+ static s32
+-brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
+-		     struct cfg80211_scan_request *request)
++brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+-	s32 err;
++	struct brcmf_cfg80211_vif *vif;
++	s32 err = 0;
+ 
+-	brcmf_dbg(SCAN, "START ESCAN\n");
++	brcmf_dbg(TRACE, "Enter\n");
++	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
++	if (!check_vif_up(vif))
++		return -EIO;
+ 
+ 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+ 		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
+@@ -1102,6 +1105,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+ 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+ 
++	brcmf_dbg(SCAN, "START ESCAN\n");
++
+ 	cfg->scan_request = request;
+ 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 
+@@ -1121,31 +1126,12 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 	return 0;
+ 
+ scan_out:
++	brcmf_err("scan error (%d)\n", err);
+ 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 	cfg->scan_request = NULL;
+ 	return err;
+ }
+ 
+-static s32
+-brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+-{
+-	struct brcmf_cfg80211_vif *vif;
+-	s32 err = 0;
+-
+-	brcmf_dbg(TRACE, "Enter\n");
+-	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
+-	if (!check_vif_up(vif))
+-		return -EIO;
+-
+-	err = brcmf_cfg80211_escan(wiphy, vif, request);
+-
+-	if (err)
+-		brcmf_err("scan error (%d)\n", err);
+-
+-	brcmf_dbg(TRACE, "Exit\n");
+-	return err;
+-}
+-
+ static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
+ {
+ 	s32 err = 0;
diff --git a/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch b/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
new file mode 100644
index 000000000..4d4235f4b
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
@@ -0,0 +1,86 @@
+From bbf35414cd23a9d7230bfd7046e1e2c26020e7eb Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:36 +0100
+Subject: [PATCH] brcmfmac: get rid of struct brcmf_cfg80211_info::active_scan
+ field
+
+The field struct brcmf_cfg80211_info::active_scan is set to true upon
+initializing the driver instance, but it is never changed so simply
+get rid of it.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 +---------
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h |  2 --
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      |  5 +----
+ 3 files changed, 2 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1043,7 +1043,6 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ {
+ 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+ 	s32 err;
+-	u32 passive_scan;
+ 	struct brcmf_scan_results *results;
+ 	struct escan_info *escan = &cfg->escan_info;
+ 
+@@ -1051,13 +1050,7 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ 	escan->ifp = ifp;
+ 	escan->wiphy = cfg->wiphy;
+ 	escan->escan_state = WL_ESCAN_STATE_SCANNING;
+-	passive_scan = cfg->active_scan ? 0 : 1;
+-	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
+-				    passive_scan);
+-	if (err) {
+-		brcmf_err("error (%d)\n", err);
+-		return err;
+-	}
++
+ 	brcmf_scan_config_mpc(ifp, 0);
+ 	results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
+ 	results->version = 0;
+@@ -5767,7 +5760,6 @@ static s32 wl_init_priv(struct brcmf_cfg
+ 
+ 	cfg->scan_request = NULL;
+ 	cfg->pwr_save = true;
+-	cfg->active_scan = true;	/* we do active scan per default */
+ 	cfg->dongle_up = false;		/* dongle is not up yet */
+ 	err = brcmf_init_priv_mem(cfg);
+ 	if (err)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -283,7 +283,6 @@ struct brcmf_cfg80211_wowl {
+  * @scan_status: scan activity on the dongle.
+  * @pub: common driver information.
+  * @channel: current channel.
+- * @active_scan: current scan mode.
+  * @int_escan_map: bucket map for which internal e-scan is done.
+  * @ibss_starter: indicates this sta is ibss starter.
+  * @pwr_save: indicate whether dongle to support power save mode.
+@@ -316,7 +315,6 @@ struct brcmf_cfg80211_info {
+ 	unsigned long scan_status;
+ 	struct brcmf_pub *pub;
+ 	u32 channel;
+-	bool active_scan;
+ 	u32 int_escan_map;
+ 	bool ibss_starter;
+ 	bool pwr_save;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -692,10 +692,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
+ 
+ 	/* determine the scan engine parameters */
+ 	sparams->bss_type = DOT11_BSSTYPE_ANY;
+-	if (p2p->cfg->active_scan)
+-		sparams->scan_type = 0;
+-	else
+-		sparams->scan_type = 1;
++	sparams->scan_type = BRCMF_SCANTYPE_ACTIVE;
+ 
+ 	eth_broadcast_addr(sparams->bssid);
+ 	sparams->home_time = cpu_to_le32(P2PAPI_SCAN_HOME_TIME_MS);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch b/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
new file mode 100644
index 000000000..3ad6e79db
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
@@ -0,0 +1,55 @@
+From bd99a3013bdc00f8fc7534c657b39616792b4467 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:37 +0100
+Subject: [PATCH] brcmfmac: move configuration of probe request IEs
+
+The configuration of the IEs for probe requests was done in a P2P
+related function, which is not very obvious. Moving it to
+.scan callback function, ie. brcmf_cfg80211_scan().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      | 6 ++----
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1108,6 +1108,11 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 	if (err)
+ 		goto scan_out;
+ 
++	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
++				    request->ie, request->ie_len);
++	if (err)
++		goto scan_out;
++
+ 	err = brcmf_do_escan(vif->ifp, request);
+ 	if (err)
+ 		goto scan_out;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -881,7 +881,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
+-	int err = 0;
++	int err;
+ 
+ 	if (brcmf_p2p_scan_is_p2p_request(request)) {
+ 		/* find my listen channel */
+@@ -904,9 +904,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
+ 		/* override .run_escan() callback. */
+ 		cfg->escan_info.run = brcmf_p2p_run_escan;
+ 	}
+-	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
+-				    request->ie, request->ie_len);
+-	return err;
++	return 0;
+ }
+ 
+ 
diff --git a/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch b/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
new file mode 100644
index 000000000..2cd5f7312
--- /dev/null
+++ b/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
@@ -0,0 +1,434 @@
+From fdd0bd88ceaecf729db103ac8836af5805dd2dc1 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Fri, 10 Nov 2017 17:27:15 +0800
+Subject: [PATCH] brcmfmac: add CLM download support
+
+The firmware for brcmfmac devices includes information regarding
+regulatory constraints. For certain devices this information is kept
+separately in a binary form that needs to be downloaded to the device.
+This patch adds support to download this so-called CLM blob file. It
+uses the same naming scheme as the other firmware files with extension
+of .clm_blob.
+
+The CLM blob file is optional. If the file does not exist, the download
+process will be bypassed. It will not affect the driver loading.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  10 ++
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 157 +++++++++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   2 +
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |   2 +
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  31 ++++
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  19 +++
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  19 +++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  18 +++
+ 8 files changed, 258 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -71,6 +71,7 @@ struct brcmf_bus_dcmd {
+  * @wowl_config: specify if dongle is configured for wowl when going to suspend
+  * @get_ramsize: obtain size of device memory.
+  * @get_memdump: obtain device memory dump in provided buffer.
++ * @get_fwname: obtain firmware name.
+  *
+  * This structure provides an abstract interface towards the
+  * bus specific driver. For control messages to common driver
+@@ -87,6 +88,8 @@ struct brcmf_bus_ops {
+ 	void (*wowl_config)(struct device *dev, bool enabled);
+ 	size_t (*get_ramsize)(struct device *dev);
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
++	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
++			  unsigned char *fw_name);
+ };
+ 
+ 
+@@ -224,6 +227,13 @@ int brcmf_bus_get_memdump(struct brcmf_b
+ 	return bus->ops->get_memdump(bus->dev, data, len);
+ }
+ 
++static inline
++int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
++			 unsigned char *fw_name)
++{
++	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
++}
++
+ /*
+  * interface functions from common layer
+  */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -18,6 +18,7 @@
+ #include <linux/string.h>
+ #include <linux/netdevice.h>
+ #include <linux/module.h>
++#include <linux/firmware.h>
+ #include <brcmu_wifi.h>
+ #include <brcmu_utils.h>
+ #include "core.h"
+@@ -28,6 +29,7 @@
+ #include "tracepoint.h"
+ #include "common.h"
+ #include "of.h"
++#include "firmware.h"
+ 
+ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+@@ -104,12 +106,140 @@ void brcmf_c_set_joinpref_default(struct
+ 		brcmf_err("Set join_pref error (%d)\n", err);
+ }
+ 
++static int brcmf_c_download(struct brcmf_if *ifp, u16 flag,
++			    struct brcmf_dload_data_le *dload_buf,
++			    u32 len)
++{
++	s32 err;
++
++	flag |= (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT);
++	dload_buf->flag = cpu_to_le16(flag);
++	dload_buf->dload_type = cpu_to_le16(DL_TYPE_CLM);
++	dload_buf->len = cpu_to_le32(len);
++	dload_buf->crc = cpu_to_le32(0);
++	len = sizeof(*dload_buf) + len - 1;
++
++	err = brcmf_fil_iovar_data_set(ifp, "clmload", dload_buf, len);
++
++	return err;
++}
++
++static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
++{
++	struct brcmf_bus *bus = ifp->drvr->bus_if;
++	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
++	u8 fw_name[BRCMF_FW_NAME_LEN];
++	u8 *ptr;
++	size_t len;
++	s32 err;
++
++	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
++	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
++	if (err) {
++		brcmf_err("get firmware name failed (%d)\n", err);
++		goto done;
++	}
++
++	/* generate CLM blob file name */
++	ptr = strrchr(fw_name, '.');
++	if (!ptr) {
++		err = -ENOENT;
++		goto done;
++	}
++
++	len = ptr - fw_name + 1;
++	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
++		err = -E2BIG;
++	} else {
++		strlcpy(clm_name, fw_name, len);
++		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
++	}
++done:
++	return err;
++}
++
++static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
++{
++	struct device *dev = ifp->drvr->bus_if->dev;
++	struct brcmf_dload_data_le *chunk_buf;
++	const struct firmware *clm = NULL;
++	u8 clm_name[BRCMF_FW_NAME_LEN];
++	u32 chunk_len;
++	u32 datalen;
++	u32 cumulative_len;
++	u16 dl_flag = DL_BEGIN;
++	u32 status;
++	s32 err;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
++	err = brcmf_c_get_clm_name(ifp, clm_name);
++	if (err) {
++		brcmf_err("get CLM blob file name failed (%d)\n", err);
++		return err;
++	}
++
++	err = request_firmware(&clm, clm_name, dev);
++	if (err) {
++		if (err == -ENOENT) {
++			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
++			return 0;
++		}
++		brcmf_err("request CLM blob file failed (%d)\n", err);
++		return err;
++	}
++
++	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
++	if (!chunk_buf) {
++		err = -ENOMEM;
++		goto done;
++	}
++
++	datalen = clm->size;
++	cumulative_len = 0;
++	do {
++		if (datalen > MAX_CHUNK_LEN) {
++			chunk_len = MAX_CHUNK_LEN;
++		} else {
++			chunk_len = datalen;
++			dl_flag |= DL_END;
++		}
++		memcpy(chunk_buf->data, clm->data + cumulative_len, chunk_len);
++
++		err = brcmf_c_download(ifp, dl_flag, chunk_buf, chunk_len);
++
++		dl_flag &= ~DL_BEGIN;
++
++		cumulative_len += chunk_len;
++		datalen -= chunk_len;
++	} while ((datalen > 0) && (err == 0));
++
++	if (err) {
++		brcmf_err("clmload (%zu byte file) failed (%d); ",
++			  clm->size, err);
++		/* Retrieve clmload_status and print */
++		err = brcmf_fil_iovar_int_get(ifp, "clmload_status", &status);
++		if (err)
++			brcmf_err("get clmload_status failed (%d)\n", err);
++		else
++			brcmf_dbg(INFO, "clmload_status=%d\n", status);
++		err = -EIO;
++	}
++
++	kfree(chunk_buf);
++done:
++	release_firmware(clm);
++	return err;
++}
++
+ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ {
+ 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+ 	u8 buf[BRCMF_DCMD_SMLEN];
+ 	struct brcmf_rev_info_le revinfo;
+ 	struct brcmf_rev_info *ri;
++	char *clmver;
+ 	char *ptr;
+ 	s32 err;
+ 
+@@ -148,6 +278,13 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	}
+ 	ri->result = err;
+ 
++	/* Do any CLM downloading */
++	err = brcmf_c_process_clm_blob(ifp);
++	if (err < 0) {
++		brcmf_err("download CLM blob file failed, %d\n", err);
++		goto done;
++	}
++
+ 	/* query for 'ver' to get version info from firmware */
+ 	memset(buf, 0, sizeof(buf));
+ 	strcpy(buf, "ver");
+@@ -167,6 +304,26 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	ptr = strrchr(buf, ' ') + 1;
+ 	strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
+ 
++	/* Query for 'clmver' to get CLM version info from firmware */
++	memset(buf, 0, sizeof(buf));
++	err = brcmf_fil_iovar_data_get(ifp, "clmver", buf, sizeof(buf));
++	if (err) {
++		brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
++	} else {
++		clmver = (char *)buf;
++		/* store CLM version for adding it to revinfo debugfs file */
++		memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
++
++		/* Replace all newline/linefeed characters with space
++		 * character
++		 */
++		ptr = clmver;
++		while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
++			*ptr = ' ';
++
++		brcmf_dbg(INFO, "CLM version = %s\n", clmver);
++	}
++
+ 	/* set mpc */
+ 	err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
+ 	if (err) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1009,6 +1009,8 @@ static int brcmf_revinfo_read(struct seq
+ 	seq_printf(s, "anarev: %u\n", ri->anarev);
+ 	seq_printf(s, "nvramrev: %08x\n", ri->nvramrev);
+ 
++	seq_printf(s, "clmver: %s\n", bus_if->drvr->clmver);
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -141,6 +141,8 @@ struct brcmf_pub {
+ 	struct notifier_block inetaddr_notifier;
+ 	struct notifier_block inet6addr_notifier;
+ 	struct brcmf_mp_device *settings;
++
++	u8 clmver[BRCMF_DCMD_SMLEN];
+ };
+ 
+ /* forward declarations */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -155,6 +155,21 @@
+ #define BRCMF_MFP_CAPABLE		1
+ #define BRCMF_MFP_REQUIRED		2
+ 
++/* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
++ * ioctl. It is relatively small because firmware has small maximum size input
++ * playload restriction for ioctls.
++ */
++#define MAX_CHUNK_LEN			1400
++
++#define DLOAD_HANDLER_VER		1	/* Downloader version */
++#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
++#define DLOAD_FLAG_VER_SHIFT		12	/* Downloader version shift */
++
++#define DL_BEGIN			0x0002
++#define DL_END				0x0004
++
++#define DL_TYPE_CLM			2
++
+ /* join preference types for join_pref iovar */
+ enum brcmf_join_pref_types {
+ 	BRCMF_JOIN_PREF_RSSI = 1,
+@@ -827,6 +842,22 @@ struct brcmf_pno_macaddr_le {
+ };
+ 
+ /**
++ * struct brcmf_dload_data_le - data passing to firmware for downloading
++ * @flag: flags related to download data.
++ * @dload_type: type of download data.
++ * @len: length in bytes of download data.
++ * @crc: crc of download data.
++ * @data: download data.
++ */
++struct brcmf_dload_data_le {
++	__le16 flag;
++	__le16 dload_type;
++	__le32 len;
++	__le32 crc;
++	u8 data[1];
++};
++
++/**
+  * struct brcmf_pno_bssid_le - bssid configuration for PNO scan.
+  *
+  * @bssid: BSS network identifier.
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1350,6 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
+ 	return 0;
+ }
+ 
++static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
++				 u8 *fw_name)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
++	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
++	int ret = 0;
++
++	if (devinfo->fw_name[0] != '\0')
++		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
++	else
++		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
++						brcmf_pcie_fwnames,
++						ARRAY_SIZE(brcmf_pcie_fwnames),
++						fw_name, NULL);
++
++	return ret;
++}
+ 
+ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
+ 	.txdata = brcmf_pcie_tx,
+@@ -1359,6 +1377,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.wowl_config = brcmf_pcie_wowl_config,
+ 	.get_ramsize = brcmf_pcie_get_ramsize,
+ 	.get_memdump = brcmf_pcie_get_memdump,
++	.get_fwname = brcmf_pcie_get_fwname,
+ };
+ 
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3985,6 +3985,24 @@ brcmf_sdio_watchdog(unsigned long data)
+ 	}
+ }
+ 
++static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
++				 u8 *fw_name)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	int ret = 0;
++
++	if (sdiodev->fw_name[0] != '\0')
++		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
++	else
++		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
++						brcmf_sdio_fwnames,
++						ARRAY_SIZE(brcmf_sdio_fwnames),
++						fw_name, NULL);
++
++	return ret;
++}
++
+ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
+ 	.stop = brcmf_sdio_bus_stop,
+ 	.preinit = brcmf_sdio_bus_preinit,
+@@ -3995,6 +4013,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.wowl_config = brcmf_sdio_wowl_config,
+ 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
+ 	.get_memdump = brcmf_sdio_bus_get_memdump,
++	.get_fwname = brcmf_sdio_get_fwname,
+ };
+ 
+ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1128,12 +1128,30 @@ static void brcmf_usb_wowl_config(struct
+ 		device_set_wakeup_enable(devinfo->dev, false);
+ }
+ 
++static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
++				u8 *fw_name)
++{
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++	int ret = 0;
++
++	if (devinfo->fw_name[0] != '\0')
++		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
++	else
++		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
++						brcmf_usb_fwnames,
++						ARRAY_SIZE(brcmf_usb_fwnames),
++						fw_name, NULL);
++
++	return ret;
++}
++
+ static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
+ 	.txdata = brcmf_usb_tx,
+ 	.stop = brcmf_usb_down,
+ 	.txctl = brcmf_usb_tx_ctlpkt,
+ 	.rxctl = brcmf_usb_rx_ctlpkt,
+ 	.wowl_config = brcmf_usb_wowl_config,
++	.get_fwname = brcmf_usb_get_fwname,
+ };
+ 
+ static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
diff --git a/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch b/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
new file mode 100644
index 000000000..3649bdda4
--- /dev/null
+++ b/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
@@ -0,0 +1,37 @@
+From 5c3de777bdaf48bd0cfb43097c0d0fb85056cab7 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Sat, 25 Nov 2017 21:39:25 +0100
+Subject: [PATCH] brcmfmac: change driver unbind order of the sdio function
+ devices
+
+In the function brcmf_sdio_firmware_callback() the driver is
+unbound from the sdio function devices in the error path.
+However, the order in which it is done resulted in a use-after-free
+issue (see brcmf_ops_sdio_remove() in bcmsdh.c). Hence change
+the order and first unbind sdio function #2 device and then
+unbind sdio function #1 device.
+
+Cc: stable@vger.kernel.org # v4.12.x
+Fixes: 7a51461fc2da ("brcmfmac: unbind all devices upon failure in firmware callback")
+Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4121,8 +4121,8 @@ release:
+ 	sdio_release_host(sdiodev->func[1]);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(dev);
+ 	device_release_driver(&sdiodev->func[2]->dev);
++	device_release_driver(dev);
+ }
+ 
+ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch b/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
new file mode 100644
index 000000000..7344580d3
--- /dev/null
+++ b/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
@@ -0,0 +1,33 @@
+From 51ef7925e10688c57186d438e784532e063492e4 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 23 Nov 2017 17:57:04 +0200
+Subject: [PATCH] brcmfmac: Avoid build error with make W=1
+
+When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for
+the first run, all next ones are okay.
+
+  CC [M]  drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
+scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed
+
+Seems like something happened with W=1 and wrong kernel doc format.
+As a quick fix remove dubious /** in the code.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2070,7 +2070,7 @@ static int brcmf_sdio_txpkt_hdalign(stru
+ 	return head_pad;
+ }
+ 
+-/**
++/*
+  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+  * bus layer usage.
+  */
diff --git a/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch b/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
new file mode 100644
index 000000000..ead5e7214
--- /dev/null
+++ b/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
@@ -0,0 +1,40 @@
+From cc124d5cc8d81985c3511892d7a6d546552ff754 Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Tue, 16 Jan 2018 17:26:50 +0800
+Subject: [PATCH] brcmfmac: fix CLM load error for legacy chips when user
+ helper is enabled
+
+For legacy chips without CLM blob files, kernel with user helper function
+returns -EAGAIN when we request_firmware(), and then driver got failed
+when bringing up legacy chips. We expect the CLM blob file for legacy chip
+is not existence in firmware path, but the -ENOENT error is transferred to
+-EAGAIN in firmware_class.c with user helper.
+Because of that, we continue with CLM data currently present in firmware
+if getting error from doing request_firmware().
+
+Cc: stable@vger.kernel.org # v4.15.y
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -182,12 +182,9 @@ static int brcmf_c_process_clm_blob(stru
+ 
+ 	err = request_firmware(&clm, clm_name, dev);
+ 	if (err) {
+-		if (err == -ENOENT) {
+-			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
+-			return 0;
+-		}
+-		brcmf_err("request CLM blob file failed (%d)\n", err);
+-		return err;
++		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
++			   err);
++		return 0;
+ 	}
+ 
+ 	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/321-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch b/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
similarity index 100%
rename from package/kernel/mac80211/patches/321-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
rename to package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
diff --git a/package/kernel/mac80211/patches/321-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch b/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
similarity index 100%
rename from package/kernel/mac80211/patches/321-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
rename to package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
diff --git a/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch b/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
new file mode 100644
index 000000000..b2b2fcf4a
--- /dev/null
+++ b/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 17 Jan 2018 11:11:17 +0100
+Subject: [PATCH] ath9k: discard undersized packets
+
+Sometimes the hardware will push small packets that trigger a WARN_ON
+in mac80211. Discard them early to avoid this issue.
+
+Reported-by: Stijn Tintel <stijn@linux-ipv6.be>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -826,9 +826,9 @@ static int ath9k_rx_skb_preprocess(struc
+ 	sc->rx.discard_next = false;
+ 
+ 	/*
+-	 * Discard zero-length packets.
++	 * Discard zero-length packets and packets smaller than an ACK
+ 	 */
+-	if (!rx_stats->rs_datalen) {
++	if (rx_stats->rs_datalen < 10) {
+ 		RX_STAT_INC(rx_len_err);
+ 		goto corrupt;
+ 	}
diff --git a/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch b/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
new file mode 100644
index 000000000..616a82119
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
@@ -0,0 +1,39 @@
+From 1fd3ae124d5e675f57cf7e3c601fb8f7712e0329 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:38 +0100
+Subject: [PATCH] brcmfmac: Fix parameter order in brcmf_sdiod_f0_writeb()
+
+All the other IO functions are the other way round in this
+driver. Make this one match.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -230,8 +230,8 @@ void brcmf_sdiod_change_state(struct brc
+ 	sdiodev->state = state;
+ }
+ 
+-static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func,
+-					uint regaddr, u8 byte)
++static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
++					uint regaddr)
+ {
+ 	int err_ret;
+ 
+@@ -269,8 +269,8 @@ static int brcmf_sdiod_request_data(stru
+ 			if (fn)
+ 				sdio_writeb(func, *(u8 *)data, addr, &ret);
+ 			else
+-				ret = brcmf_sdiod_f0_writeb(func, addr,
+-							    *(u8 *)data);
++				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
++							    addr);
+ 		} else {
+ 			if (fn)
+ 				*(u8 *)data = sdio_readb(func, addr, &ret);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch b/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
new file mode 100644
index 000000000..719268f8f
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
@@ -0,0 +1,105 @@
+From 1e6f676f43aa4270ebc5cff8e32a55f72362e042 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:39 +0100
+Subject: [PATCH] brcmfmac: Register sizes on hardware are not dependent on
+ compiler types
+
+The 4 IO functions in this patch are incorrect as they use compiler types
+to determine how many bytes to send to the hardware.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -264,7 +264,7 @@ static int brcmf_sdiod_request_data(stru
+ 	func = sdiodev->func[fn];
+ 
+ 	switch (regsz) {
+-	case sizeof(u8):
++	case 1:
+ 		if (write) {
+ 			if (fn)
+ 				sdio_writeb(func, *(u8 *)data, addr, &ret);
+@@ -278,13 +278,13 @@ static int brcmf_sdiod_request_data(stru
+ 				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
+ 		}
+ 		break;
+-	case sizeof(u16):
++	case 2:
+ 		if (write)
+ 			sdio_writew(func, *(u16 *)data, addr, &ret);
+ 		else
+ 			*(u16 *)data = sdio_readw(func, addr, &ret);
+ 		break;
+-	case sizeof(u32):
++	case 4:
+ 		if (write)
+ 			sdio_writel(func, *(u32 *)data, addr, &ret);
+ 		else
+@@ -368,7 +368,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
+ 	for (i = 0; i < 3; i++) {
+ 		err = brcmf_sdiod_regrw_helper(sdiodev,
+ 					       SBSDIO_FUNC1_SBADDRLOW + i,
+-					       sizeof(u8), &addr[i], true);
++					       1, &addr[i], true);
+ 		if (err) {
+ 			brcmf_err("failed at addr: 0x%0x\n",
+ 				  SBSDIO_FUNC1_SBADDRLOW + i);
+@@ -407,7 +407,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+ 					  false);
+ 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
+ 
+@@ -423,10 +423,10 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+ 					  false);
+ 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+@@ -443,7 +443,7 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+ 					  true);
+ 	if (ret)
+ 		*ret = retval;
+@@ -455,10 +455,10 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+-	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+ 					  true);
+ 
+ done:
+@@ -876,7 +876,7 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
+ 
+ 	/* issue abort cmd52 command through F0 */
+ 	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+-				 sizeof(t_func), &t_func, true);
++				 1, &t_func, true);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch b/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
new file mode 100644
index 000000000..b04465ae4
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
@@ -0,0 +1,179 @@
+From 0fcc9fe0048422d66bb906eaa73cc75e11ff7345 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:40 +0100
+Subject: [PATCH] brcmfmac: Split brcmf_sdiod_regrw_helper() up.
+
+This large function is concealing a LOT of obscure logic about
+how the hardware functions. Time to split it up.
+
+This first patch splits the function into two pieces - read and write,
+doing away with the rw flag in the process.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 94 +++++++++++++++++-----
+ 1 file changed, 73 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -302,8 +302,8 @@ static int brcmf_sdiod_request_data(stru
+ 	return ret;
+ }
+ 
+-static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-				   u8 regsz, void *data, bool write)
++static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
++				 u8 regsz, void *data)
+ {
+ 	u8 func;
+ 	s32 retry = 0;
+@@ -324,13 +324,66 @@ static int brcmf_sdiod_regrw_helper(stru
+ 		func = SDIO_FUNC_1;
+ 
+ 	do {
+-		if (!write)
+-			memset(data, 0, regsz);
+ 		/* for retry wait for 1 ms till bus get settled down */
+ 		if (retry)
+ 			usleep_range(1000, 2000);
++
++		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
++					       data, true);
++
++	} while (ret != 0 && ret != -ENOMEDIUM &&
++		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
++
++	if (ret == -ENOMEDIUM) {
++		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++	} else if (ret != 0) {
++		/*
++		 * SleepCSR register access can fail when
++		 * waking up the device so reduce this noise
++		 * in the logs.
++		 */
++		if (addr != SBSDIO_FUNC1_SLEEPCSR)
++			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
++		else
++			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
++	}
++
++	return ret;
++}
++
++static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
++				u8 regsz, void *data)
++{
++	u8 func;
++	s32 retry = 0;
++	int ret;
++
++	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
++		return -ENOMEDIUM;
++
++	/*
++	 * figure out how to read the register based on address range
++	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
++	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
++	 * The rest: function 1 silicon backplane core registers
++	 */
++	if ((addr & ~REG_F0_REG_MASK) == 0)
++		func = SDIO_FUNC_0;
++	else
++		func = SDIO_FUNC_1;
++
++	do {
++		memset(data, 0, regsz);
++
++		/* for retry wait for 1 ms till bus get settled down */
++		if (retry)
++			usleep_range(1000, 2000);
++
+ 		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
+-					       data, write);
++					       data, false);
++
+ 	} while (ret != 0 && ret != -ENOMEDIUM &&
+ 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+ 
+@@ -343,12 +396,13 @@ static int brcmf_sdiod_regrw_helper(stru
+ 		 * in the logs.
+ 		 */
+ 		if (addr != SBSDIO_FUNC1_SLEEPCSR)
+-			brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
+-				  write ? "write" : "read", func, addr, ret);
++			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
+ 		else
+-			brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+-				  write ? "write" : "read", func, addr, ret);
++			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
+ 	}
++
+ 	return ret;
+ }
+ 
+@@ -366,13 +420,11 @@ brcmf_sdiod_set_sbaddr_window(struct brc
+ 	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
+ 
+ 	for (i = 0; i < 3; i++) {
+-		err = brcmf_sdiod_regrw_helper(sdiodev,
+-					       SBSDIO_FUNC1_SBADDRLOW + i,
+-					       1, &addr[i], true);
++		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
++				  &err);
+ 		if (err) {
+ 			brcmf_err("failed at addr: 0x%0x\n",
+ 				  SBSDIO_FUNC1_SBADDRLOW + i);
+-			break;
+ 		}
+ 	}
+ 
+@@ -407,8 +459,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+-					  false);
++	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
+ 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
+ 
+ 	if (ret)
+@@ -426,8 +477,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+-					  false);
++
++	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
++
+ 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+ done:
+@@ -443,8 +495,8 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+-					  true);
++	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
++
+ 	if (ret)
+ 		*ret = retval;
+ }
+@@ -458,8 +510,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+-					  true);
++
++	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
+ 
+ done:
+ 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch b/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
new file mode 100644
index 000000000..1f0488a62
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
@@ -0,0 +1,62 @@
+From b9b0d290bc0c90a5a262bc89c9d995988ea98669 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:41 +0100
+Subject: [PATCH] brcmfmac: Clean up brcmf_sdiod_set_sbaddr_window()
+
+This function sets the address of the IO window used for
+SDIO accesses onto the backplane of the chip.
+
+It currently uses 3 separate masks despite the full mask being
+defined in the code already. Remove the separate masks and clean up.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c   | 17 +++++------------
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h |  3 ---
+ 2 files changed, 5 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -410,23 +410,16 @@ static int
+ brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
+ {
+ 	int err = 0, i;
+-	u8 addr[3];
++	u32 addr;
+ 
+ 	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+ 		return -ENOMEDIUM;
+ 
+-	addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
+-	addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
+-	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
++	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
+ 
+-	for (i = 0; i < 3; i++) {
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
+-				  &err);
+-		if (err) {
+-			brcmf_err("failed at addr: 0x%0x\n",
+-				  SBSDIO_FUNC1_SBADDRLOW + i);
+-		}
+-	}
++	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
++		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
++				  addr & 0xff, &err);
+ 
+ 	return err;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -133,9 +133,6 @@
+ 
+ /* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+ 
+-#define SBSDIO_SBADDRLOW_MASK		0x80	/* Valid bits in SBADDRLOW */
+-#define SBSDIO_SBADDRMID_MASK		0xff	/* Valid bits in SBADDRMID */
+-#define SBSDIO_SBADDRHIGH_MASK		0xffU	/* Valid bits in SBADDRHIGH */
+ /* Address bits from SBADDR regs */
+ #define SBSDIO_SBWINDOW_MASK		0xffff8000
+ 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch b/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
new file mode 100644
index 000000000..7d50ce923
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
@@ -0,0 +1,91 @@
+From ea243e9077b3545f20d93884e91c50ac0719685a Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:42 +0100
+Subject: [PATCH] brcmfmac: Remove dead IO code
+
+The value passed to brcmf_sdiod_addrprep() is *always* 4
+remove this parameter and the unused code to handle it.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -425,7 +425,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
+ }
+ 
+ static int
+-brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
++brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
+ {
+ 	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+ 	int err = 0;
+@@ -439,9 +439,7 @@ brcmf_sdiod_addrprep(struct brcmf_sdio_d
+ 	}
+ 
+ 	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
+-
+-	if (width == 4)
+-		*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	return 0;
+ }
+@@ -467,7 +465,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (retval)
+ 		goto done;
+ 
+@@ -500,7 +498,7 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+-	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (retval)
+ 		goto done;
+ 
+@@ -736,7 +734,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (err)
+ 		goto done;
+ 
+@@ -757,7 +755,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+ 		  addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (err)
+ 		goto done;
+ 
+@@ -801,7 +799,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 
+ 	memcpy(mypkt->data, buf, nbytes);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+ 	if (!err)
+ 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
+@@ -821,7 +819,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (err)
+ 		return err;
+ 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch b/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
new file mode 100644
index 000000000..fef29fc71
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
@@ -0,0 +1,61 @@
+From 4a3338ba2a7421db2260159cca5a27bd2ee36d00 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:43 +0100
+Subject: [PATCH] brcmfmac: Remove bandaid for SleepCSR
+
+Register access code is not the place for band-aid fixes like this.
+If this is a genuine problem, it should be fixed further up in the driver
+stack.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 28 +---------------------
+ 1 file changed, 1 insertion(+), 27 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -334,21 +334,8 @@ static int brcmf_sdiod_reg_write(struct
+ 	} while (ret != 0 && ret != -ENOMEDIUM &&
+ 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+ 
+-	if (ret == -ENOMEDIUM) {
++	if (ret == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+-	} else if (ret != 0) {
+-		/*
+-		 * SleepCSR register access can fail when
+-		 * waking up the device so reduce this noise
+-		 * in the logs.
+-		 */
+-		if (addr != SBSDIO_FUNC1_SLEEPCSR)
+-			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-		else
+-			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-	}
+ 
+ 	return ret;
+ }
+@@ -389,19 +376,6 @@ static int brcmf_sdiod_reg_read(struct b
+ 
+ 	if (ret == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+-	else if (ret != 0) {
+-		/*
+-		 * SleepCSR register access can fail when
+-		 * waking up the device so reduce this noise
+-		 * in the logs.
+-		 */
+-		if (addr != SBSDIO_FUNC1_SLEEPCSR)
+-			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-		else
+-			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-	}
+ 
+ 	return ret;
+ }
diff --git a/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch b/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
new file mode 100644
index 000000000..beaa4d3a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
@@ -0,0 +1,344 @@
+From 993a98a42e6e790fd0d2bf7d55a031513c7ba7dc Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:44 +0100
+Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_request_data()
+
+This function is obfuscating how IO works on this chip. Remove it
+and push its logic into brcmf_sdiod_reg_{read,write}().
+
+Handling of -ENOMEDIUM is altered, but as that's pretty much broken anyway
+we can ignore that.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 237 ++++++++-------------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   2 +-
+ 2 files changed, 87 insertions(+), 152 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -230,6 +230,43 @@ void brcmf_sdiod_change_state(struct brc
+ 	sdiodev->state = state;
+ }
+ 
++static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
++					 u32 address)
++{
++	int err = 0, i;
++	u32 addr;
++
++	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
++		return -ENOMEDIUM;
++
++	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
++
++	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
++		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
++				  addr & 0xff, &err);
++
++	return err;
++}
++
++static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
++{
++	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
++	int err = 0;
++
++	if (bar0 != sdiodev->sbwad) {
++		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
++		if (err)
++			return err;
++
++		sdiodev->sbwad = bar0;
++	}
++
++	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
++	return 0;
++}
++
+ static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
+ 					uint regaddr)
+ {
+@@ -249,173 +286,84 @@ static inline int brcmf_sdiod_f0_writeb(
+ 	return err_ret;
+ }
+ 
+-static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
+-				    u32 addr, u8 regsz, void *data, bool write)
+-{
+-	struct sdio_func *func;
+-	int ret = -EINVAL;
+-
+-	brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+-		  write, fn, addr, regsz);
+-
+-	/* only allow byte access on F0 */
+-	if (WARN_ON(regsz > 1 && !fn))
+-		return -EINVAL;
+-	func = sdiodev->func[fn];
+-
+-	switch (regsz) {
+-	case 1:
+-		if (write) {
+-			if (fn)
+-				sdio_writeb(func, *(u8 *)data, addr, &ret);
+-			else
+-				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
+-							    addr);
+-		} else {
+-			if (fn)
+-				*(u8 *)data = sdio_readb(func, addr, &ret);
+-			else
+-				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
+-		}
+-		break;
+-	case 2:
+-		if (write)
+-			sdio_writew(func, *(u16 *)data, addr, &ret);
+-		else
+-			*(u16 *)data = sdio_readw(func, addr, &ret);
+-		break;
+-	case 4:
+-		if (write)
+-			sdio_writel(func, *(u32 *)data, addr, &ret);
+-		else
+-			*(u32 *)data = sdio_readl(func, addr, &ret);
+-		break;
+-	default:
+-		brcmf_err("invalid size: %d\n", regsz);
+-		break;
+-	}
+-
+-	if (ret)
+-		brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+-			  write ? "write" : "read", fn, addr, ret);
+-
+-	return ret;
+-}
+-
+ static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
+ 				 u8 regsz, void *data)
+ {
+-	u8 func;
+-	s32 retry = 0;
+ 	int ret;
+ 
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
+-
+ 	/*
+ 	 * figure out how to read the register based on address range
+ 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+ 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+ 	 * The rest: function 1 silicon backplane core registers
++	 * f0 writes must be bytewise
+ 	 */
+-	if ((addr & ~REG_F0_REG_MASK) == 0)
+-		func = SDIO_FUNC_0;
+-	else
+-		func = SDIO_FUNC_1;
+ 
+-	do {
+-		/* for retry wait for 1 ms till bus get settled down */
+-		if (retry)
+-			usleep_range(1000, 2000);
+-
+-		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
+-					       data, true);
+-
+-	} while (ret != 0 && ret != -ENOMEDIUM &&
+-		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
++	if ((addr & ~REG_F0_REG_MASK) == 0) {
++		if (WARN_ON(regsz > 1))
++			return -EINVAL;
++		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
++					    *(u8 *)data, addr);
++	} else {
++		switch (regsz) {
++		case 1:
++			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
++			break;
++		case 4:
++			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
++			if (ret)
++				goto done;
+ 
+-	if (ret == -ENOMEDIUM)
+-		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
++			break;
++		default:
++			WARN(1, "Invalid reg size\n");
++			ret = -EINVAL;
++			break;
++		}
++	}
+ 
++done:
+ 	return ret;
+ }
+ 
+ static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
+ 				u8 regsz, void *data)
+ {
+-	u8 func;
+-	s32 retry = 0;
+ 	int ret;
+ 
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
+-
+ 	/*
+ 	 * figure out how to read the register based on address range
+ 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+ 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+ 	 * The rest: function 1 silicon backplane core registers
++	 * f0 reads must be bytewise
+ 	 */
+-	if ((addr & ~REG_F0_REG_MASK) == 0)
+-		func = SDIO_FUNC_0;
+-	else
+-		func = SDIO_FUNC_1;
+-
+-	do {
+-		memset(data, 0, regsz);
+-
+-		/* for retry wait for 1 ms till bus get settled down */
+-		if (retry)
+-			usleep_range(1000, 2000);
+-
+-		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
+-					       data, false);
+-
+-	} while (ret != 0 && ret != -ENOMEDIUM &&
+-		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+-
+-	if (ret == -ENOMEDIUM)
+-		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+-
+-	return ret;
+-}
+-
+-static int
+-brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
+-{
+-	int err = 0, i;
+-	u32 addr;
+-
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
+-
+-	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
+-
+-	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
+-				  addr & 0xff, &err);
+-
+-	return err;
+-}
+-
+-static int
+-brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
+-{
+-	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+-	int err = 0;
+-
+-	if (bar0 != sdiodev->sbwad) {
+-		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
+-		if (err)
+-			return err;
++	if ((addr & ~REG_F0_REG_MASK) == 0) {
++		if (WARN_ON(regsz > 1))
++			return -EINVAL;
++		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
++	} else {
++		switch (regsz) {
++		case 1:
++			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
++			break;
++		case 4:
++			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
++			if (ret)
++				goto done;
+ 
+-		sdiodev->sbwad = bar0;
++			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
++			break;
++		default:
++			WARN(1, "Invalid reg size\n");
++			ret = -EINVAL;
++			break;
++		}
+ 	}
+ 
+-	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
+-	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+-
+-	return 0;
++done:
++	return ret;
+ }
+ 
+ u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+@@ -439,15 +387,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+-	if (retval)
+-		goto done;
+-
+ 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
+-
+ 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+-done:
+ 	if (ret)
+ 		*ret = retval;
+ 
+@@ -472,13 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+-	if (retval)
+-		goto done;
+-
+ 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
+ 
+-done:
+ 	if (ret)
+ 		*ret = retval;
+ }
+@@ -886,14 +823,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	return bcmerror;
+ }
+ 
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
+ {
+-	char t_func = (char)fn;
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* issue abort cmd52 command through F0 */
+-	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+-				 1, &t_func, true);
++	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -339,7 +339,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
+ 		      u8 *data, uint size);
+ 
+ /* Issue an abort to the specified function */
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
+ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
+ 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch b/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
new file mode 100644
index 000000000..bcf59722b
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
@@ -0,0 +1,28 @@
+From 3508a056a1f45d95c874fc9af8748bf4229432b6 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:45 +0100
+Subject: [PATCH] brcmfmac: Fix asymmetric IO functions.
+
+Unlikely to be a problem, but brcmf_sdiod_regrl() is
+not symmetric with brcmf_sdiod_regrb() in initializing
+the data value on stack. Fix that.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+[arend: reword the commit message a bit]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -383,7 +383,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 
+ u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+ {
+-	u32 data = 0;
++	u32 data;
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch b/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
new file mode 100644
index 000000000..9a570450a
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
@@ -0,0 +1,53 @@
+From 12e3e74e2820e11d91ee44fd3a190cd80d109faa Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:46 +0100
+Subject: [PATCH] brcmfmac: Remove noisy debugging.
+
+If you need debugging this low level, you're doing something wrong.
+Remove these noisy debug statements so the code is more readable.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -371,9 +371,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 	u8 data;
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+ 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
+-	brcmf_dbg(SDIO, "data:0x%02x\n", data);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -386,9 +384,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	u32 data;
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+ 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
+-	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -401,7 +397,6 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
+ {
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
+ 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
+ 
+ 	if (ret)
+@@ -413,7 +408,6 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ {
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+ 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
+ 
+ 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch b/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
new file mode 100644
index 000000000..dd153fe6c
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
@@ -0,0 +1,58 @@
+From dd8a2d49e4ed321ab8e7b679499c3a98ccc5ca24 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:47 +0100
+Subject: [PATCH] brcmfmac: Rename bcmerror to err
+
+Trivial cleanup of nasty variable name
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -746,7 +746,7 @@ int
+ brcmf_sdiod_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
+ 		  u8 *data, uint size)
+ {
+-	int bcmerror = 0;
++	int err = 0;
+ 	struct sk_buff *pkt;
+ 	u32 sdaddr;
+ 	uint dsize;
+@@ -771,8 +771,8 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	/* Do the transfer(s) */
+ 	while (size) {
+ 		/* Set the backplane window to include the start address */
+-		bcmerror = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
+-		if (bcmerror)
++		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
++		if (err)
+ 			break;
+ 
+ 		brcmf_dbg(SDIO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
+@@ -785,9 +785,9 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 		skb_put(pkt, dsize);
+ 		if (write)
+ 			memcpy(pkt->data, data, dsize);
+-		bcmerror = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write,
+-					      sdaddr, pkt);
+-		if (bcmerror) {
++		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
++					 pkt);
++		if (err) {
+ 			brcmf_err("membytes transfer failed\n");
+ 			break;
+ 		}
+@@ -814,7 +814,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	sdio_release_host(sdiodev->func[1]);
+ 
+-	return bcmerror;
++	return err;
+ }
+ 
+ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
diff --git a/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch b/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
new file mode 100644
index 000000000..c260b9655
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
@@ -0,0 +1,143 @@
+From 8f13c87ccc495e30de5f58bbda967f6edd5bec53 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:26 +0100
+Subject: [PATCH] brcmfmac: Split brcmf_sdiod_buffrw function up.
+
+This function needs to be split up into separate read / write variants
+for clarity.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 67 +++++++++++++++-------
+ 1 file changed, 45 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -414,8 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
+-			     bool write, u32 addr, struct sk_buff *pkt)
++static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
++				 u32 addr, struct sk_buff *pkt)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+@@ -424,18 +424,36 @@ static int brcmf_sdiod_buffrw(struct brc
+ 	req_sz = pkt->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	if (write)
+-		err = sdio_memcpy_toio(sdiodev->func[fn], addr,
+-				       ((u8 *)(pkt->data)), req_sz);
+-	else if (fn == 1)
+-		err = sdio_memcpy_fromio(sdiodev->func[fn], ((u8 *)(pkt->data)),
+-					 addr, req_sz);
++	if (fn == 1)
++		err = sdio_memcpy_fromio(sdiodev->func[fn],
++					 ((u8 *)(pkt->data)), addr, req_sz);
+ 	else
+ 		/* function 2 read is FIFO operation */
+-		err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
+-				  req_sz);
++		err = sdio_readsb(sdiodev->func[fn],
++				  ((u8 *)(pkt->data)), addr, req_sz);
++
++	if (err == -ENOMEDIUM)
++		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++
++	return err;
++}
++
++static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
++				  u32 addr, struct sk_buff *pkt)
++{
++	unsigned int req_sz;
++	int err;
++
++	/* Single skb use the standard mmc interface */
++	req_sz = pkt->len + 3;
++	req_sz &= (uint)~3;
++
++	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
++			       ((u8 *)(pkt->data)), req_sz);
++
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++
+ 	return err;
+ }
+ 
+@@ -643,7 +661,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	if (err)
+ 		goto done;
+ 
+-	err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -665,14 +683,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 		goto done;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+-					 pktq->next);
++		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+-					 glom_skb);
++		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++					    glom_skb);
+ 		if (err)
+ 			goto done;
+ 
+@@ -707,8 +725,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
+-					 mypkt);
++		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 	return err;
+@@ -730,8 +747,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support)
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true,
+-						 addr, skb);
++			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
++						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+@@ -783,10 +800,16 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 		sdaddr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 		skb_put(pkt, dsize);
+-		if (write)
++
++		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
+-					 pkt);
++			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
++						     sdaddr, pkt);
++		} else {
++			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
++						    sdaddr, pkt);
++		}
++
+ 		if (err) {
+ 			brcmf_err("membytes transfer failed\n");
+ 			break;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch b/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
new file mode 100644
index 000000000..088a6169f
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
@@ -0,0 +1,34 @@
+From 6e24dd012bfda479d0046f7995058f167e1923bc Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:27 +0100
+Subject: [PATCH] brcmfmac: whitespace fixes in brcmf_sdiod_send_buf()
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: mention function in patch subject]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -714,6 +714,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	int err;
+ 
+ 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
++
+ 	if (!mypkt) {
+ 		brcmf_err("brcmu_pkt_buf_get_skb failed: len %d\n",
+ 			  nbytes);
+@@ -728,8 +729,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+-	return err;
+ 
++	return err;
+ }
+ 
+ int brcmf_sdiod_send_pkt(struct brcmf_sdio_dev *sdiodev,
diff --git a/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch b/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
new file mode 100644
index 000000000..a44155b61
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
@@ -0,0 +1,36 @@
+From a7323378dcf1f10a98f47b744e6f65e6fd671d84 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:28 +0100
+Subject: [PATCH] brcmfmac: Clarify if using braces.
+
+Whilst this if () statement is technically correct, it lacks clarity.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -746,16 +746,17 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 	if (err)
+ 		return err;
+ 
+-	if (pktq->qlen == 1 || !sdiodev->sg_support)
++	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+ 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+-	else
++	} else {
+ 		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
+ 					    pktq);
++	}
+ 
+ 	return err;
+ }
diff --git a/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch b/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
new file mode 100644
index 000000000..7aa3de929
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
@@ -0,0 +1,831 @@
+From 71bd508d7ded8c504ef05d1b4befecfe25e54cb1 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:29 +0100
+Subject: [PATCH] brcmfmac: Rename / replace old IO functions with simpler
+ ones.
+
+Primarily this patch removes:
+
+brcmf_sdiod_f0_writeb()
+brcmf_sdiod_reg_write()
+brcmf_sdiod_reg_read()
+
+Since we no longer use the quirky method of deciding which function to
+address via the address being accessed, take the opportunity to rename
+some IO functions more in line with common kernel code. We also convert
+those that map directly to sdio_{read,write}*() to macros.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 169 +++----------------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 186 ++++++++++-----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  28 +++-
+ 3 files changed, 138 insertions(+), 245 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -137,27 +137,27 @@ int brcmf_sdiod_intr_register(struct brc
+ 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
+ 			/* assign GPIO to SDIO core */
+ 			addr = CORE_CC_REG(SI_ENUM_BASE, gpiocontrol);
+-			gpiocontrol = brcmf_sdiod_regrl(sdiodev, addr, &ret);
++			gpiocontrol = brcmf_sdiod_readl(sdiodev, addr, &ret);
+ 			gpiocontrol |= 0x2;
+-			brcmf_sdiod_regwl(sdiodev, addr, gpiocontrol, &ret);
++			brcmf_sdiod_writel(sdiodev, addr, gpiocontrol, &ret);
+ 
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_SELECT, 0xf,
+-					  &ret);
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_SELECT,
++					   0xf, &ret);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
+ 		}
+ 
+ 		/* must configure SDIO_CCCR_IENx to enable irq */
+-		data = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
++		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
+ 		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+ 
+ 		/* redirect, configure and enable io for interrupt signal */
+ 		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
+ 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
+ 			data |= SDIO_SEPINT_ACT_HI;
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
+-
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
++				     data, &ret);
+ 		sdio_release_host(sdiodev->func[1]);
+ 	} else {
+ 		brcmf_dbg(SDIO, "Entering\n");
+@@ -183,8 +183,8 @@ void brcmf_sdiod_intr_unregister(struct
+ 
+ 		pdata = &sdiodev->settings->bus.sdio;
+ 		sdio_claim_host(sdiodev->func[1]);
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+ 		sdio_release_host(sdiodev->func[1]);
+ 
+ 		sdiodev->oob_irq_requested = false;
+@@ -242,8 +242,8 @@ static int brcmf_sdiod_set_sbaddr_window
+ 	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
+ 
+ 	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
+-				  addr & 0xff, &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
++				   addr & 0xff, &err);
+ 
+ 	return err;
+ }
+@@ -267,124 +267,15 @@ static int brcmf_sdiod_addrprep(struct b
+ 	return 0;
+ }
+ 
+-static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
+-					uint regaddr)
+-{
+-	int err_ret;
+-
+-	/*
+-	 * Can only directly write to some F0 registers.
+-	 * Handle CCCR_IENx and CCCR_ABORT command
+-	 * as a special case.
+-	 */
+-	if ((regaddr == SDIO_CCCR_ABORT) ||
+-	    (regaddr == SDIO_CCCR_IENx))
+-		sdio_writeb(func, byte, regaddr, &err_ret);
+-	else
+-		sdio_f0_writeb(func, byte, regaddr, &err_ret);
+-
+-	return err_ret;
+-}
+-
+-static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-				 u8 regsz, void *data)
+-{
+-	int ret;
+-
+-	/*
+-	 * figure out how to read the register based on address range
+-	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+-	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+-	 * The rest: function 1 silicon backplane core registers
+-	 * f0 writes must be bytewise
+-	 */
+-
+-	if ((addr & ~REG_F0_REG_MASK) == 0) {
+-		if (WARN_ON(regsz > 1))
+-			return -EINVAL;
+-		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
+-					    *(u8 *)data, addr);
+-	} else {
+-		switch (regsz) {
+-		case 1:
+-			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
+-			break;
+-		case 4:
+-			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
+-			if (ret)
+-				goto done;
+-
+-			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
+-			break;
+-		default:
+-			WARN(1, "Invalid reg size\n");
+-			ret = -EINVAL;
+-			break;
+-		}
+-	}
+-
+-done:
+-	return ret;
+-}
+-
+-static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-				u8 regsz, void *data)
+-{
+-	int ret;
+-
+-	/*
+-	 * figure out how to read the register based on address range
+-	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+-	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+-	 * The rest: function 1 silicon backplane core registers
+-	 * f0 reads must be bytewise
+-	 */
+-	if ((addr & ~REG_F0_REG_MASK) == 0) {
+-		if (WARN_ON(regsz > 1))
+-			return -EINVAL;
+-		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
+-	} else {
+-		switch (regsz) {
+-		case 1:
+-			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
+-			break;
+-		case 4:
+-			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
+-			if (ret)
+-				goto done;
+-
+-			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
+-			break;
+-		default:
+-			WARN(1, "Invalid reg size\n");
+-			ret = -EINVAL;
+-			break;
+-		}
+-	}
+-
+-done:
+-	return ret;
+-}
+-
+-u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
++u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+ {
+-	u8 data;
++	u32 data = 0;
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+-	if (ret)
+-		*ret = retval;
+-
+-	return data;
+-}
+-
+-u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+-{
+-	u32 data;
+-	int retval;
+-
+-	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
++	if (!retval)
++		data = sdio_readl(sdiodev->func[1], addr, &retval);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -392,23 +283,15 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	return data;
+ }
+ 
+-void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-		      u8 data, int *ret)
++void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr,
++			u32 data, int *ret)
+ {
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
+-
+-	if (ret)
+-		*ret = retval;
+-}
+-
+-void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-		      u32 data, int *ret)
+-{
+-	int retval;
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+-	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
++	if (!retval)
++		sdio_writel(sdiodev->func[1], data, addr, &retval);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -846,8 +729,8 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
+ {
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+-	/* issue abort cmd52 command through F0 */
+-	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
++	/* Issue abort cmd52 command through F0 */
++	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -669,7 +669,7 @@ static int r_sdreg32(struct brcmf_sdio *
+ 	int ret;
+ 
+ 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+-	*regvar = brcmf_sdiod_regrl(bus->sdiodev, core->base + offset, &ret);
++	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
+ 
+ 	return ret;
+ }
+@@ -680,7 +680,7 @@ static int w_sdreg32(struct brcmf_sdio *
+ 	int ret;
+ 
+ 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+-	brcmf_sdiod_regwl(bus->sdiodev, core->base + reg_offset, regval, &ret);
++	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
+ 
+ 	return ret;
+ }
+@@ -697,8 +697,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 
+ 	wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+ 	/* 1st KSO write goes to AOS wake up core if device is asleep  */
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+-			  wr_val, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+ 
+ 	if (on) {
+ 		/* device WAKEUP through KSO:
+@@ -724,7 +723,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 		 * just one write attempt may fail,
+ 		 * read it back until it matches written value
+ 		 */
+-		rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
++		rd_val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+ 					   &err);
+ 		if (!err) {
+ 			if ((rd_val & bmask) == cmp_val)
+@@ -734,9 +733,11 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 		/* bail out upon subsequent access errors */
+ 		if (err && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS))
+ 			break;
++
+ 		udelay(KSO_WAIT_US);
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+-				  wr_val, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val,
++				   &err);
++
+ 	} while (try_cnt++ < MAX_KSO_ATTEMPTS);
+ 
+ 	if (try_cnt > 2)
+@@ -772,15 +773,15 @@ static int brcmf_sdio_htclk(struct brcmf
+ 		clkreq =
+ 		    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+ 
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  clkreq, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   clkreq, &err);
+ 		if (err) {
+ 			brcmf_err("HT Avail request error: %d\n", err);
+ 			return -EBADE;
+ 		}
+ 
+ 		/* Check current status */
+-		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
++		clkctl = brcmf_sdiod_readb(bus->sdiodev,
+ 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 		if (err) {
+ 			brcmf_err("HT Avail read error: %d\n", err);
+@@ -790,35 +791,34 @@ static int brcmf_sdio_htclk(struct brcmf
+ 		/* Go to pending and await interrupt if appropriate */
+ 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+ 			/* Allow only clock-available interrupt */
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			if (err) {
+-				brcmf_err("Devctl error setting CA: %d\n",
+-					  err);
++				brcmf_err("Devctl error setting CA: %d\n", err);
+ 				return -EBADE;
+ 			}
+ 
+ 			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   devctl, &err);
+ 			brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
+ 			bus->clkstate = CLK_PENDING;
+ 
+ 			return 0;
+ 		} else if (bus->clkstate == CLK_PENDING) {
+ 			/* Cancel CA-only interrupt filter */
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   devctl, &err);
+ 		}
+ 
+ 		/* Otherwise, wait here (polling) for HT Avail */
+ 		timeout = jiffies +
+ 			  msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
+ 		while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+-			clkctl = brcmf_sdiod_regrb(bus->sdiodev,
++			clkctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_FUNC1_CHIPCLKCSR,
+ 						   &err);
+ 			if (time_after(jiffies, timeout))
+@@ -852,16 +852,16 @@ static int brcmf_sdio_htclk(struct brcmf
+ 
+ 		if (bus->clkstate == CLK_PENDING) {
+ 			/* Cancel CA-only interrupt filter */
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   devctl, &err);
+ 		}
+ 
+ 		bus->clkstate = CLK_SDONLY;
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  clkreq, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   clkreq, &err);
+ 		brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
+ 		if (err) {
+ 			brcmf_err("Failed access turning clock off: %d\n",
+@@ -951,14 +951,14 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *
+ 
+ 		/* Going to sleep */
+ 		if (sleep) {
+-			clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
++			clkcsr = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_FUNC1_CHIPCLKCSR,
+ 						   &err);
+ 			if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
+ 				brcmf_dbg(SDIO, "no clock, set ALP\n");
+-				brcmf_sdiod_regwb(bus->sdiodev,
+-						  SBSDIO_FUNC1_CHIPCLKCSR,
+-						  SBSDIO_ALP_AVAIL_REQ, &err);
++				brcmf_sdiod_writeb(bus->sdiodev,
++						   SBSDIO_FUNC1_CHIPCLKCSR,
++						   SBSDIO_ALP_AVAIL_REQ, &err);
+ 			}
+ 			err = brcmf_sdio_kso_control(bus, false);
+ 		} else {
+@@ -1178,16 +1178,16 @@ static void brcmf_sdio_rxfail(struct brc
+ 	if (abort)
+ 		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
+ 
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
+-			  SFC_RF_TERM, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
++			   &err);
+ 	bus->sdcnt.f1regdata++;
+ 
+ 	/* Wait until the packet has been flushed (device/FIFO stable) */
+ 	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+-		hi = brcmf_sdiod_regrb(bus->sdiodev,
+-				       SBSDIO_FUNC1_RFRAMEBCHI, &err);
+-		lo = brcmf_sdiod_regrb(bus->sdiodev,
+-				       SBSDIO_FUNC1_RFRAMEBCLO, &err);
++		hi = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCHI,
++				       &err);
++		lo = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCLO,
++				       &err);
+ 		bus->sdcnt.f1regdata += 2;
+ 
+ 		if ((hi == 0) && (lo == 0))
+@@ -1229,12 +1229,12 @@ static void brcmf_sdio_txfail(struct brc
+ 	bus->sdcnt.tx_sderrs++;
+ 
+ 	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+ 	for (i = 0; i < 3; i++) {
+-		hi = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+-		lo = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
++		hi = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
++		lo = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+ 		bus->sdcnt.f1regdata += 2;
+ 		if ((hi == 0) && (lo == 0))
+ 			break;
+@@ -2446,11 +2446,11 @@ static void brcmf_sdio_bus_stop(struct d
+ 		bus->hostintmask = 0;
+ 
+ 		/* Force backplane clocks to assure F2 interrupt propagates */
+-		saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++		saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+ 					    &err);
+ 		if (!err)
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-					  (saveclk | SBSDIO_FORCE_HT), &err);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++					   (saveclk | SBSDIO_FORCE_HT), &err);
+ 		if (err)
+ 			brcmf_err("Failed to force clock for F2: err %d\n",
+ 				  err);
+@@ -2509,7 +2509,7 @@ static int brcmf_sdio_intr_rstatus(struc
+ 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
+ 
+-	val = brcmf_sdiod_regrl(bus->sdiodev, addr, &ret);
++	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+ 	bus->sdcnt.f1regdata++;
+ 	if (ret != 0)
+ 		return ret;
+@@ -2519,7 +2519,7 @@ static int brcmf_sdio_intr_rstatus(struc
+ 
+ 	/* Clear interrupts */
+ 	if (val) {
+-		brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
++		brcmf_sdiod_writel(bus->sdiodev, addr, val, &ret);
+ 		bus->sdcnt.f1regdata++;
+ 		atomic_or(val, &bus->intstatus);
+ 	}
+@@ -2545,23 +2545,23 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ #ifdef DEBUG
+ 		/* Check for inconsistent device control */
+-		devctl = brcmf_sdiod_regrb(bus->sdiodev,
+-					   SBSDIO_DEVICE_CTL, &err);
++		devctl = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   &err);
+ #endif				/* DEBUG */
+ 
+ 		/* Read CSR, if clock on switch to AVAIL, else ignore */
+-		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
++		clkctl = brcmf_sdiod_readb(bus->sdiodev,
+ 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 
+ 		brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
+ 			  devctl, clkctl);
+ 
+ 		if (SBSDIO_HTAV(clkctl)) {
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev,
++					   SBSDIO_DEVICE_CTL, devctl, &err);
+ 			bus->clkstate = CLK_AVAIL;
+ 		}
+ 	}
+@@ -3347,31 +3347,31 @@ static void brcmf_sdio_sr_init(struct br
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
++	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
+ 	if (err) {
+ 		brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
+ 		return;
+ 	}
+ 
+ 	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
+ 		return;
+ 	}
+ 
+ 	/* Add CMD14 Support */
+-	brcmf_sdiod_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
+-			  (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
+-			   SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
+-			  &err);
++	brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
++			     (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
++			      SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
++			     &err);
+ 	if (err) {
+ 		brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
+ 		return;
+ 	}
+ 
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-			  SBSDIO_FORCE_HT, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++			   SBSDIO_FORCE_HT, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
+ 		return;
+@@ -3394,7 +3394,7 @@ static int brcmf_sdio_kso_init(struct br
+ 	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
+ 		return 0;
+ 
+-	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
++	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
+ 	if (err) {
+ 		brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
+ 		return err;
+@@ -3403,8 +3403,8 @@ static int brcmf_sdio_kso_init(struct br
+ 	if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+ 		val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
+ 			SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+-				  val, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
++				   val, &err);
+ 		if (err) {
+ 			brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
+ 			return err;
+@@ -3565,9 +3565,9 @@ static void brcmf_sdio_bus_watchdog(stru
+ 				u8 devpend;
+ 
+ 				sdio_claim_host(bus->sdiodev->func[1]);
+-				devpend = brcmf_sdiod_regrb(bus->sdiodev,
+-							    SDIO_CCCR_INTx,
+-							    NULL);
++				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
++							       SDIO_CCCR_INTx,
++							       NULL);
+ 				sdio_release_host(bus->sdiodev->func[1]);
+ 				intstatus = devpend & (INTR_STATUS_FUNC1 |
+ 						       INTR_STATUS_FUNC2);
+@@ -3705,12 +3705,12 @@ brcmf_sdio_drivestrengthinit(struct brcm
+ 			}
+ 		}
+ 		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
+-		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
+-		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
++		brcmf_sdiod_writel(sdiodev, addr, 1, NULL);
++		cc_data_temp = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 		cc_data_temp &= ~str_mask;
+ 		drivestrength_sel <<= str_shift;
+ 		cc_data_temp |= drivestrength_sel;
+-		brcmf_sdiod_regwl(sdiodev, addr, cc_data_temp, NULL);
++		brcmf_sdiod_writel(sdiodev, addr, cc_data_temp, NULL);
+ 
+ 		brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
+ 			  str_tab[i].strength, drivestrength, cc_data_temp);
+@@ -3725,7 +3725,7 @@ static int brcmf_sdio_buscoreprep(void *
+ 
+ 	/* Try forcing SDIO core to do ALPAvail request only */
+ 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+ 	if (err) {
+ 		brcmf_err("error writing for HT off\n");
+ 		return err;
+@@ -3733,8 +3733,7 @@ static int brcmf_sdio_buscoreprep(void *
+ 
+ 	/* If register supported, wait for ALPAvail and then force ALP */
+ 	/* This may take up to 15 milliseconds */
+-	clkval = brcmf_sdiod_regrb(sdiodev,
+-				   SBSDIO_FUNC1_CHIPCLKCSR, NULL);
++	clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+ 
+ 	if ((clkval & ~SBSDIO_AVBITS) != clkset) {
+ 		brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
+@@ -3742,10 +3741,11 @@ static int brcmf_sdio_buscoreprep(void *
+ 		return -EACCES;
+ 	}
+ 
+-	SPINWAIT(((clkval = brcmf_sdiod_regrb(sdiodev,
+-					      SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+-			!SBSDIO_ALPAV(clkval)),
+-			PMU_MAX_TRANSITION_DLY);
++	SPINWAIT(((clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++					      NULL)),
++		 !SBSDIO_ALPAV(clkval)),
++		 PMU_MAX_TRANSITION_DLY);
++
+ 	if (!SBSDIO_ALPAV(clkval)) {
+ 		brcmf_err("timeout on ALPAV wait, clkval 0x%02x\n",
+ 			  clkval);
+@@ -3753,11 +3753,11 @@ static int brcmf_sdio_buscoreprep(void *
+ 	}
+ 
+ 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+ 	udelay(65);
+ 
+ 	/* Also, disable the extra SDIO pull-ups */
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+ 
+ 	return 0;
+ }
+@@ -3772,7 +3772,7 @@ static void brcmf_sdio_buscore_activate(
+ 	/* clear all interrupts */
+ 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
+ 	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
+-	brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
++	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+ 
+ 	if (rstvec)
+ 		/* Write reset vector to address 0 */
+@@ -3785,7 +3785,7 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	struct brcmf_sdio_dev *sdiodev = ctx;
+ 	u32 val, rev;
+ 
+-	val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
++	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
+ 	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
+ 	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
+@@ -3802,7 +3802,7 @@ static void brcmf_sdio_buscore_write32(v
+ {
+ 	struct brcmf_sdio_dev *sdiodev = ctx;
+ 
+-	brcmf_sdiod_regwl(sdiodev, addr, val, NULL);
++	brcmf_sdiod_writel(sdiodev, addr, val, NULL);
+ }
+ 
+ static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
+@@ -3826,18 +3826,18 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	sdio_claim_host(sdiodev->func[1]);
+ 
+ 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
+-		 brcmf_sdiod_regrl(sdiodev, SI_ENUM_BASE, NULL));
++		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
+ 
+ 	/*
+ 	 * Force PLL off until brcmf_chip_attach()
+ 	 * programs PLL control regs
+ 	 */
+ 
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-			  BRCMF_INIT_CLKCTL1, &err);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, BRCMF_INIT_CLKCTL1,
++			   &err);
+ 	if (!err)
+-		clkctl = brcmf_sdiod_regrb(sdiodev,
+-					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
++		clkctl = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++					   &err);
+ 
+ 	if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
+ 		brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
+@@ -3897,25 +3897,25 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
+ 
+ 	/* Set card control so an SDIO card reset does a WLAN backplane reset */
+-	reg_val = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
++	reg_val = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
+ 	if (err)
+ 		goto fail;
+ 
+ 	reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
+ 
+-	brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
++	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
+ 	if (err)
+ 		goto fail;
+ 
+ 	/* set PMUControl so a backplane reset does PMU state reload */
+ 	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
+-	reg_val = brcmf_sdiod_regrl(sdiodev, reg_addr, &err);
++	reg_val = brcmf_sdiod_readl(sdiodev, reg_addr, &err);
+ 	if (err)
+ 		goto fail;
+ 
+ 	reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
+ 
+-	brcmf_sdiod_regwl(sdiodev, reg_addr, reg_val, &err);
++	brcmf_sdiod_writel(sdiodev, reg_addr, reg_val, &err);
+ 	if (err)
+ 		goto fail;
+ 
+@@ -4055,10 +4055,10 @@ static void brcmf_sdio_firmware_callback
+ 		goto release;
+ 
+ 	/* Force clocks on backplane to be sure F2 interrupt propagates */
+-	saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
++	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 	if (!err) {
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  (saveclk | SBSDIO_FORCE_HT), &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   (saveclk | SBSDIO_FORCE_HT), &err);
+ 	}
+ 	if (err) {
+ 		brcmf_err("Failed to force clock for F2: err %d\n", err);
+@@ -4080,7 +4080,7 @@ static void brcmf_sdio_firmware_callback
+ 		w_sdreg32(bus, bus->hostintmask,
+ 			  offsetof(struct sdpcmd_regs, hostintmask));
+ 
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_WATERMARK, 8, &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+ 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+@@ -4091,8 +4091,8 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdio_sr_init(bus);
+ 	} else {
+ 		/* Restore previous clock setting */
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  saveclk, &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   saveclk, &err);
+ 	}
+ 
+ 	if (err == 0) {
+@@ -4225,7 +4225,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	bus->rxflow = false;
+ 
+ 	/* Done with backplane-dependent accesses, can drop clock... */
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+ 
+ 	sdio_release_host(bus->sdiodev->func[1]);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -50,6 +50,7 @@
+ #define SBSDIO_NUM_FUNCTION		3
+ 
+ /* function 0 vendor specific CCCR registers */
++
+ #define SDIO_CCCR_BRCM_CARDCAP			0xf0
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
+@@ -131,8 +132,6 @@
+ /* with b15, maps to 32-bit SB access */
+ #define SBSDIO_SB_ACCESS_2_4B_FLAG	0x08000
+ 
+-/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+-
+ /* Address bits from SBADDR regs */
+ #define SBSDIO_SBWINDOW_MASK		0xffff8000
+ 
+@@ -293,13 +292,24 @@ struct sdpcmd_regs {
+ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev);
+ 
+-/* sdio device register access interface */
+-u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+-u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+-void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
+-		       int *ret);
+-void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
+-		       int *ret);
++/* SDIO device register access interface */
++/* Accessors for SDIO Function 0 */
++#define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
++	sdio_readb((sdiodev)->func[0], (addr), (r))
++
++#define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
++	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
++
++/* Accessors for SDIO Function 1 */
++#define brcmf_sdiod_readb(sdiodev, addr, r) \
++	sdio_readb((sdiodev)->func[1], (addr), (r))
++
++#define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
++	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
++
++u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
++void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
++			int *ret);
+ 
+ /* Buffer transfer to/from device (client) core via cmd53.
+  *   fn:       function number
diff --git a/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch b/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
new file mode 100644
index 000000000..e77d601a8
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
@@ -0,0 +1,59 @@
+From eeef8a5da781e11746347b3cd9f1942be48ebaf0 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:30 +0100
+Subject: [PATCH] brcmfmac: Tidy register definitions a little
+
+Trivial tidy of register definitions.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  4 ++--
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 19 ++++++++++---------
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -153,9 +153,9 @@ int brcmf_sdiod_intr_register(struct brc
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+ 
+ 		/* redirect, configure and enable io for interrupt signal */
+-		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
++		data = SDIO_CCCR_BRCM_SEPINT_MASK | SDIO_CCCR_BRCM_SEPINT_OE;
+ 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
+-			data |= SDIO_SEPINT_ACT_HI;
++			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
+ 				     data, &ret);
+ 		sdio_release_host(sdiodev->func[1]);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -52,16 +52,17 @@
+ /* function 0 vendor specific CCCR registers */
+ 
+ #define SDIO_CCCR_BRCM_CARDCAP			0xf0
+-#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
+-#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
+-#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	0x08
+-#define SDIO_CCCR_BRCM_CARDCTRL		0xf1
+-#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	0x02
+-#define SDIO_CCCR_BRCM_SEPINT			0xf2
++#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	BIT(1)
++#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
++#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
++
++#define SDIO_CCCR_BRCM_CARDCTRL			0xf1
++#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
+ 
+-#define  SDIO_SEPINT_MASK		0x01
+-#define  SDIO_SEPINT_OE			0x02
+-#define  SDIO_SEPINT_ACT_HI		0x04
++#define SDIO_CCCR_BRCM_SEPINT			0xf2
++#define SDIO_CCCR_BRCM_SEPINT_MASK		BIT(0)
++#define SDIO_CCCR_BRCM_SEPINT_OE		BIT(1)
++#define SDIO_CCCR_BRCM_SEPINT_ACT_HI		BIT(2)
+ 
+ /* function 1 miscellaneous registers */
+ 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch b/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
new file mode 100644
index 000000000..44303fa41
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
@@ -0,0 +1,190 @@
+From a7c3aa1509e243a09c5b1660c8702d792ca76aed Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:31 +0100
+Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_addrprep()
+
+This function has become trivial enough that it may as well be pushed into
+its callers, which has the side-benefit of clarifying what's going on.
+
+Remove it, and rename brcmf_sdiod_set_sbaddr_window() to
+brcmf_sdiod_set_backplane_window() as it's easier to understand.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 84 ++++++++++++----------
+ 1 file changed, 46 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -230,41 +230,25 @@ void brcmf_sdiod_change_state(struct brc
+ 	sdiodev->state = state;
+ }
+ 
+-static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
+-					 u32 address)
++static int brcmf_sdiod_set_backplane_window(struct brcmf_sdio_dev *sdiodev,
++					    u32 addr)
+ {
++	u32 v, bar0 = addr & SBSDIO_SBWINDOW_MASK;
+ 	int err = 0, i;
+-	u32 addr;
+ 
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
++	if (bar0 == sdiodev->sbwad)
++		return 0;
+ 
+-	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
++	v = bar0 >> 8;
+ 
+-	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
++	for (i = 0 ; i < 3 && !err ; i++, v >>= 8)
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
+-				   addr & 0xff, &err);
+-
+-	return err;
+-}
+-
+-static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
+-{
+-	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+-	int err = 0;
+-
+-	if (bar0 != sdiodev->sbwad) {
+-		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
+-		if (err)
+-			return err;
++				   v & 0xff, &err);
+ 
++	if (!err)
+ 		sdiodev->sbwad = bar0;
+-	}
+-
+-	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
+-	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	return 0;
++	return err;
+ }
+ 
+ u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+@@ -272,11 +256,16 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
+ 	u32 data = 0;
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
++	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
++	if (retval)
++		goto out;
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	if (!retval)
+-		data = sdio_readl(sdiodev->func[1], addr, &retval);
++	data = sdio_readl(sdiodev->func[1], addr, &retval);
+ 
++out:
+ 	if (ret)
+ 		*ret = retval;
+ 
+@@ -288,11 +277,16 @@ void brcmf_sdiod_writel(struct brcmf_sdi
+ {
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
++	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
++	if (retval)
++		goto out;
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	if (!retval)
+-		sdio_writel(sdiodev->func[1], data, addr, &retval);
++	sdio_writel(sdiodev->func[1], data, addr, &retval);
+ 
++out:
+ 	if (ret)
+ 		*ret = retval;
+ }
+@@ -540,10 +534,13 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+ 		goto done;
+ 
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
+ 	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
+ 
+ done:
+@@ -561,10 +558,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+ 		  addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+ 		goto done;
+ 
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
+ 	if (pktq->qlen == 1)
+ 		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
+ 					    pktq->next);
+@@ -606,7 +606,12 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 
+ 	memcpy(mypkt->data, buf, nbytes);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
++	if (err)
++		return err;
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+ 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
+@@ -625,10 +630,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+ 		return err;
+ 
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+ 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
+@@ -673,7 +681,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	/* Do the transfer(s) */
+ 	while (size) {
+ 		/* Set the backplane window to include the start address */
+-		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
++		err = brcmf_sdiod_set_backplane_window(sdiodev, address);
+ 		if (err)
+ 			break;
+ 
+@@ -716,7 +724,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	dev_kfree_skb(pkt);
+ 
+ 	/* Return the window to backplane enumeration space for core access */
+-	if (brcmf_sdiod_set_sbaddr_window(sdiodev, sdiodev->sbwad))
++	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
+ 		brcmf_err("FAILED to set window back to 0x%x\n",
+ 			  sdiodev->sbwad);
+ 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch b/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
new file mode 100644
index 000000000..b9410dd7d
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
@@ -0,0 +1,32 @@
+From c900072bd6faff089aa4fb7b19136a2a0fe3baf0 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:32 +0100
+Subject: [PATCH] brcmfmac: remove unnecessary call to
+ brcmf_sdiod_set_backplane_window()
+
+All functions that might require the window address changing call
+brcmf_sdiod_set_backplane_window() prior to access. Thus resetting
+the window is not required.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+[arend: corrected the driver prefix in the subject]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -723,11 +723,6 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	dev_kfree_skb(pkt);
+ 
+-	/* Return the window to backplane enumeration space for core access */
+-	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
+-		brcmf_err("FAILED to set window back to 0x%x\n",
+-			  sdiodev->sbwad);
+-
+ 	sdio_release_host(sdiodev->func[1]);
+ 
+ 	return err;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch b/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
new file mode 100644
index 000000000..f9e5df550
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
@@ -0,0 +1,134 @@
+From e4c05fc3c0a6c79376f72f17d08014477e962ada Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:33 +0100
+Subject: [PATCH] brcmfmac: Cleanup offsetof()
+
+Create a macro to make the code a bit more readable, whilst we're stuck
+with using struct element offsets as register offsets.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: rename macro to SD_REG]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 35 +++++++++-------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -161,6 +161,8 @@ struct rte_console {
+ 
+ #define CORE_BUS_REG(base, field) \
+ 		(base + offsetof(struct sdpcmd_regs, field))
++#define SD_REG(field) \
++		(offsetof(struct sdpcmd_regs, field))
+ 
+ /* SDIO function 1 register CHIPCLKCSR */
+ /* Force ALP request to backplane */
+@@ -1087,12 +1089,10 @@ static u32 brcmf_sdio_hostmail(struct br
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Read mailbox data and ack that we did so */
+-	ret = r_sdreg32(bus, &hmb_data,
+-			offsetof(struct sdpcmd_regs, tohostmailboxdata));
++	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
+ 
+ 	if (ret == 0)
+-		w_sdreg32(bus, SMB_INT_ACK,
+-			  offsetof(struct sdpcmd_regs, tosbmailbox));
++		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
+ 	bus->sdcnt.f1regdata += 2;
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+@@ -1207,8 +1207,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 
+ 	if (rtx) {
+ 		bus->sdcnt.rxrtx++;
+-		err = w_sdreg32(bus, SMB_NAK,
+-				offsetof(struct sdpcmd_regs, tosbmailbox));
++		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
+ 
+ 		bus->sdcnt.f1regdata++;
+ 		if (err == 0)
+@@ -2333,9 +2332,7 @@ static uint brcmf_sdio_sendfromq(struct
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+ 			sdio_claim_host(bus->sdiodev->func[1]);
+-			ret = r_sdreg32(bus, &intstatus,
+-					offsetof(struct sdpcmd_regs,
+-						 intstatus));
++			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
+ 			sdio_release_host(bus->sdiodev->func[1]);
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+@@ -2441,7 +2438,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 		/* Disable and clear interrupts at the chip level also */
+-		w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
++		w_sdreg32(bus, 0, SD_REG(hostintmask));
+ 		local_hostintmask = bus->hostintmask;
+ 		bus->hostintmask = 0;
+ 
+@@ -2460,8 +2457,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+-		w_sdreg32(bus, local_hostintmask,
+-			  offsetof(struct sdpcmd_regs, intstatus));
++		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
+ 
+ 		sdio_release_host(sdiodev->func[1]);
+ 	}
+@@ -2507,7 +2503,7 @@ static int brcmf_sdio_intr_rstatus(struc
+ 	int ret;
+ 
+ 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+-	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
++	addr = buscore->base + SD_REG(intstatus);
+ 
+ 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+ 	bus->sdcnt.f1regdata++;
+@@ -2584,11 +2580,9 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	 */
+ 	if (intstatus & I_HMB_FC_CHANGE) {
+ 		intstatus &= ~I_HMB_FC_CHANGE;
+-		err = w_sdreg32(bus, I_HMB_FC_CHANGE,
+-				offsetof(struct sdpcmd_regs, intstatus));
++		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
+ 
+-		err = r_sdreg32(bus, &newstatus,
+-				offsetof(struct sdpcmd_regs, intstatus));
++		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
+ 		bus->sdcnt.f1regdata += 2;
+ 		atomic_set(&bus->fcstate,
+ 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
+@@ -3771,7 +3765,7 @@ static void brcmf_sdio_buscore_activate(
+ 
+ 	/* clear all interrupts */
+ 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
+-	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
++	reg_addr = core->base + SD_REG(intstatus);
+ 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+ 
+ 	if (rstvec)
+@@ -4067,7 +4061,7 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	/* Enable function 2 (frame transfers) */
+ 	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
+-		  offsetof(struct sdpcmd_regs, tosbmailboxdata));
++		  SD_REG(tosbmailboxdata));
+ 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 
+@@ -4077,8 +4071,7 @@ static void brcmf_sdio_firmware_callback
+ 	if (!err) {
+ 		/* Set up the interrupt mask and enable interrupts */
+ 		bus->hostintmask = HOSTINTMASK;
+-		w_sdreg32(bus, bus->hostintmask,
+-			  offsetof(struct sdpcmd_regs, hostintmask));
++		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
+ 
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
diff --git a/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch b/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
new file mode 100644
index 000000000..df72a70b3
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
@@ -0,0 +1,26 @@
+From 5cfe38f1f8d3c6b98e15b8cfde05028a3c79930b Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:34 +0100
+Subject: [PATCH] brcmfmac: Remove unused macro.
+
+This macro is used exactly nowhere in the code. Delete it.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -159,8 +159,6 @@ struct rte_console {
+ /* manfid tuple length, include tuple, link bytes */
+ #define SBSDIO_CIS_MANFID_TUPLE_LEN	6
+ 
+-#define CORE_BUS_REG(base, field) \
+-		(base + offsetof(struct sdpcmd_regs, field))
+ #define SD_REG(field) \
+ 		(offsetof(struct sdpcmd_regs, field))
+ 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch b/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
new file mode 100644
index 000000000..69fbf5c80
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
@@ -0,0 +1,128 @@
+From 21a10846d09db3c5e3bdfb0be0fc7aa9fdc7000a Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:35 +0100
+Subject: [PATCH] brcmfmac: Remove repeated calls to brcmf_chip_get_core()
+
+There is no need to repeatdly call brcmf_chip_get_core(), which
+traverses a list of cores every time its called (including during
+register access code!).
+
+Call it once, and store a pointer to the core structure. The existing
+code does nto keep track of users of the cores anyway, and even so, this
+will allow for easier refcounting in future.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 25 +++++++++++++---------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -436,6 +436,7 @@ struct brcmf_sdio_count {
+ struct brcmf_sdio {
+ 	struct brcmf_sdio_dev *sdiodev;	/* sdio device handler */
+ 	struct brcmf_chip *ci;	/* Chip info struct */
++	struct brcmf_core *sdio_core; /* sdio core info struct */
+ 
+ 	u32 hostintmask;	/* Copy of Host Interrupt Mask */
+ 	atomic_t intstatus;	/* Intstatus bits (events) pending */
+@@ -665,10 +666,9 @@ static bool data_ok(struct brcmf_sdio *b
+  */
+ static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
+ {
+-	struct brcmf_core *core;
++	struct brcmf_core *core = bus->sdio_core;
+ 	int ret;
+ 
+-	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
+ 
+ 	return ret;
+@@ -676,10 +676,9 @@ static int r_sdreg32(struct brcmf_sdio *
+ 
+ static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
+ {
+-	struct brcmf_core *core;
++	struct brcmf_core *core = bus->sdio_core;
+ 	int ret;
+ 
+-	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
+ 
+ 	return ret;
+@@ -2495,12 +2494,11 @@ static inline void brcmf_sdio_clrintr(st
+ 
+ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
+ {
+-	struct brcmf_core *buscore;
++	struct brcmf_core *buscore = bus->sdio_core;
+ 	u32 addr;
+ 	unsigned long val;
+ 	int ret;
+ 
+-	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	addr = buscore->base + SD_REG(intstatus);
+ 
+ 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+@@ -3377,13 +3375,14 @@ static void brcmf_sdio_sr_init(struct br
+ /* enable KSO bit */
+ static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
+ {
++	struct brcmf_core *core = bus->sdio_core;
+ 	u8 val;
+ 	int err = 0;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	/* KSO bit added in SDIO core rev 12 */
+-	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
++	if (core->rev < 12)
+ 		return 0;
+ 
+ 	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
+@@ -3412,6 +3411,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ 	struct brcmf_sdio *bus = sdiodev->bus;
++	struct brcmf_core *core = bus->sdio_core;
+ 	uint pad_size;
+ 	u32 value;
+ 	int err;
+@@ -3420,7 +3420,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	 * a device perspective, ie. bus:txglom affects the
+ 	 * bus transfers from device to host.
+ 	 */
+-	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12) {
++	if (core->rev < 12) {
+ 		/* for sdio core rev < 12, disable txgloming */
+ 		value = 0;
+ 		err = brcmf_iovar_data_set(dev, "bus:txglom", &value,
+@@ -3758,11 +3758,10 @@ static void brcmf_sdio_buscore_activate(
+ 					u32 rstvec)
+ {
+ 	struct brcmf_sdio_dev *sdiodev = ctx;
+-	struct brcmf_core *core;
++	struct brcmf_core *core = sdiodev->bus->sdio_core;
+ 	u32 reg_addr;
+ 
+ 	/* clear all interrupts */
+-	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
+ 	reg_addr = core->base + SD_REG(intstatus);
+ 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+ 
+@@ -3843,6 +3842,12 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 		bus->ci = NULL;
+ 		goto fail;
+ 	}
++
++	/* Pick up the SDIO core info struct from chip.c */
++	bus->sdio_core   = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
++	if (!bus->sdio_core)
++		goto fail;
++
+ 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
+ 						   BRCMF_BUSTYPE_SDIO,
+ 						   bus->ci->chip,
diff --git a/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch b/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
new file mode 100644
index 000000000..731b7eda1
--- /dev/null
+++ b/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
@@ -0,0 +1,44 @@
+From 7762bb134e3b40e8ee2611365775b7432190a9c7 Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Mon, 11 Dec 2017 15:38:21 +0800
+Subject: [PATCH] brcmfmac: enlarge buffer size of caps to 512 bytes
+
+The buffer size of return of cap iovar is greater than 256 bytes in some
+firmwares. For instance, the return size of cap iovar is 271 bytes in 4373
+13.10.246.79 firmare. It makes feature capability parsing failed because
+caps buffer is default value.
+So we enlarge caps buffer size to 512 bytes and add the error print for
+cap iovar error.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -130,13 +130,19 @@ static void brcmf_feat_iovar_data_set(st
+ 	}
+ }
+ 
++#define MAX_CAPS_BUFFER_SIZE	512
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
+-	char caps[256];
++	char caps[MAX_CAPS_BUFFER_SIZE];
+ 	enum brcmf_feat_id id;
+-	int i;
++	int i, err;
++
++	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
++	if (err) {
++		brcmf_err("could not get firmware cap (%d)\n", err);
++		return;
++	}
+ 
+-	brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
+ 	brcmf_dbg(INFO, "[ %s]\n", caps);
+ 
+ 	for (i = 0; i < ARRAY_SIZE(brcmf_fwcap_map); i++) {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch b/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
new file mode 100644
index 000000000..291cd5d78
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
@@ -0,0 +1,227 @@
+From 3d110df8f74781354051e4bb1e3e97fa368b2f80 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:07 +0100
+Subject: [PATCH] brcmfmac: Remove {r,w}_sdreg32
+
+Remove yet another IO function from the code and replace with one
+that already exists.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: keep address calculation, ie. (base + offset) in one line]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 88 +++++++++++-----------
+ 1 file changed, 42 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -660,30 +660,6 @@ static bool data_ok(struct brcmf_sdio *b
+ 	       ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
+ }
+ 
+-/*
+- * Reads a register in the SDIO hardware block. This block occupies a series of
+- * adresses on the 32 bit backplane bus.
+- */
+-static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
+-{
+-	struct brcmf_core *core = bus->sdio_core;
+-	int ret;
+-
+-	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
+-
+-	return ret;
+-}
+-
+-static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
+-{
+-	struct brcmf_core *core = bus->sdio_core;
+-	int ret;
+-
+-	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
+-
+-	return ret;
+-}
+-
+ static int
+ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
+ {
+@@ -1078,6 +1054,8 @@ static void brcmf_sdio_get_console_addr(
+ 
+ static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
+ {
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_core *core = bus->sdio_core;
+ 	u32 intstatus = 0;
+ 	u32 hmb_data;
+ 	u8 fcbits;
+@@ -1086,10 +1064,14 @@ static u32 brcmf_sdio_hostmail(struct br
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Read mailbox data and ack that we did so */
+-	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
++	hmb_data = brcmf_sdiod_readl(sdiod,
++				     core->base + SD_REG(tohostmailboxdata),
++				     &ret);
++
++	if (!ret)
++		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
++				   SMB_INT_ACK, &ret);
+ 
+-	if (ret == 0)
+-		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
+ 	bus->sdcnt.f1regdata += 2;
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+@@ -1163,6 +1145,8 @@ static u32 brcmf_sdio_hostmail(struct br
+ 
+ static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
+ {
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_core *core = bus->sdio_core;
+ 	uint retries = 0;
+ 	u16 lastrbc;
+ 	u8 hi, lo;
+@@ -1204,7 +1188,8 @@ static void brcmf_sdio_rxfail(struct brc
+ 
+ 	if (rtx) {
+ 		bus->sdcnt.rxrtx++;
+-		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
++		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
++				   SMB_NAK, &err);
+ 
+ 		bus->sdcnt.f1regdata++;
+ 		if (err == 0)
+@@ -2291,6 +2276,7 @@ static uint brcmf_sdio_sendfromq(struct
+ {
+ 	struct sk_buff *pkt;
+ 	struct sk_buff_head pktq;
++	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
+ 	u32 intstatus = 0;
+ 	int ret = 0, prec_out, i;
+ 	uint cnt = 0;
+@@ -2329,7 +2315,8 @@ static uint brcmf_sdio_sendfromq(struct
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+ 			sdio_claim_host(bus->sdiodev->func[1]);
+-			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
++			intstatus = brcmf_sdiod_readl(bus->sdiodev,
++						      intstat_addr, &ret);
+ 			sdio_release_host(bus->sdiodev->func[1]);
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+@@ -2413,12 +2400,13 @@ static int brcmf_sdio_tx_ctrlframe(struc
+ 
+ static void brcmf_sdio_bus_stop(struct device *dev)
+ {
+-	u32 local_hostintmask;
+-	u8 saveclk;
+-	int err;
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ 	struct brcmf_sdio *bus = sdiodev->bus;
++	struct brcmf_core *core = bus->sdio_core;
++	u32 local_hostintmask;
++	u8 saveclk;
++	int err;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -2435,7 +2423,9 @@ static void brcmf_sdio_bus_stop(struct d
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 		/* Disable and clear interrupts at the chip level also */
+-		w_sdreg32(bus, 0, SD_REG(hostintmask));
++		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(hostintmask),
++				   0, NULL);
++
+ 		local_hostintmask = bus->hostintmask;
+ 		bus->hostintmask = 0;
+ 
+@@ -2454,7 +2444,8 @@ static void brcmf_sdio_bus_stop(struct d
+ 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+-		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
++		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
++				   local_hostintmask, NULL);
+ 
+ 		sdio_release_host(sdiodev->func[1]);
+ 	}
+@@ -2521,7 +2512,9 @@ static int brcmf_sdio_intr_rstatus(struc
+ 
+ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
+ {
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
+ 	u32 newstatus = 0;
++	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
+ 	unsigned long intstatus;
+ 	uint txlimit = bus->txbound;	/* Tx frames to send before resched */
+ 	uint framecnt;			/* Temporary counter of tx/rx frames */
+@@ -2576,9 +2569,10 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	 */
+ 	if (intstatus & I_HMB_FC_CHANGE) {
+ 		intstatus &= ~I_HMB_FC_CHANGE;
+-		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
++		brcmf_sdiod_writel(sdiod, intstat_addr, I_HMB_FC_CHANGE, &err);
++
++		newstatus = brcmf_sdiod_readl(sdiod, intstat_addr, &err);
+ 
+-		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
+ 		bus->sdcnt.f1regdata += 2;
+ 		atomic_set(&bus->fcstate,
+ 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
+@@ -4017,22 +4011,21 @@ static void brcmf_sdio_firmware_callback
+ 					 const struct firmware *code,
+ 					 void *nvram, u32 nvram_len)
+ {
+-	struct brcmf_bus *bus_if;
+-	struct brcmf_sdio_dev *sdiodev;
+-	struct brcmf_sdio *bus;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_core *core = bus->sdio_core;
+ 	u8 saveclk;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+-	bus_if = dev_get_drvdata(dev);
+-	sdiodev = bus_if->bus_priv.sdio;
++
+ 	if (err)
+ 		goto fail;
+ 
+ 	if (!bus_if->drvr)
+ 		return;
+ 
+-	bus = sdiodev->bus;
+-
+ 	/* try to download image and nvram to the dongle */
+ 	bus->alp_only = true;
+ 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+@@ -4063,8 +4056,9 @@ static void brcmf_sdio_firmware_callback
+ 	}
+ 
+ 	/* Enable function 2 (frame transfers) */
+-	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
+-		  SD_REG(tosbmailboxdata));
++	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
++			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
++
+ 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 
+@@ -4074,7 +4068,9 @@ static void brcmf_sdio_firmware_callback
+ 	if (!err) {
+ 		/* Set up the interrupt mask and enable interrupts */
+ 		bus->hostintmask = HOSTINTMASK;
+-		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
++		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
++				   bus->hostintmask, NULL);
++
+ 
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch b/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
new file mode 100644
index 000000000..e9b562830
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
@@ -0,0 +1,33 @@
+From dbda7dacb79a377e8ed9d38ce0e4a58b70aa9060 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 19 Dec 2017 13:47:08 +0100
+Subject: [PATCH] brcmfmac: Rename buscore to core for consistency
+
+Avoid confusion with unrelated _buscore labels.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: only do the rename]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2485,12 +2485,12 @@ static inline void brcmf_sdio_clrintr(st
+ 
+ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
+ {
+-	struct brcmf_core *buscore = bus->sdio_core;
++	struct brcmf_core *core = bus->sdio_core;
+ 	u32 addr;
+ 	unsigned long val;
+ 	int ret;
+ 
+-	addr = buscore->base + SD_REG(intstatus);
++	addr = core->base + SD_REG(intstatus);
+ 
+ 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+ 	bus->sdcnt.f1regdata++;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch b/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
new file mode 100644
index 000000000..3828c320f
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
@@ -0,0 +1,82 @@
+From 874bb8e49b7c6368f8ff9f2566c7bd06a2249be0 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:09 +0100
+Subject: [PATCH] brcmfmac: stabilise the value of ->sbwad in use for some xfer
+ routines.
+
+The IO functions operate within the Chipcommon IO window. Explicitly
+set this, rather than relying on the last initialisation IO access to
+leave it set to the right value by chance.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 5 +++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 1 +
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -529,7 +529,7 @@ int brcmf_sdiod_recv_buf(struct brcmf_sd
+ 
+ int brcmf_sdiod_recv_pkt(struct brcmf_sdio_dev *sdiodev, struct sk_buff *pkt)
+ {
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err = 0;
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
+@@ -552,7 +552,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ {
+ 	struct sk_buff *glom_skb = NULL;
+ 	struct sk_buff *skb;
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err = 0;
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+@@ -593,7 +593,7 @@ done:
+ int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
+ {
+ 	struct sk_buff *mypkt;
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err;
+ 
+ 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
+@@ -625,7 +625,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 			 struct sk_buff_head *pktq)
+ {
+ 	struct sk_buff *skb;
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err;
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3842,6 +3842,11 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	if (!bus->sdio_core)
+ 		goto fail;
+ 
++	/* Pick up the CHIPCOMMON core info struct, for bulk IO in bcmsdh.c */
++	sdiodev->cc_core = brcmf_chip_get_core(bus->ci, BCMA_CORE_CHIPCOMMON);
++	if (!sdiodev->cc_core)
++		goto fail;
++
+ 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
+ 						   BRCMF_BUSTYPE_SDIO,
+ 						   bus->ci->chip,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -178,6 +178,7 @@ struct brcmf_sdio_dev {
+ 	struct sdio_func *func[SDIO_MAX_FUNCS];
+ 	u8 num_funcs;			/* Supported funcs on client */
+ 	u32 sbwad;			/* Save backplane window address */
++	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+ 	struct brcmf_sdio *bus;
+ 	struct device *dev;
+ 	struct brcmf_bus *bus_if;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch b/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
new file mode 100644
index 000000000..86b269a34
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
@@ -0,0 +1,45 @@
+From 508422f3695bf66f7b85fb4723c22f5166003ec6 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:10 +0100
+Subject: [PATCH] brcmfmac: Correctly handle accesses to SDIO func0
+
+Rather than workaround the restrictions on func0 addressing in the
+driver, set MMC_QUIRK_LENIENT_FN0
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 ++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 4 ++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -995,6 +995,10 @@ static int brcmf_ops_sdio_probe(struct s
+ 	brcmf_dbg(SDIO, "Function#: %d\n", func->num);
+ 
+ 	dev = &func->dev;
++
++	/* Set MMC_QUIRK_LENIENT_FN0 for this card */
++	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
++
+ 	/* prohibit ACPI power management for this device */
+ 	brcmf_sdiod_acpi_set_power_manageable(dev, 0);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -297,10 +297,10 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_readb((sdiodev)->func[0], (addr), (r))
++	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch b/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
new file mode 100644
index 000000000..715b86561
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
@@ -0,0 +1,111 @@
+From 99d7b6fdfc8c24052c92c720330d31ca1332f996 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:11 +0100
+Subject: [PATCH] brcmfmac: Remove func0 from function array
+
+func0 is not provided by the mmc stack as a function when probing.
+Instead providing specific access functions to read/write it.
+
+This prepares for a patch to remove the actual array entry itself.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: rephrased the commit message]
+[arend: removed unrelated comment for which separate patch is warranted]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  5 +----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   |  7 ++++---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 13 ++++++-------
+ 3 files changed, 11 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1022,8 +1022,7 @@ static int brcmf_ops_sdio_probe(struct s
+ 	/* store refs to functions used. mmc_card does
+ 	 * not hold the F0 function pointer.
+ 	 */
+-	sdiodev->func[0] = kmemdup(func, sizeof(*func), GFP_KERNEL);
+-	sdiodev->func[0]->num = 0;
++	sdiodev->func[0] = NULL;
+ 	sdiodev->func[1] = func->card->sdio_func[0];
+ 	sdiodev->func[2] = func;
+ 
+@@ -1049,7 +1048,6 @@ static int brcmf_ops_sdio_probe(struct s
+ fail:
+ 	dev_set_drvdata(&func->dev, NULL);
+ 	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+-	kfree(sdiodev->func[0]);
+ 	kfree(sdiodev);
+ 	kfree(bus_if);
+ 	return err;
+@@ -1082,7 +1080,6 @@ static void brcmf_ops_sdio_remove(struct
+ 		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
+ 
+ 		kfree(bus_if);
+-		kfree(sdiodev->func[0]);
+ 		kfree(sdiodev);
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3771,9 +3771,10 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	u32 val, rev;
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+-	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
+-	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
+-	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
++
++	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
++	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
++	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -21,7 +21,9 @@
+ #include <linux/firmware.h>
+ #include "firmware.h"
+ 
+-#define SDIO_FUNC_0		0
++/* Maximum number of I/O funcs */
++#define NUM_SDIO_FUNCS	3
++
+ #define SDIO_FUNC_1		1
+ #define SDIO_FUNC_2		2
+ 
+@@ -39,9 +41,6 @@
+ #define INTR_STATUS_FUNC1	0x2
+ #define INTR_STATUS_FUNC2	0x4
+ 
+-/* Maximum number of I/O funcs */
+-#define SDIOD_MAX_IOFUNCS	7
+-
+ /* mask of register map */
+ #define REG_F0_REG_MASK		0x7FF
+ #define REG_F1_MISC_MASK	0x1FFFF
+@@ -175,7 +174,7 @@ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
+ struct brcmf_sdio_dev {
+-	struct sdio_func *func[SDIO_MAX_FUNCS];
++	struct sdio_func *func[NUM_SDIO_FUNCS];
+ 	u8 num_funcs;			/* Supported funcs on client */
+ 	u32 sbwad;			/* Save backplane window address */
+ 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+@@ -297,10 +296,10 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
++	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch b/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
new file mode 100644
index 000000000..71e4894b0
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
@@ -0,0 +1,40 @@
+From bcadaaa097c7ec103fe75f9da41f8fe52693b644 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 19 Dec 2017 13:47:12 +0100
+Subject: [PATCH] brcmfmac: More efficient and slightly easier to read fixup
+ for 4339 chips
+
+Its more efficient to test the register we're interested in first,
+potentially avoiding two more comparisons, and therefore always avoiding
+one comparison per call on all other chips.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+[arend: fix some checkpatch warnings]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3772,15 +3772,16 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
+-	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
+-	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
+-	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
++	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
++	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
++	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+ 			val |= BRCM_CC_4339_CHIP_ID;
+ 		}
+ 	}
++
+ 	return val;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch b/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
new file mode 100644
index 000000000..4354a7081
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
@@ -0,0 +1,347 @@
+From 00eb62cfc5f806b003fe5d54c8b5fe9a9665482f Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:13 +0100
+Subject: [PATCH] brcmfmac: Replace function index with function pointer
+
+In preparation for removing the function array, remove all code that
+refers to function by index and replace with pointers to the function
+itself.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: replace BUG() with WARN() macro]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 85 ++++++++++++----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 15 ++--
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  6 +-
+ 3 files changed, 56 insertions(+), 50 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -291,8 +291,9 @@ out:
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
+-				 u32 addr, struct sk_buff *pkt)
++static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
++				 struct sdio_func *func, u32 addr,
++				 struct sk_buff *pkt)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+@@ -301,13 +302,19 @@ static int brcmf_sdiod_buff_read(struct
+ 	req_sz = pkt->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	if (fn == 1)
+-		err = sdio_memcpy_fromio(sdiodev->func[fn],
+-					 ((u8 *)(pkt->data)), addr, req_sz);
+-	else
+-		/* function 2 read is FIFO operation */
+-		err = sdio_readsb(sdiodev->func[fn],
+-				  ((u8 *)(pkt->data)), addr, req_sz);
++	switch (func->num) {
++	case 1:
++		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
++					 req_sz);
++		break;
++	case 2:
++		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
++		break;
++	default:
++		/* bail out as things are really fishy here */
++		WARN(1, "invalid sdio function number: %d\n", func->num);
++		err = -ENOMEDIUM;
++	};
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -315,8 +322,9 @@ static int brcmf_sdiod_buff_read(struct
+ 	return err;
+ }
+ 
+-static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
+-				  u32 addr, struct sk_buff *pkt)
++static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
++				  struct sdio_func *func, u32 addr,
++				  struct sk_buff *pkt)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+@@ -325,8 +333,7 @@ static int brcmf_sdiod_buff_write(struct
+ 	req_sz = pkt->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
+-			       ((u8 *)(pkt->data)), req_sz);
++	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -337,7 +344,7 @@ static int brcmf_sdiod_buff_write(struct
+ /**
+  * brcmf_sdiod_sglist_rw - SDIO interface function for block data access
+  * @sdiodev: brcmfmac sdio device
+- * @fn: SDIO function number
++ * @func: SDIO function
+  * @write: direction flag
+  * @addr: dongle memory address as source/destination
+  * @pkt: skb pointer
+@@ -346,7 +353,8 @@ static int brcmf_sdiod_buff_write(struct
+  * stack for block data access. It assumes that the skb passed down by the
+  * caller has already been padded and aligned.
+  */
+-static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
++static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev,
++				 struct sdio_func *func,
+ 				 bool write, u32 addr,
+ 				 struct sk_buff_head *pktlist)
+ {
+@@ -372,7 +380,7 @@ static int brcmf_sdiod_sglist_rw(struct
+ 		req_sz = 0;
+ 		skb_queue_walk(pktlist, pkt_next)
+ 			req_sz += pkt_next->len;
+-		req_sz = ALIGN(req_sz, sdiodev->func[fn]->cur_blksize);
++		req_sz = ALIGN(req_sz, func->cur_blksize);
+ 		while (req_sz > PAGE_SIZE) {
+ 			pkt_next = brcmu_pkt_buf_get_skb(PAGE_SIZE);
+ 			if (pkt_next == NULL) {
+@@ -391,7 +399,7 @@ static int brcmf_sdiod_sglist_rw(struct
+ 		target_list = &local_list;
+ 	}
+ 
+-	func_blk_sz = sdiodev->func[fn]->cur_blksize;
++	func_blk_sz = func->cur_blksize;
+ 	max_req_sz = sdiodev->max_request_size;
+ 	max_seg_cnt = min_t(unsigned short, sdiodev->max_segment_count,
+ 			    target_list->qlen);
+@@ -408,10 +416,10 @@ static int brcmf_sdiod_sglist_rw(struct
+ 	mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
+ 	mmc_cmd.opcode = SD_IO_RW_EXTENDED;
+ 	mmc_cmd.arg = write ? 1<<31 : 0;	/* write flag  */
+-	mmc_cmd.arg |= (fn & 0x7) << 28;	/* SDIO func num */
+-	mmc_cmd.arg |= 1<<27;			/* block mode */
++	mmc_cmd.arg |= (func->num & 0x7) << 28;	/* SDIO func num */
++	mmc_cmd.arg |= 1 << 27;			/* block mode */
+ 	/* for function 1 the addr will be incremented */
+-	mmc_cmd.arg |= (fn == 1) ? 1<<26 : 0;
++	mmc_cmd.arg |= (func->num == 1) ? 1 << 26 : 0;
+ 	mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+ 	mmc_req.cmd = &mmc_cmd;
+ 	mmc_req.data = &mmc_dat;
+@@ -457,11 +465,11 @@ static int brcmf_sdiod_sglist_rw(struct
+ 		mmc_cmd.arg |= (addr & 0x1FFFF) << 9;	/* address */
+ 		mmc_cmd.arg |= mmc_dat.blocks & 0x1FF;	/* block count */
+ 		/* incrementing addr for function 1 */
+-		if (fn == 1)
++		if (func->num == 1)
+ 			addr += req_sz;
+ 
+-		mmc_set_data_timeout(&mmc_dat, sdiodev->func[fn]->card);
+-		mmc_wait_for_req(sdiodev->func[fn]->card->host, &mmc_req);
++		mmc_set_data_timeout(&mmc_dat, func->card);
++		mmc_wait_for_req(func->card->host, &mmc_req);
+ 
+ 		ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
+ 		if (ret == -ENOMEDIUM) {
+@@ -541,7 +549,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -566,13 +574,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
+ 					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
+ 					    glom_skb);
+ 		if (err)
+ 			goto done;
+@@ -582,8 +590,8 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 			skb_pull(glom_skb, skb->len);
+ 		}
+ 	} else
+-		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
+-					    pktq);
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
++					    addr, pktq);
+ 
+ done:
+ 	brcmu_pkt_buf_free_skb(glom_skb);
+@@ -614,7 +622,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
++		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
++					     mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+@@ -639,14 +648,14 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+ 	} else {
+-		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
+-					    pktq);
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
++					    addr, pktq);
+ 	}
+ 
+ 	return err;
+@@ -696,10 +705,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
+ 						     sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
++			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
+ 						    sdaddr, pkt);
+ 		}
+ 
+@@ -728,12 +737,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	return err;
+ }
+ 
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func)
+ {
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Issue abort cmd52 command through F0 */
+-	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
++	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, func->num, NULL);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
+@@ -1105,7 +1114,7 @@ static int brcmf_ops_sdio_suspend(struct
+ 
+ 	func = container_of(dev, struct sdio_func, dev);
+ 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
+-	if (func->num != SDIO_FUNC_1)
++	if (func->num != 1)
+ 		return 0;
+ 
+ 
+@@ -1134,7 +1143,7 @@ static int brcmf_ops_sdio_resume(struct
+ 	struct sdio_func *func = container_of(dev, struct sdio_func, dev);
+ 
+ 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
+-	if (func->num != SDIO_FUNC_2)
++	if (func->num != 2)
+ 		return 0;
+ 
+ 	brcmf_sdiod_freezer_off(sdiodev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 		  rtx ? ", send NAK" : "");
+ 
+ 	if (abort)
+-		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
++		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
+ 			   &err);
+@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
+ 	brcmf_err("sdio error, abort command and terminate frame\n");
+ 	bus->sdcnt.tx_sderrs++;
+ 
+-	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
++	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
+ 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
+ 	int ntail, ret;
+ 
+ 	sdiodev = bus->sdiodev;
+-	blksize = sdiodev->func[SDIO_FUNC_2]->cur_blksize;
++	blksize = sdiodev->func[2]->cur_blksize;
+ 	/* sg entry alignment should be a divisor of block size */
+ 	WARN_ON(blksize % bus->sgentry_align);
+ 
+@@ -2441,7 +2441,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 
+ 		/* Turn off the bus (F2), free any pending packets */
+ 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
+-		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
++		sdio_disable_func(sdiodev->func[2]);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+ 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
+@@ -4066,8 +4066,7 @@ static void brcmf_sdio_firmware_callback
+ 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
+ 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
+ 
+-	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+-
++	err = sdio_enable_func(sdiodev->func[2]);
+ 
+ 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+ 
+@@ -4082,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+-		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
++		sdio_disable_func(sdiodev->func[2]);
+ 		goto release;
+ 	}
+ 
+@@ -4219,7 +4218,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	sdio_claim_host(bus->sdiodev->func[1]);
+ 
+ 	/* Disable F2 to clear any intermediate frame state on the dongle */
+-	sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
++	sdio_disable_func(bus->sdiodev->func[2]);
+ 
+ 	bus->rxflow = false;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -45,9 +45,6 @@
+ #define REG_F0_REG_MASK		0x7FF
+ #define REG_F1_MISC_MASK	0x1FFFF
+ 
+-/* as of sdiod rev 0, supports 3 functions */
+-#define SBSDIO_NUM_FUNCTION		3
+-
+ /* function 0 vendor specific CCCR registers */
+ 
+ #define SDIO_CCCR_BRCM_CARDCAP			0xf0
+@@ -350,7 +347,8 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
+ 		      u8 *data, uint size);
+ 
+ /* Issue an abort to the specified function */
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func);
++
+ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
+ 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch b/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
new file mode 100644
index 000000000..d732c8e58
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
@@ -0,0 +1,53 @@
+From 9c3438ed215adba7025268ee1f0b6f7a2af12316 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:14 +0100
+Subject: [PATCH] brcmfmac: Clean up interrupt macros
+
+Make it more obvious that this code acually enables interrupts, and
+provide nice definitions for the bits in the register.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 8 +++++---
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -149,7 +149,8 @@ int brcmf_sdiod_intr_register(struct brc
+ 
+ 		/* must configure SDIO_CCCR_IENx to enable irq */
+ 		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
+-		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
++		data |= SDIO_CCCR_IEN_FUNC1 | SDIO_CCCR_IEN_FUNC2 |
++			SDIO_CCCR_IEN_FUNC0;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+ 
+ 		/* redirect, configure and enable io for interrupt signal */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -24,9 +24,6 @@
+ /* Maximum number of I/O funcs */
+ #define NUM_SDIO_FUNCS	3
+ 
+-#define SDIO_FUNC_1		1
+-#define SDIO_FUNC_2		2
+-
+ #define SDIOD_FBR_SIZE		0x100
+ 
+ /* io_en */
+@@ -52,6 +49,11 @@
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
+ 
++/* Interrupt enable bits for each function */
++#define SDIO_CCCR_IEN_FUNC0			BIT(0)
++#define SDIO_CCCR_IEN_FUNC1			BIT(1)
++#define SDIO_CCCR_IEN_FUNC2			BIT(2)
++
+ #define SDIO_CCCR_BRCM_CARDCTRL			0xf1
+ #define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
+ 
diff --git a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
new file mode 100644
index 000000000..d010d23f0
--- /dev/null
+++ b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
@@ -0,0 +1,27 @@
+From e3720dad99859251a8b0fe2807275a8afcfb560d Mon Sep 17 00:00:00 2001
+From: Double Lo <double.lo@cypress.com>
+Date: Tue, 19 Dec 2017 14:56:44 +0800
+Subject: [PATCH] brcmfmac: Support 43455 save-restore (SR) feature if FW
+ include -sr
+
+This patch will add 43455 into the save-restore(SR) capable chip list, so
+the SR engine will be enabled with 43455 FW which built-in the -sr
+function.
+
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -1338,6 +1338,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 	switch (pub->chip) {
+ 	case BRCM_CC_4354_CHIP_ID:
+ 	case BRCM_CC_4356_CHIP_ID:
++	case BRCM_CC_4345_CHIP_ID:
+ 		/* explicitly check SR engine enable bit */
+ 		pmu_cc3_mask = BIT(2);
+ 		/* fall-through */
diff --git a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
new file mode 100644
index 000000000..bd9de13d7
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
@@ -0,0 +1,1043 @@
+From c9aa7a91de740c537dc8c2f9f3d36fc651371b13 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:52 +0100
+Subject: [PATCH] brcmfmac: Remove array of functions
+
+Replace the array of functions with a pair of pointers to the
+relevant functions.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 115 +++++++-------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 168 ++++++++++-----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  15 +-
+ 3 files changed, 146 insertions(+), 152 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -118,7 +118,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 
+ 		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
+ 				  pdata->oob_irq_flags, "brcmf_oob_intr",
+-				  &sdiodev->func[1]->dev);
++				  &sdiodev->func1->dev);
+ 		if (ret != 0) {
+ 			brcmf_err("request_irq failed %d\n", ret);
+ 			return ret;
+@@ -132,7 +132,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 		}
+ 		sdiodev->irq_wake = true;
+ 
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 
+ 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
+ 			/* assign GPIO to SDIO core */
+@@ -159,13 +159,13 @@ int brcmf_sdiod_intr_register(struct brc
+ 			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
+ 				     data, &ret);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 	} else {
+ 		brcmf_dbg(SDIO, "Entering\n");
+-		sdio_claim_host(sdiodev->func[1]);
+-		sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler);
+-		sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
++		sdio_claim_irq(sdiodev->func1, brcmf_sdiod_ib_irqhandler);
++		sdio_claim_irq(sdiodev->func2, brcmf_sdiod_dummy_irqhandler);
++		sdio_release_host(sdiodev->func1);
+ 		sdiodev->sd_irq_requested = true;
+ 	}
+ 
+@@ -183,26 +183,26 @@ void brcmf_sdiod_intr_unregister(struct
+ 		struct brcmfmac_sdio_pd *pdata;
+ 
+ 		pdata = &sdiodev->settings->bus.sdio;
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 
+ 		sdiodev->oob_irq_requested = false;
+ 		if (sdiodev->irq_wake) {
+ 			disable_irq_wake(pdata->oob_irq_nr);
+ 			sdiodev->irq_wake = false;
+ 		}
+-		free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
++		free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev);
+ 		sdiodev->irq_en = false;
+ 		sdiodev->oob_irq_requested = false;
+ 	}
+ 
+ 	if (sdiodev->sd_irq_requested) {
+-		sdio_claim_host(sdiodev->func[1]);
+-		sdio_release_irq(sdiodev->func[2]);
+-		sdio_release_irq(sdiodev->func[1]);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
++		sdio_release_irq(sdiodev->func2);
++		sdio_release_irq(sdiodev->func1);
++		sdio_release_host(sdiodev->func1);
+ 		sdiodev->sd_irq_requested = false;
+ 	}
+ }
+@@ -264,7 +264,7 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	data = sdio_readl(sdiodev->func[1], addr, &retval);
++	data = sdio_readl(sdiodev->func1, addr, &retval);
+ 
+ out:
+ 	if (ret)
+@@ -285,7 +285,7 @@ void brcmf_sdiod_writel(struct brcmf_sdi
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	sdio_writel(sdiodev->func[1], data, addr, &retval);
++	sdio_writel(sdiodev->func1, data, addr, &retval);
+ 
+ out:
+ 	if (ret)
+@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -575,13 +575,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+ 					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+ 					    glom_skb);
+ 		if (err)
+ 			goto done;
+@@ -591,7 +591,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 			skb_pull(glom_skb, skb->len);
+ 		}
+ 	} else
+-		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, false,
+ 					    addr, pktq);
+ 
+ done:
+@@ -623,7 +623,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
+ 					     mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+@@ -649,13 +649,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+ 	} else {
+-		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, true,
+ 					    addr, pktq);
+ 	}
+ 
+@@ -686,7 +686,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	else
+ 		dsize = size;
+ 
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	/* Do the transfer(s) */
+ 	while (size) {
+@@ -706,10 +706,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
+ 						     sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
++			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
+ 						    sdaddr, pkt);
+ 		}
+ 
+@@ -733,7 +733,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	dev_kfree_skb(pkt);
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	return err;
+ }
+@@ -757,7 +757,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
+ 	uint nents;
+ 	int err;
+ 
+-	func = sdiodev->func[2];
++	func = sdiodev->func2;
+ 	host = func->card->host;
+ 	sdiodev->sg_support = host->max_segs > 1;
+ 	max_blocks = min_t(uint, host->max_blk_count, 511u);
+@@ -818,17 +818,17 @@ static int brcmf_sdiod_freezer_on(struct
+ 	brcmf_sdio_trigger_dpc(sdiodev->bus);
+ 	wait_event(sdiodev->freezer->thread_freeze,
+ 		   atomic_read(expect) == sdiodev->freezer->frozen_count);
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	res = brcmf_sdio_sleep(sdiodev->bus, true);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return res;
+ }
+ 
+ static void brcmf_sdiod_freezer_off(struct brcmf_sdio_dev *sdiodev)
+ {
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	brcmf_sdio_sleep(sdiodev->bus, false);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	atomic_set(&sdiodev->freezer->freezing, 0);
+ 	complete_all(&sdiodev->freezer->resumed);
+ }
+@@ -878,19 +878,19 @@ static int brcmf_sdiod_remove(struct brc
+ 	brcmf_sdiod_freezer_detach(sdiodev);
+ 
+ 	/* Disable Function 2 */
+-	sdio_claim_host(sdiodev->func[2]);
+-	sdio_disable_func(sdiodev->func[2]);
+-	sdio_release_host(sdiodev->func[2]);
++	sdio_claim_host(sdiodev->func2);
++	sdio_disable_func(sdiodev->func2);
++	sdio_release_host(sdiodev->func2);
+ 
+ 	/* Disable Function 1 */
+-	sdio_claim_host(sdiodev->func[1]);
+-	sdio_disable_func(sdiodev->func[1]);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
++	sdio_disable_func(sdiodev->func1);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	sg_free_table(&sdiodev->sgtable);
+ 	sdiodev->sbwad = 0;
+ 
+-	pm_runtime_allow(sdiodev->func[1]->card->host->parent);
++	pm_runtime_allow(sdiodev->func1->card->host->parent);
+ 	return 0;
+ }
+ 
+@@ -906,29 +906,27 @@ static int brcmf_sdiod_probe(struct brcm
+ {
+ 	int ret = 0;
+ 
+-	sdiodev->num_funcs = 2;
++	sdio_claim_host(sdiodev->func1);
+ 
+-	sdio_claim_host(sdiodev->func[1]);
+-
+-	ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
++	ret = sdio_set_block_size(sdiodev->func1, SDIO_FUNC1_BLOCKSIZE);
+ 	if (ret) {
+ 		brcmf_err("Failed to set F1 blocksize\n");
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 		goto out;
+ 	}
+-	ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
++	ret = sdio_set_block_size(sdiodev->func2, SDIO_FUNC2_BLOCKSIZE);
+ 	if (ret) {
+ 		brcmf_err("Failed to set F2 blocksize\n");
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 		goto out;
+ 	}
+ 
+ 	/* increase F2 timeout */
+-	sdiodev->func[2]->enable_timeout = SDIO_WAIT_F2RDY;
++	sdiodev->func2->enable_timeout = SDIO_WAIT_F2RDY;
+ 
+ 	/* Enable Function 1 */
+-	ret = sdio_enable_func(sdiodev->func[1]);
+-	sdio_release_host(sdiodev->func[1]);
++	ret = sdio_enable_func(sdiodev->func1);
++	sdio_release_host(sdiodev->func1);
+ 	if (ret) {
+ 		brcmf_err("Failed to enable F1: err=%d\n", ret);
+ 		goto out;
+@@ -944,7 +942,7 @@ static int brcmf_sdiod_probe(struct brcm
+ 		ret = -ENODEV;
+ 		goto out;
+ 	}
+-	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
++	brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
+ out:
+ 	if (ret)
+ 		brcmf_sdiod_remove(sdiodev);
+@@ -1032,16 +1030,15 @@ static int brcmf_ops_sdio_probe(struct s
+ 	/* store refs to functions used. mmc_card does
+ 	 * not hold the F0 function pointer.
+ 	 */
+-	sdiodev->func[0] = NULL;
+-	sdiodev->func[1] = func->card->sdio_func[0];
+-	sdiodev->func[2] = func;
++	sdiodev->func1 = func->card->sdio_func[0];
++	sdiodev->func2 = func;
+ 
+ 	sdiodev->bus_if = bus_if;
+ 	bus_if->bus_priv.sdio = sdiodev;
+ 	bus_if->proto_type = BRCMF_PROTO_BCDC;
+ 	dev_set_drvdata(&func->dev, bus_if);
+-	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
+-	sdiodev->dev = &sdiodev->func[1]->dev;
++	dev_set_drvdata(&sdiodev->func1->dev, bus_if);
++	sdiodev->dev = &sdiodev->func1->dev;
+ 
+ 	brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
+ 
+@@ -1057,7 +1054,7 @@ static int brcmf_ops_sdio_probe(struct s
+ 
+ fail:
+ 	dev_set_drvdata(&func->dev, NULL);
+-	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
++	dev_set_drvdata(&sdiodev->func1->dev, NULL);
+ 	kfree(sdiodev);
+ 	kfree(bus_if);
+ 	return err;
+@@ -1086,8 +1083,8 @@ static void brcmf_ops_sdio_remove(struct
+ 		/* only proceed with rest of cleanup if func 1 */
+ 		brcmf_sdiod_remove(sdiodev);
+ 
+-		dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+-		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
++		dev_set_drvdata(&sdiodev->func1->dev, NULL);
++		dev_set_drvdata(&sdiodev->func2->dev, NULL);
+ 
+ 		kfree(bus_if);
+ 		kfree(sdiodev);
+@@ -1132,7 +1129,7 @@ static int brcmf_ops_sdio_suspend(struct
+ 		else
+ 			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
+ 	}
+-	if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
++	if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags))
+ 		brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
+ 	return 0;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -979,7 +979,7 @@ static int brcmf_sdio_readshared(struct
+ 	struct sdpcm_shared_le sh_le;
+ 	__le32 addr_le;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 	/*
+@@ -1013,7 +1013,7 @@ static int brcmf_sdio_readshared(struct
+ 	if (rv < 0)
+ 		goto fail;
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* Endianness */
+ 	sh->flags = le32_to_cpu(sh_le.flags);
+@@ -1035,7 +1035,7 @@ static int brcmf_sdio_readshared(struct
+ fail:
+ 	brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
+ 		  rv, addr);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 	return rv;
+ }
+ 
+@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 		  rtx ? ", send NAK" : "");
+ 
+ 	if (abort)
+-		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
++		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func2);
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
+ 			   &err);
+@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
+ 	brcmf_err("sdio error, abort command and terminate frame\n");
+ 	bus->sdcnt.tx_sderrs++;
+ 
+-	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
++	brcmf_sdiod_abort(sdiodev, sdiodev->func2);
+ 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+@@ -1565,10 +1565,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 		 * read directly into the chained packet, or allocate a large
+ 		 * packet and and copy into the chain.
+ 		 */
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
+ 						 &bus->glom, dlen);
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		bus->sdcnt.f2rxdata++;
+ 
+ 		/* On failure, kill the superframe */
+@@ -1576,11 +1576,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 			brcmf_err("glom read of %d bytes failed: %d\n",
+ 				  dlen, errcode);
+ 
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true, false);
+ 			bus->sdcnt.rxglomfail++;
+ 			brcmf_sdio_free_glom(bus);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			return 0;
+ 		}
+ 
+@@ -1590,10 +1590,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		rd_new.seq_num = rxseq;
+ 		rd_new.len = dlen;
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
+ 					     BRCMF_SDIO_FT_SUPER);
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		bus->cur_read.len = rd_new.len_nxtfrm << 4;
+ 
+ 		/* Remove superframe header, remember offset */
+@@ -1609,10 +1609,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 			rd_new.len = pnext->len;
+ 			rd_new.seq_num = rxseq++;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
+ 						     BRCMF_SDIO_FT_SUB);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
+ 					   pnext->data, 32, "subframe:\n");
+ 
+@@ -1621,11 +1621,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		if (errcode) {
+ 			/* Terminate frame on error */
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true, false);
+ 			bus->sdcnt.rxglomfail++;
+ 			brcmf_sdio_free_glom(bus);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			bus->cur_read.len = 0;
+ 			return 0;
+ 		}
+@@ -1833,7 +1833,7 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 		rd->len_left = rd->len;
+ 		/* read header first for unknow frame length */
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (!rd->len) {
+ 			ret = brcmf_sdiod_recv_buf(bus->sdiodev,
+ 						   bus->rxhdr, BRCMF_FIRSTREAD);
+@@ -1843,7 +1843,7 @@ static uint brcmf_sdio_readframes(struct
+ 					  ret);
+ 				bus->sdcnt.rx_hdrfail++;
+ 				brcmf_sdio_rxfail(bus, true, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				continue;
+ 			}
+ 
+@@ -1853,7 +1853,7 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				if (!bus->rxpending)
+ 					break;
+ 				else
+@@ -1869,7 +1869,7 @@ static uint brcmf_sdio_readframes(struct
+ 				rd->len_nxtfrm = 0;
+ 				/* treat all packet as event if we don't know */
+ 				rd->channel = SDPCM_EVENT_CHANNEL;
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				continue;
+ 			}
+ 			rd->len_left = rd->len > BRCMF_FIRSTREAD ?
+@@ -1886,7 +1886,7 @@ static uint brcmf_sdio_readframes(struct
+ 			brcmf_err("brcmu_pkt_buf_get_skb failed\n");
+ 			brcmf_sdio_rxfail(bus, false,
+ 					    RETRYCHAN(rd->channel));
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			continue;
+ 		}
+ 		skb_pull(pkt, head_read);
+@@ -1894,16 +1894,16 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 		ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
+ 		bus->sdcnt.f2rxdata++;
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 
+ 		if (ret < 0) {
+ 			brcmf_err("read %d bytes from channel %d failed: %d\n",
+ 				  rd->len, rd->channel, ret);
+ 			brcmu_pkt_buf_free_skb(pkt);
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true,
+ 					    RETRYCHAN(rd->channel));
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			continue;
+ 		}
+ 
+@@ -1914,7 +1914,7 @@ static uint brcmf_sdio_readframes(struct
+ 		} else {
+ 			memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
+ 			rd_new.seq_num = rd->seq_num;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+ 				rd->len = 0;
+@@ -1927,11 +1927,11 @@ static uint brcmf_sdio_readframes(struct
+ 					  roundup(rd_new.len, 16) >> 4);
+ 				rd->len = 0;
+ 				brcmf_sdio_rxfail(bus, true, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				brcmu_pkt_buf_free_skb(pkt);
+ 				continue;
+ 			}
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			rd->len_nxtfrm = rd_new.len_nxtfrm;
+ 			rd->channel = rd_new.channel;
+ 			rd->dat_offset = rd_new.dat_offset;
+@@ -1947,9 +1947,9 @@ static uint brcmf_sdio_readframes(struct
+ 					  rd_new.seq_num);
+ 				/* Force retry w/normal header read */
+ 				rd->len = 0;
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_rxfail(bus, false, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				brcmu_pkt_buf_free_skb(pkt);
+ 				continue;
+ 			}
+@@ -1972,9 +1972,9 @@ static uint brcmf_sdio_readframes(struct
+ 			} else {
+ 				brcmf_err("%s: glom superframe w/o "
+ 					  "descriptor!\n", __func__);
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_rxfail(bus, false, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 			/* prepare the descriptor for the next read */
+ 			rd->len = rd->len_nxtfrm << 4;
+@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
+ 	int ntail, ret;
+ 
+ 	sdiodev = bus->sdiodev;
+-	blksize = sdiodev->func[2]->cur_blksize;
++	blksize = sdiodev->func2->cur_blksize;
+ 	/* sg entry alignment should be a divisor of block size */
+ 	WARN_ON(blksize % bus->sgentry_align);
+ 
+@@ -2251,14 +2251,14 @@ static int brcmf_sdio_txpkt(struct brcmf
+ 	if (ret)
+ 		goto done;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
+ 	bus->sdcnt.f2txdata++;
+ 
+ 	if (ret < 0)
+ 		brcmf_sdio_txfail(bus);
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ done:
+ 	brcmf_sdio_txpkt_postp(bus, pktq);
+@@ -2314,10 +2314,11 @@ static uint brcmf_sdio_sendfromq(struct
+ 		/* In poll mode, need to check for other events */
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			intstatus = brcmf_sdiod_readl(bus->sdiodev,
+ 						      intstat_addr, &ret);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
++
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+ 				break;
+@@ -2417,7 +2418,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 	}
+ 
+ 	if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 
+ 		/* Enable clock for device interrupts */
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+@@ -2441,13 +2442,13 @@ static void brcmf_sdio_bus_stop(struct d
+ 
+ 		/* Turn off the bus (F2), free any pending packets */
+ 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
+-		sdio_disable_func(sdiodev->func[2]);
++		sdio_disable_func(sdiodev->func2);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+ 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
+ 				   local_hostintmask, NULL);
+ 
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 	}
+ 	/* Clear the data packet queues */
+ 	brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
+@@ -2522,7 +2523,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* If waiting for HTAVAIL, check status */
+ 	if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
+@@ -2585,7 +2586,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 		intstatus |= brcmf_sdio_hostmail(bus);
+ 	}
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* Generally don't ask for these, can get CRC errors... */
+ 	if (intstatus & I_WR_OOSYNC) {
+@@ -2628,7 +2629,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
+ 	    data_ok(bus)) {
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+ 						      bus->ctrl_frame_len);
+@@ -2636,7 +2637,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 			wmb();
+ 			bus->ctrl_frame_stat = false;
+ 		}
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		brcmf_sdio_wait_event_wakeup(bus);
+ 	}
+ 	/* Send queued frames (limit 1 if rx may still be pending) */
+@@ -2652,14 +2653,14 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 		brcmf_err("failed backplane access over SDIO, halting operation\n");
+ 		atomic_set(&bus->intstatus, 0);
+ 		if (bus->ctrl_frame_stat) {
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			if (bus->ctrl_frame_stat) {
+ 				bus->ctrl_frame_err = -ENODEV;
+ 				wmb();
+ 				bus->ctrl_frame_stat = false;
+ 				brcmf_sdio_wait_event_wakeup(bus);
+ 			}
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 		}
+ 	} else if (atomic_read(&bus->intstatus) ||
+ 		   atomic_read(&bus->ipend) > 0 ||
+@@ -2874,13 +2875,13 @@ brcmf_sdio_bus_txctl(struct device *dev,
+ 					 CTL_DONE_TIMEOUT);
+ 	ret = 0;
+ 	if (bus->ctrl_frame_stat) {
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			brcmf_dbg(SDIO, "ctrl_frame timeout\n");
+ 			bus->ctrl_frame_stat = false;
+ 			ret = -ETIMEDOUT;
+ 		}
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 	}
+ 	if (!ret) {
+ 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
+@@ -3004,7 +3005,7 @@ static int brcmf_sdio_assert_info(struct
+ 		return 0;
+ 	}
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	if (sh->assert_file_addr != 0) {
+ 		error = brcmf_sdiod_ramrw(bus->sdiodev, false,
+ 					  sh->assert_file_addr, (u8 *)file, 80);
+@@ -3017,7 +3018,7 @@ static int brcmf_sdio_assert_info(struct
+ 		if (error < 0)
+ 			return error;
+ 	}
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	seq_printf(seq, "dongle assert: %s:%d: assert(%s)\n",
+ 		   file, sh->assert_line, expr);
+@@ -3291,7 +3292,7 @@ static int brcmf_sdio_download_firmware(
+ 	int bcmerror;
+ 	u32 rstvec;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+ 
+ 	rstvec = get_unaligned_le32(fw->data);
+@@ -3320,7 +3321,7 @@ static int brcmf_sdio_download_firmware(
+ 
+ err:
+ 	brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 	return bcmerror;
+ }
+ 
+@@ -3435,7 +3436,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (sdiodev->sg_support) {
+ 		bus->txglom = false;
+ 		value = 1;
+-		pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
++		pad_size = bus->sdiodev->func2->cur_blksize << 1;
+ 		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
+ 					   &value, sizeof(u32));
+ 		if (err < 0) {
+@@ -3477,7 +3478,7 @@ static int brcmf_sdio_bus_get_memdump(st
+ 
+ 	address = bus->ci->rambase;
+ 	offset = err = 0;
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	while (offset < mem_size) {
+ 		len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
+ 		      mem_size - offset;
+@@ -3493,7 +3494,7 @@ static int brcmf_sdio_bus_get_memdump(st
+ 	}
+ 
+ done:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return err;
+ }
+ 
+@@ -3550,11 +3551,10 @@ static void brcmf_sdio_bus_watchdog(stru
+ 			if (!bus->dpc_triggered) {
+ 				u8 devpend;
+ 
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
+-							       SDIO_CCCR_INTx,
+-							       NULL);
+-				sdio_release_host(bus->sdiodev->func[1]);
++						  SDIO_CCCR_INTx, NULL);
++				sdio_release_host(bus->sdiodev->func1);
+ 				intstatus = devpend & (INTR_STATUS_FUNC1 |
+ 						       INTR_STATUS_FUNC2);
+ 			}
+@@ -3580,13 +3580,13 @@ static void brcmf_sdio_bus_watchdog(stru
+ 		bus->console.count += jiffies_to_msecs(BRCMF_WD_POLL);
+ 		if (bus->console.count >= bus->console_interval) {
+ 			bus->console.count -= bus->console_interval;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			/* Make sure backplane clock is on */
+ 			brcmf_sdio_bus_sleep(bus, false, false);
+ 			if (brcmf_sdio_readconsole(bus) < 0)
+ 				/* stop on error */
+ 				bus->console_interval = 0;
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 		}
+ 	}
+ #endif				/* DEBUG */
+@@ -3599,11 +3599,11 @@ static void brcmf_sdio_bus_watchdog(stru
+ 			bus->idlecount++;
+ 			if (bus->idlecount > bus->idletime) {
+ 				brcmf_dbg(SDIO, "idle\n");
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_wd_timer(bus, false);
+ 				bus->idlecount = 0;
+ 				brcmf_sdio_bus_sleep(bus, true, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 		} else {
+ 			bus->idlecount = 0;
+@@ -3773,8 +3773,8 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
+ 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
+-	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
+-	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
++	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
++	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+@@ -3810,7 +3810,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	u32 drivestrength;
+ 
+ 	sdiodev = bus->sdiodev;
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
+ 		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
+@@ -3877,8 +3877,8 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
+ 	 * is true or when platform data OOB irq is true).
+ 	 */
+-	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
+-	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
++	if ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_KEEP_POWER) &&
++	    ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_WAKE_SDIO_IRQ) ||
+ 	     (sdiodev->settings->bus.sdio.oob_irq_supported)))
+ 		sdiodev->bus_if->wowl_supported = true;
+ #endif
+@@ -3917,7 +3917,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	if (err)
+ 		goto fail;
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
+ 
+@@ -3938,7 +3938,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	return true;
+ 
+ fail:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return false;
+ }
+ 
+@@ -4044,7 +4044,7 @@ static void brcmf_sdio_firmware_callback
+ 	bus->sdcnt.tickcnt = 0;
+ 	brcmf_sdio_wd_timer(bus, true);
+ 
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+@@ -4066,7 +4066,7 @@ static void brcmf_sdio_firmware_callback
+ 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
+ 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
+ 
+-	err = sdio_enable_func(sdiodev->func[2]);
++	err = sdio_enable_func(sdiodev->func2);
+ 
+ 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+ 
+@@ -4081,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+-		sdio_disable_func(sdiodev->func[2]);
++		sdio_disable_func(sdiodev->func2);
+ 		goto release;
+ 	}
+ 
+@@ -4106,7 +4106,7 @@ static void brcmf_sdio_firmware_callback
+ 	if (err != 0)
+ 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	err = brcmf_bus_started(dev);
+ 	if (err != 0) {
+@@ -4116,10 +4116,10 @@ static void brcmf_sdio_firmware_callback
+ 	return;
+ 
+ release:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(&sdiodev->func[2]->dev);
++	device_release_driver(&sdiodev->func2->dev);
+ 	device_release_driver(dev);
+ }
+ 
+@@ -4146,7 +4146,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 
+ 	/* single-threaded workqueue */
+ 	wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
+-				     dev_name(&sdiodev->func[1]->dev));
++				     dev_name(&sdiodev->func1->dev));
+ 	if (!wq) {
+ 		brcmf_err("insufficient memory to create txworkqueue\n");
+ 		goto fail;
+@@ -4173,7 +4173,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	init_completion(&bus->watchdog_wait);
+ 	bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
+ 					bus, "brcmf_wdog/%s",
+-					dev_name(&sdiodev->func[1]->dev));
++					dev_name(&sdiodev->func1->dev));
+ 	if (IS_ERR(bus->watchdog_tsk)) {
+ 		pr_warn("brcmf_watchdog thread failed to start\n");
+ 		bus->watchdog_tsk = NULL;
+@@ -4199,7 +4199,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	}
+ 
+ 	/* Query the F2 block size, set roundup accordingly */
+-	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
++	bus->blocksize = bus->sdiodev->func2->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+ 
+ 	/* Allocate buffers */
+@@ -4215,17 +4215,17 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 		}
+ 	}
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* Disable F2 to clear any intermediate frame state on the dongle */
+-	sdio_disable_func(bus->sdiodev->func[2]);
++	sdio_disable_func(bus->sdiodev->func2);
+ 
+ 	bus->rxflow = false;
+ 
+ 	/* Done with backplane-dependent accesses, can drop clock... */
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* ...and initialize clock/power states */
+ 	bus->clkstate = CLK_SDONLY;
+@@ -4277,7 +4277,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 
+ 		if (bus->ci) {
+ 			if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_wd_timer(bus, false);
+ 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+ 				/* Leave the device in state where it is
+@@ -4287,7 +4287,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 				msleep(20);
+ 				brcmf_chip_set_passive(bus->ci);
+ 				brcmf_sdio_clkctl(bus, CLK_NONE, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 			brcmf_chip_detach(bus->ci);
+ 		}
+@@ -4334,9 +4334,9 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
+ {
+ 	int ret;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	ret = brcmf_sdio_bus_sleep(bus, sleep, false);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	return ret;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -21,9 +21,6 @@
+ #include <linux/firmware.h>
+ #include "firmware.h"
+ 
+-/* Maximum number of I/O funcs */
+-#define NUM_SDIO_FUNCS	3
+-
+ #define SDIOD_FBR_SIZE		0x100
+ 
+ /* io_en */
+@@ -173,8 +170,8 @@ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
+ struct brcmf_sdio_dev {
+-	struct sdio_func *func[NUM_SDIO_FUNCS];
+-	u8 num_funcs;			/* Supported funcs on client */
++	struct sdio_func *func1;
++	struct sdio_func *func2;
+ 	u32 sbwad;			/* Save backplane window address */
+ 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+ 	struct brcmf_sdio *bus;
+@@ -295,17 +292,17 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
++	sdio_f0_readb((sdiodev)->func1, (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func1, (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
+-	sdio_readb((sdiodev)->func[1], (addr), (r))
++	sdio_readb((sdiodev)->func1, (addr), (r))
+ 
+ #define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
+-	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
++	sdio_writeb((sdiodev)->func1, (v), (addr), (ret))
+ 
+ u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+ void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
diff --git a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
new file mode 100644
index 000000000..dc78000be
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
@@ -0,0 +1,31 @@
+From 32adbcaa5df49f1977441f7a4bf180a0bcfe9966 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:53 +0100
+Subject: [PATCH] brcmfmac: add comment block in brcmf_sdio_buscore_read()
+
+In brcmf_sdio_buscore_read() there is some special handling upon
+register access to chipid register of the chipcommon core. Add
+comment explaining why it is done here.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3772,6 +3772,13 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
++	/*
++	 * this is a bit of special handling if reading the chipcommon chipid
++	 * register. The 4339 is a next-gen of the 4335. It uses the same
++	 * SDIO device id as 4335 and the chipid register returns 4335 as well.
++	 * It can be identified as 4339 by looking at the chip revision. It
++	 * is corrected here so the chip.c module has the right info.
++	 */
+ 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
+ 	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
+ 	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
diff --git a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
new file mode 100644
index 000000000..c587f413d
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
@@ -0,0 +1,137 @@
+From 378f6a16043e5d3346301fc618f503e97aea335b Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:54 +0100
+Subject: [PATCH] brcmfmac: rename brcmf_sdiod_buff_{read,write}() functions
+
+Rename functions to brcmf_sdio_skbuff_{read,write}() as we pass an
+skbuff to this function.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 48 +++++++++++-----------
+ 1 file changed, 24 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -292,24 +292,24 @@ out:
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
+-				 struct sdio_func *func, u32 addr,
+-				 struct sk_buff *pkt)
++static int brcmf_sdiod_skbuff_read(struct brcmf_sdio_dev *sdiodev,
++				   struct sdio_func *func, u32 addr,
++				   struct sk_buff *skb)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+ 
+ 	/* Single skb use the standard mmc interface */
+-	req_sz = pkt->len + 3;
++	req_sz = skb->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+ 	switch (func->num) {
+ 	case 1:
+-		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
++		err = sdio_memcpy_fromio(func, ((u8 *)(skb->data)), addr,
+ 					 req_sz);
+ 		break;
+ 	case 2:
+-		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
++		err = sdio_readsb(func, ((u8 *)(skb->data)), addr, req_sz);
+ 		break;
+ 	default:
+ 		/* bail out as things are really fishy here */
+@@ -323,18 +323,18 @@ static int brcmf_sdiod_buff_read(struct
+ 	return err;
+ }
+ 
+-static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
+-				  struct sdio_func *func, u32 addr,
+-				  struct sk_buff *pkt)
++static int brcmf_sdiod_skbuff_write(struct brcmf_sdio_dev *sdiodev,
++				    struct sdio_func *func, u32 addr,
++				    struct sk_buff *skb)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+ 
+ 	/* Single skb use the standard mmc interface */
+-	req_sz = pkt->len + 3;
++	req_sz = skb->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
++	err = sdio_memcpy_toio(func, addr, ((u8 *)(skb->data)), req_sz);
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
++	err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -575,14 +575,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+-					    pktq->next);
++		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
++					      pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+-					    glom_skb);
++		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
++					      glom_skb);
+ 		if (err)
+ 			goto done;
+ 
+@@ -623,8 +623,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
+-					     mypkt);
++		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
++					       mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+@@ -649,8 +649,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
+-						     addr, skb);
++			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2,
++						       addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+@@ -706,11 +706,11 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
+-						     sdaddr, pkt);
++			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func1,
++						       sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
+-						    sdaddr, pkt);
++			err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func1,
++						      sdaddr, pkt);
+ 		}
+ 
+ 		if (err) {
diff --git a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
new file mode 100644
index 000000000..b60c81a3a
--- /dev/null
+++ b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
@@ -0,0 +1,59 @@
+From b7acadaf038740c43515dc1548f43d01cc92823a Mon Sep 17 00:00:00 2001
+From: Himanshu Jha <himanshujha199640@gmail.com>
+Date: Tue, 9 Jan 2018 02:15:31 +0530
+Subject: [PATCH] brcmfmac: Use zeroing memory allocator than allocator/memset
+
+Use dma_zalloc_coherent for allocating zeroed
+memory and remove unnecessary memset function.
+
+Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci
+
+Suggested-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c  | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1251,14 +1251,14 @@ static int brcmf_pcie_init_scratchbuffer
+ 	u64 address;
+ 	u32 addr;
+ 
+-	devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
+-		BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
+-		&devinfo->shared.scratch_dmahandle, GFP_KERNEL);
++	devinfo->shared.scratch =
++		dma_zalloc_coherent(&devinfo->pdev->dev,
++					BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
++					&devinfo->shared.scratch_dmahandle,
++					GFP_KERNEL);
+ 	if (!devinfo->shared.scratch)
+ 		goto fail;
+ 
+-	memset(devinfo->shared.scratch, 0, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
+-
+ 	addr = devinfo->shared.tcm_base_address +
+ 	       BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
+ 	address = (u64)devinfo->shared.scratch_dmahandle;
+@@ -1268,14 +1268,14 @@ static int brcmf_pcie_init_scratchbuffer
+ 	       BRCMF_SHARED_DMA_SCRATCH_LEN_OFFSET;
+ 	brcmf_pcie_write_tcm32(devinfo, addr, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
+ 
+-	devinfo->shared.ringupd = dma_alloc_coherent(&devinfo->pdev->dev,
+-		BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
+-		&devinfo->shared.ringupd_dmahandle, GFP_KERNEL);
++	devinfo->shared.ringupd =
++		dma_zalloc_coherent(&devinfo->pdev->dev,
++					BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
++					&devinfo->shared.ringupd_dmahandle,
++					GFP_KERNEL);
+ 	if (!devinfo->shared.ringupd)
+ 		goto fail;
+ 
+-	memset(devinfo->shared.ringupd, 0, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
+-
+ 	addr = devinfo->shared.tcm_base_address +
+ 	       BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
+ 	address = (u64)devinfo->shared.ringupd_dmahandle;
diff --git a/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch b/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
new file mode 100644
index 000000000..e955cb3a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
@@ -0,0 +1,26 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 9 Feb 2018 19:46:54 +0100
+Subject: [PATCH] mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple
+ of 4
+
+This ensures that mac80211 allocated management frames are properly
+aligned, which makes copying them more efficient.
+For instance, mt76 uses iowrite32_copy to copy beacon frames to beacon
+template memory on the chip.
+Misaligned 32-bit accesses cause CPU exceptions on MIPS and should be
+avoided.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4145,7 +4145,7 @@ void ieee80211_sta_uapsd_trigger(struct
+  * The TX headroom reserved by mac80211 for its own tx_status functions.
+  * This is enough for the radiotap header.
+  */
+-#define IEEE80211_TX_STATUS_HEADROOM	14
++#define IEEE80211_TX_STATUS_HEADROOM	ALIGN(14, 4)
+ 
+ /**
+  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
diff --git a/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch b/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
new file mode 100644
index 000000000..a7562996b
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 09:59:35 +0100
+Subject: [PATCH] mac80211: drop frames with unexpected DS bits from
+ fast-rx to slow path
+
+Fixes rx for 4-addr packets in AP mode
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3928,7 +3928,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
+ 					      IEEE80211_FCTL_TODS)) !=
+ 	    fast_rx->expected_ds_bits)
+-		goto drop;
++		return false;
+ 
+ 	/* assign the key to drop unencrypted frames (later)
+ 	 * and strip the IV/MIC if necessary
diff --git a/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
new file mode 100644
index 000000000..3f3eb0a5e
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 10:00:22 +0100
+Subject: [PATCH] mac80211: support AP 4-addr mode fast-rx
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3774,6 +3774,15 @@ void ieee80211_check_fast_rx(struct sta_
+ 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
+ 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
+ 			 !sdata->u.vlan.sta);
++
++		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++		    sdata->u.vlan.sta) {
++			fastrx.expected_ds_bits |=
++				cpu_to_le16(IEEE80211_FCTL_FROMDS);
++			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++			fastrx.internal_forward = 0;
++		}
++
+ 		break;
+ 	default:
+ 		goto clear;
diff --git a/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch b/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
new file mode 100644
index 000000000..8c4c724ef
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
@@ -0,0 +1,53 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 10:01:53 +0100
+Subject: [PATCH] mac80211: support fast-rx with incompatible PS
+ capabilities when PS is disabled
+
+When powersave is disabled for the interface, we can do fast-rx anyway.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2658,6 +2658,7 @@ static int ieee80211_set_power_mgmt(stru
+ 
+ 	ieee80211_recalc_ps(local);
+ 	ieee80211_recalc_ps_vif(sdata);
++	ieee80211_check_fast_rx_iface(sdata);
+ 
+ 	return 0;
+ }
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3741,12 +3741,7 @@ void ieee80211_check_fast_rx(struct sta_
+ 		/* 4-addr is harder to deal with, later maybe */
+ 		if (sdata->u.mgd.use_4addr)
+ 			goto clear;
+-		/* software powersave is a huge mess, avoid all of it */
+-		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
+-			goto clear;
+-		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
+-		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
+-			goto clear;
++
+ 		if (sta->sta.tdls) {
+ 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
+ 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
+@@ -3758,6 +3753,16 @@ void ieee80211_check_fast_rx(struct sta_
+ 			fastrx.expected_ds_bits =
+ 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
+ 		}
++
++		if (!sdata->u.mgd.powersave)
++		    break;
++
++		/* software powersave is a huge mess, avoid all of it */
++		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
++			goto clear;
++		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
++		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
++			goto clear;
+ 		break;
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 	case NL80211_IFTYPE_AP:
diff --git a/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
new file mode 100644
index 000000000..97a5d8beb
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
@@ -0,0 +1,34 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 10:05:08 +0100
+Subject: [PATCH] mac80211: support station 4-addr mode fast-rx
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3738,10 +3738,6 @@ void ieee80211_check_fast_rx(struct sta_
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_STATION:
+-		/* 4-addr is harder to deal with, later maybe */
+-		if (sdata->u.mgd.use_4addr)
+-			goto clear;
+-
+ 		if (sta->sta.tdls) {
+ 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
+ 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
+@@ -3754,6 +3750,13 @@ void ieee80211_check_fast_rx(struct sta_
+ 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
+ 		}
+ 
++		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
++			fastrx.expected_ds_bits |=
++				cpu_to_le16(IEEE80211_FCTL_TODS);
++			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++		}
++
+ 		if (!sdata->u.mgd.powersave)
+ 		    break;
+ 
diff --git a/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch b/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
new file mode 100644
index 000000000..3c6d342ff
--- /dev/null
+++ b/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
@@ -0,0 +1,256 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 26 Feb 2018 22:09:29 +0100
+Subject: [PATCH] mac80211: support A-MSDU in fast-rx
+
+Only works if the IV was stripped from packets. Create a smaller
+variant of ieee80211_rx_h_amsdu, which bypasses checks already done
+within the fast-rx context.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2358,39 +2358,17 @@ ieee80211_deliver_skb(struct ieee80211_r
+ }
+ 
+ static ieee80211_rx_result debug_noinline
+-ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
++__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
+ {
+ 	struct net_device *dev = rx->sdata->dev;
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	__le16 fc = hdr->frame_control;
+ 	struct sk_buff_head frame_list;
+-	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
+ 
+-	if (unlikely(!ieee80211_is_data(fc)))
+-		return RX_CONTINUE;
+-
+-	if (unlikely(!ieee80211_is_data_present(fc)))
+-		return RX_DROP_MONITOR;
+-
+-	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
+-		return RX_CONTINUE;
+-
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+-		switch (rx->sdata->vif.type) {
+-		case NL80211_IFTYPE_AP_VLAN:
+-			if (!rx->sdata->u.vlan.sta)
+-				return RX_DROP_UNUSABLE;
+-			break;
+-		case NL80211_IFTYPE_STATION:
+-			if (!rx->sdata->u.mgd.use_4addr)
+-				return RX_DROP_UNUSABLE;
+-			break;
+-		default:
+-			return RX_DROP_UNUSABLE;
+-		}
+ 		check_da = NULL;
+ 		check_sa = NULL;
+ 	} else switch (rx->sdata->vif.type) {
+@@ -2410,15 +2388,13 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 			break;
+ 	}
+ 
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		return RX_DROP_UNUSABLE;
+-
+ 	skb->dev = dev;
+ 	__skb_queue_head_init(&frame_list);
+ 
+ 	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
+ 					  rx->sdata->vif.addr,
+-					  rx->sdata->vif.type))
++					  rx->sdata->vif.type,
++					  data_offset))
+ 		return RX_DROP_UNUSABLE;
+ 
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+@@ -2440,6 +2416,44 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 	return RX_QUEUED;
+ }
+ 
++static ieee80211_rx_result debug_noinline
++ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
++{
++	struct sk_buff *skb = rx->skb;
++	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	__le16 fc = hdr->frame_control;
++
++	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
++		return RX_CONTINUE;
++
++	if (unlikely(!ieee80211_is_data(fc)))
++		return RX_CONTINUE;
++
++	if (unlikely(!ieee80211_is_data_present(fc)))
++		return RX_DROP_MONITOR;
++
++	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
++		switch (rx->sdata->vif.type) {
++		case NL80211_IFTYPE_AP_VLAN:
++			if (!rx->sdata->u.vlan.sta)
++				return RX_DROP_UNUSABLE;
++			break;
++		case NL80211_IFTYPE_STATION:
++			if (!rx->sdata->u.mgd.use_4addr)
++				return RX_DROP_UNUSABLE;
++			break;
++		default:
++			return RX_DROP_UNUSABLE;
++		}
++	}
++
++	if (is_multicast_ether_addr(hdr->addr1))
++		return RX_DROP_UNUSABLE;
++
++	return __ieee80211_rx_h_amsdu(rx, 0);
++}
++
+ #ifdef CPTCFG_MAC80211_MESH
+ static ieee80211_rx_result
+ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+@@ -3889,7 +3903,8 @@ static bool ieee80211_invoke_fast_rx(str
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct sta_info *sta = rx->sta;
+ 	int orig_len = skb->len;
+-	int snap_offs = ieee80211_hdrlen(hdr->frame_control);
++	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	int snap_offs = hdrlen;
+ 	struct {
+ 		u8 snap[sizeof(rfc1042_header)];
+ 		__be16 proto;
+@@ -3920,10 +3935,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
+ 		return false;
+ 
+-	/* we don't deal with A-MSDU deaggregation here */
+-	if (status->rx_flags & IEEE80211_RX_AMSDU)
+-		return false;
+-
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return false;
+ 
+@@ -3955,21 +3966,24 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
+-	if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+-		goto drop;
+-	payload = (void *)(skb->data + snap_offs);
++	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
++		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
++			goto drop;
+ 
+-	if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
+-		return false;
++		payload = (void *)(skb->data + snap_offs);
+ 
+-	/* Don't handle these here since they require special code.
