diff --git a/target/linux/brcm47xx/patches-3.18/032-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch b/target/linux/brcm47xx/patches-3.18/032-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ab7ceaa0f36d9d65224c139650f50ac52b718c4b
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
@@ -0,0 +1,136 @@
+From f229d75f1472c4cd30f464e4a0f94f410046bd80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sat, 6 Jun 2015 23:16:23 +0200
+Subject: [PATCH] MIPS: BCM47xx: Add helper variable for storing NVRAM length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This simplifies code just a bit (also maybe makes it a bit more
+intuitive?) and will allow us to stop storing header. Right now we copy
+whole NVRAM including its header to the internal buffer. It is not
+needed to store a header as we don't access all these details like CRC,
+flags, etc. The next improvement that should follow is copying only the
+real contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Cc: Arend van Spriel <arend@broadcom.com>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Patchwork: https://patchwork.linux-mips.org/patch/10535/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index 2ed762e..9ccdce8 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -35,6 +35,7 @@ struct nvram_header {
+ };
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+ static u32 find_nvram_size(void __iomem *end)
+@@ -60,7 +61,7 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
+ 	u32 *src, *dst;
+ 	u32 size;
+ 
+-	if (nvram_buf[0]) {
++	if (nvram_len) {
+ 		pr_warn("nvram already initialized\n");
+ 		return -EEXIST;
+ 	}
+@@ -99,17 +100,18 @@ found:
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+ 	header = (struct nvram_header *)nvram_buf;
+-	if (header->len > size) {
++	nvram_len = header->len;
++	if (nvram_len > size) {
+ 		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
+-		header->len = size;
++		nvram_len = size;
+ 	}
+-	if (header->len >= NVRAM_SPACE) {
++	if (nvram_len >= NVRAM_SPACE) {
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 		       header->len, NVRAM_SPACE - 1);
+-		header->len = NVRAM_SPACE - 1;
++		nvram_len = NVRAM_SPACE - 1;
+ 	}
+ 	/* proceed reading data after header */
+-	for (; i < header->len; i += 4)
++	for (; i < nvram_len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -144,7 +146,6 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
+-	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -155,20 +156,16 @@ static int nvram_init(void)
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+ 	if (!err && header.magic == NVRAM_MAGIC &&
+ 	    header.len > sizeof(header)) {
+-		if (header.len >= NVRAM_SPACE) {
++		nvram_len = header.len;
++		if (nvram_len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 				header.len, NVRAM_SPACE);
+-			header.len = NVRAM_SPACE - 1;
++			nvram_len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, header.len, &bytes_read,
++		err = mtd_read(mtd, 0, nvram_len, &nvram_len,
+ 			       (u8 *)nvram_buf);
+-		if (err)
+-			return err;
+-
+-		pheader = (struct nvram_header *)nvram_buf;
+-		pheader->len = header.len;
+-		return 0;
++		return err;
+ 	}
+ #endif
+ 
+@@ -183,7 +180,7 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ 	if (!name)
+ 		return -EINVAL;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return err;
+@@ -231,16 +228,14 @@ char *bcm47xx_nvram_get_contents(size_t *nvram_size)
+ {
+ 	int err;
+ 	char *nvram;
+-	struct nvram_header *header;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return NULL;
+ 	}
+ 
+-	header = (struct nvram_header *)nvram_buf;
+-	*nvram_size = header->len - sizeof(struct nvram_header);
++	*nvram_size = nvram_len - sizeof(struct nvram_header);
+ 	nvram = vmalloc(*nvram_size);
+ 	if (!nvram)
+ 		return NULL;
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/032-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch b/target/linux/brcm47xx/patches-3.18/032-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0114daa1373f104af4ddb574e2bec820f8f7165f
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
@@ -0,0 +1,35 @@
+From 5521bb0c510ed5c1881636524badfb9bc951f6ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sun, 7 Jun 2015 13:26:44 +0200
+Subject: [PATCH] MIPS: BCM47xx: Don't select BCMA_HOST_PCI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+SoC may have non-Broadcom PCI device attached or one may want to use
+totally different PCI driver.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10537/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
+index fc21d36..51ed599 100644
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -25,7 +25,6 @@ config BCM47XX_BCMA
+ 	select BCMA
+ 	select BCMA_HOST_SOC
+ 	select BCMA_DRIVER_MIPS
+-	select BCMA_HOST_PCI if PCI
+ 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ 	select BCMA_DRIVER_GPIO
+ 	default y
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch b/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
index c4082ab4641b1e8022d7002eb3c0c57de92fe471..33fefddafeeb990e0f764a2bde7694573a42dcfc 100644
--- a/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
+++ b/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
@@ -5,7 +5,7 @@ This prevents the options from being delete with make kernel_oldconfig.
 
