diff --git a/target/linux/brcm47xx/patches-3.18/035-MIPS-BCM47XX-Use-mtd-as-an-alternative-way-API-to-ge.patch b/target/linux/brcm47xx/patches-3.18/035-MIPS-BCM47XX-Use-mtd-as-an-alternative-way-API-to-ge.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7f19d3ac65dc3a3d440538eca8708673aaa96e93
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/035-MIPS-BCM47XX-Use-mtd-as-an-alternative-way-API-to-ge.patch
@@ -0,0 +1,88 @@
+From 9d1d08646af4491aec41d40341930b9bfd62ffa9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 29 Oct 2014 10:05:06 +0100
+Subject: [PATCH] MIPS: BCM47XX: Use mtd as an alternative way/API to get NVRAM
+ content
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+NVRAM can be read using magic memory offset, but after all it's just a
+flash partition. On platforms where NVRAM isn't needed early we can get
+it using mtd subsystem.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8266/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 42 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index 21712fb..8b64991 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -13,12 +13,10 @@
+ 
+ #include <linux/types.h>
+ #include <linux/module.h>
+-#include <linux/ssb/ssb.h>
+ #include <linux/kernel.h>
+ #include <linux/string.h>
+-#include <asm/addrspace.h>
++#include <linux/mtd/mtd.h>
+ #include <bcm47xx_nvram.h>
+-#include <asm/mach-bcm47xx/bcm47xx.h>
+ 
+ static char nvram_buf[NVRAM_SPACE];
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+@@ -123,7 +121,43 @@ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ 
+ static int nvram_init(void)
+ {
+-	/* TODO: Look for MTD "nvram" partition */
++#ifdef CONFIG_MTD
++	struct mtd_info *mtd;
++	struct nvram_header header;
++	size_t bytes_read;
++	int err, i;
++
++	mtd = get_mtd_device_nm("nvram");
++	if (IS_ERR(mtd))
++		return -ENODEV;
++
++	for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
++		loff_t from = mtd->size - nvram_sizes[i];
++
++		if (from < 0)
++			continue;
++
++		err = mtd_read(mtd, from, sizeof(header), &bytes_read,
++			       (uint8_t *)&header);
++		if (!err && header.magic == NVRAM_HEADER) {
++			u8 *dst = (uint8_t *)nvram_buf;
++			size_t len = header.len;
++
++			if (header.len > NVRAM_SPACE) {
++				pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++				       header.len, NVRAM_SPACE);
++				len = NVRAM_SPACE;
++			}
++
++			err = mtd_read(mtd, from, len, &bytes_read, dst);
++			if (err)
++				return err;
++			memset(dst + bytes_read, 0x0, NVRAM_SPACE - bytes_read);
++
++			return 0;
++		}
++	}
++#endif
+ 
+ 	return -ENXIO;
+ }
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/036-MIPS-BCM47XX-Clean-up-nvram-header.patch b/target/linux/brcm47xx/patches-3.18/036-MIPS-BCM47XX-Clean-up-nvram-header.patch
new file mode 100644
index 0000000000000000000000000000000000000000..b4a07919b7524401d1cc0925967205b0007b5d08
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/036-MIPS-BCM47XX-Clean-up-nvram-header.patch
@@ -0,0 +1,167 @@
+From 341097f17c76b3dd39539526a2af9e7fff43705e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 30 Oct 2014 12:50:03 +0100
+Subject: [PATCH] MIPS: BCM47XX: Clean up nvram header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1) Move private defines to the .c file
+2) Move SPROM helper to the sprom.c
+3) Drop unused code
+4) Rename magic to the NVRAM_MAGIC
+5) Add const to the char pointer we never modify
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8289/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c                          | 23 ++++++++++----
+ arch/mips/bcm47xx/sprom.c                          | 14 +++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h | 35 +---------------------
+ 3 files changed, 33 insertions(+), 39 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index 8b64991..c5c381c 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -18,6 +18,19 @@
+ #include <linux/mtd/mtd.h>
+ #include <bcm47xx_nvram.h>
+ 
++#define NVRAM_MAGIC		0x48534C46	/* 'FLSH' */
++#define NVRAM_SPACE		0x8000
++
++#define FLASH_MIN		0x00020000	/* Minimum flash size */
++
++struct nvram_header {
++	u32 magic;
++	u32 len;
++	u32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:31 sdram_init */
++	u32 config_refresh;	/* 0:15 sdram_config, 16:31 sdram_refresh */
++	u32 config_ncdl;	/* ncdl values for memc */
++};
++
+ static char nvram_buf[NVRAM_SPACE];
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+@@ -28,7 +41,7 @@ static u32 find_nvram_size(void __iomem *end)
+ 
+ 	for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
+ 		header = (struct nvram_header *)(end - nvram_sizes[i]);
+-		if (header->magic == NVRAM_HEADER)