+-	 * Accept AARP and IPX even though they should come with a
+-	 * bridge-tunnel header - but if we get them this way then
+-	 * there's little point in discarding them.
+-	 */
+-	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
+-		     payload->proto == fast_rx->control_port_protocol))
+-		return false;
++		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
++			return false;
++
++		/* Don't handle these here since they require special code.
++		 * Accept AARP and IPX even though they should come with a
++		 * bridge-tunnel header - but if we get them this way then
++		 * there's little point in discarding them.
++		 */
++		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
++			     payload->proto == fast_rx->control_port_protocol))
++			return false;
++	}
+ 
+ 	/* after this point, don't punt to the slowpath! */
+ 
+@@ -3983,12 +3997,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 	}
+ 
+ 	/* statistics part of ieee80211_rx_h_sta_process() */
+-	stats->last_rx = jiffies;
+-	stats->last_rate = sta_stats_encode_rate(status);
+-
+-	stats->fragments++;
+-	stats->packets++;
+-
+ 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
+ 		stats->last_signal = status->signal;
+ 		if (!fast_rx->uses_rss)
+@@ -4017,6 +4025,20 @@ static bool ieee80211_invoke_fast_rx(str
+ 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
+ 		goto drop;
+ 
++	if (status->rx_flags & IEEE80211_RX_AMSDU) {
++		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
++		    RX_QUEUED)
++			goto drop;
++
++		return true;
++	}
++
++	stats->last_rx = jiffies;
++	stats->last_rate = sta_stats_encode_rate(status);
++
++	stats->fragments++;
++	stats->packets++;
++
+ 	/* do the header conversion - first grab the addresses */
+ 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
+ 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4331,10 +4331,12 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+  *	of it being pushed into the SKB
+  * @addr: the device MAC address
+  * @iftype: the virtual interface type
++ * @data_offset: offset of payload after the 802.11 header
+  * Return: 0 on success. Non-zero on error.
+  */
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+-				  const u8 *addr, enum nl80211_iftype iftype);
++				  const u8 *addr, enum nl80211_iftype iftype,
++				  u8 data_offset);
+ 
+ /**
+  * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
+@@ -4346,7 +4348,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+ 					 enum nl80211_iftype iftype)
+ {
+-	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype);
++	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0);
+ }
+ 
+ /**
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -419,7 +419,8 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+-				  const u8 *addr, enum nl80211_iftype iftype)
++				  const u8 *addr, enum nl80211_iftype iftype,
++				  u8 data_offset)
+ {
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ 	struct {
+@@ -433,7 +434,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return -1;
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
+ 	if (skb->len < hdrlen + 8)
+ 		return -1;
+ 
diff --git a/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch b/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
new file mode 100644
index 000000000..394fbfc5b
--- /dev/null
+++ b/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
@@ -0,0 +1,68 @@
+From 5242a5444e0b6464d7455beb55d936dd192b5e9d Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Mon, 22 Jan 2018 21:46:39 +0100
+Subject: [PATCH] brcmfmac: assure bcdc dcmd api does not return value > 0
+
+The protocol layer api defines callbacks for dongle commands.
+Although not really well documented these should only return an
+error code in case of an error, or 0 upon success. In the bcdc
+protocol it can return value above 0 and we carry a fix in the
+caller of the protocol layer api. This patch makes it adhere to
+the intent of the api as described above.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 6 +++++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 8 +++-----
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -211,6 +211,8 @@ retry:
+ 		memcpy(buf, info, len);
+ 	}
+ 
++	ret = 0;
++
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+ 		ret = le32_to_cpu(msg->status);
+@@ -225,7 +227,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ {
+ 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+ 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+-	int ret = 0;
++	int ret;
+ 	u32 flags, id;
+ 
+ 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+@@ -249,6 +251,8 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 		goto done;
+ 	}
+ 
++	ret = 0;
++
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+ 		ret = le32_to_cpu(msg->status);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -121,11 +121,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 	else
+ 		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
+ 
+-	if (err >= 0)
+-		return 0;
+-
+-	brcmf_dbg(FIL, "Failed: %s (%d)\n",
+-		  brcmf_fil_get_errstr((u32)(-err)), err);
++	if (err)
++		brcmf_dbg(FIL, "Failed: %s (%d)\n",
++			  brcmf_fil_get_errstr((u32)(-err)), err);
+ 
+ 	return err;
+ }
diff --git a/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch b/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
new file mode 100644
index 000000000..28e3c1a65
--- /dev/null
+++ b/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
@@ -0,0 +1,186 @@
+From b69c1df47281ad47bd2037a42b98f5c7115b7fd5 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Mon, 22 Jan 2018 21:46:40 +0100
+Subject: [PATCH] brcmfmac: separate firmware errors from i/o errors
+
+When using the firmware api it can fail simply because firmware does
+not like the request or it fails due to issues in the host interface.
+Currently, there is only a single error code which is confusing. So
+adding a parameter to pass the firmware error separately and in case
+of a firmware error always return -EBADE to user-space.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++++++-----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c  | 16 +++++++++++-----
+ .../net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c    | 10 ++++++----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 14 ++++++++------
+ 4 files changed, 31 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -165,7 +165,7 @@ static int brcmf_proto_bcdc_cmplt(struct
+ 
+ static int
+ brcmf_proto_bcdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+-			    void *buf, uint len)
++			    void *buf, uint len, int *fwerr)
+ {
+ 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+ 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+@@ -175,6 +175,7 @@ brcmf_proto_bcdc_query_dcmd(struct brcmf
+ 
+ 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+ 
++	*fwerr = 0;
+ 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, false);
+ 	if (ret < 0) {
+ 		brcmf_err("brcmf_proto_bcdc_msg failed w/status %d\n",
+@@ -215,15 +216,14 @@ retry:
+ 
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+-		ret = le32_to_cpu(msg->status);
+-
++		*fwerr = le32_to_cpu(msg->status);
+ done:
+ 	return ret;
+ }
+ 
+ static int
+ brcmf_proto_bcdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+-			  void *buf, uint len)
++			  void *buf, uint len, int *fwerr)
+ {
+ 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+ 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+@@ -232,6 +232,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 
+ 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+ 
++	*fwerr = 0;
+ 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, true);
+ 	if (ret < 0)
+ 		goto done;
+@@ -255,7 +256,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+-		ret = le32_to_cpu(msg->status);
++		*fwerr = le32_to_cpu(msg->status);
+ 
+ done:
+ 	return ret;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -107,7 +107,7 @@ static s32
+ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
+ {
+ 	struct brcmf_pub *drvr = ifp->drvr;
+-	s32 err;
++	s32 err, fwerr;
+ 
+ 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
+ 		brcmf_err("bus is down. we have nothing to do.\n");
+@@ -117,14 +117,20 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 	if (data != NULL)
+ 		len = min_t(uint, len, BRCMF_DCMD_MAXLEN);
+ 	if (set)
+-		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd, data, len);
++		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd,
++					   data, len, &fwerr);
+ 	else
+-		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
++		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd,
++					     data, len, &fwerr);
+ 
+-	if (err)
++	if (err) {
+ 		brcmf_dbg(FIL, "Failed: %s (%d)\n",
+ 			  brcmf_fil_get_errstr((u32)(-err)), err);
+-
++	} else if (fwerr < 0) {
++		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
++			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
++		err = -EBADE;
++	}
+ 	return err;
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -477,7 +477,7 @@ static void brcmf_msgbuf_ioctl_resp_wake
+ 
+ 
+ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
+-				   uint cmd, void *buf, uint len)
++				   uint cmd, void *buf, uint len, int *fwerr)
+ {
+ 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
+ 	struct sk_buff *skb = NULL;
+@@ -485,6 +485,7 @@ static int brcmf_msgbuf_query_dcmd(struc
+ 	int err;
+ 
+ 	brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
++	*fwerr = 0;
+ 	msgbuf->ctl_completed = false;
+ 	err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
+ 	if (err)
+@@ -508,14 +509,15 @@ static int brcmf_msgbuf_query_dcmd(struc
+ 	}
+ 	brcmu_pkt_buf_free_skb(skb);
+ 
+-	return msgbuf->ioctl_resp_status;
++	*fwerr = msgbuf->ioctl_resp_status;
++	return 0;
+ }
+ 
+ 
+ static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
+-				 uint cmd, void *buf, uint len)
++				 uint cmd, void *buf, uint len, int *fwerr)
+ {
+-	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len);
++	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
+ }
+ 
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -30,9 +30,9 @@ struct brcmf_proto {
+ 	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
+ 		       struct sk_buff *skb, struct brcmf_if **ifp);
+ 	int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
+-			  void *buf, uint len);
++			  void *buf, uint len, int *fwerr);
+ 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
+-			uint len);
++			uint len, int *fwerr);
+ 	int (*tx_queue_data)(struct brcmf_pub *drvr, int ifidx,
+ 			     struct sk_buff *skb);
+ 	int (*txdata)(struct brcmf_pub *drvr, int ifidx, u8 offset,
+@@ -71,14 +71,16 @@ static inline int brcmf_proto_hdrpull(st
+ 	return drvr->proto->hdrpull(drvr, do_fws, skb, ifp);
+ }
+ static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
+-					 uint cmd, void *buf, uint len)
++					 uint cmd, void *buf, uint len,
++					 int *fwerr)
+ {
+-	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len);
++	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len,fwerr);
+ }
+ static inline int brcmf_proto_set_dcmd(struct brcmf_pub *drvr, int ifidx,
+-				       uint cmd, void *buf, uint len)
++				       uint cmd, void *buf, uint len,
++				       int *fwerr)
+ {
+-	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len);
++	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
+ }
+ 
+ static inline int brcmf_proto_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
diff --git a/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch b/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
new file mode 100644
index 000000000..e6486160f
--- /dev/null
+++ b/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
@@ -0,0 +1,92 @@
+From 933897342d0714ae1c10729cbaeecea0c6178db5 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 28 Feb 2018 21:15:19 +0100
+Subject: [PATCH] brcmfmac: add possibility to obtain firmware error
+
+The feature module needs to evaluate the actual firmware error return
+upon a control command. This adds a flag to struct brcmf_if that the
+caller can set. This flag is checked to determine the error code that
+needs to be returned.
+
+Fixes: b69c1df47281 ("brcmfmac: separate firmware errors from i/o errors")
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 10 ++++++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c    |  3 +++
+ 3 files changed, 15 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -181,6 +181,7 @@ enum brcmf_netif_stop_reason {
+  * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
+  * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
+  * @pend_8021x_wait: used for signalling change in count.
++ * @fwil_fwerr: flag indicating fwil layer should return firmware error codes.
+  */
+ struct brcmf_if {
+ 	struct brcmf_pub *drvr;
+@@ -198,6 +199,7 @@ struct brcmf_if {
+ 	wait_queue_head_t pend_8021x_wait;
+ 	struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
+ 	u8 ipv6addr_idx;
++	bool fwil_fwerr;
+ };
+ 
+ int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -104,6 +104,9 @@ static void brcmf_feat_iovar_int_get(str
+ 	u32 data;
+ 	int err;
+ 
++	/* we need to know firmware error */
++	ifp->fwil_fwerr = true;
++
+ 	err = brcmf_fil_iovar_int_get(ifp, name, &data);
+ 	if (err == 0) {
+ 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
+@@ -112,6 +115,8 @@ static void brcmf_feat_iovar_int_get(str
+ 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
+ 			  brcmf_feat_names[id], err);
+ 	}
++
++	ifp->fwil_fwerr = false;
+ }
+ 
+ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
+@@ -120,6 +125,9 @@ static void brcmf_feat_iovar_data_set(st
+ {
+ 	int err;
+ 
++	/* we need to know firmware error */
++	ifp->fwil_fwerr = true;
++
+ 	err = brcmf_fil_iovar_data_set(ifp, name, data, len);
+ 	if (err != -BRCMF_FW_UNSUPPORTED) {
+ 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
+@@ -128,6 +136,8 @@ static void brcmf_feat_iovar_data_set(st
+ 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
+ 			  brcmf_feat_names[id], err);
+ 	}
++
++	ifp->fwil_fwerr = false;
+ }
+ 
+ #define MAX_CAPS_BUFFER_SIZE	512
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -131,6 +131,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
+ 		err = -EBADE;
+ 	}
++	if (ifp->fwil_fwerr)
++		return fwerr;
++
+ 	return err;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch b/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
new file mode 100644
index 000000000..20e16ad23
--- /dev/null
+++ b/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
@@ -0,0 +1,64 @@
+From 455f3e76cfc0d893585a5f358b9ddbe9c1e1e53b Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 28 Feb 2018 21:15:20 +0100
+Subject: [PATCH] brcmfmac: fix P2P_DEVICE ethernet address generation
+
+The firmware has a requirement that the P2P_DEVICE address should
+be different from the address of the primary interface. When not
+specified by user-space, the driver generates the MAC address for
+the P2P_DEVICE interface using the MAC address of the primary
+interface and setting the locally administered bit. However, the MAC
+address of the primary interface may already have that bit set causing
+the creation of the P2P_DEVICE interface to fail with -EBUSY. Fix this
+by using a random address instead to determine the P2P_DEVICE address.
+
+Cc: stable@vger.kernel.org # 3.10.y
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 24 ++++++++++------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct
+  * @dev_addr: optional device address.
+  *
+  * P2P needs mac addresses for P2P device and interface. If no device
+- * address it specified, these are derived from the primary net device, ie.
+- * the permanent ethernet address of the device.
++ * address it specified, these are derived from a random ethernet
++ * address.
+  */
+ static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
+ {
+-	struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+-	bool local_admin = false;
++	bool random_addr = false;
+ 
+-	if (!dev_addr || is_zero_ether_addr(dev_addr)) {
+-		dev_addr = pri_ifp->mac_addr;
+-		local_admin = true;
+-	}
++	if (!dev_addr || is_zero_ether_addr(dev_addr))
++		random_addr = true;
+ 
+-	/* Generate the P2P Device Address.  This consists of the device's
+-	 * primary MAC address with the locally administered bit set.
++	/* Generate the P2P Device Address obtaining a random ethernet
++	 * address with the locally administered bit set.
+ 	 */
+-	memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+-	if (local_admin)
+-		p2p->dev_addr[0] |= 0x02;
++	if (random_addr)
++		eth_random_addr(p2p->dev_addr);
++	else
++		memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+ 
+ 	/* Generate the P2P Interface Address.  If the discovery and connection
+ 	 * BSSCFGs need to simultaneously co-exist, then this address must be
diff --git a/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch b/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
new file mode 100644
index 000000000..f25dea01d
--- /dev/null
+++ b/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
@@ -0,0 +1,157 @@
+From 1259055170287a350cad453e9eac139c81609860 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 15 Mar 2018 08:29:09 +0100
+Subject: [PATCH] brcmfmac: drop Inter-Access Point Protocol packets by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Testing brcmfmac with more recent firmwares resulted in AP interfaces
+not working in some specific setups. Debugging resulted in discovering
+support for IAPP in Broadcom's firmwares.
+
+Older firmwares were only generating 802.11f frames. Newer ones like:
+1) 10.10 (TOB) (r663589)
+2) 10.10.122.20 (r683106)
+for 4366b1 and 4366c0 respectively seem to also /respect/ 802.11f frames
+in the Tx path by performing a STA disassociation.
+
+This obsoleted standard and its implementation is something that:
+1) Most people don't need / want to use
+2) Can allow local DoS attacks
+3) Breaks AP interfaces in some specific bridge setups
+
+To solve issues it can cause this commit modifies brcmfmac to drop IAPP
+packets. If affects:
+1) Rx path: driver won't be sending these unwanted packets up.
+2) Tx path: driver will reject packets that would trigger STA
+   disassociation perfromed by a firmware (possible local DoS attack).
+
+It appears there are some Broadcom's clients/users who care about this
+feature despite the drawbacks. They can switch it on using a new module
+param.
+
+This change results in only two more comparisons (check for module param
+and check for Ethernet packet length) for 99.9% of packets. Its overhead
+should be very minimal.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ++
+ .../wireless/broadcom/brcm80211/brcmfmac/common.h  |  1 +
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 57 ++++++++++++++++++++++
+ 3 files changed, 63 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -75,6 +75,10 @@ static int brcmf_roamoff;
+ module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
+ MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
+ 
++static int brcmf_iapp_enable;
++module_param_named(iapp, brcmf_iapp_enable, int, 0);
++MODULE_PARM_DESC(iapp, "Enable partial support for the obsoleted Inter-Access Point Protocol");
++
+ #ifdef DEBUG
+ /* always succeed brcmf_bus_started() */
+ static int brcmf_ignore_probe_fail;
+@@ -441,6 +445,7 @@ struct brcmf_mp_device *brcmf_get_module
+ 	settings->feature_disable = brcmf_feature_disable;
+ 	settings->fcmode = brcmf_fcmode;
+ 	settings->roamoff = !!brcmf_roamoff;
++	settings->iapp = !!brcmf_iapp_enable;
+ #ifdef DEBUG
+ 	settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
+ #endif
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -58,6 +58,7 @@ struct brcmf_mp_device {
+ 	unsigned int	feature_disable;
+ 	int		fcmode;
+ 	bool		roamoff;
++	bool		iapp;
+ 	bool		ignore_probe_fail;
+ 	struct brcmfmac_pd_cc *country_codes;
+ 	union {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -230,6 +230,37 @@ static void brcmf_netdev_set_multicast_l
+ 	schedule_work(&ifp->multicast_work);
+ }
+ 
++/**
++ * brcmf_skb_is_iapp - checks if skb is an IAPP packet
++ *
++ * @skb: skb to check
++ */
++static bool brcmf_skb_is_iapp(struct sk_buff *skb)
++{
++	static const u8 iapp_l2_update_packet[6] __aligned(2) = {
++		0x00, 0x01, 0xaf, 0x81, 0x01, 0x00,
++	};
++	unsigned char *eth_data;
++#if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++	const u16 *a, *b;
++#endif
++
++	if (skb->len - skb->mac_len != 6 ||
++	    !is_multicast_ether_addr(eth_hdr(skb)->h_dest))
++		return false;
++
++	eth_data = skb_mac_header(skb) + ETH_HLEN;
++#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++	return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) |
++		 ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4))));
++#else
++	a = (const u16 *)eth_data;
++	b = (const u16 *)iapp_l2_update_packet;
++
++	return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]));
++#endif
++}
++
+ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+ 					   struct net_device *ndev)
+ {
+@@ -250,6 +281,23 @@ static netdev_tx_t brcmf_netdev_start_xm
+ 		goto done;
+ 	}
+ 
++	/* Some recent Broadcom's firmwares disassociate STA when they receive
++	 * an 802.11f ADD frame. This behavior can lead to a local DoS security
++	 * issue. Attacker may trigger disassociation of any STA by sending a
++	 * proper Ethernet frame to the wireless interface.
++	 *
++	 * Moreover this feature may break AP interfaces in some specific
++	 * setups. This applies e.g. to the bridge with hairpin mode enabled and
++	 * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware
++	 * will get passed back to the wireless interface and cause immediate
++	 * disassociation of a just-connected STA.
++	 */
++	if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
++		dev_kfree_skb(skb);
++		ret = -EINVAL;
++		goto done;
++	}
++
+ 	/* Make sure there's enough writeable headroom */
+ 	if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
+ 		head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
+@@ -325,6 +373,15 @@ void brcmf_txflowblock_if(struct brcmf_i
+ 
+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
+ {
++	/* Most of Broadcom's firmwares send 802.11f ADD frame every time a new
++	 * STA connects to the AP interface. This is an obsoleted standard most
++	 * users don't use, so don't pass these frames up unless requested.
++	 */
++	if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
++		brcmu_pkt_buf_free_skb(skb);
++		return;
++	}
++
+ 	if (skb->pkt_type == PACKET_MULTICAST)
+ 		ifp->ndev->stats.multicast++;
+ 
diff --git a/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch b/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
new file mode 100644
index 000000000..d45f64ff2
--- /dev/null
+++ b/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
@@ -0,0 +1,29 @@
+From 9b9322db5c5a1917a66c71fe47c3848a9a31227e Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 14 Mar 2018 20:02:59 +0100
+Subject: [PATCH] brcmfmac: Fix check for ISO3166 code
+
+The commit "regulatory: add NUL to request alpha2" increases the length of
+alpha2 to 3. This causes a regression on brcmfmac, because
+brcmf_cfg80211_reg_notifier() expect valid ISO3166 codes in the complete
+array. So fix this accordingly.
+
+Fixes: 657308f73e67 ("regulatory: add NUL to request alpha2")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6803,7 +6803,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 		return;
+ 
+ 	/* ignore non-ISO3166 country codes */
+-	for (i = 0; i < sizeof(req->alpha2); i++)
++	for (i = 0; i < 2; i++)
+ 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+ 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
+ 				  req->alpha2[0], req->alpha2[1]);
diff --git a/package/kernel/mac80211/patches/300-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/300-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
diff --git a/package/kernel/mac80211/patches/301-ath9k_hw-issue-external-reset-for-QCA955x.patch b/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 100%
rename from package/kernel/mac80211/patches/301-ath9k_hw-issue-external-reset-for-QCA955x.patch
rename to package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
diff --git a/package/kernel/mac80211/patches/302-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch b/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
similarity index 100%
rename from package/kernel/mac80211/patches/302-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
rename to package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
diff --git a/package/kernel/mac80211/patches/303-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch b/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
similarity index 100%
rename from package/kernel/mac80211/patches/303-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
rename to package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
diff --git a/package/kernel/mac80211/patches/304-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/304-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/305-ath9k-limit-retries-for-powersave-response-frames.patch b/package/kernel/mac80211/patches/355-ath9k-limit-retries-for-powersave-response-frames.patch
similarity index 100%
rename from package/kernel/mac80211/patches/305-ath9k-limit-retries-for-powersave-response-frames.patch
rename to package/kernel/mac80211/patches/355-ath9k-limit-retries-for-powersave-response-frames.patch
diff --git a/package/kernel/mac80211/patches/306-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 100%
rename from package/kernel/mac80211/patches/306-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
diff --git a/package/kernel/mac80211/patches/307-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
similarity index 100%
rename from package/kernel/mac80211/patches/307-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
rename to package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
diff --git a/package/kernel/mac80211/patches/308-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
similarity index 100%
rename from package/kernel/mac80211/patches/308-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
rename to package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
diff --git a/package/kernel/mac80211/patches/309-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch b/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
similarity index 100%
rename from package/kernel/mac80211/patches/309-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
rename to package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
diff --git a/package/kernel/mac80211/patches/310-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch b/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
similarity index 100%
rename from package/kernel/mac80211/patches/310-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
rename to package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
diff --git a/package/kernel/mac80211/patches/311-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch b/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
similarity index 100%
rename from package/kernel/mac80211/patches/311-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
rename to package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
diff --git a/package/kernel/mac80211/patches/312-ath9k-report-tx-status-on-EOSP.patch b/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
similarity index 100%
rename from package/kernel/mac80211/patches/312-ath9k-report-tx-status-on-EOSP.patch
rename to package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
diff --git a/package/kernel/mac80211/patches/313-ath9k-fix-block-ack-window-tracking-issues.patch b/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
similarity index 100%
rename from package/kernel/mac80211/patches/313-ath9k-fix-block-ack-window-tracking-issues.patch
rename to package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
diff --git a/package/kernel/mac80211/patches/314-ath9k_hw-fix-channel-maximum-power-level-test.patch b/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
similarity index 100%
rename from package/kernel/mac80211/patches/314-ath9k_hw-fix-channel-maximum-power-level-test.patch
rename to package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
diff --git a/package/kernel/mac80211/patches/315-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
similarity index 100%
rename from package/kernel/mac80211/patches/315-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
rename to package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
diff --git a/package/kernel/mac80211/patches/316-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch b/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
similarity index 100%
rename from package/kernel/mac80211/patches/316-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
rename to package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
diff --git a/package/kernel/mac80211/patches/317-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch b/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
similarity index 100%
rename from package/kernel/mac80211/patches/317-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
rename to package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
diff --git a/package/kernel/mac80211/patches/319-ath10k-fix-recent-bandwidth-conversion-bug.patch b/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
similarity index 100%
rename from package/kernel/mac80211/patches/319-ath10k-fix-recent-bandwidth-conversion-bug.patch
rename to package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
diff --git a/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch b/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
new file mode 100644
index 000000000..bc4174e4c
--- /dev/null
+++ b/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
@@ -0,0 +1,55 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 30 Jan 2018 13:17:38 +0100
+Subject: [PATCH] cfg80211: use only 1Mbps for basic rates in mesh
+
+Mesh used to use the mandatory rates as basic rates, but we got
+the calculation of mandatory rates wrong until some time ago.
+Fix this this broke interoperability with older versions since
+now more basic rates are required, and thus the MBSS isn't the
+same and the network stops working.
+
+Fix this by simply using only 1Mbps as the basic rate in 2.4GHz.
+Since the changed mandatory rates only affected 2.4GHz, this is
+all we need to make it work again.
+
+Reported-and-tested-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Fixes: 1bd773c077de ("wireless: set correct mandatory rate flags")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/wireless/mesh.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/mesh.c
++++ b/net/wireless/mesh.c
+@@ -169,9 +169,28 @@ int __cfg80211_join_mesh(struct cfg80211
+ 		enum nl80211_bss_scan_width scan_width;
+ 		struct ieee80211_supported_band *sband =
+ 				rdev->wiphy.bands[setup->chandef.chan->band];
+-		scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
+-		setup->basic_rates = ieee80211_mandatory_rates(sband,
+-							       scan_width);
++
++		if (setup->chandef.chan->band == NL80211_BAND_2GHZ) {
++			int i;
++
++			/*
++			 * Older versions selected the mandatory rates for
++			 * 2.4 GHz as well, but were broken in that only
++			 * 1 Mbps was regarded as a mandatory rate. Keep
++			 * using just 1 Mbps as the default basic rate for
++			 * mesh to be interoperable with older versions.
++			 */
++			for (i = 0; i < sband->n_bitrates; i++) {
++				if (sband->bitrates[i].bitrate == 10) {
++					setup->basic_rates = BIT(i);
++					break;
++				}
++			}
++		} else {
++			scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
++			setup->basic_rates = ieee80211_mandatory_rates(sband,
++								       scan_width);
++		}
+ 	}
+ 
+ 	err = cfg80211_chandef_dfs_required(&rdev->wiphy,
diff --git a/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch b/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
new file mode 100644
index 000000000..14cf6641d
--- /dev/null
+++ b/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
@@ -0,0 +1,150 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:41:51 +0100
+Subject: [PATCH] mac80211: minstrel: remove unnecessary debugfs cleanup
+ code
+
+debugfs entries are cleaned up by debugfs_remove_recursive already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -689,8 +689,8 @@ minstrel_alloc(struct ieee80211_hw *hw,
+ 
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	mp->fixed_rate_idx = (u32) -1;
+-	mp->dbg_fixed_rate = debugfs_create_u32("fixed_rate_idx",
+-			S_IRUGO | S_IWUGO, debugfsdir, &mp->fixed_rate_idx);
++	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
++			   &mp->fixed_rate_idx);
+ #endif
+ 
+ 	minstrel_init_cck_rates(mp);
+@@ -701,9 +701,6 @@ minstrel_alloc(struct ieee80211_hw *hw,
+ static void
+ minstrel_free(void *priv)
+ {
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	debugfs_remove(((struct minstrel_priv *)priv)->dbg_fixed_rate);
+-#endif
+ 	kfree(priv);
+ }
+ 
+@@ -735,7 +732,6 @@ const struct rate_control_ops mac80211_m
+ 	.free_sta = minstrel_free_sta,
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	.add_sta_debugfs = minstrel_add_sta_debugfs,
+-	.remove_sta_debugfs = minstrel_remove_sta_debugfs,
+ #endif
+ 	.get_expected_throughput = minstrel_get_expected_throughput,
+ };
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -109,11 +109,6 @@ struct minstrel_sta_info {
+ 
+ 	/* sampling table */
+ 	u8 *sample_table;
+-
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	struct dentry *dbg_stats;
+-	struct dentry *dbg_stats_csv;
+-#endif
+ };
+ 
+ struct minstrel_priv {
+@@ -137,7 +132,6 @@ struct minstrel_priv {
+ 	 *   - setting will be applied on next update
+ 	 */
+ 	u32 fixed_rate_idx;
+-	struct dentry *dbg_fixed_rate;
+ #endif
+ };
+ 
+@@ -156,7 +150,6 @@ minstrel_get_ewmsd10(struct minstrel_rat
+ 
+ extern const struct rate_control_ops mac80211_minstrel;
+ void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+-void minstrel_remove_sta_debugfs(void *priv, void *priv_sta);
+ 
+ /* Recalculate success probabilities and counters for a given rate using EWMA */
+ void minstrel_calc_rate_stats(struct minstrel_rate_stats *mrs);
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -214,19 +214,7 @@ minstrel_add_sta_debugfs(void *priv, voi
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+ 
+-	mi->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, mi,
+-			&minstrel_stat_fops);
+-
+-	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO, dir,
+-			mi, &minstrel_stat_csv_fops);
+-}
+-
+-void
+-minstrel_remove_sta_debugfs(void *priv, void *priv_sta)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	debugfs_remove(mi->dbg_stats);
+-
+-	debugfs_remove(mi->dbg_stats_csv);
++	debugfs_create_file("rc_stats", S_IRUGO, dir, mi, &minstrel_stat_fops);
++	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, mi,
++			    &minstrel_stat_csv_fops);
+ }
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1393,7 +1393,6 @@ static const struct rate_control_ops mac
+ 	.free = minstrel_ht_free,
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	.add_sta_debugfs = minstrel_ht_add_sta_debugfs,
+-	.remove_sta_debugfs = minstrel_ht_remove_sta_debugfs,
+ #endif
+ 	.get_expected_throughput = minstrel_ht_get_expected_throughput,
+ };
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -110,17 +110,12 @@ struct minstrel_ht_sta_priv {
+ 		struct minstrel_ht_sta ht;
+ 		struct minstrel_sta_info legacy;
+ 	};
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	struct dentry *dbg_stats;
+-	struct dentry *dbg_stats_csv;
+-#endif
+ 	void *ratelist;
+ 	void *sample_table;
+ 	bool is_ht;
+ };
+ 
+ void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+-void minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta);
+ int minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
+ 			   int prob_ewma);
+ 
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -303,17 +303,8 @@ minstrel_ht_add_sta_debugfs(void *priv,
+ {
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 
+-	msp->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
+-			&minstrel_ht_stat_fops);
+-	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO,
+-			     dir, msp, &minstrel_ht_stat_csv_fops);
+-}
+-
+-void
+-minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta)
+-{
+-	struct minstrel_ht_sta_priv *msp = priv_sta;
+-
+-	debugfs_remove(msp->dbg_stats);
+-	debugfs_remove(msp->dbg_stats_csv);
++	debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
++			    &minstrel_ht_stat_fops);
++	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, msp,
++			    &minstrel_ht_stat_csv_fops);
+ }
diff --git a/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
new file mode 100644
index 000000000..a2bdfd81a
--- /dev/null
+++ b/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
@@ -0,0 +1,576 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:43:30 +0100
+Subject: [PATCH] mac80211: minstrel: merge with minstrel_ht, always enable
+ VHT support
+
+Legacy-only devices are not very common and the overhead of the extra
+code for HT and VHT rates is not big enough to justify all those extra
+lines of code to make it optional.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -25,20 +25,6 @@ config MAC80211_RC_MINSTREL
+ 	---help---
+ 	  This option enables the 'minstrel' TX rate control algorithm
+ 
+-config MAC80211_RC_MINSTREL_HT
+-	bool "Minstrel 802.11n support" if EXPERT
+-	depends on MAC80211_RC_MINSTREL
+-	default y
+-	---help---
+-	  This option enables the 'minstrel_ht' TX rate control algorithm
+-
+-config MAC80211_RC_MINSTREL_VHT
+-	bool "Minstrel 802.11ac support" if EXPERT
+-	depends on MAC80211_RC_MINSTREL_HT
+-	default n
+-	---help---
+-	  This option enables VHT in the 'minstrel_ht' TX rate control algorithm
+-
+ choice
+ 	prompt "Default rate control algorithm"
+ 	depends on MAC80211_HAS_RC
+@@ -60,8 +46,7 @@ endchoice
+ 
+ config MAC80211_RC_DEFAULT
+ 	string
+-	default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL && MAC80211_RC_MINSTREL_HT
+-	default "minstrel" if MAC80211_RC_DEFAULT_MINSTREL
++	default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL
+ 	default ""
+ 
+ endif
+--- a/net/mac80211/Makefile
++++ b/net/mac80211/Makefile
+@@ -50,13 +50,14 @@ mac80211-$(CONFIG_PM) += pm.o
+ 
+ CFLAGS_trace.o := -I$(src)
+ 
+-rc80211_minstrel-y := rc80211_minstrel.o
+-rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += rc80211_minstrel_debugfs.o
++rc80211_minstrel-y := \
++	rc80211_minstrel.o \
++	rc80211_minstrel_ht.o
+ 
+-rc80211_minstrel_ht-y := rc80211_minstrel_ht.o
+-rc80211_minstrel_ht-$(CPTCFG_MAC80211_DEBUGFS) += rc80211_minstrel_ht_debugfs.o
++rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += \
++	rc80211_minstrel_debugfs.o \
++	rc80211_minstrel_ht_debugfs.o
+ 
+ mac80211-$(CPTCFG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
+-mac80211-$(CPTCFG_MAC80211_RC_MINSTREL_HT) += $(rc80211_minstrel_ht-y)
+ 
+ ccflags-y += -DDEBUG
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1252,18 +1252,12 @@ static int __init ieee80211_init(void)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = rc80211_minstrel_ht_init();
+-	if (ret)
+-		goto err_minstrel;
+-
+ 	ret = ieee80211_iface_init();
+ 	if (ret)
+ 		goto err_netdev;
+ 
+ 	return 0;
+  err_netdev:
+-	rc80211_minstrel_ht_exit();
+- err_minstrel:
+ 	rc80211_minstrel_exit();
+ 
+ 	return ret;
+@@ -1271,7 +1265,6 @@ static int __init ieee80211_init(void)
+ 
+ static void __exit ieee80211_exit(void)
+ {
+-	rc80211_minstrel_ht_exit();
+ 	rc80211_minstrel_exit();
+ 
+ 	ieee80211s_stop();
+--- a/net/mac80211/rate.h
++++ b/net/mac80211/rate.h
+@@ -95,18 +95,5 @@ static inline void rc80211_minstrel_exit
+ }
+ #endif
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_HT
+-int rc80211_minstrel_ht_init(void);
+-void rc80211_minstrel_ht_exit(void);
+-#else
+-static inline int rc80211_minstrel_ht_init(void)
+-{
+-	return 0;
+-}
+-static inline void rc80211_minstrel_ht_exit(void)
+-{
+-}
+-#endif
+-
+ 
+ #endif /* IEEE80211_RATE_H */
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -572,138 +572,6 @@ minstrel_rate_init(void *priv, struct ie
+ 	minstrel_update_rates(mp, mi);
+ }
+ 
+-static void *
+-minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
+-{
+-	struct ieee80211_supported_band *sband;
+-	struct minstrel_sta_info *mi;
+-	struct minstrel_priv *mp = priv;
+-	struct ieee80211_hw *hw = mp->hw;
+-	int max_rates = 0;
+-	int i;
+-
+-	mi = kzalloc(sizeof(struct minstrel_sta_info), gfp);
+-	if (!mi)
+-		return NULL;
+-
+-	for (i = 0; i < NUM_NL80211_BANDS; i++) {
+-		sband = hw->wiphy->bands[i];
+-		if (sband && sband->n_bitrates > max_rates)
+-			max_rates = sband->n_bitrates;
+-	}
+-
+-	mi->r = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+-	if (!mi->r)
+-		goto error;
+-
+-	mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+-	if (!mi->sample_table)
+-		goto error1;
+-
+-	mi->last_stats_update = jiffies;
+-	return mi;
+-
+-error1:
+-	kfree(mi->r);
+-error:
+-	kfree(mi);
+-	return NULL;
+-}
+-
+-static void
+-minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	kfree(mi->sample_table);
+-	kfree(mi->r);
+-	kfree(mi);
+-}
+-
+-static void
+-minstrel_init_cck_rates(struct minstrel_priv *mp)
+-{
+-	static const int bitrates[4] = { 10, 20, 55, 110 };
+-	struct ieee80211_supported_band *sband;
+-	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
+-	int i, j;
+-
+-	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
+-	if (!sband)
+-		return;
+-
+-	for (i = 0, j = 0; i < sband->n_bitrates; i++) {
+-		struct ieee80211_rate *rate = &sband->bitrates[i];
+-
+-		if (rate->flags & IEEE80211_RATE_ERP_G)
+-			continue;
+-
+-		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+-			continue;
+-
+-		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
+-			if (rate->bitrate != bitrates[j])
+-				continue;
+-
+-			mp->cck_rates[j] = i;
+-			break;
+-		}
+-	}
+-}
+-
+-static void *
+-minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+-{
+-	struct minstrel_priv *mp;
+-
+-	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
+-	if (!mp)
+-		return NULL;
+-
+-	/* contention window settings
+-	 * Just an approximation. Using the per-queue values would complicate
+-	 * the calculations and is probably unnecessary */
+-	mp->cw_min = 15;
+-	mp->cw_max = 1023;
+-
+-	/* number of packets (in %) to use for sampling other rates
+-	 * sample less often for non-mrr packets, because the overhead
+-	 * is much higher than with mrr */
+-	mp->lookaround_rate = 5;
+-	mp->lookaround_rate_mrr = 10;
+-
+-	/* maximum time that the hw is allowed to stay in one MRR segment */
+-	mp->segment_size = 6000;
+-
+-	if (hw->max_rate_tries > 0)
+-		mp->max_retry = hw->max_rate_tries;
+-	else
+-		/* safe default, does not necessarily have to match hw properties */
+-		mp->max_retry = 7;
+-
+-	if (hw->max_rates >= 4)
+-		mp->has_mrr = true;
+-
+-	mp->hw = hw;
+-	mp->update_interval = 100;
+-
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	mp->fixed_rate_idx = (u32) -1;
+-	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
+-			   &mp->fixed_rate_idx);
+-#endif
+-
+-	minstrel_init_cck_rates(mp);
+-
+-	return mp;
+-}
+-
+-static void
+-minstrel_free(void *priv)
+-{
+-	kfree(priv);
+-}
+-
+ static u32 minstrel_get_expected_throughput(void *priv_sta)
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+@@ -722,29 +590,8 @@ static u32 minstrel_get_expected_through
+ }
+ 
+ const struct rate_control_ops mac80211_minstrel = {
+-	.name = "minstrel",
+ 	.tx_status_ext = minstrel_tx_status,
+ 	.get_rate = minstrel_get_rate,
+ 	.rate_init = minstrel_rate_init,
+-	.alloc = minstrel_alloc,
+-	.free = minstrel_free,
+-	.alloc_sta = minstrel_alloc_sta,
+-	.free_sta = minstrel_free_sta,
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	.add_sta_debugfs = minstrel_add_sta_debugfs,
+-#endif
+ 	.get_expected_throughput = minstrel_get_expected_throughput,
+ };
+-
+-int __init
+-rc80211_minstrel_init(void)
+-{
+-	return ieee80211_rate_control_register(&mac80211_minstrel);
+-}
+-
+-void
+-rc80211_minstrel_exit(void)
+-{
+-	ieee80211_rate_control_unregister(&mac80211_minstrel);
+-}
+-
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -158,7 +158,5 @@ int minstrel_get_tp_avg(struct minstrel_
+ /* debugfs */
+ int minstrel_stats_open(struct inode *inode, struct file *file);
+ int minstrel_stats_csv_open(struct inode *inode, struct file *file);
+-ssize_t minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos);
+-int minstrel_stats_release(struct inode *inode, struct file *file);
+ 
+ #endif
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -54,22 +54,6 @@
+ #include <net/mac80211.h>
+ #include "rc80211_minstrel.h"
+ 
+-ssize_t
+-minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
+-{
+-	struct minstrel_debugfs_info *ms;
+-
+-	ms = file->private_data;
+-	return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
+-}
+-
+-int
+-minstrel_stats_release(struct inode *inode, struct file *file)
+-{
+-	kfree(file->private_data);
+-	return 0;
+-}
+-
+ int
+ minstrel_stats_open(struct inode *inode, struct file *file)
+ {
+@@ -135,14 +119,6 @@ minstrel_stats_open(struct inode *inode,
+ 	return 0;
+ }
+ 
+-static const struct file_operations minstrel_stat_fops = {
+-	.owner = THIS_MODULE,
+-	.open = minstrel_stats_open,
+-	.read = minstrel_stats_read,
+-	.release = minstrel_stats_release,
+-	.llseek = default_llseek,
+-};
+-
+ int
+ minstrel_stats_csv_open(struct inode *inode, struct file *file)
+ {
+@@ -200,21 +176,3 @@ minstrel_stats_csv_open(struct inode *in
+ 
+ 	return 0;
+ }
+-
+-static const struct file_operations minstrel_stat_csv_fops = {
+-	.owner = THIS_MODULE,
+-	.open = minstrel_stats_csv_open,
+-	.read = minstrel_stats_read,
+-	.release = minstrel_stats_release,
+-	.llseek = default_llseek,
+-};
+-
+-void
+-minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	debugfs_create_file("rc_stats", S_IRUGO, dir, mi, &minstrel_stat_fops);
+-	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, mi,
+-			    &minstrel_stat_csv_fops);
+-}
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -137,12 +137,10 @@
+ 		}					\
+ 	}
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ static bool minstrel_vht_only = true;
+ module_param(minstrel_vht_only, bool, 0644);
+ MODULE_PARM_DESC(minstrel_vht_only,
+ 		 "Use only VHT rates when VHT is supported by sta.");
+-#endif
+ 
+ /*
+  * To enable sufficiently targeted rate sampling, MCS rates are divided into
+@@ -171,7 +169,6 @@ const struct mcs_group minstrel_mcs_grou
+ 
+ 	CCK_GROUP,
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 	VHT_GROUP(1, 0, BW_20),
+ 	VHT_GROUP(2, 0, BW_20),
+ 	VHT_GROUP(3, 0, BW_20),
+@@ -195,7 +192,6 @@ const struct mcs_group minstrel_mcs_grou
+ 	VHT_GROUP(1, 1, BW_80),
+ 	VHT_GROUP(2, 1, BW_80),
+ 	VHT_GROUP(3, 1, BW_80),
+-#endif
+ };
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
+@@ -1146,12 +1142,10 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 	BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 	if (vht_cap->vht_supported)
+ 		use_vht = vht_cap->vht_mcs.tx_mcs_map != cpu_to_le16(~0);
+ 	else
+-#endif
+-	use_vht = 0;
++		use_vht = 0;
+ 
+ 	msp->is_ht = true;
+ 	memset(mi, 0, sizeof(*mi));
+@@ -1226,10 +1220,9 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 		/* HT rate */
+ 		if (gflags & IEEE80211_TX_RC_MCS) {
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 			if (use_vht && minstrel_vht_only)
+ 				continue;
+-#endif
++
+ 			mi->supported[i] = mcs->rx_mask[nss - 1];
+ 			if (mi->supported[i])
+ 				n_supported++;
+@@ -1349,16 +1342,88 @@ minstrel_ht_free_sta(void *priv, struct
+ 	kfree(msp);
+ }
+ 
++static void
++minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
++{
++	static const int bitrates[4] = { 10, 20, 55, 110 };
++	struct ieee80211_supported_band *sband;
++	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
++	int i, j;
++
++	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
++	if (!sband)
++		return;
++
++	for (i = 0, j = 0; i < sband->n_bitrates; i++) {
++		struct ieee80211_rate *rate = &sband->bitrates[i];
++
++		if (rate->flags & IEEE80211_RATE_ERP_G)
++			continue;
++
++		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
++			continue;
++
++		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
++			if (rate->bitrate != bitrates[j])
++				continue;
++
++			mp->cck_rates[j] = i;
++			break;
++		}
++	}
++}
++
+ static void *
+ minstrel_ht_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+ {
+-	return mac80211_minstrel.alloc(hw, debugfsdir);
++	struct minstrel_priv *mp;
++
++	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
++	if (!mp)
++		return NULL;
++
++	/* contention window settings
++	 * Just an approximation. Using the per-queue values would complicate
++	 * the calculations and is probably unnecessary */
++	mp->cw_min = 15;
++	mp->cw_max = 1023;
++
++	/* number of packets (in %) to use for sampling other rates
++	 * sample less often for non-mrr packets, because the overhead
++	 * is much higher than with mrr */
++	mp->lookaround_rate = 5;
++	mp->lookaround_rate_mrr = 10;
++
++	/* maximum time that the hw is allowed to stay in one MRR segment */
++	mp->segment_size = 6000;
++
++	if (hw->max_rate_tries > 0)
++		mp->max_retry = hw->max_rate_tries;
++	else
++		/* safe default, does not necessarily have to match hw properties */
++		mp->max_retry = 7;
++
++	if (hw->max_rates >= 4)
++		mp->has_mrr = true;
++
++	mp->hw = hw;
++	mp->update_interval = 100;
++
++#ifdef CPTCFG_MAC80211_DEBUGFS
++	mp->fixed_rate_idx = (u32) -1;
++	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
++			   &mp->fixed_rate_idx);
++#endif
++
++	minstrel_ht_init_cck_rates(mp);
++
++	return mp;
+ }
+ 
+ static void
+ minstrel_ht_free(void *priv)
+ {
+-	mac80211_minstrel.free(priv);
++	kfree(priv);
+ }
+ 
+ static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
+@@ -1417,14 +1482,14 @@ static void __init init_sample_table(voi
+ }
+ 
+ int __init
+-rc80211_minstrel_ht_init(void)
++rc80211_minstrel_init(void)
+ {
+ 	init_sample_table();
+ 	return ieee80211_rate_control_register(&mac80211_minstrel_ht);
+ }
+ 
+ void
+-rc80211_minstrel_ht_exit(void)
++rc80211_minstrel_exit(void)
+ {
+ 	ieee80211_rate_control_unregister(&mac80211_minstrel_ht);
+ }
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -15,11 +15,7 @@
+  */
+ #define MINSTREL_MAX_STREAMS		3
+ #define MINSTREL_HT_STREAM_GROUPS	4 /* BW(=2) * SGI(=2) */
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ #define MINSTREL_VHT_STREAM_GROUPS	6 /* BW(=3) * SGI(=2) */
+-#else
+-#define MINSTREL_VHT_STREAM_GROUPS	0
+-#endif
+ 
+ #define MINSTREL_HT_GROUPS_NB	(MINSTREL_MAX_STREAMS *		\
+ 				 MINSTREL_HT_STREAM_GROUPS)
+@@ -34,11 +30,7 @@
+ #define MINSTREL_CCK_GROUP	(MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
+ #define MINSTREL_VHT_GROUP_0	(MINSTREL_CCK_GROUP + 1)
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ #define MCS_GROUP_RATES		10
+-#else
+-#define MCS_GROUP_RATES		8
+-#endif
+ 
+ struct mcs_group {
+ 	u32 flags;
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -15,6 +15,22 @@
+ #include "rc80211_minstrel.h"
+ #include "rc80211_minstrel_ht.h"
+ 
++static ssize_t
++minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
++{
++	struct minstrel_debugfs_info *ms;
++
++	ms = file->private_data;
++	return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
++}
++
++static int
++minstrel_stats_release(struct inode *inode, struct file *file)
++{
++	kfree(file->private_data);
++	return 0;
++}
++
+ static char *
+ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
+ {
diff --git a/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch b/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
new file mode 100644
index 000000000..fa51f1be7
--- /dev/null
+++ b/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
@@ -0,0 +1,358 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:45:47 +0100
+Subject: [PATCH] mac80211: minstrel: reduce minstrel_mcs_groups size
+
+By storing a shift value for all duration values of a group, we can
+reduce precision by a neglegible amount to make it fit into a u16 value.
+This improves cache footprint and reduces size:
+
+Before:
+   text    data     bss     dec     hex filename
+  10024     116       0   10140    279c rc80211_minstrel_ht.o
+
+After:
+   text    data     bss     dec     hex filename
+   9368     116       0    9484    250c rc80211_minstrel_ht.o
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -52,22 +52,23 @@
+ 	_streams - 1
+ 
+ /* MCS rate information for an MCS group */
+-#define MCS_GROUP(_streams, _sgi, _ht40)				\
++#define MCS_GROUP(_streams, _sgi, _ht40, _s)				\
+ 	[GROUP_IDX(_streams, _sgi, _ht40)] = {				\
+ 	.streams = _streams,						\
++	.shift = _s,							\
+ 	.flags =							\
+ 		IEEE80211_TX_RC_MCS |					\
+ 		(_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |			\
+ 		(_ht40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),		\
+ 	.duration = {							\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260)		\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260) >> _s	\
+ 	}								\
+ }
+ 
+@@ -80,9 +81,10 @@
+ #define BW2VBPS(_bw, r3, r2, r1)					\
+ 	(_bw == BW_80 ? r3 : _bw == BW_40 ? r2 : r1)
+ 
+-#define VHT_GROUP(_streams, _sgi, _bw)					\
++#define VHT_GROUP(_streams, _sgi, _bw, _s)				\
+ 	[VHT_GROUP_IDX(_streams, _sgi, _bw)] = {			\
+ 	.streams = _streams,						\
++	.shift = _s,							\
+ 	.flags =							\
+ 		IEEE80211_TX_RC_VHT_MCS |				\
+ 		(_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |			\
+@@ -90,25 +92,25 @@
+ 		 _bw == BW_40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),	\
+ 	.duration = {							\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  117,  54,  26)),		\
++			     BW2VBPS(_bw,  117,  54,  26)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  234, 108,  52)),		\
++			     BW2VBPS(_bw,  234, 108,  52)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  351, 162,  78)),		\
++			     BW2VBPS(_bw,  351, 162,  78)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  468, 216, 104)),		\
++			     BW2VBPS(_bw,  468, 216, 104)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  702, 324, 156)),		\
++			     BW2VBPS(_bw,  702, 324, 156)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  936, 432, 208)),		\
++			     BW2VBPS(_bw,  936, 432, 208)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1053, 486, 234)),		\
++			     BW2VBPS(_bw, 1053, 486, 234)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1170, 540, 260)),		\
++			     BW2VBPS(_bw, 1170, 540, 260)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1404, 648, 312)),		\
++			     BW2VBPS(_bw, 1404, 648, 312)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1560, 720, 346))		\
++			     BW2VBPS(_bw, 1560, 720, 346)) >> _s	\
+ 	}								\
+ }
+ 
+@@ -121,19 +123,20 @@
+ 	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
+ 	 CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
+ 
+-#define CCK_DURATION_LIST(_short)			\
+-	CCK_ACK_DURATION(10, _short),			\
+-	CCK_ACK_DURATION(20, _short),			\
+-	CCK_ACK_DURATION(55, _short),			\
+-	CCK_ACK_DURATION(110, _short)
++#define CCK_DURATION_LIST(_short, _s)			\
++	CCK_ACK_DURATION(10, _short) >> _s,		\
++	CCK_ACK_DURATION(20, _short) >> _s,		\
++	CCK_ACK_DURATION(55, _short) >> _s,		\
++	CCK_ACK_DURATION(110, _short) >> _s
+ 
+-#define CCK_GROUP					\
++#define CCK_GROUP(_s)					\
+ 	[MINSTREL_CCK_GROUP] = {			\
+ 		.streams = 0,				\
+ 		.flags = 0,				\
++		.shift = _s,				\
+ 		.duration = {				\
+-			CCK_DURATION_LIST(false),	\
+-			CCK_DURATION_LIST(true)		\
++			CCK_DURATION_LIST(false, _s),	\
++			CCK_DURATION_LIST(true, _s)	\
+ 		}					\
+ 	}
+ 
+@@ -151,47 +154,47 @@ MODULE_PARM_DESC(minstrel_vht_only,
+  * BW -> SGI -> #streams
+  */
+ const struct mcs_group minstrel_mcs_groups[] = {
+-	MCS_GROUP(1, 0, BW_20),
+-	MCS_GROUP(2, 0, BW_20),
+-	MCS_GROUP(3, 0, BW_20),
++	MCS_GROUP(1, 0, BW_20, 5),
++	MCS_GROUP(2, 0, BW_20, 4),
++	MCS_GROUP(3, 0, BW_20, 4),
+ 
+-	MCS_GROUP(1, 1, BW_20),
+-	MCS_GROUP(2, 1, BW_20),
+-	MCS_GROUP(3, 1, BW_20),
++	MCS_GROUP(1, 1, BW_20, 5),
++	MCS_GROUP(2, 1, BW_20, 4),
++	MCS_GROUP(3, 1, BW_20, 4),
+ 
+-	MCS_GROUP(1, 0, BW_40),
+-	MCS_GROUP(2, 0, BW_40),
+-	MCS_GROUP(3, 0, BW_40),
++	MCS_GROUP(1, 0, BW_40, 4),
++	MCS_GROUP(2, 0, BW_40, 4),
++	MCS_GROUP(3, 0, BW_40, 4),
+ 
+-	MCS_GROUP(1, 1, BW_40),
+-	MCS_GROUP(2, 1, BW_40),
+-	MCS_GROUP(3, 1, BW_40),
++	MCS_GROUP(1, 1, BW_40, 4),
++	MCS_GROUP(2, 1, BW_40, 4),
++	MCS_GROUP(3, 1, BW_40, 4),
+ 
+-	CCK_GROUP,
++	CCK_GROUP(8),
+ 
+-	VHT_GROUP(1, 0, BW_20),
+-	VHT_GROUP(2, 0, BW_20),
+-	VHT_GROUP(3, 0, BW_20),
++	VHT_GROUP(1, 0, BW_20, 5),
++	VHT_GROUP(2, 0, BW_20, 4),
++	VHT_GROUP(3, 0, BW_20, 4),
+ 
+-	VHT_GROUP(1, 1, BW_20),
+-	VHT_GROUP(2, 1, BW_20),
+-	VHT_GROUP(3, 1, BW_20),
++	VHT_GROUP(1, 1, BW_20, 5),
++	VHT_GROUP(2, 1, BW_20, 4),
++	VHT_GROUP(3, 1, BW_20, 4),
+ 
+-	VHT_GROUP(1, 0, BW_40),
+-	VHT_GROUP(2, 0, BW_40),
+-	VHT_GROUP(3, 0, BW_40),
++	VHT_GROUP(1, 0, BW_40, 4),
++	VHT_GROUP(2, 0, BW_40, 4),
++	VHT_GROUP(3, 0, BW_40, 4),
+ 
+-	VHT_GROUP(1, 1, BW_40),
+-	VHT_GROUP(2, 1, BW_40),
+-	VHT_GROUP(3, 1, BW_40),
++	VHT_GROUP(1, 1, BW_40, 4),
++	VHT_GROUP(2, 1, BW_40, 4),
++	VHT_GROUP(3, 1, BW_40, 4),
+ 
+-	VHT_GROUP(1, 0, BW_80),
+-	VHT_GROUP(2, 0, BW_80),
+-	VHT_GROUP(3, 0, BW_80),
++	VHT_GROUP(1, 0, BW_80, 4),
++	VHT_GROUP(2, 0, BW_80, 4),
++	VHT_GROUP(3, 0, BW_80, 4),
+ 
+-	VHT_GROUP(1, 1, BW_80),
+-	VHT_GROUP(2, 1, BW_80),
+-	VHT_GROUP(3, 1, BW_80),
++	VHT_GROUP(1, 1, BW_80, 4),
++	VHT_GROUP(2, 1, BW_80, 4),
++	VHT_GROUP(3, 1, BW_80, 4),
+ };
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
+@@ -307,7 +310,8 @@ minstrel_ht_get_tp_avg(struct minstrel_h
+ 	if (group != MINSTREL_CCK_GROUP)
+ 		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+ 
+-	nsecs += minstrel_mcs_groups[group].duration[rate];
++	nsecs += minstrel_mcs_groups[group].duration[rate] <<
++		 minstrel_mcs_groups[group].shift;
+ 
+ 	/*
+ 	 * For the throughput calculation, limit the probability value to 90% to
+@@ -755,12 +759,19 @@ minstrel_ht_tx_status(void *priv, struct
+ 		minstrel_ht_update_rates(mp, mi);
+ }
+ 
++static inline int
++minstrel_get_duration(int index)
++{
++	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
++	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
++	return duration << group->shift;
++}
++
+ static void
+ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                          int index)
+ {
+ 	struct minstrel_rate_stats *mrs;
+-	const struct mcs_group *group;
+ 	unsigned int tx_time, tx_time_rtscts, tx_time_data;
+ 	unsigned int cw = mp->cw_min;
+ 	unsigned int ctime = 0;
+@@ -779,8 +790,7 @@ minstrel_calc_retransmit(struct minstrel
+ 	mrs->retry_count_rtscts = 2;
+ 	mrs->retry_updated = true;
+ 
+-	group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+-	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len / 1000;
++	tx_time_data = minstrel_get_duration(index) * ampdu_len / 1000;
+ 
+ 	/* Contention time for first 2 tries */
+ 	ctime = (t_slot * cw) >> 1;
+@@ -874,20 +884,24 @@ minstrel_ht_get_max_amsdu_len(struct min
+ 	int group = mi->max_prob_rate / MCS_GROUP_RATES;
+ 	const struct mcs_group *g = &minstrel_mcs_groups[group];
+ 	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
++	unsigned int duration;
+ 
+ 	/* Disable A-MSDU if max_prob_rate is bad */
+ 	if (mi->groups[group].rates[rate].prob_ewma < MINSTREL_FRAC(50, 100))
+ 		return 1;
+ 
++	duration = g->duration[rate];
++	duration <<= g->shift;
++
+ 	/* If the rate is slower than single-stream MCS1, make A-MSDU limit small */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 52))
++	if (duration > MCS_DURATION(1, 0, 52))
+ 		return 500;
+ 
+ 	/*
+ 	 * If the rate is slower than single-stream MCS4, limit A-MSDU to usual
+ 	 * data packet size
+ 	 */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 104))
++	if (duration > MCS_DURATION(1, 0, 104))
+ 		return 1600;
+ 
+ 	/*
+@@ -895,7 +909,7 @@ minstrel_ht_get_max_amsdu_len(struct min
+ 	 * rate success probability is less than 75%, limit A-MSDU to twice the usual
+ 	 * data packet size
+ 	 */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 260) ||
++	if (duration > MCS_DURATION(1, 0, 260) ||
+ 	    (minstrel_ht_get_prob_ewma(mi, mi->max_tp_rate[0]) <
+ 	     MINSTREL_FRAC(75, 100)))
+ 		return 3200;
+@@ -942,13 +956,6 @@ minstrel_ht_update_rates(struct minstrel
+ 	rate_control_set_rates(mp->hw, mi->sta, rates);
+ }
+ 
+-static inline int
+-minstrel_get_duration(int index)
+-{
+-	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+-	return group->duration[index % MCS_GROUP_RATES];
+-}
+-
+ static int
+ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+ {
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -33,9 +33,10 @@
+ #define MCS_GROUP_RATES		10
+ 
+ struct mcs_group {
+-	u32 flags;
+-	unsigned int streams;
+-	unsigned int duration[MCS_GROUP_RATES];
++	u16 flags;
++	u8 streams;
++	u8 shift;
++	u16 duration[MCS_GROUP_RATES];
+ };
+ 
+ extern const struct mcs_group minstrel_mcs_groups[];
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -58,6 +58,7 @@ minstrel_ht_stats_dump(struct minstrel_h
+ 		static const int bitrates[4] = { 10, 20, 55, 110 };
+ 		int idx = i * MCS_GROUP_RATES + j;
+ 		unsigned int prob_ewmsd;
++		unsigned int duration;
+ 
+ 		if (!(mi->supported[i] & BIT(j)))
+ 			continue;
+@@ -95,7 +96,9 @@ minstrel_ht_stats_dump(struct minstrel_h
+ 		p += sprintf(p, "  %3u  ", idx);
+ 
+ 		/* tx_time[rate(i)] in usec */
+-		tx_time = DIV_ROUND_CLOSEST(mg->duration[j], 1000);
++		duration = mg->duration[j];
++		duration <<= mg->shift;
++		tx_time = DIV_ROUND_CLOSEST(duration, 1000);
+ 		p += sprintf(p, "%6u  ", tx_time);
+ 
+ 		tp_max = minstrel_ht_get_tp_avg(mi, i, j, MINSTREL_FRAC(100, 100));
+@@ -204,6 +207,7 @@ minstrel_ht_stats_csv_dump(struct minstr
+ 		static const int bitrates[4] = { 10, 20, 55, 110 };
+ 		int idx = i * MCS_GROUP_RATES + j;
+ 		unsigned int prob_ewmsd;
++		unsigned int duration;
+ 
+ 		if (!(mi->supported[i] & BIT(j)))
+ 			continue;
+@@ -238,7 +242,10 @@ minstrel_ht_stats_csv_dump(struct minstr
+ 		}
+ 
+ 		p += sprintf(p, "%u,", idx);
+-		tx_time = DIV_ROUND_CLOSEST(mg->duration[j], 1000);
++
++		duration = mg->duration[j];
++		duration <<= mg->shift;
++		tx_time = DIV_ROUND_CLOSEST(duration, 1000);
+ 		p += sprintf(p, "%u,", tx_time);
+ 
+ 		tp_max = minstrel_ht_get_tp_avg(mi, i, j, MINSTREL_FRAC(100, 100));
diff --git a/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch b/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
new file mode 100644
index 000000000..502d8c776
--- /dev/null
+++ b/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
@@ -0,0 +1,31 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 13:43:07 +0100
+Subject: [PATCH] mac80211: minstrel: fix using short preamble CCK rates on
+ HT clients
+
+mi->supported[MINSTREL_CCK_GROUP] needs to be updated
+
+Fixes: 782dda00ab8e ("mac80211: minstrel_ht: move short preamble check out of get_rate")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1135,7 +1135,6 @@ minstrel_ht_update_caps(void *priv, stru
+ 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+ 	u16 ht_cap = sta->ht_cap.cap;
+ 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+-	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
+ 	int use_vht;
+ 	int n_supported = 0;
+ 	int ack_dur;
+@@ -1267,8 +1266,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	if (!n_supported)
+ 		goto use_legacy;
+ 
+-	if (test_sta_flag(sinfo, WLAN_STA_SHORT_PREAMBLE))
+-		mi->cck_supported_short |= mi->cck_supported_short << 4;
++	mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
+ 
+ 	/* create an initial rate table with the lowest supported rates */
+ 	minstrel_ht_update_stats(mp, mi);
diff --git a/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch b/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
new file mode 100644
index 000000000..9970574e1
--- /dev/null
+++ b/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
@@ -0,0 +1,43 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Fri, 2 Feb 2018 11:36:45 +0100
+Subject: [PATCH] ath9k: Protect queue draining by rcu_read_lock()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When ath9k was switched over to use the mac80211 intermediate queues,
+node cleanup now drains the mac80211 queues. However, this call path is
+not protected by rcu_read_lock() as it was previously entirely internal
+to the driver which uses its own locking.
+
+This leads to a possible rcu_dereference() without holding
+rcu_read_lock(); but only if a station is cleaned up while having
+packets queued on the TXQ. Fix this by adding the rcu_read_lock() to the
+caller in ath9k.
+
+Fixes: 50f08edf9809 ("ath9k: Switch to using mac80211 intermediate software queues.")
+Cc: stable@vger.kernel.org
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2930,6 +2930,8 @@ void ath_tx_node_cleanup(struct ath_soft
+ 	struct ath_txq *txq;
+ 	int tidno;
+ 
++	rcu_read_lock();
++
+ 	for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+ 		tid = ath_node_to_tid(an, tidno);
+ 		txq = tid->txq;
+@@ -2947,6 +2949,8 @@ void ath_tx_node_cleanup(struct ath_soft
+ 		if (!an->sta)
+ 			break; /* just one multicast ath_atx_tid */
+ 	}
++
++	rcu_read_unlock();
+ }
+ 
+ #ifdef CPTCFG_ATH9K_TX99
diff --git a/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch b/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
new file mode 100644
index 000000000..f0ffcd965
--- /dev/null
+++ b/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Mar 2018 13:27:54 +0100
+Subject: [PATCH] mac80211: minstrel: fix CCK rate group streams value
+
+Fixes a harmless underflow issue when CCK rates are actively being used
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -131,7 +131,7 @@
+ 
+ #define CCK_GROUP(_s)					\
+ 	[MINSTREL_CCK_GROUP] = {			\
+-		.streams = 0,				\
++		.streams = 1,				\
+ 		.flags = 0,				\
+ 		.shift = _s,				\
+ 		.duration = {				\
diff --git a/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch b/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
new file mode 100644
index 000000000..e0049c36e
--- /dev/null
+++ b/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Mar 2018 13:28:48 +0100
+Subject: [PATCH] mac80211: minstrel: fix sampling/reporting of CCK rates
+ in HT mode
+
+Long/short preamble selection cannot be sampled separately, since it
+depends on the BSS state. Because of that, sampling attempts to
+currently not used preamble modes are not counted in the statistics,
+which leads to CCK rates being sampled too often.
+
+Fix statistics accounting for long/short preamble by increasing the
+index where necessary.
+Fix excessive CCK rate sampling by dropping unsupported sample attempts.
+
+This improves throughput on 2.4 GHz channels
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -281,7 +281,8 @@ minstrel_ht_get_stats(struct minstrel_pr
+ 				break;
+ 
+ 		/* short preamble */
+-		if (!(mi->supported[group] & BIT(idx)))
++		if ((mi->supported[group] & BIT(idx + 4)) &&
++		    (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
+ 			idx += 4;
+ 	}
+ 	return &mi->groups[group].rates[idx];
+@@ -1080,18 +1081,23 @@ minstrel_ht_get_rate(void *priv, struct
+ 		return;
+ 
+ 	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++	sample_idx %= MCS_GROUP_RATES;
++
++	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
++	    (sample_idx >= 4) != txrc->short_preamble)
++		return;
++
+ 	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ 	rate->count = 1;
+ 
+-	if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
++	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
+ 		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+ 		rate->idx = mp->cck_rates[idx];
+ 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
+ 		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
+ 				       sample_group->streams);
+ 	} else {
+-		rate->idx = sample_idx % MCS_GROUP_RATES +
+-			    (sample_group->streams - 1) * 8;
++		rate->idx = sample_idx + (sample_group->streams - 1) * 8;
+ 	}
+ 
+ 	rate->flags = sample_group->flags;
diff --git a/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch b/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
new file mode 100644
index 000000000..414cb137d
--- /dev/null
+++ b/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
@@ -0,0 +1,40 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 3 Mar 2018 18:48:58 +0100
+Subject: [PATCH] mac80211: minstrel: do not sample rates 3 times slower than
+ max_prob_rate
+
+These rates are highly unlikely to be used quickly, even if the link
+deteriorates rapidly. This improves throughput in cases where CCK rates
+are not reliable enough to be skipped entirely during sampling.
+Sampling these rates regularly can cost a lot of airtime.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1004,10 +1004,13 @@ minstrel_get_sample_rate(struct minstrel
+ 		return -1;
+ 
+ 	/*
+-	 * Do not sample if the probability is already higher than 95%
+-	 * to avoid wasting airtime.
++	 * Do not sample if the probability is already higher than 95%,
++	 * or if the rate is 3 times slower than the current max probability
++	 * rate, to avoid wasting airtime.
+ 	 */
+-	if (mrs->prob_ewma > MINSTREL_FRAC(95, 100))
++	sample_dur = minstrel_get_duration(sample_idx);
++	if (mrs->prob_ewma > MINSTREL_FRAC(95, 100) ||
++	    minstrel_get_duration(mi->max_prob_rate) * 3 < sample_dur)
+ 		return -1;
+ 
+ 	/*
+@@ -1017,7 +1020,6 @@ minstrel_get_sample_rate(struct minstrel
+ 
+ 	cur_max_tp_streams = minstrel_mcs_groups[tp_rate1 /
+ 		MCS_GROUP_RATES].streams;
+-	sample_dur = minstrel_get_duration(sample_idx);
+ 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
+ 	    (cur_max_tp_streams - 1 <
+ 	     minstrel_mcs_groups[sample_group].streams ||
diff --git a/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
new file mode 100644
index 000000000..c64457a17
--- /dev/null
+++ b/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Mar 2018 21:00:56 +0100
+Subject: [PATCH] mac80211: fix memory accounting with A-MSDU aggregation
+
+fq uses skb->truesize for memory usage tracking. Increments/decrements
+are done on enqueue/dequeue.
+When A-MSDU aggregation is performed on tx side, the packet is
+aggregated with the last packet in the queue belonging to the same flow.
+There are multiple bugs here:
+- The truesize field of the aggregated packet isn't updated, so memory
+usage is underestimated
+- fq->memory_usage isn't adjusted.
+
+Because of the combination of both bugs, this only causes tx issues in
+rare cases, mainly when the A-MSDU head needs to be reallocated.
+
+Fix this by adjusting both truesize of the A-MSDU head and adding the
+truesize delta to fq->memory_usage.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3171,6 +3171,7 @@ static bool ieee80211_amsdu_aggregate(st
+ 	u8 max_subframes = sta->sta.max_amsdu_subframes;
+ 	int max_frags = local->hw.max_tx_fragments;
+ 	int max_amsdu_len = sta->sta.max_amsdu_len;
++	int orig_truesize;
+ 	__be16 len;
+ 	void *data;
+ 	bool ret = false;
+@@ -3201,12 +3202,13 @@ static bool ieee80211_amsdu_aggregate(st
+ 	flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
+ 	head = skb_peek_tail(&flow->queue);
+ 	if (!head)
+-		goto out;
++		goto unlock;
+ 
++	orig_truesize = head->truesize;
+ 	orig_len = head->len;
+ 
+ 	if (skb->len + head->len > max_amsdu_len)
+-		goto out;
++		goto unlock;
+ 
+ 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+ 		goto out;
+@@ -3249,6 +3251,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	fq_recalc_backlog(fq, tin, flow);
+ 
+ out:
++	fq->memory_usage += head->truesize - orig_truesize;
++
++unlock:
+ 	spin_unlock_bh(&fq->lock);
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
index edd4ce26b..8fa56f40a 100644
--- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
@@ -57,19 +57,7 @@
  	if (!wiphy->bands[NL80211_BAND_5GHZ])
  		return;
  
-@@ -544,6 +559,11 @@ void ath_reg_notifier_apply(struct wiphy
- 		ath_reg_dyn_country(wiphy, reg, request);
- 		break;
- 	}
-+
-+	/* Prevent broken CTLs from being applied */
-+	if (IS_ENABLED(CPTCFG_ATH_USER_REGD) &&
-+	    reg->regpair != common->reg_world_copy.regpair)
-+		reg->regpair = ath_get_regpair(WOR0_WORLD);
- }
- EXPORT_SYMBOL(ath_reg_notifier_apply);
- 
-@@ -639,6 +659,10 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -639,6 +654,10 @@ ath_regd_init_wiphy(struct ath_regulator
  	const struct ieee80211_regdomain *regd;
  
  	wiphy->reg_notifier = reg_notifier;
@@ -80,18 +68,6 @@
  	wiphy->regulatory_flags |= REGULATORY_STRICT_REG |
  				   REGULATORY_CUSTOM_REG;
  
-@@ -767,10 +791,7 @@ ath_regd_init(struct ath_regulatory *reg
- 	if (r)
- 		return r;
- 
--	if (ath_is_world_regd(reg))
--		memcpy(&common->reg_world_copy, reg,
--		       sizeof(struct ath_regulatory));
--
-+	memcpy(&common->reg_world_copy, reg, sizeof(struct ath_regulatory));
- 	ath_regd_init_wiphy(reg, wiphy, reg_notifier);
- 
- 	return 0;
 --- a/drivers/net/wireless/ath/Kconfig
 +++ b/drivers/net/wireless/ath/Kconfig
 @@ -23,6 +23,9 @@ config WLAN_VENDOR_ATH
diff --git a/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
index 44e8f3281..35b0f2b76 100644
--- a/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
+++ b/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
@@ -39,7 +39,7 @@
  bool ath_is_world_regd(struct ath_regulatory *reg)
  {
  	return is_wwr_sku(ath_regd_get_eepromRD(reg));
-@@ -663,6 +671,9 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -658,6 +666,9 @@ ath_regd_init_wiphy(struct ath_regulator
  	if (IS_ENABLED(CPTCFG_ATH_USER_REGD))
  		return 0;
  
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index 2a2d2f3cd..19f0ff2ae 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3720,6 +3733,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3721,6 +3734,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
index cc29402c0..b7bce637f 100644
--- a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
+++ b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1198,6 +1198,7 @@ int __init brcmf_core_init(void)
+@@ -1295,6 +1295,7 @@ int __init brcmf_core_init(void)
  {
  	if (!schedule_work(&brcmf_driver_work))
  		return -EBUSY;
diff --git a/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
index 7fc1e449d..1345e85f6 100644
--- a/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
+++ b/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -655,9 +655,37 @@ static struct wireless_dev *brcmf_cfg802
+@@ -614,9 +614,37 @@ static struct wireless_dev *brcmf_cfg802
  						     enum nl80211_iftype type,
  						     struct vif_params *params)
  {
diff --git a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
index 43f8fbf67..c02d00966 100644
--- a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2838,6 +2838,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2727,6 +2727,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch b/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
index 891c539fb..0ae012cbe 100644
--- a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
+++ b/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
@@ -9,7 +9,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -69,7 +69,11 @@ static int brcmf_fcmode;
+@@ -71,7 +71,11 @@ static int brcmf_fcmode;
  module_param_named(fcmode, brcmf_fcmode, int, 0);
  MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
  
diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index 441f59e43..d83e38793 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2017-12-17
-PKG_SOURCE_VERSION:=68b0cf17efe32623efd2a46d33b0b551bb78cbbe
-PKG_MIRROR_HASH:=855901e5e02249f53bb943d2d5da5bb3cb357f02e4c68c6291604867e250e9bd
+PKG_SOURCE_DATE:=2018-02-27
+PKG_SOURCE_VERSION:=ffa2069e78cf267ce79d7a8820aa0368161ff6e1
+PKG_MIRROR_HASH:=dee90d713e3c351ee51da51030e56867fa9bd2eac8f222734d0573223a5e0a41
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_BUILD_PARALLEL:=1
diff --git a/package/kernel/mwlwifi/Makefile b/package/kernel/mwlwifi/Makefile
index f8e70e54a..1613fb405 100644
--- a/package/kernel/mwlwifi/Makefile
+++ b/package/kernel/mwlwifi/Makefile
@@ -8,7 +8,6 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mwlwifi
-PKG_VERSION:=10.3.4.0-20171214
 PKG_RELEASE=1
 
 PKG_LICENSE:=ISC
@@ -16,8 +15,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/kaloz/mwlwifi
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=843d00cd9c134629b9dad7162831ec5f136399b3
-PKG_MIRROR_HASH:=080c491473f0dbe9a7cac0fa3c6d004bf2dc3bd953a9f9d074eb8876a86437c2
+PKG_SOURCE_DATE:=2018-03-05
+PKG_SOURCE_VERSION:=b1b9a9e1c1beee30a8cce4038f4109727362ebe0
+PKG_MIRROR_HASH:=720a3bc5ecb31419fdeebe02efba764ecc77815332114e97dc80f989d85a816f
 
 PKG_MAINTAINER:=Imre Kaloz <kaloz@openwrt.org>
 PKG_BUILD_PARALLEL:=1
@@ -27,7 +27,7 @@ include $(INCLUDE_DIR)/package.mk
 
 define KernelPackage/mwlwifi
   SUBMENU:=Wireless Drivers
-  TITLE:=Marvell 88W8864 wireless driver
+  TITLE:=Marvell 88W8864/88W8897/88W8964 wireless driver
   DEPENDS:=+kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT @PCI_SUPPORT @TARGET_mvebu
   FILES:=$(PKG_BUILD_DIR)/mwlwifi.ko
   AUTOLOAD:=$(call AutoLoad,50,mwlwifi)
@@ -49,13 +49,45 @@ define Build/Compile
 		modules
 endef
 
-define KernelPackage/mwlwifi/install
+define Package/mwlwifi-firmware-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  TITLE:=Marvell $(1) firmware
+  DEPENDS:=+kmod-mwlwifi @TARGET_mvebu
+endef
+
+define Package/mwlwifi-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware
 	$(INSTALL_DIR) $(1)/lib/firmware/mwlwifi
-	$(CP) $(PKG_BUILD_DIR)/bin/firmware/88W8864.bin $(1)/lib/firmware/mwlwifi/
-	$(CP) $(PKG_BUILD_DIR)/bin/firmware/88W8897.bin $(1)/lib/firmware/mwlwifi/
-	$(CP) $(PKG_BUILD_DIR)/bin/firmware/88W8964.bin $(1)/lib/firmware/mwlwifi/
-	$(CP) $(PKG_BUILD_DIR)/bin/firmware/Marvell_license.txt $(1)/lib/firmware/mwlwifi/
+	$(CP) $(PKG_BUILD_DIR)/bin/firmware/$(2) $(1)/lib/firmware/mwlwifi/
+	$(CP) $(PKG_BUILD_DIR)/bin/firmware/Marvell_license.txt $(1)/lib/firmware/mwlwifi/$(2).Marvell_license.txt
+endef
+
+define Package/mwlwifi-firmware-88w8864
+$(call Package/mwlwifi-firmware-default,88W8864)
+endef
+
+define Package/mwlwifi-firmware-88w8864/install
+	$(call Package/mwlwifi-firmware/install,$(1),88W8864.bin)
+endef
+
+define Package/mwlwifi-firmware-88w8897
+$(call Package/mwlwifi-firmware-default,88W8897)
+endef
+
+define Package/mwlwifi-firmware-88w8897/install
+	$(call Package/mwlwifi-firmware/install,$(1),88W8897.bin)
+endef
+
+define Package/mwlwifi-firmware-88w8964
+$(call Package/mwlwifi-firmware-default,88W8964)
+endef
+
+define Package/mwlwifi-firmware-88w8964/install
+	$(call Package/mwlwifi-firmware/install,$(1),88W8964.bin)
 endef
 
 $(eval $(call KernelPackage,mwlwifi))
+$(eval $(call BuildPackage,mwlwifi-firmware-88w8864))
+$(eval $(call BuildPackage,mwlwifi-firmware-88w8897))
+$(eval $(call BuildPackage,mwlwifi-firmware-88w8964))
diff --git a/package/kernel/wrt55agv2-spidevs/Makefile b/package/kernel/wrt55agv2-spidevs/Makefile
deleted file mode 100644
index d80c1e570..000000000
--- a/package/kernel/wrt55agv2-spidevs/Makefile
+++ /dev/null
@@ -1,37 +0,0 @@
-#
-# Copyright (C) 2008 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
-
-PKG_NAME:=wrt55agv2-spidevs
-PKG_RELEASE:=1
-
-include $(INCLUDE_DIR)/package.mk
-
-define KernelPackage/wrt55agv2-spidevs
-  SUBMENU:=Other modules
-  TITLE:=WRT55AG v2 SPI devices support
-  DEPENDS:=@TARGET_ath25 +kmod-spi-gpio-old +kmod-spi-ks8995
-  FILES:=$(PKG_BUILD_DIR)/wrt55agv2_spidevs.ko
-endef
-
-define KernelPackage/wrt55agv2-spidevs/description
-  Kernel module for the SPI devices on the WRT55AG v2 board.
-endef
-
-MAKE_OPTS:= \
-	$(KERNEL_MAKE_FLAGS) \
-	SUBDIRS="$(PKG_BUILD_DIR)"
-
-define Build/Compile
-	$(MAKE) -C "$(LINUX_DIR)" \
-		$(MAKE_OPTS) \
-		modules
-endef
-
-$(eval $(call KernelPackage,wrt55agv2-spidevs))
diff --git a/package/kernel/wrt55agv2-spidevs/src/Kconfig b/package/kernel/wrt55agv2-spidevs/src/Kconfig
deleted file mode 100644
index 75e8242be..000000000
--- a/package/kernel/wrt55agv2-spidevs/src/Kconfig
+++ /dev/null
@@ -1,3 +0,0 @@
-config WRT55AGV2_SPIDEVS
-	tristate "SPI device support for the WRT55AG v2 board"
-	depends on SPI && MIPS_ATHEROS
diff --git a/package/kernel/wrt55agv2-spidevs/src/Makefile b/package/kernel/wrt55agv2-spidevs/src/Makefile
deleted file mode 100644
index 76b093930..000000000
--- a/package/kernel/wrt55agv2-spidevs/src/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-m += wrt55agv2_spidevs.o
diff --git a/package/kernel/wrt55agv2-spidevs/src/wrt55agv2_spidevs.c b/package/kernel/wrt55agv2-spidevs/src/wrt55agv2_spidevs.c
deleted file mode 100644
index dfb7f6abe..000000000
--- a/package/kernel/wrt55agv2-spidevs/src/wrt55agv2_spidevs.c
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * SPI driver for the Linksys WRT55AG v2 board.
- *
- * Copyright (C) 2008 Gabor Juhos <juhosg at openwrt.org>
- *
- * This file was based on the mmc_over_gpio driver:
- *	Copyright 2008 Michael Buesch <mb@bu3sch.de>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published
- * by the Free Software Foundation.
- */
-
-#include <linux/platform_device.h>
-#include <linux/spi/spi_gpio_old.h>
-#include <linux/module.h>
-
-#define DRV_NAME	"wrt55agv2-spidevs"
-#define DRV_DESC	"SPI driver for the WRT55AG v2 board"
-#define DRV_VERSION	"0.1.0"
-#define PFX		DRV_NAME ": "
-
-#define GPIO_PIN_MISO	1
-#define GPIO_PIN_CS	2
-#define GPIO_PIN_CLK	3
-#define GPIO_PIN_MOSI	4
-
-static struct platform_device *spi_gpio_dev;
-
-static int __init boardinfo_setup(struct spi_board_info *bi,
-		struct spi_master *master, void *data)
-{
-
-	strlcpy(bi->modalias, "spi-ks8995", sizeof(bi->modalias));
-
-	bi->max_speed_hz = 5000000 /* Hz */;
-	bi->bus_num = master->bus_num;
-	bi->mode = SPI_MODE_0;
-
-	return 0;
-}
-
-static int __init wrt55agv2_spidevs_init(void)
-{
-	struct spi_gpio_platform_data pdata;
-	int err;
-
-	spi_gpio_dev = platform_device_alloc("spi-gpio", 0);
-	if (!spi_gpio_dev) {
-		printk(KERN_ERR PFX "no memory for spi-gpio device\n");
-		return -ENOMEM;
-	}
-
-	memset(&pdata, 0, sizeof(pdata));
-	pdata.pin_miso = GPIO_PIN_MISO;
-	pdata.pin_cs = GPIO_PIN_CS;
-	pdata.pin_clk = GPIO_PIN_CLK;
-	pdata.pin_mosi = GPIO_PIN_MOSI;
-	pdata.cs_activelow = 1;
-	pdata.no_spi_delay = 1;
-	pdata.boardinfo_setup = boardinfo_setup;
-	pdata.boardinfo_setup_data = NULL;
-
-	err = platform_device_add_data(spi_gpio_dev, &pdata, sizeof(pdata));
-	if (err)
-		goto err_free_dev;
-
-	err = platform_device_register(spi_gpio_dev);
-	if (err) {
-		printk(KERN_ERR PFX "unable to register device\n");
-		goto err_free_pdata;
-	}
-
-	return 0;
-
-err_free_pdata:
-	kfree(spi_gpio_dev->dev.platform_data);
-	spi_gpio_dev->dev.platform_data = NULL;
-
-err_free_dev:
-	platform_device_put(spi_gpio_dev);
-	return err;
-}
-
-static void __exit wrt55agv2_spidevs_cleanup(void)
-{
-	if (!spi_gpio_dev)
-		return;
-
-	platform_device_unregister(spi_gpio_dev);
-
-	kfree(spi_gpio_dev->dev.platform_data);
-	spi_gpio_dev->dev.platform_data = NULL;
-	platform_device_put(spi_gpio_dev);
-}
-
-static int __init wrt55agv2_spidevs_modinit(void)
-{
-	printk(KERN_INFO DRV_DESC " version " DRV_VERSION "\n");
-	return wrt55agv2_spidevs_init();
-}
-module_init(wrt55agv2_spidevs_modinit);
-
-static void __exit wrt55agv2_spidevs_modexit(void)
-{
-	wrt55agv2_spidevs_cleanup();
-}
-module_exit(wrt55agv2_spidevs_modexit);
-
-MODULE_DESCRIPTION(DRV_DESC);
-MODULE_VERSION(DRV_VERSION);
-MODULE_AUTHOR("Gabor Juhos <juhosg at openwrt.org>");
-MODULE_LICENSE("GPL v2");
-
diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
new file mode 100644
index 000000000..e5bbdf40c
--- /dev/null
+++ b/target/linux/ipq40xx/Makefile
@@ -0,0 +1,21 @@
+include $(TOPDIR)/rules.mk
+
+ARCH:=arm
+BOARD:=ipq40xx
+BOARDNAME:=Qualcomm Atheros IPQ40XX
+FEATURES:=squashfs fpu ramdisk nand
+CPU_TYPE:=cortex-a7
+CPU_SUBTYPE:=neon-vfpv4
+MAINTAINER:=John Crispin <john@phrozen.org>
+
+KERNEL_PATCHVER:=4.14
+
+KERNELNAME:=zImage Image dtbs
+
+include $(INCLUDE_DIR)/target.mk
+DEFAULT_PACKAGES += \
+	kmod-leds-gpio kmod-gpio-button-hotplug swconfig \
+	kmod-ath10k wpad-mini \
+	kmod-usb3 kmod-usb-dwc3-of-simple kmod-usb-phy-qcom-dwc3 \
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
new file mode 100755
index 000000000..f1f49abb2
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -0,0 +1,38 @@
+#!/bin/sh
+#
+# Copyright (C) 2015 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+boardname="${board##*,}"
+
+case "$board" in
+asus,rt-ac58u)
+	ucidef_set_led_wlan "wlan2g" "WLAN2G" "${boardname}:blue:wlan2G" "phy0tpt"
+	ucidef_set_led_wlan "wlan5g" "WLAN5G" "${boardname}:blue:wlan5G" "phy1tpt"
+	ucidef_set_led_usbport "usb" "USB" "${boardname}:blue:usb" "usb1-port1" "usb2-port1" "usb3-port1" "usb4-port1"
+	ucidef_set_led_netdev "wan" "WAN" "${boardname}:blue:wan" "eth1"
+	ucidef_set_led_switch "lan" "LAN" "${boardname}:blue:lan" "switch0" "0x1e"
+	;;
+avm,fritzbox-4040)
+	ucidef_set_led_wlan "wlan" "WLAN" "fritz4040:green:wlan" "phy0tpt" "phy1tpt"
+	ucidef_set_led_netdev "wan" "WAN" "fritz4040:green:wan" "eth1"
+	ucidef_set_led_switch "lan" "LAN" "fritz4040:green:lan" "switch0" "0x1e"
+	;;
+glinet,gl-b1300)
+	ucidef_set_led_wlan "wlan" "WLAN" "${boardname}:green:wlan" "phy0tpt"
+	;;
+meraki,mr33)
+	ucidef_set_interface_lan "eth0"
+	;;
+*)
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
new file mode 100755
index 000000000..a53e2860a
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+# Copyright (c) 2015 The Linux Foundation. All rights reserved.
+# Copyright (c) 2011-2015 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+. /lib/functions/system.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+asus,rt-ac58u)
+	CI_UBIPART=UBI_DEV
+	wan_mac_addr=$(mtd_get_mac_binary_ubi Factory 20486)
+	lan_mac_addr=$(mtd_get_mac_binary_ubi Factory 4102)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	ucidef_add_switch "switch0" \
+		"0u@eth0" "1:lan" "2:lan" "3:lan" "4:lan"
+	ucidef_set_interface_macaddr "lan" "$lan_mac_addr"
+	ucidef_set_interface_macaddr "wan" "$wan_mac_addr"
+	;;
+avm,fritzbox-4040)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	ucidef_add_switch "switch0" \
+		"0u@eth0" "1:lan" "2:lan" "3:lan" "4:lan"
+	;;
+compex,wpj428)
+	ucidef_set_interface_lan "eth0 eth1"
+	;;
+glinet,gl-b1300)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	ucidef_add_switch "switch0" \
+		"0u@eth0" "3:lan" "4:lan"
+	;;
+openmesh,a42)
+	ucidef_set_interfaces_lan_wan "eth1" "eth0"
+	;;
+
+meraki,mr33)
+	ucidef_set_interface_lan "eth0"
+	;;
+*)
+	echo "Unsupported hardware. Network interfaces not intialized"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
new file mode 100755
index 000000000..4e306a94a
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+compex,wpj428)
+	ucidef_add_gpio_switch "sim_card_select" "SIM card select" "3" "0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/ipq40xx/base-files/etc/diag.sh b/target/linux/ipq40xx/base-files/etc/diag.sh
new file mode 100755
index 000000000..4cfe6325f
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/diag.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+. /lib/functions/leds.sh
+
+boot="$(get_dt_led boot)"
+failsafe="$(get_dt_led failsafe)"
+running="$(get_dt_led running)"
+upgrade="$(get_dt_led upgrade)"
+
+set_state() {
+	status_led="$boot"
+
+	case "$1" in
+	preinit)
+		status_led_blink_preinit
+		;;
+	failsafe)
+		status_led_off
+		[ -n "$running" ] && {
+			status_led="$running"
+			status_led_off
+		}
+		status_led="$failsafe"
+		status_led_blink_failsafe
+		;;
+	preinit_regular)
+		status_led_blink_preinit_regular
+		;;
+	upgrade)
+		[ -n "$running" ] && {
+			status_led="$upgrade"
+			status_led_blink_preinit_regular
+		}
+		;;
+	done)
+		status_led_off
+		[ -n "$running" ] && {
+			status_led="$running"
+			status_led_on
+		}
+		;;
+	esac
+}
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
new file mode 100644
index 000000000..969983e6b
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -0,0 +1,164 @@
+#!/bin/sh
+
+# xor multiple hex values of the same length
+xor() {
+	local val
+	local ret="0x$1"
+	local retlen=${#1}
+
+	shift
+	while [ -n "$1" ]; do
+		val="0x$1"
+		ret=$((ret ^ val))
+		shift
+	done
+
+	printf "%0${retlen}x" "$ret"
+}
+
+ath10kcal_die() {
+	echo "ath10cal: " "$*"
+	exit 1
+}
+
+ath10kcal_extract() {
+	local part=$1
+	local offset=$2
+	local count=$3
+	local mtd
+
+	mtd=$(find_mtd_chardev $part)
+	[ -n "$mtd" ] || \
+		ath10kcal_die "no mtd device found for partition $part"
+
+	dd if=$mtd of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
+		ath10kcal_die "failed to extract calibration data from $mtd"
+}
+
+ath10kcal_ubi_extract() {
+	local part=$1
+	local offset=$2
+	local count=$3
+	local ubidev
+	local ubi
+
+	. /lib/upgrade/nand.sh
+
+	ubidev=$(nand_find_ubi $CI_UBIPART)
+	ubi=$(nand_find_volume $ubidev $part)
+	[ -n "$ubi" ] || \
+		ath10kcal_die "no UBI volume found for $part"
+
+	dd if=/dev/$ubi of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
+		ath10kcal_die "failed to extract from $ubi"
+}
+
+ath10kcal_patch_mac() {
+	local mac=$1
+
+	[ -z "$mac" ] && return
+
+	macaddr_2bin $mac | dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=6 count=6
+}
+
+ath10kcal_patch_mac_crc() {
+	local mac=$1
+	local mac_offset=6
+	local chksum_offset=2
+	local xor_mac
+	local xor_fw_mac
+	local xor_fw_chksum
+
+	xor_fw_mac=$(hexdump -v -n 6 -s $mac_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
+	xor_fw_mac="${xor_fw_mac:0:4} ${xor_fw_mac:4:4} ${xor_fw_mac:8:4}"
+
+	ath10kcal_patch_mac "$mac" && {
+		xor_mac=${mac//:/}
+		xor_mac="${xor_mac:0:4} ${xor_mac:4:4} ${xor_mac:8:4}"
+
+		xor_fw_chksum=$(hexdump -v -n 2 -s $chksum_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
+		xor_fw_chksum=$(xor $xor_fw_chksum $xor_fw_mac $xor_mac)
+
+		printf "%b" "\x${xor_fw_chksum:0:2}\x${xor_fw_chksum:2:2}" | \
+			dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=$chksum_offset count=2
+	}
+}
+
+ath10kcal_is_caldata_valid() {
+	local expected="$1"
+
+	magic=$(hexdump -v -n 2 -e '1/1 "%02x"' /lib/firmware/$FIRMWARE)
+	[[ "$magic" == "$expected" ]]
+	return $?
+}
+
+[ -e /lib/firmware/$FIRMWARE ] && exit 0
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+board=$(board_name)
+
+
+case "$FIRMWARE" in
+"ath10k/cal-pci-0000:01:00.0.bin")
+	case "$board" in
+	meraki,mr33)
+		ath10kcal_ubi_extract "ART" 36864 2116
+		ath10kcal_is_caldata_valid "4408" || ath10kcal_extract "ART" 36864 2116
+		ath10kcal_patch_mac $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102) +1)
+		;;
+	esac
+	;;
+"ath10k/pre-cal-ahb-a000000.wifi.bin")
+	case "$board" in
+	asus,rt-ac58u)
+		CI_UBIPART=UBI_DEV
+		ath10kcal_ubi_extract "Factory" 4096 12064
+		;;
+	avm,fritzbox-4040)
+		/usr/bin/fritz_cal_extract -i 1 -s 0x400 -e 0x207 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader_config")
+		;;
+	glinet,gl-b1300 |\
+	qcom,ap-dk01.1-c1)
+		ath10kcal_extract "ART" 4096 12064
+		;;
+	meraki,mr33)
+		ath10kcal_ubi_extract "ART" 4096 12064
+		ath10kcal_is_caldata_valid "202f" || ath10kcal_extract "ART" 4096 12064
+		ath10kcal_patch_mac_crc $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102) +2)
+		;;
+	compex,wpj428 |\
+	openmesh,a42)
+		ath10kcal_extract "0:ART" 4096 12064
+		;;
+	esac
+	;;
+"ath10k/pre-cal-ahb-a800000.wifi.bin")
+	case "$board" in
+	asus,rt-ac58u)
+		CI_UBIPART=UBI_DEV
+		ath10kcal_ubi_extract "Factory" 20480 12064
+		;;
+	avm,fritzbox-4040)
+		/usr/bin/fritz_cal_extract -i 1 -s 0x400 -e 0x208 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader_config")
+		;;
+	glinet,gl-b1300 |\
+	qcom,ap-dk01.1-c1)
+		ath10kcal_extract "ART" 20480 12064
+		;;
+	meraki,mr33)
+		ath10kcal_ubi_extract "ART" 20480 12064
+		ath10kcal_is_caldata_valid "202f" || ath10kcal_extract "ART" 20480 12064
+		ath10kcal_patch_mac_crc $(macaddr_add $(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102) +3)
+		;;
+	compex,wpj428 |\
+	openmesh,a42)
+		ath10kcal_extract "0:ART" 20480 12064
+		;;
+	esac
+	;;
+*)
+	exit 1
+	;;
+esac
diff --git a/target/linux/ipq40xx/base-files/etc/inittab b/target/linux/ipq40xx/base-files/etc/inittab
new file mode 100644
index 000000000..809bba5e5
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/etc/inittab
@@ -0,0 +1,4 @@
+# Copyright (c) 2013 The Linux Foundation. All rights reserved.
+::sysinit:/etc/init.d/rcS S boot
+::shutdown:/etc/init.d/rcS K shutdown
+ttyMSM0::askfirst:/usr/libexec/login.sh
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
new file mode 100644
index 000000000..1acd7366c
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+preinit_set_mac_address() {
+	case $(board_name) in
+	meraki,mr33)
+		mac_lan=$(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102)
+		[ -n "$mac_lan" ] && ip link set dev eth0 address "$mac_lan"
+		;;
+	esac
+}
+
+boot_hook_add preinit_main preinit_set_mac_address
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/openmesh.sh b/target/linux/ipq40xx/base-files/lib/upgrade/openmesh.sh
new file mode 100644
index 000000000..71ab247ea
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/openmesh.sh
@@ -0,0 +1,110 @@
+# The U-Boot loader of the OpenMesh devices requires image sizes and
+# checksums to be provided in the U-Boot environment.
+# The OpenMesh devices come with 2 main partitions - while one is active
+# sysupgrade will flash the other. The boot order is changed to boot the
+# newly flashed partition. If the new partition can't be booted due to
+# upgrade failures the previously used partition is loaded.
+
+platform_do_upgrade_openmesh() {
+	local tar_file="$1"
+	local restore_backup
+	local primary_kernel_mtd
+
+	local setenv_script="/tmp/fw_env_upgrade"
+
+	local kernel_mtd="$(find_mtd_index $PART_NAME)"
+	local kernel_offset="$(cat /sys/class/mtd/mtd${kernel_mtd}/offset)"
+	local total_size="$(cat /sys/class/mtd/mtd${kernel_mtd}/size)"
+
+	# detect to which flash region the new image is written to.
+	#
+	# 1. check what is the mtd index for the first flash region on this
+	#    device
+	# 2. check if the target partition ("inactive") has the mtd index of
+	#    the first flash region
+	#
+	#    - when it is: the new bootseq will be 1,2 and the first region is
+	#      modified
+	#    - when it isnt: bootseq will be 2,1 and the second region is
+	#      modified
+	#
+	# The detection has to be done via the hardcoded mtd partition because
+	# the current boot might be done with the fallback region. Let us
+	# assume that the current bootseq is 1,2. The bootloader detected that
+	# the image in flash region 1 is corrupt and thus switches to flash
+	# region 2. The bootseq in the u-boot-env is now still the same and
+	# the sysupgrade code can now only rely on the actual mtd indexes and
+	# not the bootseq variable to detect the currently booted flash
+	# region/image.
+	#
+	# In the above example, an implementation which uses bootseq ("1,2") to
+	# detect the currently booted image would assume that region 1 is booted
+	# and then overwrite the variables for the wrong flash region (aka the
+	# one which isn't modified). This could result in a device which doesn't
+	# boot anymore to Linux until it was reflashed with ap51-flash.
+	local next_boot_part="1"
+	case "$(board_name)" in
+	openmesh,a42)
+		primary_kernel_mtd=8
+		;;
+	*)
+		echo "failed to detect primary kernel mtd partition for board"
+		return 1
+		;;
+	esac
+	[ "$kernel_mtd" = "$primary_kernel_mtd" ] || next_boot_part="2"
+
+	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
+	board_dir=${board_dir%/}
+
+	local kernel_length=$(tar xf $tar_file ${board_dir}/kernel -O | wc -c)
+	local rootfs_length=$(tar xf $tar_file ${board_dir}/root -O | wc -c)
+	# rootfs without EOF marker
+	rootfs_length=$((rootfs_length-4))
+
+	local kernel_md5=$(tar xf $tar_file ${board_dir}/kernel -O | md5sum); kernel_md5="${kernel_md5%% *}"
+	# md5 checksum of rootfs with EOF marker
+	local rootfs_md5=$(tar xf $tar_file ${board_dir}/root -O | dd bs=1 count=$rootfs_length | md5sum); rootfs_md5="${rootfs_md5%% *}"
+
+	#
+	# add tar support to get_image() to use default_do_upgrade() instead?
+	#
+
+	# take care of restoring a saved config
+	[ "$SAVE_CONFIG" -eq 1 ] && restore_backup="${MTD_CONFIG_ARGS} -j ${CONF_TAR}"
+
+	# write concatinated kernel + rootfs to flash
+	tar xf $tar_file ${board_dir}/kernel ${board_dir}/root -O | \
+		mtd $restore_backup write - $PART_NAME
+
+	# prepare new u-boot env
+	if [ "$next_boot_part" = "1" ]; then
+		echo "bootseq 1,2" > $setenv_script
+	else
+		echo "bootseq 2,1" > $setenv_script
+	fi
+
+	printf "kernel_size_%i 0x%08x\n" $next_boot_part $kernel_length >> $setenv_script
+	printf "vmlinux_start_addr 0x%08x\n" ${kernel_offset} >> $setenv_script
+	printf "vmlinux_size 0x%08x\n" ${kernel_length} >> $setenv_script
+	printf "vmlinux_checksum %s\n" ${kernel_md5} >> $setenv_script
+
+	printf "rootfs_size_%i 0x%08x\n" $next_boot_part $((total_size-kernel_length)) >> $setenv_script
+	printf "rootfs_start_addr 0x%08x\n" $((kernel_offset+kernel_length)) >> $setenv_script
+	printf "rootfs_size 0x%08x\n" ${rootfs_length} >> $setenv_script
+	printf "rootfs_checksum %s\n" ${rootfs_md5} >> $setenv_script
+
+	# store u-boot env changes
+	fw_setenv -s $setenv_script || {
+		echo "failed to update U-Boot environment"
+		return 1
+	}
+}
+
+# create /var/lock for the lock "fw_setenv.lock" of fw_setenv
+# the rest is copied using ipq806x's RAMFS_COPY_BIN and RAMFS_COPY_DATA
+platform_add_ramfs_ubootenv()
+{
+	mkdir -p $RAM_ROOT/var/lock
+}
+append sysupgrade_pre_upgrade platform_add_ramfs_ubootenv
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
new file mode 100644
index 000000000..52aa2321e
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,69 @@
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+RAMFS_COPY_BIN='fw_printenv fw_setenv'
+RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
+
+platform_check_image() {
+	case "$(board_name)" in
+	asus,rt-ac58u)
+		CI_UBIPART="UBI_DEV"
+		local ubidev=$(nand_find_ubi $CI_UBIPART)
+		local asus_root=$(nand_find_volume $ubidev jffs2)
+
+		[ -n "$asus_root" ] || return 0
+
+		cat << EOF
+jffs2 partition is still present.
+There's probably no space left
+to install the filesystem.
+
+You need to delete the jffs2 partition first:
+# ubirmvol /dev/ubi0 --name=jffs2
+
+Once this is done. Retry.
+EOF
+		return 1
+		;;
+	esac
+	return 0;
+}
+
+platform_do_upgrade() {
+	case "$(board_name)" in
+	asus,rt-ac58u)
+		CI_UBIPART="UBI_DEV"
+		CI_KERNPART="linux"
+		nand_do_upgrade "$1"
+		;;
+	openmesh,a42)
+		PART_NAME="inactive"
+		platform_do_upgrade_openmesh "$ARGV"
+		;;
+	meraki,mr33)
+		CI_KERNPART="part.safe"
+		nand_do_upgrade "$1"
+		;;
+	*)
+		default_do_upgrade "$ARGV"
+		;;
+	esac
+}
+
+platform_nand_pre_upgrade() {
+	case "$(board_name)" in
+	asus,rt-ac58u)
+		CI_UBIPART="UBI_DEV"
+		CI_KERNPART="linux"
+		;;
+	meraki,mr33)
+		CI_KERNPART="part.safe"
+		;;
+	esac
+}
+
+blink_led() {
+	. /etc/diag.sh; set_state upgrade
+}
+
+append sysupgrade_pre_upgrade blink_led
diff --git a/target/linux/ipq40xx/config-4.14 b/target/linux/ipq40xx/config-4.14
new file mode 100644
index 000000000..1bba06176
--- /dev/null
+++ b/target/linux/ipq40xx/config-4.14
@@ -0,0 +1,489 @@
+CONFIG_ALIGNMENT_TRAP=y
+# CONFIG_APQ_GCC_8084 is not set
+# CONFIG_APQ_MMCC_8084 is not set
+CONFIG_AR40XX_PHY=y
+CONFIG_ARCH_CLOCKSOURCE_DATA=y
+CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y
+CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
+CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
+CONFIG_ARCH_HAS_SET_MEMORY=y
+CONFIG_ARCH_HAS_SG_CHAIN=y
+CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
+CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
+CONFIG_ARCH_HAS_TICK_BROADCAST=y
+CONFIG_ARCH_HAVE_CUSTOM_GPIO_H=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_IPQ40XX=y
+# CONFIG_ARCH_MDM9615 is not set
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+# CONFIG_ARCH_MSM8960 is not set
+# CONFIG_ARCH_MSM8974 is not set
+# CONFIG_ARCH_MSM8X60 is not set
+CONFIG_ARCH_MULTIPLATFORM=y
+# CONFIG_ARCH_MULTI_CPU_AUTO is not set
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_NR_GPIO=0
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_QCOM=y
+# CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
+# CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
+CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
+CONFIG_ARCH_SUPPORTS_BIG_ENDIAN=y
+CONFIG_ARCH_SUPPORTS_UPROBES=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_USE_BUILTIN_BSWAP=y
+CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
+# CONFIG_ARCH_WANTS_THP_SWAP is not set
+CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
+CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+# CONFIG_ARM_ATAG_DTB_COMPAT is not set
+CONFIG_ARM_CPUIDLE=y
+CONFIG_ARM_CPU_SUSPEND=y
+# CONFIG_ARM_CPU_TOPOLOGY is not set
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_SG_CHAIN=y
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+# CONFIG_ARM_LPAE is not set
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+CONFIG_ARM_QCOM_CPUIDLE=y
+# CONFIG_ARM_SMMU is not set
+# CONFIG_ARM_SP805_WATCHDOG is not set
+CONFIG_ARM_THUMB=y
+# CONFIG_ARM_THUMBEE is not set
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_AT803X_PHY=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BOUNCE=y
+CONFIG_BUS_TOPOLOGY_ADHOC=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CLKDEV_LOOKUP=y
+CONFIG_CLKSRC_QCOM=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_QCOM=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+# CONFIG_CPU_BPREDICT_DISABLE is not set
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+# CONFIG_CPU_ICACHE_DISABLE is not set
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_THERMAL=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+# CONFIG_CRC32_SARWATE is not set
+CONFIG_CRC32_SLICEBY8=y
+CONFIG_CRYPTO_ACOMP2=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTR=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_DEV_QCE=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_NULL2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_WORKQUEUE=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+# CONFIG_DEBUG_UART_8250 is not set
+# CONFIG_DEBUG_USER is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_ENGINE=y
+# CONFIG_DMA_NOOP_OPS is not set
+CONFIG_DMA_OF=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+# CONFIG_DMA_VIRT_OPS is not set
+# CONFIG_DRM_LIB_RANDOM is not set
+CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EEPROM_AT24=y
+CONFIG_ESSEDMA=y
+CONFIG_EXPORTFS=y
+CONFIG_EXTCON=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FUTEX_PI=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IO=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_WATCHDOG=y
+# CONFIG_GPIO_WATCHDOG_ARCH_INITCALL is not set
+# CONFIG_GRO_CELLS is not set
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+# CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set
+CONFIG_HAVE_ARCH_AUDITSYSCALL=y
+CONFIG_HAVE_ARCH_BITREVERSE=y
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_PFN_VALID=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_ARM_ARCH_TIMER=y
+CONFIG_HAVE_ARM_SMCCC=y
+# CONFIG_HAVE_BOOTMEM_INFO_NODE is not set
+CONFIG_HAVE_CC_STACKPROTECTOR=y
+CONFIG_HAVE_CLK=y
+CONFIG_HAVE_CLK_PREPARE=y
+CONFIG_HAVE_CONTEXT_TRACKING=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_HAVE_DEBUG_KMEMLEAK=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_DMA_CONTIGUOUS=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y
+CONFIG_HAVE_EBPF_JIT=y
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
+CONFIG_HAVE_MEMBLOCK=y
+CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
+CONFIG_HAVE_NET_DSA=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_OPTPROBES=y
+CONFIG_HAVE_PERF_EVENTS=y
+CONFIG_HAVE_PERF_REGS=y
+CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+CONFIG_HAVE_PROC_CPU=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_SMP=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_UID16=y
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
+CONFIG_HIGHMEM=y
+# CONFIG_HIGHPTE is not set
+CONFIG_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_MSM=y
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_QUP=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IOMMU_HELPER=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+# CONFIG_IOMMU_IO_PGTABLE_LPAE is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IPQ_GCC_4019=y
+# CONFIG_IPQ_GCC_806X is not set
+# CONFIG_IPQ_GCC_8074 is not set
+# CONFIG_IPQ_LCC_806X is not set
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_LEDS_LP5562=y
+CONFIG_LEDS_LP55XX_COMMON=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_GPIO=y
+CONFIG_MDIO_IPQ40XX=y
+# CONFIG_MDM_GCC_9615 is not set
+# CONFIG_MDM_LCC_9615 is not set
+# CONFIG_MFD_QCOM_RPM is not set
+# CONFIG_MFD_SPMI_PMIC is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGHT_HAVE_PCI=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MSM_BUS_SCALING=y
+# CONFIG_MSM_GCC_8660 is not set
+# CONFIG_MSM_GCC_8916 is not set
+# CONFIG_MSM_GCC_8960 is not set
+# CONFIG_MSM_GCC_8974 is not set
+# CONFIG_MSM_GCC_8994 is not set
+# CONFIG_MSM_GCC_8996 is not set
+# CONFIG_MSM_LCC_8960 is not set
+# CONFIG_MSM_MMCC_8960 is not set
+# CONFIG_MSM_MMCC_8974 is not set
+# CONFIG_MSM_MMCC_8996 is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_M25P80=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_NAND_QCOM=y
+CONFIG_MTD_SPINAND_MT29F=y
+CONFIG_MTD_SPINAND_ONDIEECC=y
+CONFIG_MTD_SPI_NOR=y
+CONFIG_MTD_SPLIT_FIRMWARE=y
+CONFIG_MTD_SPLIT_FIT_FW=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_LIMIT=20
+CONFIG_MTD_UBI_BLOCK=y
+# CONFIG_MTD_UBI_FASTMAP is not set
+# CONFIG_MTD_UBI_GLUEBI is not set
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MULTI_IRQ_HANDLER=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEON=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_QCA8K=y
+CONFIG_NET_DSA_TAG_QCA=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NO_BOOTMEM=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=4
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_ADDRESS_PCI=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_NET=y
+CONFIG_OF_PCI=y
+CONFIG_OF_PCI_IRQ=y
+CONFIG_OF_RESERVED_MEM=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OPTEE=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PCI=y
+CONFIG_PCIEAER=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+CONFIG_PCIE_QCOM=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+# CONFIG_PHY_QCOM_APQ8064_SATA is not set
+# CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+# CONFIG_PHY_QCOM_QMP is not set
+# CONFIG_PHY_QCOM_QUSB2 is not set
+# CONFIG_PHY_QCOM_UFS is not set
+CONFIG_PINCTRL=y
+# CONFIG_PINCTRL_APQ8064 is not set
+# CONFIG_PINCTRL_APQ8084 is not set
+CONFIG_PINCTRL_IPQ4019=y
+# CONFIG_PINCTRL_IPQ8064 is not set
+# CONFIG_PINCTRL_IPQ8074 is not set
+# CONFIG_PINCTRL_MDM9615 is not set
+CONFIG_PINCTRL_MSM=y
+# CONFIG_PINCTRL_MSM8660 is not set
+# CONFIG_PINCTRL_MSM8916 is not set
+# CONFIG_PINCTRL_MSM8960 is not set
+# CONFIG_PINCTRL_MSM8994 is not set
+# CONFIG_PINCTRL_MSM8996 is not set
+# CONFIG_PINCTRL_QCOM_SPMI_PMIC is not set
+# CONFIG_PINCTRL_QCOM_SSBI_PMIC is not set
+CONFIG_PM_OPP=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_MSM=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_QCOM_BAM_DMA=y
+# CONFIG_QCOM_EBI2 is not set
+# CONFIG_QCOM_GSBI is not set
+# CONFIG_QCOM_IOMMU is not set
+CONFIG_QCOM_PM=y
+CONFIG_QCOM_QFPROM=y
+CONFIG_QCOM_SCM=y
+CONFIG_QCOM_SCM_32=y
+CONFIG_QCOM_SMEM=y
+# CONFIG_QCOM_SMP2P is not set
+# CONFIG_QCOM_SMSM is not set
+CONFIG_QCOM_TCSR=y
+# CONFIG_QCOM_TSENS is not set
+CONFIG_QCOM_WDT=y
+# CONFIG_QRTR is not set
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+CONFIG_RCU_CPU_STALL_TIMEOUT=21
+CONFIG_RCU_NEED_SEGCBLIST=y
+CONFIG_RCU_STALL_COMMON=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGMAP_SPI=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+# CONFIG_REGULATOR_QCOM_SPMI is not set
+CONFIG_REGULATOR_VCTRL=y
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RFS_ACCEL=y
+# CONFIG_RPMSG_QCOM_SMD is not set
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_CMOS is not set
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+# CONFIG_SCHED_INFO is not set
+# CONFIG_SCSI_DMA is not set
+CONFIG_SERIAL_8250_FSL=y
+# CONFIG_SERIAL_AMBA_PL011 is not set
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_QUP=y
+CONFIG_SPMI=y
+CONFIG_SPMI_MSM_PMIC_ARB=y
+CONFIG_SRCU=y
+CONFIG_SWCONFIG=y
+CONFIG_SWCONFIG_LEDS=y
+CONFIG_SWIOTLB=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TEE=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_GOV_STEP_WISE=y
+CONFIG_THERMAL_OF=y
+CONFIG_THIN_ARCHIVES=y
+# CONFIG_THUMB2_KERNEL is not set
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_UBIFS_FS=y
+CONFIG_UBIFS_FS_ADVANCED_COMPR=y
+CONFIG_UBIFS_FS_LZO=y
+CONFIG_UBIFS_FS_ZLIB=y
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+# CONFIG_USB_EHCI_HCD is not set
+CONFIG_USB_IPQ4019_PHY=y
+CONFIG_USB_PHY=y
+# CONFIG_USB_QCOM_8X16_PHY is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_OF=y
+CONFIG_VDSO=y
+CONFIG_VECTORS_BASE=0xffff0000
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-a42.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-a42.dts
new file mode 100644
index 000000000..d365a7e53
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-a42.dts
@@ -0,0 +1,237 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017, Sven Eckelmann <sven.eckelmann@openmesh.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "OpenMesh A42";
+	compatible = "openmesh,a42", "qcom,ipq4019";
+
+	reserved-memory {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		ranges;
+
+		tz_apps@87b80000 {
+			reg = <0x87b80000 0x280000>;
+			no-map;
+		};
+
+		smem@87e00000 {
+			reg = <0x87e00000 0x080000>;
+			no-map;
+		};
+
+		tz@87e80000 {
+			reg = <0x87e80000 0x180000>;
+			no-map;
+		};
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2: usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 59 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		red {
+			label = "a42:red:status";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "default-off";
+		};
+
+		power: green {
+			label = "a42:green:status";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		blue {
+			label = "a42:blue:status";
+			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "default-off";
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&tlmm 5 GPIO_ACTIVE_LOW>;
+		hw_algo = "toggle";
+		/* hw_margin_ms is actually 300s but driver limits it to 60s */
+		hw_margin_ms = <60000>;
+		always-running;
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pin {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pin_cs {
+			function = "gpio";
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&spi_0 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	m25p80@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+		/* partitions are passed via bootloader */
+	};
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&gmac0 {
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <1>;
+	qcom,forced_speed = <1000>;
+	qcom,forced_duplex = <1>;
+	vlan_tag = <2 0x20>;
+};
+
+&gmac1 {
+	qcom,phy_mdio_addr = <3>;
+	qcom,poll_required = <1>;
+	qcom,forced_speed = <1000>;
+	qcom,forced_duplex = <1>;
+	vlan_tag = <1 0x10>;
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "OM-A42";
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "OM-A42";
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-fritz4040.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-fritz4040.dts
new file mode 100644
index 000000000..4b5cbcac3
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-fritz4040.dts
@@ -0,0 +1,322 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "AVM FRITZ!Box 4040";
+	compatible = "avm,fritzbox-4040", "qcom,ipq4019";
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &flash;
+		led-running = &power;
+		led-upgrade = &flash;
+	};
+
+	reserved-memory {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		ranges;
+
+		tz_apps@87b80000 {
+			reg = <0x87b80000 0x280000>;
+			reusable;
+		};
+
+		smem@87e00000 {
+			reg = <0x87e00000 0x080000>;
+			no-map;
+		};
+
+		tz@87e80000 {
+			reg = <0x87e80000 0x180000>;
+			no-map;
+		};
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		wifi@a000000 {
+			status = "okay";
+		};
+
+		wifi@a800000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		qca8075: ess-switch@c000000 {
+			status = "okay";
+
+			#gpio-cells = <2>;
+			gpio-controller;
+
+			enable-usb-power {
+				gpio-hog;
+				line-name = "enable USB3 power";
+				gpios = <7 GPIO_ACTIVE_HIGH>;
+				output-high;
+			};
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		wlan {
+			label = "wlan";
+			gpios = <&tlmm 58 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		wlan {
+			label = "fritz4040:green:wlan";
+			gpios = <&qca8075 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		panic: info_red {
+			label = "fritz4040:red:info";
+			gpios = <&qca8075 3 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		wan {
+			label = "fritz4040:green:wan";
+			gpios = <&qca8075 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		power: power {
+			label = "fritz4040:green:power";
+			gpios = <&qca8075 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan {
+			label = "fritz4040:green:lan";
+			gpios = <&qca8075 13 GPIO_ACTIVE_HIGH>;
+		};
+
+		flash: info_amber {
+			label = "fritz4040:amber:info";
+			gpios = <&qca8075 15 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		mux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		mux_cs {
+			function = "gpio";
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&spi_0 { /* BLSP1 QUP1 */
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	mx25l25635f@0 {
+		compatible = "jedec,spi-nor";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+		status = "okay";
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+			partition1@40000 {
+				label = "MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+			partition2@60000 {
+				label = "QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+			partition3@c0000 {
+				label = "CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+			partition4@d0000 {
+				label = "DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+			partition5@e0000 {
+				label = "APPSBLENV"; /* uboot env - empty */
+				reg = <0x000e0000 0x00010000>;
+				read-only;
+			};
+			partition6@f0000 {
+				label = "urlader"; /* APPSBL */
+				reg = <0x000f0000 0x0002dc000>;
+				read-only;
+			};
+			partition7@11dc00 {
+				/* make a backup of this partition! */
+				label = "urlader_config";
+				reg = <0x0011dc00 0x00002400>;
+				read-only;
+			};
+			partition8@120000 {
+				label = "tffs1";
+				reg = <0x00120000 0x00080000>;
+				read-only;
+			};
+			partition9@1a0000 {
+				label = "tffs2";
+				reg = <0x001a0000 0x00080000>;
+				read-only;
+			};
+			partition10@220000 {
+				label = "uboot";
+				reg = <0x00220000 0x00080000>;
+				read-only;
+			};
+			partition11@2A0000 {
+				label = "firmware";
+				reg = <0x002a0000 0x01c60000>;
+			};
+			partition12@1f00000 {
+				label = "jffs2";
+				reg = <0x01f00000 0x00100000>;
+			};
+		};
+	};
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts
new file mode 100644
index 000000000..446da0451
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-rt-ac58u.dts
@@ -0,0 +1,314 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "ASUS RT-AC58U";
+	compatible = "asus,rt-ac58u", "qcom,ipq4019";
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x8000000>;
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	reserved-memory {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		ranges;
+
+		smem@87e00000 {
+			reg = <0x87e00000 0x080000>;
+			no-map;
+		};
+
+		tz@87e80000 {
+			reg = <0x87e80000 0x180000>;
+			no-map;
+		};
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		wifi@a000000 {
+			status = "okay";
+			qcom,ath10k-calibration-variant = "ASUS-RT-AC58U";
+		};
+
+		wifi@a800000 {
+			status = "okay";
+			qcom,ath10k-calibration-variant = "ASUS-RT-AC58U";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		power: status {
+			label = "rt-ac58u:blue:status";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "rt-ac58u:blue:wan";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2G {
+			label = "rt-ac58u:blue:wlan2G";
+			gpios = <&tlmm 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan5G {
+			label = "rt-ac58u:blue:wlan5G";
+			gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "rt-ac58u:blue:usb";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan {
+			label = "rt-ac58u:blue:lan";
+			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		mux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		mux_cs {
+			function = "gpio";
+			pins = "gpio54", "gpio59";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&spi_0 { /* BLSP1 QUP1 */
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>,
+		   <&tlmm 59 GPIO_ACTIVE_HIGH>;
+
+	m25p80@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		/*
+		 * U-boot looks for "n25q128a11" node,
+		 * if we don't have it, it will spit out the following warning:
+		 * "ipq: fdt fixup unable to find compatible node".
+		 */
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		linux,modalias = "m25p80", "mx25l1606e", "n25q128a11";
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+			partition1@40000 {
+				label = "MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+			partition2@60000 {
+				label = "QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+			partition3@c0000 {
+				label = "CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+			partition4@d0000 {
+				label = "DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+			partition5@e0000 {
+				label = "APPSBLENV"; /* uboot env*/
+				reg = <0x000e0000 0x00010000>;
+				read-only;
+			};
+			partition5@f0000 {
+				label = "APPSBL"; /* uboot */
+				reg = <0x000f0000 0x00080000>;
+				read-only;
+			};
+			partition5@170000 {
+				label = "ART";
+				reg = <0x00170000 0x00010000>;
+				read-only;
+			};
+			/* 0x00180000 - 0x00200000 unused */
+		};
+	};
+
+	mt29f@1 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "spinand,mt29f";
+		reg = <1>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "ubi";
+				reg = <0x00000000 0x08000000>;
+			};
+		};
+	};
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
new file mode 100644
index 000000000..47202d28f
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
@@ -0,0 +1,21 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019-ap.dk04.1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. IPQ40xx/AP-DK04.1-C1";
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
new file mode 100644
index 000000000..eeadc075d
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
@@ -0,0 +1,177 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. IPQ4019/AP-DK04.1";
+	compatible = "qcom,ipq4019";
+
+	soc {
+		pinctrl@1000000 {
+			serial_0_pins: serial_pinmux {
+				mux {
+					pins = "gpio16", "gpio17";
+					function = "blsp_uart0";
+					bias-disable;
+				};
+			};
+
+			serial_1_pins: serial1_pinmux {
+				mux {
+					pins = "gpio8", "gpio9";
+					function = "blsp_uart1";
+					bias-disable;
+				};
+			};
+
+			spi_0_pins: spi_0_pinmux {
+				pinmux {
+					function = "blsp_spi0";
+					pins = "gpio13", "gpio14", "gpio15";
+				};
+				pinmux_cs {
+					function = "gpio";
+					pins = "gpio12";
+				};
+				pinconf {
+					pins = "gpio13", "gpio14", "gpio15";
+					drive-strength = <12>;
+					bias-disable;
+				};
+				pinconf_cs {
+					pins = "gpio12";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+
+			i2c_0_pins: i2c_0_pinmux {
+				pinmux {
+					function = "blsp_i2c0";
+					pins = "gpio10", "gpio11";
+				};
+				pinconf {
+					pins = "gpio10", "gpio11";
+					drive-strength = <16>;
+					bias-disable;
+				};
+			};
+
+			nand_pins: nand_pins {
+
+				pullups {
+					pins = "gpio52", "gpio53", "gpio58",
+						"gpio59";
+					function = "qpic";
+					bias-pull-up;
+				};
+
+				pulldowns {
+					pins = "gpio54", "gpio55", "gpio56",
+						"gpio57", "gpio60", "gpio61",
+						"gpio62", "gpio63", "gpio64",
+						"gpio65", "gpio66", "gpio67",
+						"gpio68", "gpio69";
+					function = "qpic";
+					bias-pull-down;
+				};
+			};
+		};
+
+		blsp_dma: dma@7884000 {
+			status = "okay";
+		};
+
+		spi_0: spi@78b5000 {
+			pinctrl-0 = <&spi_0_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+			cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+
+			mx25l25635e@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				reg = <0>;
+				compatible = "mx25l25635e";
+				spi-max-frequency = <24000000>;
+			};
+		};
+
+		i2c_0: i2c@78b7000 { /* BLSP1 QUP2 */
+			pinctrl-0 = <&i2c_0_pins>;
+			pinctrl-names = "default";
+
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_0_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		serial@78b0000 {
+			pinctrl-0 = <&serial_1_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3_ss_phy: ssphy@9a000 {
+			status = "okay";
+		};
+
+		usb3_hs_phy: hsphy@a6000 {
+			status = "okay";
+		};
+
+		usb3: usb3@8af8800 {
+			status = "okay";
+		};
+
+		usb2_hs_phy: hsphy@a8000 {
+			status = "okay";
+		};
+
+		usb2: usb2@60f8800 {
+			status = "okay";
+		};
+
+		cryptobam: dma@8e04000 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		qpic_bam: dma@7984000 {
+			status = "okay";
+		};
+
+		nand: qpic-nand@79b0000 {
+			pinctrl-0 = <&nand_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+	};
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-bus.dtsi b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-bus.dtsi
new file mode 100644
index 000000000..169505973
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4019-bus.dtsi
@@ -0,0 +1,1142 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include <dt-bindings/msm/msm-bus-ids.h>
+
+/ {
+
+soc {
+	ad_hoc_bus: ad-hoc-bus {
+		compatible = "qcom,msm-bus-device";
+		reg = <0x580000 0x14000>,
+			<0x500000 0x11000>;
+		reg-names = "snoc-base", "pcnoc-base";
+
+		/*Buses*/
+
+		fab_pcnoc: fab-pcnoc {
+			cell-id = <MSM_BUS_FAB_PERIPH_NOC>;
+			label = "fab-pcnoc";
+			qcom,fab-dev;
+			qcom,base-name = "pcnoc-base";
+			qcom,bypass-qos-prg;
+			qcom,bus-type = <1>;
+			qcom,qos-off = <0x1000>;
+			qcom,base-offset = <0x0>;
+			clocks = <>;
+		};
+
+		fab_snoc: fab-snoc {
+			cell-id = <MSM_BUS_FAB_SYS_NOC>;
+			label = "fab-snoc";
+			qcom,fab-dev;
+			qcom,base-name = "snoc-base";
+			qcom,bypass-qos-prg;
+			qcom,bus-type = <1>;
+			qcom,qos-off = <0x80>;
+			qcom,base-offset = <0x0>;
+			clocks = <>;
+		};
+
+		/*Masters*/
+
+		mas_blsp_bam: mas-blsp-bam {
+			cell-id = <MSM_BUS_MASTER_BLSP_BAM>;
+			label = "mas-blsp-bam";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_0>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_BAM>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_usb2_bam: mas-usb2-bam {
+			cell-id = <MSM_BUS_MASTER_USB2_BAM>;
+			label = "mas-usb2-bam";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <15>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_pcnoc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB2_BAM>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_adss_dma0: mas-adss-dma0 {
+			cell-id = <MSM_BUS_MASTER_ADDS_DMA0>;
+			label = "mas-adss-dma0";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ADSS_DMA0>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_adss_dma1: mas-adss-dma1 {
+			cell-id = <MSM_BUS_MASTER_ADDS_DMA1>;
+			label = "mas-adss-dma1";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ADSS_DMA1>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_adss_dma2: mas-adss-dma2 {
+			cell-id = <MSM_BUS_MASTER_ADDS_DMA2>;
+			label = "mas-adss-dma2";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ADSS_DMA2>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_adss_dma3: mas-adss-dma3 {
+			cell-id = <MSM_BUS_MASTER_ADDS_DMA3>;
+			label = "mas-adss-dma3";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ADSS_DMA3>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_qpic_bam: mas-qpic-bam {
+			cell-id = <MSM_BUS_MASTER_QPIC_BAM>;
+			label = "mas-qpic-bam";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_0>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QPIC_BAM>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_spdm: mas-spdm {
+			cell-id = <MSM_BUS_MASTER_SPDM>;
+			label = "mas-spdm";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_m_0>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SPDM>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_pcnoc_cfg: mas-pcnoc-cfg {
+			cell-id = <MSM_BUS_MASTER_PNOC_CFG>;
+			label = "mas-pcnoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_srvc_pcnoc>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_CFG>;
+		};
+
+		mas_tic: mas-tic {
+			cell-id = <MSM_BUS_MASTER_TIC>;
+			label = "mas-tic";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_int_0 &slv_pcnoc_snoc>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_TIC>;
+		};
+
+		mas_sdcc_bam: mas-sdcc-bam {
+			cell-id = <MSM_BUS_MASTER_SDCC_BAM>;
+			label = "mas-sdcc-bam";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <14>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_pcnoc_snoc>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_BAM>;
+			qcom,blacklist = <&slv_tcsr &slv_mdio &slv_adss_cfg
+				 &slv_fephy_cfg &slv_wss1_apu_cfg &slv_ddrc_mpu1_cfg
+				 &slv_ddrc_mpu0_cfg &slv_qpic_cfg &slv_ddrc_cfg
+				 &slv_pcnoc_cfg &slv_ess_apu_cfg &slv_imem_cfg
+				 &slv_srif &slv_prng &slv_qdss_cfg
+				 &slv_wss0_apu_cfg &slv_ddrc_apu_cfg &slv_gcnt
+				 &slv_tlmm &slv_wss0_vmidmt_cfg &slv_prng_apu_cfg
+				 &slv_boot_rom &slv_security &slv_spdm
+				 &slv_pcnoc_mpu_cfg &slv_ddrc_mpu2_cfg &slv_ess_vmidmt_cfg
+				 &slv_qhss_apu_cfg &slv_adss_vmidmt_cfg &slv_clk_ctl
+				 &slv_adss_apu &slv_blsp_cfg &slv_usb2_cfg
+				 &slv_srvc_pcnoc &slv_snoc_mpu_cfg &slv_wss1_vmidmt_cfg
+				 &slv_sdcc_cfg &slv_snoc_cfg>;
+		};
+
+		mas_snoc_pcnoc: mas-snoc-pcnoc {
+			cell-id = <MSM_BUS_SNOC_PNOC_MAS>;
+			label = "mas-snoc-pcnoc";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <16>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&pcnoc_int_0>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_PCNOC>;
+		};
+
+		mas_qdss_dap: mas-qdss-dap {
+			cell-id = <MSM_BUS_MASTER_QDSS_DAP>;
+			label = "mas-qdss-dap";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&pcnoc_int_0 &slv_pcnoc_snoc>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_DAP>;
+		};
+
+		mas_ddrc_snoc: mas-ddrc-snoc {
+			cell-id = <MSM_BUS_MASTER_DDRC_SNOC>;
+			label = "mas-ddrc-snoc";
+			qcom,buswidth = <16>;
+			qcom,ap-owned;
+			qcom,connections = <&snoc_int_0 &snoc_int_1
+				 &slv_pcie>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_DDRC_SNOC>;
+			qcom,blacklist = <&slv_snoc_ddrc_m1 &slv_srvc_snoc>;
+		};
+
+		mas_wss_0: mas-wss-0 {
+			cell-id = <MSM_BUS_MASTER_WSS_0>;
+			label = "mas-wss-0";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <26>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_WSS_0>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_pcie
+				 &slv_wss1_cfg &slv_wss0_cfg &slv_crypto_cfg
+				 &slv_srvc_snoc>;
+		};
+
+		mas_wss_1: mas-wss-1 {
+			cell-id = <MSM_BUS_MASTER_WSS_1>;
+			label = "mas-wss-1";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <27>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_WSS_1>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_pcie
+				 &slv_wss1_cfg &slv_wss0_cfg &slv_crypto_cfg
+				 &slv_srvc_snoc>;
+		};
+
+		mas_crypto: mas-crypto {
+			cell-id = <MSM_BUS_MASTER_CRYPTO>;
+			label = "mas-crypto";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <5>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &snoc_int_1
+				 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CRYPTO>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_a7ss
+				 &slv_pcie &slv_qdss_stm &slv_crypto_cfg
+				 &slv_srvc_snoc>;
+		};
+
+		mas_ess: mas-ess {
+			cell-id = <MSM_BUS_MASTER_ESS>;
+			label = "mas-ess";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <44>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ESS>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_a7ss
+				 &slv_pcie &slv_qdss_stm &slv_wss1_cfg
+				 &slv_wss0_cfg &slv_crypto_cfg &slv_srvc_snoc>;
+		};
+
+		mas_pcie: mas-pcie {
+			cell-id = <MSM_BUS_MASTER_PCIE>;
+			label = "mas-pcie";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <6>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCIE>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_pcie
+				 &slv_qdss_stm &slv_wss1_cfg &slv_wss0_cfg
+				 &slv_crypto_cfg &slv_srvc_snoc>;
+		};
+
+		mas_usb3: mas-usb3 {
+			cell-id = <MSM_BUS_MASTER_USB3>;
+			label = "mas-usb3";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <7>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB3>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_a7ss
+				 &slv_pcie &slv_qdss_stm &slv_wss1_cfg
+				 &slv_wss0_cfg &slv_crypto_cfg &slv_srvc_snoc>;
+		};
+
+		mas_qdss_etr: mas-qdss-etr {
+			cell-id = <MSM_BUS_MASTER_QDSS_ETR>;
+			label = "mas-qdss-etr";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,qport = <544>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&qdss_int>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_ETR>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_a7ss
+				 &slv_pcie &slv_qdss_stm &slv_wss1_cfg
+				 &slv_wss0_cfg &slv_crypto_cfg &slv_srvc_snoc>;
+		};
+
+		mas_qdss_bamndp: mas-qdss-bamndp {
+			cell-id = <MSM_BUS_MASTER_QDSS_BAMNDP>;
+			label = "mas-qdss-bamndp";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <576>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&qdss_int>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_BAMNDP>;
+			qcom,blacklist = <&slv_usb3_cfg &slv_ess_cfg &slv_a7ss
+				 &slv_pcie &slv_qdss_stm &slv_wss1_cfg
+				 &slv_wss0_cfg &slv_crypto_cfg &slv_srvc_snoc>;
+		};
+
+		mas_pcnoc_snoc: mas-pcnoc-snoc {
+			cell-id = <MSM_BUS_PNOC_SNOC_MAS>;
+			label = "mas-pcnoc-snoc";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <384>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&snoc_int_0 &snoc_int_1
+				 &slv_snoc_ddrc_m1>;
+			qcom,prio1 = <0>;
+			qcom,prio0 = <0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PNOC_SNOC>;
+			qcom,blacklist = <&slv_srvc_snoc>;
+		};
+
+		mas_snoc_cfg: mas-snoc-cfg {
+			cell-id = <MSM_BUS_MASTER_QDSS_SNOC_CFG>;
+			label = "mas-snoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_srvc_snoc>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_SNOC_CFG>;
+		};
+
+		/*Internal nodes*/
+
+
+		pcnoc_m_0: pcnoc-m-0 {
+			cell-id = <MSM_BUS_PNOC_M_0>;
+			label = "pcnoc-m-0";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <12>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_pcnoc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_M_0>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_M_0>;
+		};
+
+		pcnoc_m_1: pcnoc-m-1 {
+			cell-id = <MSM_BUS_PNOC_M_1>;
+			label = "pcnoc-m-1";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,qport = <13>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_pcnoc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_M_1>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_M_1>;
+		};
+
+		pcnoc_int_0: pcnoc-int-0 {
+			cell-id = <MSM_BUS_PNOC_INT_0>;
+			label = "pcnoc-int-0";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,connections = < &pcnoc_s_1 &pcnoc_s_2 &pcnoc_s_0
+				 &pcnoc_s_4 &pcnoc_s_5
+				 &pcnoc_s_6 &pcnoc_s_7
+				 &pcnoc_s_8 &pcnoc_s_9
+				 &pcnoc_s_3>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_INT_0>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_INT_0>;
+		};
+
+		pcnoc_s_0: pcnoc-s-0 {
+			cell-id = <MSM_BUS_PNOC_SLV_0>;
+			label = "pcnoc-s-0";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_clk_ctl &slv_tcsr &slv_security
+				 &slv_tlmm>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_0>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_0>;
+		};
+
+		pcnoc_s_1: pcnoc-s-1 {
+			cell-id = <MSM_BUS_PNOC_SLV_1>;
+			label = "pcnoc-s-1";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_prng_apu_cfg &slv_prng&slv_imem_cfg>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_1>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_1>;
+		};
+
+		pcnoc_s_2: pcnoc-s-2 {
+			cell-id = <MSM_BUS_PNOC_SLV_2>;
+			label = "pcnoc-s-2";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_spdm &slv_pcnoc_mpu_cfg &slv_pcnoc_cfg
+				&slv_boot_rom>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_2>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_2>;
+		};
+
+		pcnoc_s_3: pcnoc-s-3 {
+			cell-id = <MSM_BUS_PNOC_SLV_3>;
+			label = "pcnoc-s-3";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_qdss_cfg&slv_gcnt &slv_snoc_cfg
+				 &slv_snoc_mpu_cfg>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_3>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_3>;
+		};
+
+		pcnoc_s_4: pcnoc-s-4 {
+			cell-id = <MSM_BUS_PNOC_SLV_4>;
+			label = "pcnoc-s-4";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_adss_cfg &slv_adss_vmidmt_cfg &slv_adss_apu>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_4>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_4>;
+		};
+
+		pcnoc_s_5: pcnoc-s-5 {
+			cell-id = <MSM_BUS_PNOC_SLV_5>;
+			label = "pcnoc-s-5";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_qhss_apu_cfg &slv_fephy_cfg &slv_mdio
+				 &slv_srif>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_5>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_5>;
+		};
+
+		pcnoc_s_6: pcnoc-s-6 {
+			cell-id = <MSM_BUS_PNOC_SLV_6>;
+			label = "pcnoc-s-6";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_ddrc_mpu0_cfg &slv_ddrc_apu_cfg &slv_ddrc_mpu2_cfg
+				&slv_ddrc_cfg &slv_ddrc_mpu1_cfg>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_6>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_6>;
+		};
+
+		pcnoc_s_7: pcnoc-s-7 {
+			cell-id = <MSM_BUS_PNOC_SLV_7>;
+			label = "pcnoc-s-7";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_ess_apu_cfg &slv_usb2_cfg&slv_ess_vmidmt_cfg>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_7>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_7>;
+		};
+
+		pcnoc_s_8: pcnoc-s-8 {
+			cell-id = <MSM_BUS_PNOC_SLV_8>;
+			label = "pcnoc-s-8";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_sdcc_cfg &slv_qpic_cfg&slv_blsp_cfg>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_8>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_8>;
+		};
+
+		pcnoc_s_9: pcnoc-s-9 {
+			cell-id = <MSM_BUS_PNOC_SLV_9>;
+			label = "pcnoc-s-9";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_wss1_apu_cfg &slv_wss1_vmidmt_cfg&slv_wss0_vmidmt_cfg
+				 &slv_wss0_apu_cfg>;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCNOC_S_9>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_S_9>;
+		};
+
+		snoc_int_0: snoc-int-0 {
+			cell-id = <MSM_BUS_SNOC_INT_0>;
+			label = "snoc-int-0";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_ocimem&slv_qdss_stm>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_INT_0>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_INT_0>;
+		};
+
+		snoc_int_1: snoc-int-1 {
+			cell-id = <MSM_BUS_SNOC_INT_1>;
+			label = "snoc-int-1";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_crypto_cfg &slv_a7ss &slv_ess_cfg
+				 &slv_usb3_cfg &slv_wss1_cfg
+				&slv_wss0_cfg>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_INT_1>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_INT_1>;
+		};
+
+		qdss_int: qdss-int {
+			cell-id = <MSM_BUS_SNOC_QDSS_INT>;
+			label = "qdss-int";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,connections = <&snoc_int_0 &slv_snoc_ddrc_m1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_INT>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_INT>;
+		};
+		/*Slaves*/
+
+		slv_clk_ctl:slv-clk-ctl {
+			cell-id = <MSM_BUS_SLAVE_CLK_CTL>;
+			label = "slv-clk-ctl";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CLK_CTL>;
+		};
+
+		slv_security:slv-security {
+			cell-id = <MSM_BUS_SLAVE_SECURITY>;
+			label = "slv-security";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SECURITY>;
+		};
+
+		slv_tcsr:slv-tcsr {
+			cell-id = <MSM_BUS_SLAVE_TCSR>;
+			label = "slv-tcsr";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TCSR>;
+		};
+
+		slv_tlmm:slv-tlmm {
+			cell-id = <MSM_BUS_SLAVE_TLMM>;
+			label = "slv-tlmm";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM>;
+		};
+
+		slv_imem_cfg:slv-imem-cfg {
+			cell-id = <MSM_BUS_SLAVE_IMEM_CFG>;
+			label = "slv-imem-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM_CFG>;
+		};
+
+		slv_prng:slv-prng {
+			cell-id = <MSM_BUS_SLAVE_PRNG>;
+			label = "slv-prng";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PRNG>;
+		};
+
+		slv_prng_apu_cfg:slv-prng-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_PRNG_APU_CFG>;
+			label = "slv-prng-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PRNG_APU_CFG>;
+		};
+
+		slv_boot_rom:slv-boot-rom {
+			cell-id = <MSM_BUS_SLAVE_BOOT_ROM>;
+			label = "slv-boot-rom";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BOOT_ROM>;
+		};
+
+		slv_spdm:slv-spdm {
+			cell-id = <MSM_BUS_SLAVE_SPDM_WRAPPER>;
+			label = "slv-spdm";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SPDM_WRAPPER>;
+		};
+
+		slv_pcnoc_cfg:slv-pcnoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_PNOC_CFG>;
+			label = "slv-pcnoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PNOC_CFG>;
+		};
+
+		slv_pcnoc_mpu_cfg:slv-pcnoc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_PERIPH_MPU_CFG>;
+			label = "slv-pcnoc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PERIPH_MPU_CFG>;
+		};
+
+		slv_gcnt:slv-gcnt {
+			cell-id = <MSM_BUS_SLAVE_GCNT>;
+			label = "slv-gcnt";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GCNT>;
+		};
+
+		slv_qdss_cfg:slv-qdss-cfg {
+			cell-id = <MSM_BUS_SLAVE_QDSS_CFG>;
+			label = "slv-qdss-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_CFG>;
+		};
+
+		slv_snoc_cfg:slv-snoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SNOC_CFG>;
+			label = "slv-snoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CFG>;
+		};
+
+		slv_snoc_mpu_cfg:slv-snoc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_SNOC_MPU_CFG>;
+			label = "slv-snoc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_MPU_CFG>;
+		};
+
+		slv_adss_cfg:slv-adss-cfg {
+			cell-id = <MSM_BUS_SLAVE_ADSS_CFG>;
+			label = "slv-adss-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_ADSS_CFG>;
+		};
+
+		slv_adss_apu:slv-adss-apu {
+			cell-id = <MSM_BUS_SLAVE_ADSS_VMIDMT_CFG>;
+			label = "slv-adss-apu";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_ADSS_APU>;
+		};
+
+		slv_adss_vmidmt_cfg:slv-adss-vmidmt-cfg {
+			cell-id = <MSM_BUS_SLAVE_ADSS_VMIDMT_CFG>;
+			label = "slv-adss-vmidmt-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_ADSS_VMIDMT_CFG>;
+		};
+
+		slv_qhss_apu_cfg:slv-qhss-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_QHSS_APU_CFG>;
+			label = "slv-qhss-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QHSS_APU_CFG>;
+		};
+
+		slv_mdio:slv-mdio {
+			cell-id = <MSM_BUS_SLAVE_MDIO>;
+			label = "slv-mdio";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MDIO>;
+		};
+
+		slv_fephy_cfg:slv-fephy-cfg {
+			cell-id = <MSM_BUS_SLAVE_FEPHY_CFG>;
+			label = "slv-fephy-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_FEPHY_CFG>;
+		};
+
+		slv_srif:slv-srif {
+			cell-id = <MSM_BUS_SLAVE_SRIF>;
+			label = "slv-srif";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SRIF>;
+		};
+
+		slv_ddrc_cfg:slv-ddrc-cfg {
+			cell-id = <MSM_BUS_SLAVE_DDRC_CFG>;
+			label = "slv-ddrc-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DDRC_CFG>;
+		};
+
+		slv_ddrc_apu_cfg:slv-ddrc-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_DDRC_APU_CFG>;
+			label = "slv-ddrc-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DDRC_APU_CFG>;
+		};
+
+		slv_ddrc_mpu0_cfg:slv-ddrc-mpu0-cfg {
+			cell-id = <MSM_BUS_SLAVE_MPU0_CFG>;
+			label = "slv-ddrc-mpu0-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DDRC_MPU0_CFG>;
+		};
+
+		slv_ddrc_mpu1_cfg:slv-ddrc-mpu1-cfg {
+			cell-id = <MSM_BUS_SLAVE_MPU1_CFG>;
+			label = "slv-ddrc-mpu1-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DDRC_MPU1_CFG>;
+		};
+
+		slv_ddrc_mpu2_cfg:slv-ddrc-mpu2-cfg {
+			cell-id = <MSM_BUS_SLAVE_MPU2_CFG>;
+			label = "slv-ddrc-mpu2-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DDRC_MPU2_CFG>;
+		};
+
+		slv_ess_vmidmt_cfg:slv-ess-vmidmt-cfg {
+			cell-id = <MSM_BUS_SLAVE_ESS_VMIDMT_CFG>;
+			label = "slv-ess-vmidmt-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_ESS_VMIDMT_CFG>;
+		};
+
+		slv_ess_apu_cfg:slv-ess-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_ESS_APU_CFG>;
+			label = "slv-ess-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_ESS_APU_CFG>;
+		};
+
+		slv_usb2_cfg:slv-usb2-cfg {
+			cell-id = <MSM_BUS_SLAVE_USB2_CFG>;
+			label = "slv-usb2-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB2_CFG>;
+		};
+
+		slv_blsp_cfg:slv-blsp-cfg {
+			cell-id = <MSM_BUS_SLAVE_BLSP_CFG>;
+			label = "slv-blsp-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_CFG>;
+		};
+
+		slv_qpic_cfg:slv-qpic-cfg {
+			cell-id = <MSM_BUS_SLAVE_QPIC_CFG>;
+			label = "slv-qpic-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QPIC_CFG>;
+		};
+
+		slv_sdcc_cfg:slv-sdcc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SDCC_CFG>;
+			label = "slv-sdcc-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_CFG>;
+		};
+
+		slv_wss0_vmidmt_cfg:slv-wss0-vmidmt-cfg {
+			cell-id = <MSM_BUS_SLAVE_WSS0_VMIDMT_CFG>;
+			label = "slv-wss0-vmidmt-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WSS0_VMIDMT_CFG>;
+		};
+
+		slv_wss0_apu_cfg:slv-wss0-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_WSS0_APU_CFG>;
+			label = "slv-wss0-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WSS0_APU_CFG>;
+		};
+
+		slv_wss1_vmidmt_cfg:slv-wss1-vmidmt-cfg {
+			cell-id = <MSM_BUS_SLAVE_WSS1_VMIDMT_CFG>;
+			label = "slv-wss1-vmidmt-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WSS1_VMIDMT_CFG>;
+		};
+
+		slv_wss1_apu_cfg:slv-wss1-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_WSS1_APU_CFG>;
+			label = "slv-wss1-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WSS1_APU_CFG>;
+		};
+
+		slv_pcnoc_snoc:slv-pcnoc-snoc {
+			cell-id = <MSM_BUS_PNOC_SNOC_SLV>;
+			label = "slv-pcnoc-snoc";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCNOC_SNOC>;
+		};
+
+		slv_srvc_pcnoc:slv-srvc-pcnoc {
+			cell-id = <MSM_BUS_SLAVE_SRVC_PCNOC>;
+			label = "slv-srvc-pcnoc";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pcnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SRVC_PCNOC>;
+		};
+
+		slv_snoc_ddrc_m1:slv-snoc-ddrc-m1 {
+			cell-id = <MSM_BUS_SLAVE_SNOC_DDRC>;
+			label = "slv-snoc-ddrc-m1";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_DDRC>;
+		};
+
+		slv_a7ss:slv-a7ss {
+			cell-id = <MSM_BUS_SLAVE_A7SS>;
+			label = "slv-a7ss";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A7SS>;
+		};
+
+		slv_ocimem:slv-ocimem {
+			cell-id = <MSM_BUS_SLAVE_OCIMEM>;
+			label = "slv-ocimem";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_OCIMEM>;
+		};
+
+		slv_wss0_cfg:slv-wss0-cfg {
+			cell-id = <MSM_BUS_SLAVE_WSS0_CFG>;
+			label = "slv-wss0-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WSS0_CFG>;
+		};
+
+		slv_wss1_cfg:slv-wss1-cfg {
+			cell-id = <MSM_BUS_SLAVE_WSS1_CFG>;
+			label = "slv-wss1-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WSS1_CFG>;
+		};
+
+		slv_pcie:slv-pcie {
+			cell-id = <MSM_BUS_SLAVE_PCIE>;
+			label = "slv-pcie";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE>;
+		};
+
+		slv_usb3_cfg:slv-usb3-cfg {
+			cell-id = <MSM_BUS_SLAVE_USB3_CFG>;
+			label = "slv-usb3-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB3_CFG>;
+		};
+
+		slv_crypto_cfg:slv-crypto-cfg {
+			cell-id = <MSM_BUS_SLAVE_CRYPTO_CFG>;
+			label = "slv-crypto-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CRYPTO_CFG>;
+		};
+
+		slv_ess_cfg:slv-ess-cfg {
+			cell-id = <MSM_BUS_SLAVE_ESS_CFG>;
+			label = "slv-ess-cfg";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_ESS_CFG>;
+		};
+
+		slv_qdss_stm:slv-qdss-stm {
+			cell-id = <MSM_BUS_SLAVE_QDSS_STM>;
+			label = "slv-qdss-stm";
+			qcom,buswidth = <4>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_STM>;
+		};
+
+		slv_srvc_snoc:slv-srvc-snoc {
+			cell-id = <MSM_BUS_SLAVE_SRVC_SNOC>;
+			label = "slv-srvc-snoc";
+			qcom,buswidth = <8>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SRVC_SNOC>;
+		};
+	};
+};
+
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts
new file mode 100644
index 000000000..88ea37085
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4028-wpj428.dts
@@ -0,0 +1,291 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017, Christian Mehlis <christian@m3hlis.de>
+ * Copyright (c) 2017-2018, Sven Eckelmann <sven.eckelmann@openmesh.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Compex WPJ428";
+	compatible = "compex,wpj428", "qcom,ipq4019";
+
+	reserved-memory {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		ranges;
+
+		tz_apps@87b80000 {
+			reg = <0x87b80000 0x280000>;
+			no-map;
+		};
+
+		smem@87e00000 {
+			reg = <0x87e00000 0x080000>;
+			no-map;
+		};
+
+		tz@87e80000 {
+			reg = <0x87e80000 0x180000>;
+			no-map;
+		};
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2: usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3: usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			switch_lan_bmp = <0x10>;
+			switch_wan_bmp = <0x20>;
+
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	aliases {
+		led-boot = &status;
+		led-failsafe = &status;
+		led-upgrade = &status;
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		status: rss4 {
+			label = "wpj428:green:rss4";
+			gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+
+		rss3 {
+			label = "wpj428:green:rss3";
+			gpios = <&tlmm 4 GPIO_ACTIVE_HIGH>;
+			default-state = "off";
+		};
+	};
+
+	beeper: beeper {
+		compatible = "gpio-beeper";
+		gpios = <&tlmm 58 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pin {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pin_cs {
+			function = "gpio";
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&spi_0 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	m25p80@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "0:SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+			partition1@40000 {
+				label = "0:MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+			partition2@60000 {
+				label = "0:QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+			partition3@c0000 {
+				label = "0:CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+			partition4@d0000 {
+				label = "0:DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+			partition5@e0000 {
+				label = "0:APPSBLENV"; /* uboot env*/
+				reg = <0x000e0000 0x00010000>;
+				read-only;
+			};
+			partition5@f0000 {
+				label = "0:APPSBL"; /* uboot */
+				reg = <0x000f0000 0x00080000>;
+				read-only;
+			};
+			partition5@170000 {
+				label = "0:ART";
+				reg = <0x00170000 0x00010000>;
+				read-only;
+			};
+			partition6@180000 {
+				label = "firmware";
+				reg = <0x00180000 0x01e80000>;
+			};
+		};
+	};
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&gmac0 {
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <1>;
+	qcom,forced_speed = <1000>;
+	qcom,forced_duplex = <1>;
+	vlan_tag = <2 0x20>;
+};
+
+&gmac1 {
+	qcom,phy_mdio_addr = <3>;
+	qcom,poll_required = <1>;
+	qcom,forced_speed = <1000>;
+	qcom,forced_duplex = <1>;
+	vlan_tag = <1 0x10>;
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+};
+
+&wifi1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts
new file mode 100644
index 000000000..c4b002bdd
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-gl-b1300.dts
@@ -0,0 +1,310 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "GL.iNet GL-B1300";
+	compatible = "glinet,gl-b1300", "qcom,ipq4019";
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x10000000>;
+	};
+
+	reserved-memory {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		ranges;
+
+		apps_bl@87000000 {
+			reg = <0x87000000 0x400000>;
+			no-map;
+		};
+
+		sbl@87400000 {
+			reg = <0x87400000 0x100000>;
+			no-map;
+		};
+
+		cnss_debug@87500000 {
+			reg = <0x87500000 0x600000>;
+			no-map;
+		};
+
+		cpu_context_dump@87b00000 {
+			reg = <0x87b00000 0x080000>;
+			no-map;
+		};
+
+		tz_apps@87b80000 {
+			reg = <0x87b80000 0x280000>;
+			no-map;
+		};
+
+		smem@87e00000 {
+			reg = <0x87e00000 0x080000>;
+			no-map;
+		};
+
+		tz@87e80000 {
+			reg = <0x87e80000 0x180000>;
+			no-map;
+		};
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+			switch_lan_bmp = <0x18>;
+			switch_wan_bmp = <0x20>;
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 5 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		power: power {
+			label = "gl-b1300:green:power";
+			gpios = <&tlmm 4 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		mesh {
+			label = "gl-b1300:green:mesh";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan {
+			label = "gl-b1300:green:wlan";
+			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&spi_0 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	mx25l25635f@0 {
+		compatible = "jedec,spi-nor";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+
+		SBL1@0 {
+			label = "SBL1";
+			reg = <0x0 0x40000>;
+			read-only;
+		};
+
+		MIBIB@40000 {
+			label = "MIBIB";
+			reg = <0x40000 0x20000>;
+			read-only;
+		};
+
+		QSEE@60000 {
+			label = "QSEE";
+			reg = <0x60000 0x60000>;
+			read-only;
+		};
+
+		CDT@c0000 {
+			label = "CDT";
+			reg = <0xc0000 0x10000>;
+			read-only;
+		};
+
+		DDRPARAMS@d0000 {
+			label = "DDRPARAMS";
+			reg = <0xd0000 0x10000>;
+			read-only;
+		};
+
+		APPSBLENV@e0000 {
+			label = "APPSBLENV";
+			reg = <0xe0000 0x10000>;
+			read-only;
+		};
+
+		APPSBL@f0000 {
+			label = "APPSBL";
+			reg = <0xf0000 0x80000>;
+			read-only;
+		};
+
+		ART@170000 {
+			label = "ART";
+			reg = <0x170000 0x10000>;
+			read-only;
+		};
+
+		firmware@180000 {
+			label = "firmware";
+			reg = <0x180000 0x1e80000>;
+		};
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio54";
+		};
+		pinconf {
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+};
+
+&wifi1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-mr33.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-mr33.dts
new file mode 100644
index 000000000..a709ae96b
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4029-mr33.dts
@@ -0,0 +1,402 @@
+/*
+ * Device Tree Source for Meraki MR33 (Stinkbug)
+ *
+ * Copyright (C) 2017 Chris Blake <chrisrblake93@gmail.com>
+ * Copyright (C) 2017 Christian Lamparter <chunkeey@googlemail.com>
+ *
+ * Based on Cisco Meraki DTS from GPL release r25-linux-3.14-20170427
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2.  This program is licensed "as is" without
+ * any warranty of any kind, whether express or implied.