 --- a/drivers/bcma/Kconfig
 +++ b/drivers/bcma/Kconfig
-@@ -39,6 +39,7 @@ config BCMA_DRIVER_PCI_HOSTMODE
+@@ -33,6 +33,7 @@ config BCMA_HOST_PCI
  config BCMA_HOST_SOC
  	bool "Support for BCMA in a SoC"
  	depends on BCMA
diff --git a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
index c543e8e2e90bb770677a1b26967b4158bd422ec1..644abde6047ccdc6369ff99353ce7423302b203d 100644
--- a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
+++ b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
@@ -243,16 +243,16 @@ out the configuration than the in kernel cfe config reader.
 +
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -36,6 +36,8 @@ struct nvram_header {
- 
+@@ -37,6 +37,8 @@ struct nvram_header {
  static char nvram_buf[NVRAM_SPACE];
+ static size_t nvram_len;
  static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
 +static int cfe_env;
 +extern char *cfe_env_get(char *nv_buf, const char *name);
  
  static u32 find_nvram_size(void __iomem *end)
  {
-@@ -65,6 +67,26 @@ static int nvram_find_and_copy(void __io
+@@ -66,6 +68,26 @@ static int nvram_find_and_copy(void __io
  		return -EEXIST;
  	}
  
@@ -279,7 +279,7 @@ out the configuration than the in kernel cfe config reader.
  	/* TODO: when nvram is on nand flash check for bad blocks first. */
  	off = FLASH_MIN;
  	while (off <= lim) {
-@@ -189,6 +211,13 @@ int bcm47xx_nvram_getenv(const char *nam
+@@ -186,6 +208,13 @@ int bcm47xx_nvram_getenv(const char *nam
  			return err;
  	}
  
diff --git a/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch b/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
index e3c6691c8c1dff6b8bafab2e35c5ec917be26c70..be14a09426593d610562771266fa31cdc6dc4022 100644
--- a/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
@@ -7,9 +7,9 @@
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
+ static size_t nvram_len;
  static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
  static int cfe_env;
- extern char *cfe_env_get(char *nv_buf, const char *name);
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
 @@ -59,6 +59,7 @@ void (*_dma_cache_wback)(unsigned long s
diff --git a/target/linux/brcm47xx/patches-4.0/031-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch b/target/linux/brcm47xx/patches-4.0/031-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ab7ceaa0f36d9d65224c139650f50ac52b718c4b
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
@@ -0,0 +1,136 @@
+From f229d75f1472c4cd30f464e4a0f94f410046bd80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sat, 6 Jun 2015 23:16:23 +0200
+Subject: [PATCH] MIPS: BCM47xx: Add helper variable for storing NVRAM length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This simplifies code just a bit (also maybe makes it a bit more
+intuitive?) and will allow us to stop storing header. Right now we copy
+whole NVRAM including its header to the internal buffer. It is not
+needed to store a header as we don't access all these details like CRC,
+flags, etc. The next improvement that should follow is copying only the
+real contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Cc: Arend van Spriel <arend@broadcom.com>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Patchwork: https://patchwork.linux-mips.org/patch/10535/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index 2ed762e..9ccdce8 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -35,6 +35,7 @@ struct nvram_header {
+ };
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+ static u32 find_nvram_size(void __iomem *end)
+@@ -60,7 +61,7 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
+ 	u32 *src, *dst;
+ 	u32 size;
+ 
+-	if (nvram_buf[0]) {
++	if (nvram_len) {
+ 		pr_warn("nvram already initialized\n");
+ 		return -EEXIST;
+ 	}
+@@ -99,17 +100,18 @@ found:
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+ 	header = (struct nvram_header *)nvram_buf;
+-	if (header->len > size) {
++	nvram_len = header->len;
++	if (nvram_len > size) {
+ 		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
+-		header->len = size;
++		nvram_len = size;
+ 	}
+-	if (header->len >= NVRAM_SPACE) {
++	if (nvram_len >= NVRAM_SPACE) {
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 		       header->len, NVRAM_SPACE - 1);
+-		header->len = NVRAM_SPACE - 1;
++		nvram_len = NVRAM_SPACE - 1;
+ 	}
+ 	/* proceed reading data after header */
+-	for (; i < header->len; i += 4)
++	for (; i < nvram_len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -144,7 +146,6 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
+-	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -155,20 +156,16 @@ static int nvram_init(void)
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+ 	if (!err && header.magic == NVRAM_MAGIC &&
+ 	    header.len > sizeof(header)) {
+-		if (header.len >= NVRAM_SPACE) {
++		nvram_len = header.len;
++		if (nvram_len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 				header.len, NVRAM_SPACE);
+-			header.len = NVRAM_SPACE - 1;
++			nvram_len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, header.len, &bytes_read,
++		err = mtd_read(mtd, 0, nvram_len, &nvram_len,
+ 			       (u8 *)nvram_buf);
+-		if (err)
+-			return err;
+-
+-		pheader = (struct nvram_header *)nvram_buf;
+-		pheader->len = header.len;
+-		return 0;
++		return err;
+ 	}
+ #endif
+ 
+@@ -183,7 +180,7 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ 	if (!name)
+ 		return -EINVAL;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return err;
+@@ -231,16 +228,14 @@ char *bcm47xx_nvram_get_contents(size_t *nvram_size)
+ {
+ 	int err;
+ 	char *nvram;
+-	struct nvram_header *header;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return NULL;
+ 	}
+ 
+-	header = (struct nvram_header *)nvram_buf;
+-	*nvram_size = header->len - sizeof(struct nvram_header);
++	*nvram_size = nvram_len - sizeof(struct nvram_header);
+ 	nvram = vmalloc(*nvram_size);
+ 	if (!nvram)
+ 		return NULL;
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/031-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch b/target/linux/brcm47xx/patches-4.0/031-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0114daa1373f104af4ddb574e2bec820f8f7165f
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
@@ -0,0 +1,35 @@
+From 5521bb0c510ed5c1881636524badfb9bc951f6ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sun, 7 Jun 2015 13:26:44 +0200
+Subject: [PATCH] MIPS: BCM47xx: Don't select BCMA_HOST_PCI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+SoC may have non-Broadcom PCI device attached or one may want to use
+totally different PCI driver.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10537/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
+index fc21d36..51ed599 100644
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -25,7 +25,6 @@ config BCM47XX_BCMA
+ 	select BCMA
+ 	select BCMA_HOST_SOC
+ 	select BCMA_DRIVER_MIPS
+-	select BCMA_HOST_PCI if PCI
+ 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ 	select BCMA_DRIVER_GPIO
+ 	default y
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/280-activate_ssb_support_in_usb.patch b/target/linux/brcm47xx/patches-4.0/280-activate_ssb_support_in_usb.patch
index c4082ab4641b1e8022d7002eb3c0c57de92fe471..33fefddafeeb990e0f764a2bde7694573a42dcfc 100644
--- a/target/linux/brcm47xx/patches-4.0/280-activate_ssb_support_in_usb.patch
+++ b/target/linux/brcm47xx/patches-4.0/280-activate_ssb_support_in_usb.patch
@@ -5,7 +5,7 @@ This prevents the options from being delete with make kernel_oldconfig.
 