++		if (header->magic == NVRAM_MAGIC)
+ 			return nvram_sizes[i];
+ 	}
+ 
+@@ -63,13 +76,13 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
+ 
+ 	/* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
+ 	header = (struct nvram_header *)(iobase + 4096);
+-	if (header->magic == NVRAM_HEADER) {
++	if (header->magic == NVRAM_MAGIC) {
+ 		size = NVRAM_SPACE;
+ 		goto found;
+ 	}
+ 
+ 	header = (struct nvram_header *)(iobase + 1024);
+-	if (header->magic == NVRAM_HEADER) {
++	if (header->magic == NVRAM_MAGIC) {
+ 		size = NVRAM_SPACE;
+ 		goto found;
+ 	}
+@@ -139,7 +152,7 @@ static int nvram_init(void)
+ 
+ 		err = mtd_read(mtd, from, sizeof(header), &bytes_read,
+ 			       (uint8_t *)&header);
+-		if (!err && header.magic == NVRAM_HEADER) {
++		if (!err && header.magic == NVRAM_MAGIC) {
+ 			u8 *dst = (uint8_t *)nvram_buf;
+ 			size_t len = header.len;
+ 
+@@ -162,7 +175,7 @@ static int nvram_init(void)
+ 	return -ENXIO;
+ }
+ 
+-int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len)
++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+ 	int err;
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index e772e77..2eff7fe 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -136,6 +136,20 @@ static void nvram_read_leddc(const char *prefix, const char *name,
+ 	*leddc_off_time = (val >> 16) & 0xff;
+ }
+ 
++static void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
++{
++	if (strchr(buf, ':'))
++		sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &macaddr[0],
++			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
++			&macaddr[5]);
++	else if (strchr(buf, '-'))
++		sscanf(buf, "%hhx-%hhx-%hhx-%hhx-%hhx-%hhx", &macaddr[0],
++			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
++			&macaddr[5]);
++	else
++		pr_warn("Can not parse mac address: %s\n", buf);
++}
++
+ static void nvram_read_macaddr(const char *prefix, const char *name,
+ 			       u8 val[6], bool fallback)
+ {
+diff --git a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+index 676be22..ee59ffe 100644
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+@@ -14,41 +14,8 @@
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ 
+-struct nvram_header {
+-	u32 magic;
+-	u32 len;
+-	u32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:31 sdram_init */
+-	u32 config_refresh;	/* 0:15 sdram_config, 16:31 sdram_refresh */
+-	u32 config_ncdl;	/* ncdl values for memc */
+-};
+-
+-#define NVRAM_HEADER		0x48534C46	/* 'FLSH' */
+-#define NVRAM_VERSION		1
+-#define NVRAM_HEADER_SIZE	20
+-#define NVRAM_SPACE		0x8000
+-
+-#define FLASH_MIN		0x00020000	/* Minimum flash size */
+-
+-#define NVRAM_MAX_VALUE_LEN 255
+-#define NVRAM_MAX_PARAM_LEN 64
+-
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+-extern int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len);
+-
+-static inline void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
+-{
+-	if (strchr(buf, ':'))
+-		sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &macaddr[0],
+-			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
+-			&macaddr[5]);
+-	else if (strchr(buf, '-'))
+-		sscanf(buf, "%hhx-%hhx-%hhx-%hhx-%hhx-%hhx", &macaddr[0],
+-			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
+-			&macaddr[5]);
+-	else
+-		printk(KERN_WARNING "Can not parse mac address: %s\n", buf);
+-}
+-
++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
+ 
+ #endif /* __BCM47XX_NVRAM_H */
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/100-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch b/target/linux/brcm47xx/patches-3.18/037-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
similarity index 77%
rename from target/linux/brcm47xx/patches-3.18/100-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
rename to target/linux/brcm47xx/patches-3.18/037-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
index 4a82b50dc7da85ab301549d224d2466ae68e079d..095338f61da585c0b632634774ca9901992f71b0 100644
--- a/target/linux/brcm47xx/patches-3.18/100-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
+++ b/target/linux/brcm47xx/patches-3.18/037-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
@@ -1,7 +1,7 @@
-From f3505e9283290dd9bb6197bd485e6cbfb5beaf7e Mon Sep 17 00:00:00 2001
+From 9a6a2b96dfd8b01336f8519a5be7fb353cfa62fb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Wed, 11 Mar 2015 19:24:42 +0100
-Subject: [PATCH V2] MIPS: BCM47XX: Support SPROM prefixes for PCI devices
+Date: Sat, 14 Mar 2015 17:55:54 +0100
+Subject: [PATCH] MIPS: BCM47XX: Support SPROM prefixes for PCI devices
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -9,20 +9,19 @@ Content-Transfer-Encoding: 8bit
 Support parsing SPROMs with prefixes defined like devpath1=pci/1/1
 
 Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
----
-V2: I've noticed that Buffalo WZR-1750 uses an extra slash in NVRAM
-    devpaths entries. I added support for them and updated comment.
-    This adds one line over 80 chars, but it improved condition
-    readability so I think it's alright there. 
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9552/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
 ---
  arch/mips/bcm47xx/sprom.c | 33 +++++++++++++++++++++++++++++++++
  1 file changed, 33 insertions(+)
 
 diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
-index 290309e..5d32afc 100644
+index 2eff7fe..eff9205 100644
 --- a/arch/mips/bcm47xx/sprom.c
 +++ b/arch/mips/bcm47xx/sprom.c
-@@ -822,6 +822,38 @@ static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+@@ -836,6 +836,38 @@ static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
  #endif
  
  #if defined(CONFIG_BCM47XX_BCMA)
@@ -61,7 +60,7 @@ index 290309e..5d32afc 100644
  static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
  {
  	char prefix[10];
-@@ -833,6 +865,7 @@ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+@@ -847,6 +879,7 @@ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
  		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
  			 bus->host_pci->bus->number + 1,
  			 PCI_SLOT(bus->host_pci->devfn));
diff --git a/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch b/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
index 748710f6f8b86b1379f4c5124c2fc74cd09bd66d..c44131f2fe3c449e93d106da7f35ca11fd772cb3 100644
--- a/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
+++ b/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
@@ -5,7 +5,7 @@ This prevents the options from being delete with make kernel_oldconfig.
 
 --- a/drivers/bcma/Kconfig
 +++ b/drivers/bcma/Kconfig
-@@ -38,6 +38,7 @@ config BCMA_DRIVER_PCI_HOSTMODE
+@@ -39,6 +39,7 @@ config BCMA_DRIVER_PCI_HOSTMODE
  config BCMA_HOST_SOC
  	bool "Support for BCMA in a SoC"
  	depends on BCMA
diff --git a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
index ea002fe73218c804a035c16773b48f0d3eed9d04..818641bcbe75fd4340e07b3def6de6ab2157a1a0 100644
--- a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
+++ b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
@@ -12,7 +12,7 @@ out the configuration than the in kernel cfe config reader.
 +obj-y				+= cfe_env.o
 --- /dev/null
 +++ b/arch/mips/bcm47xx/cfe_env.c
-@@ -0,0 +1,229 @@
+@@ -0,0 +1,228 @@
 +/*
 + * CFE environment variable access
 + *
@@ -138,8 +138,7 @@ out the configuration than the in kernel cfe config reader.
 + * @return	value of variable or NULL if undefined
 + */
 +
-+char* 
-+cfe_env_get(unsigned char *nv_buf, char* name)
++char *cfe_env_get(unsigned char *nv_buf, const char *name)
 +{
 +    int size;
 +    unsigned char *buffer;
@@ -244,7 +243,7 @@ out the configuration than the in kernel cfe config reader.
 +
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -22,6 +22,8 @@
+@@ -33,6 +33,8 @@ struct nvram_header {
  
  static char nvram_buf[NVRAM_SPACE];
  static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
@@ -253,7 +252,7 @@ out the configuration than the in kernel cfe config reader.
  
  static u32 find_nvram_size(void __iomem *end)
  {
-@@ -51,6 +53,26 @@ static int nvram_find_and_copy(void __io
+@@ -62,6 +64,26 @@ static int nvram_find_and_copy(void __io
  		return -EEXIST;
  	}
  
@@ -280,7 +279,7 @@ out the configuration than the in kernel cfe config reader.
  	/* TODO: when nvram is on nand flash check for bad blocks first. */
  	off = FLASH_MIN;
  	while (off <= lim) {
-@@ -142,6 +164,13 @@ int bcm47xx_nvram_getenv(char *name, cha
+@@ -189,6 +211,13 @@ int bcm47xx_nvram_getenv(const char *nam
  			return err;
  	}
  
diff --git a/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch b/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
index 0e62ab13604956f3d8edc35be5095a9b68351c00..c74c4cca2447ce64add8764130ab56d523adc17b 100644
--- a/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
@@ -1,8 +1,8 @@
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -20,7 +20,8 @@
- #include <bcm47xx_nvram.h>
- #include <asm/mach-bcm47xx/bcm47xx.h>
+@@ -31,7 +31,8 @@ struct nvram_header {
+ 	u32 config_ncdl;	/* ncdl values for memc */
+ };
  
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];