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Meraki MR33 Access Point";
+	compatible = "meraki,mr33", "qcom,ipq4019";
+
+	aliases {
+		led-boot = &status_green;
+		led-failsafe = &status_red;
+		led-running = &status_green;
+		led-upgrade = &power_orange;
+	};
+
+	/* Do we really need this defined? */
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x10000000>;
+	};
+
+	reserved-memory {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		ranges;
+
+		tz_apps@87b80000 {
+			reg = <0x87b80000 0x280000>;
+			reusable;
+		};
+
+		smem@87e00000 {
+			reg = <0x87e00000 0x080000>;
+			no-map;
+		};
+
+		tz@87e80000 {
+			reg = <0x87e80000 0x180000>;
+			no-map;
+		};
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+			pinctrl-0 = <&mdio_pins>;
+			pinctrl-names = "default";
+			/delete-node/ ethernet-phy@0;
+			/delete-node/ ethernet-phy@2;
+			/delete-node/ ethernet-phy@3;
+			/delete-node/ ethernet-phy@4;
+		};
+
+		/* It is a 56-bit counter that supplies the count to the ARM arch
+		   timers and without upstream driver */
+		counter@4a1000 {
+			compatible = "qcom,qca-gcnt";
+			reg = <0x4a1000 0x4>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII_RGMII5>;
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_0_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		serial@78b0000 {
+			pinctrl-0 = <&serial_1_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+
+			bluetooth {
+				compatible = "ti,cc2650";
+				enable-gpios = <&tlmm 12 GPIO_ACTIVE_LOW>;
+			};
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
+			switch_lan_bmp = <0x0>; /* lan port bitmap */
+			switch_wan_bmp = <0x10>; /* wan port bitmap */
+		};
+
+		edma@c080000 {
+			qcom,single-phy;
+			qcom,num_gmac = <1>;
+			phy-mode = "rgmii-rxid";
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		power_orange: power {
+			label = "mr33:orange:power";
+			gpios = <&tlmm 49 GPIO_ACTIVE_LOW>;
+			panic-indicator;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&gmac0 {
+	qcom,phy_mdio_addr = <1>;
+	qcom,poll_required = <1>;
+	vlan_tag = <0 0x20>;
+};
+
+&i2c_0 {
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	at24@50 {
+		compatible = "atmel,24c64";
+		pagesize = <32>;
+		reg = <0x50>;
+		read-only; /* This holds our MAC & Meraki board-data */
+	};
+};
+
+&i2c_1 {
+	pinctrl-0 = <&i2c_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	lp5562@30 {
+		enable-gpio = <&tlmm 48 GPIO_ACTIVE_HIGH>;
+		compatible = "ti,lp5562";
+		clock-mode = /bits/8 <2>;
+		reg = <0x30>;
+
+		/* RGB led */
+		status_red: chan0 {
+			chan-name = "mr33:red:status";
+			led-cur = /bits/ 8 <0x20>;
+			max-cur = /bits/ 8 <0x60>;
+		};
+
+		status_green: chan1 {
+			chan-name = "mr33:green:status";
+			led-cur = /bits/ 8 <0x20>;
+			max-cur = /bits/ 8 <0x60>;
+		};
+
+		chan2 {
+			chan-name = "mr33:blue:status";
+			led-cur = /bits/ 8 <0x20>;
+			max-cur = /bits/ 8 <0x60>;
+		};
+
+		chan3 {
+			chan-name = "mr33:white:status";
+			led-cur = /bits/ 8 <0x20>;
+			max-cur = /bits/ 8 <0x60>;
+		};
+	};
+};
+
+&nand {
+	pinctrl-0 = <&nand_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	nand@0 {
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "sbl1";
+				reg = <0x000000000000 0x000000100000>;
+				read-only;
+			};
+			partition@1 {
+				label = "mibib";
+				reg = <0x000000100000 0x000000100000>;
+				read-only;
+			};
+			partition@2 {
+				label = "bootconfig";
+				reg = <0x000000200000 0x000000100000>;
+				read-only;
+			};
+			partition@3 {
+				label = "qsee";
+				reg = <0x000000300000 0x000000100000>;
+				read-only;
+			};
+			partition@4 {
+				label = "qsee_alt";
+				reg = <0x000000400000 0x000000100000>;
+				read-only;
+			};
+			partition@5 {
+				label = "cdt";
+				reg = <0x000000500000 0x000000080000>;
+				read-only;
+			};
+			partition@6 {
+				label = "cdt_alt";
+				reg = <0x000000580000 0x000000080000>;
+				read-only;
+			};
+			partition@7 {
+				label = "ddrparams";
+				reg = <0x000000600000 0x000000080000>;
+				read-only;
+			};
+			partition@8 {
+				label = "u-boot";
+				reg = <0x000000700000 0x000000200000>;
+				read-only;
+			};
+			partition@9 {
+				label = "u-boot-backup";
+				reg = <0x000000900000 0x000000200000>;
+				read-only;
+			};
+			partition@10 {
+				label = "ART";
+				reg = <0x000000b00000 0x000000080000>;
+				read-only;
+			};
+			partition@11 {
+				label = "ubi";
+				reg = <0x000000c00000 0x000007000000>;
+			};
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	wake-gpio = <&tlmm 50 GPIO_ACTIVE_LOW>;
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&tlmm {
+	/*
+	 * GPIO43 should be 0/1 whenever the unit is
+	 * powered through PoE or AC-Adapter.
+	 * That said, playing with this seems to
+	 * reset the AP.
+	 */
+
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	serial_0_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	serial_1_pins: serial1_pinmux {
+		mux {
+			/* We use the i2c-0 pins for serial_1 */
+			pins = "gpio8", "gpio9";
+			function = "blsp_uart1";
+			bias-disable;
+		};
+	};
+
+	i2c_0_pins: i2c_0_pinmux {
+		pinmux {
+			function = "blsp_i2c0";
+			pins = "gpio20", "gpio21";
+		};
+		pinconf {
+			pins = "gpio20", "gpio21";
+			drive-strength = <16>;
+			bias-disable;
+		};
+	};
+
+	i2c_1_pins: i2c_1_pinmux {
+		pinmux {
+			function = "blsp_i2c1";
+			pins = "gpio34", "gpio35";
+		};
+		pinconf {
+			pins = "gpio34", "gpio35";
+			drive-strength = <16>;
+			bias-disable;
+		};
+	};
+
+	nand_pins: nand_pins {
+		/*
+		 * There are 18 pins. 15 pins are common between LCD and NAND.
+		 * The QPIC controller arbitrates between LCD and NAND. Of the
+		 * remaining 4, 2 are for NAND and 2 are for LCD exclusively.
+		 *
+		 * The meraki source hints that the bluetooth module claims
+		 * pin 52 as well. But sadly, there's no data whenever this
+		 * is a NAND or LCD exclusive pin or not.
+		 */
+
+		pullups {
+			pins = "gpio52", "gpio53", "gpio58",
+				"gpio59";
+			function = "qpic";
+			bias-pull-up;
+		};
+
+		pulldowns {
+			pins = "gpio54", "gpio55", "gpio56",
+				"gpio57", "gpio60", "gpio61",
+				"gpio62", "gpio63", "gpio64",
+				"gpio65", "gpio66", "gpio67",
+				"gpio68", "gpio69";
+			function = "qpic";
+			bias-pull-down;
+		};
+	};
+};
+
+&wifi0 {
+	status = "okay";
+	/* qcom,ath10k-calibration-variant = "MERAKI-MR33"; */
+};
+
+&wifi1 {
+	status = "okay";
+	/* qcom,ath10k-calibration-variant = "MERAKI-MR33"; */
+};
diff --git a/target/linux/ipq40xx/image/Makefile b/target/linux/ipq40xx/image/Makefile
new file mode 100644
index 000000000..125b3bf8e
--- /dev/null
+++ b/target/linux/ipq40xx/image/Makefile
@@ -0,0 +1,147 @@
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+define Device/Default
+	PROFILES := Default
+	KERNEL_DEPENDS = $$(wildcard $(DTS_DIR)/$$(DEVICE_DTS).dts)
+	KERNEL_INITRAMFS_PREFIX := $$(IMG_PREFIX)-$(1)-initramfs
+	KERNEL_PREFIX := $$(IMAGE_PREFIX)
+	KERNEL_LOADADDR := 0x80208000
+	SUPPORTED_DEVICES := $(subst _,$(comma),$(1))
+	IMAGE/sysupgrade.bin = sysupgrade-tar | append-metadata
+	IMAGE/sysupgrade.bin/squashfs :=
+endef
+
+define Device/FitImage
+	KERNEL_SUFFIX := -fit-uImage.itb
+	KERNEL = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+	KERNEL_NAME := Image
+endef
+
+define Device/FitImageLzma
+	KERNEL_SUFFIX := -fit-uImage.itb
+	KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+	KERNEL_NAME := Image
+endef
+
+define Device/UbiFit
+	KERNEL_IN_UBI := 1
+	IMAGES := nand-factory.ubi nand-sysupgrade.bin
+	IMAGE/nand-factory.ubi := append-ubi
+	IMAGE/nand-sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+
+
+define Device/asus_rt-ac58u
+	$(call Device/FitImageLzma)
+	DEVICE_DTS := qcom-ipq4018-rt-ac58u
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DTB_SIZE := 65536
+	DEVICE_TITLE := Asus RT-AC58U
+	IMAGE_SIZE := 20439364
+	FILESYSTEMS := squashfs
+#	Someone - in their infinite wisdom - decided to put the firmware
+#	version in front of the image name \03\00\00\04 => Version 3.0.0.4
+#	Since u-boot works with strings we either need another fixup step
+#	to add a version... or we are very careful not to add '\0' into that
+#	string and call it a day.... Yeah, we do the latter!
+	UIMAGE_NAME:=$(shell echo -e '\03\01\01\01RT-AC58U')
+	IMAGES := sysupgrade.bin
+	DEVICE_PACKAGES := ipq-wifi-asus_rt-ac58u kmod-usb-ledtrig-usbport
+endef
+TARGET_DEVICES += asus_rt-ac58u
+
+define Device/avm_fritzbox-4040
+	$(call Device/FitImageLzma)
+	DEVICE_DTS := qcom-ipq4018-fritz4040
+	BOARD_NAME := fritz4040
+	DEVICE_TITLE := AVM Fritz!Box 4040
+	IMAGE_SIZE := 29753344
+	IMAGES = sysupgrade.bin
+	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
+	DEVICE_PACKAGES := ipq-wifi-avm_fritzbox-4040 fritz-tffs fritz-caldata u-boot-fritz4040
+endef
+TARGET_DEVICES += avm_fritzbox-4040
+
+define Device/compex_wpj428
+	$(call Device/FitImage)
+	DEVICE_DTS := qcom-ipq4028-wpj428
+	DEVICE_DTS_CONFIG := config@4
+	BLOCKSIZE := 64k
+	DEVICE_TITLE := Compex WPJ428
+	IMAGE_SIZE := 31232k
+	KERNEL_SIZE := 4096k
+	IMAGES = sysupgrade.bin
+	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
+	DEVICE_PACKAGES := ath10k-firmware-qca4019 kmod-gpio-beeper
+endef
+TARGET_DEVICES += compex_wpj428
+
+define Device/glinet_gl-b1300
+	$(call Device/FitImage)
+	DEVICE_TITLE := GL.iNet GL-B1300
+	BOARD_NAME := gl-b1300
+	DEVICE_DTS := qcom-ipq4029-gl-b1300
+	KERNEL_SIZE := 4096k
+	IMAGE_SIZE := 26624k
+	IMAGES := sysupgrade.bin
+	IMAGE/sysupgrade.bin := append-kernel |append-rootfs | pad-rootfs | append-metadata
+	DEVICE_PACKAGES := ipq-wifi-glinet_gl-b1300
+endef
+TARGET_DEVICES += glinet_gl-b1300
+
+define Device/meraki_mr33
+	$(call Device/FitImage)
+	DEVICE_DTS := qcom-ipq4029-mr33
+	BLOCKSIZE := 131072
+	PAGESIZE := 2048
+	DEVICE_TITLE := Cisco Meraki MR33
+	IMAGES = sysupgrade.bin
+	DEVICE_PACKAGES := -swconfig ipq-wifi-meraki_mr33 ath10k-firmware-qca9887
+endef
+TARGET_DEVICES += meraki_mr33
+
+define Device/openmesh_a42
+	$(call Device/FitImageLzma)
+	DEVICE_DTS := qcom-ipq4018-a42
+	DEVICE_DTS_CONFIG := config@om.a42
+	BLOCKSIZE := 64k
+	DEVICE_TITLE := OpenMesh A42
+	KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb | pad-to $$(BLOCKSIZE)
+	IMAGE_SIZE := 15616k
+	IMAGES = factory.bin sysupgrade.bin
+	IMAGE/factory.bin := append-rootfs | pad-rootfs | openmesh-image ce_type=A42
+	IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
+	DEVICE_PACKAGES := ath10k-firmware-qca4019 uboot-envtools
+endef
+TARGET_DEVICES += openmesh_a42
+
+define Device/qcom_ap-dk01.1-c1
+	DEVICE_TITLE := QCA AP-DK01.1-C1
+	BOARD_NAME := ap-dk01.1-c1
+	DEVICE_DTS := qcom-ipq4019-ap.dk01.1-c1
+	KERNEL_INSTALL := 1
+	KERNEL_SIZE := 4096k
+	IMAGE_SIZE := 26624k
+	$(call Device/FitImage)
+	IMAGES := sysupgrade.bin
+	IMAGE/sysupgrade.bin := append-kernel | pad-to $$$${KERNEL_SIZE} | append-rootfs | pad-rootfs | append-metadata
+	DEVICE_PACKAGES := ath10k-firmware-qca4019
+endef
+TARGET_DEVICES += qcom_ap-dk01.1-c1
+
+define Device/qcom_ap-dk04.1-c1
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_DTS := qcom-ipq4019-ap.dk04.1-c1
+	KERNEL_INSTALL := 1
+	KERNEL_SIZE := 4048k
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	BOARD_NAME := ap-dk04.1-c1
+	DEVICE_TITLE := QCA AP-DK04.1-C1
+endef
+TARGET_DEVICES += qcom_ap-dk04.1-c1
+
+$(eval $(call BuildImage))
diff --git a/target/linux/ipq40xx/patches-4.14/017-qcom-ipq4019-add-cpu-operating-points-for-cpufreq-su.patch b/target/linux/ipq40xx/patches-4.14/017-qcom-ipq4019-add-cpu-operating-points-for-cpufreq-su.patch
new file mode 100644
index 000000000..03e9021a4
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/017-qcom-ipq4019-add-cpu-operating-points-for-cpufreq-su.patch
@@ -0,0 +1,77 @@
+From 18c3b42575a154343831aec0637aab00e19440e1 Mon Sep 17 00:00:00 2001
+From: Matthew McClintock <mmcclint@codeaurora.org>
+Date: Thu, 17 Mar 2016 15:01:09 -0500
+Subject: [PATCH 17/69] qcom: ipq4019: add cpu operating points for cpufreq
+ support
+
+This adds some operating points for cpu frequeny scaling
+
+Signed-off-by: Matthew McClintock <mmcclint@codeaurora.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 34 ++++++++++++++++++++++++++--------
+ 1 file changed, 26 insertions(+), 8 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -40,14 +40,7 @@
+ 			reg = <0x0>;
+ 			clocks = <&gcc GCC_APPS_CLK_SRC>;
+ 			clock-frequency = <0>;
+-			operating-points = <
+-				/* kHz	uV (fixed) */
+-				48000	1100000
+-				200000	1100000
+-				500000	1100000
+-				666000	1100000
+-			>;
+-			clock-latency = <256000>;
++			operating-points-v2 = <&cpu0_opp_table>;
+ 		};
+ 
+ 		cpu@1 {
+@@ -59,6 +52,7 @@
+ 			reg = <0x1>;
+ 			clocks = <&gcc GCC_APPS_CLK_SRC>;
+ 			clock-frequency = <0>;
++			operating-points-v2 = <&cpu0_opp_table>;
+ 		};
+ 
+ 		cpu@2 {
+@@ -70,6 +64,7 @@
+ 			reg = <0x2>;
+ 			clocks = <&gcc GCC_APPS_CLK_SRC>;
+ 			clock-frequency = <0>;
++			operating-points-v2 = <&cpu0_opp_table>;
+ 		};
+ 
+ 		cpu@3 {
+@@ -81,6 +76,29 @@
+ 			reg = <0x3>;
+ 			clocks = <&gcc GCC_APPS_CLK_SRC>;
+ 			clock-frequency = <0>;
++			operating-points-v2 = <&cpu0_opp_table>;
++		};
++	};
++
++	cpu0_opp_table: opp_table0 {
++		compatible = "operating-points-v2";
++		opp-shared;
++
++		opp-48000000 {
++			opp-hz = /bits/ 64 <48000000>;
++			clock-latency-ns = <256000>;
++		};
++		opp-200000000 {
++			opp-hz = /bits/ 64 <200000000>;
++			clock-latency-ns = <256000>;
++		};
++		opp-500000000 {
++			opp-hz = /bits/ 64 <500000000>;
++			clock-latency-ns = <256000>;
++		};
++		opp-716000000 {
++			opp-hz = /bits/ 64 <716000000>;
++			clock-latency-ns = <256000>;
+ 		};
+ 	};
+ 
diff --git a/target/linux/ipq40xx/patches-4.14/030-mtd-nand-Use-standard-large-page-OOB-layout-when-usi.patch b/target/linux/ipq40xx/patches-4.14/030-mtd-nand-Use-standard-large-page-OOB-layout-when-usi.patch
new file mode 100644
index 000000000..67dee7092
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/030-mtd-nand-Use-standard-large-page-OOB-layout-when-usi.patch
@@ -0,0 +1,47 @@
+From 882fd1577cbe7812ae3a48988180c5f0fda475ca Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+Date: Sat, 26 Aug 2017 17:19:15 +0200
+Subject: [PATCH] mtd: nand: Use standard large page OOB layout when using
+ NAND_ECC_NONE
+
+Use the core's large page OOB layout functions when not reserving any
+space for ECC bytes in the OOB layout. Fix ->nand_ooblayout_ecc_lp()
+to return -ERANGE instead of a zero length in this case.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+---
+ drivers/mtd/nand/nand_base.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -115,7 +115,7 @@ static int nand_ooblayout_ecc_lp(struct
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
+ 	struct nand_ecc_ctrl *ecc = &chip->ecc;
+ 
+-	if (section)
++	if (section || !ecc->total)
+ 		return -ERANGE;
+ 
+ 	oobregion->length = ecc->total;
+@@ -4712,6 +4712,19 @@ int nand_scan_tail(struct mtd_info *mtd)
+ 			mtd_set_ooblayout(mtd, &nand_ooblayout_lp_hamming_ops);
+ 			break;
+ 		default:
++			/*
++			 * Expose the whole OOB area to users if ECC_NONE
++			 * is passed. We could do that for all kind of
++			 * ->oobsize, but we must keep the old large/small
++			 * page with ECC layout when ->oobsize <= 128 for
++			 * compatibility reasons.
++			 */
++			if (ecc->mode == NAND_ECC_NONE) {
++				mtd_set_ooblayout(mtd,
++						&nand_ooblayout_lp_ops);
++				break;
++			}
++
+ 			WARN(1, "No oob scheme defined for oobsize %d\n",
+ 				mtd->oobsize);
+ 			ret = -EINVAL;
diff --git a/target/linux/ipq40xx/patches-4.14/031-mtd-nand-use-usual-return-values-for-the-erase-hook.patch b/target/linux/ipq40xx/patches-4.14/031-mtd-nand-use-usual-return-values-for-the-erase-hook.patch
new file mode 100644
index 000000000..962baeb2b
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/031-mtd-nand-use-usual-return-values-for-the-erase-hook.patch
@@ -0,0 +1,48 @@
+From eb94555e9e97c9983461214046b4d72c4ab4ba70 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+Date: Thu, 30 Nov 2017 18:01:28 +0100
+Subject: [PATCH] mtd: nand: use usual return values for the ->erase() hook
+
+Avoid using specific defined values for checking returned status of the
+->erase() hook. Instead, use usual negative error values on failure,
+zero otherwise.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+---
+ drivers/mtd/nand/denali.c    |  2 +-
+ drivers/mtd/nand/docg4.c     |  7 ++++++-
+ drivers/mtd/nand/nand_base.c | 10 ++++++++--
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2994,11 +2994,17 @@ out:
+ static int single_erase(struct mtd_info *mtd, int page)
+ {
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
++	int status;
++
+ 	/* Send commands to erase a block */
+ 	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
+ 	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
+ 
+-	return chip->waitfunc(mtd, chip);
++	status = chip->waitfunc(mtd, chip);
++	if (status < 0)
++		return status;
++
++	return status & NAND_STATUS_FAIL ? -EIO : 0;
+ }
+ 
+ /**
+@@ -3082,7 +3088,7 @@ int nand_erase_nand(struct mtd_info *mtd
+ 		status = chip->erase(mtd, page & chip->pagemask);
+ 
+ 		/* See if block erase succeeded */
+-		if (status & NAND_STATUS_FAIL) {
++		if (status) {
+ 			pr_debug("%s: failed erase, page 0x%08x\n",
+ 					__func__, page);
+ 			instr->state = MTD_ERASE_FAILED;
diff --git a/target/linux/ipq40xx/patches-4.14/040-dmaengine-qcom-bam-Process-multiple-pending-descript.patch b/target/linux/ipq40xx/patches-4.14/040-dmaengine-qcom-bam-Process-multiple-pending-descript.patch
new file mode 100644
index 000000000..dca516e87
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/040-dmaengine-qcom-bam-Process-multiple-pending-descript.patch
@@ -0,0 +1,395 @@
+From 6b4faeac05bc0b91616b921191cb054d1376f3b4 Mon Sep 17 00:00:00 2001
+From: Sricharan R <sricharan@codeaurora.org>
+Date: Mon, 28 Aug 2017 20:30:24 +0530
+Subject: [PATCH] dmaengine: qcom-bam: Process multiple pending descriptors
+
+The bam dmaengine has a circular FIFO to which we
+add hw descriptors that describes the transaction.
+The FIFO has space for about 4096 hw descriptors.
+
+Currently we add one descriptor and wait for it to
+complete with interrupt and then add the next pending
+descriptor. In this way, the FIFO is underutilized
+since only one descriptor is processed at a time, although
+there is space in FIFO for the BAM to process more.
+
+Instead keep adding descriptors to FIFO till its full,
+that allows BAM to continue to work on the next descriptor
+immediately after signalling completion interrupt for the
+previous descriptor.
+
+Also when the client has not set the DMA_PREP_INTERRUPT for
+a descriptor, then do not configure BAM to trigger a interrupt
+upon completion of that descriptor. This way we get a interrupt
+only for the descriptor for which DMA_PREP_INTERRUPT was
+requested and there signal completion of all the previous completed
+descriptors. So we still do callbacks for all requested descriptors,
+but just that the number of interrupts are reduced.
+
+CURRENT:
+
+            ------      -------   ---------------
+            |DES 0|     |DESC 1|  |DESC 2 + INT |
+            ------      -------   ---------------
+               |           |            |
+               |           |            |
+INTERRUPT:   (INT)       (INT)	      (INT)
+CALLBACK:     (CB)        (CB)         (CB)
+
+		MTD_SPEEDTEST READ PAGE: 3560 KiB/s
+		MTD_SPEEDTEST WRITE PAGE: 2664 KiB/s
+		IOZONE READ: 2456 KB/s
+		IOZONE WRITE: 1230 KB/s
+
+	bam dma interrupts (after tests): 96508
+
+CHANGE:
+
+        ------  -------    -------------
+        |DES 0| |DESC 1   |DESC 2 + INT |
+        ------  -------   --------------
+				|
+				|
+          		      (INT)
+			      (CB for 0, 1, 2)
+
+		MTD_SPEEDTEST READ PAGE: 3860 KiB/s
+		MTD_SPEEDTEST WRITE PAGE: 2837 KiB/s
+		IOZONE READ: 2677 KB/s
+		IOZONE WRITE: 1308 KB/s
+
+	bam dma interrupts (after tests): 58806
+
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+Reviewed-by: Andy Gross <andy.gross@linaro.org>
+Tested-by: Abhishek Sahu <absahu@codeaurora.org>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+---
+ drivers/dma/qcom/bam_dma.c | 169 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 109 insertions(+), 60 deletions(-)
+
+--- a/drivers/dma/qcom/bam_dma.c
++++ b/drivers/dma/qcom/bam_dma.c
+@@ -46,6 +46,7 @@
+ #include <linux/of_address.h>
+ #include <linux/of_irq.h>
+ #include <linux/of_dma.h>
++#include <linux/circ_buf.h>
+ #include <linux/clk.h>
+ #include <linux/dmaengine.h>
+ #include <linux/pm_runtime.h>
+@@ -78,6 +79,8 @@ struct bam_async_desc {
+ 
+ 	struct bam_desc_hw *curr_desc;
+ 
++	/* list node for the desc in the bam_chan list of descriptors */
++	struct list_head desc_node;
+ 	enum dma_transfer_direction dir;
+ 	size_t length;
+ 	struct bam_desc_hw desc[0];
+@@ -347,6 +350,8 @@ static const struct reg_offset_data bam_
+ #define BAM_DESC_FIFO_SIZE	SZ_32K
+ #define MAX_DESCRIPTORS (BAM_DESC_FIFO_SIZE / sizeof(struct bam_desc_hw) - 1)
+ #define BAM_FIFO_SIZE	(SZ_32K - 8)
++#define IS_BUSY(chan)	(CIRC_SPACE(bchan->tail, bchan->head,\
++			 MAX_DESCRIPTORS + 1) == 0)
+ 
+ struct bam_chan {
+ 	struct virt_dma_chan vc;
+@@ -356,8 +361,6 @@ struct bam_chan {
+ 	/* configuration from device tree */
+ 	u32 id;
+ 
+-	struct bam_async_desc *curr_txd;	/* current running dma */
+-
+ 	/* runtime configuration */
+ 	struct dma_slave_config slave;
+ 
+@@ -372,6 +375,8 @@ struct bam_chan {
+ 	unsigned int initialized;	/* is the channel hw initialized? */
+ 	unsigned int paused;		/* is the channel paused? */
+ 	unsigned int reconfigure;	/* new slave config? */
++	/* list of descriptors currently processed */
++	struct list_head desc_list;
+ 
+ 	struct list_head node;
+ };
+@@ -539,7 +544,7 @@ static void bam_free_chan(struct dma_cha
+ 
+ 	vchan_free_chan_resources(to_virt_chan(chan));
+ 
+-	if (bchan->curr_txd) {
++	if (!list_empty(&bchan->desc_list)) {
+ 		dev_err(bchan->bdev->dev, "Cannot free busy channel\n");
+ 		goto err;
+ 	}
+@@ -632,8 +637,6 @@ static struct dma_async_tx_descriptor *b
+ 
+ 	if (flags & DMA_PREP_INTERRUPT)
+ 		async_desc->flags |= DESC_FLAG_EOT;
+-	else
+-		async_desc->flags |= DESC_FLAG_INT;
+ 
+ 	async_desc->num_desc = num_alloc;
+ 	async_desc->curr_desc = async_desc->desc;
+@@ -684,14 +687,16 @@ err_out:
+ static int bam_dma_terminate_all(struct dma_chan *chan)
+ {
+ 	struct bam_chan *bchan = to_bam_chan(chan);
++	struct bam_async_desc *async_desc, *tmp;
+ 	unsigned long flag;
+ 	LIST_HEAD(head);
+ 
+ 	/* remove all transactions, including active transaction */
+ 	spin_lock_irqsave(&bchan->vc.lock, flag);
+-	if (bchan->curr_txd) {
+-		list_add(&bchan->curr_txd->vd.node, &bchan->vc.desc_issued);
+-		bchan->curr_txd = NULL;
++	list_for_each_entry_safe(async_desc, tmp,
++				 &bchan->desc_list, desc_node) {
++		list_add(&async_desc->vd.node, &bchan->vc.desc_issued);
++		list_del(&async_desc->desc_node);
+ 	}
+ 
+ 	vchan_get_all_descriptors(&bchan->vc, &head);
+@@ -763,9 +768,9 @@ static int bam_resume(struct dma_chan *c
+  */
+ static u32 process_channel_irqs(struct bam_device *bdev)
+ {
+-	u32 i, srcs, pipe_stts;
++	u32 i, srcs, pipe_stts, offset, avail;
+ 	unsigned long flags;
+-	struct bam_async_desc *async_desc;
++	struct bam_async_desc *async_desc, *tmp;
+ 
+ 	srcs = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_SRCS_EE));
+ 
+@@ -785,27 +790,40 @@ static u32 process_channel_irqs(struct b
+ 		writel_relaxed(pipe_stts, bam_addr(bdev, i, BAM_P_IRQ_CLR));
+ 
+ 		spin_lock_irqsave(&bchan->vc.lock, flags);
+-		async_desc = bchan->curr_txd;
+ 
+-		if (async_desc) {
+-			async_desc->num_desc -= async_desc->xfer_len;
+-			async_desc->curr_desc += async_desc->xfer_len;
+-			bchan->curr_txd = NULL;
++		offset = readl_relaxed(bam_addr(bdev, i, BAM_P_SW_OFSTS)) &
++				       P_SW_OFSTS_MASK;
++		offset /= sizeof(struct bam_desc_hw);
++
++		/* Number of bytes available to read */
++		avail = CIRC_CNT(offset, bchan->head, MAX_DESCRIPTORS + 1);
++
++		list_for_each_entry_safe(async_desc, tmp,
++					 &bchan->desc_list, desc_node) {
++			/* Not enough data to read */
++			if (avail < async_desc->xfer_len)
++				break;
+ 
+ 			/* manage FIFO */
+ 			bchan->head += async_desc->xfer_len;
+ 			bchan->head %= MAX_DESCRIPTORS;
+ 
++			async_desc->num_desc -= async_desc->xfer_len;
++			async_desc->curr_desc += async_desc->xfer_len;
++			avail -= async_desc->xfer_len;
++
+ 			/*
+-			 * if complete, process cookie.  Otherwise
++			 * if complete, process cookie. Otherwise
+ 			 * push back to front of desc_issued so that
+ 			 * it gets restarted by the tasklet
+ 			 */
+-			if (!async_desc->num_desc)
++			if (!async_desc->num_desc) {
+ 				vchan_cookie_complete(&async_desc->vd);
+-			else
++			} else {
+ 				list_add(&async_desc->vd.node,
+-					&bchan->vc.desc_issued);
++					 &bchan->vc.desc_issued);
++			}
++			list_del(&async_desc->desc_node);
+ 		}
+ 
+ 		spin_unlock_irqrestore(&bchan->vc.lock, flags);
+@@ -867,6 +885,7 @@ static enum dma_status bam_tx_status(str
+ 		struct dma_tx_state *txstate)
+ {
+ 	struct bam_chan *bchan = to_bam_chan(chan);
++	struct bam_async_desc *async_desc;
+ 	struct virt_dma_desc *vd;
+ 	int ret;
+ 	size_t residue = 0;
+@@ -882,11 +901,17 @@ static enum dma_status bam_tx_status(str
+ 
+ 	spin_lock_irqsave(&bchan->vc.lock, flags);
+ 	vd = vchan_find_desc(&bchan->vc, cookie);
+-	if (vd)
++	if (vd) {
+ 		residue = container_of(vd, struct bam_async_desc, vd)->length;
+-	else if (bchan->curr_txd && bchan->curr_txd->vd.tx.cookie == cookie)
+-		for (i = 0; i < bchan->curr_txd->num_desc; i++)
+-			residue += bchan->curr_txd->curr_desc[i].size;
++	} else {
++		list_for_each_entry(async_desc, &bchan->desc_list, desc_node) {
++			if (async_desc->vd.tx.cookie != cookie)
++				continue;
++
++			for (i = 0; i < async_desc->num_desc; i++)
++				residue += async_desc->curr_desc[i].size;
++		}
++	}
+ 
+ 	spin_unlock_irqrestore(&bchan->vc.lock, flags);
+ 
+@@ -927,63 +952,86 @@ static void bam_start_dma(struct bam_cha
+ {
+ 	struct virt_dma_desc *vd = vchan_next_desc(&bchan->vc);
+ 	struct bam_device *bdev = bchan->bdev;
+-	struct bam_async_desc *async_desc;
++	struct bam_async_desc *async_desc = NULL;
+ 	struct bam_desc_hw *desc;
+ 	struct bam_desc_hw *fifo = PTR_ALIGN(bchan->fifo_virt,
+ 					sizeof(struct bam_desc_hw));
+ 	int ret;
++	unsigned int avail;
++	struct dmaengine_desc_callback cb;
+ 
+ 	lockdep_assert_held(&bchan->vc.lock);
+ 
+ 	if (!vd)
+ 		return;
+ 
+-	list_del(&vd->node);
+-
+-	async_desc = container_of(vd, struct bam_async_desc, vd);
+-	bchan->curr_txd = async_desc;
+-
+ 	ret = pm_runtime_get_sync(bdev->dev);
+ 	if (ret < 0)
+ 		return;
+ 
+-	/* on first use, initialize the channel hardware */
+-	if (!bchan->initialized)
+-		bam_chan_init_hw(bchan, async_desc->dir);
+-
+-	/* apply new slave config changes, if necessary */
+-	if (bchan->reconfigure)
+-		bam_apply_new_config(bchan, async_desc->dir);
++	while (vd && !IS_BUSY(bchan)) {
++		list_del(&vd->node);
+ 
+-	desc = bchan->curr_txd->curr_desc;
++		async_desc = container_of(vd, struct bam_async_desc, vd);
+ 
+-	if (async_desc->num_desc > MAX_DESCRIPTORS)
+-		async_desc->xfer_len = MAX_DESCRIPTORS;
+-	else
+-		async_desc->xfer_len = async_desc->num_desc;
++		/* on first use, initialize the channel hardware */
++		if (!bchan->initialized)
++			bam_chan_init_hw(bchan, async_desc->dir);
+ 
+-	/* set any special flags on the last descriptor */
+-	if (async_desc->num_desc == async_desc->xfer_len)
+-		desc[async_desc->xfer_len - 1].flags |=
+-					cpu_to_le16(async_desc->flags);
+-	else
+-		desc[async_desc->xfer_len - 1].flags |=
+-					cpu_to_le16(DESC_FLAG_INT);
++		/* apply new slave config changes, if necessary */
++		if (bchan->reconfigure)
++			bam_apply_new_config(bchan, async_desc->dir);
++
++		desc = async_desc->curr_desc;
++		avail = CIRC_SPACE(bchan->tail, bchan->head,
++				   MAX_DESCRIPTORS + 1);
++
++		if (async_desc->num_desc > avail)
++			async_desc->xfer_len = avail;
++		else
++			async_desc->xfer_len = async_desc->num_desc;
++
++		/* set any special flags on the last descriptor */
++		if (async_desc->num_desc == async_desc->xfer_len)
++			desc[async_desc->xfer_len - 1].flags |=
++						cpu_to_le16(async_desc->flags);
+ 
+-	if (bchan->tail + async_desc->xfer_len > MAX_DESCRIPTORS) {
+-		u32 partial = MAX_DESCRIPTORS - bchan->tail;
++		vd = vchan_next_desc(&bchan->vc);
+ 
+-		memcpy(&fifo[bchan->tail], desc,
+-				partial * sizeof(struct bam_desc_hw));
+-		memcpy(fifo, &desc[partial], (async_desc->xfer_len - partial) *
++		dmaengine_desc_get_callback(&async_desc->vd.tx, &cb);
++
++		/*
++		 * An interrupt is generated at this desc, if
++		 *  - FIFO is FULL.
++		 *  - No more descriptors to add.
++		 *  - If a callback completion was requested for this DESC,
++		 *     In this case, BAM will deliver the completion callback
++		 *     for this desc and continue processing the next desc.
++		 */
++		if (((avail <= async_desc->xfer_len) || !vd ||
++		     dmaengine_desc_callback_valid(&cb)) &&
++		    !(async_desc->flags & DESC_FLAG_EOT))
++			desc[async_desc->xfer_len - 1].flags |=
++				cpu_to_le16(DESC_FLAG_INT);
++
++		if (bchan->tail + async_desc->xfer_len > MAX_DESCRIPTORS) {
++			u32 partial = MAX_DESCRIPTORS - bchan->tail;
++
++			memcpy(&fifo[bchan->tail], desc,
++			       partial * sizeof(struct bam_desc_hw));
++			memcpy(fifo, &desc[partial],
++			       (async_desc->xfer_len - partial) *
+ 				sizeof(struct bam_desc_hw));
+-	} else {
+-		memcpy(&fifo[bchan->tail], desc,
+-			async_desc->xfer_len * sizeof(struct bam_desc_hw));
+-	}
++		} else {
++			memcpy(&fifo[bchan->tail], desc,
++			       async_desc->xfer_len *
++			       sizeof(struct bam_desc_hw));
++		}
+ 
+-	bchan->tail += async_desc->xfer_len;
+-	bchan->tail %= MAX_DESCRIPTORS;
++		bchan->tail += async_desc->xfer_len;
++		bchan->tail %= MAX_DESCRIPTORS;
++		list_add_tail(&async_desc->desc_node, &bchan->desc_list);
++	}
+ 
+ 	/* ensure descriptor writes and dma start not reordered */
+ 	wmb();
+@@ -1012,7 +1060,7 @@ static void dma_tasklet(unsigned long da
+ 		bchan = &bdev->channels[i];
+ 		spin_lock_irqsave(&bchan->vc.lock, flags);
+ 
+-		if (!list_empty(&bchan->vc.desc_issued) && !bchan->curr_txd)
++		if (!list_empty(&bchan->vc.desc_issued) && !IS_BUSY(bchan))
+ 			bam_start_dma(bchan);
+ 		spin_unlock_irqrestore(&bchan->vc.lock, flags);
+ 	}
+@@ -1033,7 +1081,7 @@ static void bam_issue_pending(struct dma
+ 	spin_lock_irqsave(&bchan->vc.lock, flags);
+ 
+ 	/* if work pending and idle, start a transaction */
+-	if (vchan_issue_pending(&bchan->vc) && !bchan->curr_txd)
++	if (vchan_issue_pending(&bchan->vc) && !IS_BUSY(bchan))
+ 		bam_start_dma(bchan);
+ 
+ 	spin_unlock_irqrestore(&bchan->vc.lock, flags);
+@@ -1133,6 +1181,7 @@ static void bam_channel_init(struct bam_
+ 
+ 	vchan_init(&bchan->vc, &bdev->common);
+ 	bchan->vc.desc_free = bam_dma_free_desc;
++	INIT_LIST_HEAD(&bchan->desc_list);
+ }
+ 
+ static const struct of_device_id bam_of_match[] = {
diff --git a/target/linux/ipq40xx/patches-4.14/050-0002-mtd-nand-qcom-add-command-elements-in-BAM-transactio.patch b/target/linux/ipq40xx/patches-4.14/050-0002-mtd-nand-qcom-add-command-elements-in-BAM-transactio.patch
new file mode 100644
index 000000000..1a32cc376
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/050-0002-mtd-nand-qcom-add-command-elements-in-BAM-transactio.patch
@@ -0,0 +1,89 @@
+From 8c4cdce8b1ab044a2ee1d86d5a086f67e32b3c10 Mon Sep 17 00:00:00 2001
+From: Abhishek Sahu <absahu@codeaurora.org>
+Date: Mon, 25 Sep 2017 13:21:25 +0530
+Subject: [PATCH 2/7] mtd: nand: qcom: add command elements in BAM transaction
+
+All the QPIC register read/write through BAM DMA requires
+command descriptor which contains the array of command elements.
+
+Reviewed-by: Archit Taneja <architt@codeaurora.org>
+Signed-off-by: Abhishek Sahu <absahu@codeaurora.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+---
+ drivers/mtd/nand/qcom_nandc.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/qcom_nandc.c
++++ b/drivers/mtd/nand/qcom_nandc.c
+@@ -22,6 +22,7 @@
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+ #include <linux/delay.h>
++#include <linux/dma/qcom_bam_dma.h>
+ 
+ /* NANDc reg offsets */
+ #define	NAND_FLASH_CMD			0x00
+@@ -199,6 +200,7 @@ nandc_set_reg(nandc, NAND_READ_LOCATION_
+  */
+ #define dev_cmd_reg_addr(nandc, reg) ((nandc)->props->dev_cmd_reg_start + (reg))
+ 
++#define QPIC_PER_CW_CMD_ELEMENTS	32
+ #define QPIC_PER_CW_CMD_SGL		32
+ #define QPIC_PER_CW_DATA_SGL		8
+ 
+@@ -221,8 +223,13 @@ nandc_set_reg(nandc, NAND_READ_LOCATION_
+ /*
+  * This data type corresponds to the BAM transaction which will be used for all
+  * NAND transfers.
++ * @bam_ce - the array of BAM command elements
+  * @cmd_sgl - sgl for NAND BAM command pipe
+  * @data_sgl - sgl for NAND BAM consumer/producer pipe
++ * @bam_ce_pos - the index in bam_ce which is available for next sgl
++ * @bam_ce_start - the index in bam_ce which marks the start position ce
++ *		   for current sgl. It will be used for size calculation
++ *		   for current sgl
+  * @cmd_sgl_pos - current index in command sgl.
+  * @cmd_sgl_start - start index in command sgl.
+  * @tx_sgl_pos - current index in data sgl for tx.
+@@ -231,8 +238,11 @@ nandc_set_reg(nandc, NAND_READ_LOCATION_
+  * @rx_sgl_start - start index in data sgl for rx.
+  */
+ struct bam_transaction {
++	struct bam_cmd_element *bam_ce;
+ 	struct scatterlist *cmd_sgl;
+ 	struct scatterlist *data_sgl;
++	u32 bam_ce_pos;
++	u32 bam_ce_start;
+ 	u32 cmd_sgl_pos;
+ 	u32 cmd_sgl_start;
+ 	u32 tx_sgl_pos;
+@@ -462,7 +472,8 @@ alloc_bam_transaction(struct qcom_nand_c
+ 
+ 	bam_txn_size =
+ 		sizeof(*bam_txn) + num_cw *
+-		((sizeof(*bam_txn->cmd_sgl) * QPIC_PER_CW_CMD_SGL) +
++		((sizeof(*bam_txn->bam_ce) * QPIC_PER_CW_CMD_ELEMENTS) +
++		(sizeof(*bam_txn->cmd_sgl) * QPIC_PER_CW_CMD_SGL) +
+ 		(sizeof(*bam_txn->data_sgl) * QPIC_PER_CW_DATA_SGL));
+ 
+ 	bam_txn_buf = devm_kzalloc(nandc->dev, bam_txn_size, GFP_KERNEL);
+@@ -472,6 +483,10 @@ alloc_bam_transaction(struct qcom_nand_c
+ 	bam_txn = bam_txn_buf;
+ 	bam_txn_buf += sizeof(*bam_txn);
+ 
++	bam_txn->bam_ce = bam_txn_buf;
++	bam_txn_buf +=
++		sizeof(*bam_txn->bam_ce) * QPIC_PER_CW_CMD_ELEMENTS * num_cw;
++
+ 	bam_txn->cmd_sgl = bam_txn_buf;
+ 	bam_txn_buf +=
+ 		sizeof(*bam_txn->cmd_sgl) * QPIC_PER_CW_CMD_SGL * num_cw;
+@@ -489,6 +504,8 @@ static void clear_bam_transaction(struct
+ 	if (!nandc->props->is_bam)
+ 		return;
+ 
++	bam_txn->bam_ce_pos = 0;
++	bam_txn->bam_ce_start = 0;
+ 	bam_txn->cmd_sgl_pos = 0;
+ 	bam_txn->cmd_sgl_start = 0;
+ 	bam_txn->tx_sgl_pos = 0;
diff --git a/target/linux/ipq40xx/patches-4.14/050-0003-mtd-nand-qcom-support-for-command-descriptor-formati.patch b/target/linux/ipq40xx/patches-4.14/050-0003-mtd-nand-qcom-support-for-command-descriptor-formati.patch
new file mode 100644
index 000000000..8dd209b91
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/050-0003-mtd-nand-qcom-support-for-command-descriptor-formati.patch
@@ -0,0 +1,201 @@
+From 8d6b6d7e135e9bbfc923d34a45cb0e72695e63ed Mon Sep 17 00:00:00 2001
+From: Abhishek Sahu <absahu@codeaurora.org>
+Date: Mon, 25 Sep 2017 13:21:26 +0530
+Subject: [PATCH 3/7] mtd: nand: qcom: support for command descriptor formation
+
+1. Add the function for command descriptor preparation which will
+   be used only by BAM DMA and it will form the DMA descriptors
+   containing command elements
+2. DMA_PREP_CMD flag should be used for forming command DMA
+   descriptors
+
+Reviewed-by: Archit Taneja <architt@codeaurora.org>
+Signed-off-by: Abhishek Sahu <absahu@codeaurora.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+---
+ drivers/mtd/nand/qcom_nandc.c | 108 +++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 92 insertions(+), 16 deletions(-)
+
+--- a/drivers/mtd/nand/qcom_nandc.c
++++ b/drivers/mtd/nand/qcom_nandc.c
+@@ -200,6 +200,14 @@ nandc_set_reg(nandc, NAND_READ_LOCATION_
+  */
+ #define dev_cmd_reg_addr(nandc, reg) ((nandc)->props->dev_cmd_reg_start + (reg))
+ 
++/* Returns the NAND register physical address */
++#define nandc_reg_phys(chip, offset) ((chip)->base_phys + (offset))
++
++/* Returns the dma address for reg read buffer */
++#define reg_buf_dma_addr(chip, vaddr) \
++	((chip)->reg_read_dma + \
++	((uint8_t *)(vaddr) - (uint8_t *)(chip)->reg_read_buf))
++
+ #define QPIC_PER_CW_CMD_ELEMENTS	32
+ #define QPIC_PER_CW_CMD_SGL		32
+ #define QPIC_PER_CW_DATA_SGL		8
+@@ -317,7 +325,8 @@ struct nandc_regs {
+  *				controller
+  * @dev:			parent device
+  * @base:			MMIO base
+- * @base_dma:			physical base address of controller registers
++ * @base_phys:			physical base address of controller registers
++ * @base_dma:			dma base address of controller registers
+  * @core_clk:			controller clock
+  * @aon_clk:			another controller clock
+  *
+@@ -350,6 +359,7 @@ struct qcom_nand_controller {
+ 	struct device *dev;
+ 
+ 	void __iomem *base;
++	phys_addr_t base_phys;
+ 	dma_addr_t base_dma;
+ 
+ 	struct clk *core_clk;
+@@ -751,6 +761,66 @@ static int prepare_bam_async_desc(struct
+ }
+ 
+ /*
++ * Prepares the command descriptor for BAM DMA which will be used for NAND
++ * register reads and writes. The command descriptor requires the command
++ * to be formed in command element type so this function uses the command
++ * element from bam transaction ce array and fills the same with required
++ * data. A single SGL can contain multiple command elements so
++ * NAND_BAM_NEXT_SGL will be used for starting the separate SGL
++ * after the current command element.
++ */
++static int prep_bam_dma_desc_cmd(struct qcom_nand_controller *nandc, bool read,
++				 int reg_off, const void *vaddr,
++				 int size, unsigned int flags)
++{
++	int bam_ce_size;
++	int i, ret;
++	struct bam_cmd_element *bam_ce_buffer;
++	struct bam_transaction *bam_txn = nandc->bam_txn;
++
++	bam_ce_buffer = &bam_txn->bam_ce[bam_txn->bam_ce_pos];
++
++	/* fill the command desc */
++	for (i = 0; i < size; i++) {
++		if (read)
++			bam_prep_ce(&bam_ce_buffer[i],
++				    nandc_reg_phys(nandc, reg_off + 4 * i),
++				    BAM_READ_COMMAND,
++				    reg_buf_dma_addr(nandc,
++						     (__le32 *)vaddr + i));
++		else
++			bam_prep_ce_le32(&bam_ce_buffer[i],
++					 nandc_reg_phys(nandc, reg_off + 4 * i),
++					 BAM_WRITE_COMMAND,
++					 *((__le32 *)vaddr + i));
++	}
++
++	bam_txn->bam_ce_pos += size;
++
++	/* use the separate sgl after this command */
++	if (flags & NAND_BAM_NEXT_SGL) {
++		bam_ce_buffer = &bam_txn->bam_ce[bam_txn->bam_ce_start];
++		bam_ce_size = (bam_txn->bam_ce_pos -
++				bam_txn->bam_ce_start) *
++				sizeof(struct bam_cmd_element);
++		sg_set_buf(&bam_txn->cmd_sgl[bam_txn->cmd_sgl_pos],
++			   bam_ce_buffer, bam_ce_size);
++		bam_txn->cmd_sgl_pos++;
++		bam_txn->bam_ce_start = bam_txn->bam_ce_pos;
++
++		if (flags & NAND_BAM_NWD) {
++			ret = prepare_bam_async_desc(nandc, nandc->cmd_chan,
++						     DMA_PREP_FENCE |
++						     DMA_PREP_CMD);
++			if (ret)
++				return ret;
++		}
++	}
++
++	return 0;
++}
++
++/*
+  * Prepares the data descriptor for BAM DMA which will be used for NAND
+  * data reads and writes.
+  */
+@@ -868,19 +938,22 @@ static int read_reg_dma(struct qcom_nand
+ {
+ 	bool flow_control = false;
+ 	void *vaddr;
+-	int size;
+ 
+-	if (first == NAND_READ_ID || first == NAND_FLASH_STATUS)
+-		flow_control = true;
++	vaddr = nandc->reg_read_buf + nandc->reg_read_pos;
++	nandc->reg_read_pos += num_regs;
+ 
+ 	if (first == NAND_DEV_CMD_VLD || first == NAND_DEV_CMD1)
+ 		first = dev_cmd_reg_addr(nandc, first);
+ 
+-	size = num_regs * sizeof(u32);
+-	vaddr = nandc->reg_read_buf + nandc->reg_read_pos;
+-	nandc->reg_read_pos += num_regs;
++	if (nandc->props->is_bam)
++		return prep_bam_dma_desc_cmd(nandc, true, first, vaddr,
++					     num_regs, flags);
++
++	if (first == NAND_READ_ID || first == NAND_FLASH_STATUS)
++		flow_control = true;
+ 
+-	return prep_adm_dma_desc(nandc, true, first, vaddr, size, flow_control);
++	return prep_adm_dma_desc(nandc, true, first, vaddr,
++				 num_regs * sizeof(u32), flow_control);
+ }
+ 
+ /*
+@@ -897,13 +970,9 @@ static int write_reg_dma(struct qcom_nan
+ 	bool flow_control = false;
+ 	struct nandc_regs *regs = nandc->regs;
+ 	void *vaddr;
+-	int size;
+ 
+ 	vaddr = offset_to_nandc_reg(regs, first);
+ 
+-	if (first == NAND_FLASH_CMD)
+-		flow_control = true;
+-
+ 	if (first == NAND_ERASED_CW_DETECT_CFG) {
+ 		if (flags & NAND_ERASED_CW_SET)
+ 			vaddr = &regs->erased_cw_detect_cfg_set;
+@@ -920,10 +989,15 @@ static int write_reg_dma(struct qcom_nan
+ 	if (first == NAND_DEV_CMD_VLD_RESTORE || first == NAND_DEV_CMD_VLD)
+ 		first = dev_cmd_reg_addr(nandc, NAND_DEV_CMD_VLD);
+ 
+-	size = num_regs * sizeof(u32);
++	if (nandc->props->is_bam)
++		return prep_bam_dma_desc_cmd(nandc, false, first, vaddr,
++					     num_regs, flags);
++
++	if (first == NAND_FLASH_CMD)
++		flow_control = true;
+ 
+-	return prep_adm_dma_desc(nandc, false, first, vaddr, size,
+-				 flow_control);
++	return prep_adm_dma_desc(nandc, false, first, vaddr,
++				 num_regs * sizeof(u32), flow_control);
+ }
+ 
+ /*
+@@ -1187,7 +1261,8 @@ static int submit_descs(struct qcom_nand
+ 		}
+ 
+ 		if (bam_txn->cmd_sgl_pos > bam_txn->cmd_sgl_start) {
+-			r = prepare_bam_async_desc(nandc, nandc->cmd_chan, 0);
++			r = prepare_bam_async_desc(nandc, nandc->cmd_chan,
++						   DMA_PREP_CMD);
+ 			if (r)
+ 				return r;
+ 		}
+@@ -2722,6 +2797,7 @@ static int qcom_nandc_probe(struct platf
+ 	if (IS_ERR(nandc->base))
+ 		return PTR_ERR(nandc->base);
+ 
++	nandc->base_phys = res->start;
+ 	nandc->base_dma = phys_to_dma(dev, (phys_addr_t)res->start);
+ 
+ 	nandc->core_clk = devm_clk_get(dev, "core");
diff --git a/target/linux/ipq40xx/patches-4.14/050-0004-mtd-nand-provide-several-helpers-to-do-common-NAND-o.patch b/target/linux/ipq40xx/patches-4.14/050-0004-mtd-nand-provide-several-helpers-to-do-common-NAND-o.patch
new file mode 100644
index 000000000..03dcb0755
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/050-0004-mtd-nand-provide-several-helpers-to-do-common-NAND-o.patch
@@ -0,0 +1,1586 @@
+commit 97d90da8a886949f09bb4754843fb0b504956ad2
+Author: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date:   Thu Nov 30 18:01:29 2017 +0100
+
+    mtd: nand: provide several helpers to do common NAND operations
+    
+    This is part of the process of removing direct calls to ->cmdfunc()
+    outside of the core in order to introduce a better interface to execute
+    NAND operations.
+    
+    Here we provide several helpers and make use of them to remove all
+    direct calls to ->cmdfunc(). This way, we can easily modify those
+    helpers to make use of the new ->exec_op() interface when available.
+    
+    Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+    [miquel.raynal@free-electrons.com: rebased and fixed some conflicts]
+    Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+    Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -561,14 +561,19 @@ static int nand_block_markbad_lowlevel(s
+ static int nand_check_wp(struct mtd_info *mtd)
+ {
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
++	u8 status;
++	int ret;
+ 
+ 	/* Broken xD cards report WP despite being writable */
+ 	if (chip->options & NAND_BROKEN_XD)
+ 		return 0;
+ 
+ 	/* Check the WP bit */
+-	chip->cmdfunc(mtd, NAND_CMD_STATUS, -1, -1);
+-	return (chip->read_byte(mtd) & NAND_STATUS_WP) ? 0 : 1;
++	ret = nand_status_op(chip, &status);
++	if (ret)
++		return ret;
++
++	return status & NAND_STATUS_WP ? 0 : 1;
+ }
+ 
+ /**
+@@ -667,10 +672,17 @@ EXPORT_SYMBOL_GPL(nand_wait_ready);
+ static void nand_wait_status_ready(struct mtd_info *mtd, unsigned long timeo)
+ {
+ 	register struct nand_chip *chip = mtd_to_nand(mtd);
++	int ret;
+ 
+ 	timeo = jiffies + msecs_to_jiffies(timeo);
+ 	do {
+-		if ((chip->read_byte(mtd) & NAND_STATUS_READY))
++		u8 status;
++
++		ret = nand_read_data_op(chip, &status, sizeof(status), true);
++		if (ret)
++			return;
++
++		if (status & NAND_STATUS_READY)
+ 			break;
+ 		touch_softlockup_watchdog();
+ 	} while (time_before(jiffies, timeo));
+@@ -1021,7 +1033,15 @@ static void panic_nand_wait(struct mtd_i
+ 			if (chip->dev_ready(mtd))
+ 				break;
+ 		} else {
+-			if (chip->read_byte(mtd) & NAND_STATUS_READY)
++			int ret;
++			u8 status;
++
++			ret = nand_read_data_op(chip, &status, sizeof(status),
++						true);
++			if (ret)
++				return;
++
++			if (status & NAND_STATUS_READY)
+ 				break;
+ 		}
+ 		mdelay(1);
+@@ -1038,8 +1058,9 @@ static void panic_nand_wait(struct mtd_i
+ static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip)
+ {
+ 
+-	int status;
+ 	unsigned long timeo = 400;
++	u8 status;
++	int ret;
+ 
+ 	/*
+ 	 * Apply this short delay always to ensure that we do wait tWB in any
+@@ -1047,7 +1068,9 @@ static int nand_wait(struct mtd_info *mt
+ 	 */
+ 	ndelay(100);
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_STATUS, -1, -1);
++	ret = nand_status_op(chip, NULL);
++	if (ret)
++		return ret;
+ 
+ 	if (in_interrupt() || oops_in_progress)
+ 		panic_nand_wait(mtd, chip, timeo);
+@@ -1058,14 +1081,22 @@ static int nand_wait(struct mtd_info *mt
+ 				if (chip->dev_ready(mtd))
+ 					break;
+ 			} else {
+-				if (chip->read_byte(mtd) & NAND_STATUS_READY)
++				ret = nand_read_data_op(chip, &status,
++							sizeof(status), true);
++				if (ret)
++					return ret;
++
++				if (status & NAND_STATUS_READY)
+ 					break;
+ 			}
+ 			cond_resched();
+ 		} while (time_before(jiffies, timeo));
+ 	}
+ 
+-	status = (int)chip->read_byte(mtd);
++	ret = nand_read_data_op(chip, &status, sizeof(status), true);
++	if (ret)
++		return ret;
++
+ 	/* This can happen if in case of timeout or buggy dev_ready */
+ 	WARN_ON(!(status & NAND_STATUS_READY));
+ 	return status;
+@@ -1220,6 +1251,516 @@ static void nand_release_data_interface(
+ }
+ 
+ /**
++ * nand_read_page_op - Do a READ PAGE operation
++ * @chip: The NAND chip
++ * @page: page to read
++ * @offset_in_page: offset within the page
++ * @buf: buffer used to store the data
++ * @len: length of the buffer
++ *
++ * This function issues a READ PAGE operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_read_page_op(struct nand_chip *chip, unsigned int page,
++		      unsigned int offset_in_page, void *buf, unsigned int len)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (len && !buf)
++		return -EINVAL;
++
++	if (offset_in_page + len > mtd->writesize + mtd->oobsize)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_READ0, offset_in_page, page);
++	if (len)
++		chip->read_buf(mtd, buf, len);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_read_page_op);
++
++/**
++ * nand_read_param_page_op - Do a READ PARAMETER PAGE operation
++ * @chip: The NAND chip
++ * @page: parameter page to read
++ * @buf: buffer used to store the data
++ * @len: length of the buffer
++ *
++ * This function issues a READ PARAMETER PAGE operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++static int nand_read_param_page_op(struct nand_chip *chip, u8 page, void *buf,
++				   unsigned int len)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	unsigned int i;
++	u8 *p = buf;
++
++	if (len && !buf)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_PARAM, page, -1);
++	for (i = 0; i < len; i++)
++		p[i] = chip->read_byte(mtd);
++
++	return 0;
++}
++
++/**
++ * nand_change_read_column_op - Do a CHANGE READ COLUMN operation
++ * @chip: The NAND chip
++ * @offset_in_page: offset within the page
++ * @buf: buffer used to store the data
++ * @len: length of the buffer
++ * @force_8bit: force 8-bit bus access
++ *
++ * This function issues a CHANGE READ COLUMN operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_change_read_column_op(struct nand_chip *chip,
++			       unsigned int offset_in_page, void *buf,
++			       unsigned int len, bool force_8bit)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (len && !buf)
++		return -EINVAL;
++
++	if (offset_in_page + len > mtd->writesize + mtd->oobsize)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_RNDOUT, offset_in_page, -1);
++	if (len)
++		chip->read_buf(mtd, buf, len);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_change_read_column_op);
++
++/**
++ * nand_read_oob_op - Do a READ OOB operation
++ * @chip: The NAND chip
++ * @page: page to read
++ * @offset_in_oob: offset within the OOB area
++ * @buf: buffer used to store the data
++ * @len: length of the buffer
++ *
++ * This function issues a READ OOB operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_read_oob_op(struct nand_chip *chip, unsigned int page,
++		     unsigned int offset_in_oob, void *buf, unsigned int len)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (len && !buf)
++		return -EINVAL;
++
++	if (offset_in_oob + len > mtd->oobsize)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_READOOB, offset_in_oob, page);
++	if (len)
++		chip->read_buf(mtd, buf, len);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_read_oob_op);
++
++/**
++ * nand_prog_page_begin_op - starts a PROG PAGE operation
++ * @chip: The NAND chip
++ * @page: page to write
++ * @offset_in_page: offset within the page
++ * @buf: buffer containing the data to write to the page
++ * @len: length of the buffer
++ *
++ * This function issues the first half of a PROG PAGE operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_prog_page_begin_op(struct nand_chip *chip, unsigned int page,
++			    unsigned int offset_in_page, const void *buf,
++			    unsigned int len)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (len && !buf)
++		return -EINVAL;
++
++	if (offset_in_page + len > mtd->writesize + mtd->oobsize)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_SEQIN, offset_in_page, page);
++
++	if (buf)
++		chip->write_buf(mtd, buf, len);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_prog_page_begin_op);
++
++/**
++ * nand_prog_page_end_op - ends a PROG PAGE operation
++ * @chip: The NAND chip
++ *
++ * This function issues the second half of a PROG PAGE operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_prog_page_end_op(struct nand_chip *chip)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	int status;
++
++	chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
++
++	status = chip->waitfunc(mtd, chip);
++	if (status & NAND_STATUS_FAIL)
++		return -EIO;
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_prog_page_end_op);
++
++/**
++ * nand_prog_page_op - Do a full PROG PAGE operation
++ * @chip: The NAND chip
++ * @page: page to write
++ * @offset_in_page: offset within the page
++ * @buf: buffer containing the data to write to the page
++ * @len: length of the buffer
++ *
++ * This function issues a full PROG PAGE operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_prog_page_op(struct nand_chip *chip, unsigned int page,
++		      unsigned int offset_in_page, const void *buf,
++		      unsigned int len)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	int status;
++
++	if (!len || !buf)
++		return -EINVAL;
++
++	if (offset_in_page + len > mtd->writesize + mtd->oobsize)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_SEQIN, offset_in_page, page);
++	chip->write_buf(mtd, buf, len);
++	chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
++
++	status = chip->waitfunc(mtd, chip);
++	if (status & NAND_STATUS_FAIL)
++		return -EIO;
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_prog_page_op);
++
++/**
++ * nand_change_write_column_op - Do a CHANGE WRITE COLUMN operation
++ * @chip: The NAND chip
++ * @offset_in_page: offset within the page
++ * @buf: buffer containing the data to send to the NAND
++ * @len: length of the buffer
++ * @force_8bit: force 8-bit bus access
++ *
++ * This function issues a CHANGE WRITE COLUMN operation.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_change_write_column_op(struct nand_chip *chip,
++				unsigned int offset_in_page,
++				const void *buf, unsigned int len,
++				bool force_8bit)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (len && !buf)
++		return -EINVAL;
++
++	if (offset_in_page + len > mtd->writesize + mtd->oobsize)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_RNDIN, offset_in_page, -1);
++	if (len)
++		chip->write_buf(mtd, buf, len);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_change_write_column_op);
++
++/**
++ * nand_readid_op - Do a READID operation
++ * @chip: The NAND chip
++ * @addr: address cycle to pass after the READID command
++ * @buf: buffer used to store the ID
++ * @len: length of the buffer
++ *
++ * This function sends a READID command and reads back the ID returned by the
++ * NAND.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_readid_op(struct nand_chip *chip, u8 addr, void *buf,
++		   unsigned int len)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	unsigned int i;
++	u8 *id = buf;
++
++	if (len && !buf)
++		return -EINVAL;
++
++	chip->cmdfunc(mtd, NAND_CMD_READID, addr, -1);
++
++	for (i = 0; i < len; i++)
++		id[i] = chip->read_byte(mtd);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_readid_op);
++
++/**
++ * nand_status_op - Do a STATUS operation
++ * @chip: The NAND chip
++ * @status: out variable to store the NAND status
++ *
++ * This function sends a STATUS command and reads back the status returned by
++ * the NAND.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_status_op(struct nand_chip *chip, u8 *status)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	chip->cmdfunc(mtd, NAND_CMD_STATUS, -1, -1);
++	if (status)
++		*status = chip->read_byte(mtd);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_status_op);
++
++/**
++ * nand_exit_status_op - Exit a STATUS operation
++ * @chip: The NAND chip
++ *
++ * This function sends a READ0 command to cancel the effect of the STATUS
++ * command to avoid reading only the status until a new read command is sent.
++ *
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_exit_status_op(struct nand_chip *chip)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	chip->cmdfunc(mtd, NAND_CMD_READ0, -1, -1);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_exit_status_op);
++
++/**
++ * nand_erase_op - Do an erase operation
++ * @chip: The NAND chip
++ * @eraseblock: block to erase
++ *
++ * This function sends an ERASE command and waits for the NAND to be ready
++ * before returning.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_erase_op(struct nand_chip *chip, unsigned int eraseblock)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	unsigned int page = eraseblock <<
++			    (chip->phys_erase_shift - chip->page_shift);
++	int status;
++
++	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
++	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
++
++	status = chip->waitfunc(mtd, chip);
++	if (status < 0)
++		return status;
++
++	if (status & NAND_STATUS_FAIL)
++		return -EIO;
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_erase_op);
++
++/**
++ * nand_set_features_op - Do a SET FEATURES operation
++ * @chip: The NAND chip
++ * @feature: feature id
++ * @data: 4 bytes of data
++ *
++ * This function sends a SET FEATURES command and waits for the NAND to be
++ * ready before returning.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++static int nand_set_features_op(struct nand_chip *chip, u8 feature,
++				const void *data)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	const u8 *params = data;
++	int i, status;
++
++	chip->cmdfunc(mtd, NAND_CMD_SET_FEATURES, feature, -1);
++	for (i = 0; i < ONFI_SUBFEATURE_PARAM_LEN; ++i)
++		chip->write_byte(mtd, params[i]);
++
++	status = chip->waitfunc(mtd, chip);
++	if (status & NAND_STATUS_FAIL)
++		return -EIO;
++
++	return 0;
++}
++
++/**
++ * nand_get_features_op - Do a GET FEATURES operation
++ * @chip: The NAND chip
++ * @feature: feature id
++ * @data: 4 bytes of data
++ *
++ * This function sends a GET FEATURES command and waits for the NAND to be
++ * ready before returning.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++static int nand_get_features_op(struct nand_chip *chip, u8 feature,
++				void *data)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++	u8 *params = data;
++	int i;
++
++	chip->cmdfunc(mtd, NAND_CMD_GET_FEATURES, feature, -1);
++	for (i = 0; i < ONFI_SUBFEATURE_PARAM_LEN; ++i)
++		params[i] = chip->read_byte(mtd);
++
++	return 0;
++}
++
++/**
++ * nand_reset_op - Do a reset operation
++ * @chip: The NAND chip
++ *
++ * This function sends a RESET command and waits for the NAND to be ready
++ * before returning.
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_reset_op(struct nand_chip *chip)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	chip->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_reset_op);
++
++/**
++ * nand_read_data_op - Read data from the NAND
++ * @chip: The NAND chip
++ * @buf: buffer used to store the data
++ * @len: length of the buffer
++ * @force_8bit: force 8-bit bus access
++ *
++ * This function does a raw data read on the bus. Usually used after launching
++ * another NAND operation like nand_read_page_op().
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_read_data_op(struct nand_chip *chip, void *buf, unsigned int len,
++		      bool force_8bit)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (!len || !buf)
++		return -EINVAL;
++
++	if (force_8bit) {
++		u8 *p = buf;
++		unsigned int i;
++
++		for (i = 0; i < len; i++)
++			p[i] = chip->read_byte(mtd);
++	} else {
++		chip->read_buf(mtd, buf, len);
++	}
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_read_data_op);
++
++/**
++ * nand_write_data_op - Write data from the NAND
++ * @chip: The NAND chip
++ * @buf: buffer containing the data to send on the bus
++ * @len: length of the buffer
++ * @force_8bit: force 8-bit bus access
++ *
++ * This function does a raw data write on the bus. Usually used after launching
++ * another NAND operation like nand_write_page_begin_op().
++ * This function does not select/unselect the CS line.
++ *
++ * Returns 0 on success, a negative error code otherwise.
++ */
++int nand_write_data_op(struct nand_chip *chip, const void *buf,
++		       unsigned int len, bool force_8bit)
++{
++	struct mtd_info *mtd = nand_to_mtd(chip);
++
++	if (!len || !buf)
++		return -EINVAL;
++
++	if (force_8bit) {
++		const u8 *p = buf;
++		unsigned int i;
++
++		for (i = 0; i < len; i++)
++			chip->write_byte(mtd, p[i]);
++	} else {
++		chip->write_buf(mtd, buf, len);
++	}
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(nand_write_data_op);
++
++/**
+  * nand_reset - Reset and initialize a NAND device
+  * @chip: The NAND chip
+  * @chipnr: Internal die id
+@@ -1240,8 +1781,10 @@ int nand_reset(struct nand_chip *chip, i
+ 	 * interface settings, hence this weird ->select_chip() dance.
+ 	 */
+ 	chip->select_chip(mtd, chipnr);
+-	chip->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
++	ret = nand_reset_op(chip);
+ 	chip->select_chip(mtd, -1);
++	if (ret)
++		return ret;
+ 
+ 	chip->select_chip(mtd, chipnr);
+ 	ret = nand_setup_data_interface(chip, chipnr);
+@@ -1397,9 +1940,19 @@ EXPORT_SYMBOL(nand_check_erased_ecc_chun
+ int nand_read_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
+ 		       uint8_t *buf, int oob_required, int page)
+ {
+-	chip->read_buf(mtd, buf, mtd->writesize);
+-	if (oob_required)
+-		chip->read_buf(mtd, chip->oob_poi, mtd->oobsize);
++	int ret;
++
++	ret = nand_read_data_op(chip, buf, mtd->writesize, false);
++	if (ret)
++		return ret;
++
++	if (oob_required) {
++		ret = nand_read_data_op(chip, chip->oob_poi, mtd->oobsize,
++					false);
++		if (ret)
++			return ret;
++	}
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(nand_read_page_raw);
+@@ -1421,29 +1974,46 @@ static int nand_read_page_raw_syndrome(s
+ 	int eccsize = chip->ecc.size;
+ 	int eccbytes = chip->ecc.bytes;
+ 	uint8_t *oob = chip->oob_poi;
+-	int steps, size;
++	int steps, size, ret;
+ 
+ 	for (steps = chip->ecc.steps; steps > 0; steps--) {
+-		chip->read_buf(mtd, buf, eccsize);
++		ret = nand_read_data_op(chip, buf, eccsize, false);
++		if (ret)
++			return ret;
++
+ 		buf += eccsize;
+ 
+ 		if (chip->ecc.prepad) {
+-			chip->read_buf(mtd, oob, chip->ecc.prepad);
++			ret = nand_read_data_op(chip, oob, chip->ecc.prepad,
++						false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.prepad;
+ 		}
+ 
+-		chip->read_buf(mtd, oob, eccbytes);
++		ret = nand_read_data_op(chip, oob, eccbytes, false);
++		if (ret)
++			return ret;
++
+ 		oob += eccbytes;
+ 
+ 		if (chip->ecc.postpad) {
+-			chip->read_buf(mtd, oob, chip->ecc.postpad);
++			ret = nand_read_data_op(chip, oob, chip->ecc.postpad,
++						false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.postpad;
+ 		}
+ 	}
+ 
+ 	size = mtd->oobsize - (oob - chip->oob_poi);
+-	if (size)
+-		chip->read_buf(mtd, oob, size);
++	if (size) {
++		ret = nand_read_data_op(chip, oob, size, false);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+@@ -1532,7 +2102,9 @@ static int nand_read_subpage(struct mtd_
+ 		chip->cmdfunc(mtd, NAND_CMD_RNDOUT, data_col_addr, -1);
+ 
+ 	p = bufpoi + data_col_addr;
+-	chip->read_buf(mtd, p, datafrag_len);
++	ret = nand_read_data_op(chip, p, datafrag_len, false);
++	if (ret)
++		return ret;
+ 
+ 	/* Calculate ECC */
+ 	for (i = 0; i < eccfrag_len ; i += chip->ecc.bytes, p += chip->ecc.size)
+@@ -1550,8 +2122,11 @@ static int nand_read_subpage(struct mtd_
+ 		gaps = 1;
+ 
+ 	if (gaps) {
+-		chip->cmdfunc(mtd, NAND_CMD_RNDOUT, mtd->writesize, -1);
+-		chip->read_buf(mtd, chip->oob_poi, mtd->oobsize);
++		ret = nand_change_read_column_op(chip, mtd->writesize,
++						 chip->oob_poi, mtd->oobsize,
++						 false);
++		if (ret)
++			return ret;
+ 	} else {
+ 		/*
+ 		 * Send the command to read the particular ECC bytes take care
+@@ -1565,9 +2140,12 @@ static int nand_read_subpage(struct mtd_
+ 		    (busw - 1))
+ 			aligned_len++;
+ 
+-		chip->cmdfunc(mtd, NAND_CMD_RNDOUT,
+-			      mtd->writesize + aligned_pos, -1);
+-		chip->read_buf(mtd, &chip->oob_poi[aligned_pos], aligned_len);
++		ret = nand_change_read_column_op(chip,
++						 mtd->writesize + aligned_pos,
++						 &chip->oob_poi[aligned_pos],
++						 aligned_len, false);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	ret = mtd_ooblayout_get_eccbytes(mtd, chip->buffers->ecccode,
+@@ -1624,10 +2202,17 @@ static int nand_read_page_hwecc(struct m
+ 
+ 	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
+ 		chip->ecc.hwctl(mtd, NAND_ECC_READ);
+-		chip->read_buf(mtd, p, eccsize);
++
++		ret = nand_read_data_op(chip, p, eccsize, false);
++		if (ret)
++			return ret;
++
+ 		chip->ecc.calculate(mtd, p, &ecc_calc[i]);
+ 	}
+-	chip->read_buf(mtd, chip->oob_poi, mtd->oobsize);
++
++	ret = nand_read_data_op(chip, chip->oob_poi, mtd->oobsize, false);
++	if (ret)
++		return ret;
+ 
+ 	ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
+ 					 chip->ecc.total);
+@@ -1686,9 +2271,13 @@ static int nand_read_page_hwecc_oob_firs
+ 	unsigned int max_bitflips = 0;
+ 
+ 	/* Read the OOB area first */
+-	chip->cmdfunc(mtd, NAND_CMD_READOOB, 0, page);
+-	chip->read_buf(mtd, chip->oob_poi, mtd->oobsize);
+-	chip->cmdfunc(mtd, NAND_CMD_READ0, 0, page);
++	ret = nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
++	if (ret)
++		return ret;
++
++	ret = nand_read_page_op(chip, page, 0, NULL, 0);
++	if (ret)
++		return ret;
+ 
+ 	ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
+ 					 chip->ecc.total);
+@@ -1699,7 +2288,11 @@ static int nand_read_page_hwecc_oob_firs
+ 		int stat;
+ 
+ 		chip->ecc.hwctl(mtd, NAND_ECC_READ);
+-		chip->read_buf(mtd, p, eccsize);
++
++		ret = nand_read_data_op(chip, p, eccsize, false);
++		if (ret)
++			return ret;
++
+ 		chip->ecc.calculate(mtd, p, &ecc_calc[i]);
+ 
+ 		stat = chip->ecc.correct(mtd, p, &ecc_code[i], NULL);
+@@ -1736,7 +2329,7 @@ static int nand_read_page_hwecc_oob_firs
+ static int nand_read_page_syndrome(struct mtd_info *mtd, struct nand_chip *chip,
+ 				   uint8_t *buf, int oob_required, int page)
+ {
+-	int i, eccsize = chip->ecc.size;
++	int ret, i, eccsize = chip->ecc.size;
+ 	int eccbytes = chip->ecc.bytes;
+ 	int eccsteps = chip->ecc.steps;
+ 	int eccpadbytes = eccbytes + chip->ecc.prepad + chip->ecc.postpad;
+@@ -1748,21 +2341,36 @@ static int nand_read_page_syndrome(struc
+ 		int stat;
+ 
+ 		chip->ecc.hwctl(mtd, NAND_ECC_READ);
+-		chip->read_buf(mtd, p, eccsize);
++
++		ret = nand_read_data_op(chip, p, eccsize, false);
++		if (ret)
++			return ret;
+ 
+ 		if (chip->ecc.prepad) {
+-			chip->read_buf(mtd, oob, chip->ecc.prepad);
++			ret = nand_read_data_op(chip, oob, chip->ecc.prepad,
++						false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.prepad;
+ 		}
+ 
+ 		chip->ecc.hwctl(mtd, NAND_ECC_READSYN);
+-		chip->read_buf(mtd, oob, eccbytes);
++
++		ret = nand_read_data_op(chip, oob, eccbytes, false);
++		if (ret)
++			return ret;
++
+ 		stat = chip->ecc.correct(mtd, p, oob, NULL);
+ 
+ 		oob += eccbytes;
+ 
+ 		if (chip->ecc.postpad) {
+-			chip->read_buf(mtd, oob, chip->ecc.postpad);
++			ret = nand_read_data_op(chip, oob, chip->ecc.postpad,
++						false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.postpad;
+ 		}
+ 
+@@ -1786,8 +2394,11 @@ static int nand_read_page_syndrome(struc
+ 
+ 	/* Calculate remaining oob bytes */
+ 	i = mtd->oobsize - (oob - chip->oob_poi);
+-	if (i)
+-		chip->read_buf(mtd, oob, i);
++	if (i) {
++		ret = nand_read_data_op(chip, oob, i, false);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return max_bitflips;
+ }
+@@ -1908,8 +2519,11 @@ static int nand_do_read_ops(struct mtd_i
+ 						 __func__, buf);
+ 
+ read_retry:
+-			if (nand_standard_page_accessors(&chip->ecc))
+-				chip->cmdfunc(mtd, NAND_CMD_READ0, 0x00, page);
++			if (nand_standard_page_accessors(&chip->ecc)) {
++				ret = nand_read_page_op(chip, page, 0, NULL, 0);
++				if (ret)
++					break;
++			}
+ 
+ 			/*
+ 			 * Now read the page into the buffer.  Absent an error,
+@@ -2068,9 +2682,7 @@ static int nand_read(struct mtd_info *mt
+  */
+ int nand_read_oob_std(struct mtd_info *mtd, struct nand_chip *chip, int page)
+ {
+-	chip->cmdfunc(mtd, NAND_CMD_READOOB, 0, page);
+-	chip->read_buf(mtd, chip->oob_poi, mtd->oobsize);
+-	return 0;
++	return nand_read_oob_op(chip, page, 0, chip->oob_poi, mtd->oobsize);
+ }
+ EXPORT_SYMBOL(nand_read_oob_std);
+ 
+@@ -2088,25 +2700,43 @@ int nand_read_oob_syndrome(struct mtd_in
+ 	int chunk = chip->ecc.bytes + chip->ecc.prepad + chip->ecc.postpad;
+ 	int eccsize = chip->ecc.size;
+ 	uint8_t *bufpoi = chip->oob_poi;
+-	int i, toread, sndrnd = 0, pos;
++	int i, toread, sndrnd = 0, pos, ret;
++
++	ret = nand_read_page_op(chip, page, chip->ecc.size, NULL, 0);
++	if (ret)
++		return ret;
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_READ0, chip->ecc.size, page);
+ 	for (i = 0; i < chip->ecc.steps; i++) {
+ 		if (sndrnd) {
++			int ret;
++
+ 			pos = eccsize + i * (eccsize + chunk);
+ 			if (mtd->writesize > 512)
+-				chip->cmdfunc(mtd, NAND_CMD_RNDOUT, pos, -1);
++				ret = nand_change_read_column_op(chip, pos,
++								 NULL, 0,
++								 false);
+ 			else
+-				chip->cmdfunc(mtd, NAND_CMD_READ0, pos, page);
++				ret = nand_read_page_op(chip, page, pos, NULL,
++							0);
++
++			if (ret)
++				return ret;
+ 		} else
+ 			sndrnd = 1;
+ 		toread = min_t(int, length, chunk);
+-		chip->read_buf(mtd, bufpoi, toread);
++
++		ret = nand_read_data_op(chip, bufpoi, toread, false);
++		if (ret)
++			return ret;
++
+ 		bufpoi += toread;
+ 		length -= toread;
+ 	}
+-	if (length > 0)
+-		chip->read_buf(mtd, bufpoi, length);
++	if (length > 0) {
++		ret = nand_read_data_op(chip, bufpoi, length, false);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+@@ -2120,18 +2750,8 @@ EXPORT_SYMBOL(nand_read_oob_syndrome);
+  */
+ int nand_write_oob_std(struct mtd_info *mtd, struct nand_chip *chip, int page)
+ {
+-	int status = 0;
+-	const uint8_t *buf = chip->oob_poi;
+-	int length = mtd->oobsize;
+-
+-	chip->cmdfunc(mtd, NAND_CMD_SEQIN, mtd->writesize, page);
+-	chip->write_buf(mtd, buf, length);
+-	/* Send command to program the OOB data */
+-	chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+-
+-	status = chip->waitfunc(mtd, chip);
+-
+-	return status & NAND_STATUS_FAIL ? -EIO : 0;
++	return nand_prog_page_op(chip, page, mtd->writesize, chip->oob_poi,
++				 mtd->oobsize);
+ }
+ EXPORT_SYMBOL(nand_write_oob_std);
+ 
+@@ -2147,7 +2767,7 @@ int nand_write_oob_syndrome(struct mtd_i
+ {
+ 	int chunk = chip->ecc.bytes + chip->ecc.prepad + chip->ecc.postpad;
+ 	int eccsize = chip->ecc.size, length = mtd->oobsize;
+-	int i, len, pos, status = 0, sndcmd = 0, steps = chip->ecc.steps;
++	int ret, i, len, pos, sndcmd = 0, steps = chip->ecc.steps;
+ 	const uint8_t *bufpoi = chip->oob_poi;
+ 
+ 	/*
+@@ -2161,7 +2781,10 @@ int nand_write_oob_syndrome(struct mtd_i
+ 	} else
+ 		pos = eccsize;
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_SEQIN, pos, page);
++	ret = nand_prog_page_begin_op(chip, page, pos, NULL, 0);
++	if (ret)
++		return ret;
++
+ 	for (i = 0; i < steps; i++) {
+ 		if (sndcmd) {
+ 			if (mtd->writesize <= 512) {
+@@ -2170,28 +2793,40 @@ int nand_write_oob_syndrome(struct mtd_i
+ 				len = eccsize;
+ 				while (len > 0) {
+ 					int num = min_t(int, len, 4);
+-					chip->write_buf(mtd, (uint8_t *)&fill,
+-							num);
++
++					ret = nand_write_data_op(chip, &fill,
++								 num, false);
++					if (ret)
++						return ret;
++
+ 					len -= num;
+ 				}
+ 			} else {
+ 				pos = eccsize + i * (eccsize + chunk);
+-				chip->cmdfunc(mtd, NAND_CMD_RNDIN, pos, -1);
++				ret = nand_change_write_column_op(chip, pos,
++								  NULL, 0,
++								  false);
++				if (ret)
++					return ret;
+ 			}
+ 		} else
+ 			sndcmd = 1;
+ 		len = min_t(int, length, chunk);
+-		chip->write_buf(mtd, bufpoi, len);
++
++		ret = nand_write_data_op(chip, bufpoi, len, false);
++		if (ret)
++			return ret;
++
+ 		bufpoi += len;
+ 		length -= len;
+ 	}
+-	if (length > 0)
+-		chip->write_buf(mtd, bufpoi, length);
+-
+-	chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+-	status = chip->waitfunc(mtd, chip);
++	if (length > 0) {
++		ret = nand_write_data_op(chip, bufpoi, length, false);
++		if (ret)
++			return ret;
++	}
+ 
+-	return status & NAND_STATUS_FAIL ? -EIO : 0;
++	return nand_prog_page_end_op(chip);
+ }
+ EXPORT_SYMBOL(nand_write_oob_syndrome);
+ 
+@@ -2346,9 +2981,18 @@ static int nand_read_oob(struct mtd_info
+ int nand_write_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
+ 			const uint8_t *buf, int oob_required, int page)
+ {
+-	chip->write_buf(mtd, buf, mtd->writesize);
+-	if (oob_required)
+-		chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
++	int ret;
++
++	ret = nand_write_data_op(chip, buf, mtd->writesize, false);
++	if (ret)
++		return ret;
++
++	if (oob_required) {
++		ret = nand_write_data_op(chip, chip->oob_poi, mtd->oobsize,
++					 false);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+@@ -2372,29 +3016,46 @@ static int nand_write_page_raw_syndrome(
+ 	int eccsize = chip->ecc.size;
+ 	int eccbytes = chip->ecc.bytes;
+ 	uint8_t *oob = chip->oob_poi;
+-	int steps, size;
++	int steps, size, ret;
+ 
+ 	for (steps = chip->ecc.steps; steps > 0; steps--) {
+-		chip->write_buf(mtd, buf, eccsize);
++		ret = nand_write_data_op(chip, buf, eccsize, false);
++		if (ret)
++			return ret;
++
+ 		buf += eccsize;
+ 
+ 		if (chip->ecc.prepad) {
+-			chip->write_buf(mtd, oob, chip->ecc.prepad);
++			ret = nand_write_data_op(chip, oob, chip->ecc.prepad,
++						 false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.prepad;
+ 		}
+ 
+-		chip->write_buf(mtd, oob, eccbytes);
++		ret = nand_write_data_op(chip, oob, eccbytes, false);
++		if (ret)
++			return ret;
++
+ 		oob += eccbytes;
+ 
+ 		if (chip->ecc.postpad) {
+-			chip->write_buf(mtd, oob, chip->ecc.postpad);
++			ret = nand_write_data_op(chip, oob, chip->ecc.postpad,
++						 false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.postpad;
+ 		}
+ 	}
+ 
+ 	size = mtd->oobsize - (oob - chip->oob_poi);
+-	if (size)
+-		chip->write_buf(mtd, oob, size);
++	if (size) {
++		ret = nand_write_data_op(chip, oob, size, false);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+@@ -2448,7 +3109,11 @@ static int nand_write_page_hwecc(struct
+ 
+ 	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
+ 		chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
+-		chip->write_buf(mtd, p, eccsize);
++
++		ret = nand_write_data_op(chip, p, eccsize, false);
++		if (ret)
++			return ret;
++
+ 		chip->ecc.calculate(mtd, p, &ecc_calc[i]);
+ 	}
+ 
+@@ -2457,7 +3122,9 @@ static int nand_write_page_hwecc(struct
+ 	if (ret)
+ 		return ret;
+ 
+-	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
++	ret = nand_write_data_op(chip, chip->oob_poi, mtd->oobsize, false);
++	if (ret)
++		return ret;
+ 
+ 	return 0;
+ }
+@@ -2493,7 +3160,9 @@ static int nand_write_subpage_hwecc(stru
+ 		chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
+ 
+ 		/* write data (untouched subpages already masked by 0xFF) */
+-		chip->write_buf(mtd, buf, ecc_size);
++		ret = nand_write_data_op(chip, buf, ecc_size, false);
++		if (ret)
++			return ret;
+ 
+ 		/* mask ECC of un-touched subpages by padding 0xFF */
+ 		if ((step < start_step) || (step > end_step))
+@@ -2520,7 +3189,9 @@ static int nand_write_subpage_hwecc(stru
+ 		return ret;
+ 
+ 	/* write OOB buffer to NAND device */
+-	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
++	ret = nand_write_data_op(chip, chip->oob_poi, mtd->oobsize, false);
++	if (ret)
++		return ret;
+ 
+ 	return 0;
+ }
+@@ -2547,31 +3218,49 @@ static int nand_write_page_syndrome(stru
+ 	int eccsteps = chip->ecc.steps;
+ 	const uint8_t *p = buf;
+ 	uint8_t *oob = chip->oob_poi;
++	int ret;
+ 
+ 	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
+-
+ 		chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
+-		chip->write_buf(mtd, p, eccsize);
++
++		ret = nand_write_data_op(chip, p, eccsize, false);
++		if (ret)
++			return ret;
+ 
+ 		if (chip->ecc.prepad) {
+-			chip->write_buf(mtd, oob, chip->ecc.prepad);
++			ret = nand_write_data_op(chip, oob, chip->ecc.prepad,
++						 false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.prepad;
+ 		}
+ 
+ 		chip->ecc.calculate(mtd, p, oob);
+-		chip->write_buf(mtd, oob, eccbytes);
++
++		ret = nand_write_data_op(chip, oob, eccbytes, false);
++		if (ret)
++			return ret;
++
+ 		oob += eccbytes;
+ 
+ 		if (chip->ecc.postpad) {
+-			chip->write_buf(mtd, oob, chip->ecc.postpad);
++			ret = nand_write_data_op(chip, oob, chip->ecc.postpad,
++						 false);
++			if (ret)
++				return ret;
++
+ 			oob += chip->ecc.postpad;
+ 		}
+ 	}
+ 
+ 	/* Calculate remaining oob bytes */
+ 	i = mtd->oobsize - (oob - chip->oob_poi);
+-	if (i)
+-		chip->write_buf(mtd, oob, i);
++	if (i) {
++		ret = nand_write_data_op(chip, oob, i, false);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+@@ -2599,8 +3288,11 @@ static int nand_write_page(struct mtd_in
+ 	else
+ 		subpage = 0;
+ 
+-	if (nand_standard_page_accessors(&chip->ecc))
+-		chip->cmdfunc(mtd, NAND_CMD_SEQIN, 0x00, page);
++	if (nand_standard_page_accessors(&chip->ecc)) {
++		status = nand_prog_page_begin_op(chip, page, 0, NULL, 0);
++		if (status)
++			return status;
++	}
+ 
+ 	if (unlikely(raw))
+ 		status = chip->ecc.write_page_raw(mtd, chip, buf,
+@@ -2615,13 +3307,8 @@ static int nand_write_page(struct mtd_in
+ 	if (status < 0)
+ 		return status;
+ 
+-	if (nand_standard_page_accessors(&chip->ecc)) {
+-		chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+-
+-		status = chip->waitfunc(mtd, chip);
+-		if (status & NAND_STATUS_FAIL)
+-			return -EIO;
+-	}
++	if (nand_standard_page_accessors(&chip->ecc))
++		return nand_prog_page_end_op(chip);
+ 
+ 	return 0;
+ }
+@@ -2994,17 +3681,12 @@ out:
+ static int single_erase(struct mtd_info *mtd, int page)
+ {
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
+-	int status;
++	unsigned int eraseblock;
+ 
+ 	/* Send commands to erase a block */
+-	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
+-	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
+-
+-	status = chip->waitfunc(mtd, chip);
+-	if (status < 0)
+-		return status;
++	eraseblock = page >> (chip->phys_erase_shift - chip->page_shift);
+ 
+-	return status & NAND_STATUS_FAIL ? -EIO : 0;
++	return nand_erase_op(chip, eraseblock);
+ }
+ 
+ /**
+@@ -3231,22 +3913,12 @@ static int nand_max_bad_blocks(struct mt
+ static int nand_onfi_set_features(struct mtd_info *mtd, struct nand_chip *chip,
+ 			int addr, uint8_t *subfeature_param)
+ {
+-	int status;
+-	int i;
+-
+ 	if (!chip->onfi_version ||
+ 	    !(le16_to_cpu(chip->onfi_params.opt_cmd)
+ 	      & ONFI_OPT_CMD_SET_GET_FEATURES))
+ 		return -EINVAL;
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_SET_FEATURES, addr, -1);
+-	for (i = 0; i < ONFI_SUBFEATURE_PARAM_LEN; ++i)
+-		chip->write_byte(mtd, subfeature_param[i]);
+-
+-	status = chip->waitfunc(mtd, chip);
+-	if (status & NAND_STATUS_FAIL)
+-		return -EIO;
+-	return 0;
++	return nand_set_features_op(chip, addr, subfeature_param);
+ }
+ 
+ /**
+@@ -3259,17 +3931,12 @@ static int nand_onfi_set_features(struct
+ static int nand_onfi_get_features(struct mtd_info *mtd, struct nand_chip *chip,
+ 			int addr, uint8_t *subfeature_param)
+ {
+-	int i;
+-
+ 	if (!chip->onfi_version ||
+ 	    !(le16_to_cpu(chip->onfi_params.opt_cmd)
+ 	      & ONFI_OPT_CMD_SET_GET_FEATURES))
+ 		return -EINVAL;
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_GET_FEATURES, addr, -1);
+-	for (i = 0; i < ONFI_SUBFEATURE_PARAM_LEN; ++i)
+-		*subfeature_param++ = chip->read_byte(mtd);
+-	return 0;
++	return nand_get_features_op(chip, addr, subfeature_param);
+ }
+ 
+ /**
+@@ -3412,12 +4079,11 @@ static u16 onfi_crc16(u16 crc, u8 const
+ static int nand_flash_detect_ext_param_page(struct nand_chip *chip,
+ 					    struct nand_onfi_params *p)
+ {
+-	struct mtd_info *mtd = nand_to_mtd(chip);
+ 	struct onfi_ext_param_page *ep;
+ 	struct onfi_ext_section *s;
+ 	struct onfi_ext_ecc_info *ecc;
+ 	uint8_t *cursor;
+-	int ret = -EINVAL;
++	int ret;
+ 	int len;
+ 	int i;
+ 
+@@ -3427,14 +4093,18 @@ static int nand_flash_detect_ext_param_p
+ 		return -ENOMEM;
+ 
+ 	/* Send our own NAND_CMD_PARAM. */
+-	chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
++	ret = nand_read_param_page_op(chip, 0, NULL, 0);
++	if (ret)
++		goto ext_out;
+ 
+ 	/* Use the Change Read Column command to skip the ONFI param pages. */
+-	chip->cmdfunc(mtd, NAND_CMD_RNDOUT,
+-			sizeof(*p) * p->num_of_param_pages , -1);
++	ret = nand_change_read_column_op(chip,
++					 sizeof(*p) * p->num_of_param_pages,
++					 ep, len, true);
++	if (ret)
++		goto ext_out;
+ 
+-	/* Read out the Extended Parameter Page. */
+-	chip->read_buf(mtd, (uint8_t *)ep, len);
++	ret = -EINVAL;
+ 	if ((onfi_crc16(ONFI_CRC_BASE, ((uint8_t *)ep) + 2, len - 2)
+ 		!= le16_to_cpu(ep->crc))) {
+ 		pr_debug("fail in the CRC.\n");
+@@ -3487,19 +4157,23 @@ static int nand_flash_detect_onfi(struct
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(chip);
+ 	struct nand_onfi_params *p = &chip->onfi_params;
+-	int i, j;
+-	int val;
++	char id[4];
++	int i, ret, val;
+ 
+ 	/* Try ONFI for unknown chip or LP */
+-	chip->cmdfunc(mtd, NAND_CMD_READID, 0x20, -1);
+-	if (chip->read_byte(mtd) != 'O' || chip->read_byte(mtd) != 'N' ||
+-		chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I')
++	ret = nand_readid_op(chip, 0x20, id, sizeof(id));
++	if (ret || strncmp(id, "ONFI", 4))
++		return 0;
++
++	ret = nand_read_param_page_op(chip, 0, NULL, 0);
++	if (ret)
+ 		return 0;
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
+ 	for (i = 0; i < 3; i++) {
+-		for (j = 0; j < sizeof(*p); j++)
+-			((uint8_t *)p)[j] = chip->read_byte(mtd);
++		ret = nand_read_data_op(chip, p, sizeof(*p), true);
++		if (ret)
++			return 0;
++
+ 		if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
+ 				le16_to_cpu(p->crc)) {
+ 			break;
+@@ -3590,20 +4264,22 @@ static int nand_flash_detect_jedec(struc
+ 	struct mtd_info *mtd = nand_to_mtd(chip);
+ 	struct nand_jedec_params *p = &chip->jedec_params;
+ 	struct jedec_ecc_info *ecc;
+-	int val;
+-	int i, j;
++	char id[5];
++	int i, val, ret;
+ 
+ 	/* Try JEDEC for unknown chip or LP */
+-	chip->cmdfunc(mtd, NAND_CMD_READID, 0x40, -1);
+-	if (chip->read_byte(mtd) != 'J' || chip->read_byte(mtd) != 'E' ||
+-		chip->read_byte(mtd) != 'D' || chip->read_byte(mtd) != 'E' ||
+-		chip->read_byte(mtd) != 'C')
++	ret = nand_readid_op(chip, 0x40, id, sizeof(id));
++	if (ret || strncmp(id, "JEDEC", sizeof(id)))
++		return 0;
++
++	ret = nand_read_param_page_op(chip, 0x40, NULL, 0);
++	if (ret)
+ 		return 0;
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_PARAM, 0x40, -1);
+ 	for (i = 0; i < 3; i++) {
+-		for (j = 0; j < sizeof(*p); j++)
+-			((uint8_t *)p)[j] = chip->read_byte(mtd);
++		ret = nand_read_data_op(chip, p, sizeof(*p), true);
++		if (ret)
++			return 0;
+ 
+ 		if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 510) ==
+ 				le16_to_cpu(p->crc))
+@@ -3882,8 +4558,7 @@ static int nand_detect(struct nand_chip
+ {
+ 	const struct nand_manufacturer *manufacturer;
+ 	struct mtd_info *mtd = nand_to_mtd(chip);
+-	int busw;
+-	int i;
++	int busw, ret;
+ 	u8 *id_data = chip->id.data;
+ 	u8 maf_id, dev_id;
+ 
+@@ -3891,17 +4566,21 @@ static int nand_detect(struct nand_chip
+ 	 * Reset the chip, required by some chips (e.g. Micron MT29FxGxxxxx)
+ 	 * after power-up.
+ 	 */
+-	nand_reset(chip, 0);
++	ret = nand_reset(chip, 0);
++	if (ret)
++		return ret;
+ 
+ 	/* Select the device */
+ 	chip->select_chip(mtd, 0);
+ 
+ 	/* Send the command for reading device ID */
+-	chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
++	ret = nand_readid_op(chip, 0, id_data, 2);
++	if (ret)
++		return ret;
+ 
+ 	/* Read manufacturer and device IDs */
+-	maf_id = chip->read_byte(mtd);
+-	dev_id = chip->read_byte(mtd);
++	maf_id = id_data[0];
++	dev_id = id_data[1];
+ 
+ 	/*
+ 	 * Try again to make sure, as some systems the bus-hold or other
+@@ -3910,11 +4589,10 @@ static int nand_detect(struct nand_chip
+ 	 * not match, ignore the device completely.
+ 	 */
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
+-
+ 	/* Read entire ID string */
+-	for (i = 0; i < ARRAY_SIZE(chip->id.data); i++)
+-		id_data[i] = chip->read_byte(mtd);
++	ret = nand_readid_op(chip, 0, id_data, sizeof(chip->id.data));
++	if (ret)
++		return ret;
+ 
+ 	if (id_data[0] != maf_id || id_data[1] != dev_id) {
+ 		pr_info("second ID read did not match %02x,%02x against %02x,%02x\n",
+@@ -4238,15 +4916,16 @@ int nand_scan_ident(struct mtd_info *mtd
+ 
+ 	/* Check for a chip array */
+ 	for (i = 1; i < maxchips; i++) {
++		u8 id[2];
++
+ 		/* See comment in nand_get_flash_type for reset */
+ 		nand_reset(chip, i);
+ 
+ 		chip->select_chip(mtd, i);
+ 		/* Send the command for reading device ID */
+-		chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
++		nand_readid_op(chip, 0, id, sizeof(id));
+ 		/* Read manufacturer and device IDs */
+-		if (nand_maf_id != chip->read_byte(mtd) ||
+-		    nand_dev_id != chip->read_byte(mtd)) {
++		if (nand_maf_id != id[0] || nand_dev_id != id[1]) {
+ 			chip->select_chip(mtd, -1);
+ 			break;
+ 		}
+--- a/drivers/mtd/nand/qcom_nandc.c
++++ b/drivers/mtd/nand/qcom_nandc.c
+@@ -1990,7 +1990,7 @@ static int qcom_nandc_write_oob(struct m
+ 	struct nand_ecc_ctrl *ecc = &chip->ecc;
+ 	u8 *oob = chip->oob_poi;
+ 	int data_size, oob_size;
+-	int ret, status = 0;
++	int ret;
+ 
+ 	host->use_ecc = true;
+ 
+@@ -2027,11 +2027,7 @@ static int qcom_nandc_write_oob(struct m
+ 		return -EIO;
+ 	}
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+-
+-	status = chip->waitfunc(mtd, chip);
+-
+-	return status & NAND_STATUS_FAIL ? -EIO : 0;
++	return nand_prog_page_end_op(chip);
+ }
+ 
+ static int qcom_nandc_block_bad(struct mtd_info *mtd, loff_t ofs)
+@@ -2081,7 +2077,7 @@ static int qcom_nandc_block_markbad(stru
+ 	struct qcom_nand_host *host = to_qcom_nand_host(chip);
+ 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ 	struct nand_ecc_ctrl *ecc = &chip->ecc;
+-	int page, ret, status = 0;
++	int page, ret;
+ 
+ 	clear_read_regs(nandc);
+ 	clear_bam_transaction(nandc);
+@@ -2114,11 +2110,7 @@ static int qcom_nandc_block_markbad(stru
+ 		return -EIO;
+ 	}
+ 
+-	chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+-
+-	status = chip->waitfunc(mtd, chip);
+-
+-	return status & NAND_STATUS_FAIL ? -EIO : 0;
++	return nand_prog_page_end_op(chip);
+ }
+ 
+ /*
+--- a/include/linux/mtd/rawnand.h
++++ b/include/linux/mtd/rawnand.h
+@@ -1313,6 +1313,35 @@ int nand_write_page_raw(struct mtd_info
+ /* Reset and initialize a NAND device */
+ int nand_reset(struct nand_chip *chip, int chipnr);
+ 
++/* NAND operation helpers */
++int nand_reset_op(struct nand_chip *chip);
++int nand_readid_op(struct nand_chip *chip, u8 addr, void *buf,
++		   unsigned int len);
++int nand_status_op(struct nand_chip *chip, u8 *status);
++int nand_exit_status_op(struct nand_chip *chip);
++int nand_erase_op(struct nand_chip *chip, unsigned int eraseblock);
++int nand_read_page_op(struct nand_chip *chip, unsigned int page,
++		      unsigned int offset_in_page, void *buf, unsigned int len);
++int nand_change_read_column_op(struct nand_chip *chip,
++			       unsigned int offset_in_page, void *buf,
++			       unsigned int len, bool force_8bit);
++int nand_read_oob_op(struct nand_chip *chip, unsigned int page,
++		     unsigned int offset_in_page, void *buf, unsigned int len);
++int nand_prog_page_begin_op(struct nand_chip *chip, unsigned int page,
++			    unsigned int offset_in_page, const void *buf,
++			    unsigned int len);
++int nand_prog_page_end_op(struct nand_chip *chip);
++int nand_prog_page_op(struct nand_chip *chip, unsigned int page,
++		      unsigned int offset_in_page, const void *buf,
++		      unsigned int len);
++int nand_change_write_column_op(struct nand_chip *chip,
++				unsigned int offset_in_page, const void *buf,
++				unsigned int len, bool force_8bit);
++int nand_read_data_op(struct nand_chip *chip, void *buf, unsigned int len,
++		      bool force_8bit);
++int nand_write_data_op(struct nand_chip *chip, const void *buf,
++		       unsigned int len, bool force_8bit);
++
+ /* Free resources held by the NAND device */
+ void nand_cleanup(struct nand_chip *chip);
+ 
diff --git a/target/linux/ipq40xx/patches-4.14/050-0005-mtd-nand-force-drivers-to-explicitly-send-READ-PROG-.patch b/target/linux/ipq40xx/patches-4.14/050-0005-mtd-nand-force-drivers-to-explicitly-send-READ-PROG-.patch
new file mode 100644
index 000000000..e7e2e798a
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/050-0005-mtd-nand-force-drivers-to-explicitly-send-READ-PROG-.patch
@@ -0,0 +1,94 @@
+From 25f815f66a141436df8a4c45e5d2765272aea2ac Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Thu, 30 Nov 2017 18:01:30 +0100
+Subject: [PATCH 5/7] mtd: nand: force drivers to explicitly send READ/PROG
+ commands
+
+The core currently send the READ0 and SEQIN+PAGEPROG commands in
+nand_do_read/write_ops(). This is inconsistent with
+->read/write_oob[_raw]() hooks behavior which are expected to send
+these commands.
+
+There's already a flag (NAND_ECC_CUSTOM_PAGE_ACCESS) to inform the core
+that a specific controller wants to send the READ/SEQIN+PAGEPROG
+commands on its own, but it's an opt-in flag, and existing drivers are
+unlikely to be updated to pass it.
+
+Moreover, some controllers cannot dissociate the READ/PAGEPROG commands
+from the associated data transfer and ECC engine activation, and
+developers have to hack things in their ->cmdfunc() implementation to
+handle such complex cases, or have to accept the perf penalty of sending
+twice the same command.
+To address this problem we are planning on adding a new interface which
+is passed all information about a NAND operation (including the amount
+of data to transfer) and replacing all calls to ->cmdfunc() to calls to
+this new ->exec_op() hook. But, in order to do that, we need to have all
+->cmdfunc() calls placed near their associated ->read/write_buf/byte()
+calls.
+
+Modify the core and relevant drivers to make NAND_ECC_CUSTOM_PAGE_ACCESS
+the default case, and remove this flag.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+[miquel.raynal@free-electrons.com: tested, fixed and rebased on nand/next]
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+---
+ drivers/mtd/nand/qcom_nandc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/mtd/nand/qcom_nandc.c
++++ b/drivers/mtd/nand/qcom_nandc.c
+@@ -1725,6 +1725,7 @@ static int qcom_nandc_read_page(struct m
+ 	u8 *data_buf, *oob_buf = NULL;
+ 	int ret;
+ 
++	nand_read_page_op(chip, page, 0, NULL, 0);
+ 	data_buf = buf;
+ 	oob_buf = oob_required ? chip->oob_poi : NULL;
+ 
+@@ -1750,6 +1751,7 @@ static int qcom_nandc_read_page_raw(stru
+ 	int i, ret;
+ 	int read_loc;
+ 
++	nand_read_page_op(chip, page, 0, NULL, 0);
+ 	data_buf = buf;
+ 	oob_buf = chip->oob_poi;
+ 
+@@ -1850,6 +1852,8 @@ static int qcom_nandc_write_page(struct
+ 	u8 *data_buf, *oob_buf;
+ 	int i, ret;
+ 
++	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
++
+ 	clear_read_regs(nandc);
+ 	clear_bam_transaction(nandc);
+ 
+@@ -1902,6 +1906,9 @@ static int qcom_nandc_write_page(struct
+ 
+ 	free_descs(nandc);
+ 
++	if (!ret)
++		ret = nand_prog_page_end_op(chip);
++
+ 	return ret;
+ }
+ 
+@@ -1916,6 +1923,7 @@ static int qcom_nandc_write_page_raw(str
+ 	u8 *data_buf, *oob_buf;
+ 	int i, ret;
+ 
++	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
+ 	clear_read_regs(nandc);
+ 	clear_bam_transaction(nandc);
+ 
+@@ -1970,6 +1978,9 @@ static int qcom_nandc_write_page_raw(str
+ 
+ 	free_descs(nandc);
+ 
++	if (!ret)
++		ret = nand_prog_page_end_op(chip);
++
+ 	return ret;
+ }
+ 
diff --git a/target/linux/ipq40xx/patches-4.14/050-0006-mtd-nand-qcom-Add-a-NULL-check-for-devm_kasprintf.patch b/target/linux/ipq40xx/patches-4.14/050-0006-mtd-nand-qcom-Add-a-NULL-check-for-devm_kasprintf.patch
new file mode 100644
index 000000000..4ddc0148a
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/050-0006-mtd-nand-qcom-Add-a-NULL-check-for-devm_kasprintf.patch
@@ -0,0 +1,26 @@
+From 069f05346d01e7298939f16533953cdf52370be3 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Fri, 5 Jan 2018 18:02:55 -0200
+Subject: [PATCH 6/7] mtd: nand: qcom: Add a NULL check for devm_kasprintf()
+
+devm_kasprintf() may fail, so we should better add a NULL check
+and propagate an error on failure.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+---
+ drivers/mtd/nand/qcom_nandc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/nand/qcom_nandc.c
++++ b/drivers/mtd/nand/qcom_nandc.c
+@@ -2639,6 +2639,9 @@ static int qcom_nand_host_init(struct qc
+ 
+ 	nand_set_flash_node(chip, dn);
+ 	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "qcom_nand.%d", host->cs);
++	if (!mtd->name)
++		return -ENOMEM;
++
+ 	mtd->owner = THIS_MODULE;
+ 	mtd->dev.parent = dev;
+ 
diff --git a/target/linux/ipq40xx/patches-4.14/059-ARM-cpuidle-Add-cpuidle-support-for-QCOM-cpus.patch b/target/linux/ipq40xx/patches-4.14/059-ARM-cpuidle-Add-cpuidle-support-for-QCOM-cpus.patch
new file mode 100644
index 000000000..5bd58c813
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/059-ARM-cpuidle-Add-cpuidle-support-for-QCOM-cpus.patch
@@ -0,0 +1,29 @@
+From 04ca10340f1b4d92e849724d322a7ca225d11539 Mon Sep 17 00:00:00 2001
+From: Lina Iyer <lina.iyer@linaro.org>
+Date: Wed, 25 Mar 2015 14:25:29 -0600
+Subject: [PATCH 59/69] ARM: cpuidle: Add cpuidle support for QCOM cpus
+
+Define ARM_QCOM_CPUIDLE config item to enable cpuidle support.
+
+Cc: Stephen Boyd <sboyd@codeaurora.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Kevin Hilman <khilman@linaro.org>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Lina Iyer <lina.iyer@linaro.org>
+---
+ drivers/cpuidle/Kconfig.arm | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/cpuidle/Kconfig.arm
++++ b/drivers/cpuidle/Kconfig.arm
+@@ -75,3 +75,10 @@ config ARM_MVEBU_V7_CPUIDLE
+ 	depends on ARCH_MVEBU && !ARM64
+ 	help
+ 	  Select this to enable cpuidle on Armada 370, 38x and XP processors.
++
++config ARM_QCOM_CPUIDLE
++	bool "CPU Idle Driver for QCOM processors"
++	depends on ARCH_QCOM
++	select ARM_CPUIDLE
++	help
++	  Select this to enable cpuidle on QCOM processors.
diff --git a/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
new file mode 100644
index 000000000..c0bdd87fc
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
@@ -0,0 +1,27 @@
+From 8f68331e14dff9a101f2d0e1d6bec84a031f27ee Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 9 Mar 2017 11:03:18 +0100
+Subject: [PATCH 69/69] arm: boot: add dts files
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ arch/arm/boot/dts/Makefile | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -697,7 +697,14 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+ 	qcom-apq8074-dragonboard.dtb \
+ 	qcom-apq8084-ifc6540.dtb \
+ 	qcom-apq8084-mtp.dtb \
++	qcom-ipq4018-a42.dtb \
++	qcom-ipq4018-fritz4040.dtb \
++	qcom-ipq4018-rt-ac58u.dtb \
+ 	qcom-ipq4019-ap.dk01.1-c1.dtb \
++	qcom-ipq4019-ap.dk04.1-c1.dtb \
++	qcom-ipq4028-wpj428.dtb \
++	qcom-ipq4029-gl-b1300.dtb \
++	qcom-ipq4029-mr33.dtb \
+ 	qcom-ipq8064-ap148.dtb \
+ 	qcom-msm8660-surf.dtb \
+ 	qcom-msm8960-cdp.dtb \
diff --git a/target/linux/ipq40xx/patches-4.14/070-qcom-spm-fix-probe-order.patch b/target/linux/ipq40xx/patches-4.14/070-qcom-spm-fix-probe-order.patch
new file mode 100644
index 000000000..b7e375dfb
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/070-qcom-spm-fix-probe-order.patch
@@ -0,0 +1,16 @@
+Check for SCM availability before attempting to use SPM
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+
+--- a/drivers/soc/qcom/spm.c
++++ b/drivers/soc/qcom/spm.c
+@@ -219,6 +219,9 @@ static int __init qcom_cpuidle_init(stru
+ 	cpumask_t mask;
+ 	bool use_scm_power_down = false;
+ 
++	if (!qcom_scm_is_available())
++		return -EPROBE_DEFER;
++
+ 	for (i = 0; ; i++) {
+ 		state_node = of_parse_phandle(cpu_node, "cpu-idle-states", i);
+ 		if (!state_node)
diff --git a/target/linux/ipq40xx/patches-4.14/101-ARM-dts-ipq4019-Add-a-few-peripheral-nodes.patch b/target/linux/ipq40xx/patches-4.14/101-ARM-dts-ipq4019-Add-a-few-peripheral-nodes.patch
new file mode 100644
index 000000000..0f039f206
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/101-ARM-dts-ipq4019-Add-a-few-peripheral-nodes.patch
@@ -0,0 +1,188 @@
+From patchwork Mon Jan 29 05:11:16 2018
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [02/15] ARM: dts: ipq4019: Add a few peripheral nodes
+From: Sricharan R <sricharan@codeaurora.org>
+X-Patchwork-Id: 10189263
+Message-Id: <1517202689-14212-3-git-send-email-sricharan@codeaurora.org>
+To: robh+dt@kernel.org, robh@kernel.org, mark.rutland@arm.com,
+ linux@armlinux.org.uk, andy.gross@linaro.org, david.brown@linaro.org, 
+ catalin.marinas@arm.com, will.deacon@arm.com, sboyd@codeaurora.org,
+ bjorn.andersson@linaro.org, devicetree@vger.kernel.org,
+ linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+ linux-arm-msm@vger.kernel.org, linux-soc@vger.kernel.org
+Cc: sricharan@codeaurora.org
+Date: Mon, 29 Jan 2018 10:41:16 +0530
+
+Now with the driver updates for some peripherals being there,
+add i2c, spi, pcie, bam, qpic-nand, scm nodes to enhance the available
+peripheral support.
+
+Signed-off-by: Sricharan R <sricharan@codeaurora.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 134 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 134 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -25,7 +25,9 @@
+ 
+ 	aliases {
+ 		spi0 = &spi_0;
++		spi1 = &spi_1;
+ 		i2c0 = &i2c_0;
++		i2c1 = &i2c_1;
+ 	};
+ 
+ 	cpus {
+@@ -190,6 +192,22 @@
+ 			clock-names = "core", "iface";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
++			dmas = <&blsp_dma 5>, <&blsp_dma 4>;
++			dma-names = "rx", "tx";
++			status = "disabled";
++		};
++
++		spi_1: spi@78b6000 { /* BLSP1 QUP2 */
++			compatible = "qcom,spi-qup-v2.2.1";
++			reg = <0x78b6000 0x600>;
++			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&gcc GCC_BLSP1_QUP2_SPI_APPS_CLK>,
++				<&gcc GCC_BLSP1_AHB_CLK>;
++			clock-names = "core", "iface";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			dmas = <&blsp_dma 7>, <&blsp_dma 6>;
++			dma-names = "rx", "tx";
+ 			status = "disabled";
+ 		};
+ 
+@@ -202,9 +220,24 @@
+ 			clock-names = "iface", "core";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
++			dmas = <&blsp_dma 9>, <&blsp_dma 8>;
++			dma-names = "rx", "tx";
+ 			status = "disabled";
+ 		};
+ 
++		i2c_1: i2c@78b8000 { /* BLSP1 QUP4 */
++			compatible = "qcom,i2c-qup-v2.2.1";
++			reg = <0x78b8000 0x600>;
++			interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&gcc GCC_BLSP1_AHB_CLK>,
++				 <&gcc GCC_BLSP1_QUP2_I2C_APPS_CLK>;
++			clock-names = "iface", "core";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			dmas = <&blsp_dma 11>, <&blsp_dma 10>;
++			dma-names = "rx", "tx";
++			status = "disabled";
++		};
+ 
+ 		cryptobam: dma@8e04000 {
+ 			compatible = "qcom,bam-v1.7.0";
+@@ -311,6 +344,101 @@
+ 			reg = <0x4ab000 0x4>;
+ 		};
+ 
++		pcie0: pci@40000000 {
++			compatible = "qcom,pcie-ipq4019", "snps,dw-pcie";
++			reg =  <0x40000000 0xf1d
++				0x40000f20 0xa8
++				0x80000 0x2000
++				0x40100000 0x1000>;
++			reg-names = "dbi", "elbi", "parf", "config";
++			device_type = "pci";
++			linux,pci-domain = <0>;
++			bus-range = <0x00 0xff>;
++			num-lanes = <1>;
++			#address-cells = <3>;
++			#size-cells = <2>;
++
++			ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000
++				  0x82000000 0 0x48000000 0x48000000 0 0x10000000>;
++
++			interrupts = <GIC_SPI 141 IRQ_TYPE_NONE>;
++			interrupt-names = "msi";
++			#interrupt-cells = <1>;
++			interrupt-map-mask = <0 0 0 0x7>;
++			interrupt-map = <0 0 0 1 &intc 0 142 IRQ_TYPE_LEVEL_HIGH>, /* int_a */
++					<0 0 0 2 &intc 0 143 IRQ_TYPE_LEVEL_HIGH>, /* int_b */
++					<0 0 0 3 &intc 0 144 IRQ_TYPE_LEVEL_HIGH>, /* int_c */
++					<0 0 0 4 &intc 0 145 IRQ_TYPE_LEVEL_HIGH>; /* int_d */
++			clocks = <&gcc GCC_PCIE_AHB_CLK>,
++				 <&gcc GCC_PCIE_AXI_M_CLK>,
++				 <&gcc GCC_PCIE_AXI_S_CLK>;
++			clock-names = "aux",
++				      "master_bus",
++				      "slave_bus";
++
++			resets = <&gcc PCIE_AXI_M_ARES>,
++				 <&gcc PCIE_AXI_S_ARES>,
++				 <&gcc PCIE_PIPE_ARES>,
++				 <&gcc PCIE_AXI_M_VMIDMT_ARES>,
++				 <&gcc PCIE_AXI_S_XPU_ARES>,
++				 <&gcc PCIE_PARF_XPU_ARES>,
++				 <&gcc PCIE_PHY_ARES>,
++				 <&gcc PCIE_AXI_M_STICKY_ARES>,
++				 <&gcc PCIE_PIPE_STICKY_ARES>,
++				 <&gcc PCIE_PWR_ARES>,
++				 <&gcc PCIE_AHB_ARES>,
++				 <&gcc PCIE_PHY_AHB_ARES>;
++			reset-names = "axi_m",
++				      "axi_s",
++				      "pipe",
++				      "axi_m_vmid",
++				      "axi_s_xpu",
++				      "parf",
++				      "phy",
++				      "axi_m_sticky",
++				      "pipe_sticky",
++				      "pwr",
++				      "ahb",
++				      "phy_ahb";
++
++			status = "disabled";
++		};
++
++		qpic_bam: dma@7984000 {
++			compatible = "qcom,bam-v1.7.0";
++			reg = <0x7984000 0x1a000>;
++			interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&gcc GCC_QPIC_CLK>;
++			clock-names = "bam_clk";
++			#dma-cells = <1>;
++			qcom,ee = <0>;
++			status = "disabled";
++		};
++
++		nand: qpic-nand@79b0000 {
++			compatible = "qcom,ipq4019-nand";
++			reg = <0x79b0000 0x1000>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			clocks = <&gcc GCC_QPIC_CLK>,
++				 <&gcc GCC_QPIC_AHB_CLK>;
++			clock-names = "core", "aon";
++
++			dmas = <&qpic_bam 0>,
++			       <&qpic_bam 1>,
++			       <&qpic_bam 2>;
++			dma-names = "tx", "rx", "cmd";
++			status = "disabled";
++
++			nand@0 {
++				reg = <0>;
++
++				nand-ecc-strength = <4>;
++				nand-ecc-step-size = <512>;
++				nand-bus-width = <8>;
++			};
++		};
++
+ 		wifi0: wifi@a000000 {
+ 			compatible = "qcom,ipq4019-wifi";
+ 			reg = <0xa000000 0x200000>;
diff --git a/target/linux/ipq40xx/patches-4.14/102-ARM-dts-ipq4019-fix-PCI-range.patch b/target/linux/ipq40xx/patches-4.14/102-ARM-dts-ipq4019-fix-PCI-range.patch
new file mode 100644
index 000000000..eaccb00bb
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/102-ARM-dts-ipq4019-fix-PCI-range.patch
@@ -0,0 +1,23 @@
+From 561a7e69d2811f236266ff9222a1e683ebf8b9e0 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Thu, 1 Mar 2018 20:50:29 +0100
+Subject: [PATCH] ARM: dts: ipq4019: fix PCI range
+
+The PCI range is invalid and PCI attached devices doen't work.
+
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -359,7 +359,7 @@
+ 			#size-cells = <2>;
+ 
+ 			ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000
+-				  0x82000000 0 0x48000000 0x48000000 0 0x10000000>;
++				  0x82000000 0 0x40300000 0x40300000 0 0x400000>;
+ 
+ 			interrupts = <GIC_SPI 141 IRQ_TYPE_NONE>;
+ 			interrupt-names = "msi";
diff --git a/target/linux/ipq40xx/patches-4.14/104-mtd-nand-add-Winbond-manufacturer-and-chip.patch b/target/linux/ipq40xx/patches-4.14/104-mtd-nand-add-Winbond-manufacturer-and-chip.patch
new file mode 100644
index 000000000..295bc163b
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/104-mtd-nand-add-Winbond-manufacturer-and-chip.patch
@@ -0,0 +1,38 @@
+From 07b6d0cdbbda8c917480eceaec668f09e4cf24a5 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Mon, 14 Nov 2016 23:49:22 +0100
+Subject: [PATCH] mtd: nand: add Winbond manufacturer and chip
+
+This patch adds the W25N01GV NAND to the table of
+known devices. Without this patch the device gets detected:
+
+nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
+nand: Unknown NAND 256MiB 1,8V 8-bit
+nand: 256 MiB, SLC, erase size: 64 KiB, page size: 1024, OOB size : 16
+
+Whereas the u-boot identifies it as:
+spi_nand: spi_nand_flash_probe SF NAND ID 00:ef:aa:21
+SF: Detected W25N01GV with page size 2 KiB, total 128 MiB
+
+Due to the page size discrepancy, it's impossible to attach
+ubi volumes on the device.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ drivers/mtd/nand/nand_ids.c | 4 ++++
+ include/linux/mtd/nand.h    | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/mtd/nand/nand_ids.c
++++ b/drivers/mtd/nand/nand_ids.c
+@@ -54,6 +54,10 @@ struct nand_flash_dev nand_flash_ids[] =
+ 		{ .id = {0xad, 0xde, 0x94, 0xda, 0x74, 0xc4} },
+ 		  SZ_8K, SZ_8K, SZ_2M, NAND_NEED_SCRAMBLING, 6, 640,
+ 		  NAND_ECC_INFO(40, SZ_1K), 4 },
++	{"W25N01GV 1G 3.3V 8-bit",
++		{ .id = {0xef, 0xaa} },
++		  SZ_2K, SZ_128, SZ_128K, NAND_NO_SUBPAGE_WRITE,
++		  2, 64, NAND_ECC_INFO(1, SZ_512) },
+ 
+ 	LEGACY_ID_NAND("NAND 4MiB 5V 8-bit",   0x6B, 4, SZ_8K, SP_OPTIONS),
+ 	LEGACY_ID_NAND("NAND 4MiB 3,3V 8-bit", 0xE3, 4, SZ_8K, SP_OPTIONS),
diff --git a/target/linux/ipq40xx/patches-4.14/305-qcom-ipq4019-use-v2-of-the-kpss-bringup-mechanism.patch b/target/linux/ipq40xx/patches-4.14/305-qcom-ipq4019-use-v2-of-the-kpss-bringup-mechanism.patch
new file mode 100644
index 000000000..1d08b9de7
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/305-qcom-ipq4019-use-v2-of-the-kpss-bringup-mechanism.patch
@@ -0,0 +1,109 @@
+From 6a6c067b7ce2b3de4efbafddc134afbea3ddc1a3 Mon Sep 17 00:00:00 2001
+From: Matthew McClintock <mmcclint@codeaurora.org>
+Date: Fri, 8 Apr 2016 15:26:10 -0500
+Subject: [PATCH] qcom: ipq4019: use v2 of the kpss bringup mechanism
+
+v1 was the incorrect choice here and sometimes the board
+would not come up properly.
+
+Signed-off-by: Matthew McClintock <mmcclint@codeaurora.org>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+Changes:
+	- moved L2-Cache to be a subnode of cpu0
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -36,19 +36,27 @@
+ 		cpu@0 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a7";
+-			enable-method = "qcom,kpss-acc-v1";
++			enable-method = "qcom,kpss-acc-v2";
++			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc0>;
+ 			qcom,saw = <&saw0>;
+ 			reg = <0x0>;
+ 			clocks = <&gcc GCC_APPS_CLK_SRC>;
+ 			clock-frequency = <0>;
+ 			operating-points-v2 = <&cpu0_opp_table>;
++
++			L2: l2-cache {
++				compatible = "qcom,arch-cache";
++				cache-level = <2>;
++				qcom,saw = <&saw_l2>;
++			};
+ 		};
+ 
+ 		cpu@1 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a7";
+-			enable-method = "qcom,kpss-acc-v1";
++			enable-method = "qcom,kpss-acc-v2";
++			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc1>;
+ 			qcom,saw = <&saw1>;
+ 			reg = <0x1>;
+@@ -60,7 +68,8 @@
+ 		cpu@2 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a7";
+-			enable-method = "qcom,kpss-acc-v1";
++			enable-method = "qcom,kpss-acc-v2";
++			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc2>;
+ 			qcom,saw = <&saw2>;
+ 			reg = <0x2>;
+@@ -72,7 +81,8 @@
+ 		cpu@3 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a7";
+-			enable-method = "qcom,kpss-acc-v1";
++			enable-method = "qcom,kpss-acc-v2";
++			next-level-cache = <&L2>;
+ 			qcom,acc = <&acc3>;
+ 			qcom,saw = <&saw3>;
+ 			reg = <0x3>;
+@@ -264,22 +274,22 @@
+ 		};
+ 
+                 acc0: clock-controller@b088000 {
+-                        compatible = "qcom,kpss-acc-v1";
++                        compatible = "qcom,kpss-acc-v2";
+                         reg = <0x0b088000 0x1000>, <0xb008000 0x1000>;
+                 };
+ 
+                 acc1: clock-controller@b098000 {
+-                        compatible = "qcom,kpss-acc-v1";
++                        compatible = "qcom,kpss-acc-v2";
+                         reg = <0x0b098000 0x1000>, <0xb008000 0x1000>;
+                 };
+ 
+                 acc2: clock-controller@b0a8000 {
+-                        compatible = "qcom,kpss-acc-v1";
++                        compatible = "qcom,kpss-acc-v2";
+                         reg = <0x0b0a8000 0x1000>, <0xb008000 0x1000>;
+                 };
+ 
+                 acc3: clock-controller@b0b8000 {
+-                        compatible = "qcom,kpss-acc-v1";
++                        compatible = "qcom,kpss-acc-v2";
+                         reg = <0x0b0b8000 0x1000>, <0xb008000 0x1000>;
+                 };
+ 
+@@ -307,6 +317,12 @@
+                         regulator;
+                 };
+ 
++		saw_l2: regulator@b012000 {
++			compatible = "qcom,saw2";
++			reg = <0xb012000 0x1000>;
++			regulator;
++		};
++
+ 		serial@78af000 {
+ 			compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+ 			reg = <0x78af000 0x200>;
diff --git a/target/linux/ipq40xx/patches-4.14/306-qcom-ipq4019-add-USB-nodes-to-ipq4019-SoC-device-tre.patch b/target/linux/ipq40xx/patches-4.14/306-qcom-ipq4019-add-USB-nodes-to-ipq4019-SoC-device-tre.patch
new file mode 100644
index 000000000..cd0f14eaf
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/306-qcom-ipq4019-add-USB-nodes-to-ipq4019-SoC-device-tre.patch
@@ -0,0 +1,130 @@
+From ea5f4d6f4716f3a0bb4fc3614b7a0e8c0df1cb81 Mon Sep 17 00:00:00 2001
+From: Matthew McClintock <mmcclint@codeaurora.org>
+Date: Thu, 17 Mar 2016 16:22:28 -0500
+Subject: [PATCH] qcom: ipq4019: add USB nodes to ipq4019 SoC device tree
+
+This adds the SoC nodes to the ipq4019 device tree and
+enable it for the DK01.1 board.
+
+Signed-off-by: Matthew McClintock <mmcclint@codeaurora.org>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+Changes:
+	- replaced space with tab
+	- added sleep and mock_utmi clocks
+	- added registers for usb2 and usb3 parent node
+	- changed compatible to qca,ipa4019-dwc3
+	- updated usb2 and usb3 names
+	  (included the reg - in case they become necessary later)
+---
+ arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi | 20 ++++++++
+ arch/arm/boot/dts/qcom-ipq4019.dtsi           | 71 +++++++++++++++++++++++++++
+ 2 files changed, 91 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi
+@@ -101,5 +101,25 @@
+ 		wifi@a800000 {
+ 			status = "ok";
+ 		};
++
++		usb3_ss_phy: ssphy@9a000 {
++			status = "ok";
++		};
++
++		usb3_hs_phy: hsphy@a6000 {
++			status = "ok";
++		};
++
++		usb3: usb3@8af8800 {
++			status = "ok";
++		};
++
++		usb2_hs_phy: hsphy@a8000 {
++			status = "ok";
++		};
++
++		usb2: usb2@60f8800 {
++			status = "ok";
++		};
+ 	};
+ };
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -538,5 +538,76 @@
+ 					  "legacy";
+ 			status = "disabled";
+ 		};
++
++		usb3_ss_phy: ssphy@9a000 {
++			compatible = "qca,uni-ssphy";
++			reg = <0x9a000 0x800>;
++			reg-names = "phy_base";
++			resets = <&gcc USB3_UNIPHY_PHY_ARES>;
++			reset-names = "por_rst";
++			status = "disabled";
++		};
++
++		usb3_hs_phy: hsphy@a6000 {
++			compatible = "qca,baldur-usb3-hsphy";
++			reg = <0xa6000 0x40>;
++			reg-names = "phy_base";
++			resets = <&gcc USB3_HSPHY_POR_ARES>, <&gcc USB3_HSPHY_S_ARES>;
++			reset-names = "por_rst", "srif_rst";
++			status = "disabled";
++		};
++
++		usb3@8af8800 {
++			compatible = "qca,ipq4019-dwc3";
++			reg = <0x8af8800 0x100>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			clocks = <&gcc GCC_USB3_MASTER_CLK>,
++				 <&gcc GCC_USB3_SLEEP_CLK>,
++				 <&gcc GCC_USB3_MOCK_UTMI_CLK>;
++			clock-names = "master", "sleep", "mock_utmi";
++			ranges;
++			status = "disabled";
++
++			dwc3@8a00000 {
++				compatible = "snps,dwc3";
++				reg = <0x8a00000 0xf8000>;
++				interrupts = <0 132 0>;
++				usb-phy = <&usb3_hs_phy>, <&usb3_ss_phy>;
++				phy-names = "usb2-phy", "usb3-phy";
++				dr_mode = "host";
++			};
++		};
++
++		usb2_hs_phy: hsphy@a8000 {
++			compatible = "qca,baldur-usb2-hsphy";
++			reg = <0xa8000 0x40>;
++			reg-names = "phy_base";
++			resets = <&gcc USB2_HSPHY_POR_ARES>, <&gcc USB2_HSPHY_S_ARES>;
++			reset-names = "por_rst", "srif_rst";
++			status = "disabled";
++		};
++
++		usb2@60f8800 {
++			compatible = "qca,ipq4019-dwc3";
++			reg = <0x60f8800 0x100>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			clocks = <&gcc GCC_USB2_MASTER_CLK>,
++				 <&gcc GCC_USB2_SLEEP_CLK>,
++				 <&gcc GCC_USB2_MOCK_UTMI_CLK>;
++			clock-names = "master", "sleep", "mock_utmi";
++			ranges;
++			status = "disabled";
++
++			dwc3@6000000 {
++				compatible = "snps,dwc3";
++				reg = <0x6000000 0xf8000>;
++				interrupts = <0 136 0>;
++				usb-phy = <&usb2_hs_phy>;
++				phy-names = "usb2-phy";
++				dr_mode = "host";
++			};
++		};
+ 	};
+ };
diff --git a/target/linux/ipq40xx/patches-4.14/307-ARM-qcom-Add-IPQ4019-SoC-support.patch b/target/linux/ipq40xx/patches-4.14/307-ARM-qcom-Add-IPQ4019-SoC-support.patch
new file mode 100644
index 000000000..1dc1c97c7
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/307-ARM-qcom-Add-IPQ4019-SoC-support.patch
@@ -0,0 +1,35 @@
+From e7748d641ae37081e2034869491f1629461ae13c Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sat, 19 Nov 2016 00:58:18 +0100
+Subject: [PATCH] ARM: qcom: Add IPQ4019 SoC support
+
+Add support for the Qualcomm Atheros IPQ4019 SoC.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ arch/arm/Makefile          | 1 +
+ arch/arm/mach-qcom/Kconfig | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -149,6 +149,7 @@ textofs-$(CONFIG_SA1111) := 0x00208000
+ endif
+ textofs-$(CONFIG_ARCH_MSM8X60) := 0x00208000
+ textofs-$(CONFIG_ARCH_MSM8960) := 0x00208000
++textofs-$(CONFIG_ARCH_IPQ40XX) := 0x00208000
+ textofs-$(CONFIG_ARCH_AXXIA) := 0x00308000
+ 
+ # Machine directory name.  This list is sorted alphanumerically
+--- a/arch/arm/mach-qcom/Kconfig
++++ b/arch/arm/mach-qcom/Kconfig
+@@ -27,4 +27,9 @@ config ARCH_MDM9615
+ 	bool "Enable support for MDM9615"
+ 	select CLKSRC_QCOM
+ 
++config ARCH_IPQ40XX
++	bool "Enable support for IPQ40XX"
++	select CLKSRC_QCOM
++	select HAVE_ARM_ARCH_TIMER
++
+ endif
diff --git a/target/linux/ipq40xx/patches-4.14/310-msm-adhoc-bus-support.patch b/target/linux/ipq40xx/patches-4.14/310-msm-adhoc-bus-support.patch
new file mode 100644
index 000000000..cd9fd895c
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/310-msm-adhoc-bus-support.patch
@@ -0,0 +1,11026 @@
+From: Christian Lamparter <chunkeey@googlemail.com>
+Subject: BUS: add MSM_BUS
+--- a/drivers/bus/Makefile
++++ b/drivers/bus/Makefile
+@@ -11,6 +11,7 @@ obj-$(CONFIG_BRCMSTB_GISB_ARB)	+= brcmst
+ obj-$(CONFIG_IMX_WEIM)		+= imx-weim.o
+ obj-$(CONFIG_MIPS_CDMM)		+= mips_cdmm.o
+ obj-$(CONFIG_MVEBU_MBUS) 	+= mvebu-mbus.o
++obj-$(CONFIG_BUS_TOPOLOGY_ADHOC)+= msm_bus/
+ 
+ # Interconnect bus driver for OMAP SoCs.
+ obj-$(CONFIG_OMAP_INTERCONNECT)	+= omap_l3_smx.o omap_l3_noc.o
+--- a/drivers/bus/Kconfig
++++ b/drivers/bus/Kconfig
+@@ -93,6 +93,8 @@ config MVEBU_MBUS
+ 	  Driver needed for the MBus configuration on Marvell EBU SoCs
+ 	  (Kirkwood, Dove, Orion5x, MV78XX0 and Armada 370/XP).
+ 
++source "drivers/bus/msm_bus/Kconfig"
++
+ config OMAP_INTERCONNECT
+ 	tristate "OMAP INTERCONNECT DRIVER"
+ 	depends on ARCH_OMAP2PLUS
+--- /dev/null
++++ b/include/dt-bindings/msm/msm-bus-ids.h
+@@ -0,0 +1,869 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __MSM_BUS_IDS_H
++#define __MSM_BUS_IDS_H
++
++/* Topology related enums */
++#define	MSM_BUS_FAB_DEFAULT 0
++#define	MSM_BUS_FAB_APPSS 0
++#define	MSM_BUS_FAB_SYSTEM 1024
++#define	MSM_BUS_FAB_MMSS 2048
++#define	MSM_BUS_FAB_SYSTEM_FPB 3072
++#define	MSM_BUS_FAB_CPSS_FPB 4096
++
++#define	MSM_BUS_FAB_BIMC 0
++#define	MSM_BUS_FAB_SYS_NOC 1024
++#define	MSM_BUS_FAB_MMSS_NOC 2048
++#define	MSM_BUS_FAB_OCMEM_NOC 3072
++#define	MSM_BUS_FAB_PERIPH_NOC 4096
++#define	MSM_BUS_FAB_CONFIG_NOC 5120
++#define	MSM_BUS_FAB_OCMEM_VNOC 6144
++#define	MSM_BUS_FAB_MMSS_AHB 2049
++#define	MSM_BUS_FAB_A0_NOC 6145
++#define	MSM_BUS_FAB_A1_NOC 6146
++#define	MSM_BUS_FAB_A2_NOC 6147
++
++#define	MSM_BUS_MASTER_FIRST 1
++#define	MSM_BUS_MASTER_AMPSS_M0 1
++#define	MSM_BUS_MASTER_AMPSS_M1 2
++#define	MSM_BUS_APPSS_MASTER_FAB_MMSS 3
++#define	MSM_BUS_APPSS_MASTER_FAB_SYSTEM 4
++#define	MSM_BUS_SYSTEM_MASTER_FAB_APPSS 5
++#define	MSM_BUS_MASTER_SPS 6
++#define	MSM_BUS_MASTER_ADM_PORT0 7
++#define	MSM_BUS_MASTER_ADM_PORT1 8
++#define	MSM_BUS_SYSTEM_MASTER_ADM1_PORT0 9
++#define	MSM_BUS_MASTER_ADM1_PORT1 10
++#define	MSM_BUS_MASTER_LPASS_PROC 11
++#define	MSM_BUS_MASTER_MSS_PROCI 12
++#define	MSM_BUS_MASTER_MSS_PROCD 13
++#define	MSM_BUS_MASTER_MSS_MDM_PORT0 14
++#define	MSM_BUS_MASTER_LPASS 15
++#define	MSM_BUS_SYSTEM_MASTER_CPSS_FPB 16
++#define	MSM_BUS_SYSTEM_MASTER_SYSTEM_FPB 17
++#define	MSM_BUS_SYSTEM_MASTER_MMSS_FPB 18
++#define	MSM_BUS_MASTER_ADM1_CI 19
++#define	MSM_BUS_MASTER_ADM0_CI 20
++#define	MSM_BUS_MASTER_MSS_MDM_PORT1 21
++#define	MSM_BUS_MASTER_MDP_PORT0 22
++#define	MSM_BUS_MASTER_MDP_PORT1 23
++#define	MSM_BUS_MMSS_MASTER_ADM1_PORT0 24
++#define	MSM_BUS_MASTER_ROTATOR 25
++#define	MSM_BUS_MASTER_GRAPHICS_3D 26
++#define	MSM_BUS_MASTER_JPEG_DEC 27
++#define	MSM_BUS_MASTER_GRAPHICS_2D_CORE0 28
++#define	MSM_BUS_MASTER_VFE 29
++#define	MSM_BUS_MASTER_VPE 30
++#define	MSM_BUS_MASTER_JPEG_ENC 31
++#define	MSM_BUS_MASTER_GRAPHICS_2D_CORE1 32
++#define	MSM_BUS_MMSS_MASTER_APPS_FAB 33
++#define	MSM_BUS_MASTER_HD_CODEC_PORT0 34
++#define	MSM_BUS_MASTER_HD_CODEC_PORT1 35
++#define	MSM_BUS_MASTER_SPDM 36
++#define	MSM_BUS_MASTER_RPM 37
++#define	MSM_BUS_MASTER_MSS 38
++#define	MSM_BUS_MASTER_RIVA 39
++#define	MSM_BUS_MASTER_SNOC_VMEM 40
++#define	MSM_BUS_MASTER_MSS_SW_PROC 41
++#define	MSM_BUS_MASTER_MSS_FW_PROC 42
++#define	MSM_BUS_MASTER_HMSS 43
++#define	MSM_BUS_MASTER_GSS_NAV 44
++#define	MSM_BUS_MASTER_PCIE 45
++#define	MSM_BUS_MASTER_SATA 46
++#define	MSM_BUS_MASTER_CRYPTO 47
++#define	MSM_BUS_MASTER_VIDEO_CAP 48
++#define	MSM_BUS_MASTER_GRAPHICS_3D_PORT1 49
++#define	MSM_BUS_MASTER_VIDEO_ENC 50
++#define	MSM_BUS_MASTER_VIDEO_DEC 51
++#define	MSM_BUS_MASTER_LPASS_AHB 52
++#define	MSM_BUS_MASTER_QDSS_BAM 53
++#define	MSM_BUS_MASTER_SNOC_CFG 54
++#define	MSM_BUS_MASTER_CRYPTO_CORE0 55
++#define	MSM_BUS_MASTER_CRYPTO_CORE1 56
++#define	MSM_BUS_MASTER_MSS_NAV 57
++#define	MSM_BUS_MASTER_OCMEM_DMA 58
++#define	MSM_BUS_MASTER_WCSS 59
++#define	MSM_BUS_MASTER_QDSS_ETR 60
++#define	MSM_BUS_MASTER_USB3 61
++#define	MSM_BUS_MASTER_JPEG 62
++#define	MSM_BUS_MASTER_VIDEO_P0 63
++#define	MSM_BUS_MASTER_VIDEO_P1 64
++#define	MSM_BUS_MASTER_MSS_PROC 65
++#define	MSM_BUS_MASTER_JPEG_OCMEM 66
++#define	MSM_BUS_MASTER_MDP_OCMEM 67
++#define	MSM_BUS_MASTER_VIDEO_P0_OCMEM 68
++#define	MSM_BUS_MASTER_VIDEO_P1_OCMEM 69
++#define	MSM_BUS_MASTER_VFE_OCMEM 70
++#define	MSM_BUS_MASTER_CNOC_ONOC_CFG 71
++#define	MSM_BUS_MASTER_RPM_INST 72
++#define	MSM_BUS_MASTER_RPM_DATA 73
++#define	MSM_BUS_MASTER_RPM_SYS 74
++#define	MSM_BUS_MASTER_DEHR 75
++#define	MSM_BUS_MASTER_QDSS_DAP 76
++#define	MSM_BUS_MASTER_TIC 77
++#define	MSM_BUS_MASTER_SDCC_1 78
++#define	MSM_BUS_MASTER_SDCC_3 79
++#define	MSM_BUS_MASTER_SDCC_4 80
++#define	MSM_BUS_MASTER_SDCC_2 81
++#define	MSM_BUS_MASTER_TSIF 82
++#define	MSM_BUS_MASTER_BAM_DMA 83
++#define	MSM_BUS_MASTER_BLSP_2 84
++#define	MSM_BUS_MASTER_USB_HSIC 85
++#define	MSM_BUS_MASTER_BLSP_1 86
++#define	MSM_BUS_MASTER_USB_HS 87
++#define	MSM_BUS_MASTER_PNOC_CFG 88
++#define	MSM_BUS_MASTER_V_OCMEM_GFX3D 89
++#define	MSM_BUS_MASTER_IPA 90
++#define	MSM_BUS_MASTER_QPIC 91
++#define	MSM_BUS_MASTER_MDPE 92
++#define	MSM_BUS_MASTER_USB_HS2 93
++#define	MSM_BUS_MASTER_VPU 94
++#define	MSM_BUS_MASTER_UFS 95
++#define	MSM_BUS_MASTER_BCAST 96
++#define	MSM_BUS_MASTER_CRYPTO_CORE2 97
++#define	MSM_BUS_MASTER_EMAC 98
++#define	MSM_BUS_MASTER_VPU_1 99
++#define	MSM_BUS_MASTER_PCIE_1 100
++#define	MSM_BUS_MASTER_USB3_1 101
++#define	MSM_BUS_MASTER_CNOC_MNOC_MMSS_CFG 102
++#define	MSM_BUS_MASTER_CNOC_MNOC_CFG 103
++#define	MSM_BUS_MASTER_TCU_0 104
++#define	MSM_BUS_MASTER_TCU_1 105
++#define	MSM_BUS_MASTER_CPP 106
++#define	MSM_BUS_MASTER_AUDIO 107
++#define	MSM_BUS_MASTER_PCIE_2 108
++#define	MSM_BUS_MASTER_BLSP_BAM 109
++#define	MSM_BUS_MASTER_USB2_BAM 110
++#define	MSM_BUS_MASTER_ADDS_DMA0 111
++#define	MSM_BUS_MASTER_ADDS_DMA1 112
++#define	MSM_BUS_MASTER_ADDS_DMA2 113
++#define	MSM_BUS_MASTER_ADDS_DMA3 114
++#define	MSM_BUS_MASTER_QPIC_BAM 115
++#define	MSM_BUS_MASTER_SDCC_BAM 116
++#define	MSM_BUS_MASTER_DDRC_SNOC 117
++#define	MSM_BUS_MASTER_WSS_0  118
++#define	MSM_BUS_MASTER_WSS_1  119
++#define	MSM_BUS_MASTER_ESS 120
++#define	MSM_BUS_MASTER_QDSS_BAMNDP 121
++#define	MSM_BUS_MASTER_QDSS_SNOC_CFG 122
++#define	MSM_BUS_MASTER_LAST 130
++
++#define	MSM_BUS_SYSTEM_FPB_MASTER_SYSTEM MSM_BUS_SYSTEM_MASTER_SYSTEM_FPB
++#define	MSM_BUS_CPSS_FPB_MASTER_SYSTEM MSM_BUS_SYSTEM_MASTER_CPSS_FPB
++
++#define	MSM_BUS_SNOC_MM_INT_0 10000
++#define	MSM_BUS_SNOC_MM_INT_1 10001
++#define	MSM_BUS_SNOC_MM_INT_2 10002
++#define	MSM_BUS_SNOC_MM_INT_BIMC 10003
++#define	MSM_BUS_SNOC_INT_0 10004
++#define	MSM_BUS_SNOC_INT_1 10005
++#define	MSM_BUS_SNOC_INT_BIMC 10006
++#define	MSM_BUS_SNOC_BIMC_0_MAS 10007
++#define	MSM_BUS_SNOC_BIMC_1_MAS 10008
++#define	MSM_BUS_SNOC_QDSS_INT 10009
++#define	MSM_BUS_PNOC_SNOC_MAS 10010
++#define	MSM_BUS_PNOC_SNOC_SLV 10011
++#define	MSM_BUS_PNOC_INT_0 10012
++#define	MSM_BUS_PNOC_INT_1 10013
++#define	MSM_BUS_PNOC_M_0 10014
++#define	MSM_BUS_PNOC_M_1 10015
++#define	MSM_BUS_BIMC_SNOC_MAS 10016
++#define	MSM_BUS_BIMC_SNOC_SLV 10017
++#define	MSM_BUS_PNOC_SLV_0 10018
++#define	MSM_BUS_PNOC_SLV_1 10019
++#define	MSM_BUS_PNOC_SLV_2 10020
++#define	MSM_BUS_PNOC_SLV_3 10021
++#define	MSM_BUS_PNOC_SLV_4 10022
++#define	MSM_BUS_PNOC_SLV_8 10023
++#define	MSM_BUS_PNOC_SLV_9 10024
++#define	MSM_BUS_SNOC_BIMC_0_SLV 10025
++#define	MSM_BUS_SNOC_BIMC_1_SLV 10026
++#define	MSM_BUS_MNOC_BIMC_MAS 10027
++#define	MSM_BUS_MNOC_BIMC_SLV 10028
++#define	MSM_BUS_BIMC_MNOC_MAS 10029
++#define	MSM_BUS_BIMC_MNOC_SLV 10030
++#define	MSM_BUS_SNOC_BIMC_MAS 10031
++#define	MSM_BUS_SNOC_BIMC_SLV 10032
++#define	MSM_BUS_CNOC_SNOC_MAS 10033
++#define	MSM_BUS_CNOC_SNOC_SLV 10034
++#define	MSM_BUS_SNOC_CNOC_MAS 10035
++#define	MSM_BUS_SNOC_CNOC_SLV 10036
++#define	MSM_BUS_OVNOC_SNOC_MAS 10037
++#define	MSM_BUS_OVNOC_SNOC_SLV 10038
++#define	MSM_BUS_SNOC_OVNOC_MAS 10039
++#define	MSM_BUS_SNOC_OVNOC_SLV 10040
++#define	MSM_BUS_SNOC_PNOC_MAS 10041
++#define	MSM_BUS_SNOC_PNOC_SLV 10042
++#define	MSM_BUS_BIMC_INT_APPS_EBI 10043
++#define	MSM_BUS_BIMC_INT_APPS_SNOC 10044
++#define	MSM_BUS_SNOC_BIMC_2_MAS 10045
++#define	MSM_BUS_SNOC_BIMC_2_SLV 10046
++#define	MSM_BUS_PNOC_SLV_5 10047
++#define	MSM_BUS_PNOC_SLV_6 10048
++#define	MSM_BUS_PNOC_INT_2 10049
++#define	MSM_BUS_PNOC_INT_3 10050
++#define	MSM_BUS_PNOC_INT_4 10051
++#define	MSM_BUS_PNOC_INT_5 10052
++#define	MSM_BUS_PNOC_INT_6 10053
++#define	MSM_BUS_PNOC_INT_7 10054
++#define	MSM_BUS_BIMC_SNOC_1_MAS 10055
++#define	MSM_BUS_BIMC_SNOC_1_SLV 10056
++#define	MSM_BUS_PNOC_A1NOC_MAS 10057
++#define	MSM_BUS_PNOC_A1NOC_SLV 10058
++#define	MSM_BUS_CNOC_A1NOC_MAS 10059
++#define	MSM_BUS_A0NOC_SNOC_MAS 10060
++#define	MSM_BUS_A0NOC_SNOC_SLV 10061
++#define	MSM_BUS_A1NOC_SNOC_SLV 10062
++#define	MSM_BUS_A1NOC_SNOC_MAS 10063
++#define	MSM_BUS_A2NOC_SNOC_MAS 10064
++#define	MSM_BUS_A2NOC_SNOC_SLV 10065
++#define	MSM_BUS_PNOC_SLV_7 10066
++#define	MSM_BUS_INT_LAST 10067
++
++#define	MSM_BUS_SLAVE_FIRST 512
++#define	MSM_BUS_SLAVE_EBI_CH0 512
++#define	MSM_BUS_SLAVE_EBI_CH1 513
++#define	MSM_BUS_SLAVE_AMPSS_L2 514
++#define	MSM_BUS_APPSS_SLAVE_FAB_MMSS 515
++#define	MSM_BUS_APPSS_SLAVE_FAB_SYSTEM 516
++#define	MSM_BUS_SYSTEM_SLAVE_FAB_APPS 517
++#define	MSM_BUS_SLAVE_SPS 518
++#define	MSM_BUS_SLAVE_SYSTEM_IMEM 519
++#define	MSM_BUS_SLAVE_AMPSS 520
++#define	MSM_BUS_SLAVE_MSS 521
++#define	MSM_BUS_SLAVE_LPASS 522
++#define	MSM_BUS_SYSTEM_SLAVE_CPSS_FPB 523
++#define	MSM_BUS_SYSTEM_SLAVE_SYSTEM_FPB 524
++#define	MSM_BUS_SYSTEM_SLAVE_MMSS_FPB 525
++#define	MSM_BUS_SLAVE_CORESIGHT 526
++#define	MSM_BUS_SLAVE_RIVA 527
++#define	MSM_BUS_SLAVE_SMI 528
++#define	MSM_BUS_MMSS_SLAVE_FAB_APPS 529
++#define	MSM_BUS_MMSS_SLAVE_FAB_APPS_1 530
++#define	MSM_BUS_SLAVE_MM_IMEM 531
++#define	MSM_BUS_SLAVE_CRYPTO 532
++#define	MSM_BUS_SLAVE_SPDM 533
++#define	MSM_BUS_SLAVE_RPM 534
++#define	MSM_BUS_SLAVE_RPM_MSG_RAM 535
++#define	MSM_BUS_SLAVE_MPM 536
++#define	MSM_BUS_SLAVE_PMIC1_SSBI1_A 537
++#define	MSM_BUS_SLAVE_PMIC1_SSBI1_B 538
++#define	MSM_BUS_SLAVE_PMIC1_SSBI1_C 539
++#define	MSM_BUS_SLAVE_PMIC2_SSBI2_A 540
++#define	MSM_BUS_SLAVE_PMIC2_SSBI2_B 541
++#define	MSM_BUS_SLAVE_GSBI1_UART 542
++#define	MSM_BUS_SLAVE_GSBI2_UART 543
++#define	MSM_BUS_SLAVE_GSBI3_UART 544
++#define	MSM_BUS_SLAVE_GSBI4_UART 545
++#define	MSM_BUS_SLAVE_GSBI5_UART 546
++#define	MSM_BUS_SLAVE_GSBI6_UART 547
++#define	MSM_BUS_SLAVE_GSBI7_UART 548
++#define	MSM_BUS_SLAVE_GSBI8_UART 549
++#define	MSM_BUS_SLAVE_GSBI9_UART 550
++#define	MSM_BUS_SLAVE_GSBI10_UART 551
++#define	MSM_BUS_SLAVE_GSBI11_UART 552
++#define	MSM_BUS_SLAVE_GSBI12_UART 553
++#define	MSM_BUS_SLAVE_GSBI1_QUP 554
++#define	MSM_BUS_SLAVE_GSBI2_QUP 555
++#define	MSM_BUS_SLAVE_GSBI3_QUP 556
++#define	MSM_BUS_SLAVE_GSBI4_QUP 557
++#define	MSM_BUS_SLAVE_GSBI5_QUP 558
++#define	MSM_BUS_SLAVE_GSBI6_QUP 559
++#define	MSM_BUS_SLAVE_GSBI7_QUP 560
++#define	MSM_BUS_SLAVE_GSBI8_QUP 561
++#define	MSM_BUS_SLAVE_GSBI9_QUP 562
++#define	MSM_BUS_SLAVE_GSBI10_QUP 563
++#define	MSM_BUS_SLAVE_GSBI11_QUP 564
++#define	MSM_BUS_SLAVE_GSBI12_QUP 565
++#define	MSM_BUS_SLAVE_EBI2_NAND 566
++#define	MSM_BUS_SLAVE_EBI2_CS0 567
++#define	MSM_BUS_SLAVE_EBI2_CS1 568
++#define	MSM_BUS_SLAVE_EBI2_CS2 569
++#define	MSM_BUS_SLAVE_EBI2_CS3 570
++#define	MSM_BUS_SLAVE_EBI2_CS4 571
++#define	MSM_BUS_SLAVE_EBI2_CS5 572
++#define	MSM_BUS_SLAVE_USB_FS1 573
++#define	MSM_BUS_SLAVE_USB_FS2 574
++#define	MSM_BUS_SLAVE_TSIF 575
++#define	MSM_BUS_SLAVE_MSM_TSSC 576
++#define	MSM_BUS_SLAVE_MSM_PDM 577
++#define	MSM_BUS_SLAVE_MSM_DIMEM 578
++#define	MSM_BUS_SLAVE_MSM_TCSR 579
++#define	MSM_BUS_SLAVE_MSM_PRNG 580
++#define	MSM_BUS_SLAVE_GSS 581
++#define	MSM_BUS_SLAVE_SATA 582
++#define	MSM_BUS_SLAVE_USB3 583
++#define	MSM_BUS_SLAVE_WCSS 584
++#define	MSM_BUS_SLAVE_OCIMEM 585
++#define	MSM_BUS_SLAVE_SNOC_OCMEM 586
++#define	MSM_BUS_SLAVE_SERVICE_SNOC 587
++#define	MSM_BUS_SLAVE_QDSS_STM 588
++#define	MSM_BUS_SLAVE_CAMERA_CFG 589
++#define	MSM_BUS_SLAVE_DISPLAY_CFG 590
++#define	MSM_BUS_SLAVE_OCMEM_CFG 591
++#define	MSM_BUS_SLAVE_CPR_CFG 592
++#define	MSM_BUS_SLAVE_CPR_XPU_CFG 593
++#define	MSM_BUS_SLAVE_MISC_CFG 594
++#define	MSM_BUS_SLAVE_MISC_XPU_CFG 595
++#define	MSM_BUS_SLAVE_VENUS_CFG 596
++#define	MSM_BUS_SLAVE_MISC_VENUS_CFG 597
++#define	MSM_BUS_SLAVE_GRAPHICS_3D_CFG 598
++#define	MSM_BUS_SLAVE_MMSS_CLK_CFG 599
++#define	MSM_BUS_SLAVE_MMSS_CLK_XPU_CFG 600
++#define	MSM_BUS_SLAVE_MNOC_MPU_CFG 601
++#define	MSM_BUS_SLAVE_ONOC_MPU_CFG 602
++#define	MSM_BUS_SLAVE_SERVICE_MNOC 603
++#define	MSM_BUS_SLAVE_OCMEM 604
++#define	MSM_BUS_SLAVE_SERVICE_ONOC 605
++#define	MSM_BUS_SLAVE_SDCC_1 606
++#define	MSM_BUS_SLAVE_SDCC_3 607
++#define	MSM_BUS_SLAVE_SDCC_2 608
++#define	MSM_BUS_SLAVE_SDCC_4 609
++#define	MSM_BUS_SLAVE_BAM_DMA 610
++#define	MSM_BUS_SLAVE_BLSP_2 611
++#define	MSM_BUS_SLAVE_USB_HSIC 612
++#define	MSM_BUS_SLAVE_BLSP_1 613
++#define	MSM_BUS_SLAVE_USB_HS 614
++#define	MSM_BUS_SLAVE_PDM 615
++#define	MSM_BUS_SLAVE_PERIPH_APU_CFG 616
++#define	MSM_BUS_SLAVE_PNOC_MPU_CFG 617
++#define	MSM_BUS_SLAVE_PRNG 618
++#define	MSM_BUS_SLAVE_SERVICE_PNOC 619
++#define	MSM_BUS_SLAVE_CLK_CTL 620
++#define	MSM_BUS_SLAVE_CNOC_MSS 621
++#define	MSM_BUS_SLAVE_SECURITY 622
++#define	MSM_BUS_SLAVE_TCSR 623
++#define	MSM_BUS_SLAVE_TLMM 624
++#define	MSM_BUS_SLAVE_CRYPTO_0_CFG 625
++#define	MSM_BUS_SLAVE_CRYPTO_1_CFG 626
++#define	MSM_BUS_SLAVE_IMEM_CFG 627
++#define	MSM_BUS_SLAVE_MESSAGE_RAM 628
++#define	MSM_BUS_SLAVE_BIMC_CFG 629
++#define	MSM_BUS_SLAVE_BOOT_ROM 630
++#define	MSM_BUS_SLAVE_CNOC_MNOC_MMSS_CFG 631
++#define	MSM_BUS_SLAVE_PMIC_ARB 632
++#define	MSM_BUS_SLAVE_SPDM_WRAPPER 633
++#define	MSM_BUS_SLAVE_DEHR_CFG 634
++#define	MSM_BUS_SLAVE_QDSS_CFG 635
++#define	MSM_BUS_SLAVE_RBCPR_CFG 636
++#define	MSM_BUS_SLAVE_RBCPR_QDSS_APU_CFG 637
++#define	MSM_BUS_SLAVE_SNOC_MPU_CFG 638
++#define	MSM_BUS_SLAVE_CNOC_ONOC_CFG 639
++#define	MSM_BUS_SLAVE_CNOC_MNOC_CFG 640
++#define	MSM_BUS_SLAVE_PNOC_CFG 641
++#define	MSM_BUS_SLAVE_SNOC_CFG 642
++#define	MSM_BUS_SLAVE_EBI1_DLL_CFG 643
++#define	MSM_BUS_SLAVE_PHY_APU_CFG 644
++#define	MSM_BUS_SLAVE_EBI1_PHY_CFG 645
++#define	MSM_BUS_SLAVE_SERVICE_CNOC 646
++#define	MSM_BUS_SLAVE_IPS_CFG 647
++#define	MSM_BUS_SLAVE_QPIC 648
++#define	MSM_BUS_SLAVE_DSI_CFG 649
++#define	MSM_BUS_SLAVE_UFS_CFG 650
++#define	MSM_BUS_SLAVE_RBCPR_CX_CFG 651
++#define	MSM_BUS_SLAVE_RBCPR_MX_CFG 652
++#define	MSM_BUS_SLAVE_PCIE_CFG 653
++#define	MSM_BUS_SLAVE_USB_PHYS_CFG 654
++#define	MSM_BUS_SLAVE_VIDEO_CAP_CFG 655
++#define	MSM_BUS_SLAVE_AVSYNC_CFG 656
++#define	MSM_BUS_SLAVE_CRYPTO_2_CFG 657
++#define	MSM_BUS_SLAVE_VPU_CFG 658
++#define	MSM_BUS_SLAVE_BCAST_CFG 659
++#define	MSM_BUS_SLAVE_KLM_CFG 660
++#define	MSM_BUS_SLAVE_GENI_IR_CFG 661
++#define	MSM_BUS_SLAVE_OCMEM_GFX 662
++#define	MSM_BUS_SLAVE_CATS_128 663
++#define	MSM_BUS_SLAVE_OCMEM_64 664
++#define MSM_BUS_SLAVE_PCIE_0 665
++#define MSM_BUS_SLAVE_PCIE_1 666
++#define	MSM_BUS_SLAVE_PCIE_0_CFG 667
++#define	MSM_BUS_SLAVE_PCIE_1_CFG 668
++#define	MSM_BUS_SLAVE_SRVC_MNOC 669
++#define	MSM_BUS_SLAVE_USB_HS2 670
++#define	MSM_BUS_SLAVE_AUDIO	671
++#define	MSM_BUS_SLAVE_TCU	672
++#define	MSM_BUS_SLAVE_APPSS	673
++#define	MSM_BUS_SLAVE_PCIE_PARF	674
++#define	MSM_BUS_SLAVE_USB3_PHY_CFG	675
++#define	MSM_BUS_SLAVE_IPA_CFG	676
++#define	MSM_BUS_SLAVE_A0NOC_SNOC 677
++#define	MSM_BUS_SLAVE_A1NOC_SNOC 678
++#define	MSM_BUS_SLAVE_A2NOC_SNOC 679
++#define	MSM_BUS_SLAVE_HMSS_L3 680
++#define	MSM_BUS_SLAVE_PIMEM_CFG 681
++#define	MSM_BUS_SLAVE_DCC_CFG 682
++#define	MSM_BUS_SLAVE_QDSS_RBCPR_APU_CFG 683
++#define	MSM_BUS_SLAVE_PCIE_2_CFG 684
++#define	MSM_BUS_SLAVE_PCIE20_AHB2PHY 685
++#define	MSM_BUS_SLAVE_A0NOC_CFG 686
++#define	MSM_BUS_SLAVE_A1NOC_CFG 687
++#define	MSM_BUS_SLAVE_A2NOC_CFG 688
++#define	MSM_BUS_SLAVE_A1NOC_MPU_CFG 689
++#define	MSM_BUS_SLAVE_A2NOC_MPU_CFG 690
++#define	MSM_BUS_SLAVE_A0NOC_SMMU_CFG 691
++#define	MSM_BUS_SLAVE_A1NOC_SMMU_CFG 692
++#define	MSM_BUS_SLAVE_A2NOC_SMMU_CFG 693
++#define	MSM_BUS_SLAVE_LPASS_SMMU_CFG 694
++#define	MSM_BUS_SLAVE_MMAGIC_CFG 695
++#define	MSM_BUS_SLAVE_VENUS_THROTTLE_CFG 696
++#define	MSM_BUS_SLAVE_SSC_CFG 697
++#define	MSM_BUS_SLAVE_DSA_CFG 698
++#define	MSM_BUS_SLAVE_DSA_MPU_CFG 699
++#define	MSM_BUS_SLAVE_DISPLAY_THROTTLE_CFG 700
++#define	MSM_BUS_SLAVE_SMMU_CPP_CFG 701
++#define	MSM_BUS_SLAVE_SMMU_JPEG_CFG 702
++#define	MSM_BUS_SLAVE_SMMU_MDP_CFG 703
++#define	MSM_BUS_SLAVE_SMMU_ROTATOR_CFG 704
++#define	MSM_BUS_SLAVE_SMMU_VENUS_CFG 705
++#define	MSM_BUS_SLAVE_SMMU_VFE_CFG 706
++#define	MSM_BUS_SLAVE_A0NOC_MPU_CFG 707
++#define	MSM_BUS_SLAVE_VMEM_CFG 708
++#define	MSM_BUS_SLAVE_CAMERA_THROTTLE_CFG 700
++#define	MSM_BUS_SLAVE_VMEM 709
++#define	MSM_BUS_SLAVE_AHB2PHY 710
++#define	MSM_BUS_SLAVE_PIMEM 711
++#define	MSM_BUS_SLAVE_SNOC_VMEM 712
++#define	MSM_BUS_SLAVE_PCIE_2 713
++#define	MSM_BUS_SLAVE_RBCPR_MX 714
++#define	MSM_BUS_SLAVE_RBCPR_CX 715
++#define	MSM_BUS_SLAVE_PRNG_APU_CFG 716
++#define	MSM_BUS_SLAVE_PERIPH_MPU_CFG 717
++#define	MSM_BUS_SLAVE_GCNT 718
++#define	MSM_BUS_SLAVE_ADSS_CFG 719
++#define	MSM_BUS_SLAVE_ADSS_VMIDMT_CFG 720
++#define	MSM_BUS_SLAVE_QHSS_APU_CFG 721
++#define	MSM_BUS_SLAVE_MDIO 722
++#define	MSM_BUS_SLAVE_FEPHY_CFG 723
++#define	MSM_BUS_SLAVE_SRIF 724
++#define	MSM_BUS_SLAVE_LAST 730
++#define	MSM_BUS_SLAVE_DDRC_CFG 731
++#define	MSM_BUS_SLAVE_DDRC_APU_CFG 732
++#define	MSM_BUS_SLAVE_MPU0_CFG 733
++#define	MSM_BUS_SLAVE_MPU1_CFG 734
++#define	MSM_BUS_SLAVE_MPU2_CFG 734
++#define	MSM_BUS_SLAVE_ESS_VMIDMT_CFG 735
++#define	MSM_BUS_SLAVE_ESS_APU_CFG 736
++#define	MSM_BUS_SLAVE_USB2_CFG 737
++#define	MSM_BUS_SLAVE_BLSP_CFG 738
++#define	MSM_BUS_SLAVE_QPIC_CFG 739
++#define	MSM_BUS_SLAVE_SDCC_CFG 740
++#define	MSM_BUS_SLAVE_WSS0_VMIDMT_CFG 741
++#define	MSM_BUS_SLAVE_WSS0_APU_CFG 742
++#define	MSM_BUS_SLAVE_WSS1_VMIDMT_CFG 743
++#define	MSM_BUS_SLAVE_WSS1_APU_CFG 744
++#define	MSM_BUS_SLAVE_SRVC_PCNOC 745
++#define	MSM_BUS_SLAVE_SNOC_DDRC 746
++#define	MSM_BUS_SLAVE_A7SS 747
++#define	MSM_BUS_SLAVE_WSS0_CFG 748
++#define	MSM_BUS_SLAVE_WSS1_CFG 749
++#define	MSM_BUS_SLAVE_PCIE 750
++#define	MSM_BUS_SLAVE_USB3_CFG 751
++#define	MSM_BUS_SLAVE_CRYPTO_CFG 752
++#define	MSM_BUS_SLAVE_ESS_CFG 753
++#define	MSM_BUS_SLAVE_SRVC_SNOC 754
++
++#define	MSM_BUS_SYSTEM_FPB_SLAVE_SYSTEM  MSM_BUS_SYSTEM_SLAVE_SYSTEM_FPB
++#define MSM_BUS_CPSS_FPB_SLAVE_SYSTEM MSM_BUS_SYSTEM_SLAVE_CPSS_FPB
++
++/*
++ * ID's used in RPM messages
++ */
++#define ICBID_MASTER_APPSS_PROC 0
++#define ICBID_MASTER_MSS_PROC 1
++#define ICBID_MASTER_MNOC_BIMC 2
++#define ICBID_MASTER_SNOC_BIMC 3
++#define ICBID_MASTER_SNOC_BIMC_0 ICBID_MASTER_SNOC_BIMC
++#define ICBID_MASTER_CNOC_MNOC_MMSS_CFG 4
++#define ICBID_MASTER_CNOC_MNOC_CFG 5
++#define ICBID_MASTER_GFX3D 6
++#define ICBID_MASTER_JPEG 7
++#define ICBID_MASTER_MDP 8
++#define ICBID_MASTER_MDP0 ICBID_MASTER_MDP
++#define ICBID_MASTER_MDPS ICBID_MASTER_MDP
++#define ICBID_MASTER_VIDEO 9
++#define ICBID_MASTER_VIDEO_P0 ICBID_MASTER_VIDEO
++#define ICBID_MASTER_VIDEO_P1 10
++#define ICBID_MASTER_VFE 11
++#define ICBID_MASTER_CNOC_ONOC_CFG 12
++#define ICBID_MASTER_JPEG_OCMEM 13
++#define ICBID_MASTER_MDP_OCMEM 14
++#define ICBID_MASTER_VIDEO_P0_OCMEM 15
++#define ICBID_MASTER_VIDEO_P1_OCMEM 16
++#define ICBID_MASTER_VFE_OCMEM 17
++#define ICBID_MASTER_LPASS_AHB 18
++#define ICBID_MASTER_QDSS_BAM 19
++#define ICBID_MASTER_SNOC_CFG 20
++#define ICBID_MASTER_BIMC_SNOC 21
++#define ICBID_MASTER_CNOC_SNOC 22
++#define ICBID_MASTER_CRYPTO 23
++#define ICBID_MASTER_CRYPTO_CORE0 ICBID_MASTER_CRYPTO
++#define ICBID_MASTER_CRYPTO_CORE1 24
++#define ICBID_MASTER_LPASS_PROC 25
++#define ICBID_MASTER_MSS 26
++#define ICBID_MASTER_MSS_NAV 27
++#define ICBID_MASTER_OCMEM_DMA 28
++#define ICBID_MASTER_PNOC_SNOC 29
++#define ICBID_MASTER_WCSS 30
++#define ICBID_MASTER_QDSS_ETR 31
++#define ICBID_MASTER_USB3 32
++#define ICBID_MASTER_USB3_0 ICBID_MASTER_USB3
++#define ICBID_MASTER_SDCC_1 33
++#define ICBID_MASTER_SDCC_3 34
++#define ICBID_MASTER_SDCC_2 35
++#define ICBID_MASTER_SDCC_4 36
++#define ICBID_MASTER_TSIF 37
++#define ICBID_MASTER_BAM_DMA 38
++#define ICBID_MASTER_BLSP_2 39
++#define ICBID_MASTER_USB_HSIC 40
++#define ICBID_MASTER_BLSP_1 41
++#define ICBID_MASTER_USB_HS 42
++#define ICBID_MASTER_USB_HS1 ICBID_MASTER_USB_HS
++#define ICBID_MASTER_PNOC_CFG 43
++#define ICBID_MASTER_SNOC_PNOC 44
++#define ICBID_MASTER_RPM_INST 45
++#define ICBID_MASTER_RPM_DATA 46
++#define ICBID_MASTER_RPM_SYS 47
++#define ICBID_MASTER_DEHR 48
++#define ICBID_MASTER_QDSS_DAP 49
++#define ICBID_MASTER_SPDM 50
++#define ICBID_MASTER_TIC 51
++#define ICBID_MASTER_SNOC_CNOC 52
++#define ICBID_MASTER_GFX3D_OCMEM 53
++#define ICBID_MASTER_GFX3D_GMEM ICBID_MASTER_GFX3D_OCMEM
++#define ICBID_MASTER_OVIRT_SNOC 54
++#define ICBID_MASTER_SNOC_OVIRT 55
++#define ICBID_MASTER_SNOC_GVIRT ICBID_MASTER_SNOC_OVIRT
++#define ICBID_MASTER_ONOC_OVIRT 56
++#define ICBID_MASTER_USB_HS2 57
++#define ICBID_MASTER_QPIC 58
++#define ICBID_MASTER_IPA 59
++#define ICBID_MASTER_DSI 60
++#define ICBID_MASTER_MDP1 61
++#define ICBID_MASTER_MDPE ICBID_MASTER_MDP1
++#define ICBID_MASTER_VPU_PROC 62
++#define ICBID_MASTER_VPU 63
++#define ICBID_MASTER_VPU0 ICBID_MASTER_VPU
++#define ICBID_MASTER_CRYPTO_CORE2 64
++#define ICBID_MASTER_PCIE_0 65
++#define ICBID_MASTER_PCIE_1 66
++#define ICBID_MASTER_SATA 67
++#define ICBID_MASTER_UFS 68
++#define ICBID_MASTER_USB3_1 69
++#define ICBID_MASTER_VIDEO_OCMEM 70
++#define ICBID_MASTER_VPU1 71
++#define ICBID_MASTER_VCAP 72
++#define ICBID_MASTER_EMAC 73
++#define ICBID_MASTER_BCAST 74
++#define ICBID_MASTER_MMSS_PROC 75
++#define ICBID_MASTER_SNOC_BIMC_1 76
++#define ICBID_MASTER_SNOC_PCNOC 77
++#define ICBID_MASTER_AUDIO 78
++#define ICBID_MASTER_MM_INT_0 79
++#define ICBID_MASTER_MM_INT_1 80
++#define ICBID_MASTER_MM_INT_2 81
++#define ICBID_MASTER_MM_INT_BIMC 82
++#define ICBID_MASTER_MSS_INT 83
++#define ICBID_MASTER_PCNOC_CFG 84
++#define ICBID_MASTER_PCNOC_INT_0 85
++#define ICBID_MASTER_PCNOC_INT_1 86
++#define ICBID_MASTER_PCNOC_M_0 87
++#define ICBID_MASTER_PCNOC_M_1 88
++#define ICBID_MASTER_PCNOC_S_0 89
++#define ICBID_MASTER_PCNOC_S_1 90
++#define ICBID_MASTER_PCNOC_S_2 91
++#define ICBID_MASTER_PCNOC_S_3 92
++#define ICBID_MASTER_PCNOC_S_4 93
++#define ICBID_MASTER_PCNOC_S_6 94
++#define ICBID_MASTER_PCNOC_S_7 95
++#define ICBID_MASTER_PCNOC_S_8 96
++#define ICBID_MASTER_PCNOC_S_9 97
++#define ICBID_MASTER_QDSS_INT 98
++#define ICBID_MASTER_SNOC_INT_0 99
++#define ICBID_MASTER_SNOC_INT_1 100
++#define ICBID_MASTER_SNOC_INT_BIMC 101
++#define ICBID_MASTER_TCU_0 102
++#define ICBID_MASTER_TCU_1 103
++#define ICBID_MASTER_BIMC_INT_0 104
++#define ICBID_MASTER_BIMC_INT_1 105
++#define ICBID_MASTER_CAMERA 106
++#define ICBID_MASTER_RICA 107
++#define ICBID_MASTER_PCNOC_S_5	129
++#define ICBID_MASTER_PCNOC_INT_2	124
++#define ICBID_MASTER_PCNOC_INT_3	125
++#define ICBID_MASTER_PCNOC_INT_4	126
++#define ICBID_MASTER_PCNOC_INT_5	127
++#define ICBID_MASTER_PCNOC_INT_6	128
++#define ICBID_MASTER_PCIE_2 119
++#define ICBID_MASTER_MASTER_CNOC_A1NOC 116
++#define ICBID_MASTER_A0NOC_SNOC 110
++#define ICBID_MASTER_A1NOC_SNOC 111
++#define ICBID_MASTER_A2NOC_SNOC 112
++#define ICBID_MASTER_PNOC_A1NOC 117
++#define ICBID_MASTER_ROTATOR 120
++#define ICBID_MASTER_SNOC_VMEM 114
++#define ICBID_MASTER_VENUS_VMEM 121
++#define ICBID_MASTER_HMSS 118
++#define ICBID_MASTER_BIMC_SNOC_1 109
++#define ICBID_MASTER_CNOC_A1NOC 116
++#define ICBID_MASTER_CPP 115
++#define ICBID_MASTER_BLSP_BAM 130
++#define ICBID_MASTER_USB2_BAM 131
++#define ICBID_MASTER_ADSS_DMA0 132
++#define ICBID_MASTER_ADSS_DMA1 133
++#define ICBID_MASTER_ADSS_DMA2 134
++#define ICBID_MASTER_ADSS_DMA3 135
++#define ICBID_MASTER_QPIC_BAM 136
++#define ICBID_MASTER_SDCC_BAM 137
++#define ICBID_MASTER_DDRC_SNOC 138
++#define ICBID_MASTER_WSS_0 139
++#define ICBID_MASTER_WSS_1 140
++#define ICBID_MASTER_ESS 141
++#define ICBID_MASTER_PCIE 142
++#define ICBID_MASTER_QDSS_BAMNDP 143
++#define ICBID_MASTER_QDSS_SNOC_CFG 144
++
++#define ICBID_SLAVE_EBI1 0
++#define ICBID_SLAVE_APPSS_L2 1
++#define ICBID_SLAVE_BIMC_SNOC 2
++#define ICBID_SLAVE_CAMERA_CFG 3
++#define ICBID_SLAVE_DISPLAY_CFG 4
++#define ICBID_SLAVE_OCMEM_CFG 5
++#define ICBID_SLAVE_CPR_CFG 6
++#define ICBID_SLAVE_CPR_XPU_CFG 7
++#define ICBID_SLAVE_MISC_CFG 8
++#define ICBID_SLAVE_MISC_XPU_CFG 9
++#define ICBID_SLAVE_VENUS_CFG 10
++#define ICBID_SLAVE_GFX3D_CFG 11
++#define ICBID_SLAVE_MMSS_CLK_CFG 12
++#define ICBID_SLAVE_MMSS_CLK_XPU_CFG 13
++#define ICBID_SLAVE_MNOC_MPU_CFG 14
++#define ICBID_SLAVE_ONOC_MPU_CFG 15
++#define ICBID_SLAVE_MNOC_BIMC 16
++#define ICBID_SLAVE_SERVICE_MNOC 17
++#define ICBID_SLAVE_OCMEM 18
++#define ICBID_SLAVE_GMEM ICBID_SLAVE_OCMEM
++#define ICBID_SLAVE_SERVICE_ONOC 19
++#define ICBID_SLAVE_APPSS 20
++#define ICBID_SLAVE_LPASS 21
++#define ICBID_SLAVE_USB3 22
++#define ICBID_SLAVE_USB3_0 ICBID_SLAVE_USB3
++#define ICBID_SLAVE_WCSS 23
++#define ICBID_SLAVE_SNOC_BIMC 24
++#define ICBID_SLAVE_SNOC_BIMC_0 ICBID_SLAVE_SNOC_BIMC
++#define ICBID_SLAVE_SNOC_CNOC 25
++#define ICBID_SLAVE_IMEM 26
++#define ICBID_SLAVE_OCIMEM ICBID_SLAVE_IMEM
++#define ICBID_SLAVE_SNOC_OVIRT 27
++#define ICBID_SLAVE_SNOC_GVIRT ICBID_SLAVE_SNOC_OVIRT
++#define ICBID_SLAVE_SNOC_PNOC 28
++#define ICBID_SLAVE_SNOC_PCNOC ICBID_SLAVE_SNOC_PNOC
++#define ICBID_SLAVE_SERVICE_SNOC 29
++#define ICBID_SLAVE_QDSS_STM 30
++#define ICBID_SLAVE_SDCC_1 31
++#define ICBID_SLAVE_SDCC_3 32
++#define ICBID_SLAVE_SDCC_2 33
++#define ICBID_SLAVE_SDCC_4 34
++#define ICBID_SLAVE_TSIF 35
++#define ICBID_SLAVE_BAM_DMA 36
++#define ICBID_SLAVE_BLSP_2 37
++#define ICBID_SLAVE_USB_HSIC 38
++#define ICBID_SLAVE_BLSP_1 39
++#define ICBID_SLAVE_USB_HS 40
++#define ICBID_SLAVE_USB_HS1 ICBID_SLAVE_USB_HS
++#define ICBID_SLAVE_PDM 41
++#define ICBID_SLAVE_PERIPH_APU_CFG 42
++#define ICBID_SLAVE_PNOC_MPU_CFG 43
++#define ICBID_SLAVE_PRNG 44
++#define ICBID_SLAVE_PNOC_SNOC 45
++#define ICBID_SLAVE_PCNOC_SNOC ICBID_SLAVE_PNOC_SNOC
++#define ICBID_SLAVE_SERVICE_PNOC 46
++#define ICBID_SLAVE_CLK_CTL 47
++#define ICBID_SLAVE_CNOC_MSS 48
++#define ICBID_SLAVE_PCNOC_MSS ICBID_SLAVE_CNOC_MSS
++#define ICBID_SLAVE_SECURITY 49
++#define ICBID_SLAVE_TCSR 50
++#define ICBID_SLAVE_TLMM 51
++#define ICBID_SLAVE_CRYPTO_0_CFG 52
++#define ICBID_SLAVE_CRYPTO_1_CFG 53
++#define ICBID_SLAVE_IMEM_CFG 54
++#define ICBID_SLAVE_MESSAGE_RAM 55
++#define ICBID_SLAVE_BIMC_CFG 56
++#define ICBID_SLAVE_BOOT_ROM 57
++#define ICBID_SLAVE_CNOC_MNOC_MMSS_CFG 58
++#define ICBID_SLAVE_PMIC_ARB 59
++#define ICBID_SLAVE_SPDM_WRAPPER 60
++#define ICBID_SLAVE_DEHR_CFG 61
++#define ICBID_SLAVE_MPM 62
++#define ICBID_SLAVE_QDSS_CFG 63
++#define ICBID_SLAVE_RBCPR_CFG 64
++#define ICBID_SLAVE_RBCPR_CX_CFG ICBID_SLAVE_RBCPR_CFG
++#define ICBID_SLAVE_RBCPR_QDSS_APU_CFG 65
++#define ICBID_SLAVE_CNOC_MNOC_CFG 66
++#define ICBID_SLAVE_SNOC_MPU_CFG 67
++#define ICBID_SLAVE_CNOC_ONOC_CFG 68
++#define ICBID_SLAVE_PNOC_CFG 69
++#define ICBID_SLAVE_SNOC_CFG 70
++#define ICBID_SLAVE_EBI1_DLL_CFG 71
++#define ICBID_SLAVE_PHY_APU_CFG 72
++#define ICBID_SLAVE_EBI1_PHY_CFG 73
++#define ICBID_SLAVE_RPM 74
++#define ICBID_SLAVE_CNOC_SNOC 75
++#define ICBID_SLAVE_SERVICE_CNOC 76
++#define ICBID_SLAVE_OVIRT_SNOC 77
++#define ICBID_SLAVE_OVIRT_OCMEM 78
++#define ICBID_SLAVE_USB_HS2 79
++#define ICBID_SLAVE_QPIC 80
++#define ICBID_SLAVE_IPS_CFG 81
++#define ICBID_SLAVE_DSI_CFG 82
++#define ICBID_SLAVE_USB3_1 83
++#define ICBID_SLAVE_PCIE_0 84
++#define ICBID_SLAVE_PCIE_1 85
++#define ICBID_SLAVE_PSS_SMMU_CFG 86
++#define ICBID_SLAVE_CRYPTO_2_CFG 87
++#define ICBID_SLAVE_PCIE_0_CFG 88
++#define ICBID_SLAVE_PCIE_1_CFG 89
++#define ICBID_SLAVE_SATA_CFG 90
++#define ICBID_SLAVE_SPSS_GENI_IR 91
++#define ICBID_SLAVE_UFS_CFG 92
++#define ICBID_SLAVE_AVSYNC_CFG 93
++#define ICBID_SLAVE_VPU_CFG 94
++#define ICBID_SLAVE_USB_PHY_CFG 95
++#define ICBID_SLAVE_RBCPR_MX_CFG 96
++#define ICBID_SLAVE_PCIE_PARF 97
++#define ICBID_SLAVE_VCAP_CFG 98
++#define ICBID_SLAVE_EMAC_CFG 99
++#define ICBID_SLAVE_BCAST_CFG 100
++#define ICBID_SLAVE_KLM_CFG 101
++#define ICBID_SLAVE_DISPLAY_PWM 102
++#define ICBID_SLAVE_GENI 103
++#define ICBID_SLAVE_SNOC_BIMC_1 104
++#define ICBID_SLAVE_AUDIO 105
++#define ICBID_SLAVE_CATS_0 106
++#define ICBID_SLAVE_CATS_1 107
++#define ICBID_SLAVE_MM_INT_0 108
++#define ICBID_SLAVE_MM_INT_1 109
++#define ICBID_SLAVE_MM_INT_2 110
++#define ICBID_SLAVE_MM_INT_BIMC 111
++#define ICBID_SLAVE_MMU_MODEM_XPU_CFG 112
++#define ICBID_SLAVE_MSS_INT 113
++#define ICBID_SLAVE_PCNOC_INT_0 114
++#define ICBID_SLAVE_PCNOC_INT_1 115
++#define ICBID_SLAVE_PCNOC_M_0 116
++#define ICBID_SLAVE_PCNOC_M_1 117
++#define ICBID_SLAVE_PCNOC_S_0 118
++#define ICBID_SLAVE_PCNOC_S_1 119
++#define ICBID_SLAVE_PCNOC_S_2 120
++#define ICBID_SLAVE_PCNOC_S_3 121
++#define ICBID_SLAVE_PCNOC_S_4 122
++#define ICBID_SLAVE_PCNOC_S_6 123
++#define ICBID_SLAVE_PCNOC_S_7 124
++#define ICBID_SLAVE_PCNOC_S_8 125
++#define ICBID_SLAVE_PCNOC_S_9 126
++#define ICBID_SLAVE_PRNG_XPU_CFG 127
++#define ICBID_SLAVE_QDSS_INT 128
++#define ICBID_SLAVE_RPM_XPU_CFG 129
++#define ICBID_SLAVE_SNOC_INT_0 130
++#define ICBID_SLAVE_SNOC_INT_1 131
++#define ICBID_SLAVE_SNOC_INT_BIMC 132
++#define ICBID_SLAVE_TCU 133
++#define ICBID_SLAVE_BIMC_INT_0 134
++#define ICBID_SLAVE_BIMC_INT_1 135
++#define ICBID_SLAVE_RICA_CFG 136
++#define ICBID_SLAVE_PCNOC_S_5	189
++#define ICBID_SLAVE_PCNOC_S_7 124
++#define ICBID_SLAVE_PCNOC_INT_2 184
++#define ICBID_SLAVE_PCNOC_INT_3 185
++#define ICBID_SLAVE_PCNOC_INT_4 186
++#define ICBID_SLAVE_PCNOC_INT_5 187
++#define ICBID_SLAVE_PCNOC_INT_6 188
++#define ICBID_SLAVE_USB3_PHY_CFG 182
++#define ICBID_SLAVE_IPA_CFG 183
++
++#define ICBID_SLAVE_A0NOC_SNOC 141
++#define ICBID_SLAVE_A1NOC_SNOC 142
++#define ICBID_SLAVE_A2NOC_SNOC 143
++#define ICBID_SLAVE_BIMC_SNOC_1 138
++#define ICBID_SLAVE_PIMEM 167
++#define ICBID_SLAVE_PIMEM_CFG 168
++#define ICBID_SLAVE_DCC_CFG 155
++#define ICBID_SLAVE_QDSS_RBCPR_APU_CFG 168
++#define ICBID_SLAVE_A0NOC_CFG 144
++#define ICBID_SLAVE_PCIE_2_CFG 165
++#define ICBID_SLAVE_PCIE20_AHB2PHY 163
++#define ICBID_SLAVE_PCIE_2 164
++#define ICBID_SLAVE_A1NOC_CFG 147
++#define ICBID_SLAVE_A1NOC_MPU_CFG 148
++#define ICBID_SLAVE_A1NOC_SMMU_CFG 149
++#define ICBID_SLAVE_A2NOC_CFG 150
++#define ICBID_SLAVE_A2NOC_MPU_CFG 151
++#define ICBID_SLAVE_A2NOC_SMMU_CFG 152
++#define ICBID_SLAVE_AHB2PHY 153
++#define ICBID_SLAVE_HMSS_L3 161
++#define ICBID_SLAVE_LPASS_SMMU_CFG 161
++#define ICBID_SLAVE_MMAGIC_CFG 162
++#define ICBID_SLAVE_SSC_CFG 177
++#define ICBID_SLAVE_VENUS_THROTTLE_CFG 178
++#define ICBID_SLAVE_DISPLAY_THROTTLE_CFG 156
++#define ICBID_SLAVE_CAMERA_THROTTLE_CFG 154
++#define ICBID_SLAVE_DSA_CFG 157
++#define ICBID_SLAVE_DSA_MPU_CFG 158
++#define ICBID_SLAVE_SMMU_CPP_CFG 171
++#define ICBID_SLAVE_SMMU_JPEG_CFG 172
++#define ICBID_SLAVE_SMMU_MDP_CFG 173
++#define ICBID_SLAVE_SMMU_ROTATOR_CFG 174
++#define ICBID_SLAVE_SMMU_VENUS_CFG 175
++#define ICBID_SLAVE_SMMU_VFE_CFG 176
++#define ICBID_SLAVE_A0NOC_MPU_CFG 145
++#define ICBID_SLAVE_A0NOC_SMMU_CFG 146
++#define ICBID_SLAVE_VMEM_CFG 180
++#define ICBID_SLAVE_VMEM 179
++#define ICBID_SLAVE_PNOC_A1NOC 139
++#define ICBID_SLAVE_SNOC_VMEM 140
++#define ICBID_SLAVE_RBCPR_MX 170
++#define ICBID_SLAVE_RBCPR_CX 169
++#define ICBID_SLAVE_PRNG_APU_CFG 190
++#define ICBID_SLAVE_PERIPH_MPU_CFG 191
++#define ICBID_SLAVE_GCNT 192
++#define ICBID_SLAVE_ADSS_CFG 193
++#define ICBID_SLAVE_ADSS_APU 194
++#define ICBID_SLAVE_ADSS_VMIDMT_CFG 195
++#define ICBID_SLAVE_QHSS_APU_CFG 196
++#define ICBID_SLAVE_MDIO 197
++#define ICBID_SLAVE_FEPHY_CFG 198
++#define ICBID_SLAVE_SRIF 199
++#define ICBID_SLAVE_DDRC_CFG 200
++#define ICBID_SLAVE_DDRC_APU_CFG 201
++#define ICBID_SLAVE_DDRC_MPU0_CFG 202
++#define ICBID_SLAVE_DDRC_MPU1_CFG 203
++#define ICBID_SLAVE_DDRC_MPU2_CFG 210
++#define ICBID_SLAVE_ESS_VMIDMT_CFG 211
++#define ICBID_SLAVE_ESS_APU_CFG 212
++#define ICBID_SLAVE_USB2_CFG 213
++#define ICBID_SLAVE_BLSP_CFG 214
++#define ICBID_SLAVE_QPIC_CFG 215
++#define ICBID_SLAVE_SDCC_CFG 216
++#define ICBID_SLAVE_WSS0_VMIDMT_CFG 217
++#define ICBID_SLAVE_WSS0_APU_CFG 218
++#define ICBID_SLAVE_WSS1_VMIDMT_CFG 219
++#define ICBID_SLAVE_WSS1_APU_CFG 220
++#define ICBID_SLAVE_SRVC_PCNOC 221
++#define ICBID_SLAVE_SNOC_DDRC 222
++#define ICBID_SLAVE_A7SS 223
++#define ICBID_SLAVE_WSS0_CFG 224
++#define ICBID_SLAVE_WSS1_CFG 225
++#define ICBID_SLAVE_PCIE 226
++#define ICBID_SLAVE_USB3_CFG 227
++#define ICBID_SLAVE_CRYPTO_CFG 228
++#define ICBID_SLAVE_ESS_CFG 229
++#define ICBID_SLAVE_SRVC_SNOC 230
++#endif
+--- /dev/null
++++ b/include/dt-bindings/msm/msm-bus-rule-ops.h
+@@ -0,0 +1,32 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __MSM_BUS_RULE_OPS_H
++#define __MSM_BUS_RULE_OPS_H
++
++#define FLD_IB	0
++#define FLD_AB	1
++#define FLD_CLK	2
++
++#define OP_LE	0
++#define OP_LT	1
++#define OP_GE	2
++#define OP_GT	3
++#define OP_NOOP	4
++
++#define RULE_STATE_NOT_APPLIED	0
++#define RULE_STATE_APPLIED	1
++
++#define THROTTLE_ON	0
++#define THROTTLE_OFF	1
++
++#endif
+--- /dev/null
++++ b/drivers/bus/msm_bus/Kconfig
+@@ -0,0 +1,19 @@
++config BUS_TOPOLOGY_ADHOC
++	bool "ad-hoc bus scaling topology"
++	depends on ARCH_QCOM
++	default n
++	help
++	  This option enables a driver that can handle adhoc bus topologies.
++	  Adhoc bus topology driver allows one to many connections and maintains
++	  directionality of connections by explicitly listing device connections
++	  thus avoiding illegal routes.
++
++config MSM_BUS_SCALING
++	bool "Bus scaling driver"
++	depends on BUS_TOPOLOGY_ADHOC
++	default n
++	help
++	  This option enables bus scaling on MSM devices.  Bus scaling
++	  allows devices to request the clocks be set to rates sufficient
++	  for the active devices needs without keeping the clocks at max
++	  frequency when a slower speed is sufficient.
+--- /dev/null
++++ b/drivers/bus/msm_bus/Makefile
+@@ -0,0 +1,12 @@
++#
++# Makefile for msm-bus driver specific files
++#
++obj-y += msm_bus_bimc.o msm_bus_noc.o msm_bus_core.o msm_bus_client_api.o \
++	 msm_bus_id.o
++obj-$(CONFIG_OF) += msm_bus_of.o
++
++obj-y += msm_bus_fabric_adhoc.o msm_bus_arb_adhoc.o msm_bus_rules.o
++obj-$(CONFIG_OF) += msm_bus_of_adhoc.o
++obj-$(CONFIG_CORESIGHT) +=  msm_buspm_coresight_adhoc.o
++
++obj-$(CONFIG_DEBUG_FS) += msm_bus_dbg.o
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm-bus-board.h
+@@ -0,0 +1,198 @@
++/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef __ASM_ARCH_MSM_BUS_BOARD_H
++#define __ASM_ARCH_MSM_BUS_BOARD_H
++
++#include <linux/types.h>
++#include <linux/input.h>
++
++enum context {
++	DUAL_CTX,
++	ACTIVE_CTX,
++	NUM_CTX
++};
++
++struct msm_bus_fabric_registration {
++	unsigned int id;
++	const char *name;
++	struct msm_bus_node_info *info;
++	unsigned int len;
++	int ahb;
++	const char *fabclk[NUM_CTX];
++	const char *iface_clk;
++	unsigned int offset;
++	unsigned int haltid;
++	unsigned int rpm_enabled;
++	unsigned int nmasters;
++	unsigned int nslaves;
++	unsigned int ntieredslaves;
++	bool il_flag;
++	const struct msm_bus_board_algorithm *board_algo;
++	int hw_sel;
++	void *hw_data;
++	uint32_t qos_freq;
++	uint32_t qos_baseoffset;
++	u64 nr_lim_thresh;
++	uint32_t eff_fact;
++	uint32_t qos_delta;
++	bool virt;
++};
++
++struct msm_bus_device_node_registration {
++	struct msm_bus_node_device_type *info;
++	unsigned int num_devices;
++	bool virt;
++};
++
++enum msm_bus_bw_tier_type {
++	MSM_BUS_BW_TIER1 = 1,
++	MSM_BUS_BW_TIER2,
++	MSM_BUS_BW_COUNT,
++	MSM_BUS_BW_SIZE = 0x7FFFFFFF,
++};
++
++struct msm_bus_halt_vector {
++	uint32_t haltval;
++	uint32_t haltmask;
++};
++
++extern struct msm_bus_fabric_registration msm_bus_apps_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_sys_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_mm_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_sys_fpb_pdata;
++extern struct msm_bus_fabric_registration msm_bus_cpss_fpb_pdata;
++extern struct msm_bus_fabric_registration msm_bus_def_fab_pdata;
++
++extern struct msm_bus_fabric_registration msm_bus_8960_apps_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8960_sys_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8960_mm_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8960_sg_mm_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8960_sys_fpb_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8960_cpss_fpb_pdata;
++
++extern struct msm_bus_fabric_registration msm_bus_8064_apps_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8064_sys_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8064_mm_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8064_sys_fpb_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8064_cpss_fpb_pdata;
++
++extern struct msm_bus_fabric_registration msm_bus_9615_sys_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_9615_def_fab_pdata;
++
++extern struct msm_bus_fabric_registration msm_bus_8930_apps_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8930_sys_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8930_mm_fabric_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8930_sys_fpb_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8930_cpss_fpb_pdata;
++
++extern struct msm_bus_fabric_registration msm_bus_8974_sys_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8974_mmss_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8974_bimc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8974_ocmem_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8974_periph_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8974_config_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_8974_ocmem_vnoc_pdata;
++
++extern struct msm_bus_fabric_registration msm_bus_9625_sys_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_9625_bimc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_9625_periph_noc_pdata;
++extern struct msm_bus_fabric_registration msm_bus_9625_config_noc_pdata;
++
++extern int msm_bus_device_match_adhoc(struct device *dev, void *id);
++
++void msm_bus_rpm_set_mt_mask(void);
++int msm_bus_board_rpm_get_il_ids(uint16_t *id);
++int msm_bus_board_get_iid(int id);
++
++#define NFAB_MSM8226 6
++#define NFAB_MSM8610 5
++
++/*
++ * These macros specify the convention followed for allocating
++ * ids to fabrics, masters and slaves for 8x60.
++ *
++ * A node can be identified as a master/slave/fabric by using
++ * these ids.
++ */
++#define FABRIC_ID_KEY 1024
++#define SLAVE_ID_KEY ((FABRIC_ID_KEY) >> 1)
++#define MAX_FAB_KEY 7168  /* OR(All fabric ids) */
++#define INT_NODE_START 10000
++
++#define GET_FABID(id) ((id) & MAX_FAB_KEY)
++
++#define NODE_ID(id) ((id) & (FABRIC_ID_KEY - 1))
++#define IS_SLAVE(id) ((NODE_ID(id)) >= SLAVE_ID_KEY ? 1 : 0)
++#define CHECK_ID(iid, id) (((iid & id) != id) ? -ENXIO : iid)
++
++/*
++ * The following macros are used to format the data for port halt
++ * and unhalt requests.
++ */
++#define MSM_BUS_CLK_HALT 0x1
++#define MSM_BUS_CLK_HALT_MASK 0x1
++#define MSM_BUS_CLK_HALT_FIELDSIZE 0x1
++#define MSM_BUS_CLK_UNHALT 0x0
++
++#define MSM_BUS_MASTER_SHIFT(master, fieldsize) \
++	((master) * (fieldsize))
++
++#define MSM_BUS_SET_BITFIELD(word, fieldmask, fieldvalue) \
++	{	\
++		(word) &= ~(fieldmask);	\
++		(word) |= (fieldvalue);	\
++	}
++
++
++#define MSM_BUS_MASTER_HALT(u32haltmask, u32haltval, master) \
++	MSM_BUS_SET_BITFIELD(u32haltmask, \
++		MSM_BUS_CLK_HALT_MASK<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE), \
++		MSM_BUS_CLK_HALT_MASK<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE))\
++	MSM_BUS_SET_BITFIELD(u32haltval, \
++		MSM_BUS_CLK_HALT_MASK<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE), \
++		MSM_BUS_CLK_HALT<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE))\
++
++#define MSM_BUS_MASTER_UNHALT(u32haltmask, u32haltval, master) \
++	MSM_BUS_SET_BITFIELD(u32haltmask, \
++		MSM_BUS_CLK_HALT_MASK<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE), \
++		MSM_BUS_CLK_HALT_MASK<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE))\
++	MSM_BUS_SET_BITFIELD(u32haltval, \
++		MSM_BUS_CLK_HALT_MASK<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE), \
++		MSM_BUS_CLK_UNHALT<<MSM_BUS_MASTER_SHIFT((master),\
++		MSM_BUS_CLK_HALT_FIELDSIZE))\
++
++#define RPM_BUS_SLAVE_REQ	0x766c7362
++#define RPM_BUS_MASTER_REQ	0x73616d62
++
++enum msm_bus_rpm_slave_field_type {
++	RPM_SLAVE_FIELD_BW = 0x00007762,
++};
++
++enum msm_bus_rpm_mas_field_type {
++	RPM_MASTER_FIELD_BW =		0x00007762,
++	RPM_MASTER_FIELD_BW_T0 =	0x30747762,
++	RPM_MASTER_FIELD_BW_T1 =	0x31747762,
++	RPM_MASTER_FIELD_BW_T2 =	0x32747762,
++};
++
++#include <dt-bindings/msm/msm-bus-ids.h>
++
++
++#endif /*__ASM_ARCH_MSM_BUS_BOARD_H */
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm-bus.h
+@@ -0,0 +1,139 @@
++/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_BUS_H
++#define _ARCH_ARM_MACH_MSM_BUS_H
++
++#include <linux/types.h>
++#include <linux/input.h>
++#include <linux/platform_device.h>
++
++/*
++ * Macros for clients to convert their data to ib and ab
++ * Ws : Time window over which to transfer the data in SECONDS
++ * Bs : Size of the data block in bytes
++ * Per : Recurrence period
++ * Tb : Throughput bandwidth to prevent stalling
++ * R  : Ratio of actual bandwidth used to Tb
++ * Ib : Instantaneous bandwidth
++ * Ab : Arbitrated bandwidth
++ *
++ * IB_RECURRBLOCK and AB_RECURRBLOCK:
++ * These are used if the requirement is to transfer a
++ * recurring block of data over a known time window.
++ *
++ * IB_THROUGHPUTBW and AB_THROUGHPUTBW:
++ * These are used for CPU style masters. Here the requirement
++ * is to have minimum throughput bandwidth available to avoid
++ * stalling.
++ */
++#define IB_RECURRBLOCK(Ws, Bs) ((Ws) == 0 ? 0 : ((Bs)/(Ws)))
++#define AB_RECURRBLOCK(Ws, Per) ((Ws) == 0 ? 0 : ((Bs)/(Per)))
++#define IB_THROUGHPUTBW(Tb) (Tb)
++#define AB_THROUGHPUTBW(Tb, R) ((Tb) * (R))
++
++struct msm_bus_vectors {
++	int src; /* Master */
++	int dst; /* Slave */
++	uint64_t ab; /* Arbitrated bandwidth */
++	uint64_t ib; /* Instantaneous bandwidth */
++};
++
++struct msm_bus_paths {
++	int num_paths;
++	struct msm_bus_vectors *vectors;
++};
++
++struct msm_bus_scale_pdata {
++	struct msm_bus_paths *usecase;
++	int num_usecases;
++	const char *name;
++	/*
++	 * If the active_only flag is set to 1, the BW request is applied
++	 * only when at least one CPU is active (powered on). If the flag
++	 * is set to 0, then the BW request is always applied irrespective
++	 * of the CPU state.
++	 */
++	unsigned int active_only;
++};
++
++/* Scaling APIs */
++
++/*
++ * This function returns a handle to the client. This should be used to
++ * call msm_bus_scale_client_update_request.
++ * The function returns 0 if bus driver is unable to register a client
++ */
++
++#if (defined(CONFIG_MSM_BUS_SCALING) || defined(CONFIG_BUS_TOPOLOGY_ADHOC))
++int __init msm_bus_fabric_init_driver(void);
++uint32_t msm_bus_scale_register_client(struct msm_bus_scale_pdata *pdata);
++int msm_bus_scale_client_update_request(uint32_t cl, unsigned int index);
++void msm_bus_scale_unregister_client(uint32_t cl);
++/* AXI Port configuration APIs */
++int msm_bus_axi_porthalt(int master_port);
++int msm_bus_axi_portunhalt(int master_port);
++
++#else
++static inline int __init msm_bus_fabric_init_driver(void) { return 0; }
++
++static inline uint32_t
++msm_bus_scale_register_client(struct msm_bus_scale_pdata *pdata)
++{
++	return 1;
++}
++
++static inline int
++msm_bus_scale_client_update_request(uint32_t cl, unsigned int index)
++{
++	return 0;
++}
++
++static inline void
++msm_bus_scale_unregister_client(uint32_t cl)
++{
++}
++
++static inline int msm_bus_axi_porthalt(int master_port)
++{
++	return 0;
++}
++
++static inline int msm_bus_axi_portunhalt(int master_port)
++{
++	return 0;
++}
++#endif
++
++#if defined(CONFIG_OF) && defined(CONFIG_MSM_BUS_SCALING)
++struct msm_bus_scale_pdata *msm_bus_pdata_from_node(
++		struct platform_device *pdev, struct device_node *of_node);
++struct msm_bus_scale_pdata *msm_bus_cl_get_pdata(struct platform_device *pdev);
++void msm_bus_cl_clear_pdata(struct msm_bus_scale_pdata *pdata);
++#else
++static inline struct msm_bus_scale_pdata
++*msm_bus_cl_get_pdata(struct platform_device *pdev)
++{
++	return NULL;
++}
++
++static inline struct msm_bus_scale_pdata *msm_bus_pdata_from_node(
++		struct platform_device *pdev, struct device_node *of_node)
++{
++	return NULL;
++}
++
++static inline void msm_bus_cl_clear_pdata(struct msm_bus_scale_pdata *pdata)
++{
++}
++#endif
++#endif /*_ARCH_ARM_MACH_MSM_BUS_H*/
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_adhoc.h
+@@ -0,0 +1,141 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_BUS_ADHOC_H
++#define _ARCH_ARM_MACH_MSM_BUS_ADHOC_H
++
++#include <linux/types.h>
++#include <linux/device.h>
++#include "msm-bus-board.h"
++#include "msm-bus.h"
++#include "msm_bus_rules.h"
++#include "msm_bus_core.h"
++
++struct msm_bus_node_device_type;
++struct link_node {
++	uint64_t lnode_ib[NUM_CTX];
++	uint64_t lnode_ab[NUM_CTX];
++	int next;
++	struct device *next_dev;
++	struct list_head link;
++	uint32_t in_use;
++};
++
++/* New types introduced for adhoc topology */
++struct msm_bus_noc_ops {
++	int (*qos_init)(struct msm_bus_node_device_type *dev,
++			void __iomem *qos_base, uint32_t qos_off,
++			uint32_t qos_delta, uint32_t qos_freq);
++	int (*set_bw)(struct msm_bus_node_device_type *dev,
++			void __iomem *qos_base, uint32_t qos_off,
++			uint32_t qos_delta, uint32_t qos_freq);
++	int (*limit_mport)(struct msm_bus_node_device_type *dev,
++			void __iomem *qos_base, uint32_t qos_off,
++			uint32_t qos_delta, uint32_t qos_freq, bool enable_lim,
++			uint64_t lim_bw);
++	bool (*update_bw_reg)(int mode);
++};
++
++struct nodebw {
++	uint64_t ab[NUM_CTX];
++	bool dirty;
++};
++
++struct msm_bus_fab_device_type {
++	void __iomem *qos_base;
++	phys_addr_t pqos_base;
++	size_t qos_range;
++	uint32_t base_offset;
++	uint32_t qos_freq;
++	uint32_t qos_off;
++	uint32_t util_fact;
++	uint32_t vrail_comp;
++	struct msm_bus_noc_ops noc_ops;
++	enum msm_bus_hw_sel bus_type;
++	bool bypass_qos_prg;
++};
++
++struct qos_params_type {
++	int mode;
++	unsigned int prio_lvl;
++	unsigned int prio_rd;
++	unsigned int prio_wr;
++	unsigned int prio1;
++	unsigned int prio0;
++	unsigned int gp;
++	unsigned int thmp;
++	unsigned int ws;
++	int cur_mode;
++	u64 bw_buffer;
++};
++
++struct msm_bus_node_info_type {
++	const char *name;
++	unsigned int id;
++	int mas_rpm_id;
++	int slv_rpm_id;
++	int num_ports;
++	int num_qports;
++	int *qport;
++	struct qos_params_type qos_params;
++	unsigned int num_connections;
++	unsigned int num_blist;
++	bool is_fab_dev;
++	bool virt_dev;
++	bool is_traversed;
++	unsigned int *connections;
++	unsigned int *black_listed_connections;
++	struct device **dev_connections;
++	struct device **black_connections;
++	unsigned int bus_device_id;
++	struct device *bus_device;
++	unsigned int buswidth;
++	struct rule_update_path_info rule;
++	uint64_t lim_bw;
++	uint32_t util_fact;
++	uint32_t vrail_comp;
++};
++
++struct msm_bus_node_device_type {
++	struct msm_bus_node_info_type *node_info;
++	struct msm_bus_fab_device_type *fabdev;
++	int num_lnodes;
++	struct link_node *lnode_list;
++	uint64_t cur_clk_hz[NUM_CTX];
++	struct nodebw node_ab;
++	struct list_head link;
++	unsigned int ap_owned;
++	struct nodeclk clk[NUM_CTX];
++	struct nodeclk qos_clk;
++};
++
++int msm_bus_enable_limiter(struct msm_bus_node_device_type *nodedev,
++				bool throttle_en, uint64_t lim_bw);
++int msm_bus_update_clks(struct msm_bus_node_device_type *nodedev,
++	int ctx, int **dirty_nodes, int *num_dirty);
++int msm_bus_commit_data(int *dirty_nodes, int ctx, int num_dirty);
++int msm_bus_update_bw(struct msm_bus_node_device_type *nodedev, int ctx,
++	int64_t add_bw, int **dirty_nodes, int *num_dirty);
++void *msm_bus_realloc_devmem(struct device *dev, void *p, size_t old_size,
++					size_t new_size, gfp_t flags);
++
++extern struct msm_bus_device_node_registration
++	*msm_bus_of_to_pdata(struct platform_device *pdev);
++extern void msm_bus_arb_setops_adhoc(struct msm_bus_arb_ops *arb_ops);
++extern int msm_bus_bimc_set_ops(struct msm_bus_node_device_type *bus_dev);
++extern int msm_bus_noc_set_ops(struct msm_bus_node_device_type *bus_dev);
++extern int msm_bus_of_get_static_rules(struct platform_device *pdev,
++					struct bus_rule_type **static_rule);
++extern int msm_rules_update_path(struct list_head *input_list,
++				struct list_head *output_list);
++extern void print_all_rules(void);
++#endif /* _ARCH_ARM_MACH_MSM_BUS_ADHOC_H */
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_arb_adhoc.c
+@@ -0,0 +1,998 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is Mree software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/mutex.h>
++#include <linux/clk.h>
++#include "msm-bus.h"
++#include "msm_bus_core.h"
++#include "msm_bus_adhoc.h"
++
++#define NUM_CL_HANDLES	50
++#define NUM_LNODES	3
++
++struct bus_search_type {
++	struct list_head link;
++	struct list_head node_list;
++};
++
++struct handle_type {
++	int num_entries;
++	struct msm_bus_client **cl_list;
++};
++
++static struct handle_type handle_list;
++struct list_head input_list;
++struct list_head apply_list;
++
++DEFINE_MUTEX(msm_bus_adhoc_lock);
++
++static bool chk_bl_list(struct list_head *black_list, unsigned int id)
++{
++	struct msm_bus_node_device_type *bus_node = NULL;
++
++	list_for_each_entry(bus_node, black_list, link) {
++		if (bus_node->node_info->id == id)
++			return true;
++	}
++	return false;
++}
++
++static void copy_remaining_nodes(struct list_head *edge_list, struct list_head
++	*traverse_list, struct list_head *route_list)
++{
++	struct bus_search_type *search_node;
++
++	if (list_empty(edge_list) && list_empty(traverse_list))
++		return;
++
++	search_node = kzalloc(sizeof(struct bus_search_type), GFP_KERNEL);
++	INIT_LIST_HEAD(&search_node->node_list);
++	list_splice_init(edge_list, traverse_list);
++	list_splice_init(traverse_list, &search_node->node_list);
++	list_add_tail(&search_node->link, route_list);
++}
++
++/*
++ * Duplicate instantiaion from msm_bus_arb.c. Todo there needs to be a
++ * "util" file for these common func/macros.
++ *
++ * */
++uint64_t msm_bus_div64(unsigned int w, uint64_t bw)
++{
++	uint64_t *b = &bw;
++
++	if ((bw > 0) && (bw < w))
++		return 1;
++
++	switch (w) {
++	case 0:
++		WARN(1, "AXI: Divide by 0 attempted\n");
++	case 1: return bw;
++	case 2: return (bw >> 1);
++	case 4: return (bw >> 2);
++	case 8: return (bw >> 3);
++	case 16: return (bw >> 4);
++	case 32: return (bw >> 5);
++	}
++
++	do_div(*b, w);
++	return *b;
++}
++
++int msm_bus_device_match_adhoc(struct device *dev, void *id)
++{
++	int ret = 0;
++	struct msm_bus_node_device_type *bnode = dev->platform_data;
++
++	if (bnode)
++		ret = (bnode->node_info->id == *(unsigned int *)id);
++	else
++		ret = 0;
++
++	return ret;
++}
++
++static int gen_lnode(struct device *dev,
++			int next_hop, int prev_idx)
++{
++	struct link_node *lnode;
++	struct msm_bus_node_device_type *cur_dev = NULL;
++	int lnode_idx = -1;
++
++	if (!dev)
++		goto exit_gen_lnode;
++
++	cur_dev = dev->platform_data;
++	if (!cur_dev) {
++		MSM_BUS_ERR("%s: Null device ptr", __func__);
++		goto exit_gen_lnode;
++	}
++
++	if (!cur_dev->num_lnodes) {
++		cur_dev->lnode_list = devm_kzalloc(dev,
++				sizeof(struct link_node) * NUM_LNODES,
++								GFP_KERNEL);
++		if (!cur_dev->lnode_list)
++			goto exit_gen_lnode;
++
++		lnode = cur_dev->lnode_list;
++		cur_dev->num_lnodes = NUM_LNODES;
++		lnode_idx = 0;
++	} else {
++		int i;
++		for (i = 0; i < cur_dev->num_lnodes; i++) {
++			if (!cur_dev->lnode_list[i].in_use)
++				break;
++		}
++
++		if (i < cur_dev->num_lnodes) {
++			lnode = &cur_dev->lnode_list[i];
++			lnode_idx = i;
++		} else {
++			struct link_node *realloc_list;
++			size_t cur_size = sizeof(struct link_node) *
++					cur_dev->num_lnodes;
++
++			cur_dev->num_lnodes += NUM_LNODES;
++			realloc_list = msm_bus_realloc_devmem(
++					dev,
++					cur_dev->lnode_list,
++					cur_size,
++					sizeof(struct link_node) *
++					cur_dev->num_lnodes, GFP_KERNEL);
++
++			if (!realloc_list)
++				goto exit_gen_lnode;
++
++			cur_dev->lnode_list = realloc_list;
++			lnode = &cur_dev->lnode_list[i];
++			lnode_idx = i;
++		}
++	}
++
++	lnode->in_use = 1;
++	if (next_hop == cur_dev->node_info->id) {
++		lnode->next = -1;
++		lnode->next_dev = NULL;
++	} else {
++		lnode->next = prev_idx;
++		lnode->next_dev = bus_find_device(&msm_bus_type, NULL,
++					(void *) &next_hop,
++					msm_bus_device_match_adhoc);
++	}
++
++	memset(lnode->lnode_ib, 0, sizeof(uint64_t) * NUM_CTX);
++	memset(lnode->lnode_ab, 0, sizeof(uint64_t) * NUM_CTX);
++
++exit_gen_lnode:
++	return lnode_idx;
++}
++
++static int remove_lnode(struct msm_bus_node_device_type *cur_dev,
++				int lnode_idx)
++{
++	int ret = 0;
++
++	if (!cur_dev) {
++		MSM_BUS_ERR("%s: Null device ptr", __func__);
++		ret = -ENODEV;
++		goto exit_remove_lnode;
++	}
++
++	if (lnode_idx != -1) {
++		if (!cur_dev->num_lnodes ||
++				(lnode_idx > (cur_dev->num_lnodes - 1))) {
++			MSM_BUS_ERR("%s: Invalid Idx %d, num_lnodes %d",
++				__func__, lnode_idx, cur_dev->num_lnodes);
++			ret = -ENODEV;
++			goto exit_remove_lnode;
++		}
++
++		cur_dev->lnode_list[lnode_idx].next = -1;
++		cur_dev->lnode_list[lnode_idx].next_dev = NULL;
++		cur_dev->lnode_list[lnode_idx].in_use = 0;
++	}
++
++exit_remove_lnode:
++	return ret;
++}
++
++static int prune_path(struct list_head *route_list, int dest, int src,
++				struct list_head *black_list, int found)
++{
++	struct bus_search_type *search_node, *temp_search_node;
++	struct msm_bus_node_device_type *bus_node;
++	struct list_head *bl_list;
++	struct list_head *temp_bl_list;
++	int search_dev_id = dest;
++	struct device *dest_dev = bus_find_device(&msm_bus_type, NULL,
++					(void *) &dest,
++					msm_bus_device_match_adhoc);
++	int lnode_hop = -1;
++
++	if (!found)
++		goto reset_links;
++
++	if (!dest_dev) {
++		MSM_BUS_ERR("%s: Can't find dest dev %d", __func__, dest);
++		goto exit_prune_path;
++	}
++
++	lnode_hop = gen_lnode(dest_dev, search_dev_id, lnode_hop);
++
++	list_for_each_entry_reverse(search_node, route_list, link) {
++		list_for_each_entry(bus_node, &search_node->node_list, link) {
++			unsigned int i;
++			for (i = 0; i < bus_node->node_info->num_connections;
++									i++) {
++				if (bus_node->node_info->connections[i] ==
++								search_dev_id) {
++					dest_dev = bus_find_device(
++						&msm_bus_type,
++						NULL,
++						(void *)
++						&bus_node->node_info->
++						id,
++						msm_bus_device_match_adhoc);
++
++					if (!dest_dev) {
++						lnode_hop = -1;
++						goto reset_links;
++					}
++
++					lnode_hop = gen_lnode(dest_dev,
++							search_dev_id,
++							lnode_hop);
++					search_dev_id =
++						bus_node->node_info->id;
++					break;
++				}
++			}
++		}
++	}
++reset_links:
++	list_for_each_entry_safe(search_node, temp_search_node, route_list,
++									link) {
++			list_for_each_entry(bus_node, &search_node->node_list,
++									link)
++				bus_node->node_info->is_traversed = false;
++
++			list_del(&search_node->link);
++			kfree(search_node);
++	}
++
++	list_for_each_safe(bl_list, temp_bl_list, black_list)
++		list_del(bl_list);
++
++exit_prune_path:
++	return lnode_hop;
++}
++
++static void setup_bl_list(struct msm_bus_node_device_type *node,
++				struct list_head *black_list)
++{
++	unsigned int i;
++
++	for (i = 0; i < node->node_info->num_blist; i++) {
++		struct msm_bus_node_device_type *bdev;
++		bdev = node->node_info->black_connections[i]->platform_data;
++		list_add_tail(&bdev->link, black_list);
++	}
++}
++
++static int getpath(int src, int dest)
++{
++	struct list_head traverse_list;
++	struct list_head edge_list;
++	struct list_head route_list;
++	struct list_head black_list;
++	struct device *src_dev = bus_find_device(&msm_bus_type, NULL,
++					(void *) &src,
++					msm_bus_device_match_adhoc);
++	struct msm_bus_node_device_type *src_node;
++	struct bus_search_type *search_node;
++	int found = 0;
++	int depth_index = 0;
++	int first_hop = -1;
++
++	INIT_LIST_HEAD(&traverse_list);
++	INIT_LIST_HEAD(&edge_list);
++	INIT_LIST_HEAD(&route_list);
++	INIT_LIST_HEAD(&black_list);
++
++	if (!src_dev) {
++		MSM_BUS_ERR("%s: Cannot locate src dev %d", __func__, src);
++		goto exit_getpath;
++	}
++
++	src_node = src_dev->platform_data;
++	if (!src_node) {
++		MSM_BUS_ERR("%s:Fatal, Source dev %d not found", __func__, src);
++		goto exit_getpath;
++	}
++	list_add_tail(&src_node->link, &traverse_list);
++
++	while ((!found && !list_empty(&traverse_list))) {
++		struct msm_bus_node_device_type *bus_node = NULL;
++		/* Locate dest_id in the traverse list */
++		list_for_each_entry(bus_node, &traverse_list, link) {
++			if (bus_node->node_info->id == dest) {
++				found = 1;
++				break;
++			}
++		}
++
++		if (!found) {
++			unsigned int i;
++			/* Setup the new edge list */
++			list_for_each_entry(bus_node, &traverse_list, link) {
++				/* Setup list of black-listed nodes */
++				setup_bl_list(bus_node, &black_list);
++
++				for (i = 0; i < bus_node->node_info->
++						num_connections; i++) {
++					bool skip;
++					struct msm_bus_node_device_type
++							*node_conn;
++					node_conn = bus_node->node_info->
++						dev_connections[i]->
++						platform_data;
++					if (node_conn->node_info->
++							is_traversed) {
++						MSM_BUS_ERR("Circ Path %d\n",
++						node_conn->node_info->id);
++						goto reset_traversed;
++					}
++					skip = chk_bl_list(&black_list,
++							bus_node->node_info->
++							connections[i]);
++					if (!skip) {
++						list_add_tail(&node_conn->link,
++							&edge_list);
++						node_conn->node_info->
++							is_traversed = true;
++					}
++				}
++			}
++
++			/* Keep tabs of the previous search list */
++			search_node = kzalloc(sizeof(struct bus_search_type),
++					 GFP_KERNEL);
++			INIT_LIST_HEAD(&search_node->node_list);
++			list_splice_init(&traverse_list,
++					 &search_node->node_list);
++			/* Add the previous search list to a route list */
++			list_add_tail(&search_node->link, &route_list);
++			/* Advancing the list depth */
++			depth_index++;
++			list_splice_init(&edge_list, &traverse_list);
++		}
++	}
++reset_traversed:
++	copy_remaining_nodes(&edge_list, &traverse_list, &route_list);
++	first_hop = prune_path(&route_list, dest, src, &black_list, found);
++
++exit_getpath:
++	return first_hop;
++}
++
++static uint64_t arbitrate_bus_req(struct msm_bus_node_device_type *bus_dev,
++								int ctx)
++{
++	int i;
++	uint64_t max_ib = 0;
++	uint64_t sum_ab = 0;
++	uint64_t bw_max_hz;
++	struct msm_bus_node_device_type *fab_dev = NULL;
++	uint32_t util_fact = 0;
++	uint32_t vrail_comp = 0;
++
++	/* Find max ib */
++	for (i = 0; i < bus_dev->num_lnodes; i++) {
++		max_ib = max(max_ib, bus_dev->lnode_list[i].lnode_ib[ctx]);
++		sum_ab += bus_dev->lnode_list[i].lnode_ab[ctx];
++	}
++	/*
++	 *  Account for Util factor and vrail comp. The new aggregation
++	 *  formula is:
++	 *  Freq_hz = max((sum(ab) * util_fact)/num_chan, max(ib)/vrail_comp)
++	 *				/ bus-width
++	 *  util_fact and vrail comp are obtained from fabric/Node's dts
++	 *  properties.
++	 *  They default to 100 if absent.
++	 */
++	fab_dev = bus_dev->node_info->bus_device->platform_data;
++	/* Don't do this for virtual fabrics */
++	if (fab_dev && fab_dev->fabdev) {
++		util_fact = bus_dev->node_info->util_fact ?
++			bus_dev->node_info->util_fact :
++			fab_dev->fabdev->util_fact;
++		vrail_comp = bus_dev->node_info->vrail_comp ?
++			bus_dev->node_info->vrail_comp :
++			fab_dev->fabdev->vrail_comp;
++		sum_ab *= util_fact;
++		sum_ab = msm_bus_div64(100, sum_ab);
++		max_ib *= 100;
++		max_ib = msm_bus_div64(vrail_comp, max_ib);
++	}
++
++	/* Account for multiple channels if any */
++	if (bus_dev->node_info->num_qports > 1)
++		sum_ab = msm_bus_div64(bus_dev->node_info->num_qports,
++					sum_ab);
++
++	if (!bus_dev->node_info->buswidth) {
++		MSM_BUS_WARN("No bus width found for %d. Using default\n",
++					bus_dev->node_info->id);
++		bus_dev->node_info->buswidth = 8;
++	}
++
++	bw_max_hz = max(max_ib, sum_ab);
++	bw_max_hz = msm_bus_div64(bus_dev->node_info->buswidth,
++					bw_max_hz);
++
++	return bw_max_hz;
++}
++
++static void del_inp_list(struct list_head *list)
++{
++	struct rule_update_path_info *rule_node;
++	struct rule_update_path_info *rule_node_tmp;
++
++	list_for_each_entry_safe(rule_node, rule_node_tmp, list, link)
++		list_del(&rule_node->link);
++}
++
++static void del_op_list(struct list_head *list)
++{
++	struct rule_apply_rcm_info *rule;
++	struct rule_apply_rcm_info *rule_tmp;
++
++	list_for_each_entry_safe(rule, rule_tmp, list, link)
++		list_del(&rule->link);
++}
++
++static int msm_bus_apply_rules(struct list_head *list, bool after_clk_commit)
++{
++	struct rule_apply_rcm_info *rule;
++	struct device *dev = NULL;
++	struct msm_bus_node_device_type *dev_info = NULL;
++	int ret = 0;
++	bool throttle_en = false;
++
++	list_for_each_entry(rule, list, link) {
++		if (!rule)
++			break;
++
++		if (rule && (rule->after_clk_commit != after_clk_commit))
++			continue;
++
++		dev = bus_find_device(&msm_bus_type, NULL,
++				(void *) &rule->id,
++				msm_bus_device_match_adhoc);
++
++		if (!dev) {
++			MSM_BUS_ERR("Can't find dev node for %d", rule->id);
++			continue;
++		}
++		dev_info = dev->platform_data;
++
++		throttle_en = ((rule->throttle == THROTTLE_ON) ? true : false);
++		ret = msm_bus_enable_limiter(dev_info, throttle_en,
++							rule->lim_bw);
++		if (ret)
++			MSM_BUS_ERR("Failed to set limiter for %d", rule->id);
++	}
++
++	return ret;
++}
++
++static uint64_t get_node_aggab(struct msm_bus_node_device_type *bus_dev)
++{
++	int i;
++	int ctx;
++	uint64_t max_agg_ab = 0;
++	uint64_t agg_ab = 0;
++
++	for (ctx = 0; ctx < NUM_CTX; ctx++) {
++		for (i = 0; i < bus_dev->num_lnodes; i++)
++			agg_ab += bus_dev->lnode_list[i].lnode_ab[ctx];
++
++		if (bus_dev->node_info->num_qports > 1)
++			agg_ab = msm_bus_div64(bus_dev->node_info->num_qports,
++							agg_ab);
++
++		max_agg_ab = max(max_agg_ab, agg_ab);
++	}
++
++	return max_agg_ab;
++}
++
++static uint64_t get_node_ib(struct msm_bus_node_device_type *bus_dev)
++{
++	int i;
++	int ctx;
++	uint64_t max_ib = 0;
++
++	for (ctx = 0; ctx < NUM_CTX; ctx++) {
++		for (i = 0; i < bus_dev->num_lnodes; i++)
++			max_ib = max(max_ib,
++				bus_dev->lnode_list[i].lnode_ib[ctx]);
++	}
++	return max_ib;
++}
++
++static int update_path(int src, int dest, uint64_t req_ib, uint64_t req_bw,
++			uint64_t cur_ib, uint64_t cur_bw, int src_idx, int ctx)
++{
++	struct device *src_dev = NULL;
++	struct device *next_dev = NULL;
++	struct link_node *lnode = NULL;
++	struct msm_bus_node_device_type *dev_info = NULL;
++	int curr_idx;
++	int ret = 0;
++	int *dirty_nodes = NULL;
++	int num_dirty = 0;
++	struct rule_update_path_info *rule_node;
++	bool rules_registered = msm_rule_are_rules_registered();
++
++	src_dev = bus_find_device(&msm_bus_type, NULL,
++				(void *) &src,
++				msm_bus_device_match_adhoc);
++
++	if (!src_dev) {
++		MSM_BUS_ERR("%s: Can't find source device %d", __func__, src);
++		ret = -ENODEV;
++		goto exit_update_path;
++	}
++
++	next_dev = src_dev;
++
++	if (src_idx < 0) {
++		MSM_BUS_ERR("%s: Invalid lnode idx %d", __func__, src_idx);
++		ret = -ENXIO;
++		goto exit_update_path;
++	}
++	curr_idx = src_idx;
++
++	INIT_LIST_HEAD(&input_list);
++	INIT_LIST_HEAD(&apply_list);
++
++	while (next_dev) {
++		dev_info = next_dev->platform_data;
++
++		if (curr_idx >= dev_info->num_lnodes) {
++			MSM_BUS_ERR("%s: Invalid lnode Idx %d num lnodes %d",
++			 __func__, curr_idx, dev_info->num_lnodes);
++			ret = -ENXIO;
++			goto exit_update_path;
++		}
++
++		lnode = &dev_info->lnode_list[curr_idx];
++		lnode->lnode_ib[ctx] = req_ib;
++		lnode->lnode_ab[ctx] = req_bw;
++
++		dev_info->cur_clk_hz[ctx] = arbitrate_bus_req(dev_info, ctx);
++
++		/* Start updating the clocks at the first hop.
++		 * Its ok to figure out the aggregated
++		 * request at this node.
++		 */
++		if (src_dev != next_dev) {
++			ret = msm_bus_update_clks(dev_info, ctx, &dirty_nodes,
++								&num_dirty);
++			if (ret) {
++				MSM_BUS_ERR("%s: Failed to update clks dev %d",
++					__func__, dev_info->node_info->id);
++				goto exit_update_path;
++			}
++		}
++
++		ret = msm_bus_update_bw(dev_info, ctx, req_bw, &dirty_nodes,
++								&num_dirty);
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to update bw dev %d",
++				__func__, dev_info->node_info->id);
++			goto exit_update_path;
++		}
++
++		if (rules_registered) {
++			rule_node = &dev_info->node_info->rule;
++			rule_node->id = dev_info->node_info->id;
++			rule_node->ib = get_node_ib(dev_info);
++			rule_node->ab = get_node_aggab(dev_info);
++			rule_node->clk = max(dev_info->cur_clk_hz[ACTIVE_CTX],
++						dev_info->cur_clk_hz[DUAL_CTX]);
++			list_add_tail(&rule_node->link, &input_list);
++		}
++
++		next_dev = lnode->next_dev;
++		curr_idx = lnode->next;
++	}
++
++	if (rules_registered) {
++		msm_rules_update_path(&input_list, &apply_list);
++		msm_bus_apply_rules(&apply_list, false);
++	}
++
++	msm_bus_commit_data(dirty_nodes, ctx, num_dirty);
++
++	if (rules_registered) {
++		msm_bus_apply_rules(&apply_list, true);
++		del_inp_list(&input_list);
++		del_op_list(&apply_list);
++	}
++exit_update_path:
++	return ret;
++}
++
++static int remove_path(int src, int dst, uint64_t cur_ib, uint64_t cur_ab,
++				int src_idx, int active_only)
++{
++	struct device *src_dev = NULL;
++	struct device *next_dev = NULL;
++	struct link_node *lnode = NULL;
++	struct msm_bus_node_device_type *dev_info = NULL;
++	int ret = 0;
++	int cur_idx = src_idx;
++	int next_idx;
++
++	/* Update the current path to zero out all request from
++	 * this cient on all paths
++	 */
++
++	ret = update_path(src, dst, 0, 0, cur_ib, cur_ab, src_idx,
++							active_only);
++	if (ret) {
++		MSM_BUS_ERR("%s: Error zeroing out path ctx %d",
++					__func__, ACTIVE_CTX);
++		goto exit_remove_path;
++	}
++
++	src_dev = bus_find_device(&msm_bus_type, NULL,
++				(void *) &src,
++				msm_bus_device_match_adhoc);
++	if (!src_dev) {
++		MSM_BUS_ERR("%s: Can't find source device %d", __func__, src);
++		ret = -ENODEV;
++		goto exit_remove_path;
++	}
++
++	next_dev = src_dev;
++
++	while (next_dev) {
++		dev_info = next_dev->platform_data;
++		lnode = &dev_info->lnode_list[cur_idx];
++		next_idx = lnode->next;
++		next_dev = lnode->next_dev;
++		remove_lnode(dev_info, cur_idx);
++		cur_idx = next_idx;
++	}
++
++exit_remove_path:
++	return ret;
++}
++
++static void getpath_debug(int src, int curr, int active_only)
++{
++	struct device *dev_node;
++	struct device *dev_it;
++	unsigned int hop = 1;
++	int idx;
++	struct msm_bus_node_device_type *devinfo;
++	int i;
++
++	dev_node = bus_find_device(&msm_bus_type, NULL,
++				(void *) &src,
++				msm_bus_device_match_adhoc);
++
++	if (!dev_node) {
++		MSM_BUS_ERR("SRC NOT FOUND %d", src);
++		return;
++	}
++
++	idx = curr;
++	devinfo = dev_node->platform_data;
++	dev_it = dev_node;
++
++	MSM_BUS_ERR("Route list Src %d", src);
++	while (dev_it) {
++		struct msm_bus_node_device_type *busdev =
++			devinfo->node_info->bus_device->platform_data;
++
++		MSM_BUS_ERR("Hop[%d] at Device %d ctx %d", hop,
++					devinfo->node_info->id, active_only);
++
++		for (i = 0; i < NUM_CTX; i++) {
++			MSM_BUS_ERR("dev info sel ib %llu",
++						devinfo->cur_clk_hz[i]);
++			MSM_BUS_ERR("dev info sel ab %llu",
++						devinfo->node_ab.ab[i]);
++		}
++
++		dev_it = devinfo->lnode_list[idx].next_dev;
++		idx = devinfo->lnode_list[idx].next;
++		if (dev_it)
++			devinfo = dev_it->platform_data;
++
++		MSM_BUS_ERR("Bus Device %d", busdev->node_info->id);
++		MSM_BUS_ERR("Bus Clock %llu", busdev->clk[active_only].rate);
++
++		if (idx < 0)
++			break;
++		hop++;
++	}
++}
++
++static void unregister_client_adhoc(uint32_t cl)
++{
++	int i;
++	struct msm_bus_scale_pdata *pdata;
++	int lnode, src, curr, dest;
++	uint64_t  cur_clk, cur_bw;
++	struct msm_bus_client *client;
++
++	mutex_lock(&msm_bus_adhoc_lock);
++	if (!cl) {
++		MSM_BUS_ERR("%s: Null cl handle passed unregister\n",
++				__func__);
++		goto exit_unregister_client;
++	}
++	client = handle_list.cl_list[cl];
++	pdata = client->pdata;
++	if (!pdata) {
++		MSM_BUS_ERR("%s: Null pdata passed to unregister\n",
++				__func__);
++		goto exit_unregister_client;
++	}
++
++	curr = client->curr;
++	if (curr >= pdata->num_usecases) {
++		MSM_BUS_ERR("Invalid index Defaulting curr to 0");
++		curr = 0;
++	}
++
++	MSM_BUS_DBG("%s: Unregistering client %p", __func__, client);
++
++	for (i = 0; i < pdata->usecase->num_paths; i++) {
++		src = client->pdata->usecase[curr].vectors[i].src;
++		dest = client->pdata->usecase[curr].vectors[i].dst;
++
++		lnode = client->src_pnode[i];
++		cur_clk = client->pdata->usecase[curr].vectors[i].ib;
++		cur_bw = client->pdata->usecase[curr].vectors[i].ab;
++		remove_path(src, dest, cur_clk, cur_bw, lnode,
++						pdata->active_only);
++	}
++	msm_bus_dbg_client_data(client->pdata, MSM_BUS_DBG_UNREGISTER, cl);
++	kfree(client->src_pnode);
++	kfree(client);
++	handle_list.cl_list[cl] = NULL;
++exit_unregister_client:
++	mutex_unlock(&msm_bus_adhoc_lock);
++	return;
++}
++
++static int alloc_handle_lst(int size)
++{
++	int ret = 0;
++	struct msm_bus_client **t_cl_list;
++
++	if (!handle_list.num_entries) {
++		t_cl_list = kzalloc(sizeof(struct msm_bus_client *)
++			* NUM_CL_HANDLES, GFP_KERNEL);
++		if (ZERO_OR_NULL_PTR(t_cl_list)) {
++			ret = -ENOMEM;
++			MSM_BUS_ERR("%s: Failed to allocate handles list",
++								__func__);
++			goto exit_alloc_handle_lst;
++		}
++		handle_list.cl_list = t_cl_list;
++		handle_list.num_entries += NUM_CL_HANDLES;
++	} else {
++		t_cl_list = krealloc(handle_list.cl_list,
++				sizeof(struct msm_bus_client *) *
++				handle_list.num_entries + NUM_CL_HANDLES,
++				GFP_KERNEL);
++		if (ZERO_OR_NULL_PTR(t_cl_list)) {
++			ret = -ENOMEM;
++			MSM_BUS_ERR("%s: Failed to allocate handles list",
++								__func__);
++			goto exit_alloc_handle_lst;
++		}
++
++		memset(&handle_list.cl_list[handle_list.num_entries], 0,
++			NUM_CL_HANDLES * sizeof(struct msm_bus_client *));
++		handle_list.num_entries += NUM_CL_HANDLES;
++		handle_list.cl_list = t_cl_list;
++	}
++exit_alloc_handle_lst:
++	return ret;
++}
++
++static uint32_t gen_handle(struct msm_bus_client *client)
++{
++	uint32_t handle = 0;
++	int i;
++	int ret = 0;
++
++	for (i = 0; i < handle_list.num_entries; i++) {
++		if (i && !handle_list.cl_list[i]) {
++			handle = i;
++			break;
++		}
++	}
++
++	if (!handle) {
++		ret = alloc_handle_lst(NUM_CL_HANDLES);
++
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to allocate handle list",
++							__func__);
++			goto exit_gen_handle;
++		}
++		handle = i + 1;
++	}
++	handle_list.cl_list[handle] = client;
++exit_gen_handle:
++	return handle;
++}
++
++static uint32_t register_client_adhoc(struct msm_bus_scale_pdata *pdata)
++{
++	int src, dest;
++	int i;
++	struct msm_bus_client *client = NULL;
++	int *lnode;
++	uint32_t handle = 0;
++
++	mutex_lock(&msm_bus_adhoc_lock);
++	client = kzalloc(sizeof(struct msm_bus_client), GFP_KERNEL);
++	if (!client) {
++		MSM_BUS_ERR("%s: Error allocating client data", __func__);
++		goto exit_register_client;
++	}
++	client->pdata = pdata;
++
++	lnode = kzalloc(pdata->usecase->num_paths * sizeof(int), GFP_KERNEL);
++	if (ZERO_OR_NULL_PTR(lnode)) {
++		MSM_BUS_ERR("%s: Error allocating pathnode ptr!", __func__);
++		goto exit_register_client;
++	}
++	client->src_pnode = lnode;
++
++	for (i = 0; i < pdata->usecase->num_paths; i++) {
++		src = pdata->usecase->vectors[i].src;
++		dest = pdata->usecase->vectors[i].dst;
++
++		if ((src < 0) || (dest < 0)) {
++			MSM_BUS_ERR("%s:Invalid src/dst.src %d dest %d",
++				__func__, src, dest);
++			goto exit_register_client;
++		}
++
++		lnode[i] = getpath(src, dest);
++		if (lnode[i] < 0) {
++			MSM_BUS_ERR("%s:Failed to find path.src %d dest %d",
++				__func__, src, dest);
++			goto exit_register_client;
++		}
++	}
++
++	handle = gen_handle(client);
++	msm_bus_dbg_client_data(client->pdata, MSM_BUS_DBG_REGISTER,
++					handle);
++	MSM_BUS_DBG("%s:Client handle %d %s", __func__, handle,
++						client->pdata->name);
++exit_register_client:
++	mutex_unlock(&msm_bus_adhoc_lock);
++	return handle;
++}
++
++static int update_request_adhoc(uint32_t cl, unsigned int index)
++{
++	int i, ret = 0;
++	struct msm_bus_scale_pdata *pdata;
++	int lnode, src, curr, dest;
++	uint64_t req_clk, req_bw, curr_clk, curr_bw;
++	struct msm_bus_client *client;
++	const char *test_cl = "Null";
++	bool log_transaction = false;
++
++	mutex_lock(&msm_bus_adhoc_lock);
++
++	if (!cl) {
++		MSM_BUS_ERR("%s: Invalid client handle %d", __func__, cl);
++		ret = -ENXIO;
++		goto exit_update_request;
++	}
++
++	client = handle_list.cl_list[cl];
++	pdata = client->pdata;
++	if (!pdata) {
++		MSM_BUS_ERR("%s: Client data Null.[client didn't register]",
++				__func__);
++		ret = -ENXIO;
++		goto exit_update_request;
++	}
++
++	if (index >= pdata->num_usecases) {
++		MSM_BUS_ERR("Client %u passed invalid index: %d\n",
++			cl, index);
++		ret = -ENXIO;
++		goto exit_update_request;
++	}
++
++	if (client->curr == index) {
++		MSM_BUS_DBG("%s: Not updating client request idx %d unchanged",
++				__func__, index);
++		goto exit_update_request;
++	}
++
++	curr = client->curr;
++	client->curr = index;
++
++	if (!strcmp(test_cl, pdata->name))
++		log_transaction = true;
++
++	MSM_BUS_DBG("%s: cl: %u index: %d curr: %d num_paths: %d\n", __func__,
++		cl, index, client->curr, client->pdata->usecase->num_paths);
++
++	for (i = 0; i < pdata->usecase->num_paths; i++) {
++		src = client->pdata->usecase[index].vectors[i].src;
++		dest = client->pdata->usecase[index].vectors[i].dst;
++
++		lnode = client->src_pnode[i];
++		req_clk = client->pdata->usecase[index].vectors[i].ib;
++		req_bw = client->pdata->usecase[index].vectors[i].ab;
++		if (curr < 0) {
++			curr_clk = 0;
++			curr_bw = 0;
++		} else {
++			curr_clk = client->pdata->usecase[curr].vectors[i].ib;
++			curr_bw = client->pdata->usecase[curr].vectors[i].ab;
++			MSM_BUS_DBG("%s:ab: %llu ib: %llu\n", __func__,
++					curr_bw, curr_clk);
++		}
++
++		ret = update_path(src, dest, req_clk, req_bw,
++				curr_clk, curr_bw, lnode, pdata->active_only);
++
++		if (ret) {
++			MSM_BUS_ERR("%s: Update path failed! %d ctx %d\n",
++					__func__, ret, ACTIVE_CTX);
++			goto exit_update_request;
++		}
++
++		if (log_transaction)
++			getpath_debug(src, lnode, pdata->active_only);
++	}
++	msm_bus_dbg_client_data(client->pdata, index , cl);
++exit_update_request:
++	mutex_unlock(&msm_bus_adhoc_lock);
++	return ret;
++}
++
++/**
++ *  msm_bus_arb_setops_adhoc() : Setup the bus arbitration ops
++ *  @ arb_ops: pointer to the arb ops.
++ */
++void msm_bus_arb_setops_adhoc(struct msm_bus_arb_ops *arb_ops)
++{
++	arb_ops->register_client = register_client_adhoc;
++	arb_ops->update_request = update_request_adhoc;
++	arb_ops->unregister_client = unregister_client_adhoc;
++}
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_bimc.c
+@@ -0,0 +1,2112 @@
++/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "AXI: BIMC: %s(): " fmt, __func__
++
++#include <linux/slab.h>
++#include <linux/io.h>
++#include "msm-bus-board.h"
++#include "msm_bus_core.h"
++#include "msm_bus_bimc.h"
++#include "msm_bus_adhoc.h"
++#include <trace/events/trace_msm_bus.h>
++
++enum msm_bus_bimc_slave_block {
++	SLAVE_BLOCK_RESERVED = 0,
++	SLAVE_BLOCK_SLAVE_WAY,
++	SLAVE_BLOCK_XPU,
++	SLAVE_BLOCK_ARBITER,
++	SLAVE_BLOCK_SCMO,
++};
++
++enum bke_sw {
++	BKE_OFF = 0,
++	BKE_ON = 1,
++};
++
++/* M_Generic */
++
++#define M_REG_BASE(b)		((b) + 0x00008000)
++
++#define M_COMPONENT_INFO_ADDR(b, n) \
++		(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000000)
++enum bimc_m_component_info {
++	M_COMPONENT_INFO_RMSK		= 0xffffff,
++	M_COMPONENT_INFO_INSTANCE_BMSK	= 0xff0000,
++	M_COMPONENT_INFO_INSTANCE_SHFT	= 0x10,
++	M_COMPONENT_INFO_SUB_TYPE_BMSK	= 0xff00,
++	M_COMPONENT_INFO_SUB_TYPE_SHFT	= 0x8,
++	M_COMPONENT_INFO_TYPE_BMSK	= 0xff,
++	M_COMPONENT_INFO_TYPE_SHFT	= 0x0,
++};
++
++#define M_CONFIG_INFO_0_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000020)
++enum bimc_m_config_info_0 {
++	M_CONFIG_INFO_0_RMSK			= 0xff00ffff,
++	M_CONFIG_INFO_0_SYNC_MODE_BMSK		= 0xff000000,
++	M_CONFIG_INFO_0_SYNC_MODE_SHFT		= 0x18,
++	M_CONFIG_INFO_0_CONNECTION_TYPE_BMSK	= 0xff00,
++	M_CONFIG_INFO_0_CONNECTION_TYPE_SHFT	= 0x8,
++	M_CONFIG_INFO_0_FUNC_BMSK		= 0xff,
++	M_CONFIG_INFO_0_FUNC_SHFT		= 0x0,
++};
++
++#define M_CONFIG_INFO_1_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000030)
++enum bimc_m_config_info_1 {
++	M_CONFIG_INFO_1_RMSK			= 0xffffffff,
++	M_CONFIG_INFO_1_SWAY_CONNECTIVITY_BMSK	= 0xffffffff,
++	M_CONFIG_INFO_1_SWAY_CONNECTIVITY_SHFT	= 0x0,
++};
++
++#define M_CONFIG_INFO_2_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000040)
++enum bimc_m_config_info_2 {
++	M_CONFIG_INFO_2_RMSK			= 0xffffffff,
++	M_CONFIG_INFO_2_M_DATA_WIDTH_BMSK	= 0xffff0000,
++	M_CONFIG_INFO_2_M_DATA_WIDTH_SHFT	= 0x10,
++	M_CONFIG_INFO_2_M_TID_WIDTH_BMSK	= 0xff00,
++	M_CONFIG_INFO_2_M_TID_WIDTH_SHFT	= 0x8,
++	M_CONFIG_INFO_2_M_MID_WIDTH_BMSK	= 0xff,
++	M_CONFIG_INFO_2_M_MID_WIDTH_SHFT	= 0x0,
++};
++
++#define M_CONFIG_INFO_3_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000050)
++enum bimc_m_config_info_3 {
++	M_CONFIG_INFO_3_RMSK			= 0xffffffff,
++	M_CONFIG_INFO_3_RCH_DEPTH_BMSK		= 0xff000000,
++	M_CONFIG_INFO_3_RCH_DEPTH_SHFT		= 0x18,
++	M_CONFIG_INFO_3_BCH_DEPTH_BMSK		= 0xff0000,
++	M_CONFIG_INFO_3_BCH_DEPTH_SHFT		= 0x10,
++	M_CONFIG_INFO_3_WCH_DEPTH_BMSK		= 0xff00,
++	M_CONFIG_INFO_3_WCH_DEPTH_SHFT		= 0x8,
++	M_CONFIG_INFO_3_ACH_DEPTH_BMSK		= 0xff,
++	M_CONFIG_INFO_3_ACH_DEPTH_SHFT		= 0x0,
++};
++
++#define M_CONFIG_INFO_4_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000060)
++enum bimc_m_config_info_4 {
++	M_CONFIG_INFO_4_RMSK			= 0xffff,
++	M_CONFIG_INFO_4_REORDER_BUF_DEPTH_BMSK	= 0xff00,
++	M_CONFIG_INFO_4_REORDER_BUF_DEPTH_SHFT	= 0x8,
++	M_CONFIG_INFO_4_REORDER_TABLE_DEPTH_BMSK	= 0xff,
++	M_CONFIG_INFO_4_REORDER_TABLE_DEPTH_SHFT	= 0x0,
++};
++
++#define M_CONFIG_INFO_5_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000070)
++enum bimc_m_config_info_5 {
++	M_CONFIG_INFO_5_RMSK			= 0x111,
++	M_CONFIG_INFO_5_MP2ARB_PIPELINE_EN_BMSK	= 0x100,
++	M_CONFIG_INFO_5_MP2ARB_PIPELINE_EN_SHFT	= 0x8,
++	M_CONFIG_INFO_5_MPBUF_PIPELINE_EN_BMSK	= 0x10,
++	M_CONFIG_INFO_5_MPBUF_PIPELINE_EN_SHFT	= 0x4,
++	M_CONFIG_INFO_5_M2MP_PIPELINE_EN_BMSK	= 0x1,
++	M_CONFIG_INFO_5_M2MP_PIPELINE_EN_SHFT	= 0x0,
++};
++
++#define M_INT_STATUS_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000100)
++enum bimc_m_int_status {
++	M_INT_STATUS_RMSK			= 0x3,
++};
++
++#define M_INT_CLR_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000108)
++enum bimc_m_int_clr {
++	M_INT_CLR_RMSK			= 0x3,
++};
++
++#define M_INT_EN_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x0000010c)
++enum bimc_m_int_en {
++	M_INT_EN_RMSK			= 0x3,
++};
++
++#define M_CLK_CTRL_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000200)
++enum bimc_m_clk_ctrl {
++	M_CLK_CTRL_RMSK				= 0x3,
++	M_CLK_CTRL_MAS_CLK_GATING_EN_BMSK	= 0x2,
++	M_CLK_CTRL_MAS_CLK_GATING_EN_SHFT	= 0x1,
++	M_CLK_CTRL_CORE_CLK_GATING_EN_BMSK	= 0x1,
++	M_CLK_CTRL_CORE_CLK_GATING_EN_SHFT	= 0x0,
++};
++
++#define M_MODE_ADDR(b, n) \
++		(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000210)
++enum bimc_m_mode {
++	M_MODE_RMSK				= 0xf0000011,
++	M_MODE_WR_GATHER_BEATS_BMSK		= 0xf0000000,
++	M_MODE_WR_GATHER_BEATS_SHFT		= 0x1c,
++	M_MODE_NARROW_WR_BMSK			= 0x10,
++	M_MODE_NARROW_WR_SHFT			= 0x4,
++	M_MODE_ORDERING_MODEL_BMSK		= 0x1,
++	M_MODE_ORDERING_MODEL_SHFT		= 0x0,
++};
++
++#define M_PRIOLVL_OVERRIDE_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000230)
++enum bimc_m_priolvl_override {
++	M_PRIOLVL_OVERRIDE_RMSK			= 0x301,
++	M_PRIOLVL_OVERRIDE_BMSK			= 0x300,
++	M_PRIOLVL_OVERRIDE_SHFT			= 0x8,
++	M_PRIOLVL_OVERRIDE_OVERRIDE_PRIOLVL_BMSK	= 0x1,
++	M_PRIOLVL_OVERRIDE_OVERRIDE_PRIOLVL_SHFT	= 0x0,
++};
++
++#define M_RD_CMD_OVERRIDE_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000240)
++enum bimc_m_read_command_override {
++	M_RD_CMD_OVERRIDE_RMSK			= 0x3071f7f,
++	M_RD_CMD_OVERRIDE_AREQPRIO_BMSK		= 0x3000000,
++	M_RD_CMD_OVERRIDE_AREQPRIO_SHFT		= 0x18,
++	M_RD_CMD_OVERRIDE_AMEMTYPE_BMSK		= 0x70000,
++	M_RD_CMD_OVERRIDE_AMEMTYPE_SHFT		= 0x10,
++	M_RD_CMD_OVERRIDE_ATRANSIENT_BMSK		= 0x1000,
++	M_RD_CMD_OVERRIDE_ATRANSIENT_SHFT		= 0xc,
++	M_RD_CMD_OVERRIDE_ASHARED_BMSK		= 0x800,
++	M_RD_CMD_OVERRIDE_ASHARED_SHFT		= 0xb,
++	M_RD_CMD_OVERRIDE_AREDIRECT_BMSK		= 0x400,
++	M_RD_CMD_OVERRIDE_AREDIRECT_SHFT		= 0xa,
++	M_RD_CMD_OVERRIDE_AOOO_BMSK			= 0x200,
++	M_RD_CMD_OVERRIDE_AOOO_SHFT			= 0x9,
++	M_RD_CMD_OVERRIDE_AINNERSHARED_BMSK		= 0x100,
++	M_RD_CMD_OVERRIDE_AINNERSHARED_SHFT		= 0x8,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AREQPRIO_BMSK	= 0x40,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AREQPRIO_SHFT	= 0x6,
++	M_RD_CMD_OVERRIDE_OVERRIDE_ATRANSIENT_BMSK	= 0x20,
++	M_RD_CMD_OVERRIDE_OVERRIDE_ATRANSIENT_SHFT	= 0x5,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AMEMTYPE_BMSK	= 0x10,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AMEMTYPE_SHFT	= 0x4,
++	M_RD_CMD_OVERRIDE_OVERRIDE_ASHARED_BMSK	= 0x8,
++	M_RD_CMD_OVERRIDE_OVERRIDE_ASHARED_SHFT	= 0x3,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AREDIRECT_BMSK	= 0x4,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AREDIRECT_SHFT	= 0x2,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AOOO_BMSK		= 0x2,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AOOO_SHFT		= 0x1,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AINNERSHARED_BMSK	= 0x1,
++	M_RD_CMD_OVERRIDE_OVERRIDE_AINNERSHARED_SHFT	= 0x0,
++};
++
++#define M_WR_CMD_OVERRIDE_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000250)
++enum bimc_m_write_command_override {
++	M_WR_CMD_OVERRIDE_RMSK			= 0x3071f7f,
++	M_WR_CMD_OVERRIDE_AREQPRIO_BMSK		= 0x3000000,
++	M_WR_CMD_OVERRIDE_AREQPRIO_SHFT		= 0x18,
++	M_WR_CMD_OVERRIDE_AMEMTYPE_BMSK		= 0x70000,
++	M_WR_CMD_OVERRIDE_AMEMTYPE_SHFT		= 0x10,
++	M_WR_CMD_OVERRIDE_ATRANSIENT_BMSK	= 0x1000,
++	M_WR_CMD_OVERRIDE_ATRANSIENT_SHFT	= 0xc,
++	M_WR_CMD_OVERRIDE_ASHARED_BMSK		= 0x800,
++	M_WR_CMD_OVERRIDE_ASHARED_SHFT		= 0xb,
++	M_WR_CMD_OVERRIDE_AREDIRECT_BMSK		= 0x400,
++	M_WR_CMD_OVERRIDE_AREDIRECT_SHFT		= 0xa,
++	M_WR_CMD_OVERRIDE_AOOO_BMSK			= 0x200,
++	M_WR_CMD_OVERRIDE_AOOO_SHFT			= 0x9,
++	M_WR_CMD_OVERRIDE_AINNERSHARED_BMSK		= 0x100,
++	M_WR_CMD_OVERRIDE_AINNERSHARED_SHFT		= 0x8,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AREQPRIO_BMSK	= 0x40,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AREQPRIO_SHFT	= 0x6,
++	M_WR_CMD_OVERRIDE_OVERRIDE_ATRANSIENT_BMSK	= 0x20,
++	M_WR_CMD_OVERRIDE_OVERRIDE_ATRANSIENT_SHFT	= 0x5,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AMEMTYPE_BMSK	= 0x10,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AMEMTYPE_SHFT	= 0x4,
++	M_WR_CMD_OVERRIDE_OVERRIDE_ASHARED_BMSK	= 0x8,
++	M_WR_CMD_OVERRIDE_OVERRIDE_ASHARED_SHFT	= 0x3,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AREDIRECT_BMSK	= 0x4,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AREDIRECT_SHFT	= 0x2,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AOOO_BMSK	= 0x2,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AOOO_SHFT	= 0x1,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AINNERSHARED_BMSK	= 0x1,
++	M_WR_CMD_OVERRIDE_OVERRIDE_AINNERSHARED_SHFT	= 0x0,
++};
++
++#define M_BKE_EN_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000300)
++enum bimc_m_bke_en {
++	M_BKE_EN_RMSK			= 0x1,
++	M_BKE_EN_EN_BMSK		= 0x1,
++	M_BKE_EN_EN_SHFT		= 0x0,
++};
++
++/* Grant Period registers */
++#define M_BKE_GP_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000304)
++enum bimc_m_bke_grant_period {
++	M_BKE_GP_RMSK		= 0x3ff,
++	M_BKE_GP_GP_BMSK	= 0x3ff,
++	M_BKE_GP_GP_SHFT	= 0x0,
++};
++
++/* Grant count register.
++ * The Grant count register represents a signed 16 bit
++ * value, range 0-0x7fff
++ */
++#define M_BKE_GC_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000308)
++enum bimc_m_bke_grant_count {
++	M_BKE_GC_RMSK			= 0xffff,
++	M_BKE_GC_GC_BMSK		= 0xffff,
++	M_BKE_GC_GC_SHFT		= 0x0,
++};
++
++/* Threshold High Registers */
++#define M_BKE_THH_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000320)
++enum bimc_m_bke_thresh_high {
++	M_BKE_THH_RMSK		= 0xffff,
++	M_BKE_THH_THRESH_BMSK	= 0xffff,
++	M_BKE_THH_THRESH_SHFT	= 0x0,
++};
++
++/* Threshold Medium Registers */
++#define M_BKE_THM_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000324)
++enum bimc_m_bke_thresh_medium {
++	M_BKE_THM_RMSK		= 0xffff,
++	M_BKE_THM_THRESH_BMSK	= 0xffff,
++	M_BKE_THM_THRESH_SHFT	= 0x0,
++};
++
++/* Threshold Low Registers */
++#define M_BKE_THL_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000328)
++enum bimc_m_bke_thresh_low {
++	M_BKE_THL_RMSK			= 0xffff,
++	M_BKE_THL_THRESH_BMSK		= 0xffff,
++	M_BKE_THL_THRESH_SHFT		= 0x0,
++};
++
++#define M_BKE_HEALTH_0_CONFIG_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000340)
++enum bimc_m_bke_health_0 {
++	M_BKE_HEALTH_0_CONFIG_RMSK			= 0x80000303,
++	M_BKE_HEALTH_0_CONFIG_LIMIT_CMDS_BMSK		= 0x80000000,
++	M_BKE_HEALTH_0_CONFIG_LIMIT_CMDS_SHFT		= 0x1f,
++	M_BKE_HEALTH_0_CONFIG_AREQPRIO_BMSK		= 0x300,
++	M_BKE_HEALTH_0_CONFIG_AREQPRIO_SHFT		= 0x8,
++	M_BKE_HEALTH_0_CONFIG_PRIOLVL_BMSK		= 0x3,
++	M_BKE_HEALTH_0_CONFIG_PRIOLVL_SHFT		= 0x0,
++};
++
++#define M_BKE_HEALTH_1_CONFIG_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000344)
++enum bimc_m_bke_health_1 {
++	M_BKE_HEALTH_1_CONFIG_RMSK			= 0x80000303,
++	M_BKE_HEALTH_1_CONFIG_LIMIT_CMDS_BMSK		= 0x80000000,
++	M_BKE_HEALTH_1_CONFIG_LIMIT_CMDS_SHFT		= 0x1f,
++	M_BKE_HEALTH_1_CONFIG_AREQPRIO_BMSK		= 0x300,
++	M_BKE_HEALTH_1_CONFIG_AREQPRIO_SHFT		= 0x8,
++	M_BKE_HEALTH_1_CONFIG_PRIOLVL_BMSK		= 0x3,
++	M_BKE_HEALTH_1_CONFIG_PRIOLVL_SHFT		= 0x0,
++};
++
++#define M_BKE_HEALTH_2_CONFIG_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000348)
++enum bimc_m_bke_health_2 {
++	M_BKE_HEALTH_2_CONFIG_RMSK			= 0x80000303,
++	M_BKE_HEALTH_2_CONFIG_LIMIT_CMDS_BMSK		= 0x80000000,
++	M_BKE_HEALTH_2_CONFIG_LIMIT_CMDS_SHFT		= 0x1f,
++	M_BKE_HEALTH_2_CONFIG_AREQPRIO_BMSK		= 0x300,
++	M_BKE_HEALTH_2_CONFIG_AREQPRIO_SHFT		= 0x8,
++	M_BKE_HEALTH_2_CONFIG_PRIOLVL_BMSK		= 0x3,
++	M_BKE_HEALTH_2_CONFIG_PRIOLVL_SHFT		= 0x0,
++};
++
++#define M_BKE_HEALTH_3_CONFIG_ADDR(b, n) \
++	(M_REG_BASE(b) + (0x4000 * (n)) + 0x0000034c)
++enum bimc_m_bke_health_3 {
++	M_BKE_HEALTH_3_CONFIG_RMSK			= 0x303,
++	M_BKE_HEALTH_3_CONFIG_AREQPRIO_BMSK	= 0x300,
++	M_BKE_HEALTH_3_CONFIG_AREQPRIO_SHFT	= 0x8,
++	M_BKE_HEALTH_3_CONFIG_PRIOLVL_BMSK		= 0x3,
++	M_BKE_HEALTH_3_CONFIG_PRIOLVL_SHFT		= 0x0,
++};
++
++#define M_BUF_STATUS_ADDR(b, n) \
++		(M_REG_BASE(b) + (0x4000 * (n)) + 0x00000400)
++enum bimc_m_buf_status {
++	M_BUF_STATUS_RMSK			= 0xf03f030,
++	M_BUF_STATUS_RCH_DATA_WR_FULL_BMSK	= 0x8000000,
++	M_BUF_STATUS_RCH_DATA_WR_FULL_SHFT	= 0x1b,
++	M_BUF_STATUS_RCH_DATA_WR_EMPTY_BMSK	= 0x4000000,
++	M_BUF_STATUS_RCH_DATA_WR_EMPTY_SHFT	= 0x1a,
++	M_BUF_STATUS_RCH_CTRL_WR_FULL_BMSK	= 0x2000000,
++	M_BUF_STATUS_RCH_CTRL_WR_FULL_SHFT	= 0x19,
++	M_BUF_STATUS_RCH_CTRL_WR_EMPTY_BMSK	= 0x1000000,
++	M_BUF_STATUS_RCH_CTRL_WR_EMPTY_SHFT	= 0x18,
++	M_BUF_STATUS_BCH_WR_FULL_BMSK		= 0x20000,
++	M_BUF_STATUS_BCH_WR_FULL_SHFT		= 0x11,
++	M_BUF_STATUS_BCH_WR_EMPTY_BMSK		= 0x10000,
++	M_BUF_STATUS_BCH_WR_EMPTY_SHFT		= 0x10,
++	M_BUF_STATUS_WCH_DATA_RD_FULL_BMSK	= 0x8000,
++	M_BUF_STATUS_WCH_DATA_RD_FULL_SHFT	= 0xf,
++	M_BUF_STATUS_WCH_DATA_RD_EMPTY_BMSK	= 0x4000,
++	M_BUF_STATUS_WCH_DATA_RD_EMPTY_SHFT	= 0xe,
++	M_BUF_STATUS_WCH_CTRL_RD_FULL_BMSK	= 0x2000,
++	M_BUF_STATUS_WCH_CTRL_RD_FULL_SHFT	= 0xd,
++	M_BUF_STATUS_WCH_CTRL_RD_EMPTY_BMSK	= 0x1000,
++	M_BUF_STATUS_WCH_CTRL_RD_EMPTY_SHFT	= 0xc,
++	M_BUF_STATUS_ACH_RD_FULL_BMSK		= 0x20,
++	M_BUF_STATUS_ACH_RD_FULL_SHFT		= 0x5,
++	M_BUF_STATUS_ACH_RD_EMPTY_BMSK		= 0x10,
++	M_BUF_STATUS_ACH_RD_EMPTY_SHFT		= 0x4,
++};
++/*BIMC Generic */
++
++#define S_REG_BASE(b)	((b) + 0x00048000)
++
++#define S_COMPONENT_INFO_ADDR(b, n) \
++	(S_REG_BASE(b) + (0x8000 * (n)) + 0x00000000)
++enum bimc_s_component_info {
++	S_COMPONENT_INFO_RMSK			= 0xffffff,
++	S_COMPONENT_INFO_INSTANCE_BMSK		= 0xff0000,
++	S_COMPONENT_INFO_INSTANCE_SHFT		= 0x10,
++	S_COMPONENT_INFO_SUB_TYPE_BMSK		= 0xff00,
++	S_COMPONENT_INFO_SUB_TYPE_SHFT		= 0x8,
++	S_COMPONENT_INFO_TYPE_BMSK		= 0xff,
++	S_COMPONENT_INFO_TYPE_SHFT		= 0x0,
++};
++
++#define S_HW_INFO_ADDR(b, n) \
++	(S_REG_BASE(b) + (0x80000 * (n)) + 0x00000010)
++enum bimc_s_hw_info {
++	S_HW_INFO_RMSK				= 0xffffffff,
++	S_HW_INFO_MAJOR_BMSK			= 0xff000000,
++	S_HW_INFO_MAJOR_SHFT			= 0x18,
++	S_HW_INFO_BRANCH_BMSK			= 0xff0000,
++	S_HW_INFO_BRANCH_SHFT			= 0x10,
++	S_HW_INFO_MINOR_BMSK			= 0xff00,
++	S_HW_INFO_MINOR_SHFT			= 0x8,
++	S_HW_INFO_ECO_BMSK			= 0xff,
++	S_HW_INFO_ECO_SHFT			= 0x0,
++};
++
++
++/* S_SCMO_GENERIC */
++
++#define S_SCMO_REG_BASE(b)	((b) + 0x00048000)
++
++#define S_SCMO_CONFIG_INFO_0_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000020)
++enum bimc_s_scmo_config_info_0 {
++	S_SCMO_CONFIG_INFO_0_RMSK		= 0xffffffff,
++	S_SCMO_CONFIG_INFO_0_DATA_WIDTH_BMSK	= 0xffff0000,
++	S_SCMO_CONFIG_INFO_0_DATA_WIDTH_SHFT	= 0x10,
++	S_SCMO_CONFIG_INFO_0_TID_WIDTH_BMSK	= 0xff00,
++	S_SCMO_CONFIG_INFO_0_TID_WIDTH_SHFT	= 0x8,
++	S_SCMO_CONFIG_INFO_0_MID_WIDTH_BMSK	= 0xff,
++	S_SCMO_CONFIG_INFO_0_MID_WIDTH_SHFT	= 0x0,
++};
++
++#define S_SCMO_CONFIG_INFO_1_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000030)
++enum bimc_s_scmo_config_info_1 {
++	S_SCMO_CONFIG_INFO_1_RMSK			= 0xffffffff,
++	S_SCMO_CONFIG_INFO_1_MPORT_CONNECTIVITY_BMSK	= 0xffffffff,
++	S_SCMO_CONFIG_INFO_1_MPORT_CONNECTIVITY_SHFT	= 0x0,
++};
++
++#define S_SCMO_CONFIG_INFO_2_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000040)
++enum bimc_s_scmo_config_info_2 {
++	S_SCMO_CONFIG_INFO_2_RMSK			= 0xff00ff,
++	S_SCMO_CONFIG_INFO_2_NUM_GLOBAL_MONS_BMSK	= 0xff0000,
++	S_SCMO_CONFIG_INFO_2_NUM_GLOBAL_MONS_SHFT	= 0x10,
++	S_SCMO_CONFIG_INFO_2_VMID_WIDTH_BMSK	= 0xff,
++	S_SCMO_CONFIG_INFO_2_VMID_WIDTH_SHFT	= 0x0,
++};
++
++#define S_SCMO_CONFIG_INFO_3_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000050)
++enum bimc_s_scmo_config_info_3 {
++	S_SCMO_CONFIG_INFO_3_RMSK			= 0xffffffff,
++	S_SCMO_CONFIG_INFO_3_RCH0_CTRL_DEPTH_BMSK	= 0xff000000,
++	S_SCMO_CONFIG_INFO_3_RCH0_CTRL_DEPTH_SHFT	= 0x18,
++	S_SCMO_CONFIG_INFO_3_RCH0_DEPTH_BMSK		= 0xff0000,
++	S_SCMO_CONFIG_INFO_3_RCH0_DEPTH_SHFT		= 0x10,
++	S_SCMO_CONFIG_INFO_3_BCH_DEPTH_BMSK		= 0xff00,
++	S_SCMO_CONFIG_INFO_3_BCH_DEPTH_SHFT		= 0x8,
++	S_SCMO_CONFIG_INFO_3_WCH_DEPTH_BMSK		= 0xff,
++	S_SCMO_CONFIG_INFO_3_WCH_DEPTH_SHFT		= 0x0,
++};
++
++#define S_SCMO_CONFIG_INFO_4_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000060)
++enum bimc_s_scmo_config_info_4 {
++	S_SCMO_CONFIG_INFO_4_RMSK			= 0xffff,
++	S_SCMO_CONFIG_INFO_4_RCH1_CTRL_DEPTH_BMSK	= 0xff00,
++	S_SCMO_CONFIG_INFO_4_RCH1_CTRL_DEPTH_SHFT	= 0x8,
++	S_SCMO_CONFIG_INFO_4_RCH1_DEPTH_BMSK		= 0xff,
++	S_SCMO_CONFIG_INFO_4_RCH1_DEPTH_SHFT		= 0x0,
++};
++
++#define S_SCMO_CONFIG_INFO_5_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000070)
++enum bimc_s_scmo_config_info_5 {
++	S_SCMO_CONFIG_INFO_5_RMSK			= 0xffff,
++	S_SCMO_CONFIG_INFO_5_DPE_CQ_DEPTH_BMSK		= 0xff00,
++	S_SCMO_CONFIG_INFO_5_DPE_CQ_DEPTH_SHFT		= 0x8,
++	S_SCMO_CONFIG_INFO_5_DDR_BUS_WIDTH_BMSK		= 0xff,
++	S_SCMO_CONFIG_INFO_5_DDR_BUS_WIDTH_SHFT		= 0x0,
++};
++
++#define S_SCMO_CONFIG_INFO_6_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000080)
++enum bimc_s_scmo_config_info_6 {
++	S_SCMO_CONFIG_INFO_6_RMSK			= 0x1111,
++	S_SCMO_CONFIG_INFO_6_WBUFC_PIPE_BMSK		= 0x1000,
++	S_SCMO_CONFIG_INFO_6_WBUFC_PIPE_SHFT		= 0xc,
++	S_SCMO_CONFIG_INFO_6_RDOPT_PIPE_BMSK		= 0x100,
++	S_SCMO_CONFIG_INFO_6_RDOPT_PIPE_SHFT		= 0x8,
++	S_SCMO_CONFIG_INFO_6_ACHAN_INTF_PIPE_BMSK	= 0x10,
++	S_SCMO_CONFIG_INFO_6_ACHAN_INTF_PIPE_SHFT	= 0x4,
++	S_SCMO_CONFIG_INFO_6_ADDR_DECODE_HT_BMSK	= 0x1,
++	S_SCMO_CONFIG_INFO_6_ADDR_DECODE_HT_SHFT	= 0x0,
++};
++
++#define S_SCMO_INT_STATUS_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000100)
++enum bimc_s_scmo_int_status {
++	S_SCMO_INT_STATUS_RMSK			= 0x1,
++	S_SCMO_INT_STATUS_ERR_OCCURED_BMSK	= 0x1,
++	S_SCMO_INT_STATUS_ERR_OCCURED_SHFT	= 0x0,
++};
++
++#define S_SCMO_INT_CLR_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000108)
++enum bimc_s_scmo_int_clr {
++	S_SCMO_INT_CLR_RMSK		= 0x1,
++	S_SCMO_INT_CLR_IRQ_CLR_BMSK	= 0x1,
++	S_SCMO_INT_CLR_IRQ_CLR_SHFT	= 0x0,
++};
++
++#define S_SCMO_INT_EN_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x0000010c)
++enum bimc_s_scmo_int_en {
++	S_SCMO_INT_EN_RMSK		= 0x1,
++	S_SCMO_INT_EN_IRQ_EN_BMSK	= 0x1,
++	S_SCMO_INT_EN_IRQ_EN_SHFT	= 0x0,
++};
++
++#define S_SCMO_ESYN_ADDR_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000120)
++enum bimc_s_scmo_esyn_addr {
++	S_SCMO_ESYN_ADDR_RMSK				= 0xffffffff,
++	S_SCMO_ESYN_ADDR_ESYN_ADDR_ERR_ADDR_BMSK	= 0xffffffff,
++	S_SCMO_ESYN_ADDR_ESYN_ADDR_ERR_ADDR_SHFT	= 0x0,
++};
++
++#define S_SCMO_ESYN_APACKET_0_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000128)
++enum bimc_s_scmo_esyn_apacket_0 {
++	S_SCMO_ESYN_APACKET_0_RMSK			= 0xff1fffff,
++	S_SCMO_ESYN_APACKET_0_ERR_ATID_BMSK		= 0xff000000,
++	S_SCMO_ESYN_APACKET_0_ERR_ATID_SHFT		= 0x18,
++	S_SCMO_ESYN_APACKET_0_ERR_AVMID_BMSK		= 0x1f0000,
++	S_SCMO_ESYN_APACKET_0_ERR_AVMID_SHFT		= 0x10,
++	S_SCMO_ESYN_APACKET_0_ERR_AMID_BMSK		= 0xffff,
++	S_SCMO_ESYN_APACKET_0_ERR_AMID_SHFT		= 0x0,
++};
++
++#define S_SCMO_ESYN_APACKET_1_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x0000012c)
++enum bimc_s_scmo_esyn_apacket_1 {
++	S_SCMO_ESYN_APACKET_1_RMSK			= 0x10ff117,
++	S_SCMO_ESYN_APACKET_1_ERR_CODE_BMSK		= 0x1000000,
++	S_SCMO_ESYN_APACKET_1_ERR_CODE_SHFT		= 0x18,
++	S_SCMO_ESYN_APACKET_1_ERR_ALEN_BMSK		= 0xf0000,
++	S_SCMO_ESYN_APACKET_1_ERR_ALEN_SHFT		= 0x10,
++	S_SCMO_ESYN_APACKET_1_ERR_ASIZE_BMSK		= 0xe000,
++	S_SCMO_ESYN_APACKET_1_ERR_ASIZE_SHFT		= 0xd,
++	S_SCMO_ESYN_APACKET_1_ERR_ABURST_BMSK		= 0x1000,
++	S_SCMO_ESYN_APACKET_1_ERR_ABURST_SHFT		= 0xc,
++	S_SCMO_ESYN_APACKET_1_ERR_AEXCLUSIVE_BMSK	= 0x100,
++	S_SCMO_ESYN_APACKET_1_ERR_AEXCLUSIVE_SHFT	= 0x8,
++	S_SCMO_ESYN_APACKET_1_ERR_APRONTS_BMSK		= 0x10,
++	S_SCMO_ESYN_APACKET_1_ERR_APRONTS_SHFT		= 0x4,
++	S_SCMO_ESYN_APACKET_1_ERR_AOOORD_BMSK		= 0x4,
++	S_SCMO_ESYN_APACKET_1_ERR_AOOORD_SHFT		= 0x2,
++	S_SCMO_ESYN_APACKET_1_ERR_AOOOWR_BMSK		= 0x2,
++	S_SCMO_ESYN_APACKET_1_ERR_AOOOWR_SHFT		= 0x1,
++	S_SCMO_ESYN_APACKET_1_ERR_AWRITE_BMSK		= 0x1,
++	S_SCMO_ESYN_APACKET_1_ERR_AWRITE_SHFT		= 0x0,
++};
++
++#define S_SCMO_CLK_CTRL_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000200)
++enum bimc_s_scmo_clk_ctrl {
++	S_SCMO_CLK_CTRL_RMSK				= 0xffff1111,
++	S_SCMO_CLK_CTRL_PEN_CMD_CG_EN_BMSK		= 0x10000,
++	S_SCMO_CLK_CTRL_PEN_CMD_CG_EN_SHFT		= 0x10,
++	S_SCMO_CLK_CTRL_RCH_CG_EN_BMSK			= 0x1000,
++	S_SCMO_CLK_CTRL_RCH_CG_EN_SHFT			= 0xc,
++	S_SCMO_CLK_CTRL_FLUSH_CG_EN_BMSK		= 0x100,
++	S_SCMO_CLK_CTRL_FLUSH_CG_EN_SHFT		= 0x8,
++	S_SCMO_CLK_CTRL_WCH_CG_EN_BMSK			= 0x10,
++	S_SCMO_CLK_CTRL_WCH_CG_EN_SHFT			= 0x4,
++	S_SCMO_CLK_CTRL_ACH_CG_EN_BMSK			= 0x1,
++	S_SCMO_CLK_CTRL_ACH_CG_EN_SHFT			= 0x0,
++};
++
++#define S_SCMO_SLV_INTERLEAVE_CFG_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000400)
++enum bimc_s_scmo_slv_interleave_cfg {
++	S_SCMO_SLV_INTERLEAVE_CFG_RMSK			= 0xff,
++	S_SCMO_SLV_INTERLEAVE_CFG_INTERLEAVE_CS1_BMSK	= 0x10,
++	S_SCMO_SLV_INTERLEAVE_CFG_INTERLEAVE_CS1_SHFT	= 0x4,
++	S_SCMO_SLV_INTERLEAVE_CFG_INTERLEAVE_CS0_BMSK	= 0x1,
++	S_SCMO_SLV_INTERLEAVE_CFG_INTERLEAVE_CS0_SHFT	= 0x0,
++};
++
++#define S_SCMO_ADDR_BASE_CSn_ADDR(b, n, o)	\
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000410 + 0x4 * (o))
++enum bimc_s_scmo_addr_base_csn {
++	S_SCMO_ADDR_BASE_CSn_RMSK			= 0xffff,
++	S_SCMO_ADDR_BASE_CSn_MAXn			= 1,
++	S_SCMO_ADDR_BASE_CSn_ADDR_BASE_BMSK		= 0xfc,
++	S_SCMO_ADDR_BASE_CSn_ADDR_BASE_SHFT		= 0x2,
++};
++
++#define S_SCMO_ADDR_MAP_CSn_ADDR(b, n, o) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000420 + 0x4 * (o))
++enum bimc_s_scmo_addr_map_csn {
++	S_SCMO_ADDR_MAP_CSn_RMSK		= 0xffff,
++	S_SCMO_ADDR_MAP_CSn_MAXn		= 1,
++	S_SCMO_ADDR_MAP_CSn_RANK_EN_BMSK	= 0x8000,
++	S_SCMO_ADDR_MAP_CSn_RANK_EN_SHFT	= 0xf,
++	S_SCMO_ADDR_MAP_CSn_ADDR_MODE_BMSK	= 0x1000,
++	S_SCMO_ADDR_MAP_CSn_ADDR_MODE_SHFT	= 0xc,
++	S_SCMO_ADDR_MAP_CSn_BANK_SIZE_BMSK	= 0x100,
++	S_SCMO_ADDR_MAP_CSn_BANK_SIZE_SHFT	= 0x8,
++	S_SCMO_ADDR_MAP_CSn_ROW_SIZE_BMSK	= 0x30,
++	S_SCMO_ADDR_MAP_CSn_ROW_SIZE_SHFT	= 0x4,
++	S_SCMO_ADDR_MAP_CSn_COL_SIZE_BMSK	= 0x3,
++	S_SCMO_ADDR_MAP_CSn_COL_SIZE_SHFT	= 0x0,
++};
++
++#define S_SCMO_ADDR_MASK_CSn_ADDR(b, n, o) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000430 + 0x4 * (0))
++enum bimc_s_scmo_addr_mask_csn {
++	S_SCMO_ADDR_MASK_CSn_RMSK		= 0xffff,
++	S_SCMO_ADDR_MASK_CSn_MAXn		= 1,
++	S_SCMO_ADDR_MASK_CSn_ADDR_MASK_BMSK	= 0xfc,
++	S_SCMO_ADDR_MASK_CSn_ADDR_MASK_SHFT	= 0x2,
++};
++
++#define S_SCMO_SLV_STATUS_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000450)
++enum bimc_s_scmo_slv_status {
++	S_SCMO_SLV_STATUS_RMSK				= 0xff3,
++	S_SCMO_SLV_STATUS_GLOBAL_MONS_IN_USE_BMSK	= 0xff0,
++	S_SCMO_SLV_STATUS_GLOBAL_MONS_IN_USE_SHFT	= 0x4,
++	S_SCMO_SLV_STATUS_SLAVE_IDLE_BMSK		= 0x3,
++	S_SCMO_SLV_STATUS_SLAVE_IDLE_SHFT		= 0x0,
++};
++
++#define S_SCMO_CMD_BUF_CFG_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000500)
++enum bimc_s_scmo_cmd_buf_cfg {
++	S_SCMO_CMD_BUF_CFG_RMSK				= 0xf1f,
++	S_SCMO_CMD_BUF_CFG_CMD_ORDERING_BMSK		= 0x300,
++	S_SCMO_CMD_BUF_CFG_CMD_ORDERING_SHFT		= 0x8,
++	S_SCMO_CMD_BUF_CFG_HP_CMD_AREQPRIO_MAP_BMSK	= 0x10,
++	S_SCMO_CMD_BUF_CFG_HP_CMD_AREQPRIO_MAP_SHFT	= 0x4,
++	S_SCMO_CMD_BUF_CFG_HP_CMD_Q_DEPTH_BMSK		= 0x7,
++	S_SCMO_CMD_BUF_CFG_HP_CMD_Q_DEPTH_SHFT		= 0x0,
++};
++
++#define S_SCM_CMD_BUF_STATUS_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000520)
++enum bimc_s_scm_cmd_buf_status {
++	S_SCMO_CMD_BUF_STATUS_RMSK				= 0x77,
++	S_SCMO_CMD_BUF_STATUS_HP_CMD_BUF_ENTRIES_IN_USE_BMSK	= 0x70,
++	S_SCMO_CMD_BUF_STATUS_HP_CMD_BUF_ENTRIES_IN_USE_SHFT	= 0x4,
++	S_SCMO_CMD_BUF_STATUS_LP_CMD_BUF_ENTRIES_IN_USE_BMSK	= 0x7,
++	S_SCMO_CMD_BUF_STATUS_LP_CMD_BUF_ENTRIES_IN_USE_SHFT	= 0x0,
++};
++
++#define S_SCMO_RCH_SEL_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000540)
++enum bimc_s_scmo_rch_sel {
++	S_SCMO_RCH_SEL_RMSK			= 0xffffffff,
++	S_SCMO_CMD_BUF_STATUS_RCH_PORTS_BMSK	= 0xffffffff,
++	S_SCMO_CMD_BUF_STATUS_RCH_PORTS_SHFT	= 0x0,
++};
++
++#define S_SCMO_RCH_BKPR_CFG_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000544)
++enum bimc_s_scmo_rch_bkpr_cfg {
++	S_SCMO_RCH_BKPR_CFG_RMSK			= 0xffffffff,
++	S_SCMO_RCH_BKPR_CFG_RCH1_FIFO_BKPR_HI_TH_BMSK	= 0x3f000000,
++	S_SCMO_RCH_BKPR_CFG_RCH1_FIFO_BKPR_HI_TH_SHFT	= 0x18,
++	S_SCMO_RCH_BKPR_CFG_RCH1_FIFO_BKPR_LO_TH_BMSK	= 0x3f0000,
++	S_SCMO_RCH_BKPR_CFG_RCH1_FIFO_BKPR_LO_TH_SHFT	= 0x10,
++	S_SCMO_RCH_BKPR_CFG_RCH0_FIFO_BKPR_HI_TH_BMSK	= 0x3f00,
++	S_SCMO_RCH_BKPR_CFG_RCH0_FIFO_BKPR_HI_TH_SHFT	= 0x8,
++	S_SCMO_RCH_BKPR_CFG_RCH0_FIFO_BKPR_LO_TH_BMSK	= 0x3f,
++	S_SCMO_RCH_BKPR_CFG_RCH0_FIFO_BKPR_LO_TH_SHFT	= 0x0,
++};
++
++#define S_SCMO_RCH_STATUS_ADDR(b, n) \
++		(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000560)
++enum bimc_s_scmo_rch_status {
++	S_SCMO_RCH_STATUS_RMSK				= 0x33333,
++	S_SCMO_RCH_STATUS_PRQ_FIFO_FULL_BMSK		= 0x20000,
++	S_SCMO_RCH_STATUS_PRQ_FIFO_FULL_SHFT		= 0x11,
++	S_SCMO_RCH_STATUS_PRQ_FIFO_EMPTY_BMSK		= 0x10000,
++	S_SCMO_RCH_STATUS_PRQ_FIFO_EMPTY_SHFT		= 0x10,
++	S_SCMO_RCH_STATUS_RCH1_QUAL_FIFO_FULL_BMSK	= 0x2000,
++	S_SCMO_RCH_STATUS_RCH1_QUAL_FIFO_FULL_SHFT	= 0xd,
++	S_SCMO_RCH_STATUS_RCH1_QUAL_FIFO_EMPTY_BMSK	= 0x1000,
++	S_SCMO_RCH_STATUS_RCH1_QUAL_FIFO_EMPTY_SHFT	= 0xc,
++	S_SCMO_RCH_STATUS_RCH1_DATA_FIFO_FULL_BMSK	= 0x200,
++	S_SCMO_RCH_STATUS_RCH1_DATA_FIFO_FULL_SHFT	= 0x9,
++	S_SCMO_RCH_STATUS_RCH1_DATA_FIFO_EMPTY_BMSK	= 0x100,
++	S_SCMO_RCH_STATUS_RCH1_DATA_FIFO_EMPTY_SHFT	= 0x8,
++	S_SCMO_RCH_STATUS_RCH0_QUAL_FIFO_FULL_BMSK	= 0x20,
++	S_SCMO_RCH_STATUS_RCH0_QUAL_FIFO_FULL_SHFT	= 0x5,
++	S_SCMO_RCH_STATUS_RCH0_QUAL_FIFO_EMPTY_BMSK	= 0x10,
++	S_SCMO_RCH_STATUS_RCH0_QUAL_FIFO_EMPTY_SHFT	= 0x4,
++	S_SCMO_RCH_STATUS_RCH0_DATA_FIFO_FULL_BMSK	= 0x2,
++	S_SCMO_RCH_STATUS_RCH0_DATA_FIFO_FULL_SHFT	= 0x1,
++	S_SCMO_RCH_STATUS_RCH0_DATA_FIFO_EMPTY_BMSK	= 0x1,
++	S_SCMO_RCH_STATUS_RCH0_DATA_FIFO_EMPTY_SHFT	= 0x0,
++};
++
++#define S_SCMO_WCH_BUF_CFG_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000580)
++enum bimc_s_scmo_wch_buf_cfg {
++	S_SCMO_WCH_BUF_CFG_RMSK				= 0xff,
++	S_SCMO_WCH_BUF_CFG_WRITE_BLOCK_READ_BMSK	= 0x10,
++	S_SCMO_WCH_BUF_CFG_WRITE_BLOCK_READ_SHFT	= 0x4,
++	S_SCMO_WCH_BUF_CFG_COALESCE_EN_BMSK		= 0x1,
++	S_SCMO_WCH_BUF_CFG_COALESCE_EN_SHFT		= 0x0,
++};
++
++#define S_SCMO_WCH_STATUS_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x000005a0)
++enum bimc_s_scmo_wch_status {
++	S_SCMO_WCH_STATUS_RMSK				= 0x333,
++	S_SCMO_WCH_STATUS_BRESP_FIFO_FULL_BMSK		= 0x200,
++	S_SCMO_WCH_STATUS_BRESP_FIFO_FULL_SHFT		= 0x9,
++	S_SCMO_WCH_STATUS_BRESP_FIFO_EMPTY_BMSK		= 0x100,
++	S_SCMO_WCH_STATUS_BRESP_FIFO_EMPTY_SHFT		= 0x8,
++	S_SCMO_WCH_STATUS_WDATA_FIFO_FULL_BMSK		= 0x20,
++	S_SCMO_WCH_STATUS_WDATA_FIFO_FULL_SHFT		= 0x5,
++	S_SCMO_WCH_STATUS_WDATA_FIFO_EMPTY_BMSK		= 0x10,
++	S_SCMO_WCH_STATUS_WDATA_FIFO_EMPTY_SHFT		= 0x4,
++	S_SCMO_WCH_STATUS_WBUF_FULL_BMSK		= 0x2,
++	S_SCMO_WCH_STATUS_WBUF_FULL_SHFT		= 0x1,
++	S_SCMO_WCH_STATUS_WBUF_EMPTY_BMSK		= 0x1,
++	S_SCMO_WCH_STATUS_WBUF_EMPTY_SHFT		= 0x0,
++};
++
++#define S_SCMO_FLUSH_CFG_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x000005c0)
++enum bimc_s_scmo_flush_cfg {
++	S_SCMO_FLUSH_CFG_RMSK				= 0xffffffff,
++	S_SCMO_FLUSH_CFG_FLUSH_IN_ORDER_BMSK		= 0x10000000,
++	S_SCMO_FLUSH_CFG_FLUSH_IN_ORDER_SHFT		= 0x1c,
++	S_SCMO_FLUSH_CFG_FLUSH_IDLE_DELAY_BMSK		= 0x3ff0000,
++	S_SCMO_FLUSH_CFG_FLUSH_IDLE_DELAY_SHFT		= 0x10,
++	S_SCMO_FLUSH_CFG_FLUSH_UPPER_LIMIT_BMSK		= 0xf00,
++	S_SCMO_FLUSH_CFG_FLUSH_UPPER_LIMIT_SHFT		= 0x8,
++	S_SCMO_FLUSH_CFG_FLUSH_LOWER_LIMIT_BMSK		= 0xf,
++	S_SCMO_FLUSH_CFG_FLUSH_LOWER_LIMIT_SHFT		= 0x0,
++};
++
++#define S_SCMO_FLUSH_CMD_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x000005c4)
++enum bimc_s_scmo_flush_cmd {
++	S_SCMO_FLUSH_CMD_RMSK				= 0xf,
++	S_SCMO_FLUSH_CMD_FLUSH_ALL_BUF_BMSK		= 0x3,
++	S_SCMO_FLUSH_CMD_FLUSH_ALL_BUF_SHFT		= 0x0,
++};
++
++#define S_SCMO_CMD_OPT_CFG0_ADDR(b, n) \
++	(S_SCM0_REG_BASE(b) + (0x8000 * (n)) + 0x00000700)
++enum bimc_s_scmo_cmd_opt_cfg0 {
++	S_SCMO_CMD_OPT_CFG0_RMSK		= 0xffffff,
++	S_SCMO_CMD_OPT_CFG0_IGNORE_BANK_UNAVL_BMSK	= 0x100000,
++	S_SCMO_CMD_OPT_CFG0_IGNORE_BANK_UNAVL_SHFT	= 0x14,
++	S_SCMO_CMD_OPT_CFG0_MASK_CMDOUT_PRI_BMSK	= 0x10000,
++	S_SCMO_CMD_OPT_CFG0_MASK_CMDOUT_PRI_SHFT	= 0x10,
++	S_SCMO_CMD_OPT_CFG0_DPE_CMD_REORDERING_BMSK	= 0x1000,
++	S_SCMO_CMD_OPT_CFG0_DPE_CMD_REORDERING_SHFT	= 0xc,
++	S_SCMO_CMD_OPT_CFG0_WR_OPT_EN_BMSK		= 0x100,
++	S_SCMO_CMD_OPT_CFG0_WR_OPT_EN_SHFT		= 0x8,
++	S_SCMO_CMD_OPT_CFG0_RD_OPT_EN_BMSK		= 0x10,
++	S_SCMO_CMD_OPT_CFG0_RD_OPT_EN_SHFT		= 0x4,
++	S_SCMO_CMD_OPT_CFG0_PAGE_MGMT_POLICY_BMSK	= 0x1,
++	S_SCMO_CMD_OPT_CFG0_PAGE_MGMT_POLICY_SHFT	= 0x0,
++};
++
++#define S_SCMO_CMD_OPT_CFG1_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000704)
++enum bimc_s_scmo_cmd_opt_cfg1 {
++	S_SCMO_CMD_OPT_CFG1_RMSK			= 0xffffffff,
++	S_SCMO_CMD_OPT_CFG1_HSTP_CMD_TIMEOUT_BMSK	= 0x1f000000,
++	S_SCMO_CMD_OPT_CFG1_HSTP_CMD_TIMEOUT_SHFT	= 0x18,
++	S_SCMO_CMD_OPT_CFG1_HP_CMD_TIMEOUT_BMSK		= 0x1f0000,
++	S_SCMO_CMD_OPT_CFG1_HP_CMD_TIMEOUT_SHFT		= 0x10,
++	S_SCMO_CMD_OPT_CFG1_MP_CMD_TIMEOUT_BMSK		= 0x1f00,
++	S_SCMO_CMD_OPT_CFG1_MP_CMD_TIMEOUT_SHFT		= 0x8,
++	S_SCMO_CMD_OPT_CFG1_LP_CMD_TIMEOUT_BMSK		= 0x1f,
++	S_SCMO_CMD_OPT_CFG1_LP_CMD_TIMEOUT_SHFT		= 0x0,
++};
++
++#define S_SCMO_CMD_OPT_CFG2_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x00000708)
++enum bimc_s_scmo_cmd_opt_cfg2 {
++	S_SCMO_CMD_OPT_CFG2_RMSK			= 0xff,
++	S_SCMO_CMD_OPT_CFG2_RWOPT_CMD_TIMEOUT_BMSK	= 0xf,
++	S_SCMO_CMD_OPT_CFG2_RWOPT_CMD_TIMEOUT_SHFT	= 0x0,
++};
++
++#define S_SCMO_CMD_OPT_CFG3_ADDR(b, n) \
++	(S_SCMO_REG_BASE(b) + (0x8000 * (n)) + 0x0000070c)
++enum bimc_s_scmo_cmd_opt_cfg3 {
++	S_SCMO_CMD_OPT_CFG3_RMSK			= 0xff,
++	S_SCMO_CMD_OPT_CFG3_FLUSH_CMD_TIMEOUT_BMSK	= 0xf,
++	S_SCMO_CMD_OPT_CFG3_FLUSH_CMD_TIMEOUT_SHFT	= 0x0,
++};
++
++/* S_SWAY_GENERIC */
++#define S_SWAY_REG_BASE(b)	((b) + 0x00048000)
++
++#define S_SWAY_CONFIG_INFO_0_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000020)
++enum bimc_s_sway_config_info_0 {
++	S_SWAY_CONFIG_INFO_0_RMSK		= 0xff0000ff,
++	S_SWAY_CONFIG_INFO_0_SYNC_MODE_BMSK	= 0xff000000,
++	S_SWAY_CONFIG_INFO_0_SYNC_MODE_SHFT	= 0x18,
++	S_SWAY_CONFIG_INFO_0_FUNC_BMSK		= 0xff,
++	S_SWAY_CONFIG_INFO_0_FUNC_SHFT		= 0x0,
++};
++
++#define S_SWAY_CONFIG_INFO_1_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000030)
++enum bimc_s_sway_config_info_1 {
++	S_SWAY_CONFIG_INFO_1_RMSK			= 0xffffffff,
++	S_SWAY_CONFIG_INFO_1_MPORT_CONNECTIVITY_BMSK	= 0xffffffff,
++	S_SWAY_CONFIG_INFO_1_MPORT_CONNECTIVITY_SHFT	= 0x0,
++};
++
++#define S_SWAY_CONFIG_INFO_2_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000040)
++enum bimc_s_sway_config_info_2 {
++	S_SWAY_CONFIG_INFO_2_RMSK			= 0xffff0000,
++	S_SWAY_CONFIG_INFO_2_MPORT_CONNECTIVITY_BMSK	= 0xffff0000,
++	S_SWAY_CONFIG_INFO_2_MPORT_CONNECTIVITY_SHFT	= 0x10,
++};
++
++#define S_SWAY_CONFIG_INFO_3_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000050)
++enum bimc_s_sway_config_info_3 {
++	S_SWAY_CONFIG_INFO_3_RMSK			= 0xffffffff,
++	S_SWAY_CONFIG_INFO_3_RCH0_DEPTH_BMSK		= 0xff000000,
++	S_SWAY_CONFIG_INFO_3_RCH0_DEPTH_SHFT		= 0x18,
++	S_SWAY_CONFIG_INFO_3_BCH_DEPTH_BMSK		= 0xff0000,
++	S_SWAY_CONFIG_INFO_3_BCH_DEPTH_SHFT		= 0x10,
++	S_SWAY_CONFIG_INFO_3_WCH_DEPTH_BMSK		= 0xff,
++	S_SWAY_CONFIG_INFO_3_WCH_DEPTH_SHFT		= 0x0,
++};
++
++#define S_SWAY_CONFIG_INFO_4_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000060)
++enum bimc_s_sway_config_info_4 {
++	S_SWAY_CONFIG_INFO_4_RMSK			= 0x800000ff,
++	S_SWAY_CONFIG_INFO_4_DUAL_RCH_EN_BMSK		= 0x80000000,
++	S_SWAY_CONFIG_INFO_4_DUAL_RCH_EN_SHFT		= 0x1f,
++	S_SWAY_CONFIG_INFO_4_RCH1_DEPTH_BMSK		= 0xff,
++	S_SWAY_CONFIG_INFO_4_RCH1_DEPTH_SHFT		= 0x0,
++};
++
++#define S_SWAY_CONFIG_INFO_5_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000070)
++enum bimc_s_sway_config_info_5 {
++	S_SWAY_CONFIG_INFO_5_RMSK			= 0x800000ff,
++	S_SWAY_CONFIG_INFO_5_QCH_EN_BMSK		= 0x80000000,
++	S_SWAY_CONFIG_INFO_5_QCH_EN_SHFT		= 0x1f,
++	S_SWAY_CONFIG_INFO_5_QCH_DEPTH_BMSK		= 0xff,
++	S_SWAY_CONFIG_INFO_5_QCH_DEPTH_SHFT		= 0x0,
++};
++
++#define S_SWAY_CONFIG_INFO_6_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000080)
++enum bimc_s_sway_config_info_6 {
++	S_SWAY_CONFIG_INFO_6_RMSK			= 0x1,
++	S_SWAY_CONFIG_INFO_6_S2SW_PIPELINE_EN_BMSK	= 0x1,
++	S_SWAY_CONFIG_INFO_6_S2SW_PIPELINE_EN_SHFT	= 0x0,
++};
++
++#define S_SWAY_INT_STATUS_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000100)
++enum bimc_s_sway_int_status {
++	S_SWAY_INT_STATUS_RMSK		= 0x3,
++	S_SWAY_INT_STATUS_RFU_BMSK	= 0x3,
++	S_SWAY_INT_STATUS_RFU_SHFT	= 0x0,
++};
++
++#define S_SWAY_INT_CLR_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000108)
++enum bimc_s_sway_int_clr {
++	S_SWAY_INT_CLR_RMSK		= 0x3,
++	S_SWAY_INT_CLR_RFU_BMSK		= 0x3,
++	S_SWAY_INT_CLR_RFU_SHFT		= 0x0,
++};
++
++
++#define S_SWAY_INT_EN_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x0000010c)
++enum bimc_s_sway_int_en {
++	S_SWAY_INT_EN_RMSK		= 0x3,
++	S_SWAY_INT_EN_RFU_BMSK		= 0x3,
++	S_SWAY_INT_EN_RFU_SHFT		= 0x0,
++};
++
++#define S_SWAY_CLK_CTRL_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000200)
++enum bimc_s_sway_clk_ctrl {
++	S_SWAY_CLK_CTRL_RMSK				= 0x3,
++	S_SWAY_CLK_CTRL_SLAVE_CLK_GATING_EN_BMSK	= 0x2,
++	S_SWAY_CLK_CTRL_SLAVE_CLK_GATING_EN_SHFT	= 0x1,
++	S_SWAY_CLK_CTRL_CORE_CLK_GATING_EN_BMSK		= 0x1,
++	S_SWAY_CLK_CTRL_CORE_CLK_GATING_EN_SHFT		= 0x0,
++};
++
++#define S_SWAY_RCH_SEL_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000210)
++enum bimc_s_sway_rch_sel {
++	S_SWAY_RCH_SEL_RMSK		= 0x7f,
++	S_SWAY_RCH_SEL_UNUSED_BMSK	= 0x7f,
++	S_SWAY_RCH_SEL_UNUSED_SHFT	= 0x0,
++};
++
++
++#define S_SWAY_MAX_OUTSTANDING_REQS_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000220)
++enum bimc_s_sway_max_outstanding_reqs {
++	S_SWAY_MAX_OUTSTANDING_REQS_RMSK	= 0xffff,
++	S_SWAY_MAX_OUTSTANDING_REQS_WRITE_BMSK	= 0xff00,
++	S_SWAY_MAX_OUTSTANDING_REQS_WRITE_SHFT	= 0x8,
++	S_SWAY_MAX_OUTSTANDING_REQS_READ_BMSK	= 0xff,
++	S_SWAY_MAX_OUTSTANDING_REQS_READ_SHFT	= 0x0,
++};
++
++
++#define S_SWAY_BUF_STATUS_0_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000400)
++enum bimc_s_sway_buf_status_0 {
++	S_SWAY_BUF_STATUS_0_RMSK			= 0xf0300f03,
++	S_SWAY_BUF_STATUS_0_RCH0_DATA_RD_FULL_BMSK	= 0x80000000,
++	S_SWAY_BUF_STATUS_0_RCH0_DATA_RD_FULL_SHFT	= 0x1f,
++	S_SWAY_BUF_STATUS_0_RCH0_DATA_RD_EMPTY_BMSK	= 0x40000000,
++	S_SWAY_BUF_STATUS_0_RCH0_DATA_RD_EMPTY_SHFT	= 0x1e,
++	S_SWAY_BUF_STATUS_0_RCH0_CTRL_RD_FULL_BMSK	= 0x20000000,
++	S_SWAY_BUF_STATUS_0_RCH0_CTRL_RD_FULL_SHFT	= 0x1d,
++	S_SWAY_BUF_STATUS_0_RCH0_CTRL_RD_EMPTY_BMSK	= 0x10000000,
++	S_SWAY_BUF_STATUS_0_RCH0_CTRL_RD_EMPTY_SHFT	= 0x1c,
++	S_SWAY_BUF_STATUS_0_BCH_RD_FULL_BMSK		= 0x200000,
++	S_SWAY_BUF_STATUS_0_BCH_RD_FULL_SHFT		= 0x15,
++	S_SWAY_BUF_STATUS_0_BCH_RD_EMPTY_BMSK		= 0x100000,
++	S_SWAY_BUF_STATUS_0_BCH_RD_EMPTY_SHFT		= 0x14,
++	S_SWAY_BUF_STATUS_0_WCH_DATA_WR_FULL_BMSK	= 0x800,
++	S_SWAY_BUF_STATUS_0_WCH_DATA_WR_FULL_SHFT	= 0xb,
++	S_SWAY_BUF_STATUS_0_WCH_DATA_WR_EMPTY_BMSK	= 0x400,
++	S_SWAY_BUF_STATUS_0_WCH_DATA_WR_EMPTY_SHFT	= 0xa,
++	S_SWAY_BUF_STATUS_0_WCH_CTRL_WR_FULL_BMSK	= 0x200,
++	S_SWAY_BUF_STATUS_0_WCH_CTRL_WR_FULL_SHFT	= 0x9,
++	S_SWAY_BUF_STATUS_0_WCH_CTRL_WR_EMPTY_BMSK	= 0x100,
++	S_SWAY_BUF_STATUS_0_WCH_CTRL_WR_EMPTY_SHFT	= 0x8,
++	S_SWAY_BUF_STATUS_0_ACH_WR_FULL_BMSK		= 0x2,
++	S_SWAY_BUF_STATUS_0_ACH_WR_FULL_SHFT		= 0x1,
++	S_SWAY_BUF_STATUS_0_ACH_WR_EMPTY_BMSK		= 0x1,
++	S_SWAY_BUF_STATUS_0_ACH_WR_EMPTY_SHFT		= 0x0,
++};
++
++#define S_SWAY_BUF_STATUS_1_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000410)
++enum bimc_s_sway_buf_status_1 {
++	S_SWAY_BUF_STATUS_1_RMSK			= 0xf0,
++	S_SWAY_BUF_STATUS_1_RCH1_DATA_RD_FULL_BMSK	= 0x80,
++	S_SWAY_BUF_STATUS_1_RCH1_DATA_RD_FULL_SHFT	= 0x7,
++	S_SWAY_BUF_STATUS_1_RCH1_DATA_RD_EMPTY_BMSK	= 0x40,
++	S_SWAY_BUF_STATUS_1_RCH1_DATA_RD_EMPTY_SHFT	= 0x6,
++	S_SWAY_BUF_STATUS_1_RCH1_CTRL_RD_FULL_BMSK	= 0x20,
++	S_SWAY_BUF_STATUS_1_RCH1_CTRL_RD_FULL_SHFT	= 0x5,
++	S_SWAY_BUF_STATUS_1_RCH1_CTRL_RD_EMPTY_BMSK	= 0x10,
++	S_SWAY_BUF_STATUS_1_RCH1_CTRL_RD_EMPTY_SHFT	= 0x4,
++};
++
++#define S_SWAY_BUF_STATUS_2_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000420)
++enum bimc_s_sway_buf_status_2 {
++	S_SWAY_BUF_STATUS_2_RMSK		= 0x30,
++	S_SWAY_BUF_STATUS_2_QCH_RD_FULL_BMSK	= 0x20,
++	S_SWAY_BUF_STATUS_2_QCH_RD_FULL_SHFT	= 0x5,
++	S_SWAY_BUF_STATUS_2_QCH_RD_EMPTY_BMSK	= 0x10,
++	S_SWAY_BUF_STATUS_2_QCH_RD_EMPTY_SHFT	= 0x4,
++};
++
++/* S_ARB_GENERIC */
++
++#define S_ARB_REG_BASE(b)	((b) + 0x00049000)
++
++#define S_ARB_COMPONENT_INFO_ADDR(b, n) \
++	(S_SWAY_REG_BASE(b) + (0x8000 * (n)) + 0x00000000)
++enum bimc_s_arb_component_info {
++	S_ARB_COMPONENT_INFO_RMSK		= 0xffffff,
++	S_ARB_COMPONENT_INFO_INSTANCE_BMSK	= 0xff0000,
++	S_ARB_COMPONENT_INFO_INSTANCE_SHFT	= 0x10,
++	S_ARB_COMPONENT_INFO_SUB_TYPE_BMSK	= 0xff00,
++	S_ARB_COMPONENT_INFO_SUB_TYPE_SHFT	= 0x8,
++	S_ARB_COMPONENT_INFO_TYPE_BMSK		= 0xff,
++	S_ARB_COMPONENT_INFO_TYPE_SHFT		= 0x0,
++};
++
++#define S_ARB_CONFIG_INFO_0_ADDR(b, n) \
++		(S_ARB_REG_BASE(b) + (0x8000 * (n)) + 0x00000020)
++enum bimc_s_arb_config_info_0 {
++	S_ARB_CONFIG_INFO_0_RMSK			= 0x800000ff,
++	S_ARB_CONFIG_INFO_0_ARB2SW_PIPELINE_EN_BMSK	= 0x80000000,
++	S_ARB_CONFIG_INFO_0_ARB2SW_PIPELINE_EN_SHFT	= 0x1f,
++	S_ARB_CONFIG_INFO_0_FUNC_BMSK			= 0xff,
++	S_ARB_CONFIG_INFO_0_FUNC_SHFT			= 0x0,
++};
++
++#define S_ARB_CONFIG_INFO_1_ADDR(b, n) \
++		(S_ARB_REG_BASE(b) + (0x8000 * (n)) + 0x00000030)
++enum bimc_s_arb_config_info_1 {
++	S_ARB_CONFIG_INFO_1_RMSK			= 0xffffffff,
++	S_ARB_CONFIG_INFO_1_MPORT_CONNECTIVITY_BMSK	= 0xffffffff,
++	S_ARB_CONFIG_INFO_1_MPORT_CONNECTIVITY_SHFT	= 0x0,
++};
++
++#define S_ARB_CLK_CTRL_ADDR(b) \
++	(S_ARB_REG_BASE(b) + (0x8000 * (n)) + 0x00000200)
++enum bimc_s_arb_clk_ctrl {
++	S_ARB_CLK_CTRL_RMSK				= 0x1,
++	S_ARB_CLK_CTRL_SLAVE_CLK_GATING_EN_BMSK		= 0x2,
++	S_ARB_CLK_CTRL_SLAVE_CLK_GATING_EN_SHFT		= 0x1,
++	S_ARB_CLK_CTRL_CORE_CLK_GATING_EN_BMSK		= 0x1,
++	S_ARB_CLK_CTRL_CORE_CLK_GATING_EN_SHFT		= 0x0,
++	S_ARB_CLK_CTRL_CLK_GATING_EN_BMSK		= 0x1,
++	S_ARB_CLK_CTRL_CLK_GATING_EN_SHFT		= 0x0,
++};
++
++#define S_ARB_MODE_ADDR(b, n) \
++	(S_ARB_REG_BASE(b) + (0x8000 * (n)) + 0x00000210)
++enum bimc_s_arb_mode {
++	S_ARB_MODE_RMSK				= 0xf0000001,
++	S_ARB_MODE_WR_GRANTS_AHEAD_BMSK		= 0xf0000000,
++	S_ARB_MODE_WR_GRANTS_AHEAD_SHFT		= 0x1c,
++	S_ARB_MODE_PRIO_RR_EN_BMSK		= 0x1,
++	S_ARB_MODE_PRIO_RR_EN_SHFT		= 0x0,
++};
++
++#define BKE_HEALTH_MASK \
++	(M_BKE_HEALTH_0_CONFIG_LIMIT_CMDS_BMSK |\
++	M_BKE_HEALTH_0_CONFIG_AREQPRIO_BMSK |\
++	M_BKE_HEALTH_0_CONFIG_PRIOLVL_BMSK)
++
++#define BKE_HEALTH_VAL(limit, areq, plvl) \
++	((((limit) << M_BKE_HEALTH_0_CONFIG_LIMIT_CMDS_SHFT) & \
++	M_BKE_HEALTH_0_CONFIG_LIMIT_CMDS_BMSK) | \
++	(((areq) << M_BKE_HEALTH_0_CONFIG_AREQPRIO_SHFT) & \
++	M_BKE_HEALTH_0_CONFIG_AREQPRIO_BMSK) | \
++	(((plvl) << M_BKE_HEALTH_0_CONFIG_PRIOLVL_SHFT) & \
++	M_BKE_HEALTH_0_CONFIG_PRIOLVL_BMSK))
++
++#define MAX_GRANT_PERIOD \
++	(M_BKE_GP_GP_BMSK >> \
++	M_BKE_GP_GP_SHFT)
++
++#define MAX_GC \
++	(M_BKE_GC_GC_BMSK >> \
++	(M_BKE_GC_GC_SHFT + 1))
++
++static int bimc_div(int64_t *a, uint32_t b)
++{
++	if ((*a > 0) && (*a < b)) {
++		*a = 0;
++		return 1;
++	} else {
++		return do_div(*a, b);
++	}
++}
++
++#define ENABLE(val) ((val) == 1 ? 1 : 0)
++void msm_bus_bimc_set_mas_clk_gate(struct msm_bus_bimc_info *binfo,
++	uint32_t mas_index, struct msm_bus_bimc_clk_gate *bgate)
++{
++	uint32_t val, mask, reg_val;
++	void __iomem *addr;
++
++	reg_val = readl_relaxed(M_CLK_CTRL_ADDR(binfo->base,
++			mas_index)) & M_CLK_CTRL_RMSK;
++	addr = M_CLK_CTRL_ADDR(binfo->base, mas_index);
++	mask = (M_CLK_CTRL_MAS_CLK_GATING_EN_BMSK |
++		M_CLK_CTRL_CORE_CLK_GATING_EN_BMSK);
++	val = (bgate->core_clk_gate_en <<
++		M_CLK_CTRL_MAS_CLK_GATING_EN_SHFT) |
++		bgate->port_clk_gate_en;
++	writel_relaxed(((reg_val & (~mask)) | (val & mask)), addr);
++	/* Ensure clock gating enable mask is set before exiting */
++	wmb();
++}
++
++void msm_bus_bimc_arb_en(struct msm_bus_bimc_info *binfo,
++	uint32_t slv_index, bool en)
++{
++	uint32_t reg_val, reg_mask_val, enable, val;
++
++	reg_mask_val = (readl_relaxed(S_ARB_CONFIG_INFO_0_ADDR(binfo->
++		base, slv_index)) & S_ARB_CONFIG_INFO_0_FUNC_BMSK)
++		>> S_ARB_CONFIG_INFO_0_FUNC_SHFT;
++	enable = ENABLE(en);
++	val = enable << S_ARB_MODE_PRIO_RR_EN_SHFT;
++	if (reg_mask_val == BIMC_ARB_MODE_PRIORITY_RR) {
++		reg_val = readl_relaxed(S_ARB_CONFIG_INFO_0_ADDR(binfo->
++			base, slv_index)) & S_ARB_MODE_RMSK;
++		writel_relaxed(((reg_val & (~(S_ARB_MODE_PRIO_RR_EN_BMSK))) |
++			(val & S_ARB_MODE_PRIO_RR_EN_BMSK)),
++			S_ARB_MODE_ADDR(binfo->base, slv_index));
++		/* Ensure arbitration mode is set before returning */
++		wmb();
++	}
++}
++
++static void set_qos_mode(void __iomem *baddr, uint32_t index, uint32_t val0,
++	uint32_t val1, uint32_t val2)
++{
++	uint32_t reg_val, val;
++
++	reg_val = readl_relaxed(M_PRIOLVL_OVERRIDE_ADDR(baddr,
++		index)) & M_PRIOLVL_OVERRIDE_RMSK;
++	val = val0 << M_PRIOLVL_OVERRIDE_OVERRIDE_PRIOLVL_SHFT;
++	writel_relaxed(((reg_val & ~(M_PRIOLVL_OVERRIDE_OVERRIDE_PRIOLVL_BMSK))
++		| (val & M_PRIOLVL_OVERRIDE_OVERRIDE_PRIOLVL_BMSK)),
++		M_PRIOLVL_OVERRIDE_ADDR(baddr, index));
++	reg_val = readl_relaxed(M_RD_CMD_OVERRIDE_ADDR(baddr, index)) &
++		M_RD_CMD_OVERRIDE_RMSK;
++	val = val1 << M_RD_CMD_OVERRIDE_OVERRIDE_AREQPRIO_SHFT;
++	writel_relaxed(((reg_val & ~(M_RD_CMD_OVERRIDE_OVERRIDE_AREQPRIO_BMSK
++		)) | (val & M_RD_CMD_OVERRIDE_OVERRIDE_AREQPRIO_BMSK)),
++		M_RD_CMD_OVERRIDE_ADDR(baddr, index));
++	reg_val = readl_relaxed(M_WR_CMD_OVERRIDE_ADDR(baddr, index)) &
++		M_WR_CMD_OVERRIDE_RMSK;
++	val = val2 << M_WR_CMD_OVERRIDE_OVERRIDE_AREQPRIO_SHFT;
++	writel_relaxed(((reg_val & ~(M_WR_CMD_OVERRIDE_OVERRIDE_AREQPRIO_BMSK
++		)) | (val & M_WR_CMD_OVERRIDE_OVERRIDE_AREQPRIO_BMSK)),
++		M_WR_CMD_OVERRIDE_ADDR(baddr, index));
++	/* Ensure the priority register writes go through */
++	wmb();
++}
++
++static void msm_bus_bimc_set_qos_mode(void __iomem *base,
++	uint32_t mas_index, uint8_t qmode_sel)
++{
++	uint32_t reg_val, val;
++
++	switch (qmode_sel) {
++	case BIMC_QOS_MODE_FIXED:
++		reg_val = readl_relaxed(M_BKE_EN_ADDR(base,
++			mas_index));
++		writel_relaxed((reg_val & (~M_BKE_EN_EN_BMSK)),
++			M_BKE_EN_ADDR(base, mas_index));
++		/* Ensure that the book-keeping register writes
++		 * go through before setting QoS mode.
++		 * QoS mode registers might write beyond 1K
++		 * boundary in future
++		 */
++		wmb();
++		set_qos_mode(base, mas_index, 1, 1, 1);
++		break;
++
++	case BIMC_QOS_MODE_BYPASS:
++		reg_val = readl_relaxed(M_BKE_EN_ADDR(base,
++			mas_index));
++		writel_relaxed((reg_val & (~M_BKE_EN_EN_BMSK)),
++			M_BKE_EN_ADDR(base, mas_index));
++		/* Ensure that the book-keeping register writes
++		 * go through before setting QoS mode.
++		 * QoS mode registers might write beyond 1K
++		 * boundary in future
++		 */
++		wmb();
++		set_qos_mode(base, mas_index, 0, 0, 0);
++		break;
++
++	case BIMC_QOS_MODE_REGULATOR:
++	case BIMC_QOS_MODE_LIMITER:
++		set_qos_mode(base, mas_index, 0, 0, 0);
++		reg_val = readl_relaxed(M_BKE_EN_ADDR(base,
++			mas_index));
++		val = 1 << M_BKE_EN_EN_SHFT;
++		/* Ensure that the book-keeping register writes
++		 * go through before setting QoS mode.
++		 * QoS mode registers might write beyond 1K
++		 * boundary in future
++		 */
++		wmb();
++		writel_relaxed(((reg_val & (~M_BKE_EN_EN_BMSK)) | (val &
++			M_BKE_EN_EN_BMSK)), M_BKE_EN_ADDR(base,
++			mas_index));
++		break;
++	default:
++		break;
++	}
++}
++
++static void set_qos_prio_rl(void __iomem *addr, uint32_t rmsk,
++	uint8_t index, struct msm_bus_bimc_qos_mode *qmode)
++{
++	uint32_t reg_val, val0, val;
++
++	/* Note, addr is already passed with right mas_index */
++	reg_val = readl_relaxed(addr) & rmsk;
++	val0 = BKE_HEALTH_VAL(qmode->rl.qhealth[index].limit_commands,
++		qmode->rl.qhealth[index].areq_prio,
++		qmode->rl.qhealth[index].prio_level);
++	val = ((reg_val & (~(BKE_HEALTH_MASK))) | (val0 & BKE_HEALTH_MASK));
++	writel_relaxed(val, addr);
++	/* Ensure that priority for regulator/limiter modes are
++	 * set before returning
++	 */
++	wmb();
++
++}
++
++static void msm_bus_bimc_set_qos_prio(void __iomem *base,
++	uint32_t mas_index, uint8_t qmode_sel,
++	struct msm_bus_bimc_qos_mode *qmode)
++{
++	uint32_t reg_val, val;
++
++	switch (qmode_sel) {
++	case BIMC_QOS_MODE_FIXED:
++		reg_val = readl_relaxed(M_PRIOLVL_OVERRIDE_ADDR(
++			base, mas_index)) & M_PRIOLVL_OVERRIDE_RMSK;
++		val =  qmode->fixed.prio_level <<
++			M_PRIOLVL_OVERRIDE_SHFT;
++		writel_relaxed(((reg_val &
++			~(M_PRIOLVL_OVERRIDE_BMSK)) | (val
++			& M_PRIOLVL_OVERRIDE_BMSK)),
++			M_PRIOLVL_OVERRIDE_ADDR(base, mas_index));
++
++		reg_val = readl_relaxed(M_RD_CMD_OVERRIDE_ADDR(
++			base, mas_index)) & M_RD_CMD_OVERRIDE_RMSK;
++		val =  qmode->fixed.areq_prio_rd <<
++			M_RD_CMD_OVERRIDE_AREQPRIO_SHFT;
++		writel_relaxed(((reg_val & ~(M_RD_CMD_OVERRIDE_AREQPRIO_BMSK))
++			| (val & M_RD_CMD_OVERRIDE_AREQPRIO_BMSK)),
++			M_RD_CMD_OVERRIDE_ADDR(base, mas_index));
++
++		reg_val = readl_relaxed(M_WR_CMD_OVERRIDE_ADDR(
++			base, mas_index)) & M_WR_CMD_OVERRIDE_RMSK;
++		val =  qmode->fixed.areq_prio_wr <<
++			M_WR_CMD_OVERRIDE_AREQPRIO_SHFT;
++		writel_relaxed(((reg_val & ~(M_WR_CMD_OVERRIDE_AREQPRIO_BMSK))
++			| (val & M_WR_CMD_OVERRIDE_AREQPRIO_BMSK)),
++			M_WR_CMD_OVERRIDE_ADDR(base, mas_index));
++		/* Ensure that fixed mode register writes go through
++		 * before returning
++		 */
++		wmb();
++		break;
++
++	case BIMC_QOS_MODE_REGULATOR:
++	case BIMC_QOS_MODE_LIMITER:
++		set_qos_prio_rl(M_BKE_HEALTH_3_CONFIG_ADDR(base,
++			mas_index), M_BKE_HEALTH_3_CONFIG_RMSK, 3, qmode);
++		set_qos_prio_rl(M_BKE_HEALTH_2_CONFIG_ADDR(base,
++			mas_index), M_BKE_HEALTH_2_CONFIG_RMSK, 2, qmode);
++		set_qos_prio_rl(M_BKE_HEALTH_1_CONFIG_ADDR(base,
++			mas_index), M_BKE_HEALTH_1_CONFIG_RMSK, 1, qmode);
++		set_qos_prio_rl(M_BKE_HEALTH_0_CONFIG_ADDR(base,
++			mas_index), M_BKE_HEALTH_0_CONFIG_RMSK, 0 , qmode);
++		break;
++	case BIMC_QOS_MODE_BYPASS:
++	default:
++		break;
++	}
++}
++
++static void set_qos_bw_regs(void __iomem *baddr, uint32_t mas_index,
++	int32_t th, int32_t tm, int32_t tl, uint32_t gp,
++	uint32_t gc)
++{
++	int32_t reg_val, val;
++	int32_t bke_reg_val;
++	int16_t val2;
++
++	/* Disable BKE before writing to registers as per spec */
++	bke_reg_val = readl_relaxed(M_BKE_EN_ADDR(baddr, mas_index));
++	writel_relaxed((bke_reg_val & ~(M_BKE_EN_EN_BMSK)),
++		M_BKE_EN_ADDR(baddr, mas_index));
++
++	/* Write values of registers calculated */
++	reg_val = readl_relaxed(M_BKE_GP_ADDR(baddr, mas_index))
++		& M_BKE_GP_RMSK;
++	val =  gp << M_BKE_GP_GP_SHFT;
++	writel_relaxed(((reg_val & ~(M_BKE_GP_GP_BMSK)) | (val &
++		M_BKE_GP_GP_BMSK)), M_BKE_GP_ADDR(baddr, mas_index));
++
++	reg_val = readl_relaxed(M_BKE_GC_ADDR(baddr, mas_index)) &
++		M_BKE_GC_RMSK;
++	val =  gc << M_BKE_GC_GC_SHFT;
++	writel_relaxed(((reg_val & ~(M_BKE_GC_GC_BMSK)) | (val &
++		M_BKE_GC_GC_BMSK)), M_BKE_GC_ADDR(baddr, mas_index));
++
++	reg_val = readl_relaxed(M_BKE_THH_ADDR(baddr, mas_index)) &
++		M_BKE_THH_RMSK;
++	val =  th << M_BKE_THH_THRESH_SHFT;
++	writel_relaxed(((reg_val & ~(M_BKE_THH_THRESH_BMSK)) | (val &
++		M_BKE_THH_THRESH_BMSK)), M_BKE_THH_ADDR(baddr, mas_index));
++
++	reg_val = readl_relaxed(M_BKE_THM_ADDR(baddr, mas_index)) &
++		M_BKE_THM_RMSK;
++	val2 =	tm << M_BKE_THM_THRESH_SHFT;
++	writel_relaxed(((reg_val & ~(M_BKE_THM_THRESH_BMSK)) | (val2 &
++		M_BKE_THM_THRESH_BMSK)), M_BKE_THM_ADDR(baddr, mas_index));
++
++	reg_val = readl_relaxed(M_BKE_THL_ADDR(baddr, mas_index)) &
++		M_BKE_THL_RMSK;
++	val2 =	tl << M_BKE_THL_THRESH_SHFT;
++	writel_relaxed(((reg_val & ~(M_BKE_THL_THRESH_BMSK)) |
++		(val2 & M_BKE_THL_THRESH_BMSK)), M_BKE_THL_ADDR(baddr,
++		mas_index));
++
++	/* Ensure that all bandwidth register writes have completed
++	 * before returning
++	 */
++	wmb();
++}
++
++static void msm_bus_bimc_set_qos_bw(void __iomem *base, uint32_t qos_freq,
++	uint32_t mas_index, struct msm_bus_bimc_qos_bw *qbw)
++{
++	uint32_t bke_en;
++
++	/* Validate QOS Frequency */
++	if (qos_freq == 0) {
++		MSM_BUS_DBG("Zero frequency\n");
++		return;
++	}
++
++	/* Get enable bit for BKE before programming the period */
++	bke_en = (readl_relaxed(M_BKE_EN_ADDR(base, mas_index)) &
++		M_BKE_EN_EN_BMSK) >> M_BKE_EN_EN_SHFT;
++
++	/* Only calculate if there's a requested bandwidth and window */
++	if (qbw->bw && qbw->ws) {
++		int64_t th, tm, tl;
++		uint32_t gp, gc;
++		int64_t gp_nominal, gp_required, gp_calc, data, temp;
++		int64_t win = qbw->ws * qos_freq;
++		temp = win;
++		/*
++		 * Calculate nominal grant period defined by requested
++		 * window size.
++		 * Ceil this value to max grant period.
++		 */
++		bimc_div(&temp, 1000000);
++		gp_nominal = min_t(uint64_t, MAX_GRANT_PERIOD, temp);
++		/*
++		 * Calculate max window size, defined by bw request.
++		 * Units: (KHz, MB/s)
++		 */
++		gp_calc = MAX_GC * qos_freq * 1000;
++		gp_required = gp_calc;
++		bimc_div(&gp_required, qbw->bw);
++
++		/* User min of two grant periods */
++		gp = min_t(int64_t, gp_nominal, gp_required);
++
++		/* Calculate bandwith in grants and ceil. */
++		temp = qbw->bw * gp;
++		data = qos_freq * 1000;
++		bimc_div(&temp, data);
++		gc = min_t(int64_t, MAX_GC, temp);
++
++		/* Calculate thresholds */
++		th = qbw->bw - qbw->thh;
++		tm = qbw->bw - qbw->thm;
++		tl = qbw->bw - qbw->thl;
++
++		th = th * gp;
++		bimc_div(&th, data);
++		tm = tm * gp;
++		bimc_div(&tm, data);
++		tl = tl * gp;
++		bimc_div(&tl, data);
++
++		MSM_BUS_DBG("BIMC: BW: mas_index: %d, th: %llu tm: %llu\n",
++			mas_index, th, tm);
++		MSM_BUS_DBG("BIMC: tl: %llu gp:%u gc: %u bke_en: %u\n",
++			tl, gp, gc, bke_en);
++		set_qos_bw_regs(base, mas_index, th, tm, tl, gp, gc);
++	} else
++		/* Clear bandwidth registers */
++		set_qos_bw_regs(base, mas_index, 0, 0, 0, 0, 0);
++}
++
++static int msm_bus_bimc_allocate_commit_data(struct msm_bus_fabric_registration
++	*fab_pdata, void **cdata, int ctx)
++{
++	struct msm_bus_bimc_commit **cd = (struct msm_bus_bimc_commit **)cdata;
++	struct msm_bus_bimc_info *binfo =
++		(struct msm_bus_bimc_info *)fab_pdata->hw_data;
++
++	MSM_BUS_DBG("Allocating BIMC commit data\n");
++	*cd = kzalloc(sizeof(struct msm_bus_bimc_commit), GFP_KERNEL);
++	if (!*cd) {
++		MSM_BUS_DBG("Couldn't alloc mem for cdata\n");
++		return -ENOMEM;
++	}
++
++	(*cd)->mas = binfo->cdata[ctx].mas;
++	(*cd)->slv = binfo->cdata[ctx].slv;
++
++	return 0;
++}
++
++static void *msm_bus_bimc_allocate_bimc_data(struct platform_device *pdev,
++	struct msm_bus_fabric_registration *fab_pdata)
++{
++	struct resource *bimc_mem;
++	struct resource *bimc_io;
++	struct msm_bus_bimc_info *binfo;
++	int i;
++
++	MSM_BUS_DBG("Allocating BIMC data\n");
++	binfo = kzalloc(sizeof(struct msm_bus_bimc_info), GFP_KERNEL);
++	if (!binfo) {
++		WARN(!binfo, "Couldn't alloc mem for bimc_info\n");
++		return NULL;
++	}
++
++	binfo->qos_freq = fab_pdata->qos_freq;
++
++	binfo->params.nmasters = fab_pdata->nmasters;
++	binfo->params.nslaves = fab_pdata->nslaves;
++	binfo->params.bus_id = fab_pdata->id;
++
++	for (i = 0; i < NUM_CTX; i++) {
++		binfo->cdata[i].mas = kzalloc(sizeof(struct
++			msm_bus_node_hw_info) * fab_pdata->nmasters * 2,
++			GFP_KERNEL);
++		if (!binfo->cdata[i].mas) {
++			MSM_BUS_ERR("Couldn't alloc mem for bimc master hw\n");
++			kfree(binfo);
++			return NULL;
++		}
++
++		binfo->cdata[i].slv = kzalloc(sizeof(struct
++			msm_bus_node_hw_info) * fab_pdata->nslaves * 2,
++			GFP_KERNEL);
++		if (!binfo->cdata[i].slv) {
++			MSM_BUS_DBG("Couldn't alloc mem for bimc slave hw\n");
++			kfree(binfo->cdata[i].mas);
++			kfree(binfo);
++			return NULL;
++		}
++	}
++
++	if (fab_pdata->virt) {
++		MSM_BUS_DBG("Don't get memory regions for virtual fabric\n");
++		goto skip_mem;
++	}
++
++	bimc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!bimc_mem) {
++		MSM_BUS_ERR("Cannot get BIMC Base address\n");
++		kfree(binfo);
++		return NULL;
++	}
++
++	bimc_io = request_mem_region(bimc_mem->start,
++			resource_size(bimc_mem), pdev->name);
++	if (!bimc_io) {
++		MSM_BUS_ERR("BIMC memory unavailable\n");
++		kfree(binfo);
++		return NULL;
++	}
++
++	binfo->base = ioremap(bimc_mem->start, resource_size(bimc_mem));
++	if (!binfo->base) {
++		MSM_BUS_ERR("IOremap failed for BIMC!\n");
++		release_mem_region(bimc_mem->start, resource_size(bimc_mem));
++		kfree(binfo);
++		return NULL;
++	}
++
++skip_mem:
++	fab_pdata->hw_data = (void *)binfo;
++	return (void *)binfo;
++}
++
++static void free_commit_data(void *cdata)
++{
++	struct msm_bus_bimc_commit *cd = (struct msm_bus_bimc_commit *)cdata;
++
++	kfree(cd->mas);
++	kfree(cd->slv);
++	kfree(cd);
++}
++
++static void bke_switch(
++	void __iomem *baddr, uint32_t mas_index, bool req, int mode)
++{
++	uint32_t reg_val, val, cur_val;
++
++	val = req << M_BKE_EN_EN_SHFT;
++	reg_val = readl_relaxed(M_BKE_EN_ADDR(baddr, mas_index));
++	cur_val = reg_val & M_BKE_EN_RMSK;
++	if (val == cur_val)
++		return;
++
++	if (!req && mode == BIMC_QOS_MODE_FIXED)
++		set_qos_mode(baddr, mas_index, 1, 1, 1);
++
++	writel_relaxed(((reg_val & ~(M_BKE_EN_EN_BMSK)) | (val &
++		M_BKE_EN_EN_BMSK)), M_BKE_EN_ADDR(baddr, mas_index));
++	/* Make sure BKE on/off goes through before changing priorities */
++	wmb();
++
++	if (req)
++		set_qos_mode(baddr, mas_index, 0, 0, 0);
++}
++
++static void bimc_set_static_qos_bw(void __iomem *base, unsigned int qos_freq,
++	int mport, struct msm_bus_bimc_qos_bw *qbw)
++{
++	int32_t bw_mbps, thh = 0, thm, thl, gc;
++	int32_t gp;
++	u64 temp;
++
++	if (qos_freq == 0) {
++		MSM_BUS_DBG("No QoS Frequency.\n");
++		return;
++	}
++
++	if (!(qbw->bw && qbw->gp)) {
++		MSM_BUS_DBG("No QoS Bandwidth or Window size\n");
++		return;
++	}
++
++	/* Convert bandwidth to MBPS */
++	temp = qbw->bw;
++	bimc_div(&temp, 1000000);
++	bw_mbps = temp;
++
++	/* Grant period in clock cycles
++	 * Grant period from bandwidth structure
++	 * is in nano seconds, QoS freq is in KHz.
++	 * Divide by 1000 to get clock cycles.
++	 */
++	gp = (qos_freq * qbw->gp) / (1000 * NSEC_PER_USEC);
++
++	/* Grant count = BW in MBps * Grant period
++	 * in micro seconds
++	 */
++	gc = bw_mbps * (qbw->gp / NSEC_PER_USEC);
++	gc = min(gc, MAX_GC);
++
++	/* Medium threshold = -((Medium Threshold percentage *
++	 * Grant count) / 100)
++	 */
++	thm = -((qbw->thmp * gc) / 100);
++	qbw->thm = thm;
++
++	/* Low threshold = -(Grant count) */
++	thl = -gc;
++	qbw->thl = thl;
++
++	MSM_BUS_DBG("%s: BKE parameters: gp %d, gc %d, thm %d thl %d thh %d",
++			__func__, gp, gc, thm, thl, thh);
++
++	trace_bus_bke_params(gc, gp, thl, thm, thl);
++	set_qos_bw_regs(base, mport, thh, thm, thl, gp, gc);
++}
++
++static void msm_bus_bimc_config_master(
++	struct msm_bus_fabric_registration *fab_pdata,
++	struct msm_bus_inode_info *info,
++	uint64_t req_clk, uint64_t req_bw)
++{
++	int mode, i, ports;
++	struct msm_bus_bimc_info *binfo;
++	uint64_t bw = 0;
++
++	binfo = (struct msm_bus_bimc_info *)fab_pdata->hw_data;
++	ports = info->node_info->num_mports;
++
++	/**
++	 * Here check the details of dual configuration.
++	 * Take actions based on different modes.
++	 * Check for threshold if limiter mode, etc.
++	*/
++
++	if (req_clk <= info->node_info->th[0]) {
++		mode = info->node_info->mode;
++		bw = info->node_info->bimc_bw[0];
++	} else if ((info->node_info->num_thresh > 1) &&
++			(req_clk <= info->node_info->th[1])) {
++		mode = info->node_info->mode;
++		bw = info->node_info->bimc_bw[1];
++	} else
++		mode = info->node_info->mode_thresh;
++
++	switch (mode) {
++	case BIMC_QOS_MODE_BYPASS:
++	case BIMC_QOS_MODE_FIXED:
++		for (i = 0; i < ports; i++)
++			bke_switch(binfo->base, info->node_info->qport[i],
++				BKE_OFF, mode);
++		break;
++	case BIMC_QOS_MODE_REGULATOR:
++	case BIMC_QOS_MODE_LIMITER:
++		for (i = 0; i < ports; i++) {
++			/* If not in fixed mode, update bandwidth */
++			if ((info->node_info->cur_lim_bw != bw)
++					&& (mode != BIMC_QOS_MODE_FIXED)) {
++				struct msm_bus_bimc_qos_bw qbw;
++				qbw.ws = info->node_info->ws;
++				qbw.bw = bw;
++				qbw.gp = info->node_info->bimc_gp;
++				qbw.thmp = info->node_info->bimc_thmp;
++				bimc_set_static_qos_bw(binfo->base,
++					binfo->qos_freq,
++					info->node_info->qport[i], &qbw);
++				info->node_info->cur_lim_bw = bw;
++				MSM_BUS_DBG("%s: Qos is %d reqclk %llu bw %llu",
++						__func__, mode, req_clk, bw);
++			}
++			bke_switch(binfo->base, info->node_info->qport[i],
++				BKE_ON, mode);
++		}
++		break;
++	default:
++		break;
++	}
++}
++
++static void msm_bus_bimc_update_bw(struct msm_bus_inode_info *hop,
++	struct msm_bus_inode_info *info,
++	struct msm_bus_fabric_registration *fab_pdata,
++	void *sel_cdata, int *master_tiers,
++	int64_t add_bw)
++{
++	struct msm_bus_bimc_info *binfo;
++	struct msm_bus_bimc_qos_bw qbw;
++	int i;
++	int64_t bw;
++	int ports = info->node_info->num_mports;
++	struct msm_bus_bimc_commit *sel_cd =
++		(struct msm_bus_bimc_commit *)sel_cdata;
++
++	MSM_BUS_DBG("BIMC: Update bw for ID %d, with IID: %d: %lld\n",
++		info->node_info->id, info->node_info->priv_id, add_bw);
++
++	binfo = (struct msm_bus_bimc_info *)fab_pdata->hw_data;
++
++	if (info->node_info->num_mports == 0) {
++		MSM_BUS_DBG("BIMC: Skip Master BW\n");
++		goto skip_mas_bw;
++	}
++
++	ports = info->node_info->num_mports;
++	bw = INTERLEAVED_BW(fab_pdata, add_bw, ports);
++
++	for (i = 0; i < ports; i++) {
++		sel_cd->mas[info->node_info->masterp[i]].bw += bw;
++		sel_cd->mas[info->node_info->masterp[i]].hw_id =
++			info->node_info->mas_hw_id;
++		MSM_BUS_DBG("BIMC: Update mas_bw for ID: %d -> %llu\n",
++			info->node_info->priv_id,
++			sel_cd->mas[info->node_info->masterp[i]].bw);
++		if (info->node_info->hw_sel == MSM_BUS_RPM)
++			sel_cd->mas[info->node_info->masterp[i]].dirty = 1;
++		else {
++			if (!info->node_info->qport) {
++				MSM_BUS_DBG("No qos ports to update!\n");
++				break;
++			}
++			if (!(info->node_info->mode == BIMC_QOS_MODE_REGULATOR)
++					|| (info->node_info->mode ==
++						BIMC_QOS_MODE_LIMITER)) {
++				MSM_BUS_DBG("Skip QoS reg programming\n");
++				break;
++			}
++
++			MSM_BUS_DBG("qport: %d\n", info->node_info->qport[i]);
++			qbw.bw = sel_cd->mas[info->node_info->masterp[i]].bw;
++			qbw.ws = info->node_info->ws;
++			/* Threshold low = 90% of bw */
++			qbw.thl = div_s64((90 * bw), 100);
++			/* Threshold medium = bw */
++			qbw.thm = bw;
++			/* Threshold high = 10% more than bw */
++			qbw.thh = div_s64((110 * bw), 100);
++			/* Check if info is a shared master.
++			 * If it is, mark it dirty
++			 * If it isn't, then set QOS Bandwidth.
++			 * Also if dual-conf is set, don't program bw regs.
++			 **/
++			if (!info->node_info->dual_conf &&
++			((info->node_info->mode == BIMC_QOS_MODE_LIMITER) ||
++			(info->node_info->mode == BIMC_QOS_MODE_REGULATOR)))
++				msm_bus_bimc_set_qos_bw(binfo->base,
++					binfo->qos_freq,
++					info->node_info->qport[i], &qbw);
++		}
++	}
++
++skip_mas_bw:
++	ports = hop->node_info->num_sports;
++	MSM_BUS_DBG("BIMC: ID: %d, Sports: %d\n", hop->node_info->priv_id,
++		ports);
++
++	for (i = 0; i < ports; i++) {
++		sel_cd->slv[hop->node_info->slavep[i]].bw += add_bw;
++		sel_cd->slv[hop->node_info->slavep[i]].hw_id =
++			hop->node_info->slv_hw_id;
++		MSM_BUS_DBG("BIMC: Update slave_bw: ID: %d -> %llu\n",
++			hop->node_info->priv_id,
++			sel_cd->slv[hop->node_info->slavep[i]].bw);
++		MSM_BUS_DBG("BIMC: Update slave_bw: index: %d\n",
++			hop->node_info->slavep[i]);
++		/* Check if hop is a shared slave.
++		 * If it is, mark it dirty
++		 * If it isn't, then nothing to be done as the
++		 * slaves are in bypass mode.
++		 **/
++		if (hop->node_info->hw_sel == MSM_BUS_RPM) {
++			MSM_BUS_DBG("Slave dirty: %d, slavep: %d\n",
++				hop->node_info->priv_id,
++				hop->node_info->slavep[i]);
++			sel_cd->slv[hop->node_info->slavep[i]].dirty = 1;
++		}
++	}
++}
++
++static int msm_bus_bimc_commit(struct msm_bus_fabric_registration
++	*fab_pdata, void *hw_data, void **cdata)
++{
++	MSM_BUS_DBG("\nReached BIMC Commit\n");
++	msm_bus_remote_hw_commit(fab_pdata, hw_data, cdata);
++	return 0;
++}
++
++static void msm_bus_bimc_config_limiter(
++	struct msm_bus_fabric_registration *fab_pdata,
++	struct msm_bus_inode_info *info)
++{
++	struct msm_bus_bimc_info *binfo;
++	int mode, i, ports;
++
++	binfo = (struct msm_bus_bimc_info *)fab_pdata->hw_data;
++	ports = info->node_info->num_mports;
++
++	if (!info->node_info->qport) {
++		MSM_BUS_DBG("No QoS Ports to init\n");
++		return;
++	}
++
++	if (info->cur_lim_bw)
++		mode = BIMC_QOS_MODE_LIMITER;
++	else
++		mode = info->node_info->mode;
++
++	switch (mode) {
++	case BIMC_QOS_MODE_BYPASS:
++	case BIMC_QOS_MODE_FIXED:
++		for (i = 0; i < ports; i++)
++			bke_switch(binfo->base, info->node_info->qport[i],
++				BKE_OFF, mode);
++		break;
++	case BIMC_QOS_MODE_REGULATOR:
++	case BIMC_QOS_MODE_LIMITER:
++		if (info->cur_lim_bw != info->cur_prg_bw) {
++			MSM_BUS_DBG("Enabled BKE throttling node %d to %llu\n",
++				info->node_info->id, info->cur_lim_bw);
++			trace_bus_bimc_config_limiter(info->node_info->id,
++				info->cur_lim_bw);
++			for (i = 0; i < ports; i++) {
++				/* If not in fixed mode, update bandwidth */
++				struct msm_bus_bimc_qos_bw qbw;
++
++				qbw.ws = info->node_info->ws;
++				qbw.bw = info->cur_lim_bw;
++				qbw.gp = info->node_info->bimc_gp;
++				qbw.thmp = info->node_info->bimc_thmp;
++				bimc_set_static_qos_bw(binfo->base,
++					binfo->qos_freq,
++					info->node_info->qport[i], &qbw);
++				bke_switch(binfo->base,
++					info->node_info->qport[i],
++					BKE_ON, mode);
++				info->cur_prg_bw = qbw.bw;
++			}
++		}
++		break;
++	default:
++		break;
++	}
++}
++
++static void bimc_init_mas_reg(struct msm_bus_bimc_info *binfo,
++	struct msm_bus_inode_info *info,
++	struct msm_bus_bimc_qos_mode *qmode, int mode)
++{
++	int i;
++
++	switch (mode) {
++	case BIMC_QOS_MODE_FIXED:
++		qmode->fixed.prio_level = info->node_info->prio_lvl;
++		qmode->fixed.areq_prio_rd = info->node_info->prio_rd;
++		qmode->fixed.areq_prio_wr = info->node_info->prio_wr;
++		break;
++	case BIMC_QOS_MODE_LIMITER:
++		qmode->rl.qhealth[0].limit_commands = 1;
++		qmode->rl.qhealth[1].limit_commands = 0;
++		qmode->rl.qhealth[2].limit_commands = 0;
++		qmode->rl.qhealth[3].limit_commands = 0;
++		break;
++	default:
++		break;
++	}
++
++	if (!info->node_info->qport) {
++		MSM_BUS_DBG("No QoS Ports to init\n");
++		return;
++	}
++
++	for (i = 0; i < info->node_info->num_mports; i++) {
++		/* If not in bypass mode, update priority */
++		if (mode != BIMC_QOS_MODE_BYPASS) {
++			msm_bus_bimc_set_qos_prio(binfo->base,
++				info->node_info->
++				qport[i], mode, qmode);
++
++			/* If not in fixed mode, update bandwidth */
++			if (mode != BIMC_QOS_MODE_FIXED) {
++				struct msm_bus_bimc_qos_bw qbw;
++				qbw.ws = info->node_info->ws;
++				qbw.bw = info->node_info->bimc_bw[0];
++				qbw.gp = info->node_info->bimc_gp;
++				qbw.thmp = info->node_info->bimc_thmp;
++				bimc_set_static_qos_bw(binfo->base,
++					binfo->qos_freq,
++					info->node_info->qport[i], &qbw);
++			}
++		}
++
++		/* set mode */
++		msm_bus_bimc_set_qos_mode(binfo->base,
++					info->node_info->qport[i],
++					mode);
++	}
++}
++
++static void init_health_regs(struct msm_bus_bimc_info *binfo,
++				struct msm_bus_inode_info *info,
++				struct msm_bus_bimc_qos_mode *qmode,
++				int mode)
++{
++	int i;
++
++	if (mode == BIMC_QOS_MODE_LIMITER) {
++		qmode->rl.qhealth[0].limit_commands = 1;
++		qmode->rl.qhealth[1].limit_commands = 0;
++		qmode->rl.qhealth[2].limit_commands = 0;
++		qmode->rl.qhealth[3].limit_commands = 0;
++
++		if (!info->node_info->qport) {
++			MSM_BUS_DBG("No QoS Ports to init\n");
++			return;
++		}
++
++		for (i = 0; i < info->node_info->num_mports; i++) {
++			/* If not in bypass mode, update priority */
++			if (mode != BIMC_QOS_MODE_BYPASS)
++				msm_bus_bimc_set_qos_prio(binfo->base,
++				info->node_info->qport[i], mode, qmode);
++		}
++	}
++}
++
++
++static int msm_bus_bimc_mas_init(struct msm_bus_bimc_info *binfo,
++	struct msm_bus_inode_info *info)
++{
++	struct msm_bus_bimc_qos_mode *qmode;
++	qmode = kzalloc(sizeof(struct msm_bus_bimc_qos_mode),
++		GFP_KERNEL);
++	if (!qmode) {
++		MSM_BUS_WARN("Couldn't alloc prio data for node: %d\n",
++			info->node_info->id);
++		return -ENOMEM;
++	}
++
++	info->hw_data = (void *)qmode;
++
++	/**
++	 * If the master supports dual configuration,
++	 * configure registers for both modes
++	 */
++	if (info->node_info->dual_conf)
++		bimc_init_mas_reg(binfo, info, qmode,
++			info->node_info->mode_thresh);
++	else if (info->node_info->nr_lim)
++		init_health_regs(binfo, info, qmode, BIMC_QOS_MODE_LIMITER);
++
++	bimc_init_mas_reg(binfo, info, qmode, info->node_info->mode);
++	return 0;
++}
++
++static void msm_bus_bimc_node_init(void *hw_data,
++	struct msm_bus_inode_info *info)
++{
++	struct msm_bus_bimc_info *binfo =
++		(struct msm_bus_bimc_info *)hw_data;
++
++	if (!IS_SLAVE(info->node_info->priv_id) &&
++		(info->node_info->hw_sel != MSM_BUS_RPM))
++		msm_bus_bimc_mas_init(binfo, info);
++}
++
++static int msm_bus_bimc_port_halt(uint32_t haltid, uint8_t mport)
++{
++	return 0;
++}
++
++static int msm_bus_bimc_port_unhalt(uint32_t haltid, uint8_t mport)
++{
++	return 0;
++}
++
++static int msm_bus_bimc_limit_mport(struct msm_bus_node_device_type *info,
++				void __iomem *qos_base, uint32_t qos_off,
++				uint32_t qos_delta, uint32_t qos_freq,
++				bool enable_lim, u64 lim_bw)
++{
++	int mode;
++	int i;
++
++	if (ZERO_OR_NULL_PTR(info->node_info->qport)) {
++		MSM_BUS_DBG("No QoS Ports to limit\n");
++		return 0;
++	}
++
++	if (enable_lim && lim_bw) {
++		mode =  BIMC_QOS_MODE_LIMITER;
++
++		if (!info->node_info->lim_bw) {
++			struct msm_bus_bimc_qos_mode qmode;
++			qmode.rl.qhealth[0].limit_commands = 1;
++			qmode.rl.qhealth[1].limit_commands = 0;
++			qmode.rl.qhealth[2].limit_commands = 0;
++			qmode.rl.qhealth[3].limit_commands = 0;
++
++			for (i = 0; i < info->node_info->num_qports; i++) {
++				/* If not in bypass mode, update priority */
++				if (mode != BIMC_QOS_MODE_BYPASS)
++					msm_bus_bimc_set_qos_prio(qos_base,
++					info->node_info->qport[i], mode,
++					&qmode);
++			}
++		}
++
++		for (i = 0; i < info->node_info->num_qports; i++) {
++			struct msm_bus_bimc_qos_bw qbw;
++			/* If not in fixed mode, update bandwidth */
++			if ((info->node_info->lim_bw != lim_bw)) {
++				qbw.ws = info->node_info->qos_params.ws;
++				qbw.bw = lim_bw;
++				qbw.gp = info->node_info->qos_params.gp;
++				qbw.thmp = info->node_info->qos_params.thmp;
++				bimc_set_static_qos_bw(qos_base, qos_freq,
++					info->node_info->qport[i], &qbw);
++			}
++			bke_switch(qos_base, info->node_info->qport[i],
++				BKE_ON, mode);
++		}
++		info->node_info->lim_bw = lim_bw;
++	} else {
++		mode = info->node_info->qos_params.mode;
++		for (i = 0; i < info->node_info->num_qports; i++) {
++			bke_switch(qos_base, info->node_info->qport[i],
++				BKE_OFF, mode);
++		}
++	}
++	info->node_info->qos_params.cur_mode = mode;
++	return 0;
++}
++
++static bool msm_bus_bimc_update_bw_reg(int mode)
++{
++	bool ret = false;
++
++	if ((mode == BIMC_QOS_MODE_LIMITER)
++		|| (mode == BIMC_QOS_MODE_REGULATOR))
++		ret = true;
++
++	return ret;
++}
++
++static int msm_bus_bimc_qos_init(struct msm_bus_node_device_type *info,
++				void __iomem *qos_base,
++				uint32_t qos_off, uint32_t qos_delta,
++				uint32_t qos_freq)
++{
++	int i;
++	struct msm_bus_bimc_qos_mode qmode;
++
++	switch (info->node_info->qos_params.mode) {
++	case BIMC_QOS_MODE_FIXED:
++		qmode.fixed.prio_level = info->node_info->qos_params.prio_lvl;
++		qmode.fixed.areq_prio_rd = info->node_info->qos_params.prio_rd;
++		qmode.fixed.areq_prio_wr = info->node_info->qos_params.prio_wr;
++		break;
++	case BIMC_QOS_MODE_LIMITER:
++		qmode.rl.qhealth[0].limit_commands = 1;
++		qmode.rl.qhealth[1].limit_commands = 0;
++		qmode.rl.qhealth[2].limit_commands = 0;
++		qmode.rl.qhealth[3].limit_commands = 0;
++		break;
++	default:
++		break;
++	}
++
++	if (ZERO_OR_NULL_PTR(info->node_info->qport)) {
++		MSM_BUS_DBG("No QoS Ports to init\n");
++		return 0;
++	}
++
++	for (i = 0; i < info->node_info->num_qports; i++) {
++		/* If not in bypass mode, update priority */
++		if (info->node_info->qos_params.mode != BIMC_QOS_MODE_BYPASS)
++			msm_bus_bimc_set_qos_prio(qos_base, info->node_info->
++				qport[i], info->node_info->qos_params.mode,
++									&qmode);
++
++		/* set mode */
++		if (info->node_info->qos_params.mode == BIMC_QOS_MODE_LIMITER)
++			bke_switch(qos_base, info->node_info->qport[i],
++				BKE_OFF, BIMC_QOS_MODE_FIXED);
++		else
++		       msm_bus_bimc_set_qos_mode(qos_base,
++				info->node_info->qport[i],
++				info->node_info->qos_params.mode);
++	}
++
++	return 0;
++}
++
++static int msm_bus_bimc_set_bw(struct msm_bus_node_device_type *dev,
++				void __iomem *qos_base, uint32_t qos_off,
++				uint32_t qos_delta, uint32_t qos_freq)
++{
++	struct msm_bus_bimc_qos_bw qbw;
++	int i;
++	int64_t bw = 0;
++	int ret = 0;
++	struct msm_bus_node_info_type *info = dev->node_info;
++
++	if (info && info->num_qports &&
++		((info->qos_params.mode == BIMC_QOS_MODE_LIMITER) ||
++		(info->qos_params.mode == BIMC_QOS_MODE_REGULATOR))) {
++		bw = msm_bus_div64(info->num_qports,
++				dev->node_ab.ab[DUAL_CTX]);
++
++		for (i = 0; i < info->num_qports; i++) {
++			MSM_BUS_DBG("BIMC: Update mas_bw for ID: %d -> %llu\n",
++				info->id, bw);
++
++			if (!info->qport) {
++				MSM_BUS_DBG("No qos ports to update!\n");
++				break;
++			}
++
++			qbw.bw = bw + info->qos_params.bw_buffer;
++			trace_bus_bimc_config_limiter(info->id, bw);
++
++			/* Default to gp of 5us */
++			qbw.gp = (info->qos_params.gp ?
++					info->qos_params.gp : 5000);
++			/* Default to thmp of 50% */
++			qbw.thmp = (info->qos_params.thmp ?
++					info->qos_params.thmp : 50);
++			/*
++			 * If the BW vote is 0 then set the QoS mode to
++			 * Fixed.
++			 */
++			if (bw) {
++				bimc_set_static_qos_bw(qos_base, qos_freq,
++					info->qport[i], &qbw);
++				bke_switch(qos_base, info->qport[i],
++					BKE_ON, info->qos_params.mode);
++			} else {
++				bke_switch(qos_base, info->qport[i],
++					BKE_OFF, BIMC_QOS_MODE_FIXED);
++			}
++		}
++	}
++	return ret;
++}
++
++int msm_bus_bimc_hw_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo)
++{
++	/* Set interleaving to true by default */
++	MSM_BUS_DBG("\nInitializing BIMC...\n");
++	pdata->il_flag = true;
++	hw_algo->allocate_commit_data = msm_bus_bimc_allocate_commit_data;
++	hw_algo->allocate_hw_data = msm_bus_bimc_allocate_bimc_data;
++	hw_algo->node_init = msm_bus_bimc_node_init;
++	hw_algo->free_commit_data = free_commit_data;
++	hw_algo->update_bw = msm_bus_bimc_update_bw;
++	hw_algo->commit = msm_bus_bimc_commit;
++	hw_algo->port_halt = msm_bus_bimc_port_halt;
++	hw_algo->port_unhalt = msm_bus_bimc_port_unhalt;
++	hw_algo->config_master = msm_bus_bimc_config_master;
++	hw_algo->config_limiter = msm_bus_bimc_config_limiter;
++	hw_algo->update_bw_reg = msm_bus_bimc_update_bw_reg;
++	/* BIMC slaves are shared. Slave registers are set through RPM */
++	if (!pdata->ahb)
++		pdata->rpm_enabled = 1;
++	return 0;
++}
++
++int msm_bus_bimc_set_ops(struct msm_bus_node_device_type *bus_dev)
++{
++	if (!bus_dev)
++		return -ENODEV;
++	else {
++		bus_dev->fabdev->noc_ops.qos_init = msm_bus_bimc_qos_init;
++		bus_dev->fabdev->noc_ops.set_bw = msm_bus_bimc_set_bw;
++		bus_dev->fabdev->noc_ops.limit_mport = msm_bus_bimc_limit_mport;
++		bus_dev->fabdev->noc_ops.update_bw_reg =
++						msm_bus_bimc_update_bw_reg;
++	}
++	return 0;
++}
++EXPORT_SYMBOL(msm_bus_bimc_set_ops);
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_bimc.h
+@@ -0,0 +1,127 @@
++/* Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_BUS_BIMC_H
++#define _ARCH_ARM_MACH_MSM_BUS_BIMC_H
++
++struct msm_bus_bimc_params {
++	uint32_t bus_id;
++	uint32_t addr_width;
++	uint32_t data_width;
++	uint32_t nmasters;
++	uint32_t nslaves;
++};
++
++struct msm_bus_bimc_commit {
++	struct msm_bus_node_hw_info *mas;
++	struct msm_bus_node_hw_info *slv;
++};
++
++struct msm_bus_bimc_info {
++	void __iomem *base;
++	uint32_t base_addr;
++	uint32_t qos_freq;
++	struct msm_bus_bimc_params params;
++	struct msm_bus_bimc_commit cdata[NUM_CTX];
++};
++
++struct msm_bus_bimc_node {
++	uint32_t conn_mask;
++	uint32_t data_width;
++	uint8_t slv_arb_mode;
++};
++
++enum msm_bus_bimc_arb_mode {
++	BIMC_ARB_MODE_RR = 0,
++	BIMC_ARB_MODE_PRIORITY_RR,
++	BIMC_ARB_MODE_TIERED_RR,
++};
++
++
++enum msm_bus_bimc_interleave {
++	BIMC_INTERLEAVE_NONE = 0,
++	BIMC_INTERLEAVE_ODD,
++	BIMC_INTERLEAVE_EVEN,
++};
++
++struct msm_bus_bimc_slave_seg {
++	bool enable;
++	uint64_t start_addr;
++	uint64_t seg_size;
++	uint8_t interleave;
++};
++
++enum msm_bus_bimc_qos_mode_type {
++	BIMC_QOS_MODE_FIXED = 0,
++	BIMC_QOS_MODE_LIMITER,
++	BIMC_QOS_MODE_BYPASS,
++	BIMC_QOS_MODE_REGULATOR,
++};
++
++struct msm_bus_bimc_qos_health {
++	bool limit_commands;
++	uint32_t areq_prio;
++	uint32_t prio_level;
++};
++
++struct msm_bus_bimc_mode_fixed {
++	uint32_t prio_level;
++	uint32_t areq_prio_rd;
++	uint32_t areq_prio_wr;
++};
++
++struct msm_bus_bimc_mode_rl {
++	uint8_t qhealthnum;
++	struct msm_bus_bimc_qos_health qhealth[4];
++};
++
++struct msm_bus_bimc_qos_mode {
++	uint8_t mode;
++	struct msm_bus_bimc_mode_fixed fixed;
++	struct msm_bus_bimc_mode_rl rl;
++};
++
++struct msm_bus_bimc_qos_bw {
++	uint64_t bw;	/* bw is in Bytes/sec */
++	uint32_t ws;	/* Window size in nano seconds*/
++	int64_t thh;	/* Threshold high, bytes per second */
++	int64_t thm;	/* Threshold medium, bytes per second */
++	int64_t thl;	/* Threshold low, bytes per second */
++	u32 gp;	/* Grant Period in micro seconds */
++	u32 thmp; /* Threshold medium in percentage */
++};
++
++struct msm_bus_bimc_clk_gate {
++	bool core_clk_gate_en;
++	bool arb_clk_gate_en;	/* For arbiter */
++	bool port_clk_gate_en;	/* For regs on BIMC core clock */
++};
++
++void msm_bus_bimc_set_slave_seg(struct msm_bus_bimc_info *binfo,
++	uint32_t slv_index, uint32_t seg_index,
++	struct msm_bus_bimc_slave_seg *bsseg);
++void msm_bus_bimc_set_slave_clk_gate(struct msm_bus_bimc_info *binfo,
++	uint32_t slv_index, struct msm_bus_bimc_clk_gate *bgate);
++void msm_bus_bimc_set_mas_clk_gate(struct msm_bus_bimc_info *binfo,
++	uint32_t mas_index, struct msm_bus_bimc_clk_gate *bgate);
++void msm_bus_bimc_arb_en(struct msm_bus_bimc_info *binfo,
++	uint32_t slv_index, bool en);
++void msm_bus_bimc_get_params(struct msm_bus_bimc_info *binfo,
++	struct msm_bus_bimc_params *params);
++void msm_bus_bimc_get_mas_params(struct msm_bus_bimc_info *binfo,
++	uint32_t mas_index, struct msm_bus_bimc_node *mparams);
++void msm_bus_bimc_get_slv_params(struct msm_bus_bimc_info *binfo,
++	uint32_t slv_index, struct msm_bus_bimc_node *sparams);
++bool msm_bus_bimc_get_arb_en(struct msm_bus_bimc_info *binfo,
++	uint32_t slv_index);
++
++#endif /*_ARCH_ARM_MACH_MSM_BUS_BIMC_H*/
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_client_api.c
+@@ -0,0 +1,83 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "AXI: %s(): " fmt, __func__
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/mutex.h>
++#include <linux/radix-tree.h>
++#include <linux/clk.h>
++#include "msm-bus.h"
++#include "msm_bus_core.h"
++
++struct msm_bus_arb_ops arb_ops;
++
++/**
++ * msm_bus_scale_register_client() - Register the clients with the msm bus
++ * driver
++ * @pdata: Platform data of the client, containing src, dest, ab, ib.
++ * Return non-zero value in case of success, 0 in case of failure.
++ *
++ * Client data contains the vectors specifying arbitrated bandwidth (ab)
++ * and instantaneous bandwidth (ib) requested between a particular
++ * src and dest.
++ */
++uint32_t msm_bus_scale_register_client(struct msm_bus_scale_pdata *pdata)
++{
++	if (arb_ops.register_client)
++		return arb_ops.register_client(pdata);
++	else {
++		pr_err("%s: Bus driver not ready.",
++				__func__);
++		return 0;
++	}
++}
++EXPORT_SYMBOL(msm_bus_scale_register_client);
++
++/**
++ * msm_bus_scale_client_update_request() - Update the request for bandwidth
++ * from a particular client
++ *
++ * cl: Handle to the client
++ * index: Index into the vector, to which the bw and clock values need to be
++ * updated
++ */
++int msm_bus_scale_client_update_request(uint32_t cl, unsigned int index)
++{
++	if (arb_ops.update_request)
++		return arb_ops.update_request(cl, index);
++	else {
++		pr_err("%s: Bus driver not ready.",
++				__func__);
++		return -EPROBE_DEFER;
++	}
++}
++EXPORT_SYMBOL(msm_bus_scale_client_update_request);
++
++/**
++ * msm_bus_scale_unregister_client() - Unregister the client from the bus driver
++ * @cl: Handle to the client
++ */
++void msm_bus_scale_unregister_client(uint32_t cl)
++{
++	if (arb_ops.unregister_client)
++		arb_ops.unregister_client(cl);
++	else {
++		pr_err("%s: Bus driver not ready.",
++				__func__);
++	}
++}
++EXPORT_SYMBOL(msm_bus_scale_unregister_client);
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_core.c
+@@ -0,0 +1,125 @@
++/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "AXI: %s(): " fmt, __func__
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/mutex.h>
++#include <linux/radix-tree.h>
++#include <linux/clk.h>
++#include "msm-bus-board.h"
++#include "msm-bus.h"
++#include "msm_bus_core.h"
++
++static atomic_t num_fab = ATOMIC_INIT(0);
++
++int msm_bus_get_num_fab(void)
++{
++	return atomic_read(&num_fab);
++}
++
++int msm_bus_device_match(struct device *dev, void *id)
++{
++	struct msm_bus_fabric_device *fabdev = to_msm_bus_fabric_device(dev);
++
++	if (!fabdev) {
++		MSM_BUS_WARN("Fabric %p returning 0\n", fabdev);
++		return 0;
++	}
++	return fabdev->id == *(int *)id;
++}
++
++static void msm_bus_release(struct device *device)
++{
++}
++
++struct bus_type msm_bus_type = {
++	.name      = "msm-bus-type",
++};
++EXPORT_SYMBOL(msm_bus_type);
++
++/**
++ * msm_bus_get_fabric_device() - This function is used to search for
++ * the fabric device on the bus
++ * @fabid: Fabric id
++ * Function returns: Pointer to the fabric device
++ */
++struct msm_bus_fabric_device *msm_bus_get_fabric_device(int fabid)
++{
++	struct device *dev;
++	struct msm_bus_fabric_device *fabric;
++	dev = bus_find_device(&msm_bus_type, NULL, (void *)&fabid,
++		msm_bus_device_match);
++	if (!dev)
++		return NULL;
++	fabric = to_msm_bus_fabric_device(dev);
++	return fabric;
++}
++
++/**
++ * msm_bus_fabric_device_register() - Registers a fabric on msm bus
++ * @fabdev: Fabric device to be registered
++ */
++int msm_bus_fabric_device_register(struct msm_bus_fabric_device *fabdev)
++{
++	int ret = 0;
++	fabdev->dev.bus = &msm_bus_type;
++	fabdev->dev.release = msm_bus_release;
++	ret = dev_set_name(&fabdev->dev, fabdev->name);
++	if (ret) {
++		MSM_BUS_ERR("error setting dev name\n");
++		goto err;
++	}
++
++	ret = device_register(&fabdev->dev);
++	if (ret < 0) {
++		MSM_BUS_ERR("error registering device%d %s\n",
++				ret, fabdev->name);
++		goto err;
++	}
++	atomic_inc(&num_fab);
++err:
++	return ret;
++}
++
++/**
++ * msm_bus_fabric_device_unregister() - Unregisters the fabric
++ * devices from the msm bus
++ */
++void msm_bus_fabric_device_unregister(struct msm_bus_fabric_device *fabdev)
++{
++	device_unregister(&fabdev->dev);
++	atomic_dec(&num_fab);
++}
++
++static void __exit msm_bus_exit(void)
++{
++	bus_unregister(&msm_bus_type);
++}
++
++static int __init msm_bus_init(void)
++{
++	int retval = 0;
++	retval = bus_register(&msm_bus_type);
++	if (retval)
++		MSM_BUS_ERR("bus_register error! %d\n",
++			retval);
++	return retval;
++}
++postcore_initcall(msm_bus_init);
++module_exit(msm_bus_exit);
++MODULE_LICENSE("GPL v2");
++MODULE_VERSION("0.2");
++MODULE_ALIAS("platform:msm_bus");
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_core.h
+@@ -0,0 +1,375 @@
++/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_BUS_CORE_H
++#define _ARCH_ARM_MACH_MSM_BUS_CORE_H
++
++#include <linux/types.h>
++#include <linux/device.h>
++#include <linux/radix-tree.h>
++#include <linux/platform_device.h>
++#include "msm-bus-board.h"
++#include "msm-bus.h"
++
++#define MSM_BUS_DBG(msg, ...) \
++	pr_debug(msg, ## __VA_ARGS__)
++#define MSM_BUS_ERR(msg, ...) \
++	pr_err(msg, ## __VA_ARGS__)
++#define MSM_BUS_WARN(msg, ...) \
++	pr_warn(msg, ## __VA_ARGS__)
++#define MSM_FAB_ERR(msg, ...) \
++	dev_err(&fabric->fabdev.dev, msg, ## __VA_ARGS__)
++
++#define IS_MASTER_VALID(mas) \
++	(((mas >= MSM_BUS_MASTER_FIRST) && (mas <= MSM_BUS_MASTER_LAST)) \
++	 ? 1 : 0)
++#define IS_SLAVE_VALID(slv) \
++	(((slv >= MSM_BUS_SLAVE_FIRST) && (slv <= MSM_BUS_SLAVE_LAST)) ? 1 : 0)
++
++#define INTERLEAVED_BW(fab_pdata, bw, ports) \
++	((fab_pdata->il_flag) ? ((bw < 0) \
++	? -msm_bus_div64((ports), (-bw)) : msm_bus_div64((ports), (bw))) : (bw))
++#define INTERLEAVED_VAL(fab_pdata, n) \
++	((fab_pdata->il_flag) ? (n) : 1)
++#define KBTOB(a) (a * 1000ULL)
++
++enum msm_bus_dbg_op_type {
++	MSM_BUS_DBG_UNREGISTER = -2,
++	MSM_BUS_DBG_REGISTER,
++	MSM_BUS_DBG_OP = 1,
++};
++
++enum msm_bus_hw_sel {
++	MSM_BUS_RPM = 0,
++	MSM_BUS_NOC,
++	MSM_BUS_BIMC,
++};
++
++struct msm_bus_arb_ops {
++	uint32_t (*register_client)(struct msm_bus_scale_pdata *pdata);
++	int (*update_request)(uint32_t cl, unsigned int index);
++	void (*unregister_client)(uint32_t cl);
++};
++
++enum {
++	SLAVE_NODE,
++	MASTER_NODE,
++	CLK_NODE,
++	NR_LIM_NODE,
++};
++
++
++extern struct bus_type msm_bus_type;
++extern struct msm_bus_arb_ops arb_ops;
++extern void msm_bus_arb_setops_legacy(struct msm_bus_arb_ops *arb_ops);
++
++struct msm_bus_node_info {
++	unsigned int id;
++	unsigned int priv_id;
++	unsigned int mas_hw_id;
++	unsigned int slv_hw_id;
++	int gateway;
++	int *masterp;
++	int *qport;
++	int num_mports;
++	int *slavep;
++	int num_sports;
++	int *tier;
++	int num_tiers;
++	int ahb;
++	int hw_sel;
++	const char *slaveclk[NUM_CTX];
++	const char *memclk[NUM_CTX];
++	const char *iface_clk_node;
++	unsigned int buswidth;
++	unsigned int ws;
++	unsigned int mode;
++	unsigned int perm_mode;
++	unsigned int prio_lvl;
++	unsigned int prio_rd;
++	unsigned int prio_wr;
++	unsigned int prio1;
++	unsigned int prio0;
++	unsigned int num_thresh;
++	u64 *th;
++	u64 cur_lim_bw;
++	unsigned int mode_thresh;
++	bool dual_conf;
++	u64 *bimc_bw;
++	bool nr_lim;
++	u32 ff;
++	bool rt_mas;
++	u32 bimc_gp;
++	u32 bimc_thmp;
++	u64 floor_bw;
++	const char *name;
++};
++
++struct path_node {
++	uint64_t clk[NUM_CTX];
++	uint64_t bw[NUM_CTX];
++	uint64_t *sel_clk;
++	uint64_t *sel_bw;
++	int next;
++};
++
++struct msm_bus_link_info {
++	uint64_t clk[NUM_CTX];
++	uint64_t *sel_clk;
++	uint64_t memclk;
++	int64_t bw[NUM_CTX];
++	int64_t *sel_bw;
++	int *tier;
++	int num_tiers;
++};
++
++struct nodeclk {
++	struct clk *clk;
++	uint64_t rate;
++	bool dirty;
++	bool enable;
++};
++
++struct msm_bus_inode_info {
++	struct msm_bus_node_info *node_info;
++	uint64_t max_bw;
++	uint64_t max_clk;
++	uint64_t cur_lim_bw;
++	uint64_t cur_prg_bw;
++	struct msm_bus_link_info link_info;
++	int num_pnodes;
++	struct path_node *pnode;
++	int commit_index;
++	struct nodeclk nodeclk[NUM_CTX];
++	struct nodeclk memclk[NUM_CTX];
++	struct nodeclk iface_clk;
++	void *hw_data;
++};
++
++struct msm_bus_node_hw_info {
++	bool dirty;
++	unsigned int hw_id;
++	uint64_t bw;
++};
++
++struct msm_bus_hw_algorithm {
++	int (*allocate_commit_data)(struct msm_bus_fabric_registration
++		*fab_pdata, void **cdata, int ctx);
++	void *(*allocate_hw_data)(struct platform_device *pdev,
++		struct msm_bus_fabric_registration *fab_pdata);
++	void (*node_init)(void *hw_data, struct msm_bus_inode_info *info);
++	void (*free_commit_data)(void *cdata);
++	void (*update_bw)(struct msm_bus_inode_info *hop,
++		struct msm_bus_inode_info *info,
++		struct msm_bus_fabric_registration *fab_pdata,
++		void *sel_cdata, int *master_tiers,
++		int64_t add_bw);
++	void (*fill_cdata_buffer)(int *curr, char *buf, const int max_size,
++		void *cdata, int nmasters, int nslaves, int ntslaves);
++	int (*commit)(struct msm_bus_fabric_registration
++		*fab_pdata, void *hw_data, void **cdata);
++	int (*port_unhalt)(uint32_t haltid, uint8_t mport);
++	int (*port_halt)(uint32_t haltid, uint8_t mport);
++	void (*config_master)(struct msm_bus_fabric_registration *fab_pdata,
++		struct msm_bus_inode_info *info,
++		uint64_t req_clk, uint64_t req_bw);
++	void (*config_limiter)(struct msm_bus_fabric_registration *fab_pdata,
++		struct msm_bus_inode_info *info);
++	bool (*update_bw_reg)(int mode);
++};
++
++struct msm_bus_fabric_device {
++	int id;
++	const char *name;
++	struct device dev;
++	const struct msm_bus_fab_algorithm *algo;
++	const struct msm_bus_board_algorithm *board_algo;
++	struct msm_bus_hw_algorithm hw_algo;
++	int visited;
++	int num_nr_lim;
++	u64 nr_lim_thresh;
++	u32 eff_fact;
++};
++#define to_msm_bus_fabric_device(d) container_of(d, \
++		struct msm_bus_fabric_device, d)
++
++struct msm_bus_fabric {
++	struct msm_bus_fabric_device fabdev;
++	int ahb;
++	void *cdata[NUM_CTX];
++	bool arb_dirty;
++	bool clk_dirty;
++	struct radix_tree_root fab_tree;
++	int num_nodes;
++	struct list_head gateways;
++	struct msm_bus_inode_info info;
++	struct msm_bus_fabric_registration *pdata;
++	void *hw_data;
++};
++#define to_msm_bus_fabric(d) container_of(d, \
++	struct msm_bus_fabric, d)
++
++
++struct msm_bus_fab_algorithm {
++	int (*update_clks)(struct msm_bus_fabric_device *fabdev,
++		struct msm_bus_inode_info *pme, int index,
++		uint64_t curr_clk, uint64_t req_clk,
++		uint64_t bwsum, int flag, int ctx,
++		unsigned int cl_active_flag);
++	int (*port_halt)(struct msm_bus_fabric_device *fabdev, int portid);
++	int (*port_unhalt)(struct msm_bus_fabric_device *fabdev, int portid);
++	int (*commit)(struct msm_bus_fabric_device *fabdev);
++	struct msm_bus_inode_info *(*find_node)(struct msm_bus_fabric_device
++		*fabdev, int id);
++	struct msm_bus_inode_info *(*find_gw_node)(struct msm_bus_fabric_device
++		*fabdev, int id);
++	struct list_head *(*get_gw_list)(struct msm_bus_fabric_device *fabdev);
++	void (*update_bw)(struct msm_bus_fabric_device *fabdev, struct
++		msm_bus_inode_info * hop, struct msm_bus_inode_info *info,
++		int64_t add_bw, int *master_tiers, int ctx);
++	void (*config_master)(struct msm_bus_fabric_device *fabdev,
++		struct msm_bus_inode_info *info, uint64_t req_clk,
++		uint64_t req_bw);
++	void (*config_limiter)(struct msm_bus_fabric_device *fabdev,
++		struct msm_bus_inode_info *info);
++};
++
++struct msm_bus_board_algorithm {
++	int board_nfab;
++	void (*assign_iids)(struct msm_bus_fabric_registration *fabreg,
++		int fabid);
++	int (*get_iid)(int id);
++};
++
++/**
++ * Used to store the list of fabrics and other info to be
++ * maintained outside the fabric structure.
++ * Used while calculating path, and to find fabric ptrs
++ */
++struct msm_bus_fabnodeinfo {
++	struct list_head list;
++	struct msm_bus_inode_info *info;
++};
++
++struct msm_bus_client {
++	int id;
++	struct msm_bus_scale_pdata *pdata;
++	int *src_pnode;
++	int curr;
++};
++
++uint64_t msm_bus_div64(unsigned int width, uint64_t bw);
++int msm_bus_fabric_device_register(struct msm_bus_fabric_device *fabric);
++void msm_bus_fabric_device_unregister(struct msm_bus_fabric_device *fabric);
++struct msm_bus_fabric_device *msm_bus_get_fabric_device(int fabid);
++int msm_bus_get_num_fab(void);
++
++
++int msm_bus_hw_fab_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo);
++void msm_bus_board_init(struct msm_bus_fabric_registration *pdata);
++void msm_bus_board_set_nfab(struct msm_bus_fabric_registration *pdata,
++	int nfab);
++#if defined(CONFIG_MSM_RPM_SMD)
++int msm_bus_rpm_hw_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo);
++int msm_bus_remote_hw_commit(struct msm_bus_fabric_registration
++	*fab_pdata, void *hw_data, void **cdata);
++void msm_bus_rpm_fill_cdata_buffer(int *curr, char *buf, const int max_size,
++	void *cdata, int nmasters, int nslaves, int ntslaves);
++#else
++static inline int msm_bus_rpm_hw_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo)
++{
++	return 0;
++}
++static inline int msm_bus_remote_hw_commit(struct msm_bus_fabric_registration
++	*fab_pdata, void *hw_data, void **cdata)
++{
++	return 0;
++}
++static inline void msm_bus_rpm_fill_cdata_buffer(int *curr, char *buf,
++	const int max_size, void *cdata, int nmasters, int nslaves,
++	int ntslaves)
++{
++}
++#endif
++
++int msm_bus_noc_hw_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo);
++int msm_bus_bimc_hw_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo);
++#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_MSM_BUS_SCALING)
++void msm_bus_dbg_client_data(struct msm_bus_scale_pdata *pdata, int index,
++	uint32_t cl);
++void msm_bus_dbg_commit_data(const char *fabname, void *cdata,
++	int nmasters, int nslaves, int ntslaves, int op);
++#else
++static inline void msm_bus_dbg_client_data(struct msm_bus_scale_pdata *pdata,
++	int index, uint32_t cl)
++{
++}
++static inline void msm_bus_dbg_commit_data(const char *fabname,
++	void *cdata, int nmasters, int nslaves, int ntslaves,
++	int op)
++{
++}
++#endif
++
++#ifdef CONFIG_CORESIGHT
++int msmbus_coresight_init(struct platform_device *pdev);
++void msmbus_coresight_remove(struct platform_device *pdev);
++int msmbus_coresight_init_adhoc(struct platform_device *pdev,
++		struct device_node *of_node);
++void msmbus_coresight_remove_adhoc(struct platform_device *pdev);
++#else
++static inline int msmbus_coresight_init(struct platform_device *pdev)
++{
++	return 0;
++}
++
++static inline void msmbus_coresight_remove(struct platform_device *pdev)
++{
++}
++
++static inline int msmbus_coresight_init_adhoc(struct platform_device *pdev,
++		struct device_node *of_node)
++{
++	return 0;
++}
++
++static inline void msmbus_coresight_remove_adhoc(struct platform_device *pdev)
++{
++}
++#endif
++
++
++#ifdef CONFIG_OF
++void msm_bus_of_get_nfab(struct platform_device *pdev,
++		struct msm_bus_fabric_registration *pdata);
++struct msm_bus_fabric_registration
++	*msm_bus_of_get_fab_data(struct platform_device *pdev);
++#else
++static inline void msm_bus_of_get_nfab(struct platform_device *pdev,
++		struct msm_bus_fabric_registration *pdata)
++{
++	return;
++}
++
++static inline struct msm_bus_fabric_registration
++	*msm_bus_of_get_fab_data(struct platform_device *pdev)
++{
++	return NULL;
++}
++#endif
++
++#endif /*_ARCH_ARM_MACH_MSM_BUS_CORE_H*/
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_dbg.c
+@@ -0,0 +1,810 @@
++/* Copyright (c) 2010-2012, 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#define pr_fmt(fmt) "AXI: %s(): " fmt, __func__
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/seq_file.h>
++#include <linux/debugfs.h>
++#include <linux/slab.h>
++#include <linux/mutex.h>
++#include <linux/string.h>
++#include <linux/uaccess.h>
++#include <linux/hrtimer.h>
++#include "msm-bus-board.h"
++#include "msm-bus.h"
++#include "msm_bus_rules.h"
++#include "msm_bus_core.h"
++#include "msm_bus_adhoc.h"
++
++#define CREATE_TRACE_POINTS
++#include <trace/events/trace_msm_bus.h>
++
++#define MAX_BUFF_SIZE 4096
++#define FILL_LIMIT 128
++
++static struct dentry *clients;
++static struct dentry *dir;
++static DEFINE_MUTEX(msm_bus_dbg_fablist_lock);
++struct msm_bus_dbg_state {
++	uint32_t cl;
++	uint8_t enable;
++	uint8_t current_index;
++} clstate;
++
++struct msm_bus_cldata {
++	const struct msm_bus_scale_pdata *pdata;
++	int index;
++	uint32_t clid;
++	int size;
++	struct dentry *file;
++	struct list_head list;
++	char buffer[MAX_BUFF_SIZE];
++};
++
++struct msm_bus_fab_list {
++	const char *name;
++	int size;
++	struct dentry *file;
++	struct list_head list;
++	char buffer[MAX_BUFF_SIZE];
++};
++
++static char *rules_buf;
++
++LIST_HEAD(fabdata_list);
++LIST_HEAD(cl_list);
++
++/**
++ * The following structures and funtions are used for
++ * the test-client which can be created at run-time.
++ */
++
++static struct msm_bus_vectors init_vectors[1];
++static struct msm_bus_vectors current_vectors[1];
++static struct msm_bus_vectors requested_vectors[1];
++
++static struct msm_bus_paths shell_client_usecases[] = {
++	{
++		.num_paths = ARRAY_SIZE(init_vectors),
++		.vectors = init_vectors,
++	},
++	{
++		.num_paths = ARRAY_SIZE(current_vectors),
++		.vectors = current_vectors,
++	},
++	{
++		.num_paths = ARRAY_SIZE(requested_vectors),
++		.vectors = requested_vectors,
++	},
++};
++
++static struct msm_bus_scale_pdata shell_client = {
++	.usecase = shell_client_usecases,
++	.num_usecases = ARRAY_SIZE(shell_client_usecases),
++	.name = "test-client",
++};
++
++static void msm_bus_dbg_init_vectors(void)
++{
++	init_vectors[0].src = -1;
++	init_vectors[0].dst = -1;
++	init_vectors[0].ab = 0;
++	init_vectors[0].ib = 0;
++	current_vectors[0].src = -1;
++	current_vectors[0].dst = -1;
++	current_vectors[0].ab = 0;
++	current_vectors[0].ib = 0;
++	requested_vectors[0].src = -1;
++	requested_vectors[0].dst = -1;
++	requested_vectors[0].ab = 0;
++	requested_vectors[0].ib = 0;
++	clstate.enable = 0;
++	clstate.current_index = 0;
++}
++
++static int msm_bus_dbg_update_cl_request(uint32_t cl)
++{
++	int ret = 0;
++
++	if (clstate.current_index < 2)
++		clstate.current_index = 2;
++	else {
++		clstate.current_index = 1;
++		current_vectors[0].ab = requested_vectors[0].ab;
++		current_vectors[0].ib = requested_vectors[0].ib;
++	}
++
++	if (clstate.enable) {
++		MSM_BUS_DBG("Updating request for shell client, index: %d\n",
++			clstate.current_index);
++		ret = msm_bus_scale_client_update_request(clstate.cl,
++			clstate.current_index);
++	} else
++		MSM_BUS_DBG("Enable bit not set. Skipping update request\n");
++
++	return ret;
++}
++
++static void msm_bus_dbg_unregister_client(uint32_t cl)
++{
++	MSM_BUS_DBG("Unregistering shell client\n");
++	msm_bus_scale_unregister_client(clstate.cl);
++	clstate.cl = 0;
++}
++
++static uint32_t msm_bus_dbg_register_client(void)
++{
++	int ret = 0;
++
++	if (init_vectors[0].src != requested_vectors[0].src) {
++		MSM_BUS_DBG("Shell client master changed. Unregistering\n");
++		msm_bus_dbg_unregister_client(clstate.cl);
++	}
++	if (init_vectors[0].dst != requested_vectors[0].dst) {
++		MSM_BUS_DBG("Shell client slave changed. Unregistering\n");
++		msm_bus_dbg_unregister_client(clstate.cl);
++	}
++
++	current_vectors[0].src = init_vectors[0].src;
++	requested_vectors[0].src = init_vectors[0].src;
++	current_vectors[0].dst = init_vectors[0].dst;
++	requested_vectors[0].dst = init_vectors[0].dst;
++
++	if (!clstate.enable) {
++		MSM_BUS_DBG("Enable bit not set, skipping registration: cl "
++			"%d\n",	clstate.cl);
++		return 0;
++	}
++
++	if (clstate.cl) {
++		MSM_BUS_DBG("Client  registered, skipping registration\n");
++		return clstate.cl;
++	}
++
++	MSM_BUS_DBG("Registering shell client\n");
++	ret = msm_bus_scale_register_client(&shell_client);
++	return ret;
++}
++
++static int msm_bus_dbg_mas_get(void  *data, u64 *val)
++{
++	*val = init_vectors[0].src;
++	MSM_BUS_DBG("Get master: %llu\n", *val);
++	return 0;
++}
++
++static int msm_bus_dbg_mas_set(void  *data, u64 val)
++{
++	init_vectors[0].src = val;
++	MSM_BUS_DBG("Set master: %llu\n", val);
++	clstate.cl = msm_bus_dbg_register_client();
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(shell_client_mas_fops, msm_bus_dbg_mas_get,
++	msm_bus_dbg_mas_set, "%llu\n");
++
++static int msm_bus_dbg_slv_get(void  *data, u64 *val)
++{
++	*val = init_vectors[0].dst;
++	MSM_BUS_DBG("Get slave: %llu\n", *val);
++	return 0;
++}
++
++static int msm_bus_dbg_slv_set(void  *data, u64 val)
++{
++	init_vectors[0].dst = val;
++	MSM_BUS_DBG("Set slave: %llu\n", val);
++	clstate.cl = msm_bus_dbg_register_client();
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(shell_client_slv_fops, msm_bus_dbg_slv_get,
++	msm_bus_dbg_slv_set, "%llu\n");
++
++static int msm_bus_dbg_ab_get(void  *data, u64 *val)
++{
++	*val = requested_vectors[0].ab;
++	MSM_BUS_DBG("Get ab: %llu\n", *val);
++	return 0;
++}
++
++static int msm_bus_dbg_ab_set(void  *data, u64 val)
++{
++	requested_vectors[0].ab = val;
++	MSM_BUS_DBG("Set ab: %llu\n", val);
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(shell_client_ab_fops, msm_bus_dbg_ab_get,
++	msm_bus_dbg_ab_set, "%llu\n");
++
++static int msm_bus_dbg_ib_get(void  *data, u64 *val)
++{
++	*val = requested_vectors[0].ib;
++	MSM_BUS_DBG("Get ib: %llu\n", *val);
++	return 0;
++}
++
++static int msm_bus_dbg_ib_set(void  *data, u64 val)
++{
++	requested_vectors[0].ib = val;
++	MSM_BUS_DBG("Set ib: %llu\n", val);
++	return 0;
++}
++DEFINE_SIMPLE_ATTRIBUTE(shell_client_ib_fops, msm_bus_dbg_ib_get,
++	msm_bus_dbg_ib_set, "%llu\n");
++
++static int msm_bus_dbg_en_get(void  *data, u64 *val)
++{
++	*val = clstate.enable;
++	MSM_BUS_DBG("Get enable: %llu\n", *val);
++	return 0;
++}
++
++static int msm_bus_dbg_en_set(void  *data, u64 val)
++{
++	int ret = 0;
++
++	clstate.enable = val;
++	if (clstate.enable) {
++		if (!clstate.cl) {
++			MSM_BUS_DBG("client: %u\n", clstate.cl);
++			clstate.cl = msm_bus_dbg_register_client();
++			if (clstate.cl)
++				ret = msm_bus_dbg_update_cl_request(clstate.cl);
++		} else {
++			MSM_BUS_DBG("update request for cl: %u\n", clstate.cl);
++			ret = msm_bus_dbg_update_cl_request(clstate.cl);
++		}
++	}
++
++	MSM_BUS_DBG("Set enable: %llu\n", val);
++	return ret;
++}
++DEFINE_SIMPLE_ATTRIBUTE(shell_client_en_fops, msm_bus_dbg_en_get,
++	msm_bus_dbg_en_set, "%llu\n");
++
++/**
++ * The following funtions are used for viewing the client data
++ * and changing the client request at run-time
++ */
++
++static ssize_t client_data_read(struct file *file, char __user *buf,
++	size_t count, loff_t *ppos)
++{
++	int bsize = 0;
++	uint32_t cl = (uint32_t)(uintptr_t)file->private_data;
++	struct msm_bus_cldata *cldata = NULL;
++	int found = 0;
++
++	list_for_each_entry(cldata, &cl_list, list) {
++		if (cldata->clid == cl) {
++			found = 1;
++			break;
++		}
++	}
++	if (!found)
++		return 0;
++
++	bsize = cldata->size;
++	return simple_read_from_buffer(buf, count, ppos,
++		cldata->buffer, bsize);
++}
++
++static int client_data_open(struct inode *inode, struct file *file)
++{
++	file->private_data = inode->i_private;
++	return 0;
++}
++
++static const struct file_operations client_data_fops = {
++	.open		= client_data_open,
++	.read		= client_data_read,
++};
++
++struct dentry *msm_bus_dbg_create(const char *name, mode_t mode,
++	struct dentry *dent, uint32_t clid)
++{
++	if (dent == NULL) {
++		MSM_BUS_DBG("debugfs not ready yet\n");
++		return NULL;
++	}
++	return debugfs_create_file(name, mode, dent, (void *)(uintptr_t)clid,
++		&client_data_fops);
++}
++
++#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_MSM_BUS_SCALING)
++static int msm_bus_dbg_record_client(const struct msm_bus_scale_pdata *pdata,
++	int index, uint32_t clid, struct dentry *file)
++{
++	struct msm_bus_cldata *cldata;
++
++	cldata = kmalloc(sizeof(struct msm_bus_cldata), GFP_KERNEL);
++	if (!cldata) {
++		MSM_BUS_DBG("Failed to allocate memory for client data\n");
++		return -ENOMEM;
++	}
++	cldata->pdata = pdata;
++	cldata->index = index;
++	cldata->clid = clid;
++	cldata->file = file;
++	cldata->size = 0;
++	list_add_tail(&cldata->list, &cl_list);
++	return 0;
++}
++
++static void msm_bus_dbg_free_client(uint32_t clid)
++{
++	struct msm_bus_cldata *cldata = NULL;
++
++	list_for_each_entry(cldata, &cl_list, list) {
++		if (cldata->clid == clid) {
++			debugfs_remove(cldata->file);
++			list_del(&cldata->list);
++			kfree(cldata);
++			break;
++		}
++	}
++}
++
++static int msm_bus_dbg_fill_cl_buffer(const struct msm_bus_scale_pdata *pdata,
++	int index, uint32_t clid)
++{
++	int i = 0, j;
++	char *buf = NULL;
++	struct msm_bus_cldata *cldata = NULL;
++	struct timespec ts;
++	int found = 0;
++
++	list_for_each_entry(cldata, &cl_list, list) {
++		if (cldata->clid == clid) {
++			found = 1;
++			break;
++		}
++	}
++
++	if (!found)
++		return -ENOENT;
++
++	if (cldata->file == NULL) {
++		if (pdata->name == NULL) {
++			MSM_BUS_DBG("Client doesn't have a name\n");
++			return -EINVAL;
++		}
++		cldata->file = msm_bus_dbg_create(pdata->name, S_IRUGO,
++			clients, clid);
++	}
++
++	if (cldata->size < (MAX_BUFF_SIZE - FILL_LIMIT))
++		i = cldata->size;
++	else {
++		i = 0;
++		cldata->size = 0;
++	}
++	buf = cldata->buffer;
++	ts = ktime_to_timespec(ktime_get());
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\n%d.%d\n",
++		(int)ts.tv_sec, (int)ts.tv_nsec);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "curr   : %d\n", index);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "masters: ");
++
++	for (j = 0; j < pdata->usecase->num_paths; j++)
++		i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "%d  ",
++			pdata->usecase[index].vectors[j].src);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\nslaves : ");
++	for (j = 0; j < pdata->usecase->num_paths; j++)
++		i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "%d  ",
++			pdata->usecase[index].vectors[j].dst);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\nab     : ");
++	for (j = 0; j < pdata->usecase->num_paths; j++)
++		i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "%llu  ",
++			pdata->usecase[index].vectors[j].ab);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\nib     : ");
++	for (j = 0; j < pdata->usecase->num_paths; j++)
++		i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "%llu  ",
++			pdata->usecase[index].vectors[j].ib);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\n");
++
++	for (j = 0; j < pdata->usecase->num_paths; j++)
++		trace_bus_update_request((int)ts.tv_sec, (int)ts.tv_nsec,
++		pdata->name, index,
++		pdata->usecase[index].vectors[j].src,
++		pdata->usecase[index].vectors[j].dst,
++		pdata->usecase[index].vectors[j].ab,
++		pdata->usecase[index].vectors[j].ib);
++
++	cldata->size = i;
++	return i;
++}
++#endif
++
++static int msm_bus_dbg_update_request(struct msm_bus_cldata *cldata, int index)
++{
++	int ret = 0;
++
++	if ((index < 0) || (index > cldata->pdata->num_usecases)) {
++		MSM_BUS_DBG("Invalid index!\n");
++		return -EINVAL;
++	}
++	ret = msm_bus_scale_client_update_request(cldata->clid, index);
++	return ret;
++}
++
++static ssize_t  msm_bus_dbg_update_request_write(struct file *file,
++	const char __user *ubuf, size_t cnt, loff_t *ppos)
++{
++	struct msm_bus_cldata *cldata;
++	unsigned long index = 0;
++	int ret = 0;
++	char *chid;
++	char *buf = kmalloc((sizeof(char) * (cnt + 1)), GFP_KERNEL);
++	int found = 0;
++
++	if (!buf || IS_ERR(buf)) {
++		MSM_BUS_ERR("Memory allocation for buffer failed\n");
++		return -ENOMEM;
++	}
++	if (cnt == 0) {
++		kfree(buf);
++		return 0;
++	}
++	if (copy_from_user(buf, ubuf, cnt)) {
++		kfree(buf);
++		return -EFAULT;
++	}
++	buf[cnt] = '\0';
++	chid = buf;
++	MSM_BUS_DBG("buffer: %s\n size: %zu\n", buf, sizeof(ubuf));
++
++	list_for_each_entry(cldata, &cl_list, list) {
++		if (strnstr(chid, cldata->pdata->name, cnt)) {
++			found = 1;
++			cldata = cldata;
++			strsep(&chid, " ");
++			if (chid) {
++				ret = kstrtoul(chid, 10, &index);
++				if (ret) {
++					MSM_BUS_DBG("Index conversion"
++						" failed\n");
++					return -EFAULT;
++				}
++			} else {
++				MSM_BUS_DBG("Error parsing input. Index not"
++					" found\n");
++				found = 0;
++			}
++			break;
++		}
++	}
++
++	if (found)
++		msm_bus_dbg_update_request(cldata, index);
++	kfree(buf);
++	return cnt;
++}
++
++/**
++ * The following funtions are used for viewing the commit data
++ * for each fabric
++ */
++static ssize_t fabric_data_read(struct file *file, char __user *buf,
++	size_t count, loff_t *ppos)
++{
++	struct msm_bus_fab_list *fablist = NULL;
++	int bsize = 0;
++	ssize_t ret;
++	const char *name = file->private_data;
++	int found = 0;
++
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	list_for_each_entry(fablist, &fabdata_list, list) {
++		if (strcmp(fablist->name, name) == 0) {
++			found = 1;
++			break;
++		}
++	}
++	if (!found)
++		return -ENOENT;
++	bsize = fablist->size;
++	ret = simple_read_from_buffer(buf, count, ppos,
++		fablist->buffer, bsize);
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++	return ret;
++}
++
++static const struct file_operations fabric_data_fops = {
++	.open		= client_data_open,
++	.read		= fabric_data_read,
++};
++
++static ssize_t rules_dbg_read(struct file *file, char __user *buf,
++	size_t count, loff_t *ppos)
++{
++	ssize_t ret;
++	memset(rules_buf, 0, MAX_BUFF_SIZE);
++	print_rules_buf(rules_buf, MAX_BUFF_SIZE);
++	ret = simple_read_from_buffer(buf, count, ppos,
++		rules_buf, MAX_BUFF_SIZE);
++	return ret;
++}
++
++static int rules_dbg_open(struct inode *inode, struct file *file)
++{
++	file->private_data = inode->i_private;
++	return 0;
++}
++
++static const struct file_operations rules_dbg_fops = {
++	.open		= rules_dbg_open,
++	.read		= rules_dbg_read,
++};
++
++#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_MSM_BUS_SCALING)
++static int msm_bus_dbg_record_fabric(const char *fabname, struct dentry *file)
++{
++	struct msm_bus_fab_list *fablist;
++	int ret = 0;
++
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	fablist = kmalloc(sizeof(struct msm_bus_fab_list), GFP_KERNEL);
++	if (!fablist) {
++		MSM_BUS_DBG("Failed to allocate memory for commit data\n");
++		ret =  -ENOMEM;
++		goto err;
++	}
++
++	fablist->name = fabname;
++	fablist->size = 0;
++	list_add_tail(&fablist->list, &fabdata_list);
++err:
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++	return ret;
++}
++
++static void msm_bus_dbg_free_fabric(const char *fabname)
++{
++	struct msm_bus_fab_list *fablist = NULL;
++
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	list_for_each_entry(fablist, &fabdata_list, list) {
++		if (strcmp(fablist->name, fabname) == 0) {
++			debugfs_remove(fablist->file);
++			list_del(&fablist->list);
++			kfree(fablist);
++			break;
++		}
++	}
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++}
++
++static int msm_bus_dbg_fill_fab_buffer(const char *fabname,
++	void *cdata, int nmasters, int nslaves,
++	int ntslaves)
++{
++	int i;
++	char *buf = NULL;
++	struct msm_bus_fab_list *fablist = NULL;
++	struct timespec ts;
++	int found = 0;
++
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	list_for_each_entry(fablist, &fabdata_list, list) {
++		if (strcmp(fablist->name, fabname) == 0) {
++			found = 1;
++			break;
++		}
++	}
++	if (!found)
++		return -ENOENT;
++
++	if (fablist->file == NULL) {
++		MSM_BUS_DBG("Fabric dbg entry does not exist\n");
++		mutex_unlock(&msm_bus_dbg_fablist_lock);
++		return -EFAULT;
++	}
++
++	if (fablist->size < MAX_BUFF_SIZE - 256)
++		i = fablist->size;
++	else {
++		i = 0;
++		fablist->size = 0;
++	}
++	buf = fablist->buffer;
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++	ts = ktime_to_timespec(ktime_get());
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\n%d.%d\n",
++		(int)ts.tv_sec, (int)ts.tv_nsec);
++
++	msm_bus_rpm_fill_cdata_buffer(&i, buf, MAX_BUFF_SIZE, cdata,
++		nmasters, nslaves, ntslaves);
++	i += scnprintf(buf + i, MAX_BUFF_SIZE - i, "\n");
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	fablist->size = i;
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++	return 0;
++}
++#endif
++
++static const struct file_operations msm_bus_dbg_update_request_fops = {
++	.open = client_data_open,
++	.write = msm_bus_dbg_update_request_write,
++};
++
++#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_MSM_BUS_SCALING)
++/**
++ * msm_bus_dbg_client_data() - Add debug data for clients
++ * @pdata: Platform data of the client
++ * @index: The current index or operation to be performed
++ * @clid: Client handle obtained during registration
++ */
++void msm_bus_dbg_client_data(struct msm_bus_scale_pdata *pdata, int index,
++	uint32_t clid)
++{
++	struct dentry *file = NULL;
++
++	if (index == MSM_BUS_DBG_REGISTER) {
++		msm_bus_dbg_record_client(pdata, index, clid, file);
++		if (!pdata->name) {
++			MSM_BUS_DBG("Cannot create debugfs entry. Null name\n");
++			return;
++		}
++	} else if (index == MSM_BUS_DBG_UNREGISTER) {
++		msm_bus_dbg_free_client(clid);
++		MSM_BUS_DBG("Client %d unregistered\n", clid);
++	} else
++		msm_bus_dbg_fill_cl_buffer(pdata, index, clid);
++}
++EXPORT_SYMBOL(msm_bus_dbg_client_data);
++
++/**
++ * msm_bus_dbg_commit_data() - Add commit data from fabrics
++ * @fabname: Fabric name specified in platform data
++ * @cdata: Commit Data
++ * @nmasters: Number of masters attached to fabric
++ * @nslaves: Number of slaves attached to fabric
++ * @ntslaves: Number of tiered slaves attached to fabric
++ * @op: Operation to be performed
++ */
++void msm_bus_dbg_commit_data(const char *fabname, void *cdata,
++	int nmasters, int nslaves, int ntslaves, int op)
++{
++	struct dentry *file = NULL;
++
++	if (op == MSM_BUS_DBG_REGISTER)
++		msm_bus_dbg_record_fabric(fabname, file);
++	else if (op == MSM_BUS_DBG_UNREGISTER)
++		msm_bus_dbg_free_fabric(fabname);
++	else
++		msm_bus_dbg_fill_fab_buffer(fabname, cdata, nmasters,
++			nslaves, ntslaves);
++}
++EXPORT_SYMBOL(msm_bus_dbg_commit_data);
++#endif
++
++static int __init msm_bus_debugfs_init(void)
++{
++	struct dentry *commit, *shell_client, *rules_dbg;
++	struct msm_bus_fab_list *fablist;
++	struct msm_bus_cldata *cldata = NULL;
++	uint64_t val = 0;
++
++	dir = debugfs_create_dir("msm-bus-dbg", NULL);
++	if ((!dir) || IS_ERR(dir)) {
++		MSM_BUS_ERR("Couldn't create msm-bus-dbg\n");
++		goto err;
++	}
++
++	clients = debugfs_create_dir("client-data", dir);
++	if ((!dir) || IS_ERR(dir)) {
++		MSM_BUS_ERR("Couldn't create clients\n");
++		goto err;
++	}
++
++	shell_client = debugfs_create_dir("shell-client", dir);
++	if ((!dir) || IS_ERR(dir)) {
++		MSM_BUS_ERR("Couldn't create clients\n");
++		goto err;
++	}
++
++	commit = debugfs_create_dir("commit-data", dir);
++	if ((!dir) || IS_ERR(dir)) {
++		MSM_BUS_ERR("Couldn't create commit\n");
++		goto err;
++	}
++
++	rules_dbg = debugfs_create_dir("rules-dbg", dir);
++	if ((!rules_dbg) || IS_ERR(rules_dbg)) {
++		MSM_BUS_ERR("Couldn't create rules-dbg\n");
++		goto err;
++	}
++
++	if (debugfs_create_file("print_rules", S_IRUGO | S_IWUSR,
++		rules_dbg, &val, &rules_dbg_fops) == NULL)
++		goto err;
++
++	if (debugfs_create_file("update_request", S_IRUGO | S_IWUSR,
++		shell_client, &val, &shell_client_en_fops) == NULL)
++		goto err;
++	if (debugfs_create_file("ib", S_IRUGO | S_IWUSR, shell_client, &val,
++		&shell_client_ib_fops) == NULL)
++		goto err;
++	if (debugfs_create_file("ab", S_IRUGO | S_IWUSR, shell_client, &val,
++		&shell_client_ab_fops) == NULL)
++		goto err;
++	if (debugfs_create_file("slv", S_IRUGO | S_IWUSR, shell_client,
++		&val, &shell_client_slv_fops) == NULL)
++		goto err;
++	if (debugfs_create_file("mas", S_IRUGO | S_IWUSR, shell_client,
++		&val, &shell_client_mas_fops) == NULL)
++		goto err;
++	if (debugfs_create_file("update-request", S_IRUGO | S_IWUSR,
++		clients, NULL, &msm_bus_dbg_update_request_fops) == NULL)
++		goto err;
++
++	rules_buf = kzalloc(MAX_BUFF_SIZE, GFP_KERNEL);
++	if (!rules_buf) {
++		MSM_BUS_ERR("Failed to alloc rules_buf");
++		goto err;
++	}
++
++	list_for_each_entry(cldata, &cl_list, list) {
++		if (cldata->pdata->name == NULL) {
++			MSM_BUS_DBG("Client name not found\n");
++			continue;
++		}
++		cldata->file = msm_bus_dbg_create(cldata->
++			pdata->name, S_IRUGO, clients, cldata->clid);
++	}
++
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	list_for_each_entry(fablist, &fabdata_list, list) {
++		fablist->file = debugfs_create_file(fablist->name, S_IRUGO,
++			commit, (void *)fablist->name, &fabric_data_fops);
++		if (fablist->file == NULL) {
++			MSM_BUS_DBG("Cannot create files for commit data\n");
++			kfree(rules_buf);
++			goto err;
++		}
++	}
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++
++	msm_bus_dbg_init_vectors();
++	return 0;
++err:
++	debugfs_remove_recursive(dir);
++	return -ENODEV;
++}
++late_initcall(msm_bus_debugfs_init);
++
++static void __exit msm_bus_dbg_teardown(void)
++{
++	struct msm_bus_fab_list *fablist = NULL, *fablist_temp;
++	struct msm_bus_cldata *cldata = NULL, *cldata_temp;
++
++	debugfs_remove_recursive(dir);
++	list_for_each_entry_safe(cldata, cldata_temp, &cl_list, list) {
++		list_del(&cldata->list);
++		kfree(cldata);
++	}
++	mutex_lock(&msm_bus_dbg_fablist_lock);
++	list_for_each_entry_safe(fablist, fablist_temp, &fabdata_list, list) {
++		list_del(&fablist->list);
++		kfree(fablist);
++	}
++	kfree(rules_buf);
++	mutex_unlock(&msm_bus_dbg_fablist_lock);
++}
++module_exit(msm_bus_dbg_teardown);
++MODULE_DESCRIPTION("Debugfs for msm bus scaling client");
++MODULE_LICENSE("GPL v2");
++MODULE_AUTHOR("Gagan Mac <gmac@codeaurora.org>");
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_fabric_adhoc.c
+@@ -0,0 +1,1281 @@
++/* Copyright (c) 2014, Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/clk.h>
++#include <linux/device.h>
++#include <linux/init.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include "rpm-smd.h"
++#include "msm_bus_core.h"
++#include "msm_bus_adhoc.h"
++#include "msm_bus_noc.h"
++#include "msm_bus_bimc.h"
++
++ssize_t vrail_show(struct device *dev, struct device_attribute *attr,
++			  char *buf)
++{
++	struct msm_bus_node_info_type *node_info = NULL;
++	struct msm_bus_node_device_type *bus_node = NULL;
++
++	bus_node = dev->platform_data;
++	if (!bus_node)
++		return -EINVAL;
++	node_info = bus_node->node_info;
++
++	return snprintf(buf, PAGE_SIZE, "%u", node_info->vrail_comp);
++}
++
++ssize_t vrail_store(struct device *dev, struct device_attribute *attr,
++			   const char *buf, size_t count)
++{
++	struct msm_bus_node_info_type *node_info = NULL;
++	struct msm_bus_node_device_type *bus_node = NULL;
++	int ret = 0;
++
++	bus_node = dev->platform_data;
++	if (!bus_node)
++		return -EINVAL;
++	node_info = bus_node->node_info;
++
++	ret = sscanf(buf, "%u", &node_info->vrail_comp);
++	if (ret != 1)
++		return -EINVAL;
++	return count;
++}
++
++DEVICE_ATTR(vrail, 0600, vrail_show, vrail_store);
++
++struct static_rules_type {
++	int num_rules;
++	struct bus_rule_type *rules;
++};
++
++static struct static_rules_type static_rules;
++
++static int enable_nodeclk(struct nodeclk *nclk)
++{
++	int ret = 0;
++
++	if (!nclk->enable) {
++		ret = clk_prepare_enable(nclk->clk);
++
++		if (ret) {
++			MSM_BUS_ERR("%s: failed to enable clk ", __func__);
++			nclk->enable = false;
++		} else
++			nclk->enable = true;
++	}
++	return ret;
++}
++
++static int disable_nodeclk(struct nodeclk *nclk)
++{
++	int ret = 0;
++
++	if (nclk->enable) {
++		clk_disable_unprepare(nclk->clk);
++		nclk->enable = false;
++	}
++	return ret;
++}
++
++static int setrate_nodeclk(struct nodeclk *nclk, long rate)
++{
++	int ret = 0;
++
++	ret = clk_set_rate(nclk->clk, rate);
++
++	if (ret)
++		MSM_BUS_ERR("%s: failed to setrate clk", __func__);
++	return ret;
++}
++
++static int msm_bus_agg_fab_clks(struct device *bus_dev, void *data)
++{
++	struct msm_bus_node_device_type *node = NULL;
++	int ret = 0;
++	int ctx = *(int *)data;
++
++	if (ctx >= NUM_CTX) {
++		MSM_BUS_ERR("%s: Invalid Context %d", __func__, ctx);
++		goto exit_agg_fab_clks;
++	}
++
++	node = bus_dev->platform_data;
++	if (!node) {
++		MSM_BUS_ERR("%s: Can't get device info", __func__);
++		goto exit_agg_fab_clks;
++	}
++
++	if (!node->node_info->is_fab_dev) {
++		struct msm_bus_node_device_type *bus_dev = NULL;
++
++		bus_dev = node->node_info->bus_device->platform_data;
++
++		if (node->cur_clk_hz[ctx] >= bus_dev->cur_clk_hz[ctx])
++			bus_dev->cur_clk_hz[ctx] = node->cur_clk_hz[ctx];
++	}
++
++exit_agg_fab_clks:
++	return ret;
++}
++
++static int msm_bus_reset_fab_clks(struct device *bus_dev, void *data)
++{
++	struct msm_bus_node_device_type *node = NULL;
++	int ret = 0;
++	int ctx = *(int *)data;
++
++	if (ctx >= NUM_CTX) {
++		MSM_BUS_ERR("%s: Invalid Context %d", __func__, ctx);
++		goto exit_reset_fab_clks;
++	}
++
++	node = bus_dev->platform_data;
++	if (!node) {
++		MSM_BUS_ERR("%s: Can't get device info", __func__);
++		goto exit_reset_fab_clks;
++	}
++
++	if (node->node_info->is_fab_dev) {
++		node->cur_clk_hz[ctx] = 0;
++		MSM_BUS_DBG("Resetting for node %d", node->node_info->id);
++	}
++exit_reset_fab_clks:
++	return ret;
++}
++
++
++static int send_rpm_msg(struct device *device)
++{
++	int ret = 0;
++	int ctx;
++	int rsc_type;
++	struct msm_bus_node_device_type *ndev =
++					device->platform_data;
++	struct msm_rpm_kvp rpm_kvp;
++
++	if (!ndev) {
++		MSM_BUS_ERR("%s: Error getting node info.", __func__);
++		ret = -ENODEV;
++		goto exit_send_rpm_msg;
++	}
++
++	rpm_kvp.length = sizeof(uint64_t);
++	rpm_kvp.key = RPM_MASTER_FIELD_BW;
++
++	for (ctx = MSM_RPM_CTX_ACTIVE_SET; ctx <= MSM_RPM_CTX_SLEEP_SET;
++					ctx++) {
++		if (ctx == MSM_RPM_CTX_ACTIVE_SET)
++			rpm_kvp.data =
++			(uint8_t *)&ndev->node_ab.ab[MSM_RPM_CTX_ACTIVE_SET];
++		else {
++			rpm_kvp.data =
++			(uint8_t *) &ndev->node_ab.ab[MSM_RPM_CTX_SLEEP_SET];
++		}
++
++		if (ndev->node_info->mas_rpm_id != -1) {
++			rsc_type = RPM_BUS_MASTER_REQ;
++			ret = msm_rpm_send_message(ctx, rsc_type,
++				ndev->node_info->mas_rpm_id, &rpm_kvp, 1);
++			if (ret) {
++				MSM_BUS_ERR("%s: Failed to send RPM message:",
++						__func__);
++				MSM_BUS_ERR("%s:Node Id %d RPM id %d",
++				__func__, ndev->node_info->id,
++					 ndev->node_info->mas_rpm_id);
++				goto exit_send_rpm_msg;
++			}
++		}
++
++		if (ndev->node_info->slv_rpm_id != -1) {
++			rsc_type = RPM_BUS_SLAVE_REQ;
++			ret = msm_rpm_send_message(ctx, rsc_type,
++				ndev->node_info->slv_rpm_id, &rpm_kvp, 1);
++			if (ret) {
++				MSM_BUS_ERR("%s: Failed to send RPM message:",
++							__func__);
++				MSM_BUS_ERR("%s: Node Id %d RPM id %d",
++				__func__, ndev->node_info->id,
++					ndev->node_info->slv_rpm_id);
++				goto exit_send_rpm_msg;
++			}
++		}
++	}
++exit_send_rpm_msg:
++	return ret;
++}
++
++static int flush_bw_data(struct device *node_device, int ctx)
++{
++	struct msm_bus_node_device_type *node_info;
++	int ret = 0;
++
++	node_info = node_device->platform_data;
++	if (!node_info) {
++		MSM_BUS_ERR("%s: Unable to find bus device for device",
++			__func__);
++		ret = -ENODEV;
++		goto exit_flush_bw_data;
++	}
++
++	if (node_info->node_ab.dirty) {
++		if (node_info->ap_owned) {
++			struct msm_bus_node_device_type *bus_device =
++				node_info->node_info->bus_device->platform_data;
++			struct msm_bus_fab_device_type *fabdev =
++							bus_device->fabdev;
++
++			if (fabdev && fabdev->noc_ops.update_bw_reg &&
++				fabdev->noc_ops.update_bw_reg
++					(node_info->node_info->qos_params.mode))
++				ret = fabdev->noc_ops.set_bw(node_info,
++							fabdev->qos_base,
++							fabdev->base_offset,
++							fabdev->qos_off,
++							fabdev->qos_freq);
++		} else {
++			ret = send_rpm_msg(node_device);
++
++			if (ret)
++				MSM_BUS_ERR("%s: Failed to send RPM msg for%d",
++				__func__, node_info->node_info->id);
++		}
++		node_info->node_ab.dirty = false;
++	}
++
++exit_flush_bw_data:
++	return ret;
++
++}
++
++static int flush_clk_data(struct device *node_device, int ctx)
++{
++	struct msm_bus_node_device_type *node;
++	struct nodeclk *nodeclk = NULL;
++	int ret = 0;
++
++	node = node_device->platform_data;
++	if (!node) {
++		MSM_BUS_ERR("Unable to find bus device");
++		ret = -ENODEV;
++		goto exit_flush_clk_data;
++	}
++
++	nodeclk = &node->clk[ctx];
++	if (node->node_info->is_fab_dev) {
++		if (nodeclk->rate != node->cur_clk_hz[ctx]) {
++			nodeclk->rate = node->cur_clk_hz[ctx];
++			nodeclk->dirty = true;
++		}
++	}
++
++	if (nodeclk && nodeclk->clk && nodeclk->dirty) {
++		long rounded_rate;
++
++		if (nodeclk->rate) {
++			rounded_rate = clk_round_rate(nodeclk->clk,
++							nodeclk->rate);
++			ret = setrate_nodeclk(nodeclk, rounded_rate);
++
++			if (ret) {
++				MSM_BUS_ERR("%s: Failed to set_rate %lu for %d",
++					__func__, rounded_rate,
++						node->node_info->id);
++				ret = -ENODEV;
++				goto exit_flush_clk_data;
++			}
++
++			ret = enable_nodeclk(nodeclk);
++		} else
++			ret = disable_nodeclk(nodeclk);
++
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to enable for %d", __func__,
++						node->node_info->id);
++			ret = -ENODEV;
++			goto exit_flush_clk_data;
++		}
++		MSM_BUS_DBG("%s: Updated %d clk to %llu", __func__,
++				node->node_info->id, nodeclk->rate);
++
++	}
++exit_flush_clk_data:
++	/* Reset the aggregated clock rate for fab devices*/
++	if (node && node->node_info->is_fab_dev)
++		node->cur_clk_hz[ctx] = 0;
++
++	if (nodeclk)
++		nodeclk->dirty = 0;
++	return ret;
++}
++
++int msm_bus_commit_data(int *dirty_nodes, int ctx, int num_dirty)
++{
++	int ret = 0;
++	int i = 0;
++
++	/* Aggregate the bus clocks */
++	bus_for_each_dev(&msm_bus_type, NULL, (void *)&ctx,
++				msm_bus_agg_fab_clks);
++
++	for (i = 0; i < num_dirty; i++) {
++		struct device *node_device =
++					bus_find_device(&msm_bus_type, NULL,
++						(void *)&dirty_nodes[i],
++						msm_bus_device_match_adhoc);
++
++		if (!node_device) {
++			MSM_BUS_ERR("Can't find device for %d", dirty_nodes[i]);
++			continue;
++		}
++
++		ret = flush_bw_data(node_device, ctx);
++		if (ret)
++			MSM_BUS_ERR("%s: Error flushing bw data for node %d",
++					__func__, dirty_nodes[i]);
++
++		ret = flush_clk_data(node_device, ctx);
++		if (ret)
++			MSM_BUS_ERR("%s: Error flushing clk data for node %d",
++					__func__, dirty_nodes[i]);
++	}
++	kfree(dirty_nodes);
++	/* Aggregate the bus clocks */
++	bus_for_each_dev(&msm_bus_type, NULL, (void *)&ctx,
++				msm_bus_reset_fab_clks);
++	return ret;
++}
++
++void *msm_bus_realloc_devmem(struct device *dev, void *p, size_t old_size,
++					size_t new_size, gfp_t flags)
++{
++	void *ret;
++	size_t copy_size = old_size;
++
++	if (!new_size) {
++		devm_kfree(dev, p);
++		return ZERO_SIZE_PTR;
++	}
++
++	if (new_size < old_size)
++		copy_size = new_size;
++
++	ret = devm_kzalloc(dev, new_size, flags);
++	if (!ret) {
++		MSM_BUS_ERR("%s: Error Reallocating memory", __func__);
++		goto exit_realloc_devmem;
++	}
++
++	memcpy(ret, p, copy_size);
++	devm_kfree(dev, p);
++exit_realloc_devmem:
++	return ret;
++}
++
++
++static int add_dirty_node(int **dirty_nodes, int id, int *num_dirty)
++{
++	int i;
++	int found = 0;
++	int ret = 0;
++	int *dnode = NULL;
++
++	for (i = 0; i < *num_dirty; i++) {
++		if ((*dirty_nodes)[i] == id) {
++			found = 1;
++			break;
++		}
++	}
++
++	if (!found) {
++		(*num_dirty)++;
++		dnode =
++			krealloc(*dirty_nodes, sizeof(int) * (*num_dirty),
++								GFP_KERNEL);
++
++		if (ZERO_OR_NULL_PTR(dnode)) {
++			MSM_BUS_ERR("%s: Failure allocating dirty nodes array",
++								 __func__);
++			ret = -ENOMEM;
++		} else {
++			*dirty_nodes = dnode;
++			(*dirty_nodes)[(*num_dirty) - 1] = id;
++		}
++	}
++
++	return ret;
++}
++
++int msm_bus_update_bw(struct msm_bus_node_device_type *nodedev, int ctx,
++			int64_t add_bw, int **dirty_nodes, int *num_dirty)
++{
++	int ret = 0;
++	int i, j;
++	uint64_t cur_ab_slp = 0;
++	uint64_t cur_ab_act = 0;
++
++	if (nodedev->node_info->virt_dev)
++		goto exit_update_bw;
++
++	for (i = 0; i < NUM_CTX; i++) {
++		for (j = 0; j < nodedev->num_lnodes; j++) {
++			if (i == DUAL_CTX) {
++				cur_ab_act +=
++					nodedev->lnode_list[j].lnode_ab[i];
++				cur_ab_slp +=
++					nodedev->lnode_list[j].lnode_ab[i];
++			} else
++				cur_ab_act +=
++					nodedev->lnode_list[j].lnode_ab[i];
++		}
++	}
++
++	if (nodedev->node_ab.ab[MSM_RPM_CTX_ACTIVE_SET] != cur_ab_act) {
++		nodedev->node_ab.ab[MSM_RPM_CTX_ACTIVE_SET] = cur_ab_act;
++		nodedev->node_ab.ab[MSM_RPM_CTX_SLEEP_SET] = cur_ab_slp;
++		nodedev->node_ab.dirty = true;
++		ret = add_dirty_node(dirty_nodes, nodedev->node_info->id,
++								num_dirty);
++
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to add dirty node %d", __func__,
++						nodedev->node_info->id);
++			goto exit_update_bw;
++		}
++	}
++
++exit_update_bw:
++	return ret;
++}
++
++int msm_bus_update_clks(struct msm_bus_node_device_type *nodedev,
++		int ctx, int **dirty_nodes, int *num_dirty)
++{
++	int status = 0;
++	struct nodeclk *nodeclk;
++	struct nodeclk *busclk;
++	struct msm_bus_node_device_type *bus_info = NULL;
++	uint64_t req_clk;
++
++	bus_info = nodedev->node_info->bus_device->platform_data;
++
++	if (!bus_info) {
++		MSM_BUS_ERR("%s: Unable to find bus device for device %d",
++			__func__, nodedev->node_info->id);
++		status = -ENODEV;
++		goto exit_set_clks;
++	}
++
++	req_clk = nodedev->cur_clk_hz[ctx];
++	busclk = &bus_info->clk[ctx];
++
++	if (busclk->rate != req_clk) {
++		busclk->rate = req_clk;
++		busclk->dirty = 1;
++		MSM_BUS_DBG("%s: Modifying bus clk %d Rate %llu", __func__,
++					bus_info->node_info->id, req_clk);
++		status = add_dirty_node(dirty_nodes, bus_info->node_info->id,
++								num_dirty);
++
++		if (status) {
++			MSM_BUS_ERR("%s: Failed to add dirty node %d", __func__,
++						bus_info->node_info->id);
++			goto exit_set_clks;
++		}
++	}
++
++	req_clk = nodedev->cur_clk_hz[ctx];
++	nodeclk = &nodedev->clk[ctx];
++
++	if (IS_ERR_OR_NULL(nodeclk))
++		goto exit_set_clks;
++
++	if (!nodeclk->dirty || (nodeclk->dirty && (nodeclk->rate < req_clk))) {
++		nodeclk->rate = req_clk;
++		nodeclk->dirty = 1;
++		MSM_BUS_DBG("%s: Modifying node clk %d Rate %llu", __func__,
++					nodedev->node_info->id, req_clk);
++		status = add_dirty_node(dirty_nodes, nodedev->node_info->id,
++								num_dirty);
++		if (status) {
++			MSM_BUS_ERR("%s: Failed to add dirty node %d", __func__,
++						nodedev->node_info->id);
++			goto exit_set_clks;
++		}
++	}
++
++exit_set_clks:
++	return status;
++}
++
++static void msm_bus_fab_init_noc_ops(struct msm_bus_node_device_type *bus_dev)
++{
++	switch (bus_dev->fabdev->bus_type) {
++	case MSM_BUS_NOC:
++		msm_bus_noc_set_ops(bus_dev);
++		break;
++	case MSM_BUS_BIMC:
++		msm_bus_bimc_set_ops(bus_dev);
++		break;
++	default:
++		MSM_BUS_ERR("%s: Invalid Bus type", __func__);
++	}
++}
++
++static int msm_bus_qos_disable_clk(struct msm_bus_node_device_type *node,
++				int disable_bus_qos_clk)
++{
++	struct msm_bus_node_device_type *bus_node = NULL;
++	int ret = 0;
++
++	if (!node) {
++		ret = -ENXIO;
++		goto exit_disable_qos_clk;
++	}
++
++	bus_node = node->node_info->bus_device->platform_data;
++
++	if (!bus_node) {
++		ret = -ENXIO;
++		goto exit_disable_qos_clk;
++	}
++
++	if (disable_bus_qos_clk)
++		ret = disable_nodeclk(&bus_node->clk[DUAL_CTX]);
++
++	if (ret) {
++		MSM_BUS_ERR("%s: Failed to disable bus clk, node %d",
++			__func__, node->node_info->id);
++		goto exit_disable_qos_clk;
++	}
++
++	if (!IS_ERR_OR_NULL(node->qos_clk.clk)) {
++		ret = disable_nodeclk(&node->qos_clk);
++
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to disable mas qos clk,node %d",
++				__func__, node->node_info->id);
++			goto exit_disable_qos_clk;
++		}
++	}
++
++exit_disable_qos_clk:
++	return ret;
++}
++
++static int msm_bus_qos_enable_clk(struct msm_bus_node_device_type *node)
++{
++	struct msm_bus_node_device_type *bus_node = NULL;
++	long rounded_rate;
++	int ret = 0;
++	int bus_qos_enabled = 0;
++
++	if (!node) {
++		ret = -ENXIO;
++		goto exit_enable_qos_clk;
++	}
++
++	bus_node = node->node_info->bus_device->platform_data;
++
++	if (!bus_node) {
++		ret = -ENXIO;
++		goto exit_enable_qos_clk;
++	}
++
++	/* Check if the bus clk is already set before trying to set it
++	 * Do this only during
++	 *	a. Bootup
++	 *	b. Only for bus clks
++	 **/
++	if (!clk_get_rate(bus_node->clk[DUAL_CTX].clk)) {
++		rounded_rate = clk_round_rate(bus_node->clk[DUAL_CTX].clk, 1);
++		ret = setrate_nodeclk(&bus_node->clk[DUAL_CTX], rounded_rate);
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to set bus clk, node %d",
++				__func__, node->node_info->id);
++			goto exit_enable_qos_clk;
++		}
++
++		ret = enable_nodeclk(&bus_node->clk[DUAL_CTX]);
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to enable bus clk, node %d",
++				__func__, node->node_info->id);
++			goto exit_enable_qos_clk;
++		}
++		bus_qos_enabled = 1;
++	}
++
++	if (!IS_ERR_OR_NULL(node->qos_clk.clk)) {
++		rounded_rate = clk_round_rate(node->qos_clk.clk, 1);
++		ret = setrate_nodeclk(&node->qos_clk, rounded_rate);
++		if (ret) {
++			MSM_BUS_ERR("%s: Failed to enable mas qos clk, node %d",
++				__func__, node->node_info->id);
++			goto exit_enable_qos_clk;
++		}
++
++		ret = enable_nodeclk(&node->qos_clk);
++		if (ret) {
++			MSM_BUS_ERR("Err enable mas qos clk, node %d ret %d",
++				node->node_info->id, ret);
++			goto exit_enable_qos_clk;
++		}
++	}
++	ret = bus_qos_enabled;
++
++exit_enable_qos_clk:
++	return ret;
++}
++
++int msm_bus_enable_limiter(struct msm_bus_node_device_type *node_dev,
++				bool enable, uint64_t lim_bw)
++{
++	int ret = 0;
++	struct msm_bus_node_device_type *bus_node_dev;
++
++	if (!node_dev) {
++		MSM_BUS_ERR("No device specified");
++		ret = -ENXIO;
++		goto exit_enable_limiter;
++	}
++
++	if (!node_dev->ap_owned) {
++		MSM_BUS_ERR("Device is not AP owned %d.",
++						node_dev->node_info->id);
++		ret = -ENXIO;
++		goto exit_enable_limiter;
++	}
++
++	bus_node_dev = node_dev->node_info->bus_device->platform_data;
++	if (!bus_node_dev) {
++		MSM_BUS_ERR("Unable to get bus device infofor %d",
++			node_dev->node_info->id);
++		ret = -ENXIO;
++		goto exit_enable_limiter;
++	}
++	if (bus_node_dev->fabdev &&
++		bus_node_dev->fabdev->noc_ops.limit_mport) {
++		ret = msm_bus_qos_enable_clk(node_dev);
++		if (ret < 0) {
++			MSM_BUS_ERR("Can't Enable QoS clk %d",
++				node_dev->node_info->id);
++			goto exit_enable_limiter;
++		}
++		bus_node_dev->fabdev->noc_ops.limit_mport(
++				node_dev,
++				bus_node_dev->fabdev->qos_base,
++				bus_node_dev->fabdev->base_offset,
++				bus_node_dev->fabdev->qos_off,
++				bus_node_dev->fabdev->qos_freq,
++				enable, lim_bw);
++		msm_bus_qos_disable_clk(node_dev, ret);
++	}
++
++exit_enable_limiter:
++	return ret;
++}
++
++static int msm_bus_dev_init_qos(struct device *dev, void *data)
++{
++	int ret = 0;
++	struct msm_bus_node_device_type *node_dev = NULL;
++
++	node_dev = dev->platform_data;
++
++	if (!node_dev) {
++		MSM_BUS_ERR("%s: Unable to get node device info" , __func__);
++		ret = -ENXIO;
++		goto exit_init_qos;
++	}
++
++	MSM_BUS_DBG("Device = %d", node_dev->node_info->id);
++
++	if (node_dev->ap_owned) {
++		struct msm_bus_node_device_type *bus_node_info;
++
++		bus_node_info = node_dev->node_info->bus_device->platform_data;
++
++		if (!bus_node_info) {
++			MSM_BUS_ERR("%s: Unable to get bus device infofor %d",
++				__func__,
++				node_dev->node_info->id);
++			ret = -ENXIO;
++			goto exit_init_qos;
++		}
++
++		if (bus_node_info->fabdev &&
++			bus_node_info->fabdev->noc_ops.qos_init) {
++			int ret = 0;
++
++			if (node_dev->ap_owned &&
++				(node_dev->node_info->qos_params.mode) != -1) {
++
++				if (bus_node_info->fabdev->bypass_qos_prg)
++					goto exit_init_qos;
++
++				ret = msm_bus_qos_enable_clk(node_dev);
++				if (ret < 0) {
++					MSM_BUS_ERR("Can't Enable QoS clk %d",
++					node_dev->node_info->id);
++					goto exit_init_qos;
++				}
++
++				bus_node_info->fabdev->noc_ops.qos_init(
++					node_dev,
++					bus_node_info->fabdev->qos_base,
++					bus_node_info->fabdev->base_offset,
++					bus_node_info->fabdev->qos_off,
++					bus_node_info->fabdev->qos_freq);
++				msm_bus_qos_disable_clk(node_dev, ret);
++			}
++		} else
++			MSM_BUS_ERR("%s: Skipping QOS init for %d",
++				__func__, node_dev->node_info->id);
++	}
++exit_init_qos:
++	return ret;
++}
++
++static int msm_bus_fabric_init(struct device *dev,
++			struct msm_bus_node_device_type *pdata)
++{
++	struct msm_bus_fab_device_type *fabdev;
++	struct msm_bus_node_device_type *node_dev = NULL;
++	int ret = 0;
++
++	node_dev = dev->platform_data;
++	if (!node_dev) {
++		MSM_BUS_ERR("%s: Unable to get bus device info" , __func__);
++		ret = -ENXIO;
++		goto exit_fabric_init;
++	}
++
++	if (node_dev->node_info->virt_dev) {
++		MSM_BUS_ERR("%s: Skip Fab init for virtual device %d", __func__,
++						node_dev->node_info->id);
++		goto exit_fabric_init;
++	}
++
++	fabdev = devm_kzalloc(dev, sizeof(struct msm_bus_fab_device_type),
++								GFP_KERNEL);
++	if (!fabdev) {
++		MSM_BUS_ERR("Fabric alloc failed\n");
++		ret = -ENOMEM;
++		goto exit_fabric_init;
++	}
++
++	node_dev->fabdev = fabdev;
++	fabdev->pqos_base = pdata->fabdev->pqos_base;
++	fabdev->qos_range = pdata->fabdev->qos_range;
++	fabdev->base_offset = pdata->fabdev->base_offset;
++	fabdev->qos_off = pdata->fabdev->qos_off;
++	fabdev->qos_freq = pdata->fabdev->qos_freq;
++	fabdev->bus_type = pdata->fabdev->bus_type;
++	fabdev->bypass_qos_prg = pdata->fabdev->bypass_qos_prg;
++	fabdev->util_fact = pdata->fabdev->util_fact;
++	fabdev->vrail_comp = pdata->fabdev->vrail_comp;
++	msm_bus_fab_init_noc_ops(node_dev);
++
++	fabdev->qos_base = devm_ioremap(dev,
++				fabdev->pqos_base, fabdev->qos_range);
++	if (!fabdev->qos_base) {
++		MSM_BUS_ERR("%s: Error remapping address 0x%zx :bus device %d",
++			__func__,
++			 (size_t)fabdev->pqos_base, node_dev->node_info->id);
++		ret = -ENOMEM;
++		goto exit_fabric_init;
++	}
++
++	/*if (msmbus_coresight_init(pdev))
++		pr_warn("Coresight support absent for bus: %d\n", pdata->id);*/
++exit_fabric_init:
++	return ret;
++}
++
++static int msm_bus_init_clk(struct device *bus_dev,
++				struct msm_bus_node_device_type *pdata)
++{
++	unsigned int ctx;
++	int ret = 0;
++	struct msm_bus_node_device_type *node_dev = bus_dev->platform_data;
++
++	for (ctx = 0; ctx < NUM_CTX; ctx++) {
++		if (!IS_ERR_OR_NULL(pdata->clk[ctx].clk)) {
++			node_dev->clk[ctx].clk = pdata->clk[ctx].clk;
++			node_dev->clk[ctx].enable = false;
++			node_dev->clk[ctx].dirty = false;
++			MSM_BUS_ERR("%s: Valid node clk node %d ctx %d",
++				__func__, node_dev->node_info->id, ctx);
++		}
++	}
++
++	if (!IS_ERR_OR_NULL(pdata->qos_clk.clk)) {
++		node_dev->qos_clk.clk = pdata->qos_clk.clk;
++		node_dev->qos_clk.enable = false;
++		MSM_BUS_ERR("%s: Valid Iface clk node %d", __func__,
++						node_dev->node_info->id);
++	}
++
++	return ret;
++}
++
++static int msm_bus_copy_node_info(struct msm_bus_node_device_type *pdata,
++				struct device *bus_dev)
++{
++	int ret = 0;
++	struct msm_bus_node_info_type *node_info = NULL;
++	struct msm_bus_node_info_type *pdata_node_info = NULL;
++	struct msm_bus_node_device_type *bus_node = NULL;
++
++	bus_node = bus_dev->platform_data;
++
++	if (!bus_node || !pdata) {
++		ret = -ENXIO;
++		MSM_BUS_ERR("%s: Invalid pointers pdata %p, bus_node %p",
++			__func__, pdata, bus_node);
++		goto exit_copy_node_info;
++	}
++
++	node_info = bus_node->node_info;
++	pdata_node_info = pdata->node_info;
++
++	node_info->name = pdata_node_info->name;
++	node_info->id =  pdata_node_info->id;
++	node_info->bus_device_id = pdata_node_info->bus_device_id;
++	node_info->mas_rpm_id = pdata_node_info->mas_rpm_id;
++	node_info->slv_rpm_id = pdata_node_info->slv_rpm_id;
++	node_info->num_connections = pdata_node_info->num_connections;
++	node_info->num_blist = pdata_node_info->num_blist;
++	node_info->num_qports = pdata_node_info->num_qports;
++	node_info->buswidth = pdata_node_info->buswidth;
++	node_info->virt_dev = pdata_node_info->virt_dev;
++	node_info->is_fab_dev = pdata_node_info->is_fab_dev;
++	node_info->qos_params.mode = pdata_node_info->qos_params.mode;
++	node_info->qos_params.prio1 = pdata_node_info->qos_params.prio1;
++	node_info->qos_params.prio0 = pdata_node_info->qos_params.prio0;
++	node_info->qos_params.prio_lvl = pdata_node_info->qos_params.prio_lvl;
++	node_info->qos_params.prio_rd = pdata_node_info->qos_params.prio_rd;
++	node_info->qos_params.prio_wr = pdata_node_info->qos_params.prio_wr;
++	node_info->qos_params.gp = pdata_node_info->qos_params.gp;
++	node_info->qos_params.thmp = pdata_node_info->qos_params.thmp;
++	node_info->qos_params.ws = pdata_node_info->qos_params.ws;
++	node_info->qos_params.bw_buffer = pdata_node_info->qos_params.bw_buffer;
++	node_info->util_fact = pdata_node_info->util_fact;
++	node_info->vrail_comp = pdata_node_info->vrail_comp;
++
++	node_info->dev_connections = devm_kzalloc(bus_dev,
++			sizeof(struct device *) *
++				pdata_node_info->num_connections,
++			GFP_KERNEL);
++	if (!node_info->dev_connections) {
++		MSM_BUS_ERR("%s:Bus dev connections alloc failed\n", __func__);
++		ret = -ENOMEM;
++		goto exit_copy_node_info;
++	}
++
++	node_info->connections = devm_kzalloc(bus_dev,
++			sizeof(int) * pdata_node_info->num_connections,
++			GFP_KERNEL);
++	if (!node_info->connections) {
++		MSM_BUS_ERR("%s:Bus connections alloc failed\n", __func__);
++		devm_kfree(bus_dev, node_info->dev_connections);
++		ret = -ENOMEM;
++		goto exit_copy_node_info;
++	}
++
++	memcpy(node_info->connections,
++		pdata_node_info->connections,
++		sizeof(int) * pdata_node_info->num_connections);
++
++	node_info->black_connections = devm_kzalloc(bus_dev,
++			sizeof(struct device *) *
++				pdata_node_info->num_blist,
++			GFP_KERNEL);
++	if (!node_info->black_connections) {
++		MSM_BUS_ERR("%s: Bus black connections alloc failed\n",
++			__func__);
++		devm_kfree(bus_dev, node_info->dev_connections);
++		devm_kfree(bus_dev, node_info->connections);
++		ret = -ENOMEM;
++		goto exit_copy_node_info;
++	}
++
++	node_info->black_listed_connections = devm_kzalloc(bus_dev,
++			pdata_node_info->num_blist * sizeof(int),
++			GFP_KERNEL);
++	if (!node_info->black_listed_connections) {
++		MSM_BUS_ERR("%s:Bus black list connections alloc failed\n",
++					__func__);
++		devm_kfree(bus_dev, node_info->black_connections);
++		devm_kfree(bus_dev, node_info->dev_connections);
++		devm_kfree(bus_dev, node_info->connections);
++		ret = -ENOMEM;
++		goto exit_copy_node_info;
++	}
++
++	memcpy(node_info->black_listed_connections,
++		pdata_node_info->black_listed_connections,
++		sizeof(int) * pdata_node_info->num_blist);
++
++	node_info->qport = devm_kzalloc(bus_dev,
++			sizeof(int) * pdata_node_info->num_qports,
++			GFP_KERNEL);
++	if (!node_info->qport) {
++		MSM_BUS_ERR("%s:Bus qport allocation failed\n", __func__);
++		devm_kfree(bus_dev, node_info->dev_connections);
++		devm_kfree(bus_dev, node_info->connections);
++		devm_kfree(bus_dev, node_info->black_listed_connections);
++		ret = -ENOMEM;
++		goto exit_copy_node_info;
++	}
++
++	memcpy(node_info->qport,
++		pdata_node_info->qport,
++		sizeof(int) * pdata_node_info->num_qports);
++
++exit_copy_node_info:
++	return ret;
++}
++
++static struct device *msm_bus_device_init(
++			struct msm_bus_node_device_type *pdata)
++{
++	struct device *bus_dev = NULL;
++	struct msm_bus_node_device_type *bus_node = NULL;
++	struct msm_bus_node_info_type *node_info = NULL;
++	int ret = 0;
++
++	bus_dev = kzalloc(sizeof(struct device), GFP_KERNEL);
++	if (!bus_dev) {
++		MSM_BUS_ERR("%s:Device alloc failed\n", __func__);
++		bus_dev = NULL;
++		goto exit_device_init;
++	}
++	/**
++	* Init here so we can use devm calls
++	*/
++	device_initialize(bus_dev);
++
++	bus_node = devm_kzalloc(bus_dev,
++			sizeof(struct msm_bus_node_device_type), GFP_KERNEL);
++	if (!bus_node) {
++		MSM_BUS_ERR("%s:Bus node alloc failed\n", __func__);
++		kfree(bus_dev);
++		bus_dev = NULL;
++		goto exit_device_init;
++	}
++
++	node_info = devm_kzalloc(bus_dev,
++			sizeof(struct msm_bus_node_info_type), GFP_KERNEL);
++	if (!node_info) {
++		MSM_BUS_ERR("%s:Bus node info alloc failed\n", __func__);
++		devm_kfree(bus_dev, bus_node);
++		kfree(bus_dev);
++		bus_dev = NULL;
++		goto exit_device_init;
++	}
++
++	bus_node->node_info = node_info;
++	bus_node->ap_owned = pdata->ap_owned;
++	bus_dev->platform_data = bus_node;
++
++	if (msm_bus_copy_node_info(pdata, bus_dev) < 0) {
++		devm_kfree(bus_dev, bus_node);
++		devm_kfree(bus_dev, node_info);
++		kfree(bus_dev);
++		bus_dev = NULL;
++		goto exit_device_init;
++	}
++
++	bus_dev->bus = &msm_bus_type;
++	dev_set_name(bus_dev, bus_node->node_info->name);
++
++	ret = device_add(bus_dev);
++	if (ret < 0) {
++		MSM_BUS_ERR("%s: Error registering device %d",
++				__func__, pdata->node_info->id);
++		devm_kfree(bus_dev, bus_node);
++		devm_kfree(bus_dev, node_info->dev_connections);
++		devm_kfree(bus_dev, node_info->connections);
++		devm_kfree(bus_dev, node_info->black_connections);
++		devm_kfree(bus_dev, node_info->black_listed_connections);
++		devm_kfree(bus_dev, node_info);
++		kfree(bus_dev);
++		bus_dev = NULL;
++		goto exit_device_init;
++	}
++	device_create_file(bus_dev, &dev_attr_vrail);
++
++exit_device_init:
++	return bus_dev;
++}
++
++static int msm_bus_setup_dev_conn(struct device *bus_dev, void *data)
++{
++	struct msm_bus_node_device_type *bus_node = NULL;
++	int ret = 0;
++	int j;
++
++	bus_node = bus_dev->platform_data;
++	if (!bus_node) {
++		MSM_BUS_ERR("%s: Can't get device info", __func__);
++		ret = -ENODEV;
++		goto exit_setup_dev_conn;
++	}
++
++	/* Setup parent bus device for this node */
++	if (!bus_node->node_info->is_fab_dev) {
++		struct device *bus_parent_device =
++			bus_find_device(&msm_bus_type, NULL,
++				(void *)&bus_node->node_info->bus_device_id,
++				msm_bus_device_match_adhoc);
++
++		if (!bus_parent_device) {
++			MSM_BUS_ERR("%s: Error finding parentdev %d parent %d",
++				__func__,
++				bus_node->node_info->id,
++				bus_node->node_info->bus_device_id);
++			ret = -ENXIO;
++			goto exit_setup_dev_conn;
++		}
++		bus_node->node_info->bus_device = bus_parent_device;
++	}
++
++	bus_node->node_info->is_traversed = false;
++
++	for (j = 0; j < bus_node->node_info->num_connections; j++) {
++		bus_node->node_info->dev_connections[j] =
++			bus_find_device(&msm_bus_type, NULL,
++				(void *)&bus_node->node_info->connections[j],
++				msm_bus_device_match_adhoc);
++
++		if (!bus_node->node_info->dev_connections[j]) {
++			MSM_BUS_ERR("%s: Error finding conn %d for device %d",
++				__func__, bus_node->node_info->connections[j],
++				 bus_node->node_info->id);
++			ret = -ENODEV;
++			goto exit_setup_dev_conn;
++		}
++	}
++
++	for (j = 0; j < bus_node->node_info->num_blist; j++) {
++		bus_node->node_info->black_connections[j] =
++			bus_find_device(&msm_bus_type, NULL,
++				(void *)&bus_node->node_info->
++				black_listed_connections[j],
++				msm_bus_device_match_adhoc);
++
++		if (!bus_node->node_info->black_connections[j]) {
++			MSM_BUS_ERR("%s: Error finding conn %d for device %d\n",
++				__func__, bus_node->node_info->
++				black_listed_connections[j],
++				bus_node->node_info->id);
++			ret = -ENODEV;
++			goto exit_setup_dev_conn;
++		}
++	}
++
++exit_setup_dev_conn:
++	return ret;
++}
++
++static int msm_bus_node_debug(struct device *bus_dev, void *data)
++{
++	int j;
++	int ret = 0;
++	struct msm_bus_node_device_type *bus_node = NULL;
++
++	bus_node = bus_dev->platform_data;
++	if (!bus_node) {
++		MSM_BUS_ERR("%s: Can't get device info", __func__);
++		ret = -ENODEV;
++		goto exit_node_debug;
++	}
++
++	MSM_BUS_DBG("Device = %d buswidth %u", bus_node->node_info->id,
++				bus_node->node_info->buswidth);
++	for (j = 0; j < bus_node->node_info->num_connections; j++) {
++		struct msm_bus_node_device_type *bdev =
++			(struct msm_bus_node_device_type *)
++			bus_node->node_info->dev_connections[j]->platform_data;
++		MSM_BUS_DBG("\n\t Connection[%d] %d", j, bdev->node_info->id);
++	}
++
++exit_node_debug:
++	return ret;
++}
++
++static int msm_bus_device_probe(struct platform_device *pdev)
++{
++	unsigned int i, ret;
++	struct msm_bus_device_node_registration *pdata;
++
++	/* If possible, get pdata from device-tree */
++	if (pdev->dev.of_node)
++		pdata = msm_bus_of_to_pdata(pdev);
++	else {
++		pdata = (struct msm_bus_device_node_registration *)pdev->
++			dev.platform_data;
++	}
++
++	if (IS_ERR_OR_NULL(pdata)) {
++		MSM_BUS_ERR("No platform data found");
++		ret = -ENODATA;
++		goto exit_device_probe;
++	}
++
++	for (i = 0; i < pdata->num_devices; i++) {
++		struct device *node_dev = NULL;
++
++		node_dev = msm_bus_device_init(&pdata->info[i]);
++
++		if (!node_dev) {
++			MSM_BUS_ERR("%s: Error during dev init for %d",
++				__func__, pdata->info[i].node_info->id);
++			ret = -ENXIO;
++			goto exit_device_probe;
++		}
++
++		ret = msm_bus_init_clk(node_dev, &pdata->info[i]);
++		/*Is this a fabric device ?*/
++		if (pdata->info[i].node_info->is_fab_dev) {
++			MSM_BUS_DBG("%s: %d is a fab", __func__,
++						pdata->info[i].node_info->id);
++			ret = msm_bus_fabric_init(node_dev, &pdata->info[i]);
++			if (ret) {
++				MSM_BUS_ERR("%s: Error intializing fab %d",
++					__func__, pdata->info[i].node_info->id);
++				goto exit_device_probe;
++			}
++		}
++	}
++
++	ret = bus_for_each_dev(&msm_bus_type, NULL, NULL,
++						msm_bus_setup_dev_conn);
++	if (ret) {
++		MSM_BUS_ERR("%s: Error setting up dev connections", __func__);
++		goto exit_device_probe;
++	}
++
++	ret = bus_for_each_dev(&msm_bus_type, NULL, NULL, msm_bus_dev_init_qos);
++	if (ret) {
++		MSM_BUS_ERR("%s: Error during qos init", __func__);
++		goto exit_device_probe;
++	}
++
++	bus_for_each_dev(&msm_bus_type, NULL, NULL, msm_bus_node_debug);
++
++	/* Register the arb layer ops */
++	msm_bus_arb_setops_adhoc(&arb_ops);
++	devm_kfree(&pdev->dev, pdata->info);
++	devm_kfree(&pdev->dev, pdata);
++exit_device_probe:
++	return ret;
++}
++
++static int msm_bus_device_rules_probe(struct platform_device *pdev)
++{
++	struct bus_rule_type *rule_data = NULL;
++	int num_rules = 0;
++
++	num_rules = msm_bus_of_get_static_rules(pdev, &rule_data);
++
++	if (!rule_data)
++		goto exit_rules_probe;
++
++	msm_rule_register(num_rules, rule_data, NULL);
++	static_rules.num_rules = num_rules;
++	static_rules.rules = rule_data;
++	pdev->dev.platform_data = &static_rules;
++
++exit_rules_probe:
++	return 0;
++}
++
++int msm_bus_device_rules_remove(struct platform_device *pdev)
++{
++	struct static_rules_type *static_rules = NULL;
++
++	static_rules = pdev->dev.platform_data;
++	if (static_rules)
++		msm_rule_unregister(static_rules->num_rules,
++					static_rules->rules, NULL);
++	return 0;
++}
++
++static int msm_bus_free_dev(struct device *dev, void *data)
++{
++	struct msm_bus_node_device_type *bus_node = NULL;
++
++	bus_node = dev->platform_data;
++
++	if (bus_node)
++		MSM_BUS_ERR("\n%s: Removing device %d", __func__,
++						bus_node->node_info->id);
++	device_unregister(dev);
++	return 0;
++}
++
++int msm_bus_device_remove(struct platform_device *pdev)
++{
++	bus_for_each_dev(&msm_bus_type, NULL, NULL, msm_bus_free_dev);
++	return 0;
++}
++
++static struct of_device_id rules_match[] = {
++	{.compatible = "qcom,msm-bus-static-bw-rules"},
++	{}
++};
++
++static struct platform_driver msm_bus_rules_driver = {
++	.probe = msm_bus_device_rules_probe,
++	.remove = msm_bus_device_rules_remove,
++	.driver = {
++		.name = "msm_bus_rules_device",
++		.owner = THIS_MODULE,
++		.of_match_table = rules_match,
++	},
++};
++
++static struct of_device_id fabric_match[] = {
++	{.compatible = "qcom,msm-bus-device"},
++	{}
++};
++
++static struct platform_driver msm_bus_device_driver = {
++	.probe = msm_bus_device_probe,
++	.remove = msm_bus_device_remove,
++	.driver = {
++		.name = "msm_bus_device",
++		.owner = THIS_MODULE,
++		.of_match_table = fabric_match,
++	},
++};
++
++int __init msm_bus_device_init_driver(void)
++{
++	int rc;
++
++	MSM_BUS_ERR("msm_bus_fabric_init_driver\n");
++	rc =  platform_driver_register(&msm_bus_device_driver);
++
++	if (rc) {
++		MSM_BUS_ERR("Failed to register bus device driver");
++		return rc;
++	}
++	return platform_driver_register(&msm_bus_rules_driver);
++}
++subsys_initcall(msm_bus_device_init_driver);
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_id.c
+@@ -0,0 +1,94 @@
++/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include "msm-bus.h"
++#include "msm-bus-board.h"
++#include "msm_bus_core.h"
++#include "msm_bus_noc.h"
++#include "msm_bus_bimc.h"
++
++static uint32_t master_iids[MSM_BUS_MASTER_LAST];
++static uint32_t slave_iids[MSM_BUS_SLAVE_LAST - SLAVE_ID_KEY];
++
++static void msm_bus_assign_iids(struct msm_bus_fabric_registration
++	*fabreg, int fabid)
++{
++	int i;
++	for (i = 0; i < fabreg->len; i++) {
++		if (!fabreg->info[i].gateway) {
++			fabreg->info[i].priv_id = fabid + fabreg->info[i].id;
++			if (fabreg->info[i].id < SLAVE_ID_KEY) {
++				if (fabreg->info[i].id >= MSM_BUS_MASTER_LAST) {
++					WARN(1, "id %d exceeds array size!\n",
++						fabreg->info[i].id);
++					continue;
++				}
++
++				master_iids[fabreg->info[i].id] =
++					fabreg->info[i].priv_id;
++			} else {
++				if ((fabreg->info[i].id - SLAVE_ID_KEY) >=
++					(MSM_BUS_SLAVE_LAST - SLAVE_ID_KEY)) {
++					WARN(1, "id %d exceeds array size!\n",
++						fabreg->info[i].id);
++					continue;
++				}
++
++				slave_iids[fabreg->info[i].id - (SLAVE_ID_KEY)]
++					= fabreg->info[i].priv_id;
++			}
++		} else {
++			fabreg->info[i].priv_id = fabreg->info[i].id;
++		}
++	}
++}
++
++static int msm_bus_get_iid(int id)
++{
++	if ((id < SLAVE_ID_KEY && id >= MSM_BUS_MASTER_LAST) ||
++		id >= MSM_BUS_SLAVE_LAST) {
++		MSM_BUS_ERR("Cannot get iid. Invalid id %d passed\n", id);
++		return -EINVAL;
++	}
++
++	return CHECK_ID(((id < SLAVE_ID_KEY) ? master_iids[id] :
++		slave_iids[id - SLAVE_ID_KEY]), id);
++}
++
++static struct msm_bus_board_algorithm msm_bus_id_algo = {
++	.get_iid = msm_bus_get_iid,
++	.assign_iids = msm_bus_assign_iids,
++};
++
++int msm_bus_board_rpm_get_il_ids(uint16_t *id)
++{
++	return -ENXIO;
++}
++
++void msm_bus_board_init(struct msm_bus_fabric_registration *pdata)
++{
++	pdata->board_algo = &msm_bus_id_algo;
++}
++
++void msm_bus_board_set_nfab(struct msm_bus_fabric_registration *pdata,
++	int nfab)
++{
++	if (nfab <= 0)
++		return;
++
++	msm_bus_id_algo.board_nfab = nfab;
++}
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_noc.c
+@@ -0,0 +1,770 @@
++/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "AXI: NOC: %s(): " fmt, __func__
++
++#include <linux/slab.h>
++#include <linux/io.h>
++#include "msm-bus-board.h"
++#include "msm_bus_core.h"
++#include "msm_bus_noc.h"
++#include "msm_bus_adhoc.h"
++
++/* NOC_QOS generic */
++#define __CLZ(x) ((8 * sizeof(uint32_t)) - 1 - __fls(x))
++#define SAT_SCALE 16	/* 16 bytes minimum for saturation */
++#define BW_SCALE  256	/* 1/256 byte per cycle unit */
++#define QOS_DEFAULT_BASEOFFSET		0x00003000
++#define QOS_DEFAULT_DELTA		0x80
++#define MAX_BW_FIELD (NOC_QOS_BWn_BW_BMSK >> NOC_QOS_BWn_BW_SHFT)
++#define MAX_SAT_FIELD (NOC_QOS_SATn_SAT_BMSK >> NOC_QOS_SATn_SAT_SHFT)
++
++#define NOC_QOS_REG_BASE(b, o)		((b) + (o))
++
++#define NOC_QOS_ID_COREIDn_ADDR(b, o, n, d) \
++	(NOC_QOS_REG_BASE(b, o) + (d) * (n))
++enum noc_qos_id_coreidn {
++	NOC_QOS_ID_COREIDn_RMSK			= 0xffffffff,
++	NOC_QOS_ID_COREIDn_MAXn			= 32,
++	NOC_QOS_ID_COREIDn_CORECHSUM_BMSK	= 0xffffff00,
++	NOC_QOS_ID_COREIDn_CORECHSUM_SHFT	= 0x8,
++	NOC_QOS_ID_COREIDn_CORETYPEID_BMSK	= 0xff,
++	NOC_QOS_ID_COREIDn_CORETYPEID_SHFT	= 0x0,
++};
++
++#define NOC_QOS_ID_REVISIONIDn_ADDR(b, o, n, d) \
++	(NOC_QOS_REG_BASE(b, o) + 0x4 + (d) * (n))
++enum noc_qos_id_revisionidn {
++	NOC_QOS_ID_REVISIONIDn_RMSK		= 0xffffffff,
++	NOC_QOS_ID_REVISIONIDn_MAXn		= 32,
++	NOC_QOS_ID_REVISIONIDn_FLEXNOCID_BMSK	= 0xffffff00,
++	NOC_QOS_ID_REVISIONIDn_FLEXNOCID_SHFT	= 0x8,
++	NOC_QOS_ID_REVISIONIDn_USERID_BMSK	= 0xff,
++	NOC_QOS_ID_REVISIONIDn_USERID_SHFT	= 0x0,
++};
++
++#define NOC_QOS_PRIORITYn_ADDR(b, o, n, d)	\
++	(NOC_QOS_REG_BASE(b, o) + 0x8 + (d) * (n))
++enum noc_qos_id_priorityn {
++	NOC_QOS_PRIORITYn_RMSK		= 0x0000000f,
++	NOC_QOS_PRIORITYn_MAXn		= 32,
++	NOC_QOS_PRIORITYn_P1_BMSK	= 0xc,
++	NOC_QOS_PRIORITYn_P1_SHFT	= 0x2,
++	NOC_QOS_PRIORITYn_P0_BMSK	= 0x3,
++	NOC_QOS_PRIORITYn_P0_SHFT	= 0x0,
++};
++
++#define NOC_QOS_MODEn_ADDR(b, o, n, d) \
++	(NOC_QOS_REG_BASE(b, o) + 0xC + (d) * (n))
++enum noc_qos_id_moden_rmsk {
++	NOC_QOS_MODEn_RMSK		= 0x00000003,
++	NOC_QOS_MODEn_MAXn		= 32,
++	NOC_QOS_MODEn_MODE_BMSK		= 0x3,
++	NOC_QOS_MODEn_MODE_SHFT		= 0x0,
++};
++
++#define NOC_QOS_BWn_ADDR(b, o, n, d) \
++	(NOC_QOS_REG_BASE(b, o) + 0x10 + (d) * (n))
++enum noc_qos_id_bwn {
++	NOC_QOS_BWn_RMSK		= 0x0000ffff,
++	NOC_QOS_BWn_MAXn		= 32,
++	NOC_QOS_BWn_BW_BMSK		= 0xffff,
++	NOC_QOS_BWn_BW_SHFT		= 0x0,
++};
++
++/* QOS Saturation registers */
++#define NOC_QOS_SATn_ADDR(b, o, n, d) \
++	(NOC_QOS_REG_BASE(b, o) + 0x14 + (d) * (n))
++enum noc_qos_id_saturationn {
++	NOC_QOS_SATn_RMSK		= 0x000003ff,
++	NOC_QOS_SATn_MAXn		= 32,
++	NOC_QOS_SATn_SAT_BMSK		= 0x3ff,
++	NOC_QOS_SATn_SAT_SHFT		= 0x0,
++};
++
++static int noc_div(uint64_t *a, uint32_t b)
++{
++	if ((*a > 0) && (*a < b))
++		return 1;
++	else
++		return do_div(*a, b);
++}
++
++/**
++ * Calculates bw hardware is using from register values
++ * bw returned is in bytes/sec
++ */
++static uint64_t noc_bw(uint32_t bw_field, uint32_t qos_freq)
++{
++	uint64_t res;
++	uint32_t rem, scale;
++
++	res = 2 * qos_freq * bw_field;
++	scale = BW_SCALE * 1000;
++	rem = noc_div(&res, scale);
++	MSM_BUS_DBG("NOC: Calculated bw: %llu\n", res * 1000000ULL);
++	return res * 1000000ULL;
++}
++
++static uint32_t noc_bw_ceil(long int bw_field, uint32_t qos_freq)
++{
++	uint64_t bw_temp = 2 * qos_freq * bw_field;
++	uint32_t scale = 1000 * BW_SCALE;
++	noc_div(&bw_temp, scale);
++	return bw_temp * 1000000;
++}
++#define MAX_BW(timebase) noc_bw_ceil(MAX_BW_FIELD, (timebase))
++
++/**
++ * Calculates ws hardware is using from register values
++ * ws returned is in nanoseconds
++ */
++static uint32_t noc_ws(uint64_t bw, uint32_t sat, uint32_t qos_freq)
++{
++	if (bw && qos_freq) {
++		uint32_t bwf = bw * qos_freq;
++		uint64_t scale = 1000000000000LL * BW_SCALE *
++			SAT_SCALE * sat;
++		noc_div(&scale, bwf);
++		MSM_BUS_DBG("NOC: Calculated ws: %llu\n", scale);
++		return scale;
++	}
++
++	return 0;
++}
++#define MAX_WS(bw, timebase) noc_ws((bw), MAX_SAT_FIELD, (timebase))
++
++/* Calculate bandwidth field value for requested bandwidth  */
++static uint32_t noc_bw_field(uint64_t bw, uint32_t qos_freq)
++{
++	uint32_t bw_field = 0;
++
++	if (bw) {
++		uint32_t rem;
++		uint64_t bw_capped = min_t(uint64_t, bw, MAX_BW(qos_freq));
++		uint64_t bwc = bw_capped * BW_SCALE;
++		uint64_t qf = 2 * qos_freq * 1000;
++
++		rem = noc_div(&bwc, qf);
++		bw_field = (uint32_t)min_t(uint64_t, bwc, MAX_BW_FIELD);
++	}
++
++	MSM_BUS_DBG("NOC: bw_field: %u\n", bw_field);
++	return bw_field;
++}
++
++static uint32_t noc_sat_field(uint64_t bw, uint32_t ws, uint32_t qos_freq)
++{
++	uint32_t sat_field = 0, win;
++
++	if (bw) {
++		/* Limit to max bw and scale bw to 100 KB increments */
++		uint64_t tbw, tscale;
++		uint64_t bw_scaled = min_t(uint64_t, bw, MAX_BW(qos_freq));
++		uint32_t rem = noc_div(&bw_scaled, 100000);
++
++		/**
++		 * Calculate saturation from windows size.
++		 * WS must be at least one arb period.
++		 * Saturation must not exceed max field size
++		 *
++		 * Bandwidth is in 100KB increments
++		 * Window size is in ns
++		 * qos_freq is in KHz
++		 */
++		win = max(ws, 1000000 / qos_freq);
++		tbw = bw_scaled * win * qos_freq;
++		tscale = 10000000ULL * BW_SCALE * SAT_SCALE;
++		rem = noc_div(&tbw, tscale);
++		sat_field = (uint32_t)min_t(uint64_t, tbw, MAX_SAT_FIELD);
++	}
++
++	MSM_BUS_DBG("NOC: sat_field: %d\n", sat_field);
++	return sat_field;
++}
++
++static void noc_set_qos_mode(void __iomem *base, uint32_t qos_off,
++		uint32_t mport, uint32_t qos_delta, uint8_t mode,
++		uint8_t perm_mode)
++{
++	if (mode < NOC_QOS_MODE_MAX &&
++		((1 << mode) & perm_mode)) {
++		uint32_t reg_val;
++
++		reg_val = readl_relaxed(NOC_QOS_MODEn_ADDR(base, qos_off,
++			mport, qos_delta)) & NOC_QOS_MODEn_RMSK;
++		writel_relaxed(((reg_val & (~(NOC_QOS_MODEn_MODE_BMSK))) |
++			(mode & NOC_QOS_MODEn_MODE_BMSK)),
++			NOC_QOS_MODEn_ADDR(base, qos_off, mport, qos_delta));
++	}
++	/* Ensure qos mode is set before exiting */
++	wmb();
++}
++
++static void noc_set_qos_priority(void __iomem *base, uint32_t qos_off,
++		uint32_t mport, uint32_t qos_delta,
++		struct msm_bus_noc_qos_priority *priority)
++{
++	uint32_t reg_val, val;
++
++	reg_val = readl_relaxed(NOC_QOS_PRIORITYn_ADDR(base, qos_off, mport,
++		qos_delta)) & NOC_QOS_PRIORITYn_RMSK;
++	val = priority->p1 << NOC_QOS_PRIORITYn_P1_SHFT;
++	writel_relaxed(((reg_val & (~(NOC_QOS_PRIORITYn_P1_BMSK))) |
++		(val & NOC_QOS_PRIORITYn_P1_BMSK)),
++		NOC_QOS_PRIORITYn_ADDR(base, qos_off, mport, qos_delta));
++
++	reg_val = readl_relaxed(NOC_QOS_PRIORITYn_ADDR(base, qos_off, mport,
++								qos_delta))
++		& NOC_QOS_PRIORITYn_RMSK;
++	writel_relaxed(((reg_val & (~(NOC_QOS_PRIORITYn_P0_BMSK))) |
++		(priority->p0 & NOC_QOS_PRIORITYn_P0_BMSK)),
++		NOC_QOS_PRIORITYn_ADDR(base, qos_off, mport, qos_delta));
++	/* Ensure qos priority is set before exiting */
++	wmb();
++}
++
++static void msm_bus_noc_set_qos_bw(void __iomem *base, uint32_t qos_off,
++		uint32_t qos_freq, uint32_t mport, uint32_t qos_delta,
++		uint8_t perm_mode, struct msm_bus_noc_qos_bw *qbw)
++{
++	uint32_t reg_val, val, mode;
++
++	if (!qos_freq) {
++		MSM_BUS_DBG("Zero QoS Freq\n");
++		return;
++	}
++
++
++	/* If Limiter or Regulator modes are not supported, bw not available*/
++	if (perm_mode & (NOC_QOS_PERM_MODE_LIMITER |
++		NOC_QOS_PERM_MODE_REGULATOR)) {
++		uint32_t bw_val = noc_bw_field(qbw->bw, qos_freq);
++		uint32_t sat_val = noc_sat_field(qbw->bw, qbw->ws,
++			qos_freq);
++
++		MSM_BUS_DBG("NOC: BW: perm_mode: %d bw_val: %d, sat_val: %d\n",
++			perm_mode, bw_val, sat_val);
++		/*
++		 * If in Limiter/Regulator mode, first go to fixed mode.
++		 * Clear QoS accumulator
++		 **/
++		mode = readl_relaxed(NOC_QOS_MODEn_ADDR(base, qos_off,
++			mport, qos_delta)) & NOC_QOS_MODEn_MODE_BMSK;
++		if (mode == NOC_QOS_MODE_REGULATOR || mode ==
++			NOC_QOS_MODE_LIMITER) {
++			reg_val = readl_relaxed(NOC_QOS_MODEn_ADDR(
++				base, qos_off, mport, qos_delta));
++			val = NOC_QOS_MODE_FIXED;
++			writel_relaxed((reg_val & (~(NOC_QOS_MODEn_MODE_BMSK)))
++				| (val & NOC_QOS_MODEn_MODE_BMSK),
++				NOC_QOS_MODEn_ADDR(base, qos_off, mport,
++								qos_delta));
++		}
++
++		reg_val = readl_relaxed(NOC_QOS_BWn_ADDR(base, qos_off, mport,
++								qos_delta));
++		val = bw_val << NOC_QOS_BWn_BW_SHFT;
++		writel_relaxed(((reg_val & (~(NOC_QOS_BWn_BW_BMSK))) |
++			(val & NOC_QOS_BWn_BW_BMSK)),
++			NOC_QOS_BWn_ADDR(base, qos_off, mport, qos_delta));
++
++		MSM_BUS_DBG("NOC: BW: Wrote value: 0x%x\n", ((reg_val &
++			(~NOC_QOS_BWn_BW_BMSK)) | (val &
++			NOC_QOS_BWn_BW_BMSK)));
++
++		reg_val = readl_relaxed(NOC_QOS_SATn_ADDR(base, qos_off,
++			mport, qos_delta));
++		val = sat_val << NOC_QOS_SATn_SAT_SHFT;
++		writel_relaxed(((reg_val & (~(NOC_QOS_SATn_SAT_BMSK))) |
++			(val & NOC_QOS_SATn_SAT_BMSK)),
++			NOC_QOS_SATn_ADDR(base, qos_off, mport, qos_delta));
++
++		MSM_BUS_DBG("NOC: SAT: Wrote value: 0x%x\n", ((reg_val &
++			(~NOC_QOS_SATn_SAT_BMSK)) | (val &
++			NOC_QOS_SATn_SAT_BMSK)));
++
++		/* Set mode back to what it was initially */
++		reg_val = readl_relaxed(NOC_QOS_MODEn_ADDR(base, qos_off,
++			mport, qos_delta));
++		writel_relaxed((reg_val & (~(NOC_QOS_MODEn_MODE_BMSK)))
++			| (mode & NOC_QOS_MODEn_MODE_BMSK),
++			NOC_QOS_MODEn_ADDR(base, qos_off, mport, qos_delta));
++		/* Ensure that all writes for bandwidth registers have
++		 * completed before returning
++		 */
++		wmb();
++	}
++}
++
++uint8_t msm_bus_noc_get_qos_mode(void __iomem *base, uint32_t qos_off,
++	uint32_t mport, uint32_t qos_delta, uint32_t mode, uint32_t perm_mode)
++{
++	if (NOC_QOS_MODES_ALL_PERM == perm_mode)
++		return readl_relaxed(NOC_QOS_MODEn_ADDR(base, qos_off,
++			mport, qos_delta)) & NOC_QOS_MODEn_MODE_BMSK;
++	else
++		return 31 - __CLZ(mode &
++			NOC_QOS_MODES_ALL_PERM);
++}
++
++void msm_bus_noc_get_qos_priority(void __iomem *base, uint32_t qos_off,
++	uint32_t mport, uint32_t qos_delta,
++	struct msm_bus_noc_qos_priority *priority)
++{
++	priority->p1 = (readl_relaxed(NOC_QOS_PRIORITYn_ADDR(base, qos_off,
++		mport, qos_delta)) & NOC_QOS_PRIORITYn_P1_BMSK) >>
++		NOC_QOS_PRIORITYn_P1_SHFT;
++
++	priority->p0 = (readl_relaxed(NOC_QOS_PRIORITYn_ADDR(base, qos_off,
++		mport, qos_delta)) & NOC_QOS_PRIORITYn_P0_BMSK) >>
++		NOC_QOS_PRIORITYn_P0_SHFT;
++}
++
++void msm_bus_noc_get_qos_bw(void __iomem *base, uint32_t qos_off,
++	uint32_t qos_freq,
++	uint32_t mport, uint32_t qos_delta, uint8_t perm_mode,
++	struct msm_bus_noc_qos_bw *qbw)
++{
++	if (perm_mode & (NOC_QOS_PERM_MODE_LIMITER |
++		NOC_QOS_PERM_MODE_REGULATOR)) {
++		uint32_t bw_val = readl_relaxed(NOC_QOS_BWn_ADDR(
++			base, qos_off, mport, qos_delta)) & NOC_QOS_BWn_BW_BMSK;
++		uint32_t sat = readl_relaxed(NOC_QOS_SATn_ADDR(
++			base, qos_off, mport, qos_delta))
++						& NOC_QOS_SATn_SAT_BMSK;
++
++		qbw->bw = noc_bw(bw_val, qos_freq);
++		qbw->ws = noc_ws(qbw->bw, sat, qos_freq);
++	} else {
++		qbw->bw = 0;
++		qbw->ws = 0;
++	}
++}
++
++static int msm_bus_noc_mas_init(struct msm_bus_noc_info *ninfo,
++	struct msm_bus_inode_info *info)
++{
++	int i;
++	struct msm_bus_noc_qos_priority *prio;
++	prio = kzalloc(sizeof(struct msm_bus_noc_qos_priority),
++		GFP_KERNEL);
++	if (!prio) {
++		MSM_BUS_WARN("Couldn't alloc prio data for node: %d\n",
++			info->node_info->id);
++		return -ENOMEM;
++	}
++
++	prio->read_prio = info->node_info->prio_rd;
++	prio->write_prio = info->node_info->prio_wr;
++	prio->p1 = info->node_info->prio1;
++	prio->p0 = info->node_info->prio0;
++	info->hw_data = (void *)prio;
++
++	if (!info->node_info->qport) {
++		MSM_BUS_DBG("No QoS Ports to init\n");
++		return 0;
++	}
++
++	for (i = 0; i < info->node_info->num_mports; i++) {
++		if (info->node_info->mode != NOC_QOS_MODE_BYPASS) {
++			noc_set_qos_priority(ninfo->base, ninfo->qos_baseoffset,
++				info->node_info->qport[i], ninfo->qos_delta,
++				prio);
++
++			if (info->node_info->mode != NOC_QOS_MODE_FIXED) {
++				struct msm_bus_noc_qos_bw qbw;
++				qbw.ws = info->node_info->ws;
++				qbw.bw = 0;
++				msm_bus_noc_set_qos_bw(ninfo->base,
++					ninfo->qos_baseoffset,
++					ninfo->qos_freq, info->node_info->
++					qport[i], ninfo->qos_delta,
++					info->node_info->perm_mode,
++					&qbw);
++			}
++		}
++
++		noc_set_qos_mode(ninfo->base, ninfo->qos_baseoffset,
++			info->node_info->qport[i], ninfo->qos_delta,
++			info->node_info->mode,
++			info->node_info->perm_mode);
++	}
++
++	return 0;
++}
++
++static void msm_bus_noc_node_init(void *hw_data,
++	struct msm_bus_inode_info *info)
++{
++	struct msm_bus_noc_info *ninfo =
++		(struct msm_bus_noc_info *)hw_data;
++
++	if (!IS_SLAVE(info->node_info->priv_id))
++		if (info->node_info->hw_sel != MSM_BUS_RPM)
++			msm_bus_noc_mas_init(ninfo, info);
++}
++
++static int msm_bus_noc_allocate_commit_data(struct msm_bus_fabric_registration
++	*fab_pdata, void **cdata, int ctx)
++{
++	struct msm_bus_noc_commit **cd = (struct msm_bus_noc_commit **)cdata;
++	struct msm_bus_noc_info *ninfo =
++		(struct msm_bus_noc_info *)fab_pdata->hw_data;
++
++	*cd = kzalloc(sizeof(struct msm_bus_noc_commit), GFP_KERNEL);
++	if (!*cd) {
++		MSM_BUS_DBG("Couldn't alloc mem for cdata\n");
++		return -ENOMEM;
++	}
++
++	(*cd)->mas = ninfo->cdata[ctx].mas;
++	(*cd)->slv = ninfo->cdata[ctx].slv;
++
++	return 0;
++}
++
++static void *msm_bus_noc_allocate_noc_data(struct platform_device *pdev,
++	struct msm_bus_fabric_registration *fab_pdata)
++{
++	struct resource *noc_mem;
++	struct resource *noc_io;
++	struct msm_bus_noc_info *ninfo;
++	int i;
++
++	ninfo = kzalloc(sizeof(struct msm_bus_noc_info), GFP_KERNEL);
++	if (!ninfo) {
++		MSM_BUS_DBG("Couldn't alloc mem for noc info\n");
++		return NULL;
++	}
++
++	ninfo->nmasters = fab_pdata->nmasters;
++	ninfo->nqos_masters = fab_pdata->nmasters;
++	ninfo->nslaves = fab_pdata->nslaves;
++	ninfo->qos_freq = fab_pdata->qos_freq;
++
++	if (!fab_pdata->qos_baseoffset)
++		ninfo->qos_baseoffset = QOS_DEFAULT_BASEOFFSET;
++	else
++		ninfo->qos_baseoffset = fab_pdata->qos_baseoffset;
++
++	if (!fab_pdata->qos_delta)
++		ninfo->qos_delta = QOS_DEFAULT_DELTA;
++	else
++		ninfo->qos_delta = fab_pdata->qos_delta;
++
++	ninfo->mas_modes = kzalloc(sizeof(uint32_t) * fab_pdata->nmasters,
++		GFP_KERNEL);
++	if (!ninfo->mas_modes) {
++		MSM_BUS_DBG("Couldn't alloc mem for noc master-modes\n");
++		kfree(ninfo);
++		return NULL;
++	}
++
++	for (i = 0; i < NUM_CTX; i++) {
++		ninfo->cdata[i].mas = kzalloc(sizeof(struct
++			msm_bus_node_hw_info) * fab_pdata->nmasters * 2,
++			GFP_KERNEL);
++		if (!ninfo->cdata[i].mas) {
++			MSM_BUS_DBG("Couldn't alloc mem for noc master-bw\n");
++			kfree(ninfo->mas_modes);
++			kfree(ninfo);
++			return NULL;
++		}
++
++		ninfo->cdata[i].slv = kzalloc(sizeof(struct
++			msm_bus_node_hw_info) * fab_pdata->nslaves * 2,
++			GFP_KERNEL);
++		if (!ninfo->cdata[i].slv) {
++			MSM_BUS_DBG("Couldn't alloc mem for noc master-bw\n");
++			kfree(ninfo->cdata[i].mas);
++			goto err;
++		}
++	}
++
++	/* If it's a virtual fabric, don't get memory info */
++	if (fab_pdata->virt)
++		goto skip_mem;
++
++	noc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!noc_mem && !fab_pdata->virt) {
++		MSM_BUS_ERR("Cannot get NoC Base address\n");
++		goto err;
++	}
++
++	noc_io = request_mem_region(noc_mem->start,
++			resource_size(noc_mem), pdev->name);
++	if (!noc_io) {
++		MSM_BUS_ERR("NoC memory unavailable\n");
++		goto err;
++	}
++
++	ninfo->base = ioremap(noc_mem->start, resource_size(noc_mem));
++	if (!ninfo->base) {
++		MSM_BUS_ERR("IOremap failed for NoC!\n");
++		release_mem_region(noc_mem->start, resource_size(noc_mem));
++		goto err;
++	}
++
++skip_mem:
++	fab_pdata->hw_data = (void *)ninfo;
++	return (void *)ninfo;
++
++err:
++	kfree(ninfo->mas_modes);
++	kfree(ninfo);
++	return NULL;
++}
++
++static void free_commit_data(void *cdata)
++{
++	struct msm_bus_noc_commit *cd = (struct msm_bus_noc_commit *)cdata;
++
++	kfree(cd->mas);
++	kfree(cd->slv);
++	kfree(cd);
++}
++
++static bool msm_bus_noc_update_bw_reg(int mode)
++{
++	bool ret = false;
++
++	if ((mode == NOC_QOS_MODE_LIMITER) ||
++			(mode == NOC_QOS_MODE_REGULATOR))
++			ret = true;
++
++	return ret;
++}
++
++static void msm_bus_noc_update_bw(struct msm_bus_inode_info *hop,
++	struct msm_bus_inode_info *info,
++	struct msm_bus_fabric_registration *fab_pdata,
++	void *sel_cdata, int *master_tiers,
++	int64_t add_bw)
++{
++	struct msm_bus_noc_info *ninfo;
++	struct msm_bus_noc_qos_bw qos_bw;
++	int i, ports;
++	int64_t bw;
++	struct msm_bus_noc_commit *sel_cd =
++		(struct msm_bus_noc_commit *)sel_cdata;
++
++	ninfo = (struct msm_bus_noc_info *)fab_pdata->hw_data;
++	if (!ninfo->qos_freq) {
++		MSM_BUS_DBG("NOC: No qos frequency to update bw\n");
++		return;
++	}
++
++	if (info->node_info->num_mports == 0) {
++		MSM_BUS_DBG("NOC: Skip Master BW\n");
++		goto skip_mas_bw;
++	}
++
++	ports = info->node_info->num_mports;
++	bw = INTERLEAVED_BW(fab_pdata, add_bw, ports);
++
++	MSM_BUS_DBG("NOC: Update bw for: %d: %lld\n",
++		info->node_info->priv_id, add_bw);
++	for (i = 0; i < ports; i++) {
++		sel_cd->mas[info->node_info->masterp[i]].bw += bw;
++		sel_cd->mas[info->node_info->masterp[i]].hw_id =
++			info->node_info->mas_hw_id;
++		MSM_BUS_DBG("NOC: Update mas_bw: ID: %d, BW: %llu ports:%d\n",
++			info->node_info->priv_id,
++			sel_cd->mas[info->node_info->masterp[i]].bw,
++			ports);
++		/* Check if info is a shared master.
++		 * If it is, mark it dirty
++		 * If it isn't, then set QOS Bandwidth
++		 **/
++		if (info->node_info->hw_sel == MSM_BUS_RPM)
++			sel_cd->mas[info->node_info->masterp[i]].dirty = 1;
++		else {
++			if (!info->node_info->qport) {
++				MSM_BUS_DBG("No qos ports to update!\n");
++				break;
++			}
++
++			if (!(info->node_info->mode == NOC_QOS_MODE_REGULATOR)
++					|| (info->node_info->mode ==
++						NOC_QOS_MODE_LIMITER)) {
++				MSM_BUS_DBG("Skip QoS reg programming\n");
++				break;
++			}
++			qos_bw.bw = sel_cd->mas[info->node_info->masterp[i]].
++				bw;
++			qos_bw.ws = info->node_info->ws;
++			msm_bus_noc_set_qos_bw(ninfo->base,
++				ninfo->qos_baseoffset,
++				ninfo->qos_freq,
++				info->node_info->qport[i], ninfo->qos_delta,
++				info->node_info->perm_mode, &qos_bw);
++			MSM_BUS_DBG("NOC: QoS: Update mas_bw: ws: %u\n",
++				qos_bw.ws);
++		}
++	}
++
++skip_mas_bw:
++	ports = hop->node_info->num_sports;
++	for (i = 0; i < ports; i++) {
++		sel_cd->slv[hop->node_info->slavep[i]].bw += add_bw;
++		sel_cd->slv[hop->node_info->slavep[i]].hw_id =
++			hop->node_info->slv_hw_id;
++		MSM_BUS_DBG("NOC: Update slave_bw for ID: %d -> %llu\n",
++			hop->node_info->priv_id,
++			sel_cd->slv[hop->node_info->slavep[i]].bw);
++		MSM_BUS_DBG("NOC: Update slave_bw for hw_id: %d, index: %d\n",
++			hop->node_info->slv_hw_id, hop->node_info->slavep[i]);
++		/* Check if hop is a shared slave.
++		 * If it is, mark it dirty
++		 * If it isn't, then nothing to be done as the
++		 * slaves are in bypass mode.
++		 **/
++		if (hop->node_info->hw_sel == MSM_BUS_RPM)
++			sel_cd->slv[hop->node_info->slavep[i]].dirty = 1;
++	}
++}
++
++static int msm_bus_noc_commit(struct msm_bus_fabric_registration
++	*fab_pdata, void *hw_data, void **cdata)
++{
++	MSM_BUS_DBG("\nReached NOC Commit\n");
++	msm_bus_remote_hw_commit(fab_pdata, hw_data, cdata);
++	return 0;
++}
++
++static int msm_bus_noc_port_halt(uint32_t haltid, uint8_t mport)
++{
++	return 0;
++}
++
++static int msm_bus_noc_port_unhalt(uint32_t haltid, uint8_t mport)
++{
++	return 0;
++}
++
++static int msm_bus_noc_qos_init(struct msm_bus_node_device_type *info,
++				void __iomem *qos_base,
++				uint32_t qos_off, uint32_t qos_delta,
++				uint32_t qos_freq)
++{
++	struct msm_bus_noc_qos_priority prio;
++	int ret = 0;
++	int i;
++
++	prio.p1 = info->node_info->qos_params.prio1;
++	prio.p0 = info->node_info->qos_params.prio0;
++
++	if (!info->node_info->qport) {
++		MSM_BUS_DBG("No QoS Ports to init\n");
++		ret = 0;
++		goto err_qos_init;
++	}
++
++	for (i = 0; i < info->node_info->num_qports; i++) {
++		if (info->node_info->qos_params.mode != NOC_QOS_MODE_BYPASS) {
++			noc_set_qos_priority(qos_base, qos_off,
++					info->node_info->qport[i], qos_delta,
++					&prio);
++
++			if (info->node_info->qos_params.mode !=
++							NOC_QOS_MODE_FIXED) {
++				struct msm_bus_noc_qos_bw qbw;
++				qbw.ws = info->node_info->qos_params.ws;
++				qbw.bw = 0;
++				msm_bus_noc_set_qos_bw(qos_base, qos_off,
++					qos_freq,
++					info->node_info->qport[i],
++					qos_delta,
++					info->node_info->qos_params.mode,
++					&qbw);
++			}
++		}
++
++		noc_set_qos_mode(qos_base, qos_off, info->node_info->qport[i],
++				qos_delta, info->node_info->qos_params.mode,
++				(1 << info->node_info->qos_params.mode));
++	}
++err_qos_init:
++	return ret;
++}
++
++static int msm_bus_noc_set_bw(struct msm_bus_node_device_type *dev,
++				void __iomem *qos_base,
++				uint32_t qos_off, uint32_t qos_delta,
++				uint32_t qos_freq)
++{
++	int ret = 0;
++	uint64_t bw = 0;
++	int i;
++	struct msm_bus_node_info_type *info = dev->node_info;
++
++	if (info && info->num_qports &&
++		((info->qos_params.mode == NOC_QOS_MODE_REGULATOR) ||
++		(info->qos_params.mode ==
++			NOC_QOS_MODE_LIMITER))) {
++		struct msm_bus_noc_qos_bw qos_bw;
++
++		bw = msm_bus_div64(info->num_qports,
++				dev->node_ab.ab[DUAL_CTX]);
++
++		for (i = 0; i < info->num_qports; i++) {
++			if (!info->qport) {
++				MSM_BUS_DBG("No qos ports to update!\n");
++				break;
++			}
++
++			qos_bw.bw = bw;
++			qos_bw.ws = info->qos_params.ws;
++			msm_bus_noc_set_qos_bw(qos_base, qos_off, qos_freq,
++				info->qport[i], qos_delta,
++				info->qos_params.mode, &qos_bw);
++			MSM_BUS_DBG("NOC: QoS: Update mas_bw: ws: %u\n",
++				qos_bw.ws);
++		}
++	}
++	return ret;
++}
++int msm_bus_noc_hw_init(struct msm_bus_fabric_registration *pdata,
++	struct msm_bus_hw_algorithm *hw_algo)
++{
++	/* Set interleaving to true by default */
++	pdata->il_flag = true;
++	hw_algo->allocate_commit_data = msm_bus_noc_allocate_commit_data;
++	hw_algo->allocate_hw_data = msm_bus_noc_allocate_noc_data;
++	hw_algo->node_init = msm_bus_noc_node_init;
++	hw_algo->free_commit_data = free_commit_data;
++	hw_algo->update_bw = msm_bus_noc_update_bw;
++	hw_algo->commit = msm_bus_noc_commit;
++	hw_algo->port_halt = msm_bus_noc_port_halt;
++	hw_algo->port_unhalt = msm_bus_noc_port_unhalt;
++	hw_algo->update_bw_reg = msm_bus_noc_update_bw_reg;
++	hw_algo->config_master = NULL;
++	hw_algo->config_limiter = NULL;
++
++	return 0;
++}
++
++int msm_bus_noc_set_ops(struct msm_bus_node_device_type *bus_dev)
++{
++	if (!bus_dev)
++		return -ENODEV;
++	else {
++		bus_dev->fabdev->noc_ops.qos_init = msm_bus_noc_qos_init;
++		bus_dev->fabdev->noc_ops.set_bw = msm_bus_noc_set_bw;
++		bus_dev->fabdev->noc_ops.limit_mport = NULL;
++		bus_dev->fabdev->noc_ops.update_bw_reg =
++						msm_bus_noc_update_bw_reg;
++	}
++	return 0;
++}
++EXPORT_SYMBOL(msm_bus_noc_set_ops);
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_noc.h
+@@ -0,0 +1,76 @@
++/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_BUS_BIMC_H
++#define _ARCH_ARM_MACH_MSM_BUS_BIMC_H
++
++enum msm_bus_noc_qos_mode_type {
++	NOC_QOS_MODE_FIXED = 0,
++	NOC_QOS_MODE_LIMITER,
++	NOC_QOS_MODE_BYPASS,
++	NOC_QOS_MODE_REGULATOR,
++	NOC_QOS_MODE_MAX,
++};
++
++enum msm_bus_noc_qos_mode_perm {
++	NOC_QOS_PERM_MODE_FIXED = (1 << NOC_QOS_MODE_FIXED),
++	NOC_QOS_PERM_MODE_LIMITER = (1 << NOC_QOS_MODE_LIMITER),
++	NOC_QOS_PERM_MODE_BYPASS = (1 << NOC_QOS_MODE_BYPASS),
++	NOC_QOS_PERM_MODE_REGULATOR = (1 << NOC_QOS_MODE_REGULATOR),
++};
++
++#define NOC_QOS_MODES_ALL_PERM (NOC_QOS_PERM_MODE_FIXED | \
++	NOC_QOS_PERM_MODE_LIMITER | NOC_QOS_PERM_MODE_BYPASS | \
++	NOC_QOS_PERM_MODE_REGULATOR)
++
++struct msm_bus_noc_commit {
++	struct msm_bus_node_hw_info *mas;
++	struct msm_bus_node_hw_info *slv;
++};
++
++struct msm_bus_noc_info {
++	void __iomem *base;
++	uint32_t base_addr;
++	uint32_t nmasters;
++	uint32_t nqos_masters;
++	uint32_t nslaves;
++	uint32_t qos_freq; /* QOS Clock in KHz */
++	uint32_t qos_baseoffset;
++	uint32_t qos_delta;
++	uint32_t *mas_modes;
++	struct msm_bus_noc_commit cdata[NUM_CTX];
++};
++
++struct msm_bus_noc_qos_priority {
++	uint32_t high_prio;
++	uint32_t low_prio;
++	uint32_t read_prio;
++	uint32_t write_prio;
++	uint32_t p1;
++	uint32_t p0;
++};
++
++struct msm_bus_noc_qos_bw {
++	uint64_t bw; /* Bandwidth in bytes per second */
++	uint32_t ws; /* Window size in nano seconds */
++};
++
++void msm_bus_noc_init(struct msm_bus_noc_info *ninfo);
++uint8_t msm_bus_noc_get_qos_mode(void __iomem *base, uint32_t qos_off,
++	uint32_t mport, uint32_t qos_delta, uint32_t mode, uint32_t perm_mode);
++void msm_bus_noc_get_qos_priority(void __iomem *base, uint32_t qos_off,
++	uint32_t mport, uint32_t qos_delta,
++	struct msm_bus_noc_qos_priority *qprio);
++void msm_bus_noc_get_qos_bw(void __iomem *base, uint32_t qos_off,
++	uint32_t qos_freq, uint32_t mport, uint32_t qos_delta,
++	uint8_t perm_mode, struct msm_bus_noc_qos_bw *qbw);
++#endif /*_ARCH_ARM_MACH_MSM_BUS_NOC_H */
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_of.c
+@@ -0,0 +1,705 @@
++/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "AXI: %s(): " fmt, __func__
++
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include "msm-bus.h"
++#include "msm-bus-board.h"
++#include "msm_bus_core.h"
++
++static const char * const hw_sel_name[] = {"RPM", "NoC", "BIMC", NULL};
++static const char * const mode_sel_name[] = {"Fixed", "Limiter", "Bypass",
++						"Regulator", NULL};
++
++static int get_num(const char *const str[], const char *name)
++{
++	int i = 0;
++
++	do {
++		if (!strcmp(name, str[i]))
++			return i;
++
++		i++;
++	} while (str[i] != NULL);
++
++	pr_err("Error: string %s not found\n", name);
++	return -EINVAL;
++}
++
++#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_MSM_BUS_SCALING)
++static struct msm_bus_scale_pdata *get_pdata(struct platform_device *pdev,
++	struct device_node *of_node)
++{
++	struct msm_bus_scale_pdata *pdata = NULL;
++	struct msm_bus_paths *usecase = NULL;
++	int i = 0, j, ret, num_usecases = 0, num_paths, len;
++	const uint32_t *vec_arr = NULL;
++	bool mem_err = false;
++
++	if (!pdev) {
++		pr_err("Error: Null Platform device\n");
++		return NULL;
++	}
++
++	pdata = devm_kzalloc(&pdev->dev, sizeof(struct msm_bus_scale_pdata),
++		GFP_KERNEL);
++	if (!pdata) {
++		pr_err("Error: Memory allocation for pdata failed\n");
++		mem_err = true;
++		goto err;
++	}
++
++	ret = of_property_read_string(of_node, "qcom,msm-bus,name",
++		&pdata->name);
++	if (ret) {
++		pr_err("Error: Client name not found\n");
++		goto err;
++	}
++
++	ret = of_property_read_u32(of_node, "qcom,msm-bus,num-cases",
++		&num_usecases);
++	if (ret) {
++		pr_err("Error: num-usecases not found\n");
++		goto err;
++	}
++
++	pdata->num_usecases = num_usecases;
++
++	if (of_property_read_bool(of_node, "qcom,msm-bus,active-only"))
++		pdata->active_only = 1;
++	else {
++		pr_debug("active_only flag absent.\n");
++		pr_debug("Using dual context by default\n");
++	}
++
++	usecase = devm_kzalloc(&pdev->dev, (sizeof(struct msm_bus_paths) *
++		pdata->num_usecases), GFP_KERNEL);
++	if (!usecase) {
++		pr_err("Error: Memory allocation for paths failed\n");
++		mem_err = true;
++		goto err;
++	}
++
++	ret = of_property_read_u32(of_node, "qcom,msm-bus,num-paths",
++		&num_paths);
++	if (ret) {
++		pr_err("Error: num_paths not found\n");
++		goto err;
++	}
++
++	vec_arr = of_get_property(of_node, "qcom,msm-bus,vectors-KBps", &len);
++	if (vec_arr == NULL) {
++		pr_err("Error: Vector array not found\n");
++		goto err;
++	}
++
++	if (len != num_usecases * num_paths * sizeof(uint32_t) * 4) {
++		pr_err("Error: Length-error on getting vectors\n");
++		goto err;
++	}
++
++	for (i = 0; i < num_usecases; i++) {
++		usecase[i].num_paths = num_paths;
++		usecase[i].vectors = devm_kzalloc(&pdev->dev, num_paths *
++			sizeof(struct msm_bus_vectors), GFP_KERNEL);
++		if (!usecase[i].vectors) {
++			mem_err = true;
++			pr_err("Error: Mem alloc failure in vectors\n");
++			goto err;
++		}
++
++		for (j = 0; j < num_paths; j++) {
++			int index = ((i * num_paths) + j) * 4;
++			usecase[i].vectors[j].src = be32_to_cpu(vec_arr[index]);
++			usecase[i].vectors[j].dst =
++				be32_to_cpu(vec_arr[index + 1]);
++			usecase[i].vectors[j].ab = (uint64_t)
++				KBTOB(be32_to_cpu(vec_arr[index + 2]));
++			usecase[i].vectors[j].ib = (uint64_t)
++				KBTOB(be32_to_cpu(vec_arr[index + 3]));
++		}
++	}
++
++	pdata->usecase = usecase;
++	return pdata;
++err:
++	if (mem_err) {
++		for (; i > 0; i--)
++			kfree(usecase[i-1].vectors);
++
++		kfree(usecase);
++		kfree(pdata);
++	}
++
++	return NULL;
++}
++
++/**
++ * msm_bus_cl_get_pdata() - Generate bus client data from device tree
++ * provided by clients.
++ *
++ * of_node: Device tree node to extract information from
++ *
++ * The function returns a valid pointer to the allocated bus-scale-pdata
++ * if the vectors were correctly read from the client's device node.
++ * Any error in reading or parsing the device node will return NULL
++ * to the caller.
++ */
++struct msm_bus_scale_pdata *msm_bus_cl_get_pdata(struct platform_device *pdev)
++{
++	struct device_node *of_node;
++	struct msm_bus_scale_pdata *pdata = NULL;
++
++	if (!pdev) {
++		pr_err("Error: Null Platform device\n");
++		return NULL;
++	}
++
++	of_node = pdev->dev.of_node;
++	pdata = get_pdata(pdev, of_node);
++	if (!pdata) {
++		pr_err("client has to provide missing entry for successful registration\n");
++		return NULL;
++	}
++
++	return pdata;
++}
++EXPORT_SYMBOL(msm_bus_cl_get_pdata);
++
++/**
++ * msm_bus_cl_pdata_from_node() - Generate bus client data from device tree
++ * node provided by clients. This function should be used when a client
++ * driver needs to register multiple bus-clients from a single device-tree
++ * node associated with the platform-device.
++ *
++ * of_node: The subnode containing information about the bus scaling
++ * data
++ *
++ * pdev: Platform device associated with the device-tree node
++ *
++ * The function returns a valid pointer to the allocated bus-scale-pdata
++ * if the vectors were correctly read from the client's device node.
++ * Any error in reading or parsing the device node will return NULL
++ * to the caller.
++ */
++struct msm_bus_scale_pdata *msm_bus_pdata_from_node(
++		struct platform_device *pdev, struct device_node *of_node)
++{
++	struct msm_bus_scale_pdata *pdata = NULL;
++
++	if (!pdev) {
++		pr_err("Error: Null Platform device\n");
++		return NULL;
++	}
++
++	if (!of_node) {
++		pr_err("Error: Null of_node passed to bus driver\n");
++		return NULL;
++	}
++
++	pdata = get_pdata(pdev, of_node);
++	if (!pdata) {
++		pr_err("client has to provide missing entry for successful registration\n");
++		return NULL;
++	}
++
++	return pdata;
++}
++EXPORT_SYMBOL(msm_bus_pdata_from_node);
++
++/**
++ * msm_bus_cl_clear_pdata() - Clear pdata allocated from device-tree
++ * of_node: Device tree node to extract information from
++ */
++void msm_bus_cl_clear_pdata(struct msm_bus_scale_pdata *pdata)
++{
++	int i;
++
++	for (i = 0; i < pdata->num_usecases; i++)
++		kfree(pdata->usecase[i].vectors);
++
++	kfree(pdata->usecase);
++	kfree(pdata);
++}
++EXPORT_SYMBOL(msm_bus_cl_clear_pdata);
++#endif
++
++static int *get_arr(struct platform_device *pdev,
++		const struct device_node *node, const char *prop,
++		int *nports)
++{
++	int size = 0, ret;
++	int *arr = NULL;
++
++	if (of_get_property(node, prop, &size)) {
++		*nports = size / sizeof(int);
++	} else {
++		pr_debug("Property %s not available\n", prop);
++		*nports = 0;
++		return NULL;
++	}
++
++	if (!size) {
++		*nports = 0;
++		return NULL;
++	}
++
++	arr = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
++	if (ZERO_OR_NULL_PTR(arr)) {
++		pr_err("Error: Failed to alloc mem for %s\n", prop);
++		return NULL;
++	}
++
++	ret = of_property_read_u32_array(node, prop, (u32 *)arr, *nports);
++	if (ret) {
++		pr_err("Error in reading property: %s\n", prop);
++		goto err;
++	}
++
++	return arr;
++err:
++	devm_kfree(&pdev->dev, arr);
++	return NULL;
++}
++
++static u64 *get_th_params(struct platform_device *pdev,
++		const struct device_node *node, const char *prop,
++		int *nports)
++{
++	int size = 0, ret;
++	u64 *ret_arr = NULL;
++	int *arr = NULL;
++	int i;
++
++	if (of_get_property(node, prop, &size)) {
++		*nports = size / sizeof(int);
++	} else {
++		pr_debug("Property %s not available\n", prop);
++		*nports = 0;
++		return NULL;
++	}
++
++	if (!size) {
++		*nports = 0;
++		return NULL;
++	}
++
++	ret_arr = devm_kzalloc(&pdev->dev, (*nports * sizeof(u64)),
++							GFP_KERNEL);
++	if (ZERO_OR_NULL_PTR(ret_arr)) {
++		pr_err("Error: Failed to alloc mem for ret arr %s\n", prop);
++		return NULL;
++	}
++
++	arr = kzalloc(size, GFP_KERNEL);
++	if ((ZERO_OR_NULL_PTR(arr))) {
++		pr_err("Error: Failed to alloc temp mem for %s\n", prop);
++		return NULL;
++	}
++
++	ret = of_property_read_u32_array(node, prop, (u32 *)arr, *nports);
++	if (ret) {
++		pr_err("Error in reading property: %s\n", prop);
++		goto err;
++	}
++
++	for (i = 0; i < *nports; i++)
++		ret_arr[i] = (uint64_t)KBTOB(arr[i]);
++
++	MSM_BUS_DBG("%s: num entries %d prop %s", __func__, *nports, prop);
++
++	for (i = 0; i < *nports; i++)
++		MSM_BUS_DBG("Th %d val %llu", i, ret_arr[i]);
++
++	kfree(arr);
++	return ret_arr;
++err:
++	kfree(arr);
++	devm_kfree(&pdev->dev, ret_arr);
++	return NULL;
++}
++
++static struct msm_bus_node_info *get_nodes(struct device_node *of_node,
++	struct platform_device *pdev,
++	struct msm_bus_fabric_registration *pdata)
++{
++	struct msm_bus_node_info *info;
++	struct device_node *child_node = NULL;
++	int i = 0, ret;
++	int num_bw = 0;
++	u32 temp;
++
++	for_each_child_of_node(of_node, child_node) {
++		i++;
++	}
++
++	pdata->len = i;
++	info = (struct msm_bus_node_info *)
++		devm_kzalloc(&pdev->dev, sizeof(struct msm_bus_node_info) *
++			pdata->len, GFP_KERNEL);
++	if (ZERO_OR_NULL_PTR(info)) {
++		pr_err("Failed to alloc memory for nodes: %d\n", pdata->len);
++		goto err;
++	}
++
++	i = 0;
++	child_node = NULL;
++	for_each_child_of_node(of_node, child_node) {
++		const char *sel_str;
++
++		ret = of_property_read_string(child_node, "label",
++			&info[i].name);
++		if (ret)
++			pr_err("Error reading node label\n");
++
++		ret = of_property_read_u32(child_node, "cell-id", &info[i].id);
++		if (ret) {
++			pr_err("Error reading node id\n");
++			goto err;
++		}
++
++		if (of_property_read_bool(child_node, "qcom,gateway"))
++			info[i].gateway = 1;
++
++		of_property_read_u32(child_node, "qcom,mas-hw-id",
++			&info[i].mas_hw_id);
++
++		of_property_read_u32(child_node, "qcom,slv-hw-id",
++			&info[i].slv_hw_id);
++		info[i].masterp = get_arr(pdev, child_node,
++					"qcom,masterp", &info[i].num_mports);
++		/* No need to store number of qports */
++		info[i].qport = get_arr(pdev, child_node,
++					"qcom,qport", &ret);
++		pdata->nmasters += info[i].num_mports;
++
++
++		info[i].slavep = get_arr(pdev, child_node,
++					"qcom,slavep", &info[i].num_sports);
++		pdata->nslaves += info[i].num_sports;
++
++
++		info[i].tier = get_arr(pdev, child_node,
++					"qcom,tier", &info[i].num_tiers);
++
++		if (of_property_read_bool(child_node, "qcom,ahb"))
++			info[i].ahb = 1;
++
++		ret = of_property_read_string(child_node, "qcom,hw-sel",
++			&sel_str);
++		if (ret)
++			info[i].hw_sel = 0;
++		else {
++			ret =  get_num(hw_sel_name, sel_str);
++			if (ret < 0) {
++				pr_err("Invalid hw-sel\n");
++				goto err;
++			}
++
++			info[i].hw_sel = ret;
++		}
++
++		of_property_read_u32(child_node, "qcom,buswidth",
++			&info[i].buswidth);
++		of_property_read_u32(child_node, "qcom,ws", &info[i].ws);
++
++		info[i].dual_conf =
++			of_property_read_bool(child_node, "qcom,dual-conf");
++
++
++		info[i].th = get_th_params(pdev, child_node, "qcom,thresh",
++						&info[i].num_thresh);
++
++		info[i].bimc_bw = get_th_params(pdev, child_node,
++						"qcom,bimc,bw", &num_bw);
++
++		if (num_bw != info[i].num_thresh) {
++			pr_err("%s:num_bw %d must equal num_thresh %d",
++				__func__, num_bw, info[i].num_thresh);
++			pr_err("%s:Err setting up dual conf for %s",
++				__func__, info[i].name);
++			goto err;
++		}
++
++		of_property_read_u32(child_node, "qcom,bimc,gp",
++			&info[i].bimc_gp);
++		of_property_read_u32(child_node, "qcom,bimc,thmp",
++			&info[i].bimc_thmp);
++
++		ret = of_property_read_string(child_node, "qcom,mode-thresh",
++			&sel_str);
++		if (ret)
++			info[i].mode_thresh = 0;
++		else {
++			ret = get_num(mode_sel_name, sel_str);
++			if (ret < 0) {
++				pr_err("Unknown mode :%s\n", sel_str);
++				goto err;
++			}
++
++			info[i].mode_thresh = ret;
++			MSM_BUS_DBG("AXI: THreshold mode set: %d\n",
++					info[i].mode_thresh);
++		}
++
++		ret = of_property_read_string(child_node, "qcom,mode",
++				&sel_str);
++
++		if (ret)
++			info[i].mode = 0;
++		else {
++			ret = get_num(mode_sel_name, sel_str);
++			if (ret < 0) {
++				pr_err("Unknown mode :%s\n", sel_str);
++				goto err;
++			}
++
++			info[i].mode = ret;
++		}
++
++		info[i].nr_lim =
++			of_property_read_bool(child_node, "qcom,nr-lim");
++
++		ret = of_property_read_u32(child_node, "qcom,ff",
++							&info[i].ff);
++		if (ret) {
++			pr_debug("fudge factor not present %d", info[i].id);
++			info[i].ff = 0;
++		}
++
++		ret = of_property_read_u32(child_node, "qcom,floor-bw",
++						&temp);
++		if (ret) {
++			pr_debug("fabdev floor bw not present %d", info[i].id);
++			info[i].floor_bw = 0;
++		} else {
++			info[i].floor_bw = KBTOB(temp);
++		}
++
++		info[i].rt_mas =
++			of_property_read_bool(child_node, "qcom,rt-mas");
++
++		ret = of_property_read_string(child_node, "qcom,perm-mode",
++			&sel_str);
++		if (ret)
++			info[i].perm_mode = 0;
++		else {
++			ret = get_num(mode_sel_name, sel_str);
++			if (ret < 0)
++				goto err;
++
++			info[i].perm_mode = 1 << ret;
++		}
++
++		of_property_read_u32(child_node, "qcom,prio-lvl",
++			&info[i].prio_lvl);
++		of_property_read_u32(child_node, "qcom,prio-rd",
++			&info[i].prio_rd);
++		of_property_read_u32(child_node, "qcom,prio-wr",
++			&info[i].prio_wr);
++		of_property_read_u32(child_node, "qcom,prio0", &info[i].prio0);
++		of_property_read_u32(child_node, "qcom,prio1", &info[i].prio1);
++		ret = of_property_read_string(child_node, "qcom,slaveclk-dual",
++			&info[i].slaveclk[DUAL_CTX]);
++		if (!ret)
++			pr_debug("Got slaveclk_dual: %s\n",
++				info[i].slaveclk[DUAL_CTX]);
++		else
++			info[i].slaveclk[DUAL_CTX] = NULL;
++
++		ret = of_property_read_string(child_node,
++			"qcom,slaveclk-active", &info[i].slaveclk[ACTIVE_CTX]);
++		if (!ret)
++			pr_debug("Got slaveclk_active\n");
++		else
++			info[i].slaveclk[ACTIVE_CTX] = NULL;
++
++		ret = of_property_read_string(child_node, "qcom,memclk-dual",
++			&info[i].memclk[DUAL_CTX]);
++		if (!ret)
++			pr_debug("Got memclk_dual\n");
++		else
++			info[i].memclk[DUAL_CTX] = NULL;
++
++		ret = of_property_read_string(child_node, "qcom,memclk-active",
++			&info[i].memclk[ACTIVE_CTX]);
++		if (!ret)
++			pr_debug("Got memclk_active\n");
++		else
++			info[i].memclk[ACTIVE_CTX] = NULL;
++
++		ret = of_property_read_string(child_node, "qcom,iface-clk-node",
++			&info[i].iface_clk_node);
++		if (!ret)
++			pr_debug("Got iface_clk_node\n");
++		else
++			info[i].iface_clk_node = NULL;
++
++		pr_debug("Node name: %s\n", info[i].name);
++		of_node_put(child_node);
++		i++;
++	}
++
++	pr_debug("Bus %d added: %d masters\n", pdata->id, pdata->nmasters);
++	pr_debug("Bus %d added: %d slaves\n", pdata->id, pdata->nslaves);
++	return info;
++err:
++	return NULL;
++}
++
++void msm_bus_of_get_nfab(struct platform_device *pdev,
++		struct msm_bus_fabric_registration *pdata)
++{
++	struct device_node *of_node;
++	int ret, nfab = 0;
++
++	if (!pdev) {
++		pr_err("Error: Null platform device\n");
++		return;
++	}
++
++	of_node = pdev->dev.of_node;
++	ret = of_property_read_u32(of_node, "qcom,nfab",
++		&nfab);
++	if (!ret)
++		pr_debug("Fab_of: Read number of buses: %u\n", nfab);
++
++	msm_bus_board_set_nfab(pdata, nfab);
++}
++
++struct msm_bus_fabric_registration
++	*msm_bus_of_get_fab_data(struct platform_device *pdev)
++{
++	struct device_node *of_node;
++	struct msm_bus_fabric_registration *pdata;
++	bool mem_err = false;
++	int ret = 0;
++	const char *sel_str;
++	u32 temp;
++
++	if (!pdev) {
++		pr_err("Error: Null platform device\n");
++		return NULL;
++	}
++
++	of_node = pdev->dev.of_node;
++	pdata = devm_kzalloc(&pdev->dev,
++			sizeof(struct msm_bus_fabric_registration), GFP_KERNEL);
++	if (!pdata) {
++		pr_err("Error: Memory allocation for pdata failed\n");
++		mem_err = true;
++		goto err;
++	}
++
++	ret = of_property_read_string(of_node, "label", &pdata->name);
++	if (ret) {
++		pr_err("Error: label not found\n");
++		goto err;
++	}
++	pr_debug("Fab_of: Read name: %s\n", pdata->name);
++
++	ret = of_property_read_u32(of_node, "cell-id",
++		&pdata->id);
++	if (ret) {
++		pr_err("Error: num-usecases not found\n");
++		goto err;
++	}
++	pr_debug("Fab_of: Read id: %u\n", pdata->id);
++
++	if (of_property_read_bool(of_node, "qcom,ahb"))
++		pdata->ahb = 1;
++
++	ret = of_property_read_string(of_node, "qcom,fabclk-dual",
++		&pdata->fabclk[DUAL_CTX]);
++	if (ret) {
++		pr_debug("fabclk_dual not available\n");
++		pdata->fabclk[DUAL_CTX] = NULL;
++	} else
++		pr_debug("Fab_of: Read clk dual ctx: %s\n",
++			pdata->fabclk[DUAL_CTX]);
++	ret = of_property_read_string(of_node, "qcom,fabclk-active",
++		&pdata->fabclk[ACTIVE_CTX]);
++	if (ret) {
++		pr_debug("Error: fabclk_active not available\n");
++		pdata->fabclk[ACTIVE_CTX] = NULL;
++	} else
++		pr_debug("Fab_of: Read clk act ctx: %s\n",
++			pdata->fabclk[ACTIVE_CTX]);
++
++	ret = of_property_read_u32(of_node, "qcom,ntieredslaves",
++		&pdata->ntieredslaves);
++	if (ret) {
++		pr_err("Error: ntieredslaves not found\n");
++		goto err;
++	}
++
++	ret = of_property_read_u32(of_node, "qcom,qos-freq", &pdata->qos_freq);
++	if (ret)
++		pr_debug("qos_freq not available\n");
++
++	ret = of_property_read_string(of_node, "qcom,hw-sel", &sel_str);
++	if (ret) {
++		pr_err("Error: hw_sel not found\n");
++		goto err;
++	} else {
++		ret = get_num(hw_sel_name, sel_str);
++		if (ret < 0)
++			goto err;
++
++		pdata->hw_sel = ret;
++	}
++
++	if (of_property_read_bool(of_node, "qcom,virt"))
++		pdata->virt = true;
++
++	ret = of_property_read_u32(of_node, "qcom,qos-baseoffset",
++						&pdata->qos_baseoffset);
++	if (ret)
++		pr_debug("%s:qos_baseoffset not available\n", __func__);
++
++	ret = of_property_read_u32(of_node, "qcom,qos-delta",
++						&pdata->qos_delta);
++	if (ret)
++		pr_debug("%s:qos_delta not available\n", __func__);
++
++	if (of_property_read_bool(of_node, "qcom,rpm-en"))
++		pdata->rpm_enabled = 1;
++
++	ret = of_property_read_u32(of_node, "qcom,nr-lim-thresh",
++						&temp);
++
++	if (ret) {
++		pr_err("nr-lim threshold not specified");
++		pdata->nr_lim_thresh = 0;
++	} else {
++		pdata->nr_lim_thresh = KBTOB(temp);
++	}
++
++	ret = of_property_read_u32(of_node, "qcom,eff-fact",
++						&pdata->eff_fact);
++	if (ret) {
++		pr_err("Fab eff-factor not present");
++		pdata->eff_fact = 0;
++	}
++
++	pdata->info = get_nodes(of_node, pdev, pdata);
++	return pdata;
++err:
++	return NULL;
++}
++EXPORT_SYMBOL(msm_bus_of_get_fab_data);
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_of_adhoc.c
+@@ -0,0 +1,641 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#define pr_fmt(fmt) "AXI: %s(): " fmt, __func__
++
++#include <linux/clk.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include "msm-bus.h"
++#include "msm-bus-board.h"
++#include "msm_bus_rules.h"
++#include "msm_bus_core.h"
++#include "msm_bus_adhoc.h"
++
++#define DEFAULT_QOS_FREQ	19200
++#define DEFAULT_UTIL_FACT	100
++#define DEFAULT_VRAIL_COMP	100
++
++static int get_qos_mode(struct platform_device *pdev,
++			struct device_node *node, const char *qos_mode)
++{
++	const char *qos_names[] = {"fixed", "limiter", "bypass", "regulator"};
++	int i = 0;
++	int ret = -1;
++
++	if (!qos_mode)
++		goto exit_get_qos_mode;
++
++	for (i = 0; i < ARRAY_SIZE(qos_names); i++) {
++		if (!strcmp(qos_mode, qos_names[i]))
++			break;
++	}
++	if (i == ARRAY_SIZE(qos_names))
++		dev_err(&pdev->dev, "Cannot match mode qos %s using Bypass",
++				qos_mode);
++	else
++		ret = i;
++
++exit_get_qos_mode:
++	return ret;
++}
++
++static int *get_arr(struct platform_device *pdev,
++		struct device_node *node, const char *prop,
++		int *nports)
++{
++	int size = 0, ret;
++	int *arr = NULL;
++
++	if (of_get_property(node, prop, &size)) {
++		*nports = size / sizeof(int);
++	} else {
++		dev_dbg(&pdev->dev, "Property %s not available\n", prop);
++		*nports = 0;
++		return NULL;
++	}
++
++	arr = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
++	if ((size > 0) && ZERO_OR_NULL_PTR(arr)) {
++		dev_err(&pdev->dev, "Error: Failed to alloc mem for %s\n",
++				prop);
++		return NULL;
++	}
++
++	ret = of_property_read_u32_array(node, prop, (u32 *)arr, *nports);
++	if (ret) {
++		dev_err(&pdev->dev, "Error in reading property: %s\n", prop);
++		goto arr_err;
++	}
++
++	return arr;
++arr_err:
++	devm_kfree(&pdev->dev, arr);
++	return NULL;
++}
++
++static struct msm_bus_fab_device_type *get_fab_device_info(
++		struct device_node *dev_node,
++		struct platform_device *pdev)
++{
++	struct msm_bus_fab_device_type *fab_dev;
++	unsigned int ret;
++	struct resource *res;
++	const char *base_name;
++
++	fab_dev = devm_kzalloc(&pdev->dev,
++			sizeof(struct msm_bus_fab_device_type),
++			GFP_KERNEL);
++	if (!fab_dev) {
++		dev_err(&pdev->dev,
++			"Error: Unable to allocate memory for fab_dev\n");
++		return NULL;
++	}
++
++	ret = of_property_read_string(dev_node, "qcom,base-name", &base_name);
++	if (ret) {
++		dev_err(&pdev->dev, "Error: Unable to get base address name\n");
++		goto fab_dev_err;
++	}
++
++	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, base_name);
++	if (!res) {
++		dev_err(&pdev->dev, "Error getting qos base addr %s\n",
++								base_name);
++		goto fab_dev_err;
++	}
++	fab_dev->pqos_base = res->start;
++	fab_dev->qos_range = resource_size(res);
++	fab_dev->bypass_qos_prg = of_property_read_bool(dev_node,
++						"qcom,bypass-qos-prg");
++
++	ret = of_property_read_u32(dev_node, "qcom,base-offset",
++			&fab_dev->base_offset);
++	if (ret)
++		dev_dbg(&pdev->dev, "Bus base offset is missing\n");
++
++	ret = of_property_read_u32(dev_node, "qcom,qos-off",
++			&fab_dev->qos_off);
++	if (ret)
++		dev_dbg(&pdev->dev, "Bus qos off is missing\n");
++
++
++	ret = of_property_read_u32(dev_node, "qcom,bus-type",
++						&fab_dev->bus_type);
++	if (ret) {
++		dev_warn(&pdev->dev, "Bus type is missing\n");
++		goto fab_dev_err;
++	}
++
++	ret = of_property_read_u32(dev_node, "qcom,qos-freq",
++						&fab_dev->qos_freq);
++	if (ret) {
++		dev_dbg(&pdev->dev, "Bus qos freq is missing\n");
++		fab_dev->qos_freq = DEFAULT_QOS_FREQ;
++	}
++
++	ret = of_property_read_u32(dev_node, "qcom,util-fact",
++						&fab_dev->util_fact);
++	if (ret) {
++		dev_info(&pdev->dev, "Util-fact is missing, default to %d\n",
++				DEFAULT_UTIL_FACT);
++		fab_dev->util_fact = DEFAULT_UTIL_FACT;
++	}
++
++	ret = of_property_read_u32(dev_node, "qcom,vrail-comp",
++						&fab_dev->vrail_comp);
++	if (ret) {
++		dev_info(&pdev->dev, "Vrail-comp is missing, default to %d\n",
++				DEFAULT_VRAIL_COMP);
++		fab_dev->vrail_comp = DEFAULT_VRAIL_COMP;
++	}
++
++	return fab_dev;
++
++fab_dev_err:
++	devm_kfree(&pdev->dev, fab_dev);
++	fab_dev = 0;
++	return NULL;
++}
++
++static void get_qos_params(
++		struct device_node * const dev_node,
++		struct platform_device * const pdev,
++		struct msm_bus_node_info_type *node_info)
++{
++	const char *qos_mode = NULL;
++	unsigned int ret;
++	unsigned int temp;
++
++	ret = of_property_read_string(dev_node, "qcom,qos-mode", &qos_mode);
++
++	if (ret)
++		node_info->qos_params.mode = -1;
++	else
++		node_info->qos_params.mode = get_qos_mode(pdev, dev_node,
++								qos_mode);
++
++	of_property_read_u32(dev_node, "qcom,prio-lvl",
++					&node_info->qos_params.prio_lvl);
++
++	of_property_read_u32(dev_node, "qcom,prio1",
++						&node_info->qos_params.prio1);
++
++	of_property_read_u32(dev_node, "qcom,prio0",
++						&node_info->qos_params.prio0);
++
++	of_property_read_u32(dev_node, "qcom,prio-rd",
++					&node_info->qos_params.prio_rd);
++
++	of_property_read_u32(dev_node, "qcom,prio-wr",
++						&node_info->qos_params.prio_wr);
++
++	of_property_read_u32(dev_node, "qcom,gp",
++						&node_info->qos_params.gp);
++
++	of_property_read_u32(dev_node, "qcom,thmp",
++						&node_info->qos_params.thmp);
++
++	of_property_read_u32(dev_node, "qcom,ws",
++						&node_info->qos_params.ws);
++
++	ret = of_property_read_u32(dev_node, "qcom,bw_buffer", &temp);
++
++	if (ret)
++		node_info->qos_params.bw_buffer = 0;
++	else
++		node_info->qos_params.bw_buffer = KBTOB(temp);
++
++}
++
++
++static struct msm_bus_node_info_type *get_node_info_data(
++		struct device_node * const dev_node,
++		struct platform_device * const pdev)
++{
++	struct msm_bus_node_info_type *node_info;
++	unsigned int ret;
++	int size;
++	int i;
++	struct device_node *con_node;
++	struct device_node *bus_dev;
++
++	node_info = devm_kzalloc(&pdev->dev,
++			sizeof(struct msm_bus_node_info_type),
++			GFP_KERNEL);
++	if (!node_info) {
++		dev_err(&pdev->dev,
++			"Error: Unable to allocate memory for node_info\n");
++		return NULL;
++	}
++
++	ret = of_property_read_u32(dev_node, "cell-id", &node_info->id);
++	if (ret) {
++		dev_warn(&pdev->dev, "Bus node is missing cell-id\n");
++		goto node_info_err;
++	}
++	ret = of_property_read_string(dev_node, "label", &node_info->name);
++	if (ret) {
++		dev_warn(&pdev->dev, "Bus node is missing name\n");
++		goto node_info_err;
++	}
++	node_info->qport = get_arr(pdev, dev_node, "qcom,qport",
++			&node_info->num_qports);
++
++	if (of_get_property(dev_node, "qcom,connections", &size)) {
++		node_info->num_connections = size / sizeof(int);
++		node_info->connections = devm_kzalloc(&pdev->dev, size,
++				GFP_KERNEL);
++	} else {
++		node_info->num_connections = 0;
++		node_info->connections = 0;
++	}
++
++	for (i = 0; i < node_info->num_connections; i++) {
++		con_node = of_parse_phandle(dev_node, "qcom,connections", i);
++		if (IS_ERR_OR_NULL(con_node))
++			goto node_info_err;
++
++		if (of_property_read_u32(con_node, "cell-id",
++				&node_info->connections[i]))
++			goto node_info_err;
++		of_node_put(con_node);
++	}
++
++	if (of_get_property(dev_node, "qcom,blacklist", &size)) {
++		node_info->num_blist = size/sizeof(u32);
++		node_info->black_listed_connections = devm_kzalloc(&pdev->dev,
++		size, GFP_KERNEL);
++	} else {
++		node_info->num_blist = 0;
++		node_info->black_listed_connections = 0;
++	}
++
++	for (i = 0; i < node_info->num_blist; i++) {
++		con_node = of_parse_phandle(dev_node, "qcom,blacklist", i);
++		if (IS_ERR_OR_NULL(con_node))
++			goto node_info_err;
++
++		if (of_property_read_u32(con_node, "cell-id",
++				&node_info->black_listed_connections[i]))
++			goto node_info_err;
++		of_node_put(con_node);
++	}
++
++	bus_dev = of_parse_phandle(dev_node, "qcom,bus-dev", 0);
++	if (!IS_ERR_OR_NULL(bus_dev)) {
++		if (of_property_read_u32(bus_dev, "cell-id",
++			&node_info->bus_device_id)) {
++			dev_err(&pdev->dev, "Can't find bus device. Node %d",
++					node_info->id);
++			goto node_info_err;
++		}
++
++		of_node_put(bus_dev);
++	} else
++		dev_dbg(&pdev->dev, "Can't find bdev phandle for %d",
++					node_info->id);
++
++	node_info->is_fab_dev = of_property_read_bool(dev_node, "qcom,fab-dev");
++	node_info->virt_dev = of_property_read_bool(dev_node, "qcom,virt-dev");
++
++	ret = of_property_read_u32(dev_node, "qcom,buswidth",
++						&node_info->buswidth);
++	if (ret) {
++		dev_dbg(&pdev->dev, "Using default 8 bytes %d", node_info->id);
++		node_info->buswidth = 8;
++	}
++
++	ret = of_property_read_u32(dev_node, "qcom,mas-rpm-id",
++						&node_info->mas_rpm_id);
++	if (ret) {
++		dev_dbg(&pdev->dev, "mas rpm id is missing\n");
++		node_info->mas_rpm_id = -1;
++	}
++
++	ret = of_property_read_u32(dev_node, "qcom,slv-rpm-id",
++						&node_info->slv_rpm_id);
++	if (ret) {
++		dev_dbg(&pdev->dev, "slv rpm id is missing\n");
++		node_info->slv_rpm_id = -1;
++	}
++	ret = of_property_read_u32(dev_node, "qcom,util-fact",
++						&node_info->util_fact);
++	if (ret)
++		node_info->util_fact = 0;
++	ret = of_property_read_u32(dev_node, "qcom,vrail-comp",
++						&node_info->vrail_comp);
++	if (ret)
++		node_info->vrail_comp = 0;
++	get_qos_params(dev_node, pdev, node_info);
++
++	return node_info;
++
++node_info_err:
++	devm_kfree(&pdev->dev, node_info);
++	node_info = 0;
++	return NULL;
++}
++
++static unsigned int get_bus_node_device_data(
++		struct device_node * const dev_node,
++		struct platform_device * const pdev,
++		struct msm_bus_node_device_type * const node_device)
++{
++	node_device->node_info = get_node_info_data(dev_node, pdev);
++	if (IS_ERR_OR_NULL(node_device->node_info)) {
++		dev_err(&pdev->dev, "Error: Node info missing\n");
++		return -ENODATA;
++	}
++	node_device->ap_owned = of_property_read_bool(dev_node,
++							"qcom,ap-owned");
++
++	if (node_device->node_info->is_fab_dev) {
++		dev_dbg(&pdev->dev, "Dev %d\n", node_device->node_info->id);
++
++		if (!node_device->node_info->virt_dev) {
++			node_device->fabdev =
++				get_fab_device_info(dev_node, pdev);
++			if (IS_ERR_OR_NULL(node_device->fabdev)) {
++				dev_err(&pdev->dev,
++					"Error: Fabric device info missing\n");
++				devm_kfree(&pdev->dev, node_device->node_info);
++				return -ENODATA;
++			}
++		}
++		node_device->clk[DUAL_CTX].clk = of_clk_get_by_name(dev_node,
++							"bus_clk");
++
++		if (IS_ERR_OR_NULL(node_device->clk[DUAL_CTX].clk))
++			dev_dbg(&pdev->dev,
++				"%s:Failed to get bus clk for bus%d ctx%d",
++				__func__, node_device->node_info->id,
++								DUAL_CTX);
++
++		node_device->clk[ACTIVE_CTX].clk = of_clk_get_by_name(dev_node,
++							"bus_a_clk");
++		if (IS_ERR_OR_NULL(node_device->clk[ACTIVE_CTX].clk))
++			dev_err(&pdev->dev,
++				"Failed to get bus clk for bus%d ctx%d",
++				 node_device->node_info->id, ACTIVE_CTX);
++		if (msmbus_coresight_init_adhoc(pdev, dev_node))
++			dev_warn(&pdev->dev,
++				 "Coresight support absent for bus: %d\n",
++				  node_device->node_info->id);
++	} else {
++		node_device->qos_clk.clk = of_clk_get_by_name(dev_node,
++							"bus_qos_clk");
++
++		if (IS_ERR_OR_NULL(node_device->qos_clk.clk))
++			dev_dbg(&pdev->dev,
++				"%s:Failed to get bus qos clk for mas%d",
++				__func__, node_device->node_info->id);
++
++		node_device->clk[DUAL_CTX].clk = of_clk_get_by_name(dev_node,
++							"node_clk");
++
++		if (IS_ERR_OR_NULL(node_device->clk[DUAL_CTX].clk))
++			dev_dbg(&pdev->dev,
++				"%s:Failed to get bus clk for bus%d ctx%d",
++				__func__, node_device->node_info->id,
++								DUAL_CTX);
++
++	}
++	return 0;
++}
++
++struct msm_bus_device_node_registration
++	*msm_bus_of_to_pdata(struct platform_device *pdev)
++{
++	struct device_node *of_node, *child_node;
++	struct msm_bus_device_node_registration *pdata;
++	unsigned int i = 0, j;
++	unsigned int ret;
++
++	if (!pdev) {
++		pr_err("Error: Null platform device\n");
++		return NULL;
++	}
++
++	of_node = pdev->dev.of_node;
++
++	pdata = devm_kzalloc(&pdev->dev,
++			sizeof(struct msm_bus_device_node_registration),
++			GFP_KERNEL);
++	if (!pdata) {
++		dev_err(&pdev->dev,
++				"Error: Memory allocation for pdata failed\n");
++		return NULL;
++	}
++
++	pdata->num_devices = of_get_child_count(of_node);
++
++	pdata->info = devm_kzalloc(&pdev->dev,
++			sizeof(struct msm_bus_node_device_type) *
++			pdata->num_devices, GFP_KERNEL);
++
++	if (!pdata->info) {
++		dev_err(&pdev->dev,
++			"Error: Memory allocation for pdata->info failed\n");
++		goto node_reg_err;
++	}
++
++	ret = 0;
++	for_each_child_of_node(of_node, child_node) {
++		ret = get_bus_node_device_data(child_node, pdev,
++				&pdata->info[i]);
++		if (ret) {
++			dev_err(&pdev->dev, "Error: unable to initialize bus nodes\n");
++			goto node_reg_err_1;
++		}
++		i++;
++	}
++
++	dev_dbg(&pdev->dev, "bus topology:\n");
++	for (i = 0; i < pdata->num_devices; i++) {
++		dev_dbg(&pdev->dev, "id %d\nnum_qports %d\nnum_connections %d",
++				pdata->info[i].node_info->id,
++				pdata->info[i].node_info->num_qports,
++				pdata->info[i].node_info->num_connections);
++		dev_dbg(&pdev->dev, "\nbus_device_id %d\n buswidth %d\n",
++				pdata->info[i].node_info->bus_device_id,
++				pdata->info[i].node_info->buswidth);
++		for (j = 0; j < pdata->info[i].node_info->num_connections;
++									j++) {
++			dev_dbg(&pdev->dev, "connection[%d]: %d\n", j,
++				pdata->info[i].node_info->connections[j]);
++		}
++		for (j = 0; j < pdata->info[i].node_info->num_blist;
++									 j++) {
++			dev_dbg(&pdev->dev, "black_listed_node[%d]: %d\n", j,
++				pdata->info[i].node_info->
++				black_listed_connections[j]);
++		}
++		if (pdata->info[i].fabdev)
++			dev_dbg(&pdev->dev, "base_addr %zu\nbus_type %d\n",
++					(size_t)pdata->info[i].
++						fabdev->pqos_base,
++					pdata->info[i].fabdev->bus_type);
++	}
++	return pdata;
++
++node_reg_err_1:
++	devm_kfree(&pdev->dev, pdata->info);
++node_reg_err:
++	devm_kfree(&pdev->dev, pdata);
++	pdata = NULL;
++	return NULL;
++}
++
++static int msm_bus_of_get_ids(struct platform_device *pdev,
++			struct device_node *dev_node, int **dev_ids,
++			int *num_ids, char *prop_name)
++{
++	int ret = 0;
++	int size, i;
++	struct device_node *rule_node;
++	int *ids = NULL;
++
++	if (of_get_property(dev_node, prop_name, &size)) {
++		*num_ids = size / sizeof(int);
++		ids = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
++	} else {
++		dev_err(&pdev->dev, "No rule nodes, skipping node");
++		ret = -ENXIO;
++		goto exit_get_ids;
++	}
++
++	*dev_ids = ids;
++	for (i = 0; i < *num_ids; i++) {
++		rule_node = of_parse_phandle(dev_node, prop_name, i);
++		if (IS_ERR_OR_NULL(rule_node)) {
++			dev_err(&pdev->dev, "Can't get rule node id");
++			ret = -ENXIO;
++			goto err_get_ids;
++		}
++
++		if (of_property_read_u32(rule_node, "cell-id",
++				&ids[i])) {
++			dev_err(&pdev->dev, "Can't get rule node id");
++			ret = -ENXIO;
++			goto err_get_ids;
++		}
++		of_node_put(rule_node);
++	}
++exit_get_ids:
++	return ret;
++err_get_ids:
++	devm_kfree(&pdev->dev, ids);
++	of_node_put(rule_node);
++	ids = NULL;
++	return ret;
++}
++
++int msm_bus_of_get_static_rules(struct platform_device *pdev,
++					struct bus_rule_type **static_rules)
++{
++	int ret = 0;
++	struct device_node *of_node, *child_node;
++	int num_rules = 0;
++	int rule_idx = 0;
++	int bw_fld = 0;
++	int i;
++	struct bus_rule_type *static_rule = NULL;
++
++	of_node = pdev->dev.of_node;
++	num_rules = of_get_child_count(of_node);
++	static_rule = devm_kzalloc(&pdev->dev,
++				sizeof(struct bus_rule_type) * num_rules,
++				GFP_KERNEL);
++
++	if (IS_ERR_OR_NULL(static_rule)) {
++		ret = -ENOMEM;
++		goto exit_static_rules;
++	}
++
++	*static_rules = static_rule;
++	for_each_child_of_node(of_node, child_node) {
++		ret = msm_bus_of_get_ids(pdev, child_node,
++			&static_rule[rule_idx].src_id,
++			&static_rule[rule_idx].num_src,
++			"qcom,src-nodes");
++
++		ret = msm_bus_of_get_ids(pdev, child_node,
++			&static_rule[rule_idx].dst_node,
++			&static_rule[rule_idx].num_dst,
++			"qcom,dest-node");
++
++		ret = of_property_read_u32(child_node, "qcom,src-field",
++				&static_rule[rule_idx].src_field);
++		if (ret) {
++			dev_err(&pdev->dev, "src-field missing");
++			ret = -ENXIO;
++			goto err_static_rules;
++		}
++
++		ret = of_property_read_u32(child_node, "qcom,src-op",
++				&static_rule[rule_idx].op);
++		if (ret) {
++			dev_err(&pdev->dev, "src-op missing");
++			ret = -ENXIO;
++			goto err_static_rules;
++		}
++
++		ret = of_property_read_u32(child_node, "qcom,mode",
++				&static_rule[rule_idx].mode);
++		if (ret) {
++			dev_err(&pdev->dev, "mode missing");
++			ret = -ENXIO;
++			goto err_static_rules;
++		}
++
++		ret = of_property_read_u32(child_node, "qcom,thresh", &bw_fld);
++		if (ret) {
++			dev_err(&pdev->dev, "thresh missing");
++			ret = -ENXIO;
++			goto err_static_rules;
++		} else
++			static_rule[rule_idx].thresh = KBTOB(bw_fld);
++
++		ret = of_property_read_u32(child_node, "qcom,dest-bw",
++								&bw_fld);
++		if (ret)
++			static_rule[rule_idx].dst_bw = 0;
++		else
++			static_rule[rule_idx].dst_bw = KBTOB(bw_fld);
++
++		rule_idx++;
++	}
++	ret = rule_idx;
++exit_static_rules:
++	return ret;
++err_static_rules:
++	for (i = 0; i < num_rules; i++) {
++		if (!IS_ERR_OR_NULL(static_rule)) {
++			if (!IS_ERR_OR_NULL(static_rule[i].src_id))
++				devm_kfree(&pdev->dev,
++						static_rule[i].src_id);
++			if (!IS_ERR_OR_NULL(static_rule[i].dst_node))
++				devm_kfree(&pdev->dev,
++						static_rule[i].dst_node);
++			devm_kfree(&pdev->dev, static_rule);
++		}
++	}
++	devm_kfree(&pdev->dev, *static_rules);
++	static_rules = NULL;
++	return ret;
++}
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_rules.c
+@@ -0,0 +1,624 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/list_sort.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include "msm-bus-board.h"
++#include "msm_bus_rules.h"
++#include <trace/events/trace_msm_bus.h>
++
++struct node_vote_info {
++	int id;
++	u64 ib;
++	u64 ab;
++	u64 clk;
++};
++
++struct rules_def {
++	int rule_id;
++	int num_src;
++	int state;
++	struct node_vote_info *src_info;
++	struct bus_rule_type rule_ops;
++	bool state_change;
++	struct list_head link;
++};
++
++struct rule_node_info {
++	int id;
++	void *data;
++	struct raw_notifier_head rule_notify_list;
++	int cur_rule;
++	int num_rules;
++	struct list_head node_rules;
++	struct list_head link;
++	struct rule_apply_rcm_info apply;
++};
++
++DEFINE_MUTEX(msm_bus_rules_lock);
++static LIST_HEAD(node_list);
++static struct rule_node_info *get_node(u32 id, void *data);
++
++#define LE(op1, op2)	(op1 <= op2)
++#define LT(op1, op2)	(op1 < op2)
++#define GE(op1, op2)	(op1 >= op2)
++#define GT(op1, op2)	(op1 > op2)
++#define NB_ID		(0x201)
++
++static struct rule_node_info *get_node(u32 id, void *data)
++{
++	struct rule_node_info *node_it = NULL;
++	struct rule_node_info *node_match = NULL;
++
++	list_for_each_entry(node_it, &node_list, link) {
++		if (node_it->id == id) {
++			if ((id == NB_ID)) {
++				if ((node_it->data == data)) {
++					node_match = node_it;
++					break;
++				}
++			} else {
++				node_match = node_it;
++				break;
++			}
++		}
++	}
++	return node_match;
++}
++
++static struct rule_node_info *gen_node(u32 id, void *data)
++{
++	struct rule_node_info *node_it = NULL;
++	struct rule_node_info *node_match = NULL;
++
++	list_for_each_entry(node_it, &node_list, link) {
++		if (node_it->id == id) {
++			node_match = node_it;
++			break;
++		}
++	}
++
++	if (!node_match) {
++		node_match = kzalloc(sizeof(struct rule_node_info), GFP_KERNEL);
++		if (!node_match) {
++			pr_err("%s: Cannot allocate memory", __func__);
++			goto exit_node_match;
++		}
++
++		node_match->id = id;
++		node_match->cur_rule = -1;
++		node_match->num_rules = 0;
++		node_match->data = data;
++		list_add_tail(&node_match->link, &node_list);
++		INIT_LIST_HEAD(&node_match->node_rules);
++		RAW_INIT_NOTIFIER_HEAD(&node_match->rule_notify_list);
++		pr_debug("Added new node %d to list\n", id);
++	}
++exit_node_match:
++	return node_match;
++}
++
++static bool do_compare_op(u64 op1, u64 op2, int op)
++{
++	bool ret = false;
++
++	switch (op) {
++	case OP_LE:
++		ret = LE(op1, op2);
++		break;
++	case OP_LT:
++		ret = LT(op1, op2);
++		break;
++	case OP_GT:
++		ret = GT(op1, op2);
++		break;
++	case OP_GE:
++		ret = GE(op1, op2);
++		break;
++	case OP_NOOP:
++		ret = true;
++		break;
++	default:
++		pr_info("Invalid OP %d", op);
++		break;
++	}
++	return ret;
++}
++
++static void update_src_id_vote(struct rule_update_path_info *inp_node,
++				struct rule_node_info *rule_node)
++{
++	struct rules_def *rule;
++	int i;
++
++	list_for_each_entry(rule, &rule_node->node_rules, link) {
++		for (i = 0; i < rule->num_src; i++) {
++			if (rule->src_info[i].id == inp_node->id) {
++				rule->src_info[i].ib = inp_node->ib;
++				rule->src_info[i].ab = inp_node->ab;
++				rule->src_info[i].clk = inp_node->clk;
++			}
++		}
++	}
++}
++
++static u64 get_field(struct rules_def *rule, int src_id)
++{
++	u64 field = 0;
++	int i;
++
++	for (i = 0; i < rule->num_src; i++) {
++		switch (rule->rule_ops.src_field) {
++		case FLD_IB:
++			field += rule->src_info[i].ib;
++			break;
++		case FLD_AB:
++			field += rule->src_info[i].ab;
++			break;
++		case FLD_CLK:
++			field += rule->src_info[i].clk;
++			break;
++		}
++	}
++
++	return field;
++}
++
++static bool check_rule(struct rules_def *rule,
++			struct rule_update_path_info *inp)
++{
++	bool ret = false;
++
++	if (!rule)
++		return ret;
++
++	switch (rule->rule_ops.op) {
++	case OP_LE:
++	case OP_LT:
++	case OP_GT:
++	case OP_GE:
++	{
++		u64 src_field = get_field(rule, inp->id);
++		if (!src_field)
++			ret = false;
++		else
++			ret = do_compare_op(src_field, rule->rule_ops.thresh,
++							rule->rule_ops.op);
++		break;
++	}
++	default:
++		pr_err("Unsupported op %d", rule->rule_ops.op);
++		break;
++	}
++	return ret;
++}
++
++static void match_rule(struct rule_update_path_info *inp_node,
++			struct rule_node_info *node)
++{
++	struct rules_def *rule;
++	int i;
++
++	list_for_each_entry(rule, &node->node_rules, link) {
++		for (i = 0; i < rule->num_src; i++) {
++			if (rule->src_info[i].id == inp_node->id) {
++				if (check_rule(rule, inp_node)) {
++					trace_bus_rules_matches(node->cur_rule,
++						inp_node->id, inp_node->ab,
++						inp_node->ib, inp_node->clk);
++					if (rule->state ==
++						RULE_STATE_NOT_APPLIED)
++						rule->state_change = true;
++					rule->state = RULE_STATE_APPLIED;
++				} else {
++					if (rule->state ==
++						RULE_STATE_APPLIED)
++						rule->state_change = true;
++					rule->state = RULE_STATE_NOT_APPLIED;
++				}
++			}
++		}
++	}
++}
++
++static void apply_rule(struct rule_node_info *node,
++			struct list_head *output_list)
++{
++	struct rules_def *rule;
++
++	node->cur_rule = -1;
++	list_for_each_entry(rule, &node->node_rules, link) {
++		if ((rule->state == RULE_STATE_APPLIED) &&
++						(node->cur_rule == -1))
++			node->cur_rule = rule->rule_id;
++
++		if (node->id == NB_ID) {
++			if (rule->state_change) {
++				rule->state_change = false;
++				raw_notifier_call_chain(&node->rule_notify_list,
++					rule->state, (void *)&rule->rule_ops);
++			}
++		} else {
++			if ((rule->state == RULE_STATE_APPLIED) &&
++				(node->cur_rule == rule->rule_id)) {
++				node->apply.id = rule->rule_ops.dst_node[0];
++				node->apply.throttle = rule->rule_ops.mode;
++				node->apply.lim_bw = rule->rule_ops.dst_bw;
++				list_add_tail(&node->apply.link, output_list);
++			}
++			rule->state_change = false;
++		}
++	}
++
++}
++
++int msm_rules_update_path(struct list_head *input_list,
++			struct list_head *output_list)
++{
++	int ret = 0;
++	struct rule_update_path_info  *inp_node;
++	struct rule_node_info *node_it = NULL;
++
++	mutex_lock(&msm_bus_rules_lock);
++	list_for_each_entry(inp_node, input_list, link) {
++		list_for_each_entry(node_it, &node_list, link) {
++			update_src_id_vote(inp_node, node_it);
++			match_rule(inp_node, node_it);
++		}
++	}
++
++	list_for_each_entry(node_it, &node_list, link)
++		apply_rule(node_it, output_list);
++
++	mutex_unlock(&msm_bus_rules_lock);
++	return ret;
++}
++
++static bool ops_equal(int op1, int op2)
++{
++	bool ret = false;
++
++	switch (op1) {
++	case OP_GT:
++	case OP_GE:
++	case OP_LT:
++	case OP_LE:
++		if (abs(op1 - op2) <= 1)
++			ret = true;
++		break;
++	default:
++		ret = (op1 == op2);
++	}
++
++	return ret;
++}
++
++static int node_rules_compare(void *priv, struct list_head *a,
++					struct list_head *b)
++{
++	struct rules_def *ra = container_of(a, struct rules_def, link);
++	struct rules_def *rb = container_of(b, struct rules_def, link);
++	int ret = -1;
++	int64_t th_diff = 0;
++
++
++	if (ra->rule_ops.mode == rb->rule_ops.mode) {
++		if (ops_equal(ra->rule_ops.op, rb->rule_ops.op)) {
++			if ((ra->rule_ops.op == OP_LT) ||
++				(ra->rule_ops.op == OP_LE)) {
++				th_diff = ra->rule_ops.thresh -
++						rb->rule_ops.thresh;
++				if (th_diff > 0)
++					ret = 1;
++				 else
++					ret = -1;
++			} else if ((ra->rule_ops.op == OP_GT) ||
++					(ra->rule_ops.op == OP_GE)) {
++				th_diff = rb->rule_ops.thresh -
++							ra->rule_ops.thresh;
++				if (th_diff > 0)
++					ret = 1;
++				 else
++					ret = -1;
++			}
++		} else
++			ret = ra->rule_ops.op - rb->rule_ops.op;
++	} else if ((ra->rule_ops.mode == THROTTLE_OFF) &&
++		(rb->rule_ops.mode == THROTTLE_ON)) {
++		ret = 1;
++	} else if ((ra->rule_ops.mode == THROTTLE_ON) &&
++		(rb->rule_ops.mode == THROTTLE_OFF)) {
++		ret = -1;
++	}
++
++	return ret;
++}
++
++static void print_rules(struct rule_node_info *node_it)
++{
++	struct rules_def *node_rule = NULL;
++	int i;
++
++	if (!node_it) {
++		pr_err("%s: no node for found", __func__);
++		return;
++	}
++
++	pr_info("\n Now printing rules for Node %d  cur rule %d\n",
++						node_it->id, node_it->cur_rule);
++	list_for_each_entry(node_rule, &node_it->node_rules, link) {
++		pr_info("\n num Rules %d  rule Id %d\n",
++				node_it->num_rules, node_rule->rule_id);
++		pr_info("Rule: src_field %d\n", node_rule->rule_ops.src_field);
++		for (i = 0; i < node_rule->rule_ops.num_src; i++)
++			pr_info("Rule: src %d\n",
++					node_rule->rule_ops.src_id[i]);
++		for (i = 0; i < node_rule->rule_ops.num_dst; i++)
++			pr_info("Rule: dst %d dst_bw %llu\n",
++						node_rule->rule_ops.dst_node[i],
++						node_rule->rule_ops.dst_bw);
++		pr_info("Rule: thresh %llu op %d mode %d State %d\n",
++					node_rule->rule_ops.thresh,
++					node_rule->rule_ops.op,
++					node_rule->rule_ops.mode,
++					node_rule->state);
++	}
++}
++
++void print_all_rules(void)
++{
++	struct rule_node_info *node_it = NULL;
++
++	list_for_each_entry(node_it, &node_list, link)
++		print_rules(node_it);
++}
++
++void print_rules_buf(char *buf, int max_buf)
++{
++	struct rule_node_info *node_it = NULL;
++	struct rules_def *node_rule = NULL;
++	int i;
++	int cnt = 0;
++
++	list_for_each_entry(node_it, &node_list, link) {
++		cnt += scnprintf(buf + cnt, max_buf - cnt,
++					"\n Now printing rules for Node %d cur_rule %d\n",
++					node_it->id, node_it->cur_rule);
++		list_for_each_entry(node_rule, &node_it->node_rules, link) {
++			cnt += scnprintf(buf + cnt, max_buf - cnt,
++				"\nNum Rules:%d ruleId %d STATE:%d change:%d\n",
++				node_it->num_rules, node_rule->rule_id,
++				node_rule->state, node_rule->state_change);
++			cnt += scnprintf(buf + cnt, max_buf - cnt,
++				"Src_field %d\n",
++				node_rule->rule_ops.src_field);
++			for (i = 0; i < node_rule->rule_ops.num_src; i++)
++				cnt += scnprintf(buf + cnt, max_buf - cnt,
++					"Src %d Cur Ib %llu Ab %llu\n",
++					node_rule->rule_ops.src_id[i],
++					node_rule->src_info[i].ib,
++					node_rule->src_info[i].ab);
++			for (i = 0; i < node_rule->rule_ops.num_dst; i++)
++				cnt += scnprintf(buf + cnt, max_buf - cnt,
++					"Dst %d dst_bw %llu\n",
++					node_rule->rule_ops.dst_node[0],
++					node_rule->rule_ops.dst_bw);
++			cnt += scnprintf(buf + cnt, max_buf - cnt,
++					"Thresh %llu op %d mode %d\n",
++					node_rule->rule_ops.thresh,
++					node_rule->rule_ops.op,
++					node_rule->rule_ops.mode);
++		}
++	}
++}
++
++static int copy_rule(struct bus_rule_type *src, struct rules_def *node_rule,
++			struct notifier_block *nb)
++{
++	int i;
++	int ret = 0;
++
++	memcpy(&node_rule->rule_ops, src,
++				sizeof(struct bus_rule_type));
++	node_rule->rule_ops.src_id = kzalloc(
++			(sizeof(int) * node_rule->rule_ops.num_src),
++							GFP_KERNEL);
++	if (!node_rule->rule_ops.src_id) {
++		pr_err("%s:Failed to allocate for src_id",
++					__func__);
++		return -ENOMEM;
++	}
++	memcpy(node_rule->rule_ops.src_id, src->src_id,
++				sizeof(int) * src->num_src);
++
++
++	if (!nb) {
++		node_rule->rule_ops.dst_node = kzalloc(
++			(sizeof(int) * node_rule->rule_ops.num_dst),
++						GFP_KERNEL);
++		if (!node_rule->rule_ops.dst_node) {
++			pr_err("%s:Failed to allocate for src_id",
++							__func__);
++			return -ENOMEM;
++		}
++		memcpy(node_rule->rule_ops.dst_node, src->dst_node,
++						sizeof(int) * src->num_dst);
++	}
++
++	node_rule->num_src = src->num_src;
++	node_rule->src_info = kzalloc(
++		(sizeof(struct node_vote_info) * node_rule->rule_ops.num_src),
++							GFP_KERNEL);
++	if (!node_rule->src_info) {
++		pr_err("%s:Failed to allocate for src_id",
++						__func__);
++		return -ENOMEM;
++	}
++	for (i = 0; i < src->num_src; i++)
++		node_rule->src_info[i].id = src->src_id[i];
++
++	return ret;
++}
++
++void msm_rule_register(int num_rules, struct bus_rule_type *rule,
++					struct notifier_block *nb)
++{
++	struct rule_node_info *node = NULL;
++	int i, j;
++	struct rules_def *node_rule = NULL;
++	int num_dst = 0;
++
++	if (!rule)
++		return;
++
++	mutex_lock(&msm_bus_rules_lock);
++	for (i = 0; i < num_rules; i++) {
++		if (nb)
++			num_dst = 1;
++		else
++			num_dst = rule[i].num_dst;
++
++		for (j = 0; j < num_dst; j++) {
++			int id = 0;
++
++			if (nb)
++				id = NB_ID;
++			else
++				id = rule[i].dst_node[j];
++
++			node = gen_node(id, nb);
++			if (!node) {
++				pr_info("Error getting rule");
++				goto exit_rule_register;
++			}
++			node_rule = kzalloc(sizeof(struct rules_def),
++						GFP_KERNEL);
++			if (!node_rule) {
++				pr_err("%s: Failed to allocate for rule",
++								__func__);
++				goto exit_rule_register;
++			}
++
++			if (copy_rule(&rule[i], node_rule, nb)) {
++				pr_err("Error copying rule");
++				goto exit_rule_register;
++			}
++
++			node_rule->rule_id = node->num_rules++;
++			if (nb)
++				node->data = nb;
++
++			list_add_tail(&node_rule->link, &node->node_rules);
++		}
++	}
++	list_sort(NULL, &node->node_rules, node_rules_compare);
++
++	if (nb)
++		raw_notifier_chain_register(&node->rule_notify_list, nb);
++exit_rule_register:
++	mutex_unlock(&msm_bus_rules_lock);
++	return;
++}
++
++static int comp_rules(struct bus_rule_type *rulea, struct bus_rule_type *ruleb)
++{
++	int ret = 1;
++
++	if (rulea->num_src == ruleb->num_src)
++		ret = memcmp(rulea->src_id, ruleb->src_id,
++				(sizeof(int) * rulea->num_src));
++	if (!ret && (rulea->num_dst == ruleb->num_dst))
++		ret = memcmp(rulea->dst_node, ruleb->dst_node,
++				(sizeof(int) * rulea->num_dst));
++	if (!ret && (rulea->dst_bw == ruleb->dst_bw) &&
++		(rulea->op == ruleb->op) && (rulea->thresh == ruleb->thresh))
++		ret = 0;
++
++	return ret;
++}
++
++void msm_rule_unregister(int num_rules, struct bus_rule_type *rule,
++					struct notifier_block *nb)
++{
++	int i;
++	struct rule_node_info *node = NULL;
++	struct rule_node_info *node_tmp = NULL;
++	struct rules_def *node_rule;
++	struct rules_def *node_rule_tmp;
++	bool match_found = false;
++
++	if (!rule)
++		return;
++
++	mutex_lock(&msm_bus_rules_lock);
++	if (nb) {
++		node = get_node(NB_ID, nb);
++		if (!node) {
++			pr_err("%s: Can't find node", __func__);
++			goto exit_unregister_rule;
++		}
++
++		list_for_each_entry_safe(node_rule, node_rule_tmp,
++					&node->node_rules, link) {
++			list_del(&node_rule->link);
++			kfree(node_rule);
++			node->num_rules--;
++		}
++		raw_notifier_chain_unregister(&node->rule_notify_list, nb);
++	} else {
++		for (i = 0; i < num_rules; i++) {
++			match_found = false;
++
++			list_for_each_entry(node, &node_list, link) {
++				list_for_each_entry_safe(node_rule,
++				node_rule_tmp, &node->node_rules, link) {
++					if (comp_rules(&node_rule->rule_ops,
++						&rule[i]) == 0) {
++						list_del(&node_rule->link);
++						kfree(node_rule);
++						match_found = true;
++						node->num_rules--;
++						list_sort(NULL,
++							&node->node_rules,
++							node_rules_compare);
++						break;
++					}
++				}
++			}
++		}
++	}
++
++	list_for_each_entry_safe(node, node_tmp,
++					&node_list, link) {
++		if (!node->num_rules) {
++			pr_debug("Deleting Rule node %d", node->id);
++			list_del(&node->link);
++			kfree(node);
++		}
++	}
++exit_unregister_rule:
++	mutex_unlock(&msm_bus_rules_lock);
++}
++
++bool msm_rule_are_rules_registered(void)
++{
++	bool ret = false;
++
++	if (list_empty(&node_list))
++		ret = false;
++	else
++		ret = true;
++
++	return ret;
++}
++
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_bus_rules.h
+@@ -0,0 +1,77 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#ifndef _ARCH_ARM_MACH_MSM_BUS_RULES_H
++#define _ARCH_ARM_MACH_MSM_BUS_RULES_H
++
++#include <linux/types.h>
++#include <linux/list.h>
++#include <linux/notifier.h>
++#include <dt-bindings/msm/msm-bus-rule-ops.h>
++
++#define MAX_NODES		(5)
++
++struct rule_update_path_info {
++	u32 id;
++	u64 ab;
++	u64 ib;
++	u64 clk;
++	struct list_head link;
++};
++
++struct rule_apply_rcm_info {
++	u32 id;
++	u64 lim_bw;
++	int throttle;
++	bool after_clk_commit;
++	struct list_head link;
++};
++
++struct bus_rule_type {
++	int num_src;
++	int *src_id;
++	int src_field;
++	int op;
++	u64 thresh;
++	int num_dst;
++	int *dst_node;
++	u64 dst_bw;
++	int mode;
++	void *client_data;
++};
++
++#if (defined(CONFIG_BUS_TOPOLOGY_ADHOC))
++void msm_rule_register(int num_rules, struct bus_rule_type *rule,
++				struct notifier_block *nb);
++void msm_rule_unregister(int num_rules, struct bus_rule_type *rule,
++						struct notifier_block *nb);
++void print_rules_buf(char *buf, int count);
++bool msm_rule_are_rules_registered(void);
++#else
++static inline void msm_rule_register(int num_rules, struct bus_rule_type *rule,
++				struct notifier_block *nb)
++{
++}
++static inline void msm_rule_unregister(int num_rules,
++					struct bus_rule_type *rule,
++					struct notifier_block *nb)
++{
++}
++static inline void print_rules_buf(char *buf, int count)
++{
++}
++static inline bool msm_rule_are_rules_registered(void)
++{
++	return false;
++}
++#endif /* defined(CONFIG_BUS_TOPOLOGY_ADHOC) */
++#endif /* _ARCH_ARM_MACH_MSM_BUS_RULES_H */
+--- /dev/null
++++ b/drivers/bus/msm_bus/msm_buspm_coresight_adhoc.c
+@@ -0,0 +1,189 @@
++/* Copyright (c) 2014 The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/clk.h>
++#include <linux/module.h>
++#include <linux/device.h>
++#include <linux/platform_device.h>
++#include <linux/err.h>
++#include <linux/slab.h>
++#include <linux/errno.h>
++#include <linux/uaccess.h>
++#include <linux/miscdevice.h>
++#include <linux/of_coresight.h>
++#include <linux/coresight.h>
++#include <linux/io.h>
++#include <linux/of.h>
++#include <linux/list.h>
++
++struct msmbus_coresight_adhoc_clock_drvdata {
++	int				 id;
++	struct clk			*clk;
++	struct list_head		 list;
++};
++
++struct msmbus_coresight_adhoc_drvdata {
++	struct device			*dev;
++	struct coresight_device		*csdev;
++	struct coresight_desc		*desc;
++	struct list_head		 clocks;
++};
++
++static int msmbus_coresight_enable_adhoc(struct coresight_device *csdev)
++{
++	struct msmbus_coresight_adhoc_clock_drvdata *clk;
++	struct msmbus_coresight_adhoc_drvdata *drvdata =
++		dev_get_drvdata(csdev->dev.parent);
++	long rate;
++
++	list_for_each_entry(clk, &drvdata->clocks, list) {
++		if (clk->id == csdev->id) {
++			rate = clk_round_rate(clk->clk, 1L);
++			clk_set_rate(clk->clk, rate);
++			return clk_prepare_enable(clk->clk);
++		}
++	}
++
++	return -ENOENT;
++}
++
++static void msmbus_coresight_disable_adhoc(struct coresight_device *csdev)
++{
++	struct msmbus_coresight_adhoc_clock_drvdata *clk;
++	struct msmbus_coresight_adhoc_drvdata *drvdata =
++		dev_get_drvdata(csdev->dev.parent);
++
++	list_for_each_entry(clk, &drvdata->clocks, list) {
++		if (clk->id == csdev->id)
++			clk_disable_unprepare(clk->clk);
++	}
++}
++
++static const struct coresight_ops_source msmbus_coresight_adhoc_source_ops = {
++	.enable		= msmbus_coresight_enable_adhoc,
++	.disable	= msmbus_coresight_disable_adhoc,
++};
++
++static const struct coresight_ops msmbus_coresight_cs_ops = {
++	.source_ops	= &msmbus_coresight_adhoc_source_ops,
++};
++
++void msmbus_coresight_remove_adhoc(struct platform_device *pdev)
++{
++	struct msmbus_coresight_adhoc_clock_drvdata *clk, *next_clk;
++	struct msmbus_coresight_adhoc_drvdata *drvdata =
++		platform_get_drvdata(pdev);
++
++	msmbus_coresight_disable_adhoc(drvdata->csdev);
++	coresight_unregister(drvdata->csdev);
++	list_for_each_entry_safe(clk, next_clk, &drvdata->clocks, list) {
++		list_del(&clk->list);
++		devm_kfree(&pdev->dev, clk);
++	}
++	devm_kfree(&pdev->dev, drvdata->desc);
++	devm_kfree(&pdev->dev, drvdata);
++	platform_set_drvdata(pdev, NULL);
++}
++EXPORT_SYMBOL(msmbus_coresight_remove_adhoc);
++
++static int buspm_of_get_clk_adhoc(struct device_node *of_node,
++	struct msmbus_coresight_adhoc_drvdata *drvdata, int id)
++{
++	struct msmbus_coresight_adhoc_clock_drvdata *clk;
++	clk = devm_kzalloc(drvdata->dev, sizeof(*clk), GFP_KERNEL);
++
++	if (!clk)
++		return -ENOMEM;
++
++	clk->id = id;
++
++	clk->clk = of_clk_get_by_name(of_node, "bus_clk");
++	if (IS_ERR(clk->clk)) {
++		pr_err("Error: unable to get clock for coresight node %d\n",
++			id);
++		goto err;
++	}
++
++	list_add(&clk->list, &drvdata->clocks);
++	return 0;
++
++err:
++	devm_kfree(drvdata->dev, clk);
++	return -EINVAL;
++}
++
++int msmbus_coresight_init_adhoc(struct platform_device *pdev,
++		struct device_node *of_node)
++{
++	int ret;
++	struct device *dev = &pdev->dev;
++	struct coresight_platform_data *pdata;
++	struct msmbus_coresight_adhoc_drvdata *drvdata;
++	struct coresight_desc *desc;
++
++	pdata = of_get_coresight_platform_data(dev, of_node);
++	if (IS_ERR(pdata))
++		return PTR_ERR(pdata);
++
++	drvdata = platform_get_drvdata(pdev);
++	if (IS_ERR_OR_NULL(drvdata)) {
++		drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
++		if (!drvdata) {
++			pr_err("coresight: Alloc for drvdata failed\n");
++			return -ENOMEM;
++		}
++		INIT_LIST_HEAD(&drvdata->clocks);
++		drvdata->dev = &pdev->dev;
++		platform_set_drvdata(pdev, drvdata);
++	}
++	ret = buspm_of_get_clk_adhoc(of_node, drvdata, pdata->id);
++	if (ret) {
++		pr_err("Error getting clocks\n");
++		ret = -ENXIO;
++		goto err1;
++	}
++
++	desc = devm_kzalloc(dev, sizeof(*desc), GFP_KERNEL);
++	if (!desc) {
++		pr_err("coresight: Error allocating memory\n");
++		ret = -ENOMEM;
++		goto err1;
++	}
++
++	desc->type = CORESIGHT_DEV_TYPE_SOURCE;
++	desc->subtype.source_subtype = CORESIGHT_DEV_SUBTYPE_SOURCE_BUS;
++	desc->ops = &msmbus_coresight_cs_ops;
++	desc->pdata = pdata;
++	desc->dev = &pdev->dev;
++	desc->owner = THIS_MODULE;
++	drvdata->desc = desc;
++	drvdata->csdev = coresight_register(desc);
++	if (IS_ERR(drvdata->csdev)) {
++		pr_err("coresight: Coresight register failed\n");
++		ret = PTR_ERR(drvdata->csdev);
++		goto err0;
++	}
++
++	dev_info(dev, "msmbus_coresight initialized\n");
++
++	return 0;
++err0:
++	devm_kfree(dev, desc);
++err1:
++	devm_kfree(dev, drvdata);
++	platform_set_drvdata(pdev, NULL);
++	return ret;
++}
++EXPORT_SYMBOL(msmbus_coresight_init_adhoc);
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("MSM BusPM Adhoc CoreSight Driver");
+--- /dev/null
++++ b/drivers/bus/msm_bus/rpm-smd.h
+@@ -0,0 +1,268 @@
++/* Copyright (c) 2012, 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef __ARCH_ARM_MACH_MSM_RPM_SMD_H
++#define __ARCH_ARM_MACH_MSM_RPM_SMD_H
++
++/**
++ * enum msm_rpm_set - RPM enumerations for sleep/active set
++ * %MSM_RPM_CTX_SET_0: Set resource parameters for active mode.
++ * %MSM_RPM_CTX_SET_SLEEP: Set resource parameters for sleep.
++ */
++enum msm_rpm_set {
++	MSM_RPM_CTX_ACTIVE_SET,
++	MSM_RPM_CTX_SLEEP_SET,
++};
++
++struct msm_rpm_request;
++
++struct msm_rpm_kvp {
++	uint32_t key;
++	uint32_t length;
++	uint8_t *data;
++};
++#ifdef CONFIG_MSM_RPM_SMD
++/**
++ * msm_rpm_request() - Creates a parent element to identify the
++ * resource on the RPM, that stores the KVPs for different fields modified
++ * for a hardware resource
++ *
++ * @set: if the device is setting the active/sleep set parameter
++ * for the resource
++ * @rsc_type: unsigned 32 bit integer that identifies the type of the resource
++ * @rsc_id: unsigned 32 bit that uniquely identifies a resource within a type
++ * @num_elements: number of KVPs pairs associated with the resource
++ *
++ * returns pointer to a msm_rpm_request on success, NULL on error
++ */
++struct msm_rpm_request *msm_rpm_create_request(
++		enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, int num_elements);
++
++/**
++ * msm_rpm_request_noirq() - Creates a parent element to identify the
++ * resource on the RPM, that stores the KVPs for different fields modified
++ * for a hardware resource. This function is similar to msm_rpm_create_request
++ * except that it has to be called with interrupts masked.
++ *
++ * @set: if the device is setting the active/sleep set parameter
++ * for the resource
++ * @rsc_type: unsigned 32 bit integer that identifies the type of the resource
++ * @rsc_id: unsigned 32 bit that uniquely identifies a resource within a type
++ * @num_elements: number of KVPs pairs associated with the resource
++ *
++ * returns pointer to a msm_rpm_request on success, NULL on error
++ */
++struct msm_rpm_request *msm_rpm_create_request_noirq(
++		enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, int num_elements);
++
++/**
++ * msm_rpm_add_kvp_data() - Adds a Key value pair to a existing RPM resource.
++ *
++ * @handle: RPM resource handle to which the data should be appended
++ * @key:  unsigned integer identify the parameter modified
++ * @data: byte array that contains the value corresponding to key.
++ * @size:   size of data in bytes.
++ *
++ * returns 0 on success or errno
++ */
++int msm_rpm_add_kvp_data(struct msm_rpm_request *handle,
++		uint32_t key, const uint8_t *data, int size);
++
++/**
++ * msm_rpm_add_kvp_data_noirq() - Adds a Key value pair to a existing RPM
++ * resource. This function is similar to msm_rpm_add_kvp_data except that it
++ * has to be called with interrupts masked.
++ *
++ * @handle: RPM resource handle to which the data should be appended
++ * @key:  unsigned integer identify the parameter modified
++ * @data: byte array that contains the value corresponding to key.
++ * @size:   size of data in bytes.
++ *
++ * returns 0 on success or errno
++ */
++int msm_rpm_add_kvp_data_noirq(struct msm_rpm_request *handle,
++		uint32_t key, const uint8_t *data, int size);
++
++/** msm_rpm_free_request() - clean up the RPM request handle created with
++ * msm_rpm_create_request
++ *
++ * @handle: RPM resource handle to be cleared.
++ */
++
++void msm_rpm_free_request(struct msm_rpm_request *handle);
++
++/**
++ * msm_rpm_send_request() - Send the RPM messages using SMD. The function
++ * assigns a message id before sending the data out to the RPM. RPM hardware
++ * uses the message id to acknowledge the messages.
++ *
++ * @handle: pointer to the msm_rpm_request for the resource being modified.
++ *
++ * returns non-zero message id on success and zero on a failed transaction.
++ * The drivers use message id to wait for ACK from RPM.
++ */
++int msm_rpm_send_request(struct msm_rpm_request *handle);
++
++/**
++ * msm_rpm_send_request_noirq() - Send the RPM messages using SMD. The
++ * function assigns a message id before sending the data out to the RPM.
++ * RPM hardware uses the message id to acknowledge the messages. This function
++ * is similar to msm_rpm_send_request except that it has to be called with
++ * interrupts masked.
++ *
++ * @handle: pointer to the msm_rpm_request for the resource being modified.
++ *
++ * returns non-zero message id on success and zero on a failed transaction.
++ * The drivers use message id to wait for ACK from RPM.
++ */
++int msm_rpm_send_request_noirq(struct msm_rpm_request *handle);
++
++/**
++ * msm_rpm_wait_for_ack() - A blocking call that waits for acknowledgment of
++ * a message from RPM.
++ *
++ * @msg_id: the return from msm_rpm_send_requests
++ *
++ * returns 0 on success or errno
++ */
++int msm_rpm_wait_for_ack(uint32_t msg_id);
++
++/**
++ * msm_rpm_wait_for_ack_noirq() - A blocking call that waits for acknowledgment
++ * of a message from RPM. This function is similar to msm_rpm_wait_for_ack
++ * except that it has to be called with interrupts masked.
++ *
++ * @msg_id: the return from msm_rpm_send_request
++ *
++ * returns 0 on success or errno
++ */
++int msm_rpm_wait_for_ack_noirq(uint32_t msg_id);
++
++/**
++ * msm_rpm_send_message() -Wrapper function for clients to send data given an
++ * array of key value pairs.
++ *
++ * @set: if the device is setting the active/sleep set parameter
++ * for the resource
++ * @rsc_type: unsigned 32 bit integer that identifies the type of the resource
++ * @rsc_id: unsigned 32 bit that uniquely identifies a resource within a type
++ * @kvp: array of KVP data.
++ * @nelem: number of KVPs pairs associated with the message.
++ *
++ * returns  0 on success and errno on failure.
++ */
++int msm_rpm_send_message(enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, struct msm_rpm_kvp *kvp, int nelems);
++
++/**
++ * msm_rpm_send_message_noirq() -Wrapper function for clients to send data
++ * given an array of key value pairs. This function is similar to the
++ * msm_rpm_send_message() except that it has to be called with interrupts
++ * disabled. Clients should choose the irq version when possible for system
++ * performance.
++ *
++ * @set: if the device is setting the active/sleep set parameter
++ * for the resource
++ * @rsc_type: unsigned 32 bit integer that identifies the type of the resource
++ * @rsc_id: unsigned 32 bit that uniquely identifies a resource within a type
++ * @kvp: array of KVP data.
++ * @nelem: number of KVPs pairs associated with the message.
++ *
++ * returns  0 on success and errno on failure.
++ */
++int msm_rpm_send_message_noirq(enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, struct msm_rpm_kvp *kvp, int nelems);
++
++/**
++ * msm_rpm_driver_init() - Initialization function that registers for a
++ * rpm platform driver.
++ *
++ * returns 0 on success.
++ */
++int __init msm_rpm_driver_init(void);
++
++#else
++
++static inline struct msm_rpm_request *msm_rpm_create_request(
++		enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, int num_elements)
++{
++	return NULL;
++}
++
++static inline struct msm_rpm_request *msm_rpm_create_request_noirq(
++		enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, int num_elements)
++{
++	return NULL;
++
++}
++static inline uint32_t msm_rpm_add_kvp_data(struct msm_rpm_request *handle,
++		uint32_t key, const uint8_t *data, int count)
++{
++	return 0;
++}
++static inline uint32_t msm_rpm_add_kvp_data_noirq(
++		struct msm_rpm_request *handle, uint32_t key,
++		const uint8_t *data, int count)
++{
++	return 0;
++}
++
++static inline void msm_rpm_free_request(struct msm_rpm_request *handle)
++{
++	return;
++}
++
++static inline int msm_rpm_send_request(struct msm_rpm_request *handle)
++{
++	return 0;
++}
++
++static inline int msm_rpm_send_request_noirq(struct msm_rpm_request *handle)
++{
++	return 0;
++
++}
++
++static inline int msm_rpm_send_message(enum msm_rpm_set set, uint32_t rsc_type,
++		uint32_t rsc_id, struct msm_rpm_kvp *kvp, int nelems)
++{
++	return 0;
++}
++
++static inline int msm_rpm_send_message_noirq(enum msm_rpm_set set,
++		uint32_t rsc_type, uint32_t rsc_id, struct msm_rpm_kvp *kvp,
++		int nelems)
++{
++	return 0;
++}
++
++static inline int msm_rpm_wait_for_ack(uint32_t msg_id)
++{
++	return 0;
++
++}
++static inline int msm_rpm_wait_for_ack_noirq(uint32_t msg_id)
++{
++	return 0;
++}
++
++static inline int __init msm_rpm_driver_init(void)
++{
++	return 0;
++}
++#endif
++#endif /*__ARCH_ARM_MACH_MSM_RPM_SMD_H*/
+--- /dev/null
++++ b/include/trace/events/trace_msm_bus.h
+@@ -0,0 +1,163 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM msm_bus
++
++#if !defined(_TRACE_MSM_BUS_H) || defined(TRACE_HEADER_MULTI_READ)
++#define _TRACE_MSM_BUS_H
++
++#include <linux/tracepoint.h>
++
++TRACE_EVENT(bus_update_request,
++
++	TP_PROTO(int sec, int nsec, const char *name, unsigned int index,
++		int src, int dest, unsigned long long ab,
++		unsigned long long ib),
++
++	TP_ARGS(sec, nsec, name, index, src, dest, ab, ib),
++
++	TP_STRUCT__entry(
++		__field(int, sec)
++		__field(int, nsec)
++		__string(name, name)
++		__field(u32, index)
++		__field(int, src)
++		__field(int, dest)
++		__field(u64, ab)
++		__field(u64, ib)
++	),
++
++	TP_fast_assign(
++		__entry->sec = sec;
++		__entry->nsec = nsec;
++		__assign_str(name, name);
++		__entry->index = index;
++		__entry->src = src;
++		__entry->dest = dest;
++		__entry->ab = ab;
++		__entry->ib = ib;
++	),
++
++	TP_printk("time= %d.%d name=%s index=%u src=%d dest=%d ab=%llu ib=%llu",
++		__entry->sec,
++		__entry->nsec,
++		__get_str(name),
++		(unsigned int)__entry->index,
++		__entry->src,
++		__entry->dest,
++		(unsigned long long)__entry->ab,
++		(unsigned long long)__entry->ib)
++);
++
++TRACE_EVENT(bus_bimc_config_limiter,
++
++	TP_PROTO(int mas_id, unsigned long long cur_lim_bw),
++
++	TP_ARGS(mas_id, cur_lim_bw),
++
++	TP_STRUCT__entry(
++		__field(int, mas_id)
++		__field(u64, cur_lim_bw)
++	),
++
++	TP_fast_assign(
++		__entry->mas_id = mas_id;
++		__entry->cur_lim_bw = cur_lim_bw;
++	),
++
++	TP_printk("Master=%d cur_lim_bw=%llu",
++		__entry->mas_id,
++		(unsigned long long)__entry->cur_lim_bw)
++);
++
++TRACE_EVENT(bus_avail_bw,
++
++	TP_PROTO(unsigned long long cur_bimc_bw, unsigned long long cur_mdp_bw),
++
++	TP_ARGS(cur_bimc_bw, cur_mdp_bw),
++
++	TP_STRUCT__entry(
++		__field(u64, cur_bimc_bw)
++		__field(u64, cur_mdp_bw)
++	),
++
++	TP_fast_assign(
++		__entry->cur_bimc_bw = cur_bimc_bw;
++		__entry->cur_mdp_bw = cur_mdp_bw;
++	),
++
++	TP_printk("cur_bimc_bw = %llu cur_mdp_bw = %llu",
++		(unsigned long long)__entry->cur_bimc_bw,
++		(unsigned long long)__entry->cur_mdp_bw)
++);
++
++TRACE_EVENT(bus_rules_matches,
++
++	TP_PROTO(int node_id, int rule_id, unsigned long long node_ab,
++		unsigned long long node_ib, unsigned long long node_clk),
++
++	TP_ARGS(node_id, rule_id, node_ab, node_ib, node_clk),
++
++	TP_STRUCT__entry(
++		__field(int, node_id)
++		__field(int, rule_id)
++		__field(u64, node_ab)
++		__field(u64, node_ib)
++		__field(u64, node_clk)
++	),
++
++	TP_fast_assign(
++		__entry->node_id = node_id;
++		__entry->rule_id = rule_id;
++		__entry->node_ab = node_ab;
++		__entry->node_ib = node_ib;
++		__entry->node_clk = node_clk;
++	),
++
++	TP_printk("Rule match node%d rule%d node-ab%llu:ib%llu:clk%llu",
++		__entry->node_id, __entry->rule_id,
++		(unsigned long long)__entry->node_ab,
++		(unsigned long long)__entry->node_ib,
++		(unsigned long long)__entry->node_clk)
++);
++
++TRACE_EVENT(bus_bke_params,
++
++	TP_PROTO(u32 gc, u32 gp, u32 thl, u32 thm, u32 thh),
++
++	TP_ARGS(gc, gp, thl, thm, thh),
++
++	TP_STRUCT__entry(
++		__field(u32, gc)
++		__field(u32, gp)
++		__field(u32, thl)
++		__field(u32, thm)
++		__field(u32, thh)
++	),
++
++	TP_fast_assign(
++		__entry->gc = gc;
++		__entry->gp = gp;
++		__entry->thl = thl;
++		__entry->thm = thm;
++		__entry->thh = thh;
++	),
++
++	TP_printk("BKE Params GC=0x%x GP=0x%x THL=0x%x THM=0x%x THH=0x%x",
++		__entry->gc, __entry->gp, __entry->thl, __entry->thm,
++			__entry->thh)
++);
++
++#endif
++#define TRACE_INCLUDE_FILE trace_msm_bus
++#include <trace/define_trace.h>
diff --git a/target/linux/ipq40xx/patches-4.14/400-mtd-ubi-add-quirk-to-autoload-ubi-on-rt-ac58u.patch b/target/linux/ipq40xx/patches-4.14/400-mtd-ubi-add-quirk-to-autoload-ubi-on-rt-ac58u.patch
new file mode 100644
index 000000000..86cb45461
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/400-mtd-ubi-add-quirk-to-autoload-ubi-on-rt-ac58u.patch
@@ -0,0 +1,29 @@
+From b8f3a7ccbeca5bdbd1b6210b94b38d3fef2dd0bd Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 19 Jan 2017 01:57:22 +0100
+Subject: [PATCH 16/38] mtd: ubi: add auto_attach HACK for the ASUS RT-AC58U
+
+This patch adds a hack that allows UBI's autoattach feature
+to work with the custom ASUS UBI_DEV partition name.
+
+This is necessary because the vendor's u-boot doesn't leave
+the bootargs / cmdline alone, so the it can't be overwritten
+easily otherwise.
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+---
+ drivers/mtd/ubi/build.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1170,6 +1170,9 @@ static void __init ubi_auto_attach(void)
+ 	mtd = open_mtd_device("ubi");
+ 	if (IS_ERR(mtd))
+ 		mtd = open_mtd_device("data");
++	/* Hack for the Asus RT-AC58U */
++	if (IS_ERR(mtd))
++		mtd = open_mtd_device("UBI_DEV");
+ 
+ 	if (!IS_ERR(mtd)) {
+ 		size_t len;
diff --git a/target/linux/ipq40xx/patches-4.14/605-net-IPQ4019-needs-rfs-vlan_tag-callbacks-in.patch b/target/linux/ipq40xx/patches-4.14/605-net-IPQ4019-needs-rfs-vlan_tag-callbacks-in.patch
new file mode 100644
index 000000000..a52fe2832
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/605-net-IPQ4019-needs-rfs-vlan_tag-callbacks-in.patch
@@ -0,0 +1,53 @@
+From 7c129254adb1093d10a62ed7bf7b956fcc6ffe34 Mon Sep 17 00:00:00 2001
+From: Rakesh Nair <ranair@codeaurora.org>
+Date: Wed, 20 Jul 2016 15:02:01 +0530
+Subject: [PATCH] net: IPQ4019 needs rfs/vlan_tag callbacks in
+ netdev_ops
+
+Add callback support to get default vlan tag and register
+receive flow steering filter.
+
+Used by IPQ4019 ess-edma driver.
+
+BUG=chrome-os-partner:33096
+TEST=none
+
+Change-Id: I266070e4a0fbe4a0d9966fe79a71e50ec4f26c75
+Signed-off-by: Rakesh Nair <ranair@codeaurora.org>
+Reviewed-on: https://chromium-review.googlesource.com/362203
+Commit-Ready: Grant Grundler <grundler@chromium.org>
+Tested-by: Grant Grundler <grundler@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+---
+ include/linux/netdevice.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -713,6 +713,16 @@ struct xps_map {
+ #define XPS_MIN_MAP_ALLOC ((L1_CACHE_ALIGN(offsetof(struct xps_map, queues[1])) \
+        - sizeof(struct xps_map)) / sizeof(u16))
+ 
++#ifdef CONFIG_RFS_ACCEL
++typedef int (*set_rfs_filter_callback_t)(struct net_device *dev,
++                                     __be32 src,
++                                     __be32 dst,
++                                     __be16 sport,
++                                     __be16 dport,
++                                     u8 proto,
++                                     u16 rxq_index,
++                                     u32 action);
++#endif
+ /*
+  * This structure holds all XPS maps for device.  Maps are indexed by CPU.
+  */
+@@ -1239,6 +1249,9 @@ struct net_device_ops {
+ 						     const struct sk_buff *skb,
+ 						     u16 rxq_index,
+ 						     u32 flow_id);
++        int                     (*ndo_register_rfs_filter)(struct net_device *dev,
++                                                              set_rfs_filter_callback_t set_filter);
++        int                     (*ndo_get_default_vlan_tag)(struct net_device *net);
+ #endif
+ 	int			(*ndo_add_slave)(struct net_device *dev,
+ 						 struct net_device *slave_dev);
diff --git a/target/linux/ipq40xx/patches-4.14/700-net-add-qualcomm-mdio-and-phy.patch b/target/linux/ipq40xx/patches-4.14/700-net-add-qualcomm-mdio-and-phy.patch
new file mode 100644
index 000000000..c6e715510
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/700-net-add-qualcomm-mdio-and-phy.patch
@@ -0,0 +1,2690 @@
+From 5a71a2005a2e1e6bbe36f00386c495ad6626beb2 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 19 Jan 2017 01:59:43 +0100
+Subject: [PATCH 30/38] NET: add qualcomm mdio and PHY
+
+---
+ drivers/net/phy/Kconfig  | 14 ++++++++++++++
+ drivers/net/phy/Makefile |  2 ++
+ 2 files changed, 16 insertions(+)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -481,6 +481,20 @@ config XILINX_GMII2RGMII
+ 	  the Reduced Gigabit Media Independent Interface(RGMII) between
+ 	  Ethernet physical media devices and the Gigabit Ethernet controller.
+ 
++config MDIO_IPQ40XX
++	tristate "Qualcomm Atheros ipq40xx MDIO interface"
++	depends on HAS_IOMEM && OF
++	---help---
++	  This driver supports the MDIO interface found in Qualcomm
++	  Atheros ipq40xx Soc chip.
++
++config AR40XX_PHY
++	tristate "Driver for Qualcomm Atheros IPQ40XX switches"
++	depends on HAS_IOMEM && OF
++	select SWCONFIG
++	---help---
++	   This is the driver for Qualcomm Atheros IPQ40XX ESS switches.
++
+ endif # PHYLIB
+ 
+ config MICREL_KS8995MA
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -48,6 +48,7 @@ obj-$(CONFIG_MDIO_CAVIUM)	+= mdio-cavium
+ obj-$(CONFIG_MDIO_GPIO)		+= mdio-gpio.o
+ obj-$(CONFIG_MDIO_HISI_FEMAC)	+= mdio-hisi-femac.o
+ obj-$(CONFIG_MDIO_I2C)		+= mdio-i2c.o
++obj-$(CONFIG_MDIO_IPQ40XX)	+= mdio-ipq40xx.o
+ obj-$(CONFIG_MDIO_MOXART)	+= mdio-moxart.o
+ obj-$(CONFIG_MDIO_OCTEON)	+= mdio-octeon.o
+ obj-$(CONFIG_MDIO_SUN4I)	+= mdio-sun4i.o
+@@ -60,6 +61,7 @@ obj-y				+= $(sfp-obj-y) $(sfp-obj-m)
+ 
+ obj-$(CONFIG_AMD_PHY)		+= amd.o
+ obj-$(CONFIG_AQUANTIA_PHY)	+= aquantia.o
++obj-$(CONFIG_AR40XX_PHY)	+= ar40xx.o
+ obj-$(CONFIG_AT803X_PHY)	+= at803x.o
+ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_BCM7XXX_PHY)	+= bcm7xxx.o
+--- /dev/null
++++ b/drivers/net/phy/ar40xx.c
+@@ -0,0 +1,2090 @@
++/*
++ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/module.h>
++#include <linux/list.h>
++#include <linux/bitops.h>
++#include <linux/switch.h>
++#include <linux/delay.h>
++#include <linux/phy.h>
++#include <linux/clk.h>
++#include <linux/reset.h>
++#include <linux/lockdep.h>
++#include <linux/workqueue.h>
++#include <linux/of_device.h>
++#include <linux/of_address.h>
++#include <linux/mdio.h>
++#include <linux/gpio.h>
++
++#include "ar40xx.h"
++
++static struct ar40xx_priv *ar40xx_priv;
++
++#define MIB_DESC(_s , _o, _n)	\
++	{			\
++		.size = (_s),	\
++		.offset = (_o),	\
++		.name = (_n),	\
++	}
++
++static const struct ar40xx_mib_desc ar40xx_mibs[] = {
++	MIB_DESC(1, AR40XX_STATS_RXBROAD, "RxBroad"),
++	MIB_DESC(1, AR40XX_STATS_RXPAUSE, "RxPause"),
++	MIB_DESC(1, AR40XX_STATS_RXMULTI, "RxMulti"),
++	MIB_DESC(1, AR40XX_STATS_RXFCSERR, "RxFcsErr"),
++	MIB_DESC(1, AR40XX_STATS_RXALIGNERR, "RxAlignErr"),
++	MIB_DESC(1, AR40XX_STATS_RXRUNT, "RxRunt"),
++	MIB_DESC(1, AR40XX_STATS_RXFRAGMENT, "RxFragment"),
++	MIB_DESC(1, AR40XX_STATS_RX64BYTE, "Rx64Byte"),
++	MIB_DESC(1, AR40XX_STATS_RX128BYTE, "Rx128Byte"),
++	MIB_DESC(1, AR40XX_STATS_RX256BYTE, "Rx256Byte"),
++	MIB_DESC(1, AR40XX_STATS_RX512BYTE, "Rx512Byte"),
++	MIB_DESC(1, AR40XX_STATS_RX1024BYTE, "Rx1024Byte"),
++	MIB_DESC(1, AR40XX_STATS_RX1518BYTE, "Rx1518Byte"),
++	MIB_DESC(1, AR40XX_STATS_RXMAXBYTE, "RxMaxByte"),
++	MIB_DESC(1, AR40XX_STATS_RXTOOLONG, "RxTooLong"),
++	MIB_DESC(2, AR40XX_STATS_RXGOODBYTE, "RxGoodByte"),
++	MIB_DESC(2, AR40XX_STATS_RXBADBYTE, "RxBadByte"),
++	MIB_DESC(1, AR40XX_STATS_RXOVERFLOW, "RxOverFlow"),
++	MIB_DESC(1, AR40XX_STATS_FILTERED, "Filtered"),
++	MIB_DESC(1, AR40XX_STATS_TXBROAD, "TxBroad"),
++	MIB_DESC(1, AR40XX_STATS_TXPAUSE, "TxPause"),
++	MIB_DESC(1, AR40XX_STATS_TXMULTI, "TxMulti"),
++	MIB_DESC(1, AR40XX_STATS_TXUNDERRUN, "TxUnderRun"),
++	MIB_DESC(1, AR40XX_STATS_TX64BYTE, "Tx64Byte"),
++	MIB_DESC(1, AR40XX_STATS_TX128BYTE, "Tx128Byte"),
++	MIB_DESC(1, AR40XX_STATS_TX256BYTE, "Tx256Byte"),
++	MIB_DESC(1, AR40XX_STATS_TX512BYTE, "Tx512Byte"),
++	MIB_DESC(1, AR40XX_STATS_TX1024BYTE, "Tx1024Byte"),
++	MIB_DESC(1, AR40XX_STATS_TX1518BYTE, "Tx1518Byte"),
++	MIB_DESC(1, AR40XX_STATS_TXMAXBYTE, "TxMaxByte"),
++	MIB_DESC(1, AR40XX_STATS_TXOVERSIZE, "TxOverSize"),
++	MIB_DESC(2, AR40XX_STATS_TXBYTE, "TxByte"),
++	MIB_DESC(1, AR40XX_STATS_TXCOLLISION, "TxCollision"),
++	MIB_DESC(1, AR40XX_STATS_TXABORTCOL, "TxAbortCol"),
++	MIB_DESC(1, AR40XX_STATS_TXMULTICOL, "TxMultiCol"),
++	MIB_DESC(1, AR40XX_STATS_TXSINGLECOL, "TxSingleCol"),
++	MIB_DESC(1, AR40XX_STATS_TXEXCDEFER, "TxExcDefer"),
++	MIB_DESC(1, AR40XX_STATS_TXDEFER, "TxDefer"),
++	MIB_DESC(1, AR40XX_STATS_TXLATECOL, "TxLateCol"),
++};
++
++static u32
++ar40xx_read(struct ar40xx_priv *priv, int reg)
++{
++	return readl(priv->hw_addr + reg);
++}
++
++static u32
++ar40xx_psgmii_read(struct ar40xx_priv *priv, int reg)
++{
++	return readl(priv->psgmii_hw_addr + reg);
++}
++
++static void
++ar40xx_write(struct ar40xx_priv *priv, int reg, u32 val)
++{
++	writel(val, priv->hw_addr + reg);
++}
++
++static u32
++ar40xx_rmw(struct ar40xx_priv *priv, int reg, u32 mask, u32 val)
++{
++	u32 ret;
++
++	ret = ar40xx_read(priv, reg);
++	ret &= ~mask;
++	ret |= val;
++	ar40xx_write(priv, reg, ret);
++	return ret;
++}
++
++static void
++ar40xx_psgmii_write(struct ar40xx_priv *priv, int reg, u32 val)
++{
++	writel(val, priv->psgmii_hw_addr + reg);
++}
++
++static void
++ar40xx_phy_dbg_write(struct ar40xx_priv *priv, int phy_addr,
++		     u16 dbg_addr, u16 dbg_data)
++{
++	struct mii_bus *bus = priv->mii_bus;
++
++	mutex_lock(&bus->mdio_lock);
++	bus->write(bus, phy_addr, AR40XX_MII_ATH_DBG_ADDR, dbg_addr);
++	bus->write(bus, phy_addr, AR40XX_MII_ATH_DBG_DATA, dbg_data);
++	mutex_unlock(&bus->mdio_lock);
++}
++
++static void
++ar40xx_phy_dbg_read(struct ar40xx_priv *priv, int phy_addr,
++		    u16 dbg_addr, u16 *dbg_data)
++{
++	struct mii_bus *bus = priv->mii_bus;
++
++	mutex_lock(&bus->mdio_lock);
++	bus->write(bus, phy_addr, AR40XX_MII_ATH_DBG_ADDR, dbg_addr);
++	*dbg_data = bus->read(bus, phy_addr, AR40XX_MII_ATH_DBG_DATA);
++	mutex_unlock(&bus->mdio_lock);
++}
++
++static void
++ar40xx_phy_mmd_write(struct ar40xx_priv *priv, u32 phy_id,
++		     u16 mmd_num, u16 reg_id, u16 reg_val)
++{
++	struct mii_bus *bus = priv->mii_bus;
++
++	mutex_lock(&bus->mdio_lock);
++	bus->write(bus, phy_id,
++			AR40XX_MII_ATH_MMD_ADDR, mmd_num);
++	bus->write(bus, phy_id,
++			AR40XX_MII_ATH_MMD_DATA, reg_id);
++	bus->write(bus, phy_id,
++			AR40XX_MII_ATH_MMD_ADDR,
++			0x4000 | mmd_num);
++	bus->write(bus, phy_id,
++		AR40XX_MII_ATH_MMD_DATA, reg_val);
++	mutex_unlock(&bus->mdio_lock);
++}
++
++static u16
++ar40xx_phy_mmd_read(struct ar40xx_priv *priv, u32 phy_id,
++		    u16 mmd_num, u16 reg_id)
++{
++	u16 value;
++	struct mii_bus *bus = priv->mii_bus;
++
++	mutex_lock(&bus->mdio_lock);
++	bus->write(bus, phy_id,
++			AR40XX_MII_ATH_MMD_ADDR, mmd_num);
++	bus->write(bus, phy_id,
++			AR40XX_MII_ATH_MMD_DATA, reg_id);
++	bus->write(bus, phy_id,
++			AR40XX_MII_ATH_MMD_ADDR,
++			0x4000 | mmd_num);
++	value = bus->read(bus, phy_id, AR40XX_MII_ATH_MMD_DATA);
++	mutex_unlock(&bus->mdio_lock);
++	return value;
++}
++
++/* Start of swconfig support */
++
++static void
++ar40xx_phy_poll_reset(struct ar40xx_priv *priv)
++{
++	u32 i, in_reset, retries = 500;
++	struct mii_bus *bus = priv->mii_bus;
++
++	/* Assume RESET was recently issued to some or all of the phys */
++	in_reset = GENMASK(AR40XX_NUM_PHYS - 1, 0);
++
++	while (retries--) {
++		/* 1ms should be plenty of time.
++		 * 802.3 spec allows for a max wait time of 500ms
++		 */
++		usleep_range(1000, 2000);
++
++		for (i = 0; i < AR40XX_NUM_PHYS; i++) {
++			int val;
++
++			/* skip devices which have completed reset */
++			if (!(in_reset & BIT(i)))
++				continue;
++
++			val = mdiobus_read(bus, i, MII_BMCR);
++			if (val < 0)
++				continue;
++
++			/* mark when phy is no longer in reset state */
++			if (!(val & BMCR_RESET))
++				in_reset &= ~BIT(i);
++		}
++
++		if (!in_reset)
++			return;
++	}
++
++	dev_warn(&bus->dev, "Failed to reset all phys! (in_reset: 0x%x)\n",
++		 in_reset);
++}
++
++static void
++ar40xx_phy_init(struct ar40xx_priv *priv)
++{
++	int i;
++	struct mii_bus *bus;
++	u16 val;
++
++	bus = priv->mii_bus;
++	for (i = 0; i < AR40XX_NUM_PORTS - 1; i++) {
++		ar40xx_phy_dbg_read(priv, i, AR40XX_PHY_DEBUG_0, &val);
++		val &= ~AR40XX_PHY_MANU_CTRL_EN;
++		ar40xx_phy_dbg_write(priv, i, AR40XX_PHY_DEBUG_0, val);
++		mdiobus_write(bus, i,
++			      MII_ADVERTISE, ADVERTISE_ALL |
++			      ADVERTISE_PAUSE_CAP |
++			      ADVERTISE_PAUSE_ASYM);
++		mdiobus_write(bus, i, MII_CTRL1000, ADVERTISE_1000FULL);
++		mdiobus_write(bus, i, MII_BMCR, BMCR_RESET | BMCR_ANENABLE);
++	}
++
++	ar40xx_phy_poll_reset(priv);
++}
++
++static void
++ar40xx_port_phy_linkdown(struct ar40xx_priv *priv)
++{
++	struct mii_bus *bus;
++	int i;
++	u16 val;
++
++	bus = priv->mii_bus;
++	for (i = 0; i < AR40XX_NUM_PORTS - 1; i++) {
++		mdiobus_write(bus, i, MII_CTRL1000, 0);
++		mdiobus_write(bus, i, MII_ADVERTISE, 0);
++		mdiobus_write(bus, i, MII_BMCR, BMCR_RESET | BMCR_ANENABLE);
++		ar40xx_phy_dbg_read(priv, i, AR40XX_PHY_DEBUG_0, &val);
++		val |= AR40XX_PHY_MANU_CTRL_EN;
++		ar40xx_phy_dbg_write(priv, i, AR40XX_PHY_DEBUG_0, val);
++		/* disable transmit */
++		ar40xx_phy_dbg_read(priv, i, AR40XX_PHY_DEBUG_2, &val);
++		val &= 0xf00f;
++		ar40xx_phy_dbg_write(priv, i, AR40XX_PHY_DEBUG_2, val);
++	}
++}
++
++static void
++ar40xx_set_mirror_regs(struct ar40xx_priv *priv)
++{
++	int port;
++
++	/* reset all mirror registers */
++	ar40xx_rmw(priv, AR40XX_REG_FWD_CTRL0,
++		   AR40XX_FWD_CTRL0_MIRROR_PORT,
++		   (0xF << AR40XX_FWD_CTRL0_MIRROR_PORT_S));
++	for (port = 0; port < AR40XX_NUM_PORTS; port++) {
++		ar40xx_rmw(priv, AR40XX_REG_PORT_LOOKUP(port),
++			   AR40XX_PORT_LOOKUP_ING_MIRROR_EN, 0);
++
++		ar40xx_rmw(priv, AR40XX_REG_PORT_HOL_CTRL1(port),
++			   AR40XX_PORT_HOL_CTRL1_EG_MIRROR_EN, 0);
++	}
++
++	/* now enable mirroring if necessary */
++	if (priv->source_port >= AR40XX_NUM_PORTS ||
++	    priv->monitor_port >= AR40XX_NUM_PORTS ||
++	    priv->source_port == priv->monitor_port) {
++		return;
++	}
++
++	ar40xx_rmw(priv, AR40XX_REG_FWD_CTRL0,
++		   AR40XX_FWD_CTRL0_MIRROR_PORT,
++		   (priv->monitor_port << AR40XX_FWD_CTRL0_MIRROR_PORT_S));
++
++	if (priv->mirror_rx)
++		ar40xx_rmw(priv, AR40XX_REG_PORT_LOOKUP(priv->source_port), 0,
++			   AR40XX_PORT_LOOKUP_ING_MIRROR_EN);
++
++	if (priv->mirror_tx)
++		ar40xx_rmw(priv, AR40XX_REG_PORT_HOL_CTRL1(priv->source_port),
++			   0, AR40XX_PORT_HOL_CTRL1_EG_MIRROR_EN);
++}
++
++static int
++ar40xx_sw_get_ports(struct switch_dev *dev, struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	u8 ports = priv->vlan_table[val->port_vlan];
++	int i;
++
++	val->len = 0;
++	for (i = 0; i < dev->ports; i++) {
++		struct switch_port *p;
++
++		if (!(ports & BIT(i)))
++			continue;
++
++		p = &val->value.ports[val->len++];
++		p->id = i;
++		if ((priv->vlan_tagged & BIT(i)) ||
++		    (priv->pvid[i] != val->port_vlan))
++			p->flags = BIT(SWITCH_PORT_FLAG_TAGGED);
++		else
++			p->flags = 0;
++	}
++	return 0;
++}
++
++static int
++ar40xx_sw_set_ports(struct switch_dev *dev, struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	u8 *vt = &priv->vlan_table[val->port_vlan];
++	int i;
++
++	*vt = 0;
++	for (i = 0; i < val->len; i++) {
++		struct switch_port *p = &val->value.ports[i];
++
++		if (p->flags & BIT(SWITCH_PORT_FLAG_TAGGED)) {
++			if (val->port_vlan == priv->pvid[p->id])
++				priv->vlan_tagged |= BIT(p->id);
++		} else {
++			priv->vlan_tagged &= ~BIT(p->id);
++			priv->pvid[p->id] = val->port_vlan;
++		}
++
++		*vt |= BIT(p->id);
++	}
++	return 0;
++}
++
++static int
++ar40xx_reg_wait(struct ar40xx_priv *priv, u32 reg, u32 mask, u32 val,
++		unsigned timeout)
++{
++	int i;
++
++	for (i = 0; i < timeout; i++) {
++		u32 t;
++
++		t = ar40xx_read(priv, reg);
++		if ((t & mask) == val)
++			return 0;
++
++		usleep_range(1000, 2000);
++	}
++
++	return -ETIMEDOUT;
++}
++
++static int
++ar40xx_mib_op(struct ar40xx_priv *priv, u32 op)
++{
++	int ret;
++
++	lockdep_assert_held(&priv->mib_lock);
++
++	/* Capture the hardware statistics for all ports */
++	ar40xx_rmw(priv, AR40XX_REG_MIB_FUNC,
++		   AR40XX_MIB_FUNC, (op << AR40XX_MIB_FUNC_S));
++
++	/* Wait for the capturing to complete. */
++	ret = ar40xx_reg_wait(priv, AR40XX_REG_MIB_FUNC,
++			      AR40XX_MIB_BUSY, 0, 10);
++
++	return ret;
++}
++
++static void
++ar40xx_mib_fetch_port_stat(struct ar40xx_priv *priv, int port, bool flush)
++{
++	unsigned int base;
++	u64 *mib_stats;
++	int i;
++	u32 num_mibs = ARRAY_SIZE(ar40xx_mibs);
++
++	WARN_ON(port >= priv->dev.ports);
++
++	lockdep_assert_held(&priv->mib_lock);
++
++	base = AR40XX_REG_PORT_STATS_START +
++	       AR40XX_REG_PORT_STATS_LEN * port;
++
++	mib_stats = &priv->mib_stats[port * num_mibs];
++	if (flush) {
++		u32 len;
++
++		len = num_mibs * sizeof(*mib_stats);
++		memset(mib_stats, 0, len);
++		return;
++	}
++	for (i = 0; i < num_mibs; i++) {
++		const struct ar40xx_mib_desc *mib;
++		u64 t;
++
++		mib = &ar40xx_mibs[i];
++		t = ar40xx_read(priv, base + mib->offset);
++		if (mib->size == 2) {
++			u64 hi;
++
++			hi = ar40xx_read(priv, base + mib->offset + 4);
++			t |= hi << 32;
++		}
++
++		mib_stats[i] += t;
++	}
++}
++
++static int
++ar40xx_mib_capture(struct ar40xx_priv *priv)
++{
++	return ar40xx_mib_op(priv, AR40XX_MIB_FUNC_CAPTURE);
++}
++
++static int
++ar40xx_mib_flush(struct ar40xx_priv *priv)
++{
++	return ar40xx_mib_op(priv, AR40XX_MIB_FUNC_FLUSH);
++}
++
++static int
++ar40xx_sw_set_reset_mibs(struct switch_dev *dev,
++			 const struct switch_attr *attr,
++			 struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	unsigned int len;
++	int ret;
++	u32 num_mibs = ARRAY_SIZE(ar40xx_mibs);
++
++	mutex_lock(&priv->mib_lock);
++
++	len = priv->dev.ports * num_mibs * sizeof(*priv->mib_stats);
++	memset(priv->mib_stats, 0, len);
++	ret = ar40xx_mib_flush(priv);
++
++	mutex_unlock(&priv->mib_lock);
++	return ret;
++}
++
++static int
++ar40xx_sw_set_vlan(struct switch_dev *dev, const struct switch_attr *attr,
++		   struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	priv->vlan = !!val->value.i;
++	return 0;
++}
++
++static int
++ar40xx_sw_get_vlan(struct switch_dev *dev, const struct switch_attr *attr,
++		   struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	val->value.i = priv->vlan;
++	return 0;
++}
++
++static int
++ar40xx_sw_set_mirror_rx_enable(struct switch_dev *dev,
++			       const struct switch_attr *attr,
++			       struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	priv->mirror_rx = !!val->value.i;
++	ar40xx_set_mirror_regs(priv);
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++static int
++ar40xx_sw_get_mirror_rx_enable(struct switch_dev *dev,
++			       const struct switch_attr *attr,
++			       struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	val->value.i = priv->mirror_rx;
++	mutex_unlock(&priv->reg_mutex);
++	return 0;
++}
++
++static int
++ar40xx_sw_set_mirror_tx_enable(struct switch_dev *dev,
++			       const struct switch_attr *attr,
++			       struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	priv->mirror_tx = !!val->value.i;
++	ar40xx_set_mirror_regs(priv);
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++static int
++ar40xx_sw_get_mirror_tx_enable(struct switch_dev *dev,
++			       const struct switch_attr *attr,
++			       struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	val->value.i = priv->mirror_tx;
++	mutex_unlock(&priv->reg_mutex);
++	return 0;
++}
++
++static int
++ar40xx_sw_set_mirror_monitor_port(struct switch_dev *dev,
++				  const struct switch_attr *attr,
++				  struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	priv->monitor_port = val->value.i;
++	ar40xx_set_mirror_regs(priv);
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++static int
++ar40xx_sw_get_mirror_monitor_port(struct switch_dev *dev,
++				  const struct switch_attr *attr,
++				  struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	val->value.i = priv->monitor_port;
++	mutex_unlock(&priv->reg_mutex);
++	return 0;
++}
++
++static int
++ar40xx_sw_set_mirror_source_port(struct switch_dev *dev,
++				 const struct switch_attr *attr,
++				 struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	priv->source_port = val->value.i;
++	ar40xx_set_mirror_regs(priv);
++	mutex_unlock(&priv->reg_mutex);
++
++	return 0;
++}
++
++static int
++ar40xx_sw_get_mirror_source_port(struct switch_dev *dev,
++				 const struct switch_attr *attr,
++				 struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	mutex_lock(&priv->reg_mutex);
++	val->value.i = priv->source_port;
++	mutex_unlock(&priv->reg_mutex);
++	return 0;
++}
++
++static int
++ar40xx_sw_set_linkdown(struct switch_dev *dev,
++		       const struct switch_attr *attr,
++		       struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	if (val->value.i == 1)
++		ar40xx_port_phy_linkdown(priv);
++	else
++		ar40xx_phy_init(priv);
++
++	return 0;
++}
++
++static int
++ar40xx_sw_set_port_reset_mib(struct switch_dev *dev,
++			     const struct switch_attr *attr,
++			     struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	int port;
++	int ret;
++
++	port = val->port_vlan;
++	if (port >= dev->ports)
++		return -EINVAL;
++
++	mutex_lock(&priv->mib_lock);
++	ret = ar40xx_mib_capture(priv);
++	if (ret)
++		goto unlock;
++
++	ar40xx_mib_fetch_port_stat(priv, port, true);
++
++unlock:
++	mutex_unlock(&priv->mib_lock);
++	return ret;
++}
++
++static int
++ar40xx_sw_get_port_mib(struct switch_dev *dev,
++		       const struct switch_attr *attr,
++		       struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	u64 *mib_stats;
++	int port;
++	int ret;
++	char *buf = priv->buf;
++	int i, len = 0;
++	u32 num_mibs = ARRAY_SIZE(ar40xx_mibs);
++
++	port = val->port_vlan;
++	if (port >= dev->ports)
++		return -EINVAL;
++
++	mutex_lock(&priv->mib_lock);
++	ret = ar40xx_mib_capture(priv);
++	if (ret)
++		goto unlock;
++
++	ar40xx_mib_fetch_port_stat(priv, port, false);
++
++	len += snprintf(buf + len, sizeof(priv->buf) - len,
++			"Port %d MIB counters\n",
++			port);
++
++	mib_stats = &priv->mib_stats[port * num_mibs];
++	for (i = 0; i < num_mibs; i++)
++		len += snprintf(buf + len, sizeof(priv->buf) - len,
++				"%-12s: %llu\n",
++				ar40xx_mibs[i].name,
++				mib_stats[i]);
++
++	val->value.s = buf;
++	val->len = len;
++
++unlock:
++	mutex_unlock(&priv->mib_lock);
++	return ret;
++}
++
++static int
++ar40xx_sw_set_vid(struct switch_dev *dev, const struct switch_attr *attr,
++		  struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	priv->vlan_id[val->port_vlan] = val->value.i;
++	return 0;
++}
++
++static int
++ar40xx_sw_get_vid(struct switch_dev *dev, const struct switch_attr *attr,
++		  struct switch_val *val)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	val->value.i = priv->vlan_id[val->port_vlan];
++	return 0;
++}
++
++static int
++ar40xx_sw_get_pvid(struct switch_dev *dev, int port, int *vlan)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	*vlan = priv->pvid[port];
++	return 0;
++}
++
++static int
++ar40xx_sw_set_pvid(struct switch_dev *dev, int port, int vlan)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	/* make sure no invalid PVIDs get set */
++	if (vlan >= dev->vlans)
++		return -EINVAL;
++
++	priv->pvid[port] = vlan;
++	return 0;
++}
++
++static void
++ar40xx_read_port_link(struct ar40xx_priv *priv, int port,
++		      struct switch_port_link *link)
++{
++	u32 status;
++	u32 speed;
++
++	memset(link, 0, sizeof(*link));
++
++	status = ar40xx_read(priv, AR40XX_REG_PORT_STATUS(port));
++
++	link->aneg = !!(status & AR40XX_PORT_AUTO_LINK_EN);
++	if (link->aneg || (port != AR40XX_PORT_CPU))
++		link->link = !!(status & AR40XX_PORT_STATUS_LINK_UP);
++	else
++		link->link = true;
++
++	if (!link->link)
++		return;
++
++	link->duplex = !!(status & AR40XX_PORT_DUPLEX);
++	link->tx_flow = !!(status & AR40XX_PORT_STATUS_TXFLOW);
++	link->rx_flow = !!(status & AR40XX_PORT_STATUS_RXFLOW);
++
++	speed = (status & AR40XX_PORT_SPEED) >>
++		 AR40XX_PORT_STATUS_SPEED_S;
++
++	switch (speed) {
++	case AR40XX_PORT_SPEED_10M:
++		link->speed = SWITCH_PORT_SPEED_10;
++		break;
++	case AR40XX_PORT_SPEED_100M:
++		link->speed = SWITCH_PORT_SPEED_100;
++		break;
++	case AR40XX_PORT_SPEED_1000M:
++		link->speed = SWITCH_PORT_SPEED_1000;
++		break;
++	default:
++		link->speed = SWITCH_PORT_SPEED_UNKNOWN;
++		break;
++	}
++}
++
++static int
++ar40xx_sw_get_port_link(struct switch_dev *dev, int port,
++			struct switch_port_link *link)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++
++	ar40xx_read_port_link(priv, port, link);
++	return 0;
++}
++
++static const struct switch_attr ar40xx_sw_attr_globals[] = {
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "enable_vlan",
++		.description = "Enable VLAN mode",
++		.set = ar40xx_sw_set_vlan,
++		.get = ar40xx_sw_get_vlan,
++		.max = 1
++	},
++	{
++		.type = SWITCH_TYPE_NOVAL,
++		.name = "reset_mibs",
++		.description = "Reset all MIB counters",
++		.set = ar40xx_sw_set_reset_mibs,
++	},
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "enable_mirror_rx",
++		.description = "Enable mirroring of RX packets",
++		.set = ar40xx_sw_set_mirror_rx_enable,
++		.get = ar40xx_sw_get_mirror_rx_enable,
++		.max = 1
++	},
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "enable_mirror_tx",
++		.description = "Enable mirroring of TX packets",
++		.set = ar40xx_sw_set_mirror_tx_enable,
++		.get = ar40xx_sw_get_mirror_tx_enable,
++		.max = 1
++	},
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "mirror_monitor_port",
++		.description = "Mirror monitor port",
++		.set = ar40xx_sw_set_mirror_monitor_port,
++		.get = ar40xx_sw_get_mirror_monitor_port,
++		.max = AR40XX_NUM_PORTS - 1
++	},
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "mirror_source_port",
++		.description = "Mirror source port",
++		.set = ar40xx_sw_set_mirror_source_port,
++		.get = ar40xx_sw_get_mirror_source_port,
++		.max = AR40XX_NUM_PORTS - 1
++	},
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "linkdown",
++		.description = "Link down all the PHYs",
++		.set = ar40xx_sw_set_linkdown,
++		.max = 1
++	},
++};
++
++static const struct switch_attr ar40xx_sw_attr_port[] = {
++	{
++		.type = SWITCH_TYPE_NOVAL,
++		.name = "reset_mib",
++		.description = "Reset single port MIB counters",
++		.set = ar40xx_sw_set_port_reset_mib,
++	},
++	{
++		.type = SWITCH_TYPE_STRING,
++		.name = "mib",
++		.description = "Get port's MIB counters",
++		.set = NULL,
++		.get = ar40xx_sw_get_port_mib,
++	},
++};
++
++const struct switch_attr ar40xx_sw_attr_vlan[] = {
++	{
++		.type = SWITCH_TYPE_INT,
++		.name = "vid",
++		.description = "VLAN ID (0-4094)",
++		.set = ar40xx_sw_set_vid,
++		.get = ar40xx_sw_get_vid,
++		.max = 4094,
++	},
++};
++
++/* End of swconfig support */
++
++static int
++ar40xx_wait_bit(struct ar40xx_priv *priv, int reg, u32 mask, u32 val)
++{
++	int timeout = 20;
++	u32 t;
++
++	while (1) {
++		t = ar40xx_read(priv, reg);
++		if ((t & mask) == val)
++			return 0;
++
++		if (timeout-- <= 0)
++			break;
++
++		usleep_range(10, 20);
++	}
++
++	pr_err("ar40xx: timeout for reg %08x: %08x & %08x != %08x\n",
++	       (unsigned int)reg, t, mask, val);
++	return -ETIMEDOUT;
++}
++
++static int
++ar40xx_atu_flush(struct ar40xx_priv *priv)
++{
++	int ret;
++
++	ret = ar40xx_wait_bit(priv, AR40XX_REG_ATU_FUNC,
++			      AR40XX_ATU_FUNC_BUSY, 0);
++	if (!ret)
++		ar40xx_write(priv, AR40XX_REG_ATU_FUNC,
++			     AR40XX_ATU_FUNC_OP_FLUSH |
++			     AR40XX_ATU_FUNC_BUSY);
++
++	return ret;
++}
++
++static void
++ar40xx_ess_reset(struct ar40xx_priv *priv)
++{
++	reset_control_assert(priv->ess_rst);
++	mdelay(10);
++	reset_control_deassert(priv->ess_rst);
++	/* Waiting for all inner tables init done.
++	  * It cost 5~10ms.
++	  */
++	mdelay(10);
++
++	pr_info("ESS reset ok!\n");
++}
++
++/* Start of psgmii self test */
++
++static void
++ar40xx_malibu_psgmii_ess_reset(struct ar40xx_priv *priv)
++{
++	u32 n;
++	struct mii_bus *bus = priv->mii_bus;
++	/* reset phy psgmii */
++	/* fix phy psgmii RX 20bit */
++	mdiobus_write(bus, 5, 0x0, 0x005b);
++	/* reset phy psgmii */
++	mdiobus_write(bus, 5, 0x0, 0x001b);
++	/* release reset phy psgmii */
++	mdiobus_write(bus, 5, 0x0, 0x005b);
++
++	for (n = 0; n < AR40XX_PSGMII_CALB_NUM; n++) {
++		u16 status;
++
++		status = ar40xx_phy_mmd_read(priv, 5, 1, 0x28);
++		if (status & BIT(0))
++			break;
++		/* Polling interval to check PSGMII PLL in malibu is ready
++		  * the worst time is 8.67ms
++		  * for 25MHz reference clock
++		  * [512+(128+2048)*49]*80ns+100us
++		  */
++		mdelay(2);
++	}
++
++	/*check malibu psgmii calibration done end..*/
++
++	/*freeze phy psgmii RX CDR*/
++	mdiobus_write(bus, 5, 0x1a, 0x2230);
++
++	ar40xx_ess_reset(priv);
++
++	/*check psgmii calibration done start*/
++	for (n = 0; n < AR40XX_PSGMII_CALB_NUM; n++) {
++		u32 status;
++
++		status = ar40xx_psgmii_read(priv, 0xa0);
++		if (status & BIT(0))
++			break;
++		/* Polling interval to check PSGMII PLL in ESS is ready */
++		mdelay(2);
++	}
++
++	/* check dakota psgmii calibration done end..*/
++
++	/* relesae phy psgmii RX CDR */
++	mdiobus_write(bus, 5, 0x1a, 0x3230);
++	/* release phy psgmii RX 20bit */
++	mdiobus_write(bus, 5, 0x0, 0x005f);
++}
++
++static void
++ar40xx_psgmii_single_phy_testing(struct ar40xx_priv *priv, int phy)
++{
++	int j;
++	u32 tx_ok, tx_error;
++	u32 rx_ok, rx_error;
++	u32 tx_ok_high16;
++	u32 rx_ok_high16;
++	u32 tx_all_ok, rx_all_ok;
++	struct mii_bus *bus = priv->mii_bus;
++
++	mdiobus_write(bus, phy, 0x0, 0x9000);
++	mdiobus_write(bus, phy, 0x0, 0x4140);
++
++	for (j = 0; j < AR40XX_PSGMII_CALB_NUM; j++) {
++		u16 status;
++
++		status = mdiobus_read(bus, phy, 0x11);
++		if (status & AR40XX_PHY_SPEC_STATUS_LINK)
++			break;
++		/* the polling interval to check if the PHY link up or not
++		  * maxwait_timer: 750 ms +/-10 ms
++		  * minwait_timer : 1 us +/- 0.1us
++		  * time resides in minwait_timer ~ maxwait_timer
++		  * see IEEE 802.3 section 40.4.5.2
++		  */
++		mdelay(8);
++	}
++
++	/* enable check */
++	ar40xx_phy_mmd_write(priv, phy, 7, 0x8029, 0x0000);
++	ar40xx_phy_mmd_write(priv, phy, 7, 0x8029, 0x0003);
++
++	/* start traffic */
++	ar40xx_phy_mmd_write(priv, phy, 7, 0x8020, 0xa000);
++	/* wait for all traffic end
++	  * 4096(pkt num)*1524(size)*8ns(125MHz)=49.9ms
++	  */
++	mdelay(50);
++
++	/* check counter */
++	tx_ok = ar40xx_phy_mmd_read(priv, phy, 7, 0x802e);
++	tx_ok_high16 = ar40xx_phy_mmd_read(priv, phy, 7, 0x802d);
++	tx_error = ar40xx_phy_mmd_read(priv, phy, 7, 0x802f);
++	rx_ok = ar40xx_phy_mmd_read(priv, phy, 7, 0x802b);
++	rx_ok_high16 = ar40xx_phy_mmd_read(priv, phy, 7, 0x802a);
++	rx_error = ar40xx_phy_mmd_read(priv, phy, 7, 0x802c);
++	tx_all_ok = tx_ok + (tx_ok_high16 << 16);
++	rx_all_ok = rx_ok + (rx_ok_high16 << 16);
++	if (tx_all_ok == 0x1000 && tx_error == 0) {
++		/* success */
++		priv->phy_t_status &= (~BIT(phy));
++	} else {
++		pr_info("PHY %d single test PSGMII issue happen!\n", phy);
++		priv->phy_t_status |= BIT(phy);
++	}
++
++	mdiobus_write(bus, phy, 0x0, 0x1840);
++}
++
++static void
++ar40xx_psgmii_all_phy_testing(struct ar40xx_priv *priv)
++{
++	int phy, j;
++	struct mii_bus *bus = priv->mii_bus;
++
++	mdiobus_write(bus, 0x1f, 0x0, 0x9000);
++	mdiobus_write(bus, 0x1f, 0x0, 0x4140);
++
++	for (j = 0; j < AR40XX_PSGMII_CALB_NUM; j++) {
++		for (phy = 0; phy < AR40XX_NUM_PORTS - 1; phy++) {
++			u16 status;
++
++			status = mdiobus_read(bus, phy, 0x11);
++			if (!(status & BIT(10)))
++				break;
++		}
++
++		if (phy >= (AR40XX_NUM_PORTS - 1))
++			break;
++		/* The polling interva to check if the PHY link up or not */
++		mdelay(8);
++	}
++	/* enable check */
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8029, 0x0000);
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8029, 0x0003);
++
++	/* start traffic */
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8020, 0xa000);
++	/* wait for all traffic end
++	  * 4096(pkt num)*1524(size)*8ns(125MHz)=49.9ms
++	  */
++	mdelay(50);
++
++	for (phy = 0; phy < AR40XX_NUM_PORTS - 1; phy++) {
++		u32 tx_ok, tx_error;
++		u32 rx_ok, rx_error;
++		u32 tx_ok_high16;
++		u32 rx_ok_high16;
++		u32 tx_all_ok, rx_all_ok;
++
++		/* check counter */
++		tx_ok = ar40xx_phy_mmd_read(priv, phy, 7, 0x802e);
++		tx_ok_high16 = ar40xx_phy_mmd_read(priv, phy, 7, 0x802d);
++		tx_error = ar40xx_phy_mmd_read(priv, phy, 7, 0x802f);
++		rx_ok = ar40xx_phy_mmd_read(priv, phy, 7, 0x802b);
++		rx_ok_high16 = ar40xx_phy_mmd_read(priv, phy, 7, 0x802a);
++		rx_error = ar40xx_phy_mmd_read(priv, phy, 7, 0x802c);
++		tx_all_ok = tx_ok + (tx_ok_high16<<16);
++		rx_all_ok = rx_ok + (rx_ok_high16<<16);
++		if (tx_all_ok == 0x1000 && tx_error == 0) {
++			/* success */
++			priv->phy_t_status &= ~BIT(phy + 8);
++		} else {
++			pr_info("PHY%d test see issue!\n", phy);
++			priv->phy_t_status |= BIT(phy + 8);
++		}
++	}
++
++	pr_debug("PHY all test 0x%x \r\n", priv->phy_t_status);
++}
++
++void
++ar40xx_psgmii_self_test(struct ar40xx_priv *priv)
++{
++	u32 i, phy;
++	struct mii_bus *bus = priv->mii_bus;
++
++	ar40xx_malibu_psgmii_ess_reset(priv);
++
++	/* switch to access MII reg for copper */
++	mdiobus_write(bus, 4, 0x1f, 0x8500);
++	for (phy = 0; phy < AR40XX_NUM_PORTS - 1; phy++) {
++		/*enable phy mdio broadcast write*/
++		ar40xx_phy_mmd_write(priv, phy, 7, 0x8028, 0x801f);
++	}
++	/* force no link by power down */
++	mdiobus_write(bus, 0x1f, 0x0, 0x1840);
++	/*packet number*/
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8021, 0x1000);
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8062, 0x05e0);
++
++	/*fix mdi status */
++	mdiobus_write(bus, 0x1f, 0x10, 0x6800);
++	for (i = 0; i < AR40XX_PSGMII_CALB_NUM; i++) {
++		priv->phy_t_status = 0;
++
++		for (phy = 0; phy < AR40XX_NUM_PORTS - 1; phy++) {
++			ar40xx_rmw(priv, AR40XX_REG_PORT_LOOKUP(phy + 1),
++				AR40XX_PORT_LOOKUP_LOOPBACK,
++				AR40XX_PORT_LOOKUP_LOOPBACK);
++		}
++
++		for (phy = 0; phy < AR40XX_NUM_PORTS - 1; phy++)
++			ar40xx_psgmii_single_phy_testing(priv, phy);
++
++		ar40xx_psgmii_all_phy_testing(priv);
++
++		if (priv->phy_t_status)
++			ar40xx_malibu_psgmii_ess_reset(priv);
++		else
++			break;
++	}
++
++	if (i >= AR40XX_PSGMII_CALB_NUM)
++		pr_info("PSGMII cannot recover\n");
++	else
++		pr_debug("PSGMII recovered after %d times reset\n", i);
++
++	/* configuration recover */
++	/* packet number */
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8021, 0x0);
++	/* disable check */
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8029, 0x0);
++	/* disable traffic */
++	ar40xx_phy_mmd_write(priv, 0x1f, 7, 0x8020, 0x0);
++}
++
++void
++ar40xx_psgmii_self_test_clean(struct ar40xx_priv *priv)
++{
++	int phy;
++	struct mii_bus *bus = priv->mii_bus;
++
++	/* disable phy internal loopback */
++	mdiobus_write(bus, 0x1f, 0x10, 0x6860);
++	mdiobus_write(bus, 0x1f, 0x0, 0x9040);
++
++	for (phy = 0; phy < AR40XX_NUM_PORTS - 1; phy++) {
++		/* disable mac loop back */
++		ar40xx_rmw(priv, AR40XX_REG_PORT_LOOKUP(phy + 1),
++				AR40XX_PORT_LOOKUP_LOOPBACK, 0);
++		/* disable phy mdio broadcast write */
++		ar40xx_phy_mmd_write(priv, phy, 7, 0x8028, 0x001f);
++	}
++
++	/* clear fdb entry */
++	ar40xx_atu_flush(priv);
++}
++
++/* End of psgmii self test */
++
++static void
++ar40xx_mac_mode_init(struct ar40xx_priv *priv, u32 mode)
++{
++	if (mode == PORT_WRAPPER_PSGMII) {
++		ar40xx_psgmii_write(priv, AR40XX_PSGMII_MODE_CONTROL, 0x2200);
++		ar40xx_psgmii_write(priv, AR40XX_PSGMIIPHY_TX_CONTROL, 0x8380);
++	}
++}
++
++static
++int ar40xx_cpuport_setup(struct ar40xx_priv *priv)
++{
++	u32 t;
++
++	t = AR40XX_PORT_STATUS_TXFLOW |
++	     AR40XX_PORT_STATUS_RXFLOW |
++	     AR40XX_PORT_TXHALF_FLOW |
++	     AR40XX_PORT_DUPLEX |
++	     AR40XX_PORT_SPEED_1000M;
++	ar40xx_write(priv, AR40XX_REG_PORT_STATUS(0), t);
++	usleep_range(10, 20);
++
++	t |= AR40XX_PORT_TX_EN |
++	       AR40XX_PORT_RX_EN;
++	ar40xx_write(priv, AR40XX_REG_PORT_STATUS(0), t);
++
++	return 0;
++}
++
++static void
++ar40xx_init_port(struct ar40xx_priv *priv, int port)
++{
++	u32 t;
++
++	ar40xx_rmw(priv, AR40XX_REG_PORT_STATUS(port),
++			AR40XX_PORT_AUTO_LINK_EN, 0);
++
++	ar40xx_write(priv, AR40XX_REG_PORT_HEADER(port), 0);
++
++	ar40xx_write(priv, AR40XX_REG_PORT_VLAN0(port), 0);
++
++	t = AR40XX_PORT_VLAN1_OUT_MODE_UNTOUCH << AR40XX_PORT_VLAN1_OUT_MODE_S;
++	ar40xx_write(priv, AR40XX_REG_PORT_VLAN1(port), t);
++
++	t = AR40XX_PORT_LOOKUP_LEARN;
++	t |= AR40XX_PORT_STATE_FORWARD << AR40XX_PORT_LOOKUP_STATE_S;
++	ar40xx_write(priv, AR40XX_REG_PORT_LOOKUP(port), t);
++}
++
++void
++ar40xx_init_globals(struct ar40xx_priv *priv)
++{
++	u32 t;
++
++	/* enable CPU port and disable mirror port */
++	t = AR40XX_FWD_CTRL0_CPU_PORT_EN |
++	    AR40XX_FWD_CTRL0_MIRROR_PORT;
++	ar40xx_write(priv, AR40XX_REG_FWD_CTRL0, t);
++
++	/* forward multicast and broadcast frames to CPU */
++	t = (AR40XX_PORTS_ALL << AR40XX_FWD_CTRL1_UC_FLOOD_S) |
++	    (AR40XX_PORTS_ALL << AR40XX_FWD_CTRL1_MC_FLOOD_S) |
++	    (AR40XX_PORTS_ALL << AR40XX_FWD_CTRL1_BC_FLOOD_S);
++	ar40xx_write(priv, AR40XX_REG_FWD_CTRL1, t);
++
++	/* enable jumbo frames */
++	ar40xx_rmw(priv, AR40XX_REG_MAX_FRAME_SIZE,
++		   AR40XX_MAX_FRAME_SIZE_MTU, 9018 + 8 + 2);
++
++	/* Enable MIB counters */
++	ar40xx_rmw(priv, AR40XX_REG_MODULE_EN, 0,
++		   AR40XX_MODULE_EN_MIB);
++
++	/* Disable AZ */
++	ar40xx_write(priv, AR40XX_REG_EEE_CTRL, 0);
++
++	/* set flowctrl thershold for cpu port */
++	t = (AR40XX_PORT0_FC_THRESH_ON_DFLT << 16) |
++	      AR40XX_PORT0_FC_THRESH_OFF_DFLT;
++	ar40xx_write(priv, AR40XX_REG_PORT_FLOWCTRL_THRESH(0), t);
++}
++
++static void
++ar40xx_malibu_init(struct ar40xx_priv *priv)
++{
++	int i;
++	struct mii_bus *bus;
++	u16 val;
++
++	bus = priv->mii_bus;
++
++	/* war to enable AZ transmitting ability */
++	ar40xx_phy_mmd_write(priv, AR40XX_PSGMII_ID, 1,
++			     AR40XX_MALIBU_PSGMII_MODE_CTRL,
++			     AR40XX_MALIBU_PHY_PSGMII_MODE_CTRL_ADJUST_VAL);
++	for (i = 0; i < AR40XX_NUM_PORTS - 1; i++) {
++		/* change malibu control_dac */
++		val = ar40xx_phy_mmd_read(priv, i, 7,
++					  AR40XX_MALIBU_PHY_MMD7_DAC_CTRL);
++		val &= ~AR40XX_MALIBU_DAC_CTRL_MASK;
++		val |= AR40XX_MALIBU_DAC_CTRL_VALUE;
++		ar40xx_phy_mmd_write(priv, i, 7,
++				     AR40XX_MALIBU_PHY_MMD7_DAC_CTRL, val);
++		if (i == AR40XX_MALIBU_PHY_LAST_ADDR) {
++			/* to avoid goes into hibernation */
++			val = ar40xx_phy_mmd_read(priv, i, 3,
++						  AR40XX_MALIBU_PHY_RLP_CTRL);
++			val &= (~(1<<1));
++			ar40xx_phy_mmd_write(priv, i, 3,
++					     AR40XX_MALIBU_PHY_RLP_CTRL, val);
++		}
++	}
++
++	/* adjust psgmii serdes tx amp */
++	mdiobus_write(bus, AR40XX_PSGMII_ID, AR40XX_PSGMII_TX_DRIVER_1_CTRL,
++		      AR40XX_MALIBU_PHY_PSGMII_REDUCE_SERDES_TX_AMP);
++}
++
++static int
++ar40xx_hw_init(struct ar40xx_priv *priv)
++{
++	u32 i;
++
++	ar40xx_ess_reset(priv);
++
++	if (priv->mii_bus)
++		ar40xx_malibu_init(priv);
++	else
++		return -1;
++
++	ar40xx_psgmii_self_test(priv);
++	ar40xx_psgmii_self_test_clean(priv);
++
++	ar40xx_mac_mode_init(priv, priv->mac_mode);
++
++	for (i = 0; i < priv->dev.ports; i++)
++		ar40xx_init_port(priv, i);
++
++	ar40xx_init_globals(priv);
++
++	return 0;
++}
++
++/* Start of qm error WAR */
++
++static
++int ar40xx_force_1g_full(struct ar40xx_priv *priv, u32 port_id)
++{
++	u32 reg;
++
++	if (port_id < 0 || port_id > 6)
++		return -1;
++
++	reg = AR40XX_REG_PORT_STATUS(port_id);
++	return ar40xx_rmw(priv, reg, AR40XX_PORT_SPEED,
++			(AR40XX_PORT_SPEED_1000M | AR40XX_PORT_DUPLEX));
++}
++
++static
++int ar40xx_get_qm_status(struct ar40xx_priv *priv,
++			 u32 port_id, u32 *qm_buffer_err)
++{
++	u32 reg;
++	u32 qm_val;
++
++	if (port_id < 1 || port_id > 5) {
++		*qm_buffer_err = 0;
++		return -1;
++	}
++
++	if (port_id < 4) {
++		reg = AR40XX_REG_QM_PORT0_3_QNUM;
++		ar40xx_write(priv, AR40XX_REG_QM_DEBUG_ADDR, reg);
++		qm_val = ar40xx_read(priv, AR40XX_REG_QM_DEBUG_VALUE);
++		/* every 8 bits for each port */
++		*qm_buffer_err = (qm_val >> (port_id * 8)) & 0xFF;
++	} else {
++		reg = AR40XX_REG_QM_PORT4_6_QNUM;
++		ar40xx_write(priv, AR40XX_REG_QM_DEBUG_ADDR, reg);
++		qm_val = ar40xx_read(priv, AR40XX_REG_QM_DEBUG_VALUE);
++		/* every 8 bits for each port */
++		*qm_buffer_err = (qm_val >> ((port_id-4) * 8)) & 0xFF;
++	}
++
++	return 0;
++}
++
++static void
++ar40xx_sw_mac_polling_task(struct ar40xx_priv *priv)
++{
++	static int task_count;
++	u32 i;
++	u32 reg, value;
++	u32 link, speed, duplex;
++	u32 qm_buffer_err;
++	u16 port_phy_status[AR40XX_NUM_PORTS];
++	static u32 qm_err_cnt[AR40XX_NUM_PORTS] = {0, 0, 0, 0, 0, 0};
++	static u32 link_cnt[AR40XX_NUM_PORTS] = {0, 0, 0, 0, 0, 0};
++	struct mii_bus *bus = NULL;
++
++	if (!priv || !priv->mii_bus)
++		return;
++
++	bus = priv->mii_bus;
++
++	++task_count;
++
++	for (i = 1; i < AR40XX_NUM_PORTS; ++i) {
++		port_phy_status[i] =
++			mdiobus_read(bus, i-1, AR40XX_PHY_SPEC_STATUS);
++		speed = link = duplex = port_phy_status[i];
++		speed &= AR40XX_PHY_SPEC_STATUS_SPEED;
++		speed >>= 14;
++		link &= AR40XX_PHY_SPEC_STATUS_LINK;
++		link >>= 10;
++		duplex &= AR40XX_PHY_SPEC_STATUS_DUPLEX;
++		duplex >>= 13;
++
++		if (link != priv->ar40xx_port_old_link[i]) {
++			++link_cnt[i];
++			/* Up --> Down */
++			if ((priv->ar40xx_port_old_link[i] ==
++					AR40XX_PORT_LINK_UP) &&
++			    (link == AR40XX_PORT_LINK_DOWN)) {
++				/* LINK_EN disable(MAC force mode)*/
++				reg = AR40XX_REG_PORT_STATUS(i);
++				ar40xx_rmw(priv, reg,
++						AR40XX_PORT_AUTO_LINK_EN, 0);
++
++				/* Check queue buffer */
++				qm_err_cnt[i] = 0;
++				ar40xx_get_qm_status(priv, i, &qm_buffer_err);
++				if (qm_buffer_err) {
++					priv->ar40xx_port_qm_buf[i] =
++						AR40XX_QM_NOT_EMPTY;
++				} else {
++					u16 phy_val = 0;
++
++					priv->ar40xx_port_qm_buf[i] =
++						AR40XX_QM_EMPTY;
++					ar40xx_force_1g_full(priv, i);
++					/* Ref:QCA8337 Datasheet,Clearing
++					 * MENU_CTRL_EN prevents phy to
++					 * stuck in 100BT mode when
++					 * bringing up the link
++					 */
++					ar40xx_phy_dbg_read(priv, i-1,
++							    AR40XX_PHY_DEBUG_0,
++							    &phy_val);
++					phy_val &= (~AR40XX_PHY_MANU_CTRL_EN);
++					ar40xx_phy_dbg_write(priv, i-1,
++							     AR40XX_PHY_DEBUG_0,
++							     phy_val);
++				}
++				priv->ar40xx_port_old_link[i] = link;
++			} else if ((priv->ar40xx_port_old_link[i] ==
++						AR40XX_PORT_LINK_DOWN) &&
++					(link == AR40XX_PORT_LINK_UP)) {
++				/* Down --> Up */
++				if (priv->port_link_up[i] < 1) {
++					++priv->port_link_up[i];
++				} else {
++					/* Change port status */
++					reg = AR40XX_REG_PORT_STATUS(i);
++					value = ar40xx_read(priv, reg);
++					priv->port_link_up[i] = 0;
++
++					value &= ~(AR40XX_PORT_DUPLEX |
++						   AR40XX_PORT_SPEED);
++					value |= speed | (duplex ? BIT(6) : 0);
++					ar40xx_write(priv, reg, value);
++					/* clock switch need such time
++					 * to avoid glitch
++					 */
++					usleep_range(100, 200);
++
++					value |= AR40XX_PORT_AUTO_LINK_EN;
++					ar40xx_write(priv, reg, value);
++					/* HW need such time to make sure link
++					 * stable before enable MAC
++					 */
++					usleep_range(100, 200);
++
++					if (speed == AR40XX_PORT_SPEED_100M) {
++						u16 phy_val = 0;
++						/* Enable @100M, if down to 10M
++						 * clock will change smoothly
++						 */
++						ar40xx_phy_dbg_read(priv, i-1,
++								    0,
++								    &phy_val);
++						phy_val |=
++							AR40XX_PHY_MANU_CTRL_EN;
++						ar40xx_phy_dbg_write(priv, i-1,
++								     0,
++								     phy_val);
++					}
++					priv->ar40xx_port_old_link[i] = link;
++				}
++			}
++		}
++
++		if (priv->ar40xx_port_qm_buf[i] == AR40XX_QM_NOT_EMPTY) {
++			/* Check QM */
++			ar40xx_get_qm_status(priv, i, &qm_buffer_err);
++			if (qm_buffer_err) {
++				++qm_err_cnt[i];
++			} else {
++				priv->ar40xx_port_qm_buf[i] =
++						AR40XX_QM_EMPTY;
++				qm_err_cnt[i] = 0;
++				ar40xx_force_1g_full(priv, i);
++			}
++		}
++	}
++}
++
++static void
++ar40xx_qm_err_check_work_task(struct work_struct *work)
++{
++	struct ar40xx_priv *priv = container_of(work, struct ar40xx_priv,
++					qm_dwork.work);
++
++	mutex_lock(&priv->qm_lock);
++
++	ar40xx_sw_mac_polling_task(priv);
++
++	mutex_unlock(&priv->qm_lock);
++
++	schedule_delayed_work(&priv->qm_dwork,
++			      msecs_to_jiffies(AR40XX_QM_WORK_DELAY));
++}
++
++static int
++ar40xx_qm_err_check_work_start(struct ar40xx_priv *priv)
++{
++	mutex_init(&priv->qm_lock);
++
++	INIT_DELAYED_WORK(&priv->qm_dwork, ar40xx_qm_err_check_work_task);
++
++	schedule_delayed_work(&priv->qm_dwork,
++			      msecs_to_jiffies(AR40XX_QM_WORK_DELAY));
++
++	return 0;
++}
++
++/* End of qm error WAR */
++
++static int
++ar40xx_vlan_init(struct ar40xx_priv *priv)
++{
++	int port;
++	unsigned long bmp;
++
++	/* By default Enable VLAN */
++	priv->vlan = 1;
++	priv->vlan_table[AR40XX_LAN_VLAN] = priv->cpu_bmp | priv->lan_bmp;
++	priv->vlan_table[AR40XX_WAN_VLAN] = priv->cpu_bmp | priv->wan_bmp;
++	priv->vlan_tagged = priv->cpu_bmp;
++	bmp = priv->lan_bmp;
++	for_each_set_bit(port, &bmp, AR40XX_NUM_PORTS)
++			priv->pvid[port] = AR40XX_LAN_VLAN;
++
++	bmp = priv->wan_bmp;
++	for_each_set_bit(port, &bmp, AR40XX_NUM_PORTS)
++			priv->pvid[port] = AR40XX_WAN_VLAN;
++
++	return 0;
++}
++
++static void
++ar40xx_mib_work_func(struct work_struct *work)
++{
++	struct ar40xx_priv *priv;
++	int err;
++
++	priv = container_of(work, struct ar40xx_priv, mib_work.work);
++
++	mutex_lock(&priv->mib_lock);
++
++	err = ar40xx_mib_capture(priv);
++	if (err)
++		goto next_port;
++
++	ar40xx_mib_fetch_port_stat(priv, priv->mib_next_port, false);
++
++next_port:
++	priv->mib_next_port++;
++	if (priv->mib_next_port >= priv->dev.ports)
++		priv->mib_next_port = 0;
++
++	mutex_unlock(&priv->mib_lock);
++
++	schedule_delayed_work(&priv->mib_work,
++			      msecs_to_jiffies(AR40XX_MIB_WORK_DELAY));
++}
++
++static void
++ar40xx_setup_port(struct ar40xx_priv *priv, int port, u32 members)
++{
++	u32 t;
++	u32 egress, ingress;
++	u32 pvid = priv->vlan_id[priv->pvid[port]];
++
++	if (priv->vlan) {
++		egress = AR40XX_PORT_VLAN1_OUT_MODE_UNMOD;
++		ingress = AR40XX_IN_SECURE;
++	} else {
++		egress = AR40XX_PORT_VLAN1_OUT_MODE_UNTOUCH;
++		ingress = AR40XX_IN_PORT_ONLY;
++	}
++
++	t = pvid << AR40XX_PORT_VLAN0_DEF_SVID_S;
++	t |= pvid << AR40XX_PORT_VLAN0_DEF_CVID_S;
++	ar40xx_write(priv, AR40XX_REG_PORT_VLAN0(port), t);
++
++	t = AR40XX_PORT_VLAN1_PORT_VLAN_PROP;
++	t |= egress << AR40XX_PORT_VLAN1_OUT_MODE_S;
++	ar40xx_write(priv, AR40XX_REG_PORT_VLAN1(port), t);
++
++	t = members;
++	t |= AR40XX_PORT_LOOKUP_LEARN;
++	t |= ingress << AR40XX_PORT_LOOKUP_IN_MODE_S;
++	t |= AR40XX_PORT_STATE_FORWARD << AR40XX_PORT_LOOKUP_STATE_S;
++	ar40xx_write(priv, AR40XX_REG_PORT_LOOKUP(port), t);
++}
++
++static void
++ar40xx_vtu_op(struct ar40xx_priv *priv, u32 op, u32 val)
++{
++	if (ar40xx_wait_bit(priv, AR40XX_REG_VTU_FUNC1,
++			    AR40XX_VTU_FUNC1_BUSY, 0))
++		return;
++
++	if ((op & AR40XX_VTU_FUNC1_OP) == AR40XX_VTU_FUNC1_OP_LOAD)
++		ar40xx_write(priv, AR40XX_REG_VTU_FUNC0, val);
++
++	op |= AR40XX_VTU_FUNC1_BUSY;
++	ar40xx_write(priv, AR40XX_REG_VTU_FUNC1, op);
++}
++
++static void
++ar40xx_vtu_load_vlan(struct ar40xx_priv *priv, u32 vid, u32 port_mask)
++{
++	u32 op;
++	u32 val;
++	int i;
++
++	op = AR40XX_VTU_FUNC1_OP_LOAD | (vid << AR40XX_VTU_FUNC1_VID_S);
++	val = AR40XX_VTU_FUNC0_VALID | AR40XX_VTU_FUNC0_IVL;
++	for (i = 0; i < AR40XX_NUM_PORTS; i++) {
++		u32 mode;
++
++		if ((port_mask & BIT(i)) == 0)
++			mode = AR40XX_VTU_FUNC0_EG_MODE_NOT;
++		else if (priv->vlan == 0)
++			mode = AR40XX_VTU_FUNC0_EG_MODE_KEEP;
++		else if ((priv->vlan_tagged & BIT(i)) ||
++			 (priv->vlan_id[priv->pvid[i]] != vid))
++			mode = AR40XX_VTU_FUNC0_EG_MODE_TAG;
++		else
++			mode = AR40XX_VTU_FUNC0_EG_MODE_UNTAG;
++
++		val |= mode << AR40XX_VTU_FUNC0_EG_MODE_S(i);
++	}
++	ar40xx_vtu_op(priv, op, val);
++}
++
++static void
++ar40xx_vtu_flush(struct ar40xx_priv *priv)
++{
++	ar40xx_vtu_op(priv, AR40XX_VTU_FUNC1_OP_FLUSH, 0);
++}
++
++static int
++ar40xx_sw_hw_apply(struct switch_dev *dev)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	u8 portmask[AR40XX_NUM_PORTS];
++	int i, j;
++
++	mutex_lock(&priv->reg_mutex);
++	/* flush all vlan entries */
++	ar40xx_vtu_flush(priv);
++
++	memset(portmask, 0, sizeof(portmask));
++	if (priv->vlan) {
++		for (j = 0; j < AR40XX_MAX_VLANS; j++) {
++			u8 vp = priv->vlan_table[j];
++
++			if (!vp)
++				continue;
++
++			for (i = 0; i < dev->ports; i++) {
++				u8 mask = BIT(i);
++
++				if (vp & mask)
++					portmask[i] |= vp & ~mask;
++			}
++
++			ar40xx_vtu_load_vlan(priv, priv->vlan_id[j],
++					     priv->vlan_table[j]);
++		}
++	} else {
++		/* 8021q vlan disabled */
++		for (i = 0; i < dev->ports; i++) {
++			if (i == AR40XX_PORT_CPU)
++				continue;
++
++			portmask[i] = BIT(AR40XX_PORT_CPU);
++			portmask[AR40XX_PORT_CPU] |= BIT(i);
++		}
++	}
++
++	/* update the port destination mask registers and tag settings */
++	for (i = 0; i < dev->ports; i++)
++		ar40xx_setup_port(priv, i, portmask[i]);
++
++	ar40xx_set_mirror_regs(priv);
++
++	mutex_unlock(&priv->reg_mutex);
++	return 0;
++}
++
++static int
++ar40xx_sw_reset_switch(struct switch_dev *dev)
++{
++	struct ar40xx_priv *priv = swdev_to_ar40xx(dev);
++	int i, rv;
++
++	mutex_lock(&priv->reg_mutex);
++	memset(&priv->vlan, 0, sizeof(struct ar40xx_priv) -
++		offsetof(struct ar40xx_priv, vlan));
++
++	for (i = 0; i < AR40XX_MAX_VLANS; i++)
++		priv->vlan_id[i] = i;
++
++	ar40xx_vlan_init(priv);
++
++	priv->mirror_rx = false;
++	priv->mirror_tx = false;
++	priv->source_port = 0;
++	priv->monitor_port = 0;
++
++	mutex_unlock(&priv->reg_mutex);
++
++	rv = ar40xx_sw_hw_apply(dev);
++	return rv;
++}
++
++static int
++ar40xx_start(struct ar40xx_priv *priv)
++{
++	int ret;
++
++	ret = ar40xx_hw_init(priv);
++	if (ret)
++		return ret;
++
++	ret = ar40xx_sw_reset_switch(&priv->dev);
++	if (ret)
++		return ret;
++
++	/* at last, setup cpu port */
++	ret = ar40xx_cpuport_setup(priv);
++	if (ret)
++		return ret;
++
++	schedule_delayed_work(&priv->mib_work,
++			      msecs_to_jiffies(AR40XX_MIB_WORK_DELAY));
++
++	ar40xx_qm_err_check_work_start(priv);
++
++	return 0;
++}
++
++static const struct switch_dev_ops ar40xx_sw_ops = {
++	.attr_global = {
++		.attr = ar40xx_sw_attr_globals,
++		.n_attr = ARRAY_SIZE(ar40xx_sw_attr_globals),
++	},
++	.attr_port = {
++		.attr = ar40xx_sw_attr_port,
++		.n_attr = ARRAY_SIZE(ar40xx_sw_attr_port),
++	},
++	.attr_vlan = {
++		.attr = ar40xx_sw_attr_vlan,
++		.n_attr = ARRAY_SIZE(ar40xx_sw_attr_vlan),
++	},
++	.get_port_pvid = ar40xx_sw_get_pvid,
++	.set_port_pvid = ar40xx_sw_set_pvid,
++	.get_vlan_ports = ar40xx_sw_get_ports,
++	.set_vlan_ports = ar40xx_sw_set_ports,
++	.apply_config = ar40xx_sw_hw_apply,
++	.reset_switch = ar40xx_sw_reset_switch,
++	.get_port_link = ar40xx_sw_get_port_link,
++};
++
++/* Start of phy driver support */
++
++static const u32 ar40xx_phy_ids[] = {
++	0x004dd0b1,
++	0x004dd0b2, /* AR40xx */
++};
++
++static bool
++ar40xx_phy_match(u32 phy_id)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(ar40xx_phy_ids); i++)
++		if (phy_id == ar40xx_phy_ids[i])
++			return true;
++
++	return false;
++}
++
++static bool
++is_ar40xx_phy(struct mii_bus *bus)
++{
++	unsigned i;
++
++	for (i = 0; i < 4; i++) {
++		u32 phy_id;
++
++		phy_id = mdiobus_read(bus, i, MII_PHYSID1) << 16;
++		phy_id |= mdiobus_read(bus, i, MII_PHYSID2);
++		if (!ar40xx_phy_match(phy_id))
++			return false;
++	}
++
++	return true;
++}
++
++static int
++ar40xx_phy_probe(struct phy_device *phydev)
++{
++	if (!is_ar40xx_phy(phydev->mdio.bus))
++		return -ENODEV;
++
++	ar40xx_priv->mii_bus = phydev->mdio.bus;
++	phydev->priv = ar40xx_priv;
++	if (phydev->mdio.addr == 0)
++		ar40xx_priv->phy = phydev;
++
++	phydev->supported |= SUPPORTED_1000baseT_Full;
++	phydev->advertising |= ADVERTISED_1000baseT_Full;
++	return 0;
++}
++
++static void
++ar40xx_phy_remove(struct phy_device *phydev)
++{
++	ar40xx_priv->mii_bus = NULL;
++	phydev->priv = NULL;
++}
++
++static int
++ar40xx_phy_config_init(struct phy_device *phydev)
++{
++	return 0;
++}
++
++static int
++ar40xx_phy_read_status(struct phy_device *phydev)
++{
++	if (phydev->mdio.addr != 0)
++		return genphy_read_status(phydev);
++
++	return 0;
++}
++
++static int
++ar40xx_phy_config_aneg(struct phy_device *phydev)
++{
++	if (phydev->mdio.addr == 0)
++		return 0;
++
++	return genphy_config_aneg(phydev);
++}
++
++static struct phy_driver ar40xx_phy_driver = {
++	.phy_id		= 0x004d0000,
++	.name		= "QCA Malibu",
++	.phy_id_mask	= 0xffff0000,
++	.features	= PHY_BASIC_FEATURES,
++	.probe		= ar40xx_phy_probe,
++	.remove		= ar40xx_phy_remove,
++	.config_init	= ar40xx_phy_config_init,
++	.config_aneg	= ar40xx_phy_config_aneg,
++	.read_status	= ar40xx_phy_read_status,
++};
++
++static uint16_t ar40xx_gpio_get_phy(unsigned int offset)
++{
++	return offset / 4;
++}
++
++static uint16_t ar40xx_gpio_get_reg(unsigned int offset)
++{
++	return 0x8074 + offset % 4;
++}
++
++static void ar40xx_gpio_set(struct gpio_chip *gc, unsigned int offset,
++			    int value)
++{
++	struct ar40xx_priv *priv = gpiochip_get_data(gc);
++
++	ar40xx_phy_mmd_write(priv, ar40xx_gpio_get_phy(offset), 0x7,
++			     ar40xx_gpio_get_reg(offset),
++			     value ? 0xA000 : 0x8000);
++}
++
++static int ar40xx_gpio_get(struct gpio_chip *gc, unsigned offset)
++{
++	struct ar40xx_priv *priv = gpiochip_get_data(gc);
++
++	return ar40xx_phy_mmd_read(priv, ar40xx_gpio_get_phy(offset), 0x7,
++				   ar40xx_gpio_get_reg(offset)) == 0xA000;
++}
++
++static int ar40xx_gpio_get_dir(struct gpio_chip *gc, unsigned offset)
++{
++	return 0; /* only out direction */
++}
++
++static int ar40xx_gpio_dir_out(struct gpio_chip *gc, unsigned offset,
++			       int value)
++{
++	/*
++	 * the direction out value is used to set the initial value.
++	 * support of this function is required by leds-gpio.c
++	 */
++	ar40xx_gpio_set(gc, offset, value);
++	return 0;
++}
++
++static void ar40xx_register_gpio(struct device *pdev,
++				 struct ar40xx_priv *priv,
++				 struct device_node *switch_node)
++{
++	struct gpio_chip *gc;
++	int err;
++
++	gc = devm_kzalloc(pdev, sizeof(*gc), GFP_KERNEL);
++	if (!gc)
++		return;
++
++	gc->label = "ar40xx_gpio",
++	gc->base = -1,
++	gc->ngpio = 5 /* mmd 0 - 4 */ * 4 /* 0x8074 - 0x8077 */,
++	gc->parent = pdev;
++	gc->owner = THIS_MODULE;
++
++	gc->get_direction = ar40xx_gpio_get_dir;
++	gc->direction_output = ar40xx_gpio_dir_out;
++	gc->get = ar40xx_gpio_get;
++	gc->set = ar40xx_gpio_set;
++	gc->can_sleep = true;
++	gc->label = priv->dev.name;
++	gc->of_node = switch_node;
++
++	err = devm_gpiochip_add_data(pdev, gc, priv);
++	if (err != 0)
++		dev_err(pdev, "Failed to register gpio %d.\n", err);
++}
++
++/* End of phy driver support */
++
++/* Platform driver probe function */
++
++static int ar40xx_probe(struct platform_device *pdev)
++{
++	struct device_node *switch_node;
++	struct device_node *psgmii_node;
++	const __be32 *mac_mode;
++	struct clk *ess_clk;
++	struct switch_dev *swdev;
++	struct ar40xx_priv *priv;
++	u32 len;
++	u32 num_mibs;
++	struct resource psgmii_base = {0};
++	struct resource switch_base = {0};
++	int ret;
++
++	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, priv);
++	ar40xx_priv = priv;
++
++	switch_node = of_node_get(pdev->dev.of_node);
++	if (of_address_to_resource(switch_node, 0, &switch_base) != 0)
++		return -EIO;
++
++	priv->hw_addr = devm_ioremap_resource(&pdev->dev, &switch_base);
++	if (IS_ERR(priv->hw_addr)) {
++		dev_err(&pdev->dev, "Failed to ioremap switch_base!\n");
++		return PTR_ERR(priv->hw_addr);
++	}
++
++	/*psgmii dts get*/
++	psgmii_node = of_find_node_by_name(NULL, "ess-psgmii");
++	if (!psgmii_node) {
++		dev_err(&pdev->dev, "Failed to find ess-psgmii node!\n");
++		return -EINVAL;
++	}
++
++	if (of_address_to_resource(psgmii_node, 0, &psgmii_base) != 0)
++		return -EIO;
++
++	priv->psgmii_hw_addr = devm_ioremap_resource(&pdev->dev, &psgmii_base);
++	if (IS_ERR(priv->psgmii_hw_addr)) {
++		dev_err(&pdev->dev, "psgmii ioremap fail!\n");
++		return PTR_ERR(priv->psgmii_hw_addr);
++	}
++
++	mac_mode = of_get_property(switch_node, "switch_mac_mode", &len);
++	if (!mac_mode) {
++		dev_err(&pdev->dev, "Failed to read switch_mac_mode\n");
++		return -EINVAL;
++	}
++	priv->mac_mode = be32_to_cpup(mac_mode);
++
++	ess_clk = of_clk_get_by_name(switch_node, "ess_clk");
++	if (ess_clk)
++		clk_prepare_enable(ess_clk);
++
++	priv->ess_rst = devm_reset_control_get(&pdev->dev, "ess_rst");
++	if (IS_ERR(priv->ess_rst)) {
++		dev_err(&pdev->dev, "Failed to get ess_rst control!\n");
++		return PTR_ERR(priv->ess_rst);
++	}
++
++	if (of_property_read_u32(switch_node, "switch_cpu_bmp",
++				 &priv->cpu_bmp) ||
++	    of_property_read_u32(switch_node, "switch_lan_bmp",
++				 &priv->lan_bmp) ||
++	    of_property_read_u32(switch_node, "switch_wan_bmp",
++				 &priv->wan_bmp)) {
++		dev_err(&pdev->dev, "Failed to read port properties\n");
++		return -EIO;
++	}
++
++	ret = phy_driver_register(&ar40xx_phy_driver, THIS_MODULE);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to register ar40xx phy driver!\n");
++		return -EIO;
++	}
++
++	mutex_init(&priv->reg_mutex);
++	mutex_init(&priv->mib_lock);
++	INIT_DELAYED_WORK(&priv->mib_work, ar40xx_mib_work_func);
++
++	/* register switch */
++	swdev = &priv->dev;
++
++	swdev->alias = dev_name(&priv->mii_bus->dev);
++
++	swdev->cpu_port = AR40XX_PORT_CPU;
++	swdev->name = "QCA AR40xx";
++	swdev->vlans = AR40XX_MAX_VLANS;
++	swdev->ports = AR40XX_NUM_PORTS;
++	swdev->ops = &ar40xx_sw_ops;
++	ret = register_switch(swdev, NULL);
++	if (ret)
++		goto err_unregister_phy;
++
++	num_mibs = ARRAY_SIZE(ar40xx_mibs);
++	len = priv->dev.ports * num_mibs *
++	      sizeof(*priv->mib_stats);
++	priv->mib_stats = devm_kzalloc(&pdev->dev, len, GFP_KERNEL);
++	if (!priv->mib_stats) {
++		ret = -ENOMEM;
++		goto err_unregister_switch;
++	}
++
++	ar40xx_start(priv);
++
++	if (of_property_read_bool(switch_node, "gpio-controller"))
++		ar40xx_register_gpio(&pdev->dev, ar40xx_priv, switch_node);
++
++	return 0;
++
++err_unregister_switch:
++	unregister_switch(&priv->dev);
++err_unregister_phy:
++	phy_driver_unregister(&ar40xx_phy_driver);
++	platform_set_drvdata(pdev, NULL);
++	return ret;
++}
++
++static int ar40xx_remove(struct platform_device *pdev)
++{
++	struct ar40xx_priv *priv = platform_get_drvdata(pdev);
++
++	cancel_delayed_work_sync(&priv->qm_dwork);
++	cancel_delayed_work_sync(&priv->mib_work);
++
++	unregister_switch(&priv->dev);
++
++	phy_driver_unregister(&ar40xx_phy_driver);
++
++	return 0;
++}
++
++static const struct of_device_id ar40xx_of_mtable[] = {
++	{.compatible = "qcom,ess-switch" },
++	{}
++};
++
++struct platform_driver ar40xx_drv = {
++	.probe = ar40xx_probe,
++	.remove = ar40xx_remove,
++	.driver = {
++		.name    = "ar40xx",
++		.of_match_table = ar40xx_of_mtable,
++	},
++};
++
++module_platform_driver(ar40xx_drv);
++
++MODULE_DESCRIPTION("IPQ40XX ESS driver");
++MODULE_LICENSE("Dual BSD/GPL");
+--- /dev/null
++++ b/drivers/net/phy/ar40xx.h
+@@ -0,0 +1,337 @@
++/*
++ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++ #ifndef __AR40XX_H
++#define __AR40XX_H
++
++#define AR40XX_MAX_VLANS	128
++#define AR40XX_NUM_PORTS	6
++#define AR40XX_NUM_PHYS	5
++
++#define BITS(_s, _n)	(((1UL << (_n)) - 1) << _s)
++
++struct ar40xx_priv {
++	struct switch_dev dev;
++
++	u8  __iomem      *hw_addr;
++	u8  __iomem      *psgmii_hw_addr;
++	u32 mac_mode;
++	struct reset_control *ess_rst;
++	u32 cpu_bmp;
++	u32 lan_bmp;
++	u32 wan_bmp;
++
++	struct mii_bus *mii_bus;
++	struct phy_device *phy;
++
++	/* mutex for qm task */
++	struct mutex qm_lock;
++	struct delayed_work qm_dwork;
++	u32 port_link_up[AR40XX_NUM_PORTS];
++	u32 ar40xx_port_old_link[AR40XX_NUM_PORTS];
++	u32 ar40xx_port_qm_buf[AR40XX_NUM_PORTS];
++
++	u32 phy_t_status;
++
++	/* mutex for switch reg access */
++	struct mutex reg_mutex;
++
++	/* mutex for mib task */
++	struct mutex mib_lock;
++	struct delayed_work mib_work;
++	int mib_next_port;
++	u64 *mib_stats;
++
++	char buf[2048];
++
++	/* all fields below will be cleared on reset */
++	bool vlan;
++	u16 vlan_id[AR40XX_MAX_VLANS];
++	u8 vlan_table[AR40XX_MAX_VLANS];
++	u8 vlan_tagged;
++	u16 pvid[AR40XX_NUM_PORTS];
++
++	/* mirror */
++	bool mirror_rx;
++	bool mirror_tx;
++	int source_port;
++	int monitor_port;
++};
++
++#define AR40XX_PORT_LINK_UP 1
++#define AR40XX_PORT_LINK_DOWN 0
++#define AR40XX_QM_NOT_EMPTY  1
++#define AR40XX_QM_EMPTY  0
++
++#define AR40XX_LAN_VLAN	1
++#define AR40XX_WAN_VLAN	2
++
++enum ar40xx_port_wrapper_cfg {
++	PORT_WRAPPER_PSGMII = 0,
++};
++
++struct ar40xx_mib_desc {
++	u32 size;
++	u32 offset;
++	const char *name;
++};
++
++#define AR40XX_PORT_CPU	0
++
++#define AR40XX_PSGMII_MODE_CONTROL	0x1b4
++#define   AR40XX_PSGMII_ATHR_CSCO_MODE_25M	BIT(0)
++
++#define AR40XX_PSGMIIPHY_TX_CONTROL	 0x288
++
++#define AR40XX_MII_ATH_MMD_ADDR		0x0d
++#define AR40XX_MII_ATH_MMD_DATA		0x0e
++#define AR40XX_MII_ATH_DBG_ADDR		0x1d
++#define AR40XX_MII_ATH_DBG_DATA		0x1e
++
++#define AR40XX_STATS_RXBROAD		0x00
++#define AR40XX_STATS_RXPAUSE		0x04
++#define AR40XX_STATS_RXMULTI		0x08
++#define AR40XX_STATS_RXFCSERR		0x0c
++#define AR40XX_STATS_RXALIGNERR		0x10
++#define AR40XX_STATS_RXRUNT		0x14
++#define AR40XX_STATS_RXFRAGMENT		0x18
++#define AR40XX_STATS_RX64BYTE		0x1c
++#define AR40XX_STATS_RX128BYTE		0x20
++#define AR40XX_STATS_RX256BYTE		0x24
++#define AR40XX_STATS_RX512BYTE		0x28
++#define AR40XX_STATS_RX1024BYTE		0x2c
++#define AR40XX_STATS_RX1518BYTE		0x30
++#define AR40XX_STATS_RXMAXBYTE		0x34
++#define AR40XX_STATS_RXTOOLONG		0x38
++#define AR40XX_STATS_RXGOODBYTE		0x3c
++#define AR40XX_STATS_RXBADBYTE		0x44
++#define AR40XX_STATS_RXOVERFLOW		0x4c
++#define AR40XX_STATS_FILTERED		0x50
++#define AR40XX_STATS_TXBROAD		0x54
++#define AR40XX_STATS_TXPAUSE		0x58
++#define AR40XX_STATS_TXMULTI		0x5c
++#define AR40XX_STATS_TXUNDERRUN		0x60
++#define AR40XX_STATS_TX64BYTE		0x64
++#define AR40XX_STATS_TX128BYTE		0x68
++#define AR40XX_STATS_TX256BYTE		0x6c
++#define AR40XX_STATS_TX512BYTE		0x70
++#define AR40XX_STATS_TX1024BYTE		0x74
++#define AR40XX_STATS_TX1518BYTE		0x78
++#define AR40XX_STATS_TXMAXBYTE		0x7c
++#define AR40XX_STATS_TXOVERSIZE		0x80
++#define AR40XX_STATS_TXBYTE		0x84
++#define AR40XX_STATS_TXCOLLISION	0x8c
++#define AR40XX_STATS_TXABORTCOL		0x90
++#define AR40XX_STATS_TXMULTICOL		0x94
++#define AR40XX_STATS_TXSINGLECOL	0x98
++#define AR40XX_STATS_TXEXCDEFER		0x9c
++#define AR40XX_STATS_TXDEFER		0xa0
++#define AR40XX_STATS_TXLATECOL		0xa4
++
++#define AR40XX_REG_MODULE_EN			0x030
++#define   AR40XX_MODULE_EN_MIB			BIT(0)
++
++#define AR40XX_REG_MIB_FUNC			0x034
++#define   AR40XX_MIB_BUSY		BIT(17)
++#define   AR40XX_MIB_CPU_KEEP			BIT(20)
++#define   AR40XX_MIB_FUNC		BITS(24, 3)
++#define   AR40XX_MIB_FUNC_S		24
++#define   AR40XX_MIB_FUNC_NO_OP		0x0
++#define   AR40XX_MIB_FUNC_FLUSH		0x1
++
++#define AR40XX_REG_PORT_STATUS(_i)		(0x07c + (_i) * 4)
++#define   AR40XX_PORT_SPEED			BITS(0, 2)
++#define   AR40XX_PORT_STATUS_SPEED_S	0
++#define   AR40XX_PORT_TX_EN			BIT(2)
++#define   AR40XX_PORT_RX_EN			BIT(3)
++#define   AR40XX_PORT_STATUS_TXFLOW	BIT(4)
++#define   AR40XX_PORT_STATUS_RXFLOW	BIT(5)
++#define   AR40XX_PORT_DUPLEX			BIT(6)
++#define   AR40XX_PORT_TXHALF_FLOW		BIT(7)
++#define   AR40XX_PORT_STATUS_LINK_UP	BIT(8)
++#define   AR40XX_PORT_AUTO_LINK_EN		BIT(9)
++#define   AR40XX_PORT_STATUS_FLOW_CONTROL  BIT(12)
++
++#define AR40XX_REG_MAX_FRAME_SIZE		0x078
++#define   AR40XX_MAX_FRAME_SIZE_MTU		BITS(0, 14)
++
++#define AR40XX_REG_PORT_HEADER(_i)		(0x09c + (_i) * 4)
++
++#define AR40XX_REG_EEE_CTRL			0x100
++#define   AR40XX_EEE_CTRL_DISABLE_PHY(_i)	BIT(4 + (_i) * 2)
++
++#define AR40XX_REG_PORT_VLAN0(_i)		(0x420 + (_i) * 0x8)
++#define   AR40XX_PORT_VLAN0_DEF_SVID		BITS(0, 12)
++#define   AR40XX_PORT_VLAN0_DEF_SVID_S		0
++#define   AR40XX_PORT_VLAN0_DEF_CVID		BITS(16, 12)
++#define   AR40XX_PORT_VLAN0_DEF_CVID_S		16
++
++#define AR40XX_REG_PORT_VLAN1(_i)		(0x424 + (_i) * 0x8)
++#define   AR40XX_PORT_VLAN1_PORT_VLAN_PROP	BIT(6)
++#define   AR40XX_PORT_VLAN1_OUT_MODE		BITS(12, 2)
++#define   AR40XX_PORT_VLAN1_OUT_MODE_S		12
++#define   AR40XX_PORT_VLAN1_OUT_MODE_UNMOD	0
++#define   AR40XX_PORT_VLAN1_OUT_MODE_UNTAG	1
++#define   AR40XX_PORT_VLAN1_OUT_MODE_TAG		2
++#define   AR40XX_PORT_VLAN1_OUT_MODE_UNTOUCH	3
++
++#define AR40XX_REG_VTU_FUNC0			0x0610
++#define   AR40XX_VTU_FUNC0_EG_MODE		BITS(4, 14)
++#define   AR40XX_VTU_FUNC0_EG_MODE_S(_i)	(4 + (_i) * 2)
++#define   AR40XX_VTU_FUNC0_EG_MODE_KEEP		0
++#define   AR40XX_VTU_FUNC0_EG_MODE_UNTAG	1
++#define   AR40XX_VTU_FUNC0_EG_MODE_TAG		2
++#define   AR40XX_VTU_FUNC0_EG_MODE_NOT		3
++#define   AR40XX_VTU_FUNC0_IVL			BIT(19)
++#define   AR40XX_VTU_FUNC0_VALID		BIT(20)
++
++#define AR40XX_REG_VTU_FUNC1			0x0614
++#define   AR40XX_VTU_FUNC1_OP			BITS(0, 3)
++#define   AR40XX_VTU_FUNC1_OP_NOOP		0
++#define   AR40XX_VTU_FUNC1_OP_FLUSH		1
++#define   AR40XX_VTU_FUNC1_OP_LOAD		2
++#define   AR40XX_VTU_FUNC1_OP_PURGE		3
++#define   AR40XX_VTU_FUNC1_OP_REMOVE_PORT	4
++#define   AR40XX_VTU_FUNC1_OP_GET_NEXT		5
++#define   AR40XX7_VTU_FUNC1_OP_GET_ONE		6
++#define   AR40XX_VTU_FUNC1_FULL			BIT(4)
++#define   AR40XX_VTU_FUNC1_PORT			BIT(8, 4)
++#define   AR40XX_VTU_FUNC1_PORT_S		8
++#define   AR40XX_VTU_FUNC1_VID			BIT(16, 12)
++#define   AR40XX_VTU_FUNC1_VID_S		16
++#define   AR40XX_VTU_FUNC1_BUSY			BIT(31)
++
++#define AR40XX_REG_FWD_CTRL0			0x620
++#define   AR40XX_FWD_CTRL0_CPU_PORT_EN		BIT(10)
++#define   AR40XX_FWD_CTRL0_MIRROR_PORT		BITS(4, 4)
++#define   AR40XX_FWD_CTRL0_MIRROR_PORT_S	4
++
++#define AR40XX_REG_FWD_CTRL1			0x624
++#define   AR40XX_FWD_CTRL1_UC_FLOOD		BITS(0, 7)
++#define   AR40XX_FWD_CTRL1_UC_FLOOD_S		0
++#define   AR40XX_FWD_CTRL1_MC_FLOOD		BITS(8, 7)
++#define   AR40XX_FWD_CTRL1_MC_FLOOD_S		8
++#define   AR40XX_FWD_CTRL1_BC_FLOOD		BITS(16, 7)
++#define   AR40XX_FWD_CTRL1_BC_FLOOD_S		16
++#define   AR40XX_FWD_CTRL1_IGMP			BITS(24, 7)
++#define   AR40XX_FWD_CTRL1_IGMP_S		24
++
++#define AR40XX_REG_PORT_LOOKUP(_i)		(0x660 + (_i) * 0xc)
++#define   AR40XX_PORT_LOOKUP_MEMBER		BITS(0, 7)
++#define   AR40XX_PORT_LOOKUP_IN_MODE		BITS(8, 2)
++#define   AR40XX_PORT_LOOKUP_IN_MODE_S		8
++#define   AR40XX_PORT_LOOKUP_STATE		BITS(16, 3)
++#define   AR40XX_PORT_LOOKUP_STATE_S		16
++#define   AR40XX_PORT_LOOKUP_LEARN		BIT(20)
++#define   AR40XX_PORT_LOOKUP_LOOPBACK		BIT(21)
++#define   AR40XX_PORT_LOOKUP_ING_MIRROR_EN	BIT(25)
++
++#define AR40XX_REG_ATU_FUNC			0x60c
++#define   AR40XX_ATU_FUNC_OP			BITS(0, 4)
++#define   AR40XX_ATU_FUNC_OP_NOOP		0x0
++#define   AR40XX_ATU_FUNC_OP_FLUSH		0x1
++#define   AR40XX_ATU_FUNC_OP_LOAD		0x2
++#define   AR40XX_ATU_FUNC_OP_PURGE		0x3
++#define   AR40XX_ATU_FUNC_OP_FLUSH_LOCKED	0x4
++#define   AR40XX_ATU_FUNC_OP_FLUSH_UNICAST	0x5
++#define   AR40XX_ATU_FUNC_OP_GET_NEXT		0x6
++#define   AR40XX_ATU_FUNC_OP_SEARCH_MAC		0x7
++#define   AR40XX_ATU_FUNC_OP_CHANGE_TRUNK	0x8
++#define   AR40XX_ATU_FUNC_BUSY			BIT(31)
++
++#define AR40XX_REG_QM_DEBUG_ADDR		0x820
++#define AR40XX_REG_QM_DEBUG_VALUE		0x824
++#define   AR40XX_REG_QM_PORT0_3_QNUM		0x1d
++#define   AR40XX_REG_QM_PORT4_6_QNUM		0x1e
++
++#define AR40XX_REG_PORT_HOL_CTRL1(_i)		(0x974 + (_i) * 0x8)
++#define   AR40XX_PORT_HOL_CTRL1_EG_MIRROR_EN	BIT(16)
++
++#define AR40XX_REG_PORT_FLOWCTRL_THRESH(_i)	(0x9b0 + (_i) * 0x4)
++#define   AR40XX_PORT0_FC_THRESH_ON_DFLT	0x60
++#define   AR40XX_PORT0_FC_THRESH_OFF_DFLT	0x90
++
++#define AR40XX_PHY_DEBUG_0   0
++#define AR40XX_PHY_MANU_CTRL_EN  BIT(12)
++
++#define AR40XX_PHY_DEBUG_2   2
++
++#define AR40XX_PHY_SPEC_STATUS 0x11
++#define   AR40XX_PHY_SPEC_STATUS_LINK		BIT(10)
++#define   AR40XX_PHY_SPEC_STATUS_DUPLEX		BIT(13)
++#define   AR40XX_PHY_SPEC_STATUS_SPEED		BITS(14, 2)
++
++/* port forwarding state */
++enum {
++	AR40XX_PORT_STATE_DISABLED = 0,
++	AR40XX_PORT_STATE_BLOCK = 1,
++	AR40XX_PORT_STATE_LISTEN = 2,
++	AR40XX_PORT_STATE_LEARN = 3,
++	AR40XX_PORT_STATE_FORWARD = 4
++};
++
++/* ingress 802.1q mode */
++enum {
++	AR40XX_IN_PORT_ONLY = 0,
++	AR40XX_IN_PORT_FALLBACK = 1,
++	AR40XX_IN_VLAN_ONLY = 2,
++	AR40XX_IN_SECURE = 3
++};
++
++/* egress 802.1q mode */
++enum {
++	AR40XX_OUT_KEEP = 0,
++	AR40XX_OUT_STRIP_VLAN = 1,
++	AR40XX_OUT_ADD_VLAN = 2
++};
++
++/* port speed */
++enum {
++	AR40XX_PORT_SPEED_10M = 0,
++	AR40XX_PORT_SPEED_100M = 1,
++	AR40XX_PORT_SPEED_1000M = 2,
++	AR40XX_PORT_SPEED_ERR = 3,
++};
++
++#define AR40XX_MIB_WORK_DELAY	2000 /* msecs */
++
++#define AR40XX_QM_WORK_DELAY    100
++
++#define   AR40XX_MIB_FUNC_CAPTURE	0x3
++
++#define AR40XX_REG_PORT_STATS_START	0x1000
++#define AR40XX_REG_PORT_STATS_LEN		0x100
++
++#define AR40XX_PORTS_ALL	0x3f
++
++#define AR40XX_PSGMII_ID	5
++#define AR40XX_PSGMII_CALB_NUM	100
++#define AR40XX_MALIBU_PSGMII_MODE_CTRL	0x6d
++#define AR40XX_MALIBU_PHY_PSGMII_MODE_CTRL_ADJUST_VAL	0x220c
++#define AR40XX_MALIBU_PHY_MMD7_DAC_CTRL	0x801a
++#define AR40XX_MALIBU_DAC_CTRL_MASK	0x380
++#define AR40XX_MALIBU_DAC_CTRL_VALUE	0x280
++#define AR40XX_MALIBU_PHY_RLP_CTRL       0x805a
++#define AR40XX_PSGMII_TX_DRIVER_1_CTRL	0xb
++#define AR40XX_MALIBU_PHY_PSGMII_REDUCE_SERDES_TX_AMP	0x8a
++#define AR40XX_MALIBU_PHY_LAST_ADDR	4
++
++static inline struct ar40xx_priv *
++swdev_to_ar40xx(struct switch_dev *swdev)
++{
++	return container_of(swdev, struct ar40xx_priv, dev);
++}
++
++#endif
+--- /dev/null
++++ b/drivers/net/phy/mdio-ipq40xx.c
+@@ -0,0 +1,203 @@
++/*
++ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/delay.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/io.h>
++#include <linux/of_address.h>
++#include <linux/of_mdio.h>
++#include <linux/phy.h>
++#include <linux/platform_device.h>
++
++#define MDIO_CTRL_0_REG		0x40
++#define MDIO_CTRL_1_REG		0x44
++#define MDIO_CTRL_2_REG		0x48
++#define MDIO_CTRL_3_REG		0x4c
++#define MDIO_CTRL_4_REG		0x50
++#define MDIO_CTRL_4_ACCESS_BUSY		BIT(16)
++#define MDIO_CTRL_4_ACCESS_START		BIT(8)
++#define MDIO_CTRL_4_ACCESS_CODE_READ		0
++#define MDIO_CTRL_4_ACCESS_CODE_WRITE	1
++#define CTRL_0_REG_DEFAULT_VALUE	0x150FF
++
++#define IPQ40XX_MDIO_RETRY	1000
++#define IPQ40XX_MDIO_DELAY	10
++
++struct ipq40xx_mdio_data {
++	struct mii_bus	*mii_bus;
++	void __iomem	*membase;
++	int		phy_irq[PHY_MAX_ADDR];
++	struct device	*dev;
++};
++
++static int ipq40xx_mdio_wait_busy(struct ipq40xx_mdio_data *am)
++{
++	int i;
++
++	for (i = 0; i < IPQ40XX_MDIO_RETRY; i++) {
++		unsigned int busy;
++
++		busy = readl(am->membase + MDIO_CTRL_4_REG) &
++			MDIO_CTRL_4_ACCESS_BUSY;
++		if (!busy)
++			return 0;
++
++		/* BUSY might take to be cleard by 15~20 times of loop */
++		udelay(IPQ40XX_MDIO_DELAY);
++	}
++
++	dev_err(am->dev, "%s: MDIO operation timed out\n", am->mii_bus->name);
++
++	return -ETIMEDOUT;
++}
++
++static int ipq40xx_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
++{
++	struct ipq40xx_mdio_data *am = bus->priv;
++	int value = 0;
++	unsigned int cmd = 0;
++
++	lockdep_assert_held(&bus->mdio_lock);
++
++	if (ipq40xx_mdio_wait_busy(am))
++		return -ETIMEDOUT;
++
++	/* issue the phy address and reg */
++	writel((mii_id << 8) | regnum, am->membase + MDIO_CTRL_1_REG);
++
++	cmd = MDIO_CTRL_4_ACCESS_START|MDIO_CTRL_4_ACCESS_CODE_READ;
++
++	/* issue read command */
++	writel(cmd, am->membase + MDIO_CTRL_4_REG);
++
++	/* Wait read complete */
++	if (ipq40xx_mdio_wait_busy(am))
++		return -ETIMEDOUT;
++
++	/* Read data */
++	value = readl(am->membase + MDIO_CTRL_3_REG);
++
++	return value;
++}
++
++static int ipq40xx_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
++			    u16 value)
++{
++	struct ipq40xx_mdio_data *am = bus->priv;
++	unsigned int cmd = 0;
++
++	lockdep_assert_held(&bus->mdio_lock);
++
++	if (ipq40xx_mdio_wait_busy(am))
++		return -ETIMEDOUT;
++
++	/* issue the phy address and reg */
++	writel((mii_id << 8) | regnum, am->membase + MDIO_CTRL_1_REG);
++
++	/* issue write data */
++	writel(value, am->membase + MDIO_CTRL_2_REG);
++
++	cmd = MDIO_CTRL_4_ACCESS_START|MDIO_CTRL_4_ACCESS_CODE_WRITE;
++	/* issue write command */
++	writel(cmd, am->membase + MDIO_CTRL_4_REG);
++
++	/* Wait write complete */
++	if (ipq40xx_mdio_wait_busy(am))
++		return -ETIMEDOUT;
++
++	return 0;
++}
++
++static int ipq40xx_mdio_probe(struct platform_device *pdev)
++{
++	struct ipq40xx_mdio_data *am;
++	struct resource *res;
++	int i;
++
++	am = devm_kzalloc(&pdev->dev, sizeof(*am), GFP_KERNEL);
++	if (!am)
++		return -ENOMEM;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res) {
++		dev_err(&pdev->dev, "no iomem resource found\n");
++		return -ENXIO;
++	}
++
++	am->membase = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(am->membase)) {
++		dev_err(&pdev->dev, "unable to ioremap registers\n");
++		return PTR_ERR(am->membase);
++	}
++
++	am->mii_bus = devm_mdiobus_alloc(&pdev->dev);
++	if (!am->mii_bus)
++		return  -ENOMEM;
++
++	writel(CTRL_0_REG_DEFAULT_VALUE, am->membase + MDIO_CTRL_0_REG);
++
++	am->mii_bus->name = "ipq40xx_mdio";
++	am->mii_bus->read = ipq40xx_mdio_read;
++	am->mii_bus->write = ipq40xx_mdio_write;
++	memcpy(am->mii_bus->irq, am->phy_irq, sizeof(am->phy_irq));
++	am->mii_bus->priv = am;
++	am->mii_bus->parent = &pdev->dev;
++	snprintf(am->mii_bus->id, MII_BUS_ID_SIZE, "%s", dev_name(&pdev->dev));
++
++	for (i = 0; i < PHY_MAX_ADDR; i++)
++		am->phy_irq[i] = PHY_POLL;
++
++	am->dev = &pdev->dev;
++	platform_set_drvdata(pdev, am);
++
++	/* edma_axi_probe() use "am" drvdata.
++	 * ipq40xx_mdio_probe() must be called first.
++	 */
++	return of_mdiobus_register(am->mii_bus, pdev->dev.of_node);
++}
++
++static int ipq40xx_mdio_remove(struct platform_device *pdev)
++{
++	struct ipq40xx_mdio_data *am = platform_get_drvdata(pdev);
++
++	mdiobus_unregister(am->mii_bus);
++	return 0;
++}
++
++static const struct of_device_id ipq40xx_mdio_dt_ids[] = {
++	{ .compatible = "qcom,ipq4019-mdio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ipq40xx_mdio_dt_ids);
++
++static struct platform_driver ipq40xx_mdio_driver = {
++	.probe = ipq40xx_mdio_probe,
++	.remove = ipq40xx_mdio_remove,
++	.driver = {
++		.name = "ipq40xx-mdio",
++		.of_match_table = ipq40xx_mdio_dt_ids,
++	},
++};
++
++module_platform_driver(ipq40xx_mdio_driver);
++
++#define DRV_VERSION     "1.0"
++
++MODULE_DESCRIPTION("IPQ40XX MDIO interface driver");
++MODULE_AUTHOR("Qualcomm Atheros");
++MODULE_VERSION(DRV_VERSION);
++MODULE_LICENSE("Dual BSD/GPL");
diff --git a/target/linux/ipq40xx/patches-4.14/701-dts-ipq4019-add-mdio-node.patch b/target/linux/ipq40xx/patches-4.14/701-dts-ipq4019-add-mdio-node.patch
new file mode 100644
index 000000000..112c921db
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/701-dts-ipq4019-add-mdio-node.patch
@@ -0,0 +1,52 @@
+From 09ed737593f71bcca08a537a6c15264a1a6add08 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sun, 20 Nov 2016 01:10:33 +0100
+Subject: [PATCH] dts: ipq4019: add mdio node for ethernet
+
+This patch adds the mdio device-tree node.
+This is where the switch is connected to, so it's needed
+for the ethernet interfaces.
+
+Note: The driver isn't anywhere close to be upstream,
+so the info might change.
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -539,6 +539,34 @@
+ 			status = "disabled";
+ 		};
+ 
++		mdio@90000 {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			compatible = "qcom,ipq4019-mdio";
++			reg = <0x90000 0x64>;
++			status = "disabled";
++
++			ethernet-phy@0 {
++				reg = <0>;
++			};
++
++			ethernet-phy@1 {
++				reg = <1>;
++			};
++
++			ethernet-phy@2 {
++				reg = <2>;
++			};
++
++			ethernet-phy@3 {
++				reg = <3>;
++			};
++
++			ethernet-phy@4 {
++				reg = <4>;
++			};
++		};
++
+ 		usb3_ss_phy: ssphy@9a000 {
+ 			compatible = "qca,uni-ssphy";
+ 			reg = <0x9a000 0x800>;
diff --git a/target/linux/ipq40xx/patches-4.14/702-dts-ipq4019-add-PHY-switch-nodes.patch b/target/linux/ipq40xx/patches-4.14/702-dts-ipq4019-add-PHY-switch-nodes.patch
new file mode 100644
index 000000000..7ad9edbe9
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/702-dts-ipq4019-add-PHY-switch-nodes.patch
@@ -0,0 +1,46 @@
+From 9deeec35dd3b628b95624e41d4e04acf728991ba Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sun, 20 Nov 2016 02:20:54 +0100
+Subject: [PATCH] dts: ipq4019: add PHY/switch nodes
+
+This patch adds both the "qcom,ess-switch" and "qcom,ess-psgmii"
+nodes which are needed for the ar40xx.c driver to initialize the
+switch.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -567,6 +567,29 @@
+ 			};
+ 		};
+ 
++		ess-switch@c000000 {
++			compatible = "qcom,ess-switch";
++			reg = <0xc000000 0x80000>;
++			switch_access_mode = "local bus";
++			resets = <&gcc ESS_RESET>;
++			reset-names = "ess_rst";
++			clocks = <&gcc GCC_ESS_CLK>;
++			clock-names = "ess_clk";
++			switch_cpu_bmp = <0x1>;
++			switch_lan_bmp = <0x1e>;
++			switch_wan_bmp = <0x20>;
++			switch_mac_mode = <0>; /* PORT_WRAPPER_PSGMII */
++			switch_initvlas = <0x7c 0x54>;
++			status = "disabled";
++		};
++
++		ess-psgmii@98000 {
++			compatible = "qcom,ess-psgmii";
++			reg = <0x98000 0x800>;
++			psgmii_access_mode = "local bus";
++			status = "disabled";
++		};
++
+ 		usb3_ss_phy: ssphy@9a000 {
+ 			compatible = "qca,uni-ssphy";
+ 			reg = <0x9a000 0x800>;
diff --git a/target/linux/ipq40xx/patches-4.14/710-net-add-qualcomm-essedma-ethernet-driver.patch b/target/linux/ipq40xx/patches-4.14/710-net-add-qualcomm-essedma-ethernet-driver.patch
new file mode 100644
index 000000000..e304911f1
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/710-net-add-qualcomm-essedma-ethernet-driver.patch
@@ -0,0 +1,4578 @@
+From 12e9319da1adacac92930c899c99f0e1970cac11 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 19 Jan 2017 02:01:31 +0100
+Subject: [PATCH 33/38] NET: add qualcomm essedma ethernet driver
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ drivers/net/ethernet/qualcomm/Kconfig  | 9 +++++++++
+ drivers/net/ethernet/qualcomm/Makefile | 1 +
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/net/ethernet/qualcomm/Kconfig
++++ b/drivers/net/ethernet/qualcomm/Kconfig
+@@ -61,4 +61,13 @@ config QCOM_EMAC
+ 
+ source "drivers/net/ethernet/qualcomm/rmnet/Kconfig"
+ 
++config ESSEDMA
++	tristate "Qualcomm Atheros ESS Edma support"
++	---help---
++	  This driver supports ethernet edma adapter.
++	  Say Y to build this driver.
++
++	  To compile this driver as a module, choose M here. The module
++	  will be called essedma.ko.
++
+ endif # NET_VENDOR_QUALCOMM
+--- a/drivers/net/ethernet/qualcomm/Makefile
++++ b/drivers/net/ethernet/qualcomm/Makefile
+@@ -10,5 +10,6 @@ obj-$(CONFIG_QCA7000_UART) += qcauart.o
+ qcauart-objs := qca_uart.o
+ 
+ obj-y += emac/
++obj-$(CONFIG_ESSEDMA) += essedma/
+ 
+ obj-$(CONFIG_RMNET) += rmnet/
+--- /dev/null
++++ b/drivers/net/ethernet/qualcomm/essedma/Makefile
+@@ -0,0 +1,9 @@
++#
++## Makefile for the Qualcomm Atheros ethernet edma driver
++#
++
++
++obj-$(CONFIG_ESSEDMA) += essedma.o
++
++essedma-objs := edma_axi.o edma.o edma_ethtool.o
++
+--- /dev/null
++++ b/drivers/net/ethernet/qualcomm/essedma/edma.c
+@@ -0,0 +1,2143 @@
++/*
++ * Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/platform_device.h>
++#include <linux/if_vlan.h>
++#include "ess_edma.h"
++#include "edma.h"
++
++extern struct net_device *edma_netdev[EDMA_MAX_PORTID_SUPPORTED];
++bool edma_stp_rstp;
++u16 edma_ath_eth_type;
++
++/* edma_skb_priority_offset()
++ * 	get edma skb priority
++ */
++static unsigned int edma_skb_priority_offset(struct sk_buff *skb)
++{
++	return (skb->priority >> 2) & 1;
++}
++
++/* edma_alloc_tx_ring()
++ *	Allocate Tx descriptors ring
++ */
++static int edma_alloc_tx_ring(struct edma_common_info *edma_cinfo,
++			      struct edma_tx_desc_ring *etdr)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++
++	/* Initialize ring */
++	etdr->size = sizeof(struct edma_sw_desc) * etdr->count;
++	etdr->sw_next_to_fill = 0;
++	etdr->sw_next_to_clean = 0;
++
++	/* Allocate SW descriptors */
++	etdr->sw_desc = vzalloc(etdr->size);
++	if (!etdr->sw_desc) {
++		dev_err(&pdev->dev, "buffer alloc of tx ring failed=%p", etdr);
++		return -ENOMEM;
++	}
++
++	/* Allocate HW descriptors */
++	etdr->hw_desc = dma_alloc_coherent(&pdev->dev, etdr->size, &etdr->dma,
++					  GFP_KERNEL);
++	if (!etdr->hw_desc) {
++		dev_err(&pdev->dev, "descriptor allocation for tx ring failed");
++		vfree(etdr->sw_desc);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++/* edma_free_tx_ring()
++ *	Free tx rings allocated by edma_alloc_tx_rings
++ */
++static void edma_free_tx_ring(struct edma_common_info *edma_cinfo,
++			      struct edma_tx_desc_ring *etdr)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++
++	if (likely(etdr->dma))
++		dma_free_coherent(&pdev->dev, etdr->size, etdr->hw_desc,
++				 etdr->dma);
++
++	vfree(etdr->sw_desc);
++	etdr->sw_desc = NULL;
++}
++
++/* edma_alloc_rx_ring()
++ *	allocate rx descriptor ring
++ */
++static int edma_alloc_rx_ring(struct edma_common_info *edma_cinfo,
++			     struct edma_rfd_desc_ring *erxd)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++
++	erxd->size = sizeof(struct edma_sw_desc) * erxd->count;
++	erxd->sw_next_to_fill = 0;
++	erxd->sw_next_to_clean = 0;
++
++	/* Allocate SW descriptors */
++	erxd->sw_desc = vzalloc(erxd->size);
++	if (!erxd->sw_desc)
++		return -ENOMEM;
++
++	/* Alloc HW descriptors */
++	erxd->hw_desc = dma_alloc_coherent(&pdev->dev, erxd->size, &erxd->dma,
++			GFP_KERNEL);
++	if (!erxd->hw_desc) {
++		vfree(erxd->sw_desc);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++/* edma_free_rx_ring()
++ *	Free rx ring allocated by alloc_rx_ring
++ */
++static void edma_free_rx_ring(struct edma_common_info *edma_cinfo,
++			     struct edma_rfd_desc_ring *rxdr)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++
++	if (likely(rxdr->dma))
++		dma_free_coherent(&pdev->dev, rxdr->size, rxdr->hw_desc,
++				 rxdr->dma);
++
++	vfree(rxdr->sw_desc);
++	rxdr->sw_desc = NULL;
++}
++
++/* edma_configure_tx()
++ *	Configure transmission control data
++ */
++static void edma_configure_tx(struct edma_common_info *edma_cinfo)
++{
++	u32 txq_ctrl_data;
++
++	txq_ctrl_data = (EDMA_TPD_BURST << EDMA_TXQ_NUM_TPD_BURST_SHIFT);
++	txq_ctrl_data |= EDMA_TXQ_CTRL_TPD_BURST_EN;
++	txq_ctrl_data |= (EDMA_TXF_BURST << EDMA_TXQ_TXF_BURST_NUM_SHIFT);
++	edma_write_reg(EDMA_REG_TXQ_CTRL, txq_ctrl_data);
++}
++
++
++/* edma_configure_rx()
++ *	configure reception control data
++ */
++static void edma_configure_rx(struct edma_common_info *edma_cinfo)
++{
++	struct edma_hw *hw = &edma_cinfo->hw;
++	u32 rss_type, rx_desc1, rxq_ctrl_data;
++
++	/* Set RSS type */
++	rss_type = hw->rss_type;
++	edma_write_reg(EDMA_REG_RSS_TYPE, rss_type);
++
++	/* Set RFD burst number */
++	rx_desc1 = (EDMA_RFD_BURST << EDMA_RXQ_RFD_BURST_NUM_SHIFT);
++
++	/* Set RFD prefetch threshold */
++	rx_desc1 |= (EDMA_RFD_THR << EDMA_RXQ_RFD_PF_THRESH_SHIFT);
++
++	/* Set RFD in host ring low threshold to generte interrupt */
++	rx_desc1 |= (EDMA_RFD_LTHR << EDMA_RXQ_RFD_LOW_THRESH_SHIFT);
++	edma_write_reg(EDMA_REG_RX_DESC1, rx_desc1);
++
++	/* Set Rx FIFO threshold to start to DMA data to host */
++	rxq_ctrl_data = EDMA_FIFO_THRESH_128_BYTE;
++
++	/* Set RX remove vlan bit */
++	rxq_ctrl_data |= EDMA_RXQ_CTRL_RMV_VLAN;
++
++	edma_write_reg(EDMA_REG_RXQ_CTRL, rxq_ctrl_data);
++}
++
++/* edma_alloc_rx_buf()
++ *	does skb allocation for the received packets.
++ */
++static int edma_alloc_rx_buf(struct edma_common_info
++			     *edma_cinfo,
++			     struct edma_rfd_desc_ring *erdr,
++			     int cleaned_count, int queue_id)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++	struct edma_rx_free_desc *rx_desc;
++	struct edma_sw_desc *sw_desc;
++	struct sk_buff *skb;
++	unsigned int i;
++	u16 prod_idx, length;
++	u32 reg_data;
++
++	if (cleaned_count > erdr->count) {
++		dev_err(&pdev->dev, "Incorrect cleaned_count %d",
++		       cleaned_count);
++		return -1;
++	}
++
++	i = erdr->sw_next_to_fill;
++
++	while (cleaned_count) {
++		sw_desc = &erdr->sw_desc[i];
++		length = edma_cinfo->rx_head_buffer_len;
++
++		if (sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_REUSE) {
++			skb = sw_desc->skb;
++		} else {
++			/* alloc skb */
++			skb = netdev_alloc_skb(edma_netdev[0], length);
++			if (!skb) {
++				/* Better luck next round */
++				break;
++			}
++		}
++
++		if (edma_cinfo->page_mode) {
++			struct page *pg = alloc_page(GFP_ATOMIC);
++
++			if (!pg) {
++				dev_kfree_skb_any(skb);
++				break;
++			}
++
++			sw_desc->dma = dma_map_page(&pdev->dev, pg, 0,
++						   edma_cinfo->rx_page_buffer_len,
++						   DMA_FROM_DEVICE);
++			if (dma_mapping_error(&pdev->dev,
++				    sw_desc->dma)) {
++				__free_page(pg);
++				dev_kfree_skb_any(skb);
++				break;
++			}
++
++			skb_fill_page_desc(skb, 0, pg, 0,
++					   edma_cinfo->rx_page_buffer_len);
++			sw_desc->flags = EDMA_SW_DESC_FLAG_SKB_FRAG;
++			sw_desc->length = edma_cinfo->rx_page_buffer_len;
++		} else {
++			sw_desc->dma = dma_map_single(&pdev->dev, skb->data,
++						     length, DMA_FROM_DEVICE);
++			if (dma_mapping_error(&pdev->dev,
++			   sw_desc->dma)) {
++				dev_kfree_skb_any(skb);
++				break;
++			}
++
++			sw_desc->flags = EDMA_SW_DESC_FLAG_SKB_HEAD;
++			sw_desc->length = length;
++		}
++
++		/* Update the buffer info */
++		sw_desc->skb = skb;
++		rx_desc = (&((struct edma_rx_free_desc *)(erdr->hw_desc))[i]);
++		rx_desc->buffer_addr = cpu_to_le64(sw_desc->dma);
++		if (++i == erdr->count)
++			i = 0;
++		cleaned_count--;
++	}
++
++	erdr->sw_next_to_fill = i;
++
++	if (i == 0)
++		prod_idx = erdr->count - 1;
++	else
++		prod_idx = i - 1;
++
++	/* Update the producer index */
++	edma_read_reg(EDMA_REG_RFD_IDX_Q(queue_id), &reg_data);
++	reg_data &= ~EDMA_RFD_PROD_IDX_BITS;
++	reg_data |= prod_idx;
++	edma_write_reg(EDMA_REG_RFD_IDX_Q(queue_id), reg_data);
++	return cleaned_count;
++}
++
++/* edma_init_desc()
++ *	update descriptor ring size, buffer and producer/consumer index
++ */
++static void edma_init_desc(struct edma_common_info *edma_cinfo)
++{
++	struct edma_rfd_desc_ring *rfd_ring;
++	struct edma_tx_desc_ring *etdr;
++	int i = 0, j = 0;
++	u32 data = 0;
++	u16 hw_cons_idx = 0;
++
++	/* Set the base address of every TPD ring. */
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++) {
++		etdr = edma_cinfo->tpd_ring[i];
++
++		/* Update descriptor ring base address */
++		edma_write_reg(EDMA_REG_TPD_BASE_ADDR_Q(i), (u32)etdr->dma);
++		edma_read_reg(EDMA_REG_TPD_IDX_Q(i), &data);
++
++		/* Calculate hardware consumer index */
++		hw_cons_idx = (data >> EDMA_TPD_CONS_IDX_SHIFT) & 0xffff;
++		etdr->sw_next_to_fill = hw_cons_idx;
++		etdr->sw_next_to_clean = hw_cons_idx;
++		data &= ~(EDMA_TPD_PROD_IDX_MASK << EDMA_TPD_PROD_IDX_SHIFT);
++		data |= hw_cons_idx;
++
++		/* update producer index */
++		edma_write_reg(EDMA_REG_TPD_IDX_Q(i), data);
++
++		/* update SW consumer index register */
++		edma_write_reg(EDMA_REG_TX_SW_CONS_IDX_Q(i), hw_cons_idx);
++
++		/* Set TPD ring size */
++		edma_write_reg(EDMA_REG_TPD_RING_SIZE,
++			       edma_cinfo->tx_ring_count &
++				    EDMA_TPD_RING_SIZE_MASK);
++	}
++
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		rfd_ring = edma_cinfo->rfd_ring[j];
++		/* Update Receive Free descriptor ring base address */
++		edma_write_reg(EDMA_REG_RFD_BASE_ADDR_Q(j),
++			(u32)(rfd_ring->dma));
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++
++	data = edma_cinfo->rx_head_buffer_len;
++	if (edma_cinfo->page_mode)
++		data = edma_cinfo->rx_page_buffer_len;
++
++	data &= EDMA_RX_BUF_SIZE_MASK;
++	data <<= EDMA_RX_BUF_SIZE_SHIFT;
++
++	/* Update RFD ring size and RX buffer size */
++	data |= (edma_cinfo->rx_ring_count & EDMA_RFD_RING_SIZE_MASK)
++		<< EDMA_RFD_RING_SIZE_SHIFT;
++
++	edma_write_reg(EDMA_REG_RX_DESC0, data);
++
++	/* Disable TX FIFO low watermark and high watermark */
++	edma_write_reg(EDMA_REG_TXF_WATER_MARK, 0);
++
++	/* Load all of base address above */
++	edma_read_reg(EDMA_REG_TX_SRAM_PART, &data);
++	data |= 1 << EDMA_LOAD_PTR_SHIFT;
++	edma_write_reg(EDMA_REG_TX_SRAM_PART, data);
++}
++
++/* edma_receive_checksum
++ *	Api to check checksum on receive packets
++ */
++static void edma_receive_checksum(struct edma_rx_return_desc *rd,
++						 struct sk_buff *skb)
++{
++	skb_checksum_none_assert(skb);
++
++	/* check the RRD IP/L4 checksum bit to see if
++	 * its set, which in turn indicates checksum
++	 * failure.
++	 */
++	if (rd->rrd6 & EDMA_RRD_CSUM_FAIL_MASK)
++		return;
++
++	skb->ip_summed = CHECKSUM_UNNECESSARY;
++}
++
++/* edma_clean_rfd()
++ *	clean up rx resourcers on error
++ */
++static void edma_clean_rfd(struct edma_rfd_desc_ring *erdr, u16 index)
++{
++	struct edma_rx_free_desc *rx_desc;
++	struct edma_sw_desc *sw_desc;
++
++	rx_desc = (&((struct edma_rx_free_desc *)(erdr->hw_desc))[index]);
++	sw_desc = &erdr->sw_desc[index];
++	if (sw_desc->skb) {
++		dev_kfree_skb_any(sw_desc->skb);
++		sw_desc->skb = NULL;
++	}
++
++	memset(rx_desc, 0, sizeof(struct edma_rx_free_desc));
++}
++
++/* edma_rx_complete_fraglist()
++ *	Complete Rx processing for fraglist skbs
++ */
++static void edma_rx_complete_stp_rstp(struct sk_buff *skb, int port_id, struct edma_rx_return_desc *rd)
++{
++	int i;
++	u32 priority;
++	u16 port_type;
++	u8 mac_addr[EDMA_ETH_HDR_LEN];
++
++	port_type = (rd->rrd1 >> EDMA_RRD_PORT_TYPE_SHIFT)
++		                & EDMA_RRD_PORT_TYPE_MASK;
++	/* if port type is 0x4, then only proceed with
++	 * other stp/rstp calculation
++	 */
++	if (port_type == EDMA_RX_ATH_HDR_RSTP_PORT_TYPE) {
++		u8 bpdu_mac[6] = {0x01, 0x80, 0xc2, 0x00, 0x00, 0x00};
++
++		/* calculate the frame priority */
++		priority = (rd->rrd1 >> EDMA_RRD_PRIORITY_SHIFT)
++			& EDMA_RRD_PRIORITY_MASK;
++
++		for (i = 0; i < EDMA_ETH_HDR_LEN; i++)
++			mac_addr[i] = skb->data[i];
++
++		/* Check if destination mac addr is bpdu addr */
++		if (!memcmp(mac_addr, bpdu_mac, 6)) {
++			/* destination mac address is BPDU
++			 * destination mac address, then add
++			 * atheros header to the packet.
++			 */
++			u16 athr_hdr = (EDMA_RX_ATH_HDR_VERSION << EDMA_RX_ATH_HDR_VERSION_SHIFT) |
++				(priority << EDMA_RX_ATH_HDR_PRIORITY_SHIFT) |
++				(EDMA_RX_ATH_HDR_RSTP_PORT_TYPE << EDMA_RX_ATH_PORT_TYPE_SHIFT) | port_id;
++			skb_push(skb, 4);
++			memcpy(skb->data, mac_addr, EDMA_ETH_HDR_LEN);
++			*(uint16_t *)&skb->data[12] = htons(edma_ath_eth_type);
++			*(uint16_t *)&skb->data[14] = htons(athr_hdr);
++		}
++	}
++}
++
++/*
++ * edma_rx_complete_fraglist()
++ *	Complete Rx processing for fraglist skbs
++ */
++static int edma_rx_complete_fraglist(struct sk_buff *skb, u16 num_rfds, u16 length, u32 sw_next_to_clean,
++					u16 *cleaned_count, struct edma_rfd_desc_ring *erdr, struct edma_common_info *edma_cinfo)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++	struct edma_hw *hw = &edma_cinfo->hw;
++	struct sk_buff *skb_temp;
++	struct edma_sw_desc *sw_desc;
++	int i;
++	u16 size_remaining;
++
++	skb->data_len = 0;
++	skb->tail += (hw->rx_head_buff_size - 16);
++	skb->len = skb->truesize = length;
++	size_remaining = length - (hw->rx_head_buff_size - 16);
++
++	/* clean-up all related sw_descs */
++	for (i = 1; i < num_rfds; i++) {
++		struct sk_buff *skb_prev;
++		sw_desc = &erdr->sw_desc[sw_next_to_clean];
++		skb_temp = sw_desc->skb;
++
++		dma_unmap_single(&pdev->dev, sw_desc->dma,
++			sw_desc->length, DMA_FROM_DEVICE);
++
++		if (size_remaining < hw->rx_head_buff_size)
++			skb_put(skb_temp, size_remaining);
++		else
++			skb_put(skb_temp, hw->rx_head_buff_size);
++
++		/*
++		 * If we are processing the first rfd, we link
++		 * skb->frag_list to the skb corresponding to the
++		 * first RFD
++		 */
++		if (i == 1)
++			skb_shinfo(skb)->frag_list = skb_temp;
++		else
++			skb_prev->next = skb_temp;
++		skb_prev = skb_temp;
++		skb_temp->next = NULL;
++
++		skb->data_len += skb_temp->len;
++		size_remaining -= skb_temp->len;
++
++		/* Increment SW index */
++		sw_next_to_clean = (sw_next_to_clean + 1) & (erdr->count - 1);
++		(*cleaned_count)++;
++	}
++
++	return sw_next_to_clean;
++}
++
++/* edma_rx_complete_paged()
++ *	Complete Rx processing for paged skbs
++ */
++static int edma_rx_complete_paged(struct sk_buff *skb, u16 num_rfds, u16 length, u32 sw_next_to_clean,
++					u16 *cleaned_count, struct edma_rfd_desc_ring *erdr, struct edma_common_info *edma_cinfo)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++	struct sk_buff *skb_temp;
++	struct edma_sw_desc *sw_desc;
++	int i;
++	u16 size_remaining;
++
++	skb_frag_t *frag = &skb_shinfo(skb)->frags[0];
++
++	/* Setup skbuff fields */
++	skb->len = length;
++
++	if (likely(num_rfds <= 1)) {
++		skb->data_len = length;
++		skb->truesize += edma_cinfo->rx_page_buffer_len;
++		skb_fill_page_desc(skb, 0, skb_frag_page(frag),
++				16, length);
++	} else {
++		frag->size -= 16;
++		skb->data_len = frag->size;
++		skb->truesize += edma_cinfo->rx_page_buffer_len;
++		size_remaining = length - frag->size;
++
++		skb_fill_page_desc(skb, 0, skb_frag_page(frag),
++				16, frag->size);
++
++		/* clean-up all related sw_descs */
++		for (i = 1; i < num_rfds; i++) {
++			sw_desc = &erdr->sw_desc[sw_next_to_clean];
++			skb_temp = sw_desc->skb;
++			frag = &skb_shinfo(skb_temp)->frags[0];
++			dma_unmap_page(&pdev->dev, sw_desc->dma,
++				sw_desc->length, DMA_FROM_DEVICE);
++
++			if (size_remaining < edma_cinfo->rx_page_buffer_len)
++				frag->size = size_remaining;
++
++			skb_fill_page_desc(skb, i, skb_frag_page(frag),
++					0, frag->size);
++
++			skb_shinfo(skb_temp)->nr_frags = 0;
++			dev_kfree_skb_any(skb_temp);
++
++			skb->data_len += frag->size;
++			skb->truesize += edma_cinfo->rx_page_buffer_len;
++			size_remaining -= frag->size;
++
++			/* Increment SW index */
++			sw_next_to_clean = (sw_next_to_clean + 1) & (erdr->count - 1);
++			(*cleaned_count)++;
++		}
++	}
++
++	return sw_next_to_clean;
++}
++
++/*
++ * edma_rx_complete()
++ *	Main api called from the poll function to process rx packets.
++ */
++static void edma_rx_complete(struct edma_common_info *edma_cinfo,
++			    int *work_done, int work_to_do, int queue_id,
++			    struct napi_struct *napi)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++	struct edma_rfd_desc_ring *erdr = edma_cinfo->rfd_ring[queue_id];
++	struct net_device *netdev;
++	struct edma_adapter *adapter;
++	struct edma_sw_desc *sw_desc;
++	struct sk_buff *skb;
++	struct edma_rx_return_desc *rd;
++	u16 hash_type, rrd[8], cleaned_count = 0, length = 0, num_rfds = 1,
++	    sw_next_to_clean, hw_next_to_clean = 0, vlan = 0, ret_count = 0;
++	u32 data = 0;
++	u8 *vaddr;
++	int port_id, i, drop_count = 0;
++	u32 priority;
++	u16 count = erdr->count, rfd_avail;
++	u8 queue_to_rxid[8] = {0, 0, 1, 1, 2, 2, 3, 3};
++
++	sw_next_to_clean = erdr->sw_next_to_clean;
++
++	edma_read_reg(EDMA_REG_RFD_IDX_Q(queue_id), &data);
++	hw_next_to_clean = (data >> EDMA_RFD_CONS_IDX_SHIFT) &
++			   EDMA_RFD_CONS_IDX_MASK;
++
++	do {
++		while (sw_next_to_clean != hw_next_to_clean) {
++			if (!work_to_do)
++				break;
++
++			sw_desc = &erdr->sw_desc[sw_next_to_clean];
++			skb = sw_desc->skb;
++
++			/* Unmap the allocated buffer */
++			if (likely(sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_HEAD))
++				dma_unmap_single(&pdev->dev, sw_desc->dma,
++					        sw_desc->length, DMA_FROM_DEVICE);
++			else
++				dma_unmap_page(&pdev->dev, sw_desc->dma,
++					      sw_desc->length, DMA_FROM_DEVICE);
++
++			/* Get RRD */
++			if (edma_cinfo->page_mode) {
++				vaddr = kmap_atomic(skb_frag_page(&skb_shinfo(skb)->frags[0]));
++				memcpy((uint8_t *)&rrd[0], vaddr, 16);
++				rd = (struct edma_rx_return_desc *)rrd;
++				kunmap_atomic(vaddr);
++			} else {
++				rd = (struct edma_rx_return_desc *)skb->data;
++			}
++
++			/* Check if RRD is valid */
++			if (!(rd->rrd7 & EDMA_RRD_DESC_VALID)) {
++				edma_clean_rfd(erdr, sw_next_to_clean);
++				sw_next_to_clean = (sw_next_to_clean + 1) &
++						   (erdr->count - 1);
++				cleaned_count++;
++				continue;
++			}
++
++			/* Get the number of RFDs from RRD */
++			num_rfds = rd->rrd1 & EDMA_RRD_NUM_RFD_MASK;
++
++			/* Get Rx port ID from switch */
++			port_id = (rd->rrd1 >> EDMA_PORT_ID_SHIFT) & EDMA_PORT_ID_MASK;
++			if ((!port_id) || (port_id > EDMA_MAX_PORTID_SUPPORTED)) {
++				dev_err(&pdev->dev, "Invalid RRD source port bit set");
++				for (i = 0; i < num_rfds; i++) {
++					edma_clean_rfd(erdr, sw_next_to_clean);
++					sw_next_to_clean = (sw_next_to_clean + 1) & (erdr->count - 1);
++					cleaned_count++;
++				}
++				continue;
++			}
++
++			/* check if we have a sink for the data we receive.
++			 * If the interface isn't setup, we have to drop the
++			 * incoming data for now.
++			 */
++			netdev = edma_cinfo->portid_netdev_lookup_tbl[port_id];
++			if (!netdev) {
++				edma_clean_rfd(erdr, sw_next_to_clean);
++				sw_next_to_clean = (sw_next_to_clean + 1) &
++						   (erdr->count - 1);
++				cleaned_count++;
++				continue;
++			}
++			adapter = netdev_priv(netdev);
++
++			/* This code is added to handle a usecase where high
++			 * priority stream and a low priority stream are
++			 * received simultaneously on DUT. The problem occurs
++			 * if one of the  Rx rings is full and the corresponding
++			 * core is busy with other stuff. This causes ESS CPU
++			 * port to backpressure all incoming traffic including
++			 * high priority one. We monitor free descriptor count
++			 * on each CPU and whenever it reaches threshold (< 80),
++			 * we drop all low priority traffic and let only high
++			 * priotiy traffic pass through. We can hence avoid
++			 * ESS CPU port to send backpressure on high priroity
++			 * stream.
++			 */
++			priority = (rd->rrd1 >> EDMA_RRD_PRIORITY_SHIFT)
++				& EDMA_RRD_PRIORITY_MASK;
++			if (likely(!priority && !edma_cinfo->page_mode && (num_rfds <= 1))) {
++				rfd_avail = (count + sw_next_to_clean - hw_next_to_clean - 1) & (count - 1);
++				if (rfd_avail < EDMA_RFD_AVAIL_THR) {
++					sw_desc->flags = EDMA_SW_DESC_FLAG_SKB_REUSE;
++					sw_next_to_clean = (sw_next_to_clean + 1) & (erdr->count - 1);
++					adapter->stats.rx_dropped++;
++					cleaned_count++;
++					drop_count++;
++					if (drop_count == 3) {
++						work_to_do--;
++						(*work_done)++;
++						drop_count = 0;
++					}
++					if (cleaned_count == EDMA_RX_BUFFER_WRITE) {
++						/* If buffer clean count reaches 16, we replenish HW buffers. */
++						ret_count = edma_alloc_rx_buf(edma_cinfo, erdr, cleaned_count, queue_id);
++						edma_write_reg(EDMA_REG_RX_SW_CONS_IDX_Q(queue_id),
++							      sw_next_to_clean);
++						cleaned_count = ret_count;
++					}
++					continue;
++				}
++			}
++
++			work_to_do--;
++			(*work_done)++;
++
++			/* Increment SW index */
++			sw_next_to_clean = (sw_next_to_clean + 1) &
++					   (erdr->count - 1);
++
++			cleaned_count++;
++
++			/* Get the packet size and allocate buffer */
++			length = rd->rrd6 & EDMA_RRD_PKT_SIZE_MASK;
++
++			if (edma_cinfo->page_mode) {
++				/* paged skb */
++				sw_next_to_clean = edma_rx_complete_paged(skb, num_rfds, length, sw_next_to_clean, &cleaned_count, erdr, edma_cinfo);
++				if (!pskb_may_pull(skb, ETH_HLEN)) {
++					dev_kfree_skb_any(skb);
++					continue;
++				}
++			} else {
++				/* single or fraglist skb */
++
++				/* Addition of 16 bytes is required, as in the packet
++				 * first 16 bytes are rrd descriptors, so actual data
++				 * starts from an offset of 16.
++				 */
++				skb_reserve(skb, 16);
++				if (likely((num_rfds <= 1) || !edma_cinfo->fraglist_mode)) {
++					skb_put(skb, length);
++				} else {
++					sw_next_to_clean = edma_rx_complete_fraglist(skb, num_rfds, length, sw_next_to_clean, &cleaned_count, erdr, edma_cinfo);
++				}
++			}
++
++			if (edma_stp_rstp) {
++				edma_rx_complete_stp_rstp(skb, port_id, rd);
++			}
++
++			skb->protocol = eth_type_trans(skb, netdev);
++
++			/* Record Rx queue for RFS/RPS and fill flow hash from HW */
++			skb_record_rx_queue(skb, queue_to_rxid[queue_id]);
++			if (netdev->features & NETIF_F_RXHASH) {
++				hash_type = (rd->rrd5 >> EDMA_HASH_TYPE_SHIFT);
++				if ((hash_type > EDMA_HASH_TYPE_START) && (hash_type < EDMA_HASH_TYPE_END))
++					skb_set_hash(skb, rd->rrd2, PKT_HASH_TYPE_L4);
++			}
++
++#ifdef CONFIG_NF_FLOW_COOKIE
++			skb->flow_cookie = rd->rrd3 & EDMA_RRD_FLOW_COOKIE_MASK;
++#endif
++			edma_receive_checksum(rd, skb);
++
++			/* Process VLAN HW acceleration indication provided by HW */
++			if (unlikely(adapter->default_vlan_tag != rd->rrd4)) {
++				vlan = rd->rrd4;
++				if (likely(rd->rrd7 & EDMA_RRD_CVLAN))
++					__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan);
++				else if (rd->rrd1 & EDMA_RRD_SVLAN)
++					__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021AD), vlan);
++			}
++
++			/* Update rx statistics */
++			adapter->stats.rx_packets++;
++			adapter->stats.rx_bytes += length;
++
++			/* Check if we reached refill threshold */
++			if (cleaned_count == EDMA_RX_BUFFER_WRITE) {
++				ret_count = edma_alloc_rx_buf(edma_cinfo, erdr, cleaned_count, queue_id);
++				edma_write_reg(EDMA_REG_RX_SW_CONS_IDX_Q(queue_id),
++					      sw_next_to_clean);
++				cleaned_count = ret_count;
++			}
++
++			/* At this point skb should go to stack */
++			napi_gro_receive(napi, skb);
++		}
++
++		/* Check if we still have NAPI budget */
++		if (!work_to_do)
++			break;
++
++		/* Read index once again since we still have NAPI budget */
++		edma_read_reg(EDMA_REG_RFD_IDX_Q(queue_id), &data);
++		hw_next_to_clean = (data >> EDMA_RFD_CONS_IDX_SHIFT) &
++			EDMA_RFD_CONS_IDX_MASK;
++	} while (hw_next_to_clean != sw_next_to_clean);
++
++	erdr->sw_next_to_clean = sw_next_to_clean;
++
++	/* Refill here in case refill threshold wasn't reached */
++	if (likely(cleaned_count)) {
++		ret_count = edma_alloc_rx_buf(edma_cinfo, erdr, cleaned_count, queue_id);
++		if (ret_count)
++			dev_dbg(&pdev->dev, "Not all buffers was reallocated");
++		edma_write_reg(EDMA_REG_RX_SW_CONS_IDX_Q(queue_id),
++			      erdr->sw_next_to_clean);
++	}
++}
++
++/* edma_delete_rfs_filter()
++ *	Remove RFS filter from switch
++ */
++static int edma_delete_rfs_filter(struct edma_adapter *adapter,
++				 struct edma_rfs_filter_node *filter_node)
++{
++	int res = -1;
++
++	struct flow_keys *keys = &filter_node->keys;
++
++	if (likely(adapter->set_rfs_rule))
++		res = (*adapter->set_rfs_rule)(adapter->netdev,
++			flow_get_u32_src(keys), flow_get_u32_dst(keys),
++			keys->ports.src, keys->ports.dst,
++			keys->basic.ip_proto, filter_node->rq_id, 0);
++
++	return res;
++}
++
++/* edma_add_rfs_filter()
++ *	Add RFS filter to switch
++ */
++static int edma_add_rfs_filter(struct edma_adapter *adapter,
++			       struct flow_keys *keys, u16 rq,
++			       struct edma_rfs_filter_node *filter_node)
++{
++	int res = -1;
++
++	struct flow_keys *dest_keys = &filter_node->keys;
++
++	memcpy(dest_keys, &filter_node->keys, sizeof(*dest_keys));
++/*
++	dest_keys->control = keys->control;
++	dest_keys->basic = keys->basic;
++	dest_keys->addrs = keys->addrs;
++	dest_keys->ports = keys->ports;
++	dest_keys.ip_proto = keys->ip_proto;
++*/
++	/* Call callback registered by ESS driver */
++	if (likely(adapter->set_rfs_rule))
++		res = (*adapter->set_rfs_rule)(adapter->netdev, flow_get_u32_src(keys),
++		      flow_get_u32_dst(keys), keys->ports.src, keys->ports.dst,
++		      keys->basic.ip_proto, rq, 1);
++
++	return res;
++}
++
++/* edma_rfs_key_search()
++ *	Look for existing RFS entry
++ */
++static struct edma_rfs_filter_node *edma_rfs_key_search(struct hlist_head *h,
++						       struct flow_keys *key)
++{
++	struct edma_rfs_filter_node *p;
++
++	hlist_for_each_entry(p, h, node)
++		if (flow_get_u32_src(&p->keys) == flow_get_u32_src(key) &&
++		    flow_get_u32_dst(&p->keys) == flow_get_u32_dst(key) &&
++		    p->keys.ports.src == key->ports.src &&
++		    p->keys.ports.dst == key->ports.dst &&
++		    p->keys.basic.ip_proto == key->basic.ip_proto)
++			return p;
++	return NULL;
++}
++
++/* edma_initialise_rfs_flow_table()
++ * 	Initialise EDMA RFS flow table
++ */
++static void edma_initialise_rfs_flow_table(struct edma_adapter *adapter)
++{
++	int i;
++
++	spin_lock_init(&adapter->rfs.rfs_ftab_lock);
++
++	/* Initialize EDMA flow hash table */
++	for (i = 0; i < EDMA_RFS_FLOW_ENTRIES; i++)
++		INIT_HLIST_HEAD(&adapter->rfs.hlist_head[i]);
++
++	adapter->rfs.max_num_filter = EDMA_RFS_FLOW_ENTRIES;
++	adapter->rfs.filter_available = adapter->rfs.max_num_filter;
++	adapter->rfs.hashtoclean = 0;
++
++	/* Add timer to get periodic RFS updates from OS */
++	init_timer(&adapter->rfs.expire_rfs);
++	adapter->rfs.expire_rfs.function = edma_flow_may_expire;
++	adapter->rfs.expire_rfs.data = (unsigned long)adapter;
++	mod_timer(&adapter->rfs.expire_rfs, jiffies + HZ / 4);
++}
++
++/* edma_free_rfs_flow_table()
++ * 	Free EDMA RFS flow table
++ */
++static void edma_free_rfs_flow_table(struct edma_adapter *adapter)
++{
++	int i;
++
++	/* Remove sync timer */
++	del_timer_sync(&adapter->rfs.expire_rfs);
++	spin_lock_bh(&adapter->rfs.rfs_ftab_lock);
++
++	/* Free EDMA RFS table entries */
++	adapter->rfs.filter_available = 0;
++
++	/* Clean-up EDMA flow hash table */
++	for (i = 0; i < EDMA_RFS_FLOW_ENTRIES; i++) {
++		struct hlist_head *hhead;
++		struct hlist_node *tmp;
++		struct edma_rfs_filter_node *filter_node;
++		int res;
++
++		hhead = &adapter->rfs.hlist_head[i];
++		hlist_for_each_entry_safe(filter_node, tmp, hhead, node) {
++			res  = edma_delete_rfs_filter(adapter, filter_node);
++			if (res < 0)
++				dev_warn(&adapter->netdev->dev,
++					"EDMA going down but RFS entry %d not allowed to be flushed by Switch",
++				        filter_node->flow_id);
++			hlist_del(&filter_node->node);
++			kfree(filter_node);
++		}
++	}
++	spin_unlock_bh(&adapter->rfs.rfs_ftab_lock);
++}
++
++/* edma_tx_unmap_and_free()
++ *	clean TX buffer
++ */
++static inline void edma_tx_unmap_and_free(struct platform_device *pdev,
++					 struct edma_sw_desc *sw_desc)
++{
++	struct sk_buff *skb = sw_desc->skb;
++
++	if (likely((sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_HEAD) ||
++			(sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_FRAGLIST)))
++		/* unmap_single for skb head area */
++		dma_unmap_single(&pdev->dev, sw_desc->dma,
++				sw_desc->length, DMA_TO_DEVICE);
++	else if (sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_FRAG)
++		/* unmap page for paged fragments */
++		dma_unmap_page(&pdev->dev, sw_desc->dma,
++		  	      sw_desc->length, DMA_TO_DEVICE);
++
++	if (likely(sw_desc->flags & EDMA_SW_DESC_FLAG_LAST))
++		dev_kfree_skb_any(skb);
++
++	sw_desc->flags = 0;
++}
++
++/* edma_tx_complete()
++ *	Used to clean tx queues and update hardware and consumer index
++ */
++static void edma_tx_complete(struct edma_common_info *edma_cinfo, int queue_id)
++{
++	struct edma_tx_desc_ring *etdr = edma_cinfo->tpd_ring[queue_id];
++	struct edma_sw_desc *sw_desc;
++	struct platform_device *pdev = edma_cinfo->pdev;
++	int i;
++
++	u16 sw_next_to_clean = etdr->sw_next_to_clean;
++	u16 hw_next_to_clean;
++	u32 data = 0;
++
++	edma_read_reg(EDMA_REG_TPD_IDX_Q(queue_id), &data);
++	hw_next_to_clean = (data >> EDMA_TPD_CONS_IDX_SHIFT) & EDMA_TPD_CONS_IDX_MASK;
++
++	/* clean the buffer here */
++	while (sw_next_to_clean != hw_next_to_clean) {
++		sw_desc = &etdr->sw_desc[sw_next_to_clean];
++		edma_tx_unmap_and_free(pdev, sw_desc);
++		sw_next_to_clean = (sw_next_to_clean + 1) & (etdr->count - 1);
++	}
++
++	etdr->sw_next_to_clean = sw_next_to_clean;
++
++	/* update the TPD consumer index register */
++	edma_write_reg(EDMA_REG_TX_SW_CONS_IDX_Q(queue_id), sw_next_to_clean);
++
++	/* Wake the queue if queue is stopped and netdev link is up */
++	for (i = 0; i < EDMA_MAX_NETDEV_PER_QUEUE && etdr->nq[i] ; i++) {
++		if (netif_tx_queue_stopped(etdr->nq[i])) {
++			if ((etdr->netdev[i]) && netif_carrier_ok(etdr->netdev[i]))
++				netif_tx_wake_queue(etdr->nq[i]);
++		}
++	}
++}
++
++/* edma_get_tx_buffer()
++ *	Get sw_desc corresponding to the TPD
++ */
++static struct edma_sw_desc *edma_get_tx_buffer(struct edma_common_info *edma_cinfo,
++					       struct edma_tx_desc *tpd, int queue_id)
++{
++	struct edma_tx_desc_ring *etdr = edma_cinfo->tpd_ring[queue_id];
++	return &etdr->sw_desc[tpd - (struct edma_tx_desc *)etdr->hw_desc];
++}
++
++/* edma_get_next_tpd()
++ *	Return a TPD descriptor for transfer
++ */
++static struct edma_tx_desc *edma_get_next_tpd(struct edma_common_info *edma_cinfo,
++					     int queue_id)
++{
++	struct edma_tx_desc_ring *etdr = edma_cinfo->tpd_ring[queue_id];
++	u16 sw_next_to_fill = etdr->sw_next_to_fill;
++	struct edma_tx_desc *tpd_desc =
++		(&((struct edma_tx_desc *)(etdr->hw_desc))[sw_next_to_fill]);
++
++	etdr->sw_next_to_fill = (etdr->sw_next_to_fill + 1) & (etdr->count - 1);
++
++	return tpd_desc;
++}
++
++/* edma_tpd_available()
++ *	Check number of free TPDs
++ */
++static inline u16 edma_tpd_available(struct edma_common_info *edma_cinfo,
++				    int queue_id)
++{
++	struct edma_tx_desc_ring *etdr = edma_cinfo->tpd_ring[queue_id];
++
++	u16 sw_next_to_fill;
++	u16 sw_next_to_clean;
++	u16 count = 0;
++
++	sw_next_to_clean = etdr->sw_next_to_clean;
++	sw_next_to_fill = etdr->sw_next_to_fill;
++
++	if (likely(sw_next_to_clean <= sw_next_to_fill))
++		count = etdr->count;
++
++	return count + sw_next_to_clean - sw_next_to_fill - 1;
++}
++
++/* edma_tx_queue_get()
++ *	Get the starting number of  the queue
++ */
++static inline int edma_tx_queue_get(struct edma_adapter *adapter,
++				   struct sk_buff *skb, int txq_id)
++{
++	/* skb->priority is used as an index to skb priority table
++	 * and based on packet priority, correspong queue is assigned.
++	 */
++	return adapter->tx_start_offset[txq_id] + edma_skb_priority_offset(skb);
++}
++
++/* edma_tx_update_hw_idx()
++ *	update the producer index for the ring transmitted
++ */
++static void edma_tx_update_hw_idx(struct edma_common_info *edma_cinfo,
++			         struct sk_buff *skb, int queue_id)
++{
++	struct edma_tx_desc_ring *etdr = edma_cinfo->tpd_ring[queue_id];
++	u32 tpd_idx_data;
++
++	/* Read and update the producer index */
++	edma_read_reg(EDMA_REG_TPD_IDX_Q(queue_id), &tpd_idx_data);
++	tpd_idx_data &= ~EDMA_TPD_PROD_IDX_BITS;
++	tpd_idx_data |= (etdr->sw_next_to_fill & EDMA_TPD_PROD_IDX_MASK)
++		<< EDMA_TPD_PROD_IDX_SHIFT;
++
++	edma_write_reg(EDMA_REG_TPD_IDX_Q(queue_id), tpd_idx_data);
++}
++
++/* edma_rollback_tx()
++ *	Function to retrieve tx resources in case of error
++ */
++static void edma_rollback_tx(struct edma_adapter *adapter,
++			    struct edma_tx_desc *start_tpd, int queue_id)
++{
++	struct edma_tx_desc_ring *etdr = adapter->edma_cinfo->tpd_ring[queue_id];
++	struct edma_sw_desc *sw_desc;
++	struct edma_tx_desc *tpd = NULL;
++	u16 start_index, index;
++
++	start_index = start_tpd - (struct edma_tx_desc *)(etdr->hw_desc);
++
++	index = start_index;
++	while (index != etdr->sw_next_to_fill) {
++		tpd = (&((struct edma_tx_desc *)(etdr->hw_desc))[index]);
++		sw_desc = &etdr->sw_desc[index];
++		edma_tx_unmap_and_free(adapter->pdev, sw_desc);
++		memset(tpd, 0, sizeof(struct edma_tx_desc));
++		if (++index == etdr->count)
++			index = 0;
++	}
++	etdr->sw_next_to_fill = start_index;
++}
++
++/* edma_tx_map_and_fill()
++ *	gets called from edma_xmit_frame
++ *
++ * This is where the dma of the buffer to be transmitted
++ * gets mapped
++ */
++static int edma_tx_map_and_fill(struct edma_common_info *edma_cinfo,
++			       struct edma_adapter *adapter, struct sk_buff *skb, int queue_id,
++			       unsigned int flags_transmit, u16 from_cpu, u16 dp_bitmap,
++			       bool packet_is_rstp, int nr_frags)
++{
++	struct edma_sw_desc *sw_desc = NULL;
++	struct platform_device *pdev = edma_cinfo->pdev;
++	struct edma_tx_desc *tpd = NULL, *start_tpd = NULL;
++	struct sk_buff *iter_skb;
++	int i = 0;
++	u32 word1 = 0, word3 = 0, lso_word1 = 0, svlan_tag = 0;
++	u16 buf_len, lso_desc_len = 0;
++
++	/* It should either be a nr_frags skb or fraglist skb but not both */
++	BUG_ON(nr_frags && skb_has_frag_list(skb));
++
++	if (skb_is_gso(skb)) {
++		/* TODO: What additional checks need to be performed here */
++		if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
++			lso_word1 |= EDMA_TPD_IPV4_EN;
++			ip_hdr(skb)->check = 0;
++			tcp_hdr(skb)->check = ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
++				ip_hdr(skb)->daddr, 0, IPPROTO_TCP, 0);
++		} else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
++			lso_word1 |= EDMA_TPD_LSO_V2_EN;
++			ipv6_hdr(skb)->payload_len = 0;
++			tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
++				&ipv6_hdr(skb)->daddr, 0, IPPROTO_TCP, 0);
++		} else
++			return -EINVAL;
++
++		lso_word1 |= EDMA_TPD_LSO_EN | ((skb_shinfo(skb)->gso_size & EDMA_TPD_MSS_MASK) << EDMA_TPD_MSS_SHIFT) |
++				(skb_transport_offset(skb) << EDMA_TPD_HDR_SHIFT);
++	} else if (flags_transmit & EDMA_HW_CHECKSUM) {
++			u8 css, cso;
++			cso = skb_checksum_start_offset(skb);
++			css = cso  + skb->csum_offset;
++
++			word1 |= (EDMA_TPD_CUSTOM_CSUM_EN);
++			word1 |= (cso >> 1) << EDMA_TPD_HDR_SHIFT;
++			word1 |= ((css >> 1) << EDMA_TPD_CUSTOM_CSUM_SHIFT);
++	}
++
++	if (skb->protocol == htons(ETH_P_PPP_SES))
++		word1 |= EDMA_TPD_PPPOE_EN;
++
++	if (flags_transmit & EDMA_VLAN_TX_TAG_INSERT_FLAG) {
++		switch(skb->vlan_proto) {
++		case htons(ETH_P_8021Q):
++			word3 |= (1 << EDMA_TX_INS_CVLAN);
++			word3 |= skb_vlan_tag_get(skb) << EDMA_TX_CVLAN_TAG_SHIFT;
++			break;
++		case htons(ETH_P_8021AD):
++			word1 |= (1 << EDMA_TX_INS_SVLAN);
++			svlan_tag = skb_vlan_tag_get(skb) << EDMA_TX_SVLAN_TAG_SHIFT;
++			break;
++		default:
++			dev_err(&pdev->dev, "no ctag or stag present\n");
++			goto vlan_tag_error;
++		}
++	} else if (flags_transmit & EDMA_VLAN_TX_TAG_INSERT_DEFAULT_FLAG) {
++		word3 |= (1 << EDMA_TX_INS_CVLAN);
++		word3 |= (adapter->default_vlan_tag) << EDMA_TX_CVLAN_TAG_SHIFT;
++	}
++
++	if (packet_is_rstp) {
++		word3 |= dp_bitmap << EDMA_TPD_PORT_BITMAP_SHIFT;
++		word3 |= from_cpu << EDMA_TPD_FROM_CPU_SHIFT;
++	} else {
++		word3 |= adapter->dp_bitmap << EDMA_TPD_PORT_BITMAP_SHIFT;
++	}
++
++	buf_len = skb_headlen(skb);
++
++	if (lso_word1) {
++		if (lso_word1 & EDMA_TPD_LSO_V2_EN) {
++
++			/* IPv6 LSOv2 descriptor */
++			start_tpd = tpd = edma_get_next_tpd(edma_cinfo, queue_id);
++			sw_desc = edma_get_tx_buffer(edma_cinfo, tpd, queue_id);
++			sw_desc->flags |= EDMA_SW_DESC_FLAG_SKB_NONE;
++
++			/* LSOv2 descriptor overrides addr field to pass length */
++			tpd->addr = cpu_to_le16(skb->len);
++			tpd->svlan_tag = svlan_tag;
++			tpd->word1 = word1 | lso_word1;
++			tpd->word3 = word3;
++		}
++
++		tpd = edma_get_next_tpd(edma_cinfo, queue_id);
++		if (!start_tpd)
++			start_tpd = tpd;
++		sw_desc = edma_get_tx_buffer(edma_cinfo, tpd, queue_id);
++
++		/* The last buffer info contain the skb address,
++		 * so skb will be freed after unmap
++		 */
++		sw_desc->length = lso_desc_len;
++		sw_desc->flags |= EDMA_SW_DESC_FLAG_SKB_HEAD;
++
++		sw_desc->dma = dma_map_single(&adapter->pdev->dev,
++					skb->data, buf_len, DMA_TO_DEVICE);
++		if (dma_mapping_error(&pdev->dev, sw_desc->dma))
++			goto dma_error;
++
++		tpd->addr = cpu_to_le32(sw_desc->dma);
++		tpd->len  = cpu_to_le16(buf_len);
++
++		tpd->svlan_tag = svlan_tag;
++		tpd->word1 = word1 | lso_word1;
++		tpd->word3 = word3;
++
++		/* The last buffer info contain the skb address,
++		 * so it will be freed after unmap
++		 */
++		sw_desc->length = lso_desc_len;
++		sw_desc->flags |= EDMA_SW_DESC_FLAG_SKB_HEAD;
++
++		buf_len = 0;
++	}
++
++	if (likely(buf_len)) {
++
++		/* TODO Do not dequeue descriptor if there is a potential error */
++		tpd = edma_get_next_tpd(edma_cinfo, queue_id);
++
++		if (!start_tpd)
++			start_tpd = tpd;
++
++		sw_desc = edma_get_tx_buffer(edma_cinfo, tpd, queue_id);
++
++		/* The last buffer info contain the skb address,
++		 * so it will be free after unmap
++		 */
++		sw_desc->length = buf_len;
++		sw_desc->flags |= EDMA_SW_DESC_FLAG_SKB_HEAD;
++		sw_desc->dma = dma_map_single(&adapter->pdev->dev,
++			skb->data, buf_len, DMA_TO_DEVICE);
++		if (dma_mapping_error(&pdev->dev, sw_desc->dma))
++			goto dma_error;
++
++		tpd->addr = cpu_to_le32(sw_desc->dma);
++		tpd->len  = cpu_to_le16(buf_len);
++
++		tpd->svlan_tag = svlan_tag;
++		tpd->word1 = word1 | lso_word1;
++		tpd->word3 = word3;
++	}
++
++	/* Walk through all paged fragments */
++	while (nr_frags--) {
++		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
++		buf_len = skb_frag_size(frag);
++		tpd = edma_get_next_tpd(edma_cinfo, queue_id);
++		sw_desc = edma_get_tx_buffer(edma_cinfo, tpd, queue_id);
++		sw_desc->length = buf_len;
++		sw_desc->flags |= EDMA_SW_DESC_FLAG_SKB_FRAG;
++
++		sw_desc->dma = skb_frag_dma_map(&pdev->dev, frag, 0, buf_len, DMA_TO_DEVICE);
++
++		if (dma_mapping_error(NULL, sw_desc->dma))
++			goto dma_error;
++
++		tpd->addr = cpu_to_le32(sw_desc->dma);
++		tpd->len  = cpu_to_le16(buf_len);
++
++		tpd->svlan_tag = svlan_tag;
++		tpd->word1 = word1 | lso_word1;
++		tpd->word3 = word3;
++		i++;
++	}
++
++	/* Walk through all fraglist skbs */
++	skb_walk_frags(skb, iter_skb) {
++		buf_len = iter_skb->len;
++		tpd = edma_get_next_tpd(edma_cinfo, queue_id);
++		sw_desc = edma_get_tx_buffer(edma_cinfo, tpd, queue_id);
++		sw_desc->length = buf_len;
++		sw_desc->dma =  dma_map_single(&adapter->pdev->dev,
++				iter_skb->data, buf_len, DMA_TO_DEVICE);
++
++		if (dma_mapping_error(NULL, sw_desc->dma))
++			goto dma_error;
++
++		tpd->addr = cpu_to_le32(sw_desc->dma);
++		tpd->len  = cpu_to_le16(buf_len);
++		tpd->svlan_tag = svlan_tag;
++		tpd->word1 = word1 | lso_word1;
++		tpd->word3 = word3;
++		sw_desc->flags |= EDMA_SW_DESC_FLAG_SKB_FRAGLIST;
++	}
++
++	if (tpd)
++		tpd->word1 |= 1 << EDMA_TPD_EOP_SHIFT;
++
++	sw_desc->skb = skb;
++	sw_desc->flags |= EDMA_SW_DESC_FLAG_LAST;
++
++	return 0;
++
++dma_error:
++	edma_rollback_tx(adapter, start_tpd, queue_id);
++	dev_err(&pdev->dev, "TX DMA map failed\n");
++vlan_tag_error:
++	return -ENOMEM;
++}
++
++/* edma_check_link()
++ *	check Link status
++ */
++static int edma_check_link(struct edma_adapter *adapter)
++{
++	struct phy_device *phydev = adapter->phydev;
++
++	if (!(adapter->poll_required))
++		return __EDMA_LINKUP;
++
++	if (phydev->link)
++		return __EDMA_LINKUP;
++
++	return __EDMA_LINKDOWN;
++}
++
++/* edma_adjust_link()
++ *	check for edma link status
++ */
++void edma_adjust_link(struct net_device *netdev)
++{
++	int status;
++	struct edma_adapter *adapter = netdev_priv(netdev);
++	struct phy_device *phydev = adapter->phydev;
++
++	if (!test_bit(__EDMA_UP, &adapter->state_flags))
++		return;
++
++	status = edma_check_link(adapter);
++
++	if (status == __EDMA_LINKUP && adapter->link_state == __EDMA_LINKDOWN) {
++		dev_info(&adapter->pdev->dev, "%s: GMAC Link is up with phy_speed=%d\n", netdev->name, phydev->speed);
++		adapter->link_state = __EDMA_LINKUP;
++		netif_carrier_on(netdev);
++		if (netif_running(netdev))
++			netif_tx_wake_all_queues(netdev);
++	} else if (status == __EDMA_LINKDOWN && adapter->link_state == __EDMA_LINKUP) {
++		dev_info(&adapter->pdev->dev, "%s: GMAC Link is down\n", netdev->name);
++		adapter->link_state = __EDMA_LINKDOWN;
++		netif_carrier_off(netdev);
++		netif_tx_stop_all_queues(netdev);
++	}
++}
++
++/* edma_get_stats()
++ *	Statistics api used to retreive the tx/rx statistics
++ */
++struct net_device_stats *edma_get_stats(struct net_device *netdev)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++
++	return &adapter->stats;
++}
++
++/* edma_xmit()
++ *	Main api to be called by the core for packet transmission
++ */
++netdev_tx_t edma_xmit(struct sk_buff *skb,
++		     struct net_device *net_dev)
++{
++	struct edma_adapter *adapter = netdev_priv(net_dev);
++	struct edma_common_info *edma_cinfo = adapter->edma_cinfo;
++	struct edma_tx_desc_ring *etdr;
++	u16 from_cpu, dp_bitmap, txq_id;
++	int ret, nr_frags = 0, num_tpds_needed = 1, queue_id;
++	unsigned int flags_transmit = 0;
++	bool packet_is_rstp = false;
++	struct netdev_queue *nq = NULL;
++
++	if (skb_shinfo(skb)->nr_frags) {
++		nr_frags = skb_shinfo(skb)->nr_frags;
++		num_tpds_needed += nr_frags;
++	} else if (skb_has_frag_list(skb)) {
++		struct sk_buff *iter_skb;
++
++		skb_walk_frags(skb, iter_skb)
++			num_tpds_needed++;
++	}
++
++	if (num_tpds_needed > EDMA_MAX_SKB_FRAGS) {
++		dev_err(&net_dev->dev,
++			"skb received with fragments %d which is more than %lu",
++			num_tpds_needed, EDMA_MAX_SKB_FRAGS);
++		dev_kfree_skb_any(skb);
++		adapter->stats.tx_errors++;
++		return NETDEV_TX_OK;
++	}
++
++	if (edma_stp_rstp) {
++		u16 ath_hdr, ath_eth_type;
++		u8 mac_addr[EDMA_ETH_HDR_LEN];
++		ath_eth_type = ntohs(*(uint16_t *)&skb->data[12]);
++		if (ath_eth_type == edma_ath_eth_type) {
++			packet_is_rstp = true;
++			ath_hdr = htons(*(uint16_t *)&skb->data[14]);
++			dp_bitmap = ath_hdr & EDMA_TX_ATH_HDR_PORT_BITMAP_MASK;
++			from_cpu = (ath_hdr & EDMA_TX_ATH_HDR_FROM_CPU_MASK) >> EDMA_TX_ATH_HDR_FROM_CPU_SHIFT;
++			memcpy(mac_addr, skb->data, EDMA_ETH_HDR_LEN);
++
++			skb_pull(skb, 4);
++
++			memcpy(skb->data, mac_addr, EDMA_ETH_HDR_LEN);
++		}
++	}
++
++	/* this will be one of the 4 TX queues exposed to linux kernel */
++	txq_id = skb_get_queue_mapping(skb);
++	queue_id = edma_tx_queue_get(adapter, skb, txq_id);
++	etdr = edma_cinfo->tpd_ring[queue_id];
++	nq = netdev_get_tx_queue(net_dev, txq_id);
++
++	local_bh_disable();
++	/* Tx is not handled in bottom half context. Hence, we need to protect
++	 * Tx from tasks and bottom half
++	 */
++
++	if (num_tpds_needed > edma_tpd_available(edma_cinfo, queue_id)) {
++		/* not enough descriptor, just stop queue */
++		netif_tx_stop_queue(nq);
++		local_bh_enable();
++		dev_dbg(&net_dev->dev, "Not enough descriptors available");
++		edma_cinfo->edma_ethstats.tx_desc_error++;
++		return NETDEV_TX_BUSY;
++	}
++
++	/* Check and mark VLAN tag offload */
++	if (skb_vlan_tag_present(skb))
++		flags_transmit |= EDMA_VLAN_TX_TAG_INSERT_FLAG;
++	else if (adapter->default_vlan_tag)
++		flags_transmit |= EDMA_VLAN_TX_TAG_INSERT_DEFAULT_FLAG;
++
++	/* Check and mark checksum offload */
++	if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
++		flags_transmit |= EDMA_HW_CHECKSUM;
++
++	/* Map and fill descriptor for Tx */
++	ret = edma_tx_map_and_fill(edma_cinfo, adapter, skb, queue_id,
++		flags_transmit, from_cpu, dp_bitmap, packet_is_rstp, nr_frags);
++	if (ret) {
++		dev_kfree_skb_any(skb);
++		adapter->stats.tx_errors++;
++		goto netdev_okay;
++	}
++
++	/* Update SW producer index */
++	edma_tx_update_hw_idx(edma_cinfo, skb, queue_id);
++
++	/* update tx statistics */
++	adapter->stats.tx_packets++;
++	adapter->stats.tx_bytes += skb->len;
++
++netdev_okay:
++	local_bh_enable();
++	return NETDEV_TX_OK;
++}
++
++/*
++ * edma_flow_may_expire()
++ * 	Timer function called periodically to delete the node
++ */
++void edma_flow_may_expire(unsigned long data)
++{
++	struct edma_adapter *adapter = (struct edma_adapter *)data;
++	int j;
++
++	spin_lock_bh(&adapter->rfs.rfs_ftab_lock);
++	for (j = 0; j < EDMA_RFS_EXPIRE_COUNT_PER_CALL; j++) {
++		struct hlist_head *hhead;
++		struct hlist_node *tmp;
++		struct edma_rfs_filter_node *n;
++		bool res;
++
++		hhead = &adapter->rfs.hlist_head[adapter->rfs.hashtoclean++];
++		hlist_for_each_entry_safe(n, tmp, hhead, node) {
++			res = rps_may_expire_flow(adapter->netdev, n->rq_id,
++					n->flow_id, n->filter_id);
++			if (res) {
++				int ret;
++				ret = edma_delete_rfs_filter(adapter, n);
++				if (ret < 0)
++					dev_dbg(&adapter->netdev->dev,
++							"RFS entry %d not allowed to be flushed by Switch",
++							n->flow_id);
++				else {
++					hlist_del(&n->node);
++					kfree(n);
++					adapter->rfs.filter_available++;
++				}
++			}
++		}
++	}
++
++	adapter->rfs.hashtoclean = adapter->rfs.hashtoclean & (EDMA_RFS_FLOW_ENTRIES - 1);
++	spin_unlock_bh(&adapter->rfs.rfs_ftab_lock);
++	mod_timer(&adapter->rfs.expire_rfs, jiffies + HZ / 4);
++}
++
++/* edma_rx_flow_steer()
++ *	Called by core to to steer the flow to CPU
++ */
++int edma_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
++		       u16 rxq, u32 flow_id)
++{
++	struct flow_keys keys;
++	struct edma_rfs_filter_node *filter_node;
++	struct edma_adapter *adapter = netdev_priv(dev);
++	u16 hash_tblid;
++	int res;
++
++	if (skb->protocol == htons(ETH_P_IPV6)) {
++		dev_err(&adapter->pdev->dev, "IPv6 not supported\n");
++		res = -EINVAL;
++		goto no_protocol_err;
++	}
++
++	/* Dissect flow parameters
++	 * We only support IPv4 + TCP/UDP
++	 */
++	res = skb_flow_dissect_flow_keys(skb, &keys, 0);
++	if (!((keys.basic.ip_proto == IPPROTO_TCP) || (keys.basic.ip_proto == IPPROTO_UDP))) {
++		res = -EPROTONOSUPPORT;
++		goto no_protocol_err;
++	}
++
++	/* Check if table entry exists */
++	hash_tblid = skb_get_hash_raw(skb) & EDMA_RFS_FLOW_ENTRIES_MASK;
++
++	spin_lock_bh(&adapter->rfs.rfs_ftab_lock);
++	filter_node = edma_rfs_key_search(&adapter->rfs.hlist_head[hash_tblid], &keys);
++
++	if (filter_node) {
++		if (rxq == filter_node->rq_id) {
++			res = -EEXIST;
++			goto out;
++		} else {
++			res = edma_delete_rfs_filter(adapter, filter_node);
++			if (res < 0)
++				dev_warn(&adapter->netdev->dev,
++						"Cannot steer flow %d to different queue",
++						filter_node->flow_id);
++			else {
++				adapter->rfs.filter_available++;
++				res = edma_add_rfs_filter(adapter, &keys, rxq, filter_node);
++				if (res < 0) {
++					dev_warn(&adapter->netdev->dev,
++							"Cannot steer flow %d to different queue",
++							filter_node->flow_id);
++				} else {
++					adapter->rfs.filter_available--;
++					filter_node->rq_id = rxq;
++					filter_node->filter_id = res;
++				}
++			}
++		}
++	} else {
++		if (adapter->rfs.filter_available == 0) {
++			res = -EBUSY;
++			goto out;
++		}
++
++		filter_node = kmalloc(sizeof(*filter_node), GFP_ATOMIC);
++		if (!filter_node) {
++			res = -ENOMEM;
++			goto out;
++		}
++
++		res = edma_add_rfs_filter(adapter, &keys, rxq, filter_node);
++		if (res < 0) {
++			kfree(filter_node);
++			goto out;
++		}
++
++		adapter->rfs.filter_available--;
++		filter_node->rq_id = rxq;
++		filter_node->filter_id = res;
++		filter_node->flow_id = flow_id;
++		filter_node->keys = keys;
++		INIT_HLIST_NODE(&filter_node->node);
++		hlist_add_head(&filter_node->node, &adapter->rfs.hlist_head[hash_tblid]);
++	}
++
++out:
++	spin_unlock_bh(&adapter->rfs.rfs_ftab_lock);
++no_protocol_err:
++	return res;
++}
++
++/* edma_register_rfs_filter()
++ *	Add RFS filter callback
++ */
++int edma_register_rfs_filter(struct net_device *netdev,
++			    set_rfs_filter_callback_t set_filter)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++
++	spin_lock_bh(&adapter->rfs.rfs_ftab_lock);
++
++	if (adapter->set_rfs_rule) {
++		spin_unlock_bh(&adapter->rfs.rfs_ftab_lock);
++		return -1;
++	}
++
++	adapter->set_rfs_rule = set_filter;
++	spin_unlock_bh(&adapter->rfs.rfs_ftab_lock);
++
++	return 0;
++}
++
++/* edma_alloc_tx_rings()
++ *	Allocate rx rings
++ */
++int edma_alloc_tx_rings(struct edma_common_info *edma_cinfo)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++	int i, err = 0;
++
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++) {
++		err = edma_alloc_tx_ring(edma_cinfo, edma_cinfo->tpd_ring[i]);
++		if (err) {
++			dev_err(&pdev->dev, "Tx Queue alloc %u failed\n", i);
++			return err;
++		}
++	}
++
++	return 0;
++}
++
++/* edma_free_tx_rings()
++ *	Free tx rings
++ */
++void edma_free_tx_rings(struct edma_common_info *edma_cinfo)
++{
++	int i;
++
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++)
++		edma_free_tx_ring(edma_cinfo, edma_cinfo->tpd_ring[i]);
++}
++
++/* edma_free_tx_resources()
++ *	Free buffers associated with tx rings
++ */
++void edma_free_tx_resources(struct edma_common_info *edma_cinfo)
++{
++	struct edma_tx_desc_ring *etdr;
++	struct edma_sw_desc *sw_desc;
++	struct platform_device *pdev = edma_cinfo->pdev;
++	int i, j;
++
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++) {
++		etdr = edma_cinfo->tpd_ring[i];
++		for (j = 0; j < EDMA_TX_RING_SIZE; j++) {
++			sw_desc = &etdr->sw_desc[j];
++			if (sw_desc->flags & (EDMA_SW_DESC_FLAG_SKB_HEAD |
++				EDMA_SW_DESC_FLAG_SKB_FRAG | EDMA_SW_DESC_FLAG_SKB_FRAGLIST))
++				edma_tx_unmap_and_free(pdev, sw_desc);
++		}
++	}
++}
++
++/* edma_alloc_rx_rings()
++ *	Allocate rx rings
++ */
++int edma_alloc_rx_rings(struct edma_common_info *edma_cinfo)
++{
++	struct platform_device *pdev = edma_cinfo->pdev;
++	int i, j, err = 0;
++
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		err = edma_alloc_rx_ring(edma_cinfo, edma_cinfo->rfd_ring[j]);
++		if (err) {
++			dev_err(&pdev->dev, "Rx Queue alloc%u failed\n", i);
++			return err;
++		}
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++
++	return 0;
++}
++
++/* edma_free_rx_rings()
++ *	free rx rings
++ */
++void edma_free_rx_rings(struct edma_common_info *edma_cinfo)
++{
++	int i, j;
++
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		edma_free_rx_ring(edma_cinfo, edma_cinfo->rfd_ring[j]);
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++}
++
++/* edma_free_queues()
++ *	Free the queues allocaated
++ */
++void edma_free_queues(struct edma_common_info *edma_cinfo)
++{
++	int i , j;
++
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++) {
++		if (edma_cinfo->tpd_ring[i])
++			kfree(edma_cinfo->tpd_ring[i]);
++		edma_cinfo->tpd_ring[i] = NULL;
++	}
++
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		if (edma_cinfo->rfd_ring[j])
++			kfree(edma_cinfo->rfd_ring[j]);
++		edma_cinfo->rfd_ring[j] = NULL;
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++
++	edma_cinfo->num_rx_queues = 0;
++	edma_cinfo->num_tx_queues = 0;
++
++	return;
++}
++
++/* edma_free_rx_resources()
++ *	Free buffers associated with tx rings
++ */
++void edma_free_rx_resources(struct edma_common_info *edma_cinfo)
++{
++        struct edma_rfd_desc_ring *erdr;
++	struct edma_sw_desc *sw_desc;
++	struct platform_device *pdev = edma_cinfo->pdev;
++	int i, j, k;
++
++	for (i = 0, k = 0; i < edma_cinfo->num_rx_queues; i++) {
++		erdr = edma_cinfo->rfd_ring[k];
++		for (j = 0; j < EDMA_RX_RING_SIZE; j++) {
++			sw_desc = &erdr->sw_desc[j];
++			if (likely(sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_HEAD)) {
++				dma_unmap_single(&pdev->dev, sw_desc->dma,
++					sw_desc->length, DMA_FROM_DEVICE);
++				edma_clean_rfd(erdr, j);
++			} else if ((sw_desc->flags & EDMA_SW_DESC_FLAG_SKB_FRAG)) {
++				dma_unmap_page(&pdev->dev, sw_desc->dma,
++					sw_desc->length, DMA_FROM_DEVICE);
++				edma_clean_rfd(erdr, j);
++			}
++		}
++		k += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++
++	}
++}
++
++/* edma_alloc_queues_tx()
++ *	Allocate memory for all rings
++ */
++int edma_alloc_queues_tx(struct edma_common_info *edma_cinfo)
++{
++	int i;
++
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++) {
++		struct edma_tx_desc_ring *etdr;
++		etdr = kzalloc(sizeof(struct edma_tx_desc_ring), GFP_KERNEL);
++		if (!etdr)
++			goto err;
++		etdr->count = edma_cinfo->tx_ring_count;
++		edma_cinfo->tpd_ring[i] = etdr;
++	}
++
++	return 0;
++err:
++	edma_free_queues(edma_cinfo);
++	return -1;
++}
++
++/* edma_alloc_queues_rx()
++ *	Allocate memory for all rings
++ */
++int edma_alloc_queues_rx(struct edma_common_info *edma_cinfo)
++{
++	int i, j;
++
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		struct edma_rfd_desc_ring *rfd_ring;
++		rfd_ring = kzalloc(sizeof(struct edma_rfd_desc_ring),
++				GFP_KERNEL);
++		if (!rfd_ring)
++			goto err;
++		rfd_ring->count = edma_cinfo->rx_ring_count;
++		edma_cinfo->rfd_ring[j] = rfd_ring;
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++	return 0;
++err:
++	edma_free_queues(edma_cinfo);
++	return -1;
++}
++
++/* edma_clear_irq_status()
++ *	Clear interrupt status
++ */
++void edma_clear_irq_status()
++{
++	edma_write_reg(EDMA_REG_RX_ISR, 0xff);
++	edma_write_reg(EDMA_REG_TX_ISR, 0xffff);
++	edma_write_reg(EDMA_REG_MISC_ISR, 0x1fff);
++	edma_write_reg(EDMA_REG_WOL_ISR, 0x1);
++};
++
++/* edma_configure()
++ *	Configure skb, edma interrupts and control register.
++ */
++int edma_configure(struct edma_common_info *edma_cinfo)
++{
++	struct edma_hw *hw = &edma_cinfo->hw;
++	u32 intr_modrt_data;
++	u32 intr_ctrl_data = 0;
++	int i, j, ret_count;
++
++	edma_read_reg(EDMA_REG_INTR_CTRL, &intr_ctrl_data);
++	intr_ctrl_data &= ~(1 << EDMA_INTR_SW_IDX_W_TYP_SHIFT);
++	intr_ctrl_data |= hw->intr_sw_idx_w << EDMA_INTR_SW_IDX_W_TYP_SHIFT;
++	edma_write_reg(EDMA_REG_INTR_CTRL, intr_ctrl_data);
++
++	edma_clear_irq_status();
++
++	/* Clear any WOL status */
++	edma_write_reg(EDMA_REG_WOL_CTRL, 0);
++	intr_modrt_data = (EDMA_TX_IMT << EDMA_IRQ_MODRT_TX_TIMER_SHIFT);
++	intr_modrt_data |= (EDMA_RX_IMT << EDMA_IRQ_MODRT_RX_TIMER_SHIFT);
++	edma_write_reg(EDMA_REG_IRQ_MODRT_TIMER_INIT, intr_modrt_data);
++	edma_configure_tx(edma_cinfo);
++	edma_configure_rx(edma_cinfo);
++
++	/* Allocate the RX buffer */
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		struct edma_rfd_desc_ring *ring = edma_cinfo->rfd_ring[j];
++		ret_count = edma_alloc_rx_buf(edma_cinfo, ring, ring->count, j);
++		if (ret_count) {
++			dev_dbg(&edma_cinfo->pdev->dev, "not all rx buffers allocated\n");
++		}
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++
++	/* Configure descriptor Ring */
++	edma_init_desc(edma_cinfo);
++	return 0;
++}
++
++/* edma_irq_enable()
++ *	Enable default interrupt generation settings
++ */
++void edma_irq_enable(struct edma_common_info *edma_cinfo)
++{
++	struct edma_hw *hw = &edma_cinfo->hw;
++	int i, j;
++
++	edma_write_reg(EDMA_REG_RX_ISR, 0xff);
++	for (i = 0, j = 0; i < edma_cinfo->num_rx_queues; i++) {
++		edma_write_reg(EDMA_REG_RX_INT_MASK_Q(j), hw->rx_intr_mask);
++		j += ((edma_cinfo->num_rx_queues == 4) ? 2 : 1);
++	}
++	edma_write_reg(EDMA_REG_TX_ISR, 0xffff);
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++)
++		edma_write_reg(EDMA_REG_TX_INT_MASK_Q(i), hw->tx_intr_mask);
++}
++
++/* edma_irq_disable()
++ *	Disable Interrupt
++ */
++void edma_irq_disable(struct edma_common_info *edma_cinfo)
++{
++	int i;
++
++	for (i = 0; i < EDMA_MAX_RECEIVE_QUEUE; i++)
++		edma_write_reg(EDMA_REG_RX_INT_MASK_Q(i), 0x0);
++
++	for (i = 0; i < EDMA_MAX_TRANSMIT_QUEUE; i++)
++		edma_write_reg(EDMA_REG_TX_INT_MASK_Q(i), 0x0);
++	edma_write_reg(EDMA_REG_MISC_IMR, 0);
++	edma_write_reg(EDMA_REG_WOL_IMR, 0);
++}
++
++/* edma_free_irqs()
++ *	Free All IRQs
++ */
++void edma_free_irqs(struct edma_adapter *adapter)
++{
++	struct edma_common_info *edma_cinfo = adapter->edma_cinfo;
++	int i, j;
++	int k = ((edma_cinfo->num_rx_queues == 4) ? 1 : 2);
++
++	for (i = 0; i < CONFIG_NR_CPUS; i++) {
++		for (j = edma_cinfo->edma_percpu_info[i].tx_start; j < (edma_cinfo->edma_percpu_info[i].tx_start + 4); j++)
++			free_irq(edma_cinfo->tx_irq[j], &edma_cinfo->edma_percpu_info[i]);
++
++		for (j = edma_cinfo->edma_percpu_info[i].rx_start; j < (edma_cinfo->edma_percpu_info[i].rx_start + k); j++)
++			free_irq(edma_cinfo->rx_irq[j], &edma_cinfo->edma_percpu_info[i]);
++	}
++}
++
++/* edma_enable_rx_ctrl()
++ *	Enable RX queue control
++ */
++void edma_enable_rx_ctrl(struct edma_hw *hw)
++{
++	u32 data;
++
++	edma_read_reg(EDMA_REG_RXQ_CTRL, &data);
++	data |= EDMA_RXQ_CTRL_EN;
++	edma_write_reg(EDMA_REG_RXQ_CTRL, data);
++}
++
++
++/* edma_enable_tx_ctrl()
++ *	Enable TX queue control
++ */
++void edma_enable_tx_ctrl(struct edma_hw *hw)
++{
++	u32 data;
++
++	edma_read_reg(EDMA_REG_TXQ_CTRL, &data);
++	data |= EDMA_TXQ_CTRL_TXQ_EN;
++	edma_write_reg(EDMA_REG_TXQ_CTRL, data);
++}
++
++/* edma_stop_rx_tx()
++ *	Disable RX/TQ Queue control
++ */
++void edma_stop_rx_tx(struct edma_hw *hw)
++{
++	u32 data;
++
++	edma_read_reg(EDMA_REG_RXQ_CTRL, &data);
++	data &= ~EDMA_RXQ_CTRL_EN;
++	edma_write_reg(EDMA_REG_RXQ_CTRL, data);
++	edma_read_reg(EDMA_REG_TXQ_CTRL, &data);
++	data &= ~EDMA_TXQ_CTRL_TXQ_EN;
++	edma_write_reg(EDMA_REG_TXQ_CTRL, data);
++}
++
++/* edma_reset()
++ *	Reset the EDMA
++ */
++int edma_reset(struct edma_common_info *edma_cinfo)
++{
++	struct edma_hw *hw = &edma_cinfo->hw;
++
++	edma_irq_disable(edma_cinfo);
++
++	edma_clear_irq_status();
++
++	edma_stop_rx_tx(hw);
++
++	return 0;
++}
++
++/* edma_fill_netdev()
++ * 	Fill netdev for each etdr
++ */
++int edma_fill_netdev(struct edma_common_info *edma_cinfo, int queue_id,
++		    int dev, int txq_id)
++{
++	struct edma_tx_desc_ring *etdr;
++	int i = 0;
++
++	etdr = edma_cinfo->tpd_ring[queue_id];
++
++	while (etdr->netdev[i])
++		i++;
++
++	if (i >= EDMA_MAX_NETDEV_PER_QUEUE)
++		return -1;
++
++	/* Populate the netdev associated with the tpd ring */
++	etdr->netdev[i] = edma_netdev[dev];
++	etdr->nq[i] = netdev_get_tx_queue(edma_netdev[dev], txq_id);
++
++	return 0;
++}
++
++/* edma_set_mac()
++ *	Change the Ethernet Address of the NIC
++ */
++int edma_set_mac_addr(struct net_device *netdev, void *p)
++{
++	struct sockaddr *addr = p;
++
++	if (!is_valid_ether_addr(addr->sa_data))
++		return -EINVAL;
++
++	if (netif_running(netdev))
++		return -EBUSY;
++
++	memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
++	return 0;
++}
++
++/* edma_set_stp_rstp()
++ *	set stp/rstp
++ */
++void edma_set_stp_rstp(bool rstp)
++{
++	edma_stp_rstp = rstp;
++}
++
++/* edma_assign_ath_hdr_type()
++ *	assign atheros header eth type
++ */
++void edma_assign_ath_hdr_type(int eth_type)
++{
++	edma_ath_eth_type = eth_type & EDMA_ETH_TYPE_MASK;
++}
++
++/* edma_get_default_vlan_tag()
++ *	Used by other modules to get the default vlan tag
++ */
++int edma_get_default_vlan_tag(struct net_device *netdev)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++
++	if (adapter->default_vlan_tag)
++		return adapter->default_vlan_tag;
++
++	return 0;
++}
++
++/* edma_open()
++ *	gets called when netdevice is up, start the queue.
++ */
++int edma_open(struct net_device *netdev)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++	struct platform_device *pdev = adapter->edma_cinfo->pdev;
++
++	netif_tx_start_all_queues(netdev);
++	edma_initialise_rfs_flow_table(adapter);
++	set_bit(__EDMA_UP, &adapter->state_flags);
++
++	/* if Link polling is enabled, in our case enabled for WAN, then
++	 * do a phy start, else always set link as UP
++	 */
++	if (adapter->poll_required) {
++		if (!IS_ERR(adapter->phydev)) {
++			phy_start(adapter->phydev);
++			phy_start_aneg(adapter->phydev);
++			adapter->link_state = __EDMA_LINKDOWN;
++		} else {
++			dev_dbg(&pdev->dev, "Invalid PHY device for a link polled interface\n");
++		}
++	} else {
++		adapter->link_state = __EDMA_LINKUP;
++		netif_carrier_on(netdev);
++	}
++
++	return 0;
++}
++
++
++/* edma_close()
++ *	gets called when netdevice is down, stops the queue.
++ */
++int edma_close(struct net_device *netdev)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++
++	edma_free_rfs_flow_table(adapter);
++	netif_carrier_off(netdev);
++	netif_tx_stop_all_queues(netdev);
++
++	if (adapter->poll_required) {
++		if (!IS_ERR(adapter->phydev))
++			phy_stop(adapter->phydev);
++	}
++
++	adapter->link_state = __EDMA_LINKDOWN;
++
++	/* Set GMAC state to UP before link state is checked
++	 */
++	clear_bit(__EDMA_UP, &adapter->state_flags);
++
++	return 0;
++}
++
++/* edma_poll
++ *	polling function that gets called when the napi gets scheduled.
++ *
++ * Main sequence of task performed in this api
++ * is clear irq status -> clear_tx_irq -> clean_rx_irq->
++ * enable interrupts.
++ */
++int edma_poll(struct napi_struct *napi, int budget)
++{
++	struct edma_per_cpu_queues_info *edma_percpu_info = container_of(napi,
++		struct edma_per_cpu_queues_info, napi);
++	struct edma_common_info *edma_cinfo = edma_percpu_info->edma_cinfo;
++	u32 reg_data;
++	u32 shadow_rx_status, shadow_tx_status;
++	int queue_id;
++	int i, work_done = 0;
++
++	/* Store the Rx/Tx status by ANDing it with
++	 * appropriate CPU RX?TX mask
++	 */
++	edma_read_reg(EDMA_REG_RX_ISR, &reg_data);
++	edma_percpu_info->rx_status |= reg_data & edma_percpu_info->rx_mask;
++	shadow_rx_status = edma_percpu_info->rx_status;
++	edma_read_reg(EDMA_REG_TX_ISR, &reg_data);
++	edma_percpu_info->tx_status |= reg_data & edma_percpu_info->tx_mask;
++	shadow_tx_status = edma_percpu_info->tx_status;
++
++	/* Every core will have a start, which will be computed
++	 * in probe and stored in edma_percpu_info->tx_start variable.
++	 * We will shift the status bit by tx_start to obtain
++	 * status bits for the core on which the current processing
++	 * is happening. Since, there are 4 tx queues per core,
++	 * we will run the loop till we get the correct queue to clear.
++	 */
++	while (edma_percpu_info->tx_status) {
++		queue_id = ffs(edma_percpu_info->tx_status) - 1;
++		edma_tx_complete(edma_cinfo, queue_id);
++		edma_percpu_info->tx_status &= ~(1 << queue_id);
++	}
++
++	/* Every core will have a start, which will be computed
++	 * in probe and stored in edma_percpu_info->tx_start variable.
++	 * We will shift the status bit by tx_start to obtain
++	 * status bits for the core on which the current processing
++	 * is happening. Since, there are 4 tx queues per core, we
++	 * will run the loop till we get the correct queue to clear.
++	 */
++	while (edma_percpu_info->rx_status) {
++		queue_id = ffs(edma_percpu_info->rx_status) - 1;
++		edma_rx_complete(edma_cinfo, &work_done,
++			        budget, queue_id, napi);
++
++		if (likely(work_done < budget))
++			edma_percpu_info->rx_status &= ~(1 << queue_id);
++		else
++			break;
++	}
++
++	/* Clear the status register, to avoid the interrupts to
++	 * reoccur.This clearing of interrupt status register is
++	 * done here as writing to status register only takes place
++	 * once the  producer/consumer index has been updated to
++	 * reflect that the packet transmission/reception went fine.
++	 */
++	edma_write_reg(EDMA_REG_RX_ISR, shadow_rx_status);
++	edma_write_reg(EDMA_REG_TX_ISR, shadow_tx_status);
++
++	/* If budget not fully consumed, exit the polling mode */
++	if (likely(work_done < budget)) {
++		napi_complete(napi);
++
++		/* re-enable the interrupts */
++		for (i = 0; i < edma_cinfo->num_rxq_per_core; i++)
++			edma_write_reg(EDMA_REG_RX_INT_MASK_Q(edma_percpu_info->rx_start + i), 0x1);
++		for (i = 0; i < edma_cinfo->num_txq_per_core; i++)
++			edma_write_reg(EDMA_REG_TX_INT_MASK_Q(edma_percpu_info->tx_start + i), 0x1);
++	}
++
++	return work_done;
++}
++
++/* edma interrupt()
++ *	interrupt handler
++ */
++irqreturn_t edma_interrupt(int irq, void *dev)
++{
++	struct edma_per_cpu_queues_info *edma_percpu_info = (struct edma_per_cpu_queues_info *) dev;
++	struct edma_common_info *edma_cinfo = edma_percpu_info->edma_cinfo;
++	int i;
++
++	/* Unmask the TX/RX interrupt register */
++	for (i = 0; i < edma_cinfo->num_rxq_per_core; i++)
++		edma_write_reg(EDMA_REG_RX_INT_MASK_Q(edma_percpu_info->rx_start + i), 0x0);
++
++	for (i = 0; i < edma_cinfo->num_txq_per_core; i++)
++		edma_write_reg(EDMA_REG_TX_INT_MASK_Q(edma_percpu_info->tx_start + i), 0x0);
++
++	napi_schedule(&edma_percpu_info->napi);
++
++	return IRQ_HANDLED;
++}
+--- /dev/null
++++ b/drivers/net/ethernet/qualcomm/essedma/edma.h
+@@ -0,0 +1,446 @@
++/*
++ * Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _EDMA_H_
++#define _EDMA_H_
++
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/types.h>
++#include <linux/errno.h>
++#include <linux/module.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/skbuff.h>
++#include <linux/io.h>
++#include <linux/vmalloc.h>
++#include <linux/pagemap.h>
++#include <linux/smp.h>
++#include <linux/platform_device.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/kernel.h>
++#include <linux/device.h>
++#include <linux/sysctl.h>
++#include <linux/phy.h>
++#include <linux/of_net.h>
++#include <net/checksum.h>
++#include <net/ip6_checksum.h>
++#include <asm-generic/bug.h>
++#include "ess_edma.h"
++
++#define EDMA_CPU_CORES_SUPPORTED 4
++#define EDMA_MAX_PORTID_SUPPORTED 5
++#define EDMA_MAX_VLAN_SUPPORTED  EDMA_MAX_PORTID_SUPPORTED
++#define EDMA_MAX_PORTID_BITMAP_INDEX (EDMA_MAX_PORTID_SUPPORTED + 1)
++#define EDMA_MAX_PORTID_BITMAP_SUPPORTED 0x1f	/* 0001_1111 = 0x1f */
++#define EDMA_MAX_NETDEV_PER_QUEUE 4 /* 3 Netdev per queue, 1 space for indexing */
++
++#define EDMA_MAX_RECEIVE_QUEUE 8
++#define EDMA_MAX_TRANSMIT_QUEUE 16
++
++/* WAN/LAN adapter number */
++#define EDMA_WAN 0
++#define EDMA_LAN 1
++
++/* VLAN tag */
++#define EDMA_LAN_DEFAULT_VLAN 1
++#define EDMA_WAN_DEFAULT_VLAN 2
++
++#define EDMA_DEFAULT_GROUP1_VLAN 1
++#define EDMA_DEFAULT_GROUP2_VLAN 2
++#define EDMA_DEFAULT_GROUP3_VLAN 3
++#define EDMA_DEFAULT_GROUP4_VLAN 4
++#define EDMA_DEFAULT_GROUP5_VLAN 5
++
++/* Queues exposed to linux kernel */
++#define EDMA_NETDEV_TX_QUEUE 4
++#define EDMA_NETDEV_RX_QUEUE 4
++
++/* Number of queues per core */
++#define EDMA_NUM_TXQ_PER_CORE 4
++#define EDMA_NUM_RXQ_PER_CORE 2
++
++#define EDMA_TPD_EOP_SHIFT 31
++
++#define EDMA_PORT_ID_SHIFT 12
++#define EDMA_PORT_ID_MASK 0x7
++
++/* tpd word 3 bit 18-28 */
++#define EDMA_TPD_PORT_BITMAP_SHIFT 18
++
++#define EDMA_TPD_FROM_CPU_SHIFT 25
++
++#define EDMA_FROM_CPU_MASK 0x80
++#define EDMA_SKB_PRIORITY_MASK 0x38
++
++/* TX/RX descriptor ring count */
++/* should be a power of 2 */
++#define EDMA_RX_RING_SIZE 128
++#define EDMA_TX_RING_SIZE 128
++
++/* Flags used in paged/non paged mode */
++#define EDMA_RX_HEAD_BUFF_SIZE_JUMBO 256
++#define EDMA_RX_HEAD_BUFF_SIZE 1540
++
++/* MAX frame size supported by switch */
++#define EDMA_MAX_JUMBO_FRAME_SIZE 9216
++
++/* Configurations */
++#define EDMA_INTR_CLEAR_TYPE 0
++#define EDMA_INTR_SW_IDX_W_TYPE 0
++#define EDMA_FIFO_THRESH_TYPE 0
++#define EDMA_RSS_TYPE 0
++#define EDMA_RX_IMT 0x0020
++#define EDMA_TX_IMT 0x0050
++#define EDMA_TPD_BURST 5
++#define EDMA_TXF_BURST 0x100
++#define EDMA_RFD_BURST 8
++#define EDMA_RFD_THR 16
++#define EDMA_RFD_LTHR 0
++
++/* RX/TX per CPU based mask/shift */
++#define EDMA_TX_PER_CPU_MASK 0xF
++#define EDMA_RX_PER_CPU_MASK 0x3
++#define EDMA_TX_PER_CPU_MASK_SHIFT 0x2
++#define EDMA_RX_PER_CPU_MASK_SHIFT 0x1
++#define EDMA_TX_CPU_START_SHIFT 0x2
++#define EDMA_RX_CPU_START_SHIFT 0x1
++
++/* FLags used in transmit direction */
++#define EDMA_HW_CHECKSUM 0x00000001
++#define EDMA_VLAN_TX_TAG_INSERT_FLAG 0x00000002
++#define EDMA_VLAN_TX_TAG_INSERT_DEFAULT_FLAG 0x00000004
++
++#define EDMA_SW_DESC_FLAG_LAST 0x1
++#define EDMA_SW_DESC_FLAG_SKB_HEAD 0x2
++#define EDMA_SW_DESC_FLAG_SKB_FRAG 0x4
++#define EDMA_SW_DESC_FLAG_SKB_FRAGLIST 0x8
++#define EDMA_SW_DESC_FLAG_SKB_NONE 0x10
++#define EDMA_SW_DESC_FLAG_SKB_REUSE 0x20
++
++
++#define EDMA_MAX_SKB_FRAGS (MAX_SKB_FRAGS + 1)
++
++/* Ethtool specific list of EDMA supported features */
++#define EDMA_SUPPORTED_FEATURES (SUPPORTED_10baseT_Half \
++					| SUPPORTED_10baseT_Full \
++					| SUPPORTED_100baseT_Half \
++					| SUPPORTED_100baseT_Full \
++					| SUPPORTED_1000baseT_Full)
++
++/* Recevie side atheros Header */
++#define EDMA_RX_ATH_HDR_VERSION 0x2
++#define EDMA_RX_ATH_HDR_VERSION_SHIFT 14
++#define EDMA_RX_ATH_HDR_PRIORITY_SHIFT 11
++#define EDMA_RX_ATH_PORT_TYPE_SHIFT 6
++#define EDMA_RX_ATH_HDR_RSTP_PORT_TYPE 0x4
++
++/* Transmit side atheros Header */
++#define EDMA_TX_ATH_HDR_PORT_BITMAP_MASK 0x7F
++#define EDMA_TX_ATH_HDR_FROM_CPU_MASK 0x80
++#define EDMA_TX_ATH_HDR_FROM_CPU_SHIFT 7
++
++#define EDMA_TXQ_START_CORE0 8
++#define EDMA_TXQ_START_CORE1 12
++#define EDMA_TXQ_START_CORE2 0
++#define EDMA_TXQ_START_CORE3 4
++
++#define EDMA_TXQ_IRQ_MASK_CORE0 0x0F00
++#define EDMA_TXQ_IRQ_MASK_CORE1 0xF000
++#define EDMA_TXQ_IRQ_MASK_CORE2 0x000F
++#define EDMA_TXQ_IRQ_MASK_CORE3 0x00F0
++
++#define EDMA_ETH_HDR_LEN 12
++#define EDMA_ETH_TYPE_MASK 0xFFFF
++
++#define EDMA_RX_BUFFER_WRITE 16
++#define EDMA_RFD_AVAIL_THR 80
++
++#define EDMA_GMAC_NO_MDIO_PHY	PHY_MAX_ADDR
++
++extern int ssdk_rfs_ipct_rule_set(__be32 ip_src, __be32 ip_dst,
++				  __be16 sport, __be16 dport,
++				  uint8_t proto, u16 loadbalance, bool action);
++struct edma_ethtool_statistics {
++	u32 tx_q0_pkt;
++	u32 tx_q1_pkt;
++	u32 tx_q2_pkt;
++	u32 tx_q3_pkt;
++	u32 tx_q4_pkt;
++	u32 tx_q5_pkt;
++	u32 tx_q6_pkt;
++	u32 tx_q7_pkt;
++	u32 tx_q8_pkt;
++	u32 tx_q9_pkt;
++	u32 tx_q10_pkt;
++	u32 tx_q11_pkt;
++	u32 tx_q12_pkt;
++	u32 tx_q13_pkt;
++	u32 tx_q14_pkt;
++	u32 tx_q15_pkt;
++	u32 tx_q0_byte;
++	u32 tx_q1_byte;
++	u32 tx_q2_byte;
++	u32 tx_q3_byte;
++	u32 tx_q4_byte;
++	u32 tx_q5_byte;
++	u32 tx_q6_byte;
++	u32 tx_q7_byte;
++	u32 tx_q8_byte;
++	u32 tx_q9_byte;
++	u32 tx_q10_byte;
++	u32 tx_q11_byte;
++	u32 tx_q12_byte;
++	u32 tx_q13_byte;
++	u32 tx_q14_byte;
++	u32 tx_q15_byte;
++	u32 rx_q0_pkt;
++	u32 rx_q1_pkt;
++	u32 rx_q2_pkt;
++	u32 rx_q3_pkt;
++	u32 rx_q4_pkt;
++	u32 rx_q5_pkt;
++	u32 rx_q6_pkt;
++	u32 rx_q7_pkt;
++	u32 rx_q0_byte;
++	u32 rx_q1_byte;
++	u32 rx_q2_byte;
++	u32 rx_q3_byte;
++	u32 rx_q4_byte;
++	u32 rx_q5_byte;
++	u32 rx_q6_byte;
++	u32 rx_q7_byte;
++	u32 tx_desc_error;
++};
++
++struct edma_mdio_data {
++	struct mii_bus	*mii_bus;
++	void __iomem	*membase;
++	int phy_irq[PHY_MAX_ADDR];
++};
++
++/* EDMA LINK state */
++enum edma_link_state {
++	__EDMA_LINKUP, /* Indicate link is UP */
++	__EDMA_LINKDOWN /* Indicate link is down */
++};
++
++/* EDMA GMAC state */
++enum edma_gmac_state {
++	__EDMA_UP /* use to indicate GMAC is up */
++};
++
++/* edma transmit descriptor */
++struct edma_tx_desc {
++	__le16  len; /* full packet including CRC */
++	__le16  svlan_tag; /* vlan tag */
++	__le32  word1; /* byte 4-7 */
++	__le32  addr; /* address of buffer */
++	__le32  word3; /* byte 12 */
++};
++
++/* edma receive return descriptor */
++struct edma_rx_return_desc {
++	u16 rrd0;
++	u16 rrd1;
++	u16 rrd2;
++	u16 rrd3;
++	u16 rrd4;
++	u16 rrd5;
++	u16 rrd6;
++	u16 rrd7;
++};
++
++/* RFD descriptor */
++struct edma_rx_free_desc {
++	__le32  buffer_addr; /* buffer address */
++};
++
++/* edma hw specific data */
++struct edma_hw {
++	u32  __iomem *hw_addr; /* inner register address */
++	struct edma_adapter *adapter; /* netdevice adapter */
++	u32 rx_intr_mask; /*rx interrupt mask */
++	u32 tx_intr_mask; /* tx interrupt nask */
++	u32 misc_intr_mask; /* misc interrupt mask */
++	u32 wol_intr_mask; /* wake on lan interrupt mask */
++	bool intr_clear_type; /* interrupt clear */
++	bool intr_sw_idx_w; /* interrupt software index */
++	u32 rx_head_buff_size; /* Rx buffer size */
++	u8 rss_type; /* rss protocol type */
++};
++
++/* edma_sw_desc stores software descriptor
++ * SW descriptor has 1:1 map with HW descriptor
++ */
++struct edma_sw_desc {
++	struct sk_buff *skb;
++	dma_addr_t dma; /* dma address */
++	u16 length; /* Tx/Rx buffer length */
++	u32 flags;
++};
++
++/* per core related information */
++struct edma_per_cpu_queues_info {
++	struct napi_struct napi; /* napi associated with the core */
++	u32 tx_mask; /* tx interrupt mask */
++	u32 rx_mask; /* rx interrupt mask */
++	u32 tx_status; /* tx interrupt status */
++	u32 rx_status; /* rx interrupt status */
++	u32 tx_start; /* tx queue start */
++	u32 rx_start; /* rx queue start */
++	struct edma_common_info *edma_cinfo; /* edma common info */
++};
++
++/* edma specific common info */
++struct edma_common_info {
++	struct edma_tx_desc_ring *tpd_ring[16]; /* 16 Tx queues */
++	struct edma_rfd_desc_ring *rfd_ring[8]; /* 8 Rx queues */
++	struct platform_device *pdev; /* device structure */
++	struct net_device *netdev[EDMA_MAX_PORTID_SUPPORTED];
++	struct net_device *portid_netdev_lookup_tbl[EDMA_MAX_PORTID_BITMAP_INDEX];
++	struct ctl_table_header *edma_ctl_table_hdr;
++	int num_gmac;
++	struct edma_ethtool_statistics edma_ethstats; /* ethtool stats */
++	int num_rx_queues; /* number of rx queue */
++	u32 num_tx_queues; /* number of tx queue */
++	u32 tx_irq[16]; /* number of tx irq */
++	u32 rx_irq[8]; /* number of rx irq */
++	u32 from_cpu; /* from CPU TPD field */
++	u32 num_rxq_per_core; /* Rx queues per core */
++	u32 num_txq_per_core; /* Tx queues per core */
++	u16 tx_ring_count; /* Tx ring count */
++	u16 rx_ring_count; /* Rx ring*/
++	u16 rx_head_buffer_len; /* rx buffer length */
++	u16 rx_page_buffer_len; /* rx buffer length */
++	u32 page_mode; /* Jumbo frame supported flag */
++	u32 fraglist_mode; /* fraglist supported flag */
++	struct edma_hw hw; /* edma hw specific structure */
++	struct edma_per_cpu_queues_info edma_percpu_info[CONFIG_NR_CPUS]; /* per cpu information */
++	spinlock_t stats_lock; /* protect edma stats area for updation */
++};
++
++/* transimit packet descriptor (tpd) ring */
++struct edma_tx_desc_ring {
++	struct netdev_queue *nq[EDMA_MAX_NETDEV_PER_QUEUE]; /* Linux queue index */
++	struct net_device *netdev[EDMA_MAX_NETDEV_PER_QUEUE];
++			/* Array of netdevs associated with the tpd ring */
++	void *hw_desc; /* descriptor ring virtual address */
++	struct edma_sw_desc *sw_desc; /* buffer associated with ring */
++	int netdev_bmp; /* Bitmap for per-ring netdevs */
++	u32 size; /* descriptor ring length in bytes */
++	u16 count; /* number of descriptors in the ring */
++	dma_addr_t dma; /* descriptor ring physical address */
++	u16 sw_next_to_fill; /* next Tx descriptor to fill */
++	u16 sw_next_to_clean; /* next Tx descriptor to clean */
++};
++
++/* receive free descriptor (rfd) ring */
++struct edma_rfd_desc_ring {
++	void *hw_desc; /* descriptor ring virtual address */
++	struct edma_sw_desc *sw_desc; /* buffer associated with ring */
++	u16 size; /* bytes allocated to sw_desc */
++	u16 count; /* number of descriptors in the ring */
++	dma_addr_t dma; /* descriptor ring physical address */
++	u16 sw_next_to_fill; /* next descriptor to fill */
++	u16 sw_next_to_clean; /* next descriptor to clean */
++};
++
++/* edma_rfs_flter_node - rfs filter node in hash table */
++struct edma_rfs_filter_node {
++	struct flow_keys keys;
++	u32 flow_id; /* flow_id of filter provided by kernel */
++	u16 filter_id; /* filter id of filter returned by adaptor */
++	u16 rq_id; /* desired rq index */
++	struct hlist_node node; /* edma rfs list node */
++};
++
++/* edma_rfs_flow_tbl - rfs flow table */
++struct edma_rfs_flow_table {
++	u16 max_num_filter; /* Maximum number of filters edma supports */
++	u16 hashtoclean; /* hash table index to clean next */
++	int filter_available; /* Number of free filters available */
++	struct hlist_head hlist_head[EDMA_RFS_FLOW_ENTRIES];
++	spinlock_t rfs_ftab_lock;
++	struct timer_list expire_rfs; /* timer function for edma_rps_may_expire_flow */
++};
++
++/* EDMA net device structure */
++struct edma_adapter {
++	struct net_device *netdev; /* netdevice */
++	struct platform_device *pdev; /* platform device */
++	struct edma_common_info *edma_cinfo; /* edma common info */
++	struct phy_device *phydev; /* Phy device */
++	struct edma_rfs_flow_table rfs; /* edma rfs flow table */
++	struct net_device_stats stats; /* netdev statistics */
++	set_rfs_filter_callback_t set_rfs_rule;
++	u32 flags;/* status flags */
++	unsigned long state_flags; /* GMAC up/down flags */
++	u32 forced_speed; /* link force speed */
++	u32 forced_duplex; /* link force duplex */
++	u32 link_state; /* phy link state */
++	u32 phy_mdio_addr; /* PHY device address on MII interface */
++	u32 poll_required; /* check if link polling is required */
++	u32 tx_start_offset[CONFIG_NR_CPUS]; /* tx queue start */
++	u32 default_vlan_tag; /* vlan tag */
++	u32 dp_bitmap;
++	uint8_t phy_id[MII_BUS_ID_SIZE + 3];
++};
++
++int edma_alloc_queues_tx(struct edma_common_info *edma_cinfo);
++int edma_alloc_queues_rx(struct edma_common_info *edma_cinfo);
++int edma_open(struct net_device *netdev);
++int edma_close(struct net_device *netdev);
++void edma_free_tx_resources(struct edma_common_info *edma_c_info);
++void edma_free_rx_resources(struct edma_common_info *edma_c_info);
++int edma_alloc_tx_rings(struct edma_common_info *edma_cinfo);
++int edma_alloc_rx_rings(struct edma_common_info *edma_cinfo);
++void edma_free_tx_rings(struct edma_common_info *edma_cinfo);
++void edma_free_rx_rings(struct edma_common_info *edma_cinfo);
++void edma_free_queues(struct edma_common_info *edma_cinfo);
++void edma_irq_disable(struct edma_common_info *edma_cinfo);
++int edma_reset(struct edma_common_info *edma_cinfo);
++int edma_poll(struct napi_struct *napi, int budget);
++netdev_tx_t edma_xmit(struct sk_buff *skb,
++		struct net_device *netdev);
++int edma_configure(struct edma_common_info *edma_cinfo);
++void edma_irq_enable(struct edma_common_info *edma_cinfo);
++void edma_enable_tx_ctrl(struct edma_hw *hw);
++void edma_enable_rx_ctrl(struct edma_hw *hw);
++void edma_stop_rx_tx(struct edma_hw *hw);
++void edma_free_irqs(struct edma_adapter *adapter);
++irqreturn_t edma_interrupt(int irq, void *dev);
++void edma_write_reg(u16 reg_addr, u32 reg_value);
++void edma_read_reg(u16 reg_addr, volatile u32 *reg_value);
++struct net_device_stats *edma_get_stats(struct net_device *netdev);
++int edma_set_mac_addr(struct net_device *netdev, void *p);
++int edma_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
++		u16 rxq, u32 flow_id);
++int edma_register_rfs_filter(struct net_device *netdev,
++		set_rfs_filter_callback_t set_filter);
++void edma_flow_may_expire(unsigned long data);
++void edma_set_ethtool_ops(struct net_device *netdev);
++void edma_set_stp_rstp(bool tag);
++void edma_assign_ath_hdr_type(int tag);
++int edma_get_default_vlan_tag(struct net_device *netdev);
++void edma_adjust_link(struct net_device *netdev);
++int edma_fill_netdev(struct edma_common_info *edma_cinfo, int qid, int num, int txq_id);
++void edma_read_append_stats(struct edma_common_info *edma_cinfo);
++void edma_change_tx_coalesce(int usecs);
++void edma_change_rx_coalesce(int usecs);
++void edma_get_tx_rx_coalesce(u32 *reg_val);
++void edma_clear_irq_status(void);
++#endif /* _EDMA_H_ */
+--- /dev/null
++++ b/drivers/net/ethernet/qualcomm/essedma/edma_axi.c
+@@ -0,0 +1,1220 @@
++/*
++ * Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/cpu_rmap.h>
++#include <linux/of.h>
++#include <linux/of_net.h>
++#include <linux/timer.h>
++#include "edma.h"
++#include "ess_edma.h"
++
++/* Weight round robin and virtual QID mask */
++#define EDMA_WRR_VID_SCTL_MASK 0xffff
++
++/* Weight round robin and virtual QID shift */
++#define EDMA_WRR_VID_SCTL_SHIFT 16
++
++char edma_axi_driver_name[] = "ess_edma";
++static const u32 default_msg = NETIF_MSG_DRV | NETIF_MSG_PROBE |
++	NETIF_MSG_LINK | NETIF_MSG_TIMER | NETIF_MSG_IFDOWN | NETIF_MSG_IFUP;
++
++static u32 edma_hw_addr;
++
++struct timer_list edma_stats_timer;
++
++char edma_tx_irq[16][64];
++char edma_rx_irq[8][64];
++struct net_device *edma_netdev[EDMA_MAX_PORTID_SUPPORTED];
++static u16 tx_start[4] = {EDMA_TXQ_START_CORE0, EDMA_TXQ_START_CORE1,
++			EDMA_TXQ_START_CORE2, EDMA_TXQ_START_CORE3};
++static u32 tx_mask[4] = {EDMA_TXQ_IRQ_MASK_CORE0, EDMA_TXQ_IRQ_MASK_CORE1,
++			EDMA_TXQ_IRQ_MASK_CORE2, EDMA_TXQ_IRQ_MASK_CORE3};
++
++static u32 edma_default_ltag  __read_mostly = EDMA_LAN_DEFAULT_VLAN;
++static u32 edma_default_wtag  __read_mostly = EDMA_WAN_DEFAULT_VLAN;
++static u32 edma_default_group1_vtag  __read_mostly = EDMA_DEFAULT_GROUP1_VLAN;
++static u32 edma_default_group2_vtag  __read_mostly = EDMA_DEFAULT_GROUP2_VLAN;
++static u32 edma_default_group3_vtag  __read_mostly = EDMA_DEFAULT_GROUP3_VLAN;
++static u32 edma_default_group4_vtag  __read_mostly = EDMA_DEFAULT_GROUP4_VLAN;
++static u32 edma_default_group5_vtag  __read_mostly = EDMA_DEFAULT_GROUP5_VLAN;
++static u32 edma_rss_idt_val = EDMA_RSS_IDT_VALUE;
++static u32 edma_rss_idt_idx;
++
++static int edma_weight_assigned_to_q __read_mostly;
++static int edma_queue_to_virtual_q __read_mostly;
++static bool edma_enable_rstp  __read_mostly;
++static int edma_athr_hdr_eth_type __read_mostly;
++
++static int page_mode;
++module_param(page_mode, int, 0);
++MODULE_PARM_DESC(page_mode, "enable page mode");
++
++static int overwrite_mode;
++module_param(overwrite_mode, int, 0);
++MODULE_PARM_DESC(overwrite_mode, "overwrite default page_mode setting");
++
++static int jumbo_mru = EDMA_RX_HEAD_BUFF_SIZE;
++module_param(jumbo_mru, int, 0);
++MODULE_PARM_DESC(jumbo_mru, "enable fraglist support");
++
++static int num_rxq = 4;
++module_param(num_rxq, int, 0);
++MODULE_PARM_DESC(num_rxq, "change the number of rx queues");
++
++void edma_write_reg(u16 reg_addr, u32 reg_value)
++{
++	writel(reg_value, ((void __iomem *)(edma_hw_addr + reg_addr)));
++}
++
++void edma_read_reg(u16 reg_addr, volatile u32 *reg_value)
++{
++	*reg_value = readl((void __iomem *)(edma_hw_addr + reg_addr));
++}
++
++/* edma_change_tx_coalesce()
++ *	change tx interrupt moderation timer
++ */
++void edma_change_tx_coalesce(int usecs)
++{
++	u32 reg_value;
++
++	/* Here, we right shift the value from the user by 1, this is
++	 * done because IMT resolution timer is 2usecs. 1 count
++	 * of this register corresponds to 2 usecs.
++	 */
++	edma_read_reg(EDMA_REG_IRQ_MODRT_TIMER_INIT, &reg_value);
++	reg_value = ((reg_value & 0xffff) | ((usecs >> 1) << 16));
++	edma_write_reg(EDMA_REG_IRQ_MODRT_TIMER_INIT, reg_value);
++}
++
++/* edma_change_rx_coalesce()
++ *	change rx interrupt moderation timer
++ */
++void edma_change_rx_coalesce(int usecs)
++{
++	u32 reg_value;
++
++	/* Here, we right shift the value from the user by 1, this is
++	 * done because IMT resolution timer is 2usecs. 1 count
++	 * of this register corresponds to 2 usecs.
++	 */
++	edma_read_reg(EDMA_REG_IRQ_MODRT_TIMER_INIT, &reg_value);
++	reg_value = ((reg_value & 0xffff0000) | (usecs >> 1));
++	edma_write_reg(EDMA_REG_IRQ_MODRT_TIMER_INIT, reg_value);
++}
++
++/* edma_get_tx_rx_coalesce()
++ *	Get tx/rx interrupt moderation value
++ */
++void edma_get_tx_rx_coalesce(u32 *reg_val)
++{
++	edma_read_reg(EDMA_REG_IRQ_MODRT_TIMER_INIT, reg_val);
++}
++
++void edma_read_append_stats(struct edma_common_info *edma_cinfo)
++{
++	uint32_t *p;
++	int i;
++	u32 stat;
++
++	spin_lock(&edma_cinfo->stats_lock);
++	p = (uint32_t *)&(edma_cinfo->edma_ethstats);
++
++	for (i = 0; i < EDMA_MAX_TRANSMIT_QUEUE; i++) {
++		edma_read_reg(EDMA_REG_TX_STAT_PKT_Q(i), &stat);
++		*p += stat;
++		p++;
++	}
++
++	for (i = 0; i < EDMA_MAX_TRANSMIT_QUEUE; i++) {
++		edma_read_reg(EDMA_REG_TX_STAT_BYTE_Q(i), &stat);
++		*p += stat;
++		p++;
++	}
++
++	for (i = 0; i < EDMA_MAX_RECEIVE_QUEUE; i++) {
++		edma_read_reg(EDMA_REG_RX_STAT_PKT_Q(i), &stat);
++		*p += stat;
++		p++;
++	}
++
++	for (i = 0; i < EDMA_MAX_RECEIVE_QUEUE; i++) {
++		edma_read_reg(EDMA_REG_RX_STAT_BYTE_Q(i), &stat);
++		*p += stat;
++		p++;
++	}
++
++	spin_unlock(&edma_cinfo->stats_lock);
++}
++
++static void edma_statistics_timer(unsigned long data)
++{
++	struct edma_common_info *edma_cinfo = (struct edma_common_info *)data;
++
++	edma_read_append_stats(edma_cinfo);
++
++	mod_timer(&edma_stats_timer, jiffies + 1*HZ);
++}
++
++static int edma_enable_stp_rstp(struct ctl_table *table, int write,
++				void __user *buffer, size_t *lenp,
++				loff_t *ppos)
++{
++	int ret;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++	if (write)
++		edma_set_stp_rstp(edma_enable_rstp);
++
++	return ret;
++}
++
++static int edma_ath_hdr_eth_type(struct ctl_table *table, int write,
++				 void __user *buffer, size_t *lenp,
++				 loff_t *ppos)
++{
++	int ret;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++	if (write)
++		edma_assign_ath_hdr_type(edma_athr_hdr_eth_type);
++
++	return ret;
++}
++
++static int edma_change_default_lan_vlan(struct ctl_table *table, int write,
++					void __user *buffer, size_t *lenp,
++					loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	int ret;
++
++	if (!edma_netdev[1]) {
++		pr_err("Netdevice for default_lan does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[1]);
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_ltag;
++
++	return ret;
++}
++
++static int edma_change_default_wan_vlan(struct ctl_table *table, int write,
++					void __user *buffer, size_t *lenp,
++					loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	int ret;
++
++	if (!edma_netdev[0]) {
++		pr_err("Netdevice for default_wan does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[0]);
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_wtag;
++
++	return ret;
++}
++
++static int edma_change_group1_vtag(struct ctl_table *table, int write,
++				   void __user *buffer, size_t *lenp,
++				   loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	struct edma_common_info *edma_cinfo;
++	int ret;
++
++	if (!edma_netdev[0]) {
++		pr_err("Netdevice for Group 1 does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[0]);
++	edma_cinfo = adapter->edma_cinfo;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_group1_vtag;
++
++	return ret;
++}
++
++static int edma_change_group2_vtag(struct ctl_table *table, int write,
++				   void __user *buffer, size_t *lenp,
++				   loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	struct edma_common_info *edma_cinfo;
++	int ret;
++
++	if (!edma_netdev[1]) {
++		pr_err("Netdevice for Group 2 does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[1]);
++	edma_cinfo = adapter->edma_cinfo;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_group2_vtag;
++
++	return ret;
++}
++
++static int edma_change_group3_vtag(struct ctl_table *table, int write,
++				   void __user *buffer, size_t *lenp,
++				   loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	struct edma_common_info *edma_cinfo;
++	int ret;
++
++	if (!edma_netdev[2]) {
++		pr_err("Netdevice for Group 3 does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[2]);
++	edma_cinfo = adapter->edma_cinfo;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_group3_vtag;
++
++	return ret;
++}
++
++static int edma_change_group4_vtag(struct ctl_table *table, int write,
++				   void __user *buffer, size_t *lenp,
++				   loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	struct edma_common_info *edma_cinfo;
++	int ret;
++
++	if (!edma_netdev[3]) {
++		pr_err("Netdevice for Group 4 does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[3]);
++	edma_cinfo = adapter->edma_cinfo;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_group4_vtag;
++
++	return ret;
++}
++
++static int edma_change_group5_vtag(struct ctl_table *table, int write,
++				   void __user *buffer, size_t *lenp,
++				   loff_t *ppos)
++{
++	struct edma_adapter *adapter;
++	struct edma_common_info *edma_cinfo;
++	int ret;
++
++	if (!edma_netdev[4]) {
++		pr_err("Netdevice for Group 5 does not exist\n");
++		return -1;
++	}
++
++	adapter = netdev_priv(edma_netdev[4]);
++	edma_cinfo = adapter->edma_cinfo;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++
++	if (write)
++		adapter->default_vlan_tag = edma_default_group5_vtag;
++
++	return ret;
++}
++
++static int edma_set_rss_idt_value(struct ctl_table *table, int write,
++				  void __user *buffer, size_t *lenp,
++				  loff_t *ppos)
++{
++	int ret;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++	if (write && !ret)
++		edma_write_reg(EDMA_REG_RSS_IDT(edma_rss_idt_idx),
++			       edma_rss_idt_val);
++	return ret;
++}
++
++static int edma_set_rss_idt_idx(struct ctl_table *table, int write,
++				void __user *buffer, size_t *lenp,
++				loff_t *ppos)
++{
++	int ret;
++	u32 old_value = edma_rss_idt_idx;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++	if (!write || ret)
++		return ret;
++
++	if (edma_rss_idt_idx >= EDMA_NUM_IDT) {
++		pr_err("Invalid RSS indirection table index %d\n",
++		       edma_rss_idt_idx);
++		edma_rss_idt_idx = old_value;
++		return -EINVAL;
++	}
++	return ret;
++}
++
++static int edma_weight_assigned_to_queues(struct ctl_table *table, int write,
++					  void __user *buffer, size_t *lenp,
++					  loff_t *ppos)
++{
++	int ret, queue_id, weight;
++	u32 reg_data, data, reg_addr;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++	if (write) {
++		queue_id = edma_weight_assigned_to_q & EDMA_WRR_VID_SCTL_MASK;
++		if (queue_id < 0 || queue_id > 15) {
++			pr_err("queue_id not within desired range\n");
++			return -EINVAL;
++		}
++
++		weight = edma_weight_assigned_to_q >> EDMA_WRR_VID_SCTL_SHIFT;
++		if (weight < 0 || weight > 0xF) {
++			pr_err("queue_id not within desired range\n");
++			return -EINVAL;
++		}
++
++		data = weight << EDMA_WRR_SHIFT(queue_id);
++
++		reg_addr = EDMA_REG_WRR_CTRL_Q0_Q3 + (queue_id & ~0x3);
++		edma_read_reg(reg_addr, &reg_data);
++		reg_data &= ~(1 << EDMA_WRR_SHIFT(queue_id));
++		edma_write_reg(reg_addr, data | reg_data);
++	}
++
++	return ret;
++}
++
++static int edma_queue_to_virtual_queue_map(struct ctl_table *table, int write,
++					   void __user *buffer, size_t *lenp,
++					   loff_t *ppos)
++{
++	int ret, queue_id, virtual_qid;
++	u32 reg_data, data, reg_addr;
++
++	ret = proc_dointvec(table, write, buffer, lenp, ppos);
++	if (write) {
++		queue_id = edma_queue_to_virtual_q & EDMA_WRR_VID_SCTL_MASK;
++		if (queue_id < 0 || queue_id > 15) {
++			pr_err("queue_id not within desired range\n");
++			return -EINVAL;
++		}
++
++		virtual_qid = edma_queue_to_virtual_q >>
++			EDMA_WRR_VID_SCTL_SHIFT;
++		if (virtual_qid < 0 || virtual_qid > 8) {
++			pr_err("queue_id not within desired range\n");
++			return -EINVAL;
++		}
++
++		data = virtual_qid << EDMA_VQ_ID_SHIFT(queue_id);
++
++		reg_addr = EDMA_REG_VQ_CTRL0 + (queue_id & ~0x3);
++		edma_read_reg(reg_addr, &reg_data);
++		reg_data &= ~(1 << EDMA_VQ_ID_SHIFT(queue_id));
++		edma_write_reg(reg_addr, data | reg_data);
++	}
++
++	return ret;
++}
++
++static struct ctl_table edma_table[] = {
++	{
++		.procname       = "default_lan_tag",
++		.data           = &edma_default_ltag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_default_lan_vlan
++	},
++	{
++		.procname       = "default_wan_tag",
++		.data           = &edma_default_wtag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_default_wan_vlan
++	},
++	{
++		.procname       = "weight_assigned_to_queues",
++		.data           = &edma_weight_assigned_to_q,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_weight_assigned_to_queues
++	},
++	{
++		.procname       = "queue_to_virtual_queue_map",
++		.data           = &edma_queue_to_virtual_q,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_queue_to_virtual_queue_map
++	},
++	{
++		.procname       = "enable_stp_rstp",
++		.data           = &edma_enable_rstp,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_enable_stp_rstp
++	},
++	{
++		.procname       = "athr_hdr_eth_type",
++		.data           = &edma_athr_hdr_eth_type,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_ath_hdr_eth_type
++	},
++	{
++		.procname       = "default_group1_vlan_tag",
++		.data           = &edma_default_group1_vtag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_group1_vtag
++	},
++	{
++		.procname       = "default_group2_vlan_tag",
++		.data           = &edma_default_group2_vtag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_group2_vtag
++	},
++	{
++		.procname       = "default_group3_vlan_tag",
++		.data           = &edma_default_group3_vtag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_group3_vtag
++	},
++	{
++		.procname       = "default_group4_vlan_tag",
++		.data           = &edma_default_group4_vtag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_group4_vtag
++	},
++	{
++		.procname       = "default_group5_vlan_tag",
++		.data           = &edma_default_group5_vtag,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_change_group5_vtag
++	},
++	{
++		.procname       = "edma_rss_idt_value",
++		.data           = &edma_rss_idt_val,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_set_rss_idt_value
++	},
++	{
++		.procname       = "edma_rss_idt_idx",
++		.data           = &edma_rss_idt_idx,
++		.maxlen         = sizeof(int),
++		.mode           = 0644,
++		.proc_handler   = edma_set_rss_idt_idx
++	},
++	{}
++};
++
++/* edma_axi_netdev_ops
++ *	Describe the operations supported by registered netdevices
++ *
++ * static const struct net_device_ops edma_axi_netdev_ops = {
++ *	.ndo_open               = edma_open,
++ *	.ndo_stop               = edma_close,
++ *	.ndo_start_xmit         = edma_xmit_frame,
++ *	.ndo_set_mac_address    = edma_set_mac_addr,
++ * }
++ */
++static const struct net_device_ops edma_axi_netdev_ops = {
++	.ndo_open               = edma_open,
++	.ndo_stop               = edma_close,
++	.ndo_start_xmit         = edma_xmit,
++	.ndo_set_mac_address    = edma_set_mac_addr,
++#ifdef CONFIG_RFS_ACCEL
++	.ndo_rx_flow_steer      = edma_rx_flow_steer,
++	.ndo_register_rfs_filter = edma_register_rfs_filter,
++	.ndo_get_default_vlan_tag = edma_get_default_vlan_tag,
++#endif
++	.ndo_get_stats          = edma_get_stats,
++};
++
++/* edma_axi_probe()
++ *	Initialise an adapter identified by a platform_device structure.
++ *
++ * The OS initialization, configuring of the adapter private structure,
++ * and a hardware reset occur in the probe.
++ */
++static int edma_axi_probe(struct platform_device *pdev)
++{
++	struct edma_common_info *edma_cinfo;
++	struct edma_hw *hw;
++	struct edma_adapter *adapter[EDMA_MAX_PORTID_SUPPORTED];
++	struct resource *res;
++	struct device_node *np = pdev->dev.of_node;
++	struct device_node *pnp;
++	struct device_node *mdio_node = NULL;
++	struct platform_device *mdio_plat = NULL;
++	struct mii_bus *miibus = NULL;
++	struct edma_mdio_data *mdio_data = NULL;
++	int i, j, k, err = 0;
++	int portid_bmp;
++	int idx = 0, idx_mac = 0;
++
++	if (CONFIG_NR_CPUS != EDMA_CPU_CORES_SUPPORTED) {
++		dev_err(&pdev->dev, "Invalid CPU Cores\n");
++		return -EINVAL;
++	}
++
++	if ((num_rxq != 4) && (num_rxq != 8)) {
++		dev_err(&pdev->dev, "Invalid RX queue, edma probe failed\n");
++		return -EINVAL;
++	}
++	edma_cinfo = kzalloc(sizeof(struct edma_common_info), GFP_KERNEL);
++	if (!edma_cinfo) {
++		err = -ENOMEM;
++		goto err_alloc;
++	}
++
++	edma_cinfo->pdev = pdev;
++
++	of_property_read_u32(np, "qcom,num_gmac", &edma_cinfo->num_gmac);
++	if (edma_cinfo->num_gmac > EDMA_MAX_PORTID_SUPPORTED) {
++		pr_err("Invalid DTSI Entry for qcom,num_gmac\n");
++		err = -EINVAL;
++		goto err_cinfo;
++	}
++
++	/* Initialize the netdev array before allocation
++	 * to avoid double free
++	 */
++	for (i = 0 ; i < edma_cinfo->num_gmac ; i++)
++		edma_netdev[i] = NULL;
++
++	for (i = 0 ; i < edma_cinfo->num_gmac ; i++) {
++		edma_netdev[i] = alloc_etherdev_mqs(sizeof(struct edma_adapter),
++			EDMA_NETDEV_TX_QUEUE, EDMA_NETDEV_RX_QUEUE);
++
++		if (!edma_netdev[i]) {
++			dev_err(&pdev->dev,
++				"net device alloc fails for index=%d\n", i);
++			err = -ENODEV;
++			goto err_ioremap;
++		}
++
++		SET_NETDEV_DEV(edma_netdev[i], &pdev->dev);
++		platform_set_drvdata(pdev, edma_netdev[i]);
++		edma_cinfo->netdev[i] = edma_netdev[i];
++	}
++
++	/* Fill ring details */
++	edma_cinfo->num_tx_queues = EDMA_MAX_TRANSMIT_QUEUE;
++	edma_cinfo->num_txq_per_core = (EDMA_MAX_TRANSMIT_QUEUE / 4);
++	edma_cinfo->tx_ring_count = EDMA_TX_RING_SIZE;
++
++	/* Update num rx queues based on module parameter */
++	edma_cinfo->num_rx_queues = num_rxq;
++	edma_cinfo->num_rxq_per_core = ((num_rxq == 4) ? 1 : 2);
++
++	edma_cinfo->rx_ring_count = EDMA_RX_RING_SIZE;
++
++	hw = &edma_cinfo->hw;
++
++	/* Fill HW defaults */
++	hw->tx_intr_mask = EDMA_TX_IMR_NORMAL_MASK;
++	hw->rx_intr_mask = EDMA_RX_IMR_NORMAL_MASK;
++
++	of_property_read_u32(np, "qcom,page-mode", &edma_cinfo->page_mode);
++	of_property_read_u32(np, "qcom,rx_head_buf_size",
++			     &hw->rx_head_buff_size);
++
++	if (overwrite_mode) {
++		dev_info(&pdev->dev, "page mode overwritten");
++		edma_cinfo->page_mode = page_mode;
++	}
++
++	if (jumbo_mru)
++		edma_cinfo->fraglist_mode = 1;
++
++	if (edma_cinfo->page_mode)
++		hw->rx_head_buff_size = EDMA_RX_HEAD_BUFF_SIZE_JUMBO;
++	else if (edma_cinfo->fraglist_mode)
++		hw->rx_head_buff_size = jumbo_mru;
++	else if (!hw->rx_head_buff_size)
++		hw->rx_head_buff_size = EDMA_RX_HEAD_BUFF_SIZE;
++
++	hw->misc_intr_mask = 0;
++	hw->wol_intr_mask = 0;
++
++	hw->intr_clear_type = EDMA_INTR_CLEAR_TYPE;
++	hw->intr_sw_idx_w = EDMA_INTR_SW_IDX_W_TYPE;
++
++	/* configure RSS type to the different protocol that can be
++	 * supported
++	 */
++	hw->rss_type = EDMA_RSS_TYPE_IPV4TCP | EDMA_RSS_TYPE_IPV6_TCP |
++		EDMA_RSS_TYPE_IPV4_UDP | EDMA_RSS_TYPE_IPV6UDP |
++		EDMA_RSS_TYPE_IPV4 | EDMA_RSS_TYPE_IPV6;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++
++	edma_cinfo->hw.hw_addr = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(edma_cinfo->hw.hw_addr)) {
++		err = PTR_ERR(edma_cinfo->hw.hw_addr);
++		goto err_ioremap;
++	}
++
++	edma_hw_addr = (u32)edma_cinfo->hw.hw_addr;
++
++	/* Parse tx queue interrupt number from device tree */
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++)
++		edma_cinfo->tx_irq[i] = platform_get_irq(pdev, i);
++
++	/* Parse rx queue interrupt number from device tree
++	 * Here we are setting j to point to the point where we
++	 * left tx interrupt parsing(i.e 16) and run run the loop
++	 * from 0 to 7 to parse rx interrupt number.
++	 */
++	for (i = 0, j = edma_cinfo->num_tx_queues, k = 0;
++			i < edma_cinfo->num_rx_queues; i++) {
++		edma_cinfo->rx_irq[k] = platform_get_irq(pdev, j);
++		k += ((num_rxq == 4) ?  2 : 1);
++		j += ((num_rxq == 4) ?  2 : 1);
++	}
++
++	edma_cinfo->rx_head_buffer_len = edma_cinfo->hw.rx_head_buff_size;
++	edma_cinfo->rx_page_buffer_len = PAGE_SIZE;
++
++	err = edma_alloc_queues_tx(edma_cinfo);
++	if (err) {
++		dev_err(&pdev->dev, "Allocation of TX queue failed\n");
++		goto err_tx_qinit;
++	}
++
++	err = edma_alloc_queues_rx(edma_cinfo);
++	if (err) {
++		dev_err(&pdev->dev, "Allocation of RX queue failed\n");
++		goto err_rx_qinit;
++	}
++
++	err = edma_alloc_tx_rings(edma_cinfo);
++	if (err) {
++		dev_err(&pdev->dev, "Allocation of TX resources failed\n");
++		goto err_tx_rinit;
++	}
++
++	err = edma_alloc_rx_rings(edma_cinfo);
++	if (err) {
++		dev_err(&pdev->dev, "Allocation of RX resources failed\n");
++		goto err_rx_rinit;
++	}
++
++	/* Initialize netdev and netdev bitmap for transmit descriptor rings */
++	for (i = 0; i < edma_cinfo->num_tx_queues; i++) {
++		struct edma_tx_desc_ring *etdr =  edma_cinfo->tpd_ring[i];
++		int j;
++
++		etdr->netdev_bmp = 0;
++		for (j = 0; j < EDMA_MAX_NETDEV_PER_QUEUE; j++) {
++			etdr->netdev[j] = NULL;
++			etdr->nq[j] = NULL;
++		}
++	}
++
++	if (of_property_read_bool(np, "qcom,mdio_supported")) {
++		mdio_node = of_find_compatible_node(NULL, NULL,
++						    "qcom,ipq4019-mdio");
++		if (!mdio_node) {
++			dev_err(&pdev->dev, "cannot find mdio node by phandle");
++			err = -EIO;
++			goto err_mdiobus_init_fail;
++		}
++
++		mdio_plat = of_find_device_by_node(mdio_node);
++		if (!mdio_plat) {
++			dev_err(&pdev->dev,
++				"cannot find platform device from mdio node");
++			of_node_put(mdio_node);
++			err = -EIO;
++			goto err_mdiobus_init_fail;
++		}
++
++		mdio_data = dev_get_drvdata(&mdio_plat->dev);
++		if (!mdio_data) {
++			dev_err(&pdev->dev,
++				"cannot get mii bus reference from device data");
++			of_node_put(mdio_node);
++			err = -EIO;
++			goto err_mdiobus_init_fail;
++		}
++
++		miibus = mdio_data->mii_bus;
++	}
++
++	for_each_available_child_of_node(np, pnp) {
++		const char *mac_addr;
++
++		/* this check is needed if parent and daughter dts have
++		 * different number of gmac nodes
++		 */
++		if (idx_mac == edma_cinfo->num_gmac) {
++			of_node_put(np);
++			break;
++		}
++
++		mac_addr = of_get_mac_address(pnp);
++		if (mac_addr)
++			memcpy(edma_netdev[idx_mac]->dev_addr, mac_addr, ETH_ALEN);
++
++		idx_mac++;
++	}
++
++	/* Populate the adapter structure register the netdevice */
++	for (i = 0; i < edma_cinfo->num_gmac; i++) {
++		int k, m;
++
++		adapter[i] = netdev_priv(edma_netdev[i]);
++		adapter[i]->netdev = edma_netdev[i];
++		adapter[i]->pdev = pdev;
++		for (j = 0; j < CONFIG_NR_CPUS; j++) {
++			m = i % 2;
++			adapter[i]->tx_start_offset[j] =
++				((j << EDMA_TX_CPU_START_SHIFT) + (m << 1));
++			/* Share the queues with available net-devices.
++			 * For instance , with 5 net-devices
++			 * eth0/eth2/eth4 will share q0,q1,q4,q5,q8,q9,q12,q13
++			 * and eth1/eth3 will get the remaining.
++			 */
++			for (k = adapter[i]->tx_start_offset[j]; k <
++			     (adapter[i]->tx_start_offset[j] + 2); k++) {
++				if (edma_fill_netdev(edma_cinfo, k, i, j)) {
++					pr_err("Netdev overflow Error\n");
++					goto err_register;
++				}
++			}
++		}
++
++		adapter[i]->edma_cinfo = edma_cinfo;
++		edma_netdev[i]->netdev_ops = &edma_axi_netdev_ops;
++		edma_netdev[i]->max_mtu = 9000;
++		edma_netdev[i]->features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM
++				      | NETIF_F_HW_VLAN_CTAG_TX
++				      | NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_SG |
++				      NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_GRO;
++		edma_netdev[i]->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM |
++				NETIF_F_HW_VLAN_CTAG_RX
++				| NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
++				NETIF_F_GRO;
++		edma_netdev[i]->vlan_features = NETIF_F_HW_CSUM | NETIF_F_SG |
++					   NETIF_F_TSO | NETIF_F_TSO6 |
++					   NETIF_F_GRO;
++		edma_netdev[i]->wanted_features = NETIF_F_HW_CSUM | NETIF_F_SG |
++					     NETIF_F_TSO | NETIF_F_TSO6 |
++					     NETIF_F_GRO;
++
++#ifdef CONFIG_RFS_ACCEL
++		edma_netdev[i]->features |=  NETIF_F_RXHASH | NETIF_F_NTUPLE;
++		edma_netdev[i]->hw_features |=  NETIF_F_RXHASH | NETIF_F_NTUPLE;
++		edma_netdev[i]->vlan_features |= NETIF_F_RXHASH | NETIF_F_NTUPLE;
++		edma_netdev[i]->wanted_features |= NETIF_F_RXHASH | NETIF_F_NTUPLE;
++#endif
++		edma_set_ethtool_ops(edma_netdev[i]);
++
++		/* This just fill in some default MAC address
++		 */
++		if (!is_valid_ether_addr(edma_netdev[i]->dev_addr)) {
++			random_ether_addr(edma_netdev[i]->dev_addr);
++			pr_info("EDMA using MAC@ - using");
++			pr_info("%02x:%02x:%02x:%02x:%02x:%02x\n",
++			*(edma_netdev[i]->dev_addr),
++			*(edma_netdev[i]->dev_addr + 1),
++			*(edma_netdev[i]->dev_addr + 2),
++			*(edma_netdev[i]->dev_addr + 3),
++			*(edma_netdev[i]->dev_addr + 4),
++			*(edma_netdev[i]->dev_addr + 5));
++		}
++
++		err = register_netdev(edma_netdev[i]);
++		if (err)
++			goto err_register;
++
++		/* carrier off reporting is important to
++		 * ethtool even BEFORE open
++		 */
++		netif_carrier_off(edma_netdev[i]);
++
++		/* Allocate reverse irq cpu mapping structure for
++		* receive queues
++		*/
++#ifdef CONFIG_RFS_ACCEL
++		edma_netdev[i]->rx_cpu_rmap =
++			alloc_irq_cpu_rmap(EDMA_NETDEV_RX_QUEUE);
++		if (!edma_netdev[i]->rx_cpu_rmap) {
++			err = -ENOMEM;
++			goto err_rmap_alloc_fail;
++		}
++#endif
++	}
++
++	for (i = 0; i < EDMA_MAX_PORTID_BITMAP_INDEX; i++)
++		edma_cinfo->portid_netdev_lookup_tbl[i] = NULL;
++
++	for_each_available_child_of_node(np, pnp) {
++		const uint32_t *vlan_tag = NULL;
++		int len;
++
++		/* this check is needed if parent and daughter dts have
++		 * different number of gmac nodes
++		 */
++		if (idx == edma_cinfo->num_gmac)
++			break;
++
++		/* Populate port-id to netdev lookup table */
++		vlan_tag = of_get_property(pnp, "vlan_tag", &len);
++		if (!vlan_tag) {
++			pr_err("Vlan tag parsing Failed.\n");
++			goto err_rmap_alloc_fail;
++		}
++
++		adapter[idx]->default_vlan_tag = of_read_number(vlan_tag, 1);
++		vlan_tag++;
++		portid_bmp = of_read_number(vlan_tag, 1);
++		adapter[idx]->dp_bitmap = portid_bmp;
++
++		portid_bmp = portid_bmp >> 1; /* We ignore CPU Port bit 0 */
++		while (portid_bmp) {
++			int port_bit = ffs(portid_bmp);
++
++			if (port_bit > EDMA_MAX_PORTID_SUPPORTED)
++				goto err_rmap_alloc_fail;
++			edma_cinfo->portid_netdev_lookup_tbl[port_bit] =
++				edma_netdev[idx];
++			portid_bmp &= ~(1 << (port_bit - 1));
++		}
++
++		if (!of_property_read_u32(pnp, "qcom,poll_required",
++					  &adapter[idx]->poll_required)) {
++			if (adapter[idx]->poll_required) {
++				of_property_read_u32(pnp, "qcom,phy_mdio_addr",
++						     &adapter[idx]->phy_mdio_addr);
++				of_property_read_u32(pnp, "qcom,forced_speed",
++						     &adapter[idx]->forced_speed);
++				of_property_read_u32(pnp, "qcom,forced_duplex",
++						     &adapter[idx]->forced_duplex);
++
++				/* create a phyid using MDIO bus id
++				 * and MDIO bus address
++				 */
++				snprintf(adapter[idx]->phy_id,
++					 MII_BUS_ID_SIZE + 3, PHY_ID_FMT,
++					 miibus->id,
++					 adapter[idx]->phy_mdio_addr);
++			}
++		} else {
++			adapter[idx]->poll_required = 0;
++			adapter[idx]->forced_speed = SPEED_1000;
++			adapter[idx]->forced_duplex = DUPLEX_FULL;
++		}
++
++		idx++;
++	}
++
++	edma_cinfo->edma_ctl_table_hdr = register_net_sysctl(&init_net,
++							     "net/edma",
++							     edma_table);
++	if (!edma_cinfo->edma_ctl_table_hdr) {
++		dev_err(&pdev->dev, "edma sysctl table hdr not registered\n");
++		goto err_unregister_sysctl_tbl;
++	}
++
++	/* Disable all 16 Tx and 8 rx irqs */
++	edma_irq_disable(edma_cinfo);
++
++	err = edma_reset(edma_cinfo);
++	if (err) {
++		err = -EIO;
++		goto err_reset;
++	}
++
++	/* populate per_core_info, do a napi_Add, request 16 TX irqs,
++	 * 8 RX irqs, do a napi enable
++	 */
++	for (i = 0; i < CONFIG_NR_CPUS; i++) {
++		u8 rx_start;
++
++		edma_cinfo->edma_percpu_info[i].napi.state = 0;
++
++		netif_napi_add(edma_netdev[0],
++			       &edma_cinfo->edma_percpu_info[i].napi,
++			       edma_poll, 64);
++		napi_enable(&edma_cinfo->edma_percpu_info[i].napi);
++		edma_cinfo->edma_percpu_info[i].tx_mask = tx_mask[i];
++		edma_cinfo->edma_percpu_info[i].rx_mask = EDMA_RX_PER_CPU_MASK
++				<< (i << EDMA_RX_PER_CPU_MASK_SHIFT);
++		edma_cinfo->edma_percpu_info[i].tx_start = tx_start[i];
++		edma_cinfo->edma_percpu_info[i].rx_start =
++			i << EDMA_RX_CPU_START_SHIFT;
++		rx_start = i << EDMA_RX_CPU_START_SHIFT;
++		edma_cinfo->edma_percpu_info[i].tx_status = 0;
++		edma_cinfo->edma_percpu_info[i].rx_status = 0;
++		edma_cinfo->edma_percpu_info[i].edma_cinfo = edma_cinfo;
++
++		/* Request irq per core */
++		for (j = edma_cinfo->edma_percpu_info[i].tx_start;
++		     j < tx_start[i] + 4; j++) {
++			sprintf(&edma_tx_irq[j][0], "edma_eth_tx%d", j);
++			err = request_irq(edma_cinfo->tx_irq[j],
++					  edma_interrupt,
++					  0,
++					  &edma_tx_irq[j][0],
++					  &edma_cinfo->edma_percpu_info[i]);
++			if (err)
++				goto err_reset;
++		}
++
++		for (j = edma_cinfo->edma_percpu_info[i].rx_start;
++		     j < (rx_start +
++		     ((edma_cinfo->num_rx_queues == 4) ? 1 : 2));
++		     j++) {
++			sprintf(&edma_rx_irq[j][0], "edma_eth_rx%d", j);
++			err = request_irq(edma_cinfo->rx_irq[j],
++					  edma_interrupt,
++					  0,
++					  &edma_rx_irq[j][0],
++					  &edma_cinfo->edma_percpu_info[i]);
++			if (err)
++				goto err_reset;
++		}
++
++#ifdef CONFIG_RFS_ACCEL
++		for (j = edma_cinfo->edma_percpu_info[i].rx_start;
++		     j < rx_start + 2; j += 2) {
++			err = irq_cpu_rmap_add(edma_netdev[0]->rx_cpu_rmap,
++					       edma_cinfo->rx_irq[j]);
++			if (err)
++				goto err_rmap_add_fail;
++		}
++#endif
++	}
++
++	/* Used to clear interrupt status, allocate rx buffer,
++	 * configure edma descriptors registers
++	 */
++	err = edma_configure(edma_cinfo);
++	if (err) {
++		err = -EIO;
++		goto err_configure;
++	}
++
++	/* Configure RSS indirection table.
++	 * 128 hash will be configured in the following
++	 * pattern: hash{0,1,2,3} = {Q0,Q2,Q4,Q6} respectively
++	 * and so on
++	 */
++	for (i = 0; i < EDMA_NUM_IDT; i++)
++		edma_write_reg(EDMA_REG_RSS_IDT(i), EDMA_RSS_IDT_VALUE);
++
++	/* Configure load balance mapping table.
++	 * 4 table entry will be configured according to the
++	 * following pattern: load_balance{0,1,2,3} = {Q0,Q1,Q3,Q4}
++	 * respectively.
++	 */
++	edma_write_reg(EDMA_REG_LB_RING, EDMA_LB_REG_VALUE);
++
++	/* Configure Virtual queue for Tx rings
++	 * User can also change this value runtime through
++	 * a sysctl
++	 */
++	edma_write_reg(EDMA_REG_VQ_CTRL0, EDMA_VQ_REG_VALUE);
++	edma_write_reg(EDMA_REG_VQ_CTRL1, EDMA_VQ_REG_VALUE);
++
++	/* Configure Max AXI Burst write size to 128 bytes*/
++	edma_write_reg(EDMA_REG_AXIW_CTRL_MAXWRSIZE,
++		       EDMA_AXIW_MAXWRSIZE_VALUE);
++
++	/* Enable All 16 tx and 8 rx irq mask */
++	edma_irq_enable(edma_cinfo);
++	edma_enable_tx_ctrl(&edma_cinfo->hw);
++	edma_enable_rx_ctrl(&edma_cinfo->hw);
++
++	for (i = 0; i < edma_cinfo->num_gmac; i++) {
++		if (adapter[i]->poll_required) {
++			adapter[i]->phydev =
++				phy_connect(edma_netdev[i],
++					    (const char *)adapter[i]->phy_id,
++					    &edma_adjust_link,
++					    PHY_INTERFACE_MODE_SGMII);
++			if (IS_ERR(adapter[i]->phydev)) {
++				dev_dbg(&pdev->dev, "PHY attach FAIL");
++				err = -EIO;
++				goto edma_phy_attach_fail;
++			} else {
++				adapter[i]->phydev->advertising |=
++					ADVERTISED_Pause |
++					ADVERTISED_Asym_Pause;
++				adapter[i]->phydev->supported |=
++					SUPPORTED_Pause |
++					SUPPORTED_Asym_Pause;
++			}
++		} else {
++			adapter[i]->phydev = NULL;
++		}
++	}
++
++	spin_lock_init(&edma_cinfo->stats_lock);
++
++	init_timer(&edma_stats_timer);
++	edma_stats_timer.expires = jiffies + 1*HZ;
++	edma_stats_timer.data = (unsigned long)edma_cinfo;
++	edma_stats_timer.function = edma_statistics_timer; /* timer handler */
++	add_timer(&edma_stats_timer);
++
++	return 0;
++
++edma_phy_attach_fail:
++	miibus = NULL;
++err_configure:
++#ifdef CONFIG_RFS_ACCEL
++	for (i = 0; i < edma_cinfo->num_gmac; i++) {
++		free_irq_cpu_rmap(adapter[i]->netdev->rx_cpu_rmap);
++		adapter[i]->netdev->rx_cpu_rmap = NULL;
++	}
++#endif
++err_rmap_add_fail:
++	edma_free_irqs(adapter[0]);
++	for (i = 0; i < CONFIG_NR_CPUS; i++)
++		napi_disable(&edma_cinfo->edma_percpu_info[i].napi);
++err_reset:
++err_unregister_sysctl_tbl:
++err_rmap_alloc_fail:
++	for (i = 0; i < edma_cinfo->num_gmac; i++)
++		unregister_netdev(edma_netdev[i]);
++err_register:
++err_mdiobus_init_fail:
++	edma_free_rx_rings(edma_cinfo);
++err_rx_rinit:
++	edma_free_tx_rings(edma_cinfo);
++err_tx_rinit:
++	edma_free_queues(edma_cinfo);
++err_rx_qinit:
++err_tx_qinit:
++	iounmap(edma_cinfo->hw.hw_addr);
++err_ioremap:
++	for (i = 0; i < edma_cinfo->num_gmac; i++) {
++		if (edma_netdev[i])
++			free_netdev(edma_netdev[i]);
++	}
++err_cinfo:
++	kfree(edma_cinfo);
++err_alloc:
++	return err;
++}
++
++/* edma_axi_remove()
++ *	Device Removal Routine
++ *
++ * edma_axi_remove is called by the platform subsystem to alert the driver
++ * that it should release a platform device.
++ */
++static int edma_axi_remove(struct platform_device *pdev)
++{
++	struct edma_adapter *adapter = netdev_priv(edma_netdev[0]);
++	struct edma_common_info *edma_cinfo = adapter->edma_cinfo;
++	struct edma_hw *hw = &edma_cinfo->hw;
++	int i;
++
++	for (i = 0; i < edma_cinfo->num_gmac; i++)
++		unregister_netdev(edma_netdev[i]);
++
++	edma_stop_rx_tx(hw);
++	for (i = 0; i < CONFIG_NR_CPUS; i++)
++		napi_disable(&edma_cinfo->edma_percpu_info[i].napi);
++
++	edma_irq_disable(edma_cinfo);
++	edma_write_reg(EDMA_REG_RX_ISR, 0xff);
++	edma_write_reg(EDMA_REG_TX_ISR, 0xffff);
++#ifdef CONFIG_RFS_ACCEL
++	for (i = 0; i < edma_cinfo->num_gmac; i++) {
++		free_irq_cpu_rmap(edma_netdev[i]->rx_cpu_rmap);
++		edma_netdev[i]->rx_cpu_rmap = NULL;
++	}
++#endif
++
++	for (i = 0; i < edma_cinfo->num_gmac; i++) {
++		struct edma_adapter *adapter = netdev_priv(edma_netdev[i]);
++
++		if (adapter->phydev)
++			phy_disconnect(adapter->phydev);
++	}
++
++	del_timer_sync(&edma_stats_timer);
++	edma_free_irqs(adapter);
++	unregister_net_sysctl_table(edma_cinfo->edma_ctl_table_hdr);
++	edma_free_tx_resources(edma_cinfo);
++	edma_free_rx_resources(edma_cinfo);
++	edma_free_tx_rings(edma_cinfo);
++	edma_free_rx_rings(edma_cinfo);
++	edma_free_queues(edma_cinfo);
++	for (i = 0; i < edma_cinfo->num_gmac; i++)
++		free_netdev(edma_netdev[i]);
++
++	kfree(edma_cinfo);
++
++	return 0;
++}
++
++static const struct of_device_id edma_of_mtable[] = {
++	{.compatible = "qcom,ess-edma" },
++	{}
++};
++MODULE_DEVICE_TABLE(of, edma_of_mtable);
++
++static struct platform_driver edma_axi_driver = {
++	.driver = {
++		.name    = edma_axi_driver_name,
++		.of_match_table = edma_of_mtable,
++	},
++	.probe    = edma_axi_probe,
++	.remove   = edma_axi_remove,
++};
++
++module_platform_driver(edma_axi_driver);
++
++MODULE_AUTHOR("Qualcomm Atheros Inc");
++MODULE_DESCRIPTION("QCA ESS EDMA driver");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/drivers/net/ethernet/qualcomm/essedma/edma_ethtool.c
+@@ -0,0 +1,374 @@
++/*
++ * Copyright (c) 2015 - 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/ethtool.h>
++#include <linux/netdevice.h>
++#include <linux/string.h>
++#include "edma.h"
++
++struct edma_ethtool_stats {
++	uint8_t stat_string[ETH_GSTRING_LEN];
++	uint32_t stat_offset;
++};
++
++#define EDMA_STAT(m)    offsetof(struct edma_ethtool_statistics, m)
++#define DRVINFO_LEN	32
++
++/* Array of strings describing statistics
++ */
++static const struct edma_ethtool_stats edma_gstrings_stats[] = {
++	{"tx_q0_pkt", EDMA_STAT(tx_q0_pkt)},
++	{"tx_q1_pkt", EDMA_STAT(tx_q1_pkt)},
++	{"tx_q2_pkt", EDMA_STAT(tx_q2_pkt)},
++	{"tx_q3_pkt", EDMA_STAT(tx_q3_pkt)},
++	{"tx_q4_pkt", EDMA_STAT(tx_q4_pkt)},
++	{"tx_q5_pkt", EDMA_STAT(tx_q5_pkt)},
++	{"tx_q6_pkt", EDMA_STAT(tx_q6_pkt)},
++	{"tx_q7_pkt", EDMA_STAT(tx_q7_pkt)},
++	{"tx_q8_pkt", EDMA_STAT(tx_q8_pkt)},
++	{"tx_q9_pkt", EDMA_STAT(tx_q9_pkt)},
++	{"tx_q10_pkt", EDMA_STAT(tx_q10_pkt)},
++	{"tx_q11_pkt", EDMA_STAT(tx_q11_pkt)},
++	{"tx_q12_pkt", EDMA_STAT(tx_q12_pkt)},
++	{"tx_q13_pkt", EDMA_STAT(tx_q13_pkt)},
++	{"tx_q14_pkt", EDMA_STAT(tx_q14_pkt)},
++	{"tx_q15_pkt", EDMA_STAT(tx_q15_pkt)},
++	{"tx_q0_byte", EDMA_STAT(tx_q0_byte)},
++	{"tx_q1_byte", EDMA_STAT(tx_q1_byte)},
++	{"tx_q2_byte", EDMA_STAT(tx_q2_byte)},
++	{"tx_q3_byte", EDMA_STAT(tx_q3_byte)},
++	{"tx_q4_byte", EDMA_STAT(tx_q4_byte)},
++	{"tx_q5_byte", EDMA_STAT(tx_q5_byte)},
++	{"tx_q6_byte", EDMA_STAT(tx_q6_byte)},
++	{"tx_q7_byte", EDMA_STAT(tx_q7_byte)},
++	{"tx_q8_byte", EDMA_STAT(tx_q8_byte)},
++	{"tx_q9_byte", EDMA_STAT(tx_q9_byte)},
++	{"tx_q10_byte", EDMA_STAT(tx_q10_byte)},
++	{"tx_q11_byte", EDMA_STAT(tx_q11_byte)},
++	{"tx_q12_byte", EDMA_STAT(tx_q12_byte)},
++	{"tx_q13_byte", EDMA_STAT(tx_q13_byte)},
++	{"tx_q14_byte", EDMA_STAT(tx_q14_byte)},
++	{"tx_q15_byte", EDMA_STAT(tx_q15_byte)},
++	{"rx_q0_pkt", EDMA_STAT(rx_q0_pkt)},
++	{"rx_q1_pkt", EDMA_STAT(rx_q1_pkt)},
++	{"rx_q2_pkt", EDMA_STAT(rx_q2_pkt)},
++	{"rx_q3_pkt", EDMA_STAT(rx_q3_pkt)},
++	{"rx_q4_pkt", EDMA_STAT(rx_q4_pkt)},
++	{"rx_q5_pkt", EDMA_STAT(rx_q5_pkt)},
++	{"rx_q6_pkt", EDMA_STAT(rx_q6_pkt)},
++	{"rx_q7_pkt", EDMA_STAT(rx_q7_pkt)},
++	{"rx_q0_byte", EDMA_STAT(rx_q0_byte)},
++	{"rx_q1_byte", EDMA_STAT(rx_q1_byte)},
++	{"rx_q2_byte", EDMA_STAT(rx_q2_byte)},
++	{"rx_q3_byte", EDMA_STAT(rx_q3_byte)},
++	{"rx_q4_byte", EDMA_STAT(rx_q4_byte)},
++	{"rx_q5_byte", EDMA_STAT(rx_q5_byte)},
++	{"rx_q6_byte", EDMA_STAT(rx_q6_byte)},
++	{"rx_q7_byte", EDMA_STAT(rx_q7_byte)},
++	{"tx_desc_error", EDMA_STAT(tx_desc_error)},
++};
++
++#define EDMA_STATS_LEN ARRAY_SIZE(edma_gstrings_stats)
++
++/* edma_get_strset_count()
++ *	Get strset count
++ */
++static int edma_get_strset_count(struct net_device *netdev,
++				 int sset)
++{
++	switch (sset) {
++	case ETH_SS_STATS:
++		return EDMA_STATS_LEN;
++	default:
++		netdev_dbg(netdev, "%s: Invalid string set", __func__);
++		return -EOPNOTSUPP;
++	}
++}
++
++
++/* edma_get_strings()
++ *	get stats string
++ */
++static void edma_get_strings(struct net_device *netdev, uint32_t stringset,
++			     uint8_t *data)
++{
++	uint8_t *p = data;
++	uint32_t i;
++
++	switch (stringset) {
++	case ETH_SS_STATS:
++		for (i = 0; i < EDMA_STATS_LEN; i++) {
++			memcpy(p, edma_gstrings_stats[i].stat_string,
++				min((size_t)ETH_GSTRING_LEN,
++				    strlen(edma_gstrings_stats[i].stat_string)
++				    + 1));
++			p += ETH_GSTRING_LEN;
++		}
++		break;
++	}
++}
++
++/* edma_get_ethtool_stats()
++ *	Get ethtool statistics
++ */
++static void edma_get_ethtool_stats(struct net_device *netdev,
++				   struct ethtool_stats *stats, uint64_t *data)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++	struct edma_common_info *edma_cinfo = adapter->edma_cinfo;
++	int i;
++	uint8_t *p = NULL;
++
++	edma_read_append_stats(edma_cinfo);
++
++	for(i = 0; i < EDMA_STATS_LEN; i++) {
++		p = (uint8_t *)&(edma_cinfo->edma_ethstats) +
++			edma_gstrings_stats[i].stat_offset;
++		data[i] = *(uint32_t *)p;
++	}
++}
++
++/* edma_get_drvinfo()
++ *	get edma driver info
++ */
++static void edma_get_drvinfo(struct net_device *dev,
++			     struct ethtool_drvinfo *info)
++{
++	strlcpy(info->driver, "ess_edma", DRVINFO_LEN);
++	strlcpy(info->bus_info, "axi", ETHTOOL_BUSINFO_LEN);
++}
++
++/* edma_nway_reset()
++ *	Reset the phy, if available.
++ */
++static int edma_nway_reset(struct net_device *netdev)
++{
++	return -EINVAL;
++}
++
++/* edma_get_wol()
++ *	get wake on lan info
++ */
++static void edma_get_wol(struct net_device *netdev,
++			 struct ethtool_wolinfo *wol)
++{
++	wol->supported = 0;
++	wol->wolopts = 0;
++}
++
++/* edma_get_msglevel()
++ *	get message level.
++ */
++static uint32_t edma_get_msglevel(struct net_device *netdev)
++{
++	return 0;
++}
++
++/* edma_get_settings()
++ *	Get edma settings
++ */
++static int edma_get_settings(struct net_device *netdev,
++			     struct ethtool_cmd *ecmd)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++
++	if (adapter->poll_required) {
++		struct phy_device *phydev = NULL;
++		uint16_t phyreg;
++
++		if ((adapter->forced_speed != SPEED_UNKNOWN)
++			&& !(adapter->poll_required))
++			return -EPERM;
++
++		phydev = adapter->phydev;
++
++		ecmd->advertising = phydev->advertising;
++		ecmd->autoneg = phydev->autoneg;
++
++		if (adapter->link_state == __EDMA_LINKDOWN) {
++			ecmd->speed =  SPEED_UNKNOWN;
++			ecmd->duplex = DUPLEX_UNKNOWN;
++		} else {
++			ecmd->speed = phydev->speed;
++			ecmd->duplex = phydev->duplex;
++		}
++
++		ecmd->phy_address = adapter->phy_mdio_addr;
++
++		phyreg = (uint16_t)phy_read(adapter->phydev, MII_LPA);
++		if (phyreg & LPA_10HALF)
++			ecmd->lp_advertising |= ADVERTISED_10baseT_Half;
++
++		if (phyreg & LPA_10FULL)
++			ecmd->lp_advertising |= ADVERTISED_10baseT_Full;
++
++		if (phyreg & LPA_100HALF)
++			ecmd->lp_advertising |= ADVERTISED_100baseT_Half;
++
++		if (phyreg & LPA_100FULL)
++			ecmd->lp_advertising |= ADVERTISED_100baseT_Full;
++
++		phyreg = (uint16_t)phy_read(adapter->phydev, MII_STAT1000);
++		if (phyreg & LPA_1000HALF)
++			ecmd->lp_advertising |= ADVERTISED_1000baseT_Half;
++
++		if (phyreg & LPA_1000FULL)
++			ecmd->lp_advertising |= ADVERTISED_1000baseT_Full;
++	} else {
++		/* If the speed/duplex for this GMAC is forced and we
++		 * are not polling for link state changes, return the
++		 * values as specified by platform. This will be true
++		 * for GMACs connected to switch, and interfaces that
++		 * do not use a PHY.
++		 */
++		if (!(adapter->poll_required)) {
++			if (adapter->forced_speed != SPEED_UNKNOWN) {
++				/* set speed and duplex */
++				ethtool_cmd_speed_set(ecmd, SPEED_1000);
++				ecmd->duplex = DUPLEX_FULL;
++
++				/* Populate capabilities advertised by self */
++				ecmd->advertising = 0;
++				ecmd->autoneg = 0;
++				ecmd->port = PORT_TP;
++				ecmd->transceiver = XCVR_EXTERNAL;
++			} else {
++				/* non link polled and non
++				 * forced speed/duplex interface
++				 */
++				return -EIO;
++			}
++		}
++	}
++
++	return 0;
++}
++
++/* edma_set_settings()
++ *	Set EDMA settings
++ */
++static int edma_set_settings(struct net_device *netdev,
++			     struct ethtool_cmd *ecmd)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++	struct phy_device *phydev = NULL;
++
++	if ((adapter->forced_speed != SPEED_UNKNOWN) &&
++	     !adapter->poll_required)
++		return -EPERM;
++
++	phydev = adapter->phydev;
++	phydev->advertising = ecmd->advertising;
++	phydev->autoneg = ecmd->autoneg;
++	phydev->speed = ethtool_cmd_speed(ecmd);
++	phydev->duplex = ecmd->duplex;
++
++	genphy_config_aneg(phydev);
++
++	return 0;
++}
++
++/* edma_get_coalesce
++ *	get interrupt mitigation
++ */
++static int edma_get_coalesce(struct net_device *netdev,
++			     struct ethtool_coalesce *ec)
++{
++	u32 reg_val;
++
++	edma_get_tx_rx_coalesce(&reg_val);
++
++	/* We read the Interrupt Moderation Timer(IMT) register value,
++	 * use lower 16 bit for rx and higher 16 bit for Tx. We do a
++	 * left shift by 1, because IMT resolution timer is 2usecs.
++	 * Hence the value given by the register is multiplied by 2 to
++	 * get the actual time in usecs.
++	 */
++	ec->tx_coalesce_usecs = (((reg_val >> 16) & 0xffff) << 1);
++	ec->rx_coalesce_usecs = ((reg_val & 0xffff) << 1);
++
++	return 0;
++}
++
++/* edma_set_coalesce
++ *	set interrupt mitigation
++ */
++static int edma_set_coalesce(struct net_device *netdev,
++			     struct ethtool_coalesce *ec)
++{
++	if (ec->tx_coalesce_usecs)
++		edma_change_tx_coalesce(ec->tx_coalesce_usecs);
++	if (ec->rx_coalesce_usecs)
++		edma_change_rx_coalesce(ec->rx_coalesce_usecs);
++
++	return 0;
++}
++
++/* edma_set_priv_flags()
++ *	Set EDMA private flags
++ */
++static int edma_set_priv_flags(struct net_device *netdev, u32 flags)
++{
++	return 0;
++}
++
++/* edma_get_priv_flags()
++ *	get edma driver flags
++ */
++static u32 edma_get_priv_flags(struct net_device *netdev)
++{
++	return 0;
++}
++
++/* edma_get_ringparam()
++ *	get ring size
++ */
++static void edma_get_ringparam(struct net_device *netdev,
++			       struct ethtool_ringparam *ring)
++{
++	struct edma_adapter *adapter = netdev_priv(netdev);
++	struct edma_common_info *edma_cinfo = adapter->edma_cinfo;
++
++	ring->tx_max_pending = edma_cinfo->tx_ring_count;
++	ring->rx_max_pending = edma_cinfo->rx_ring_count;
++}
++
++/* Ethtool operations
++ */
++static const struct ethtool_ops edma_ethtool_ops = {
++	.get_drvinfo = &edma_get_drvinfo,
++	.get_link = &ethtool_op_get_link,
++	.get_msglevel = &edma_get_msglevel,
++	.nway_reset = &edma_nway_reset,
++	.get_wol = &edma_get_wol,
++	.get_settings = &edma_get_settings,
++	.set_settings = &edma_set_settings,
++	.get_strings = &edma_get_strings,
++	.get_sset_count = &edma_get_strset_count,
++	.get_ethtool_stats = &edma_get_ethtool_stats,
++	.get_coalesce = &edma_get_coalesce,
++	.set_coalesce = &edma_set_coalesce,
++	.get_priv_flags = edma_get_priv_flags,
++	.set_priv_flags = edma_set_priv_flags,
++	.get_ringparam = edma_get_ringparam,
++};
++
++/* edma_set_ethtool_ops
++ *	Set ethtool operations
++ */
++void edma_set_ethtool_ops(struct net_device *netdev)
++{
++	netdev->ethtool_ops = &edma_ethtool_ops;
++}
+--- /dev/null
++++ b/drivers/net/ethernet/qualcomm/essedma/ess_edma.h
+@@ -0,0 +1,332 @@
++/*
++ * Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _ESS_EDMA_H_
++#define _ESS_EDMA_H_
++
++#include <linux/types.h>
++
++struct edma_adapter;
++struct edma_hw;
++
++/* register definition */
++#define EDMA_REG_MAS_CTRL 0x0
++#define EDMA_REG_TIMEOUT_CTRL 0x004
++#define EDMA_REG_DBG0 0x008
++#define EDMA_REG_DBG1 0x00C
++#define EDMA_REG_SW_CTRL0 0x100
++#define EDMA_REG_SW_CTRL1 0x104
++
++/* Interrupt Status Register */
++#define EDMA_REG_RX_ISR 0x200
++#define EDMA_REG_TX_ISR 0x208
++#define EDMA_REG_MISC_ISR 0x210
++#define EDMA_REG_WOL_ISR 0x218
++
++#define EDMA_MISC_ISR_RX_URG_Q(x) (1 << x)
++
++#define EDMA_MISC_ISR_AXIR_TIMEOUT 0x00000100
++#define EDMA_MISC_ISR_AXIR_ERR 0x00000200
++#define EDMA_MISC_ISR_TXF_DEAD 0x00000400
++#define EDMA_MISC_ISR_AXIW_ERR 0x00000800
++#define EDMA_MISC_ISR_AXIW_TIMEOUT 0x00001000
++
++#define EDMA_WOL_ISR 0x00000001
++
++/* Interrupt Mask Register */
++#define EDMA_REG_MISC_IMR 0x214
++#define EDMA_REG_WOL_IMR 0x218
++
++#define EDMA_RX_IMR_NORMAL_MASK 0x1
++#define EDMA_TX_IMR_NORMAL_MASK 0x1
++#define EDMA_MISC_IMR_NORMAL_MASK 0x80001FFF
++#define EDMA_WOL_IMR_NORMAL_MASK 0x1
++
++/* Edma receive consumer index */
++#define EDMA_REG_RX_SW_CONS_IDX_Q(x) (0x220 + ((x) << 2)) /* x is the queue id */
++/* Edma transmit consumer index */
++#define EDMA_REG_TX_SW_CONS_IDX_Q(x) (0x240 + ((x) << 2)) /* x is the queue id */
++
++/* IRQ Moderator Initial Timer Register */
++#define EDMA_REG_IRQ_MODRT_TIMER_INIT 0x280
++#define EDMA_IRQ_MODRT_TIMER_MASK 0xFFFF
++#define EDMA_IRQ_MODRT_RX_TIMER_SHIFT 0
++#define EDMA_IRQ_MODRT_TX_TIMER_SHIFT 16
++
++/* Interrupt Control Register */
++#define EDMA_REG_INTR_CTRL 0x284
++#define EDMA_INTR_CLR_TYP_SHIFT 0
++#define EDMA_INTR_SW_IDX_W_TYP_SHIFT 1
++#define EDMA_INTR_CLEAR_TYPE_W1 0
++#define EDMA_INTR_CLEAR_TYPE_R 1
++
++/* RX Interrupt Mask Register */
++#define EDMA_REG_RX_INT_MASK_Q(x) (0x300 + ((x) << 2)) /* x = queue id */
++
++/* TX Interrupt mask register */
++#define EDMA_REG_TX_INT_MASK_Q(x) (0x340 + ((x) << 2)) /* x = queue id */
++
++/* Load Ptr Register
++ * Software sets this bit after the initialization of the head and tail
++ */
++#define EDMA_REG_TX_SRAM_PART 0x400
++#define EDMA_LOAD_PTR_SHIFT 16
++
++/* TXQ Control Register */
++#define EDMA_REG_TXQ_CTRL 0x404
++#define EDMA_TXQ_CTRL_IP_OPTION_EN 0x10
++#define EDMA_TXQ_CTRL_TXQ_EN 0x20
++#define EDMA_TXQ_CTRL_ENH_MODE 0x40
++#define EDMA_TXQ_CTRL_LS_8023_EN 0x80
++#define EDMA_TXQ_CTRL_TPD_BURST_EN 0x100
++#define EDMA_TXQ_CTRL_LSO_BREAK_EN 0x200
++#define EDMA_TXQ_NUM_TPD_BURST_MASK 0xF
++#define EDMA_TXQ_TXF_BURST_NUM_MASK 0xFFFF
++#define EDMA_TXQ_NUM_TPD_BURST_SHIFT 0
++#define EDMA_TXQ_TXF_BURST_NUM_SHIFT 16
++
++#define	EDMA_REG_TXF_WATER_MARK 0x408 /* In 8-bytes */
++#define EDMA_TXF_WATER_MARK_MASK 0x0FFF
++#define EDMA_TXF_LOW_WATER_MARK_SHIFT 0
++#define EDMA_TXF_HIGH_WATER_MARK_SHIFT 16
++#define EDMA_TXQ_CTRL_BURST_MODE_EN 0x80000000
++
++/* WRR Control Register */
++#define EDMA_REG_WRR_CTRL_Q0_Q3 0x40c
++#define EDMA_REG_WRR_CTRL_Q4_Q7 0x410
++#define EDMA_REG_WRR_CTRL_Q8_Q11 0x414
++#define EDMA_REG_WRR_CTRL_Q12_Q15 0x418
++
++/* Weight round robin(WRR), it takes queue as input, and computes
++ * starting bits where we need to write the weight for a particular
++ * queue
++ */
++#define EDMA_WRR_SHIFT(x) (((x) * 5) % 20)
++
++/* Tx Descriptor Control Register */
++#define EDMA_REG_TPD_RING_SIZE 0x41C
++#define EDMA_TPD_RING_SIZE_SHIFT 0
++#define EDMA_TPD_RING_SIZE_MASK 0xFFFF
++
++/* Transmit descriptor base address */
++#define EDMA_REG_TPD_BASE_ADDR_Q(x) (0x420 + ((x) << 2)) /* x = queue id */
++
++/* TPD Index Register */
++#define EDMA_REG_TPD_IDX_Q(x) (0x460 + ((x) << 2)) /* x = queue id */
++
++#define EDMA_TPD_PROD_IDX_BITS 0x0000FFFF
++#define EDMA_TPD_CONS_IDX_BITS 0xFFFF0000
++#define EDMA_TPD_PROD_IDX_MASK 0xFFFF
++#define EDMA_TPD_CONS_IDX_MASK 0xFFFF
++#define EDMA_TPD_PROD_IDX_SHIFT 0
++#define EDMA_TPD_CONS_IDX_SHIFT 16
++
++/* TX Virtual Queue Mapping Control Register */
++#define EDMA_REG_VQ_CTRL0 0x4A0
++#define EDMA_REG_VQ_CTRL1 0x4A4
++
++/* Virtual QID shift, it takes queue as input, and computes
++ * Virtual QID position in virtual qid control register
++ */
++#define EDMA_VQ_ID_SHIFT(i) (((i) * 3) % 24)
++
++/* Virtual Queue Default Value */
++#define EDMA_VQ_REG_VALUE 0x240240
++
++/* Tx side Port Interface Control Register */
++#define EDMA_REG_PORT_CTRL 0x4A8
++#define EDMA_PAD_EN_SHIFT 15
++
++/* Tx side VLAN Configuration Register */
++#define EDMA_REG_VLAN_CFG 0x4AC
++
++#define EDMA_TX_CVLAN 16
++#define EDMA_TX_INS_CVLAN 17
++#define EDMA_TX_CVLAN_TAG_SHIFT 0
++
++#define EDMA_TX_SVLAN 14
++#define EDMA_TX_INS_SVLAN 15
++#define EDMA_TX_SVLAN_TAG_SHIFT 16
++
++/* Tx Queue Packet Statistic Register */
++#define EDMA_REG_TX_STAT_PKT_Q(x) (0x700 + ((x) << 3)) /* x = queue id */
++
++#define EDMA_TX_STAT_PKT_MASK 0xFFFFFF
++
++/* Tx Queue Byte Statistic Register */
++#define EDMA_REG_TX_STAT_BYTE_Q(x) (0x704 + ((x) << 3)) /* x = queue id */
++
++/* Load Balance Based Ring Offset Register */
++#define EDMA_REG_LB_RING 0x800
++#define EDMA_LB_RING_ENTRY_MASK 0xff
++#define EDMA_LB_RING_ID_MASK 0x7
++#define EDMA_LB_RING_PROFILE_ID_MASK 0x3
++#define EDMA_LB_RING_ENTRY_BIT_OFFSET 8
++#define EDMA_LB_RING_ID_OFFSET 0
++#define EDMA_LB_RING_PROFILE_ID_OFFSET 3
++#define EDMA_LB_REG_VALUE 0x6040200
++
++/* Load Balance Priority Mapping Register */
++#define EDMA_REG_LB_PRI_START 0x804
++#define EDMA_REG_LB_PRI_END 0x810
++#define EDMA_LB_PRI_REG_INC 4
++#define EDMA_LB_PRI_ENTRY_BIT_OFFSET 4
++#define EDMA_LB_PRI_ENTRY_MASK 0xf
++
++/* RSS Priority Mapping Register */
++#define EDMA_REG_RSS_PRI 0x820
++#define EDMA_RSS_PRI_ENTRY_MASK 0xf
++#define EDMA_RSS_RING_ID_MASK 0x7
++#define EDMA_RSS_PRI_ENTRY_BIT_OFFSET 4
++
++/* RSS Indirection Register */
++#define EDMA_REG_RSS_IDT(x) (0x840 + ((x) << 2)) /* x = No. of indirection table */
++#define EDMA_NUM_IDT 16
++#define EDMA_RSS_IDT_VALUE 0x64206420
++
++/* Default RSS Ring Register */
++#define EDMA_REG_DEF_RSS 0x890
++#define EDMA_DEF_RSS_MASK 0x7
++
++/* RSS Hash Function Type Register */
++#define EDMA_REG_RSS_TYPE 0x894
++#define EDMA_RSS_TYPE_NONE 0x01
++#define EDMA_RSS_TYPE_IPV4TCP 0x02
++#define EDMA_RSS_TYPE_IPV6_TCP 0x04
++#define EDMA_RSS_TYPE_IPV4_UDP 0x08
++#define EDMA_RSS_TYPE_IPV6UDP 0x10
++#define EDMA_RSS_TYPE_IPV4 0x20
++#define EDMA_RSS_TYPE_IPV6 0x40
++#define EDMA_RSS_HASH_MODE_MASK 0x7f
++
++#define EDMA_REG_RSS_HASH_VALUE 0x8C0
++
++#define EDMA_REG_RSS_TYPE_RESULT 0x8C4
++
++#define EDMA_HASH_TYPE_START 0
++#define EDMA_HASH_TYPE_END 5
++#define EDMA_HASH_TYPE_SHIFT 12
++
++#define EDMA_RFS_FLOW_ENTRIES 1024
++#define EDMA_RFS_FLOW_ENTRIES_MASK (EDMA_RFS_FLOW_ENTRIES - 1)
++#define EDMA_RFS_EXPIRE_COUNT_PER_CALL 128
++
++/* RFD Base Address Register */
++#define EDMA_REG_RFD_BASE_ADDR_Q(x) (0x950 + ((x) << 2)) /* x = queue id */
++
++/* RFD Index Register */
++#define EDMA_REG_RFD_IDX_Q(x) (0x9B0 + ((x) << 2))
++
++#define EDMA_RFD_PROD_IDX_BITS 0x00000FFF
++#define EDMA_RFD_CONS_IDX_BITS 0x0FFF0000
++#define EDMA_RFD_PROD_IDX_MASK 0xFFF
++#define EDMA_RFD_CONS_IDX_MASK 0xFFF
++#define EDMA_RFD_PROD_IDX_SHIFT 0
++#define EDMA_RFD_CONS_IDX_SHIFT 16
++
++/* Rx Descriptor Control Register */
++#define EDMA_REG_RX_DESC0 0xA10
++#define EDMA_RFD_RING_SIZE_MASK 0xFFF
++#define EDMA_RX_BUF_SIZE_MASK 0xFFFF
++#define EDMA_RFD_RING_SIZE_SHIFT 0
++#define EDMA_RX_BUF_SIZE_SHIFT 16
++
++#define EDMA_REG_RX_DESC1 0xA14
++#define EDMA_RXQ_RFD_BURST_NUM_MASK 0x3F
++#define EDMA_RXQ_RFD_PF_THRESH_MASK 0x1F
++#define EDMA_RXQ_RFD_LOW_THRESH_MASK 0xFFF
++#define EDMA_RXQ_RFD_BURST_NUM_SHIFT 0
++#define EDMA_RXQ_RFD_PF_THRESH_SHIFT 8
++#define EDMA_RXQ_RFD_LOW_THRESH_SHIFT 16
++
++/* RXQ Control Register */
++#define EDMA_REG_RXQ_CTRL 0xA18
++#define EDMA_FIFO_THRESH_TYPE_SHIF 0
++#define EDMA_FIFO_THRESH_128_BYTE 0x0
++#define EDMA_FIFO_THRESH_64_BYTE 0x1
++#define EDMA_RXQ_CTRL_RMV_VLAN 0x00000002
++#define EDMA_RXQ_CTRL_EN 0x0000FF00
++
++/* AXI Burst Size Config */
++#define EDMA_REG_AXIW_CTRL_MAXWRSIZE 0xA1C
++#define EDMA_AXIW_MAXWRSIZE_VALUE 0x0
++
++/* Rx Statistics Register */
++#define EDMA_REG_RX_STAT_BYTE_Q(x) (0xA30 + ((x) << 2)) /* x = queue id */
++#define EDMA_REG_RX_STAT_PKT_Q(x) (0xA50 + ((x) << 2)) /* x = queue id */
++
++/* WoL Pattern Length Register */
++#define EDMA_REG_WOL_PATTERN_LEN0 0xC00
++#define EDMA_WOL_PT_LEN_MASK 0xFF
++#define EDMA_WOL_PT0_LEN_SHIFT 0
++#define EDMA_WOL_PT1_LEN_SHIFT 8
++#define EDMA_WOL_PT2_LEN_SHIFT 16
++#define EDMA_WOL_PT3_LEN_SHIFT 24
++
++#define EDMA_REG_WOL_PATTERN_LEN1 0xC04
++#define EDMA_WOL_PT4_LEN_SHIFT 0
++#define EDMA_WOL_PT5_LEN_SHIFT 8
++#define EDMA_WOL_PT6_LEN_SHIFT 16
++
++/* WoL Control Register */
++#define EDMA_REG_WOL_CTRL 0xC08
++#define EDMA_WOL_WK_EN 0x00000001
++#define EDMA_WOL_MG_EN 0x00000002
++#define EDMA_WOL_PT0_EN 0x00000004
++#define EDMA_WOL_PT1_EN 0x00000008
++#define EDMA_WOL_PT2_EN 0x00000010
++#define EDMA_WOL_PT3_EN 0x00000020
++#define EDMA_WOL_PT4_EN 0x00000040
++#define EDMA_WOL_PT5_EN 0x00000080
++#define EDMA_WOL_PT6_EN 0x00000100
++
++/* MAC Control Register */
++#define EDMA_REG_MAC_CTRL0 0xC20
++#define EDMA_REG_MAC_CTRL1 0xC24
++
++/* WoL Pattern Register */
++#define EDMA_REG_WOL_PATTERN_START 0x5000
++#define EDMA_PATTERN_PART_REG_OFFSET 0x40
++
++
++/* TX descriptor fields */
++#define EDMA_TPD_HDR_SHIFT 0
++#define EDMA_TPD_PPPOE_EN 0x00000100
++#define EDMA_TPD_IP_CSUM_EN 0x00000200
++#define EDMA_TPD_TCP_CSUM_EN 0x0000400
++#define EDMA_TPD_UDP_CSUM_EN 0x00000800
++#define EDMA_TPD_CUSTOM_CSUM_EN 0x00000C00
++#define EDMA_TPD_LSO_EN 0x00001000
++#define EDMA_TPD_LSO_V2_EN 0x00002000
++#define EDMA_TPD_IPV4_EN 0x00010000
++#define EDMA_TPD_MSS_MASK 0x1FFF
++#define EDMA_TPD_MSS_SHIFT 18
++#define EDMA_TPD_CUSTOM_CSUM_SHIFT 18
++
++/* RRD descriptor fields */
++#define EDMA_RRD_NUM_RFD_MASK 0x000F
++#define EDMA_RRD_SVLAN 0x8000
++#define EDMA_RRD_FLOW_COOKIE_MASK 0x07FF;
++
++#define EDMA_RRD_PKT_SIZE_MASK 0x3FFF
++#define EDMA_RRD_CSUM_FAIL_MASK 0xC000
++#define EDMA_RRD_CVLAN 0x0001
++#define EDMA_RRD_DESC_VALID 0x8000
++
++#define EDMA_RRD_PRIORITY_SHIFT 4
++#define EDMA_RRD_PRIORITY_MASK 0x7
++#define EDMA_RRD_PORT_TYPE_SHIFT 7
++#define EDMA_RRD_PORT_TYPE_MASK 0x1F
++#endif /* _ESS_EDMA_H_ */
diff --git a/target/linux/ipq40xx/patches-4.14/711-dts-ipq4019-add-ethernet-essedma-node.patch b/target/linux/ipq40xx/patches-4.14/711-dts-ipq4019-add-ethernet-essedma-node.patch
new file mode 100644
index 000000000..285cafd6d
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/711-dts-ipq4019-add-ethernet-essedma-node.patch
@@ -0,0 +1,92 @@
+From c611d3780fa101662a822d10acf8feb04ca97409 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sun, 20 Nov 2016 01:01:10 +0100
+Subject: [PATCH] dts: ipq4019: add ethernet essedma node
+
+This patch adds the device-tree node for the ethernet
+interfaces.
+
+Note: The driver isn't anywhere close to be upstream,
+so the info might change.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 60 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 60 insertions(+)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -28,6 +28,8 @@
+ 		spi1 = &spi_1;
+ 		i2c0 = &i2c_0;
+ 		i2c1 = &i2c_1;
++		ethernet0 = &gmac0;
++		ethernet1 = &gmac1;
+ 	};
+ 
+ 	cpus {
+@@ -590,6 +592,64 @@
+ 			status = "disabled";
+ 		};
+ 
++		edma@c080000 {
++			compatible = "qcom,ess-edma";
++			reg = <0xc080000 0x8000>;
++			qcom,page-mode = <0>;
++			qcom,rx_head_buf_size = <1540>;
++			qcom,mdio_supported;
++			qcom,poll_required = <1>;
++			qcom,num_gmac = <2>;
++			interrupts = <0  65 IRQ_TYPE_EDGE_RISING
++				      0  66 IRQ_TYPE_EDGE_RISING
++				      0  67 IRQ_TYPE_EDGE_RISING
++				      0  68 IRQ_TYPE_EDGE_RISING
++				      0  69 IRQ_TYPE_EDGE_RISING
++				      0  70 IRQ_TYPE_EDGE_RISING
++				      0  71 IRQ_TYPE_EDGE_RISING
++				      0  72 IRQ_TYPE_EDGE_RISING
++				      0  73 IRQ_TYPE_EDGE_RISING
++				      0  74 IRQ_TYPE_EDGE_RISING
++				      0  75 IRQ_TYPE_EDGE_RISING
++				      0  76 IRQ_TYPE_EDGE_RISING
++				      0  77 IRQ_TYPE_EDGE_RISING
++				      0  78 IRQ_TYPE_EDGE_RISING
++				      0  79 IRQ_TYPE_EDGE_RISING
++				      0  80 IRQ_TYPE_EDGE_RISING
++				      0 240 IRQ_TYPE_EDGE_RISING
++				      0 241 IRQ_TYPE_EDGE_RISING
++				      0 242 IRQ_TYPE_EDGE_RISING
++				      0 243 IRQ_TYPE_EDGE_RISING
++				      0 244 IRQ_TYPE_EDGE_RISING
++				      0 245 IRQ_TYPE_EDGE_RISING
++				      0 246 IRQ_TYPE_EDGE_RISING
++				      0 247 IRQ_TYPE_EDGE_RISING
++				      0 248 IRQ_TYPE_EDGE_RISING
++				      0 249 IRQ_TYPE_EDGE_RISING
++				      0 250 IRQ_TYPE_EDGE_RISING
++				      0 251 IRQ_TYPE_EDGE_RISING
++				      0 252 IRQ_TYPE_EDGE_RISING
++				      0 253 IRQ_TYPE_EDGE_RISING
++				      0 254 IRQ_TYPE_EDGE_RISING
++				      0 255 IRQ_TYPE_EDGE_RISING>;
++
++			status = "disabled";
++
++			gmac0: gmac0 {
++				local-mac-address = [00 00 00 00 00 00];
++				vlan_tag = <1 0x1f>;
++			};
++
++			gmac1: gmac1 {
++				local-mac-address = [00 00 00 00 00 00];
++				qcom,phy_mdio_addr = <4>;
++				qcom,poll_required = <1>;
++				qcom,forced_speed = <1000>;
++				qcom,forced_duplex = <1>;
++				vlan_tag = <2 0x20>;
++			};
++		};
++
+ 		usb3_ss_phy: ssphy@9a000 {
+ 			compatible = "qca,uni-ssphy";
+ 			reg = <0x9a000 0x800>;
diff --git a/target/linux/ipq40xx/patches-4.14/712-mr33-essedma.patch b/target/linux/ipq40xx/patches-4.14/712-mr33-essedma.patch
new file mode 100644
index 000000000..6be30070d
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/712-mr33-essedma.patch
@@ -0,0 +1,340 @@
+--- a/drivers/net/ethernet/qualcomm/essedma/edma_axi.c
++++ b/drivers/net/ethernet/qualcomm/essedma/edma_axi.c
+@@ -17,6 +17,11 @@
+ #include <linux/of.h>
+ #include <linux/of_net.h>
+ #include <linux/timer.h>
++#include <linux/of_platform.h>
++#include <linux/of_address.h>
++#include <linux/clk.h>
++#include <linux/string.h>
++#include <linux/reset.h>
+ #include "edma.h"
+ #include "ess_edma.h"
+ 
+@@ -83,7 +88,103 @@ void edma_read_reg(u16 reg_addr, volatil
+ 	*reg_value = readl((void __iomem *)(edma_hw_addr + reg_addr));
+ }
+ 
+-/* edma_change_tx_coalesce()
++static void ess_write_reg(struct edma_common_info *edma, u16 reg_addr, u32 reg_value)
++{
++	writel(reg_value, ((void __iomem *)
++		((unsigned long)edma->ess_hw_addr + reg_addr)));
++}
++
++static void ess_read_reg(struct edma_common_info *edma, u16 reg_addr,
++		  volatile u32 *reg_value)
++{
++	*reg_value = readl((void __iomem *)
++		((unsigned long)edma->ess_hw_addr + reg_addr));
++}
++
++static int ess_reset(struct edma_common_info *edma)
++{
++	struct device_node *switch_node = NULL;
++	struct reset_control *ess_rst;
++	u32 regval;
++
++	switch_node = of_find_node_by_name(NULL, "ess-switch");
++	if (!switch_node) {
++		pr_err("switch-node not found\n");
++		return -EINVAL;
++	}
++
++	ess_rst = of_reset_control_get(switch_node, "ess_rst");
++	of_node_put(switch_node);
++
++	if (IS_ERR(ess_rst)) {
++		pr_err("failed to find ess_rst!\n");
++		return -ENOENT;
++	}
++
++	reset_control_assert(ess_rst);
++	msleep(10);
++	reset_control_deassert(ess_rst);
++	msleep(100);
++	reset_control_put(ess_rst);
++
++	/* Enable only port 5 <--> port 0
++	 * bits 0:6 bitmap of ports it can fwd to */
++#define SET_PORT_BMP(r,v) \
++		ess_read_reg(edma, r, &regval); \
++		ess_write_reg(edma, r, ((regval & ~0x3F) | v));
++
++	SET_PORT_BMP(ESS_PORT0_LOOKUP_CTRL,0x20);
++	SET_PORT_BMP(ESS_PORT1_LOOKUP_CTRL,0x00);
++	SET_PORT_BMP(ESS_PORT2_LOOKUP_CTRL,0x00);
++	SET_PORT_BMP(ESS_PORT3_LOOKUP_CTRL,0x00);
++	SET_PORT_BMP(ESS_PORT4_LOOKUP_CTRL,0x00);
++	SET_PORT_BMP(ESS_PORT5_LOOKUP_CTRL,0x01);
++	ess_write_reg(edma, ESS_RGMII_CTRL, 0x400);
++	ess_write_reg(edma, ESS_PORT0_STATUS, ESS_PORT_1G_FDX);
++	ess_write_reg(edma, ESS_PORT5_STATUS, ESS_PORT_1G_FDX);
++	ess_write_reg(edma, ESS_PORT0_HEADER_CTRL, 0);
++#undef SET_PORT_BMP
++
++	/* forward multicast and broadcast frames to CPU */
++	ess_write_reg(edma, ESS_FWD_CTRL1,
++		(ESS_PORTS_ALL << ESS_FWD_CTRL1_UC_FLOOD_S) |
++		(ESS_PORTS_ALL << ESS_FWD_CTRL1_MC_FLOOD_S) |
++		(ESS_PORTS_ALL << ESS_FWD_CTRL1_BC_FLOOD_S));
++
++	return 0;
++}
++
++void ess_set_port_status_speed(struct edma_common_info *edma,
++			       struct phy_device *phydev, uint8_t port_id)
++{
++	uint16_t reg_off = ESS_PORT0_STATUS + (4 * port_id);
++	uint32_t reg_val = 0;
++
++	ess_read_reg(edma, reg_off, &reg_val);
++
++	/* reset the speed bits [0:1] */
++	reg_val &= ~ESS_PORT_STATUS_SPEED_INV;
++
++	/* set the new speed */
++	switch(phydev->speed) {
++		case SPEED_1000:  reg_val |= ESS_PORT_STATUS_SPEED_1000; break;
++		case SPEED_100:   reg_val |= ESS_PORT_STATUS_SPEED_100;  break;
++		case SPEED_10:    reg_val |= ESS_PORT_STATUS_SPEED_10;   break;
++		default:          reg_val |= ESS_PORT_STATUS_SPEED_INV;  break;
++	}
++
++	/* check full/half duplex */
++	if (phydev->duplex) {
++		reg_val |= ESS_PORT_STATUS_DUPLEX_MODE;
++	} else {
++		reg_val &= ~ESS_PORT_STATUS_DUPLEX_MODE;
++	}
++
++	ess_write_reg(edma, reg_off, reg_val);
++}
++
++/*
++ * edma_change_tx_coalesce()
+  *	change tx interrupt moderation timer
+  */
+ void edma_change_tx_coalesce(int usecs)
+@@ -551,6 +652,31 @@ static struct ctl_table edma_table[] = {
+ 	{}
+ };
+ 
++static int ess_parse(struct edma_common_info *edma)
++{
++	struct device_node *switch_node;
++	int ret = -EINVAL;
++
++	switch_node = of_find_node_by_name(NULL, "ess-switch");
++	if (!switch_node) {
++		pr_err("cannot find ess-switch node\n");
++		goto out;
++	}
++
++	edma->ess_hw_addr = of_io_request_and_map(switch_node,
++						  0, KBUILD_MODNAME);
++	if (!edma->ess_hw_addr) {
++		pr_err("%s ioremap fail.", __func__);
++		goto out;
++	}
++
++	edma->ess_clk = of_clk_get_by_name(switch_node, "ess_clk");
++	ret = clk_prepare_enable(edma->ess_clk);
++out:
++	of_node_put(switch_node);
++	return ret;
++}
++
+ /* edma_axi_netdev_ops
+  *	Describe the operations supported by registered netdevices
+  *
+@@ -786,6 +912,17 @@ static int edma_axi_probe(struct platfor
+ 		miibus = mdio_data->mii_bus;
+ 	}
+ 
++	if (of_property_read_bool(np, "qcom,single-phy") &&
++	    edma_cinfo->num_gmac == 1) {
++		err = ess_parse(edma_cinfo);
++		if (!err)
++			err = ess_reset(edma_cinfo);
++		if (err)
++			goto err_single_phy_init;
++		else
++			edma_cinfo->is_single_phy = true;
++	}
++
+ 	for_each_available_child_of_node(np, pnp) {
+ 		const char *mac_addr;
+ 
+@@ -1074,11 +1211,15 @@ static int edma_axi_probe(struct platfor
+ 
+ 	for (i = 0; i < edma_cinfo->num_gmac; i++) {
+ 		if (adapter[i]->poll_required) {
++			int phy_mode = of_get_phy_mode(np);
++
++			if (phy_mode < 0)
++				phy_mode = PHY_INTERFACE_MODE_SGMII;
+ 			adapter[i]->phydev =
+ 				phy_connect(edma_netdev[i],
+ 					    (const char *)adapter[i]->phy_id,
+ 					    &edma_adjust_link,
+-					    PHY_INTERFACE_MODE_SGMII);
++					    phy_mode);
+ 			if (IS_ERR(adapter[i]->phydev)) {
+ 				dev_dbg(&pdev->dev, "PHY attach FAIL");
+ 				err = -EIO;
+@@ -1125,6 +1266,9 @@ err_rmap_alloc_fail:
+ 	for (i = 0; i < edma_cinfo->num_gmac; i++)
+ 		unregister_netdev(edma_netdev[i]);
+ err_register:
++err_single_phy_init:
++	iounmap(edma_cinfo->ess_hw_addr);
++	clk_disable_unprepare(edma_cinfo->ess_clk);
+ err_mdiobus_init_fail:
+ 	edma_free_rx_rings(edma_cinfo);
+ err_rx_rinit:
+@@ -1185,6 +1329,8 @@ static int edma_axi_remove(struct platfo
+ 	del_timer_sync(&edma_stats_timer);
+ 	edma_free_irqs(adapter);
+ 	unregister_net_sysctl_table(edma_cinfo->edma_ctl_table_hdr);
++	iounmap(edma_cinfo->ess_hw_addr);
++	clk_disable_unprepare(edma_cinfo->ess_clk);
+ 	edma_free_tx_resources(edma_cinfo);
+ 	edma_free_rx_resources(edma_cinfo);
+ 	edma_free_tx_rings(edma_cinfo);
+--- a/drivers/net/ethernet/qualcomm/essedma/edma.c
++++ b/drivers/net/ethernet/qualcomm/essedma/edma.c
+@@ -161,8 +161,10 @@ static void edma_configure_rx(struct edm
+ 	/* Set Rx FIFO threshold to start to DMA data to host */
+ 	rxq_ctrl_data = EDMA_FIFO_THRESH_128_BYTE;
+ 
+-	/* Set RX remove vlan bit */
+-	rxq_ctrl_data |= EDMA_RXQ_CTRL_RMV_VLAN;
++	if (!edma_cinfo->is_single_phy) {
++		/* Set RX remove vlan bit */
++		rxq_ctrl_data |= EDMA_RXQ_CTRL_RMV_VLAN;
++	}
+ 
+ 	edma_write_reg(EDMA_REG_RXQ_CTRL, rxq_ctrl_data);
+ }
+@@ -1295,6 +1297,10 @@ void edma_adjust_link(struct net_device
+ 	if (status == __EDMA_LINKUP && adapter->link_state == __EDMA_LINKDOWN) {
+ 		dev_info(&adapter->pdev->dev, "%s: GMAC Link is up with phy_speed=%d\n", netdev->name, phydev->speed);
+ 		adapter->link_state = __EDMA_LINKUP;
++		if (adapter->edma_cinfo->is_single_phy) {
++			ess_set_port_status_speed(adapter->edma_cinfo, phydev,
++						  ffs(adapter->dp_bitmap) - 1);
++		}
+ 		netif_carrier_on(netdev);
+ 		if (netif_running(netdev))
+ 			netif_tx_wake_all_queues(netdev);
+@@ -1388,10 +1394,12 @@ netdev_tx_t edma_xmit(struct sk_buff *sk
+ 	}
+ 
+ 	/* Check and mark VLAN tag offload */
+-	if (skb_vlan_tag_present(skb))
+-		flags_transmit |= EDMA_VLAN_TX_TAG_INSERT_FLAG;
+-	else if (adapter->default_vlan_tag)
+-		flags_transmit |= EDMA_VLAN_TX_TAG_INSERT_DEFAULT_FLAG;
++	if (!adapter->edma_cinfo->is_single_phy) {
++		if (unlikely(skb_vlan_tag_present(skb)))
++			flags_transmit |= EDMA_VLAN_TX_TAG_INSERT_FLAG;
++		else if (adapter->default_vlan_tag)
++			flags_transmit |= EDMA_VLAN_TX_TAG_INSERT_DEFAULT_FLAG;
++	}
+ 
+ 	/* Check and mark checksum offload */
+ 	if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
+--- a/drivers/net/ethernet/qualcomm/essedma/edma.h
++++ b/drivers/net/ethernet/qualcomm/essedma/edma.h
+@@ -31,6 +31,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
++#include <linux/clk.h>
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+ #include <linux/sysctl.h>
+@@ -331,6 +332,10 @@ struct edma_common_info {
+ 	struct edma_hw hw; /* edma hw specific structure */
+ 	struct edma_per_cpu_queues_info edma_percpu_info[CONFIG_NR_CPUS]; /* per cpu information */
+ 	spinlock_t stats_lock; /* protect edma stats area for updation */
++
++	bool is_single_phy;
++	void __iomem *ess_hw_addr;
++	struct clk *ess_clk;
+ };
+ 
+ /* transimit packet descriptor (tpd) ring */
+@@ -443,4 +448,6 @@ void edma_change_tx_coalesce(int usecs);
+ void edma_change_rx_coalesce(int usecs);
+ void edma_get_tx_rx_coalesce(u32 *reg_val);
+ void edma_clear_irq_status(void);
++void ess_set_port_status_speed(struct edma_common_info *edma_cinfo,
++                               struct phy_device *phydev, uint8_t port_id);
+ #endif /* _EDMA_H_ */
+--- a/drivers/net/ethernet/qualcomm/essedma/ess_edma.h
++++ b/drivers/net/ethernet/qualcomm/essedma/ess_edma.h
+@@ -329,4 +329,61 @@ struct edma_hw;
+ #define EDMA_RRD_PRIORITY_MASK 0x7
+ #define EDMA_RRD_PORT_TYPE_SHIFT 7
+ #define EDMA_RRD_PORT_TYPE_MASK 0x1F
++
++#define ESS_RGMII_CTRL		0x0004
++
++/* Port status registers */
++#define ESS_PORT0_STATUS	0x007C
++#define ESS_PORT1_STATUS	0x0080
++#define ESS_PORT2_STATUS	0x0084
++#define ESS_PORT3_STATUS	0x0088
++#define ESS_PORT4_STATUS	0x008C
++#define ESS_PORT5_STATUS	0x0090
++
++#define ESS_PORT_STATUS_HDX_FLOW_CTL	0x80
++#define ESS_PORT_STATUS_DUPLEX_MODE	0x40
++#define ESS_PORT_STATUS_RX_FLOW_EN	0x20
++#define ESS_PORT_STATUS_TX_FLOW_EN	0x10
++#define ESS_PORT_STATUS_RX_MAC_EN	0x08
++#define ESS_PORT_STATUS_TX_MAC_EN	0x04
++#define ESS_PORT_STATUS_SPEED_INV	0x03
++#define ESS_PORT_STATUS_SPEED_1000	0x02
++#define ESS_PORT_STATUS_SPEED_100	0x01
++#define ESS_PORT_STATUS_SPEED_10	0x00
++
++#define ESS_PORT_1G_FDX      (ESS_PORT_STATUS_DUPLEX_MODE | ESS_PORT_STATUS_RX_FLOW_EN | \
++			       ESS_PORT_STATUS_TX_FLOW_EN  | ESS_PORT_STATUS_RX_MAC_EN  | \
++			       ESS_PORT_STATUS_TX_MAC_EN   | ESS_PORT_STATUS_SPEED_1000)
++
++#define PHY_STATUS_REG			0x11
++#define PHY_STATUS_SPEED		0xC000
++#define PHY_STATUS_SPEED_SHIFT		14
++#define PHY_STATUS_DUPLEX		0x2000
++#define PHY_STATUS_DUPLEX_SHIFT	13
++#define PHY_STATUS_SPEED_DUPLEX_RESOLVED 0x0800
++#define PHY_STATUS_CARRIER		0x0400
++#define PHY_STATUS_CARRIER_SHIFT	10
++
++/* Port lookup control registers */
++#define ESS_PORT0_LOOKUP_CTRL	0x0660
++#define ESS_PORT1_LOOKUP_CTRL	0x066C
++#define ESS_PORT2_LOOKUP_CTRL	0x0678
++#define ESS_PORT3_LOOKUP_CTRL	0x0684
++#define ESS_PORT4_LOOKUP_CTRL	0x0690
++#define ESS_PORT5_LOOKUP_CTRL	0x069C
++
++#define ESS_PORT0_HEADER_CTRL	0x009C
++
++#define ESS_PORTS_ALL		0x3f
++
++#define ESS_FWD_CTRL1		0x0624
++#define   ESS_FWD_CTRL1_UC_FLOOD		BITS(0, 7)
++#define   ESS_FWD_CTRL1_UC_FLOOD_S		0
++#define   ESS_FWD_CTRL1_MC_FLOOD		BITS(8, 7)
++#define   ESS_FWD_CTRL1_MC_FLOOD_S		8
++#define   ESS_FWD_CTRL1_BC_FLOOD		BITS(16, 7)
++#define   ESS_FWD_CTRL1_BC_FLOOD_S		16
++#define   ESS_FWD_CTRL1_IGMP			BITS(24, 7)
++#define   ESS_FWD_CTRL1_IGMP_S			24
++
+ #endif /* _ESS_EDMA_H_ */
diff --git a/target/linux/ipq40xx/patches-4.14/820-qcom-ipq4019-Add-IPQ4019-USB-HS-SS-PHY-drivers.patch b/target/linux/ipq40xx/patches-4.14/820-qcom-ipq4019-Add-IPQ4019-USB-HS-SS-PHY-drivers.patch
new file mode 100644
index 000000000..47291fea0
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/820-qcom-ipq4019-Add-IPQ4019-USB-HS-SS-PHY-drivers.patch
@@ -0,0 +1,429 @@
+From e73682ec4455c34f3f3edc7f40d90ed297521012 Mon Sep 17 00:00:00 2001
+From: Senthilkumar N L <snlakshm@codeaurora.org>
+Date: Tue, 6 Jan 2015 12:52:23 +0530
+Subject: [PATCH] qcom: ipq4019: Add IPQ4019 USB HS/SS PHY drivers
+
+These drivers handles control and configuration of the HS
+and SS USB PHY transceivers.
+
+Signed-off-by: Senthilkumar N L <snlakshm@codeaurora.org>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+
+---
+Changed:
+	- replaced spaces with tabs
+	- remove emulation and host variables
+---
+ drivers/usb/phy/Kconfig          |  11 ++
+ drivers/usb/phy/Makefile         |   2 +
+ drivers/usb/phy/phy-qca-baldur.c | 233 +++++++++++++++++++++++++++++++++++++++
+ drivers/usb/phy/phy-qca-uniphy.c | 141 +++++++++++++++++++++++
+ 4 files changed, 387 insertions(+)
+ create mode 100644 drivers/usb/phy/phy-qca-baldur.c
+ create mode 100644 drivers/usb/phy/phy-qca-uniphy.c
+
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -188,6 +188,17 @@ config USB_MXS_PHY
+ 
+ 	  MXS Phy is used by some of the i.MX SoCs, for example imx23/28/6x.
+ 
++config USB_IPQ4019_PHY
++	tristate "IPQ4019 PHY wrappers support"
++	depends on (USB || USB_GADGET) && ARCH_QCOM
++	select USB_PHY
++	help
++	  Enable this to support the USB PHY transceivers on QCA961x chips.
++	  It handles PHY initialization, clock management required after
++	  resetting the hardware and power management.
++	  This driver is required even for peripheral only or host only
++	  mode configurations.
++
+ config USB_ULPI
+ 	bool "Generic ULPI Transceiver Driver"
+ 	depends on ARM || ARM64
+--- a/drivers/usb/phy/Makefile
++++ b/drivers/usb/phy/Makefile
+@@ -21,6 +21,8 @@ obj-$(CONFIG_USB_GPIO_VBUS)		+= phy-gpio
+ obj-$(CONFIG_USB_ISP1301)		+= phy-isp1301.o
+ obj-$(CONFIG_USB_MSM_OTG)		+= phy-msm-usb.o
+ obj-$(CONFIG_USB_QCOM_8X16_PHY)	+= phy-qcom-8x16-usb.o
++obj-$(CONFIG_USB_IPQ4019_PHY)		+= phy-qca-baldur.o
++obj-$(CONFIG_USB_IPQ4019_PHY)		+= phy-qca-uniphy.o
+ obj-$(CONFIG_USB_MV_OTG)		+= phy-mv-usb.o
+ obj-$(CONFIG_USB_MXS_PHY)		+= phy-mxs-usb.o
+ obj-$(CONFIG_USB_ULPI)			+= phy-ulpi.o
+--- /dev/null
++++ b/drivers/usb/phy/phy-qca-baldur.c
+@@ -0,0 +1,233 @@
++/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ *
++ */
++
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
++#include <linux/usb/phy.h>
++#include <linux/reset.h>
++#include <linux/of_device.h>
++
++/**
++ *  USB Hardware registers
++ */
++#define PHY_CTRL0_ADDR	0x000
++#define PHY_CTRL1_ADDR	0x004
++#define PHY_CTRL2_ADDR	0x008
++#define PHY_CTRL3_ADDR	0x00C
++#define PHY_CTRL4_ADDR	0x010
++#define PHY_MISC_ADDR	0x024
++#define PHY_IPG_ADDR	0x030
++
++#define PHY_CTRL0_VAL	0xA4600015
++#define PHY_CTRL1_VAL	0x09500000
++#define PHY_CTRL2_VAL	0x00058180
++#define PHY_CTRL3_VAL	0x6DB6DCD6
++#define PHY_CTRL4_VAL	0x836DB6DB
++#define PHY_MISC_VAL	0x3803FB0C
++#define PHY_IPG_VAL	0x47323232
++
++#define USB30_HS_PHY_HOST_MODE	(0x01 << 21)
++#define USB20_HS_PHY_HOST_MODE	(0x01 << 5)
++
++/* used to differentiate between USB3 HS and USB2 HS PHY */
++struct qca_baldur_hs_data {
++	unsigned int usb3_hs_phy;
++	unsigned int phy_config_offset;
++};
++
++struct qca_baldur_hs_phy {
++	struct device *dev;
++	struct usb_phy phy;
++
++	void __iomem *base;
++	void __iomem *qscratch_base;
++
++	struct reset_control *por_rst;
++	struct reset_control *srif_rst;
++
++	const struct qca_baldur_hs_data *data;
++};
++
++#define phy_to_dw_phy(x) container_of((x), struct qca_baldur_hs_phy, phy)
++
++static int qca_baldur_phy_read(struct usb_phy *x, u32 reg)
++{
++	struct qca_baldur_hs_phy *phy = phy_to_dw_phy(x);
++
++	return readl(phy->base + reg);
++}
++
++static int qca_baldur_phy_write(struct usb_phy *x, u32 val, u32 reg)
++{
++	struct qca_baldur_hs_phy *phy = phy_to_dw_phy(x);
++
++	writel(val, phy->base + reg);
++	return 0;
++}
++
++static int qca_baldur_hs_phy_init(struct usb_phy *x)
++{
++	struct qca_baldur_hs_phy *phy = phy_to_dw_phy(x);
++
++	/* assert HS PHY POR reset */
++	reset_control_assert(phy->por_rst);
++	msleep(10);
++
++	/* assert HS PHY SRIF reset */
++	reset_control_assert(phy->srif_rst);
++	msleep(10);
++
++	/* deassert HS PHY SRIF reset and program HS PHY registers */
++	reset_control_deassert(phy->srif_rst);
++	msleep(10);
++
++	/* perform PHY register writes */
++	writel(PHY_CTRL0_VAL, phy->base + PHY_CTRL0_ADDR);
++	writel(PHY_CTRL1_VAL, phy->base + PHY_CTRL1_ADDR);
++	writel(PHY_CTRL2_VAL, phy->base + PHY_CTRL2_ADDR);
++	writel(PHY_CTRL3_VAL, phy->base + PHY_CTRL3_ADDR);
++	writel(PHY_CTRL4_VAL, phy->base + PHY_CTRL4_ADDR);
++	writel(PHY_MISC_VAL, phy->base + PHY_MISC_ADDR);
++	writel(PHY_IPG_VAL, phy->base + PHY_IPG_ADDR);
++
++	msleep(10);
++
++	/* de-assert USB3 HS PHY POR reset */
++	reset_control_deassert(phy->por_rst);
++
++	return 0;
++}
++
++static int qca_baldur_hs_get_resources(struct qca_baldur_hs_phy *phy)
++{
++	struct platform_device *pdev = to_platform_device(phy->dev);
++	struct resource *res;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	phy->base = devm_ioremap_resource(phy->dev, res);
++	if (IS_ERR(phy->base))
++		return PTR_ERR(phy->base);
++
++	phy->por_rst = devm_reset_control_get(phy->dev, "por_rst");
++	if (IS_ERR(phy->por_rst))
++		return PTR_ERR(phy->por_rst);
++
++	phy->srif_rst = devm_reset_control_get(phy->dev, "srif_rst");
++	if (IS_ERR(phy->srif_rst))
++		return PTR_ERR(phy->srif_rst);
++
++	return 0;
++}
++
++static void qca_baldur_hs_put_resources(struct qca_baldur_hs_phy *phy)
++{
++	reset_control_assert(phy->srif_rst);
++	reset_control_assert(phy->por_rst);
++}
++
++static int qca_baldur_hs_remove(struct platform_device *pdev)
++{
++	struct qca_baldur_hs_phy *phy = platform_get_drvdata(pdev);
++
++	usb_remove_phy(&phy->phy);
++	return 0;
++}
++
++static void qca_baldur_hs_phy_shutdown(struct usb_phy *x)
++{
++	struct qca_baldur_hs_phy *phy = phy_to_dw_phy(x);
++
++	qca_baldur_hs_put_resources(phy);
++}
++
++static struct usb_phy_io_ops qca_baldur_io_ops = {
++	.read = qca_baldur_phy_read,
++	.write = qca_baldur_phy_write,
++};
++
++static const struct qca_baldur_hs_data usb3_hs_data = {
++	.usb3_hs_phy = 1,
++	.phy_config_offset = USB30_HS_PHY_HOST_MODE,
++};
++
++static const struct qca_baldur_hs_data usb2_hs_data = {
++	.usb3_hs_phy = 0,
++	.phy_config_offset = USB20_HS_PHY_HOST_MODE,
++};
++
++static const struct of_device_id qca_baldur_hs_id_table[] = {
++	{ .compatible = "qca,baldur-usb3-hsphy", .data = &usb3_hs_data },
++	{ .compatible = "qca,baldur-usb2-hsphy", .data = &usb2_hs_data },
++	{ /* Sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, qca_baldur_hs_id_table);
++
++static int qca_baldur_hs_probe(struct platform_device *pdev)
++{
++	const struct of_device_id *match;
++	struct qca_baldur_hs_phy *phy;
++	int err;
++
++	match = of_match_device(qca_baldur_hs_id_table, &pdev->dev);
++	if (!match)
++		return -ENODEV;
++
++	phy = devm_kzalloc(&pdev->dev, sizeof(*phy), GFP_KERNEL);
++	if (!phy)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, phy);
++	phy->dev = &pdev->dev;
++
++	phy->data = match->data;
++
++	err = qca_baldur_hs_get_resources(phy);
++	if (err < 0) {
++		dev_err(&pdev->dev, "failed to request resources: %d\n", err);
++		return err;
++	}
++
++	phy->phy.dev = phy->dev;
++	phy->phy.label = "qca-baldur-hsphy";
++	phy->phy.init = qca_baldur_hs_phy_init;
++	phy->phy.shutdown = qca_baldur_hs_phy_shutdown;
++	phy->phy.type = USB_PHY_TYPE_USB2;
++	phy->phy.io_ops = &qca_baldur_io_ops;
++
++	err = usb_add_phy_dev(&phy->phy);
++	return err;
++}
++
++static struct platform_driver qca_baldur_hs_driver = {
++	.probe		= qca_baldur_hs_probe,
++	.remove		= qca_baldur_hs_remove,
++	.driver		= {
++		.name	= "qca-baldur-hsphy",
++		.owner	= THIS_MODULE,
++		.of_match_table = qca_baldur_hs_id_table,
++	},
++};
++
++module_platform_driver(qca_baldur_hs_driver);
++
++MODULE_ALIAS("platform:qca-baldur-hsphy");
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_DESCRIPTION("USB3 QCA BALDUR HSPHY driver");
+--- /dev/null
++++ b/drivers/usb/phy/phy-qca-uniphy.c
+@@ -0,0 +1,135 @@
++/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ *
++ */
++
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
++#include <linux/usb/phy.h>
++#include <linux/reset.h>
++#include <linux/of_device.h>
++
++struct qca_uni_ss_phy {
++	struct usb_phy phy;
++	struct device *dev;
++
++	void __iomem *base;
++
++	struct reset_control *por_rst;
++};
++
++#define phy_to_dw_phy(x) container_of((x), struct qca_uni_ss_phy, phy)
++
++static void qca_uni_ss_phy_shutdown(struct usb_phy *x)
++{
++	struct qca_uni_ss_phy *phy = phy_to_dw_phy(x);
++
++	/* assert SS PHY POR reset */
++	reset_control_assert(phy->por_rst);
++}
++
++static int qca_uni_ss_phy_init(struct usb_phy *x)
++{
++	struct qca_uni_ss_phy *phy = phy_to_dw_phy(x);
++
++	/* assert SS PHY POR reset */
++	reset_control_assert(phy->por_rst);
++
++	msleep(20);
++
++	/* deassert SS PHY POR reset */
++	reset_control_deassert(phy->por_rst);
++
++	return 0;
++}
++
++static int qca_uni_ss_get_resources(struct platform_device *pdev,
++		struct qca_uni_ss_phy *phy)
++{
++	struct resource *res;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	phy->base = devm_ioremap_resource(phy->dev, res);
++	if (IS_ERR(phy->base))
++		return PTR_ERR(phy->base);
++
++	phy->por_rst = devm_reset_control_get(phy->dev, "por_rst");
++	if (IS_ERR(phy->por_rst))
++		return PTR_ERR(phy->por_rst);
++
++	return 0;
++}
++
++static int qca_uni_ss_remove(struct platform_device *pdev)
++{
++	struct qca_uni_ss_phy *phy = platform_get_drvdata(pdev);
++
++	usb_remove_phy(&phy->phy);
++	return 0;
++}
++
++static const struct of_device_id qca_uni_ss_id_table[] = {
++	{ .compatible = "qca,uni-ssphy" },
++	{ /* Sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, qca_uni_ss_id_table);
++
++static int qca_uni_ss_probe(struct platform_device *pdev)
++{
++	struct qca_uni_ss_phy *phy;
++	int ret;
++
++	phy = devm_kzalloc(&pdev->dev, sizeof(*phy), GFP_KERNEL);
++	if (!phy)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, phy);
++	phy->dev = &pdev->dev;
++
++	ret = qca_uni_ss_get_resources(pdev, phy);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "failed to request resources: %d\n", ret);
++		return ret;
++	}
++
++	phy->phy.dev = phy->dev;
++	phy->phy.label = "qca-uni-ssphy";
++	phy->phy.init = qca_uni_ss_phy_init;
++	phy->phy.shutdown = qca_uni_ss_phy_shutdown;
++	phy->phy.type = USB_PHY_TYPE_USB3;
++
++	ret = usb_add_phy_dev(&phy->phy);
++	return ret;
++}
++
++static struct platform_driver qca_uni_ss_driver = {
++	.probe = qca_uni_ss_probe,
++	.remove	= qca_uni_ss_remove,
++	.driver = {
++		.name = "qca-uni-ssphy",
++		.owner = THIS_MODULE,
++		.of_match_table = qca_uni_ss_id_table,
++	},
++};
++
++module_platform_driver(qca_uni_ss_driver);
++
++MODULE_ALIAS("platform:qca-uni-ssphy");
++MODULE_LICENSE("Dual BSD/GPL");
++MODULE_DESCRIPTION("USB3 QCA UNI SSPHY driver");
diff --git a/target/linux/ipq40xx/patches-4.14/830-usb-dwc3-register-qca-ipq4019-dwc3-in-dwc3-of-simple.patch b/target/linux/ipq40xx/patches-4.14/830-usb-dwc3-register-qca-ipq4019-dwc3-in-dwc3-of-simple.patch
new file mode 100644
index 000000000..e9b33446d
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/830-usb-dwc3-register-qca-ipq4019-dwc3-in-dwc3-of-simple.patch
@@ -0,0 +1,25 @@
+From 08c18ab774368feb610d1eb952957bb1bb35129f Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sat, 19 Nov 2016 00:52:35 +0100
+Subject: [PATCH 37/38] usb: dwc3: register qca,ipq4019-dwc3 in dwc3-of-simple
+
+For host mode, the dwc3 found in the IPQ4019 can be driven
+by the dwc3-of-simple module. It will get more tricky for
+OTG since they'll need to enable VBUS and reconfigure the
+registers.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+ drivers/usb/dwc3/dwc3-of-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -176,6 +176,7 @@ static const struct dev_pm_ops dwc3_of_s
+ 
+ static const struct of_device_id of_dwc3_simple_match[] = {
+ 	{ .compatible = "qcom,dwc3" },
++	{ .compatible = "qca,ipq4019-dwc3" },
+ 	{ .compatible = "rockchip,rk3399-dwc3" },
+ 	{ .compatible = "xlnx,zynqmp-dwc3" },
+ 	{ .compatible = "cavium,octeon-7130-usb-uctl" },
diff --git a/target/linux/ipq40xx/patches-4.14/850-soc-add-qualcomm-syscon.patch b/target/linux/ipq40xx/patches-4.14/850-soc-add-qualcomm-syscon.patch
new file mode 100644
index 000000000..59e277c34
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/850-soc-add-qualcomm-syscon.patch
@@ -0,0 +1,177 @@
+From: Christian Lamparter <chunkeey@googlemail.com>
+Subject: SoC: add qualcomm syscon
+--- a/drivers/soc/qcom/Makefile
++++ b/drivers/soc/qcom/Makefile
+@@ -9,3 +9,4 @@ obj-$(CONFIG_QCOM_SMEM_STATE) += smem_st
+ obj-$(CONFIG_QCOM_SMP2P)	+= smp2p.o
+ obj-$(CONFIG_QCOM_SMSM)	+= smsm.o
+ obj-$(CONFIG_QCOM_WCNSS_CTRL) += wcnss_ctrl.o
++obj-$(CONFIG_QCOM_TCSR)	 += qcom_tcsr.o
+--- a/drivers/soc/qcom/Kconfig
++++ b/drivers/soc/qcom/Kconfig
+@@ -78,6 +78,13 @@ config QCOM_SMSM
+ 	  Say yes here to support the Qualcomm Shared Memory State Machine.
+ 	  The state machine is represented by bits in shared memory.
+ 
++config QCOM_TCSR
++	tristate "QCOM Top Control and Status Registers"
++	depends on ARCH_QCOM
++	help
++	  Say y here to enable TCSR support.  The TCSR provides control
++	  functions for various peripherals.
++
+ config QCOM_WCNSS_CTRL
+ 	tristate "Qualcomm WCNSS control driver"
+ 	depends on ARCH_QCOM
+--- /dev/null
++++ b/drivers/soc/qcom/qcom_tcsr.c
+@@ -0,0 +1,98 @@
++/*
++ * Copyright (c) 2014, The Linux foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License rev 2 and
++ * only rev 2 as published by the free Software foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or fITNESS fOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/clk.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++
++#define TCSR_USB_PORT_SEL	0xb0
++#define TCSR_USB_HSPHY_CONFIG	0xC
++
++#define TCSR_ESS_INTERFACE_SEL_OFFSET   0x0
++#define TCSR_ESS_INTERFACE_SEL_MASK     0xf
++
++#define TCSR_WIFI0_GLB_CFG_OFFSET	0x0
++#define TCSR_WIFI1_GLB_CFG_OFFSET	0x4
++#define TCSR_PNOC_SNOC_MEMTYPE_M0_M2	0x4
++
++static int tcsr_probe(struct platform_device *pdev)
++{
++	struct resource *res;
++	const struct device_node *node = pdev->dev.of_node;
++	void __iomem *base;
++	u32 val;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	base = devm_ioremap_resource(&pdev->dev, res);
++	if (IS_ERR(base))
++		return PTR_ERR(base);
++
++	if (!of_property_read_u32(node, "qcom,usb-ctrl-select", &val)) {
++		dev_err(&pdev->dev, "setting usb port select = %d\n", val);
++		writel(val, base + TCSR_USB_PORT_SEL);
++	}
++
++	if (!of_property_read_u32(node, "qcom,usb-hsphy-mode-select", &val)) {
++		dev_info(&pdev->dev, "setting usb hs phy mode select = %x\n", val);
++		writel(val, base + TCSR_USB_HSPHY_CONFIG);
++	}
++
++	if (!of_property_read_u32(node, "qcom,ess-interface-select", &val)) {
++		u32 tmp = 0;
++		dev_info(&pdev->dev, "setting ess interface select = %x\n", val);
++		tmp = readl(base + TCSR_ESS_INTERFACE_SEL_OFFSET);
++		tmp = tmp & (~TCSR_ESS_INTERFACE_SEL_MASK);
++		tmp = tmp | (val&TCSR_ESS_INTERFACE_SEL_MASK);
++		writel(tmp, base + TCSR_ESS_INTERFACE_SEL_OFFSET);
++        }
++
++	if (!of_property_read_u32(node, "qcom,wifi_glb_cfg", &val)) {
++		dev_info(&pdev->dev, "setting wifi_glb_cfg = %x\n", val);
++		writel(val, base + TCSR_WIFI0_GLB_CFG_OFFSET);
++		writel(val, base + TCSR_WIFI1_GLB_CFG_OFFSET);
++	}
++
++	if (!of_property_read_u32(node, "qcom,wifi_noc_memtype_m0_m2", &val)) {
++		dev_info(&pdev->dev,
++			"setting wifi_noc_memtype_m0_m2 = %x\n", val);
++		writel(val, base + TCSR_PNOC_SNOC_MEMTYPE_M0_M2);
++	}
++
++	return 0;
++}
++
++static const struct of_device_id tcsr_dt_match[] = {
++	{ .compatible = "qcom,tcsr", },
++	{ },
++};
++
++MODULE_DEVICE_TABLE(of, tcsr_dt_match);
++
++static struct platform_driver tcsr_driver = {
++	.driver = {
++		.name		= "tcsr",
++		.owner		= THIS_MODULE,
++		.of_match_table	= tcsr_dt_match,
++	},
++	.probe = tcsr_probe,
++};
++
++module_platform_driver(tcsr_driver);
++
++MODULE_AUTHOR("Andy Gross <agross@codeaurora.org>");
++MODULE_DESCRIPTION("QCOM TCSR driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/include/dt-bindings/soc/qcom,tcsr.h
+@@ -0,0 +1,48 @@
++/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 and
++ * only version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++#ifndef __DT_BINDINGS_QCOM_TCSR_H
++#define __DT_BINDINGS_QCOM_TCSR_H
++
++#define TCSR_USB_SELECT_USB3_P0		0x1
++#define TCSR_USB_SELECT_USB3_P1		0x2
++#define TCSR_USB_SELECT_USB3_DUAL	0x3
++
++/* IPQ40xx HS PHY Mode Select */
++#define TCSR_USB_HSPHY_HOST_MODE	0x00E700E7
++#define TCSR_USB_HSPHY_DEVICE_MODE	0x00C700E7
++
++/* IPQ40xx ess interface mode select */
++#define TCSR_ESS_PSGMII              0
++#define TCSR_ESS_PSGMII_RGMII5       1
++#define TCSR_ESS_PSGMII_RMII0        2
++#define TCSR_ESS_PSGMII_RMII1        4
++#define TCSR_ESS_PSGMII_RMII0_RMII1  6
++#define TCSR_ESS_PSGMII_RGMII4       9
++
++/*
++ * IPQ40xx WiFi Global Config
++ * Bit 30:AXID_EN
++ * Enable AXI master bus Axid translating to confirm all txn submitted by order
++ * Bit 24: Use locally generated socslv_wxi_bvalid
++ * 1:  use locally generate socslv_wxi_bvalid for performance.
++ * 0:  use SNOC socslv_wxi_bvalid.
++ */
++#define TCSR_WIFI_GLB_CFG		0x41000000
++
++/* IPQ40xx MEM_TYPE_SEL_M0_M2 Select Bit 26:24 - 2 NORMAL */
++#define TCSR_WIFI_NOC_MEMTYPE_M0_M2	0x02222222
++
++/* TCSR A/B REG */
++#define IPQ806X_TCSR_REG_A_ADM_CRCI_MUX_SEL     0
++#define IPQ806X_TCSR_REG_B_ADM_CRCI_MUX_SEL     1
++
++#endif
diff --git a/target/linux/ipq40xx/patches-4.14/864-03-dts-ipq4019-ap-dk01-add-tcsr-config-to-dtsi.patch b/target/linux/ipq40xx/patches-4.14/864-03-dts-ipq4019-ap-dk01-add-tcsr-config-to-dtsi.patch
new file mode 100644
index 000000000..f17176061
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/864-03-dts-ipq4019-ap-dk01-add-tcsr-config-to-dtsi.patch
@@ -0,0 +1,42 @@
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi
+@@ -15,12 +15,39 @@
+  */
+ 
+ #include "qcom-ipq4019.dtsi"
++#include <dt-bindings/soc/qcom,tcsr.h>
+ 
+ / {
+ 	model = "Qualcomm Technologies, Inc. IPQ4019/AP-DK01.1";
+ 	compatible = "qcom,ipq4019";
+ 
+ 	soc {
++		tcsr@194b000 {
++			/* select hostmode */
++			compatible = "qcom,tcsr";
++			reg = <0x194b000 0x100>;
++			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
++			status = "ok";
++		};
++
++		ess_tcsr@1953000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1953000 0x1000>;
++			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
++		};
++
++		tcsr@1949000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1949000 0x100>;
++			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
++		};
++
++		tcsr@1957000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1957000 0x100>;
++			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
++		};
++
+ 		rng@22000 {
+ 			status = "ok";
+ 		};
diff --git a/target/linux/ipq40xx/patches-4.14/864-05-dts-ipq4019-ap-dk01-remove-spi-chip-node-from-dtsi.patch b/target/linux/ipq40xx/patches-4.14/864-05-dts-ipq4019-ap-dk01-remove-spi-chip-node-from-dtsi.patch
new file mode 100644
index 000000000..5cbb79cb1
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/864-05-dts-ipq4019-ap-dk01-remove-spi-chip-node-from-dtsi.patch
@@ -0,0 +1,17 @@
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1.dtsi
+@@ -93,14 +93,6 @@
+ 			pinctrl-names = "default";
+ 			status = "ok";
+ 			cs-gpios = <&tlmm 54 0>;
+-
+-			mx25l25635e@0 {
+-				#address-cells = <1>;
+-				#size-cells = <1>;
+-				reg = <0>;
+-				compatible = "mx25l25635e";
+-				spi-max-frequency = <24000000>;
+-			};
+ 		};
+ 
+ 		serial@78af000 {
diff --git a/target/linux/ipq40xx/patches-4.14/864-07-dts-ipq4019-ap-dk01.1-c1-add-spi-and-ram-nodes.patch b/target/linux/ipq40xx/patches-4.14/864-07-dts-ipq4019-ap-dk01.1-c1-add-spi-and-ram-nodes.patch
new file mode 100644
index 000000000..e9d262069
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/864-07-dts-ipq4019-ap-dk01.1-c1-add-spi-and-ram-nodes.patch
@@ -0,0 +1,115 @@
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1-c1.dts
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1-c1.dts
+@@ -19,4 +19,112 @@
+ / {
+ 	model = "Qualcomm Technologies, Inc. IPQ40xx/AP-DK01.1-C1";
+ 
++	memory {
++		device_type = "memory";
++		reg = <0x80000000 0x10000000>;
++	};
++
++	reserved-memory {
++		#address-cells = <0x1>;
++		#size-cells = <0x1>;
++		ranges;
++
++		apps_bl@87000000 {
++			reg = <0x87000000 0x400000>;
++			no-map;
++		};
++
++		sbl@87400000 {
++			reg = <0x87400000 0x100000>;
++			no-map;
++		};
++
++		cnss_debug@87500000 {
++			reg = <0x87500000 0x600000>;
++			no-map;
++		};
++
++		cpu_context_dump@87b00000 {
++			reg = <0x87b00000 0x080000>;
++			no-map;
++		};
++
++		tz_apps@87b80000 {
++			reg = <0x87b80000 0x280000>;
++			no-map;
++		};
++
++		smem@87e00000 {
++			reg = <0x87e00000 0x080000>;
++			no-map;
++		};
++
++		tz@87e80000 {
++			reg = <0x87e80000 0x180000>;
++			no-map;
++		};
++	};
++};
++
++&spi_0 {
++	mx25l25635f@0 {
++		compatible = "mx25l25635f", "jedec,spi-nor";
++		#address-cells = <1>;
++		#size-cells = <1>;
++		reg = <0>;
++		spi-max-frequency = <24000000>;
++
++		SBL1@0 {
++			label = "SBL1";
++			reg = <0x0 0x40000>;
++			read-only;
++		};
++		MIBIB@40000 {
++			label = "MIBIB";
++			reg = <0x40000 0x20000>;
++			read-only;
++		};
++		QSEE@60000 {
++			label = "QSEE";
++			reg = <0x60000 0x60000>;
++			read-only;
++		};
++		CDT@c0000 {
++			label = "CDT";
++			reg = <0xc0000 0x10000>;
++			read-only;
++		};
++		DDRPARAMS@d0000 {
++			label = "DDRPARAMS";
++			reg = <0xd0000 0x10000>;
++			read-only;
++		};
++		APPSBLENV@e0000 {
++			label = "APPSBLENV";
++			reg = <0xe0000 0x10000>;
++			read-only;
++		};
++		APPSBL@f0000 {
++			label = "APPSBL";
++			reg = <0xf0000 0x80000>;
++			read-only;
++		};
++		ART@170000 {
++			label = "ART";
++			reg = <0x170000 0x10000>;
++			read-only;
++		};
++		kernel@180000 {
++			label = "kernel";
++			reg = <0x180000 0x400000>;
++		};
++		rootfs@580000 {
++			label = "rootfs";
++			reg = <0x580000 0x1600000>;
++		};
++		firmware@180000 {
++			label = "firmware";
++			reg = <0x180000 0x1a00000>;
++		};
++	};
+ };
diff --git a/target/linux/ipq40xx/patches-4.14/864-08-dts-ipq4019-ap-dk01.1-c1-add-compatible-string.patch b/target/linux/ipq40xx/patches-4.14/864-08-dts-ipq4019-ap-dk01.1-c1-add-compatible-string.patch
new file mode 100644
index 000000000..2d4ff3104
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/864-08-dts-ipq4019-ap-dk01.1-c1-add-compatible-string.patch
@@ -0,0 +1,10 @@
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1-c1.dts
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk01.1-c1.dts
+@@ -18,6 +18,7 @@
+ 
+ / {
+ 	model = "Qualcomm Technologies, Inc. IPQ40xx/AP-DK01.1-C1";
++	compatible = "qcom,ap-dk01.1-c1", "qcom,ap-dk01.2-c1", "qcom,ipq4019";
+ 
+ 	memory {
+ 		device_type = "memory";
diff --git a/target/linux/ipq40xx/patches-4.14/900-clk-fix.patch b/target/linux/ipq40xx/patches-4.14/900-clk-fix.patch
new file mode 100644
index 000000000..1c6b8c831
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/900-clk-fix.patch
@@ -0,0 +1,111 @@
+From 12e9319da1adacac92930c899c99f0e1970cac11 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 11 Mar 2018 14:41:31 +0100
+Subject: [PATCH] clk: fix apss cpu overclocking
+
+There's an interaction issue between the clk changes:"
+clk: qcom: ipq4019: Add the apss cpu pll divider clock node
+clk: qcom: ipq4019: remove fixed clocks and add pll clocks
+" and the cpufreq-dt.
+
+cpufreq-dt is now spamming the kernel-log with the following:
+
+[ 1099.190658] cpu cpu0: dev_pm_opp_set_rate: failed to find current OPP
+for freq 761142857 (-34)
+
+This only happens on certain devices like the Compex WPJ428
+and AVM FritzBox!4040. However, other devices like the Asus
+RT-AC58U and Meraki MR33 work just fine.
+
+The issue stem from the fact that all higher CPU-Clocks
+are achieved by switching the clock-parent to the P_DDRPLLAPSS
+(ddrpllapss). Which is set by Qualcomm's proprietary bootcode
+as part of the DDR calibration.
+
+For example, the FB4040 uses 256 MiB Nanya NT5CC128M16IP clocked
+at round 533 MHz (ddrpllsdcc = 190285714 Hz).
+
+whereas the 128 MiB Nanya NT5CC64M16GP-DI in the ASUS RT-AC58U is
+clocked at a slightly higher 537 MHz ( ddrpllsdcc = 192000000 Hz).
+
+This patch attempts to fix the issue by modifying
+clk_cpu_div_round_rate(), clk_cpu_div_set_rate(), clk_cpu_div_recalc_rate()
+to use a new qcom_find_freq_close() function, which returns the closest
+matching frequency, instead of the next higher. This way, the SoC in
+the FB4040 (with its max clock speed of 710.4 MHz) will no longer
+try to overclock to 761 MHz.
+
+Fixes: d83dcacea18 ("clk: qcom: ipq4019: Add the apss cpu pll divider clock node")
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+--- a/drivers/clk/qcom/gcc-ipq4019.c
++++ b/drivers/clk/qcom/gcc-ipq4019.c
+@@ -1253,6 +1253,29 @@ static const struct clk_fepll_vco gcc_fe
+ 	.reg = 0x2f020,
+ };
+ 
++
++const struct freq_tbl *qcom_find_freq_close(const struct freq_tbl *f,
++					     unsigned long rate)
++{
++	const struct freq_tbl *last = NULL;
++
++	for ( ; f->freq; f++) {
++		if (rate == f->freq)
++			return f;
++
++		if (f->freq > rate) {
++			if (!last ||
++			   (f->freq - rate) < (rate - last->freq))
++				return f;
++			else
++				return last;
++		}
++		last = f;
++	}
++
++	return last;
++}
++
+ /*
+  * Round rate function for APSS CPU PLL Clock divider.
+  * It looks up the frequency table and returns the next higher frequency
+@@ -1265,7 +1288,7 @@ static long clk_cpu_div_round_rate(struc
+ 	struct clk_hw *p_hw;
+ 	const struct freq_tbl *f;
+ 
+-	f = qcom_find_freq(pll->freq_tbl, rate);
++	f = qcom_find_freq_close(pll->freq_tbl, rate);
+ 	if (!f)
+ 		return -EINVAL;
+ 
+@@ -1288,7 +1311,7 @@ static int clk_cpu_div_set_rate(struct c
+ 	u32 mask;
+ 	int ret;
+ 
+-	f = qcom_find_freq(pll->freq_tbl, rate);
++	f = qcom_find_freq_close(pll->freq_tbl, rate);
+ 	if (!f)
+ 		return -EINVAL;
+ 
+@@ -1315,6 +1338,7 @@ static unsigned long
+ clk_cpu_div_recalc_rate(struct clk_hw *hw,
+ 			unsigned long parent_rate)
+ {
++	const struct freq_tbl *f;
+ 	struct clk_fepll *pll = to_clk_fepll(hw);
+ 	u32 cdiv, pre_div;
+ 	u64 rate;
+@@ -1335,7 +1359,11 @@ clk_cpu_div_recalc_rate(struct clk_hw *h
+ 	rate = clk_fepll_vco_calc_rate(pll, parent_rate) * 2;
+ 	do_div(rate, pre_div);
+ 
+-	return rate;
++	f = qcom_find_freq_close(pll->freq_tbl, rate);
++	if (!f)
++		return rate;
++
++	return f->freq;
+ };
+ 
+ static const struct clk_ops clk_regmap_cpu_div_ops = {
diff --git a/target/linux/ipq40xx/profiles/00-default.mk b/target/linux/ipq40xx/profiles/00-default.mk
new file mode 100644
index 000000000..f6ded8544
--- /dev/null
+++ b/target/linux/ipq40xx/profiles/00-default.mk
@@ -0,0 +1,9 @@
+define Profile/Default
+  NAME:=Default Profile
+  PRIORITY:=1
+endef
+
+define Profile/Default/Description
+	Default package set compatible with most boards.
+endef
+$(eval $(call Profile,Default))
diff --git a/target/linux/ipq806x/modules.mk b/target/linux/ipq806x/modules.mk
index 9943bdf35..b36b2d7e3 100644
--- a/target/linux/ipq806x/modules.mk
+++ b/target/linux/ipq806x/modules.mk
@@ -1,35 +1,3 @@
-define KernelPackage/usb-dwc3-of-simple
-  TITLE:=DWC3 USB simple OF driver
-  DEPENDS:=+kmod-usb-dwc3
-  KCONFIG:= CONFIG_USB_DWC3_OF_SIMPLE
-  FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-of-simple.ko
-  AUTOLOAD:=$(call AutoLoad,53,dwc3-of-simple,1)
-  $(call AddDepends/usb)
-endef
-
-define KernelPackage/usb-dwc3-of-simple/description
- This driver provides generic platform glue for the integrated DesignWare
- USB3 IP Core.
-endef
-
-$(eval $(call KernelPackage,usb-dwc3-of-simple))
-
-define KernelPackage/usb-phy-qcom-dwc3
-  TITLE:=DWC3 USB QCOM PHY driver
-  DEPENDS:=@TARGET_ipq806x +kmod-usb-dwc3-of-simple
-  KCONFIG:= CONFIG_PHY_QCOM_DWC3
-  FILES:= $(LINUX_DIR)/drivers/phy/phy-qcom-dwc3.ko
-  AUTOLOAD:=$(call AutoLoad,45,phy-qcom-dwc3,1)
-  $(call AddDepends/usb)
-endef
-
-define KernelPackage/usb-phy-qcom-dwc3/description
- This driver provides support for the integrated DesignWare
- USB3 IP Core within the QCOM SoCs.
-endef
-
-$(eval $(call KernelPackage,usb-phy-qcom-dwc3))
-
 define KernelPackage/usb-phy-qcom-ipq4019
   TITLE:=IPQ4019 PHY wrappers support
   DEPENDS:=+kmod-usb-dwc3
diff --git a/target/linux/omap24xx/modules.mk b/target/linux/omap24xx/modules.mk
index 6a6829ddf..6b7e85d79 100644
--- a/target/linux/omap24xx/modules.mk
+++ b/target/linux/omap24xx/modules.mk
@@ -70,7 +70,7 @@ define KernelPackage/usb-tahvo
 	CONFIG_TAHVO_USB_HOST_BY_DEFAULT=n \
 	CONFIG_USB_OHCI_HCD_OMAP1=y \
 	CONFIG_USB_GADGET_DEBUG_FS=n
-  DEPENDS:=@TARGET_omap24xx +kmod-usb-musb-tusb6010
+  DEPENDS:=@TARGET_omap24xx
   FILES:=$(LINUX_DIR)/drivers/usb/phy/phy-tahvo.ko
   AUTOLOAD:=$(call AutoLoad,45,phy-tahvo)
   $(call AddDepends/usb)