 --- a/drivers/bcma/Kconfig
 +++ b/drivers/bcma/Kconfig
-@@ -39,6 +39,7 @@ config BCMA_DRIVER_PCI_HOSTMODE
+@@ -33,6 +33,7 @@ config BCMA_HOST_PCI
  config BCMA_HOST_SOC
  	bool "Support for BCMA in a SoC"
  	depends on BCMA
diff --git a/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch
index c543e8e2e90bb770677a1b26967b4158bd422ec1..644abde6047ccdc6369ff99353ce7423302b203d 100644
--- a/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch
+++ b/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch
@@ -243,16 +243,16 @@ out the configuration than the in kernel cfe config reader.
 +
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -36,6 +36,8 @@ struct nvram_header {
- 
+@@ -37,6 +37,8 @@ struct nvram_header {
  static char nvram_buf[NVRAM_SPACE];
+ static size_t nvram_len;
  static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
 +static int cfe_env;
 +extern char *cfe_env_get(char *nv_buf, const char *name);
  
  static u32 find_nvram_size(void __iomem *end)
  {
-@@ -65,6 +67,26 @@ static int nvram_find_and_copy(void __io
+@@ -66,6 +68,26 @@ static int nvram_find_and_copy(void __io
  		return -EEXIST;
  	}
  
@@ -279,7 +279,7 @@ out the configuration than the in kernel cfe config reader.
  	/* TODO: when nvram is on nand flash check for bad blocks first. */
  	off = FLASH_MIN;
  	while (off <= lim) {
-@@ -189,6 +211,13 @@ int bcm47xx_nvram_getenv(const char *nam
+@@ -186,6 +208,13 @@ int bcm47xx_nvram_getenv(const char *nam
  			return err;
  	}
  
diff --git a/target/linux/brcm47xx/patches-4.0/999-wl_exports.patch b/target/linux/brcm47xx/patches-4.0/999-wl_exports.patch
index e3c6691c8c1dff6b8bafab2e35c5ec917be26c70..be14a09426593d610562771266fa31cdc6dc4022 100644
--- a/target/linux/brcm47xx/patches-4.0/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-4.0/999-wl_exports.patch
@@ -7,9 +7,9 @@
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
+ static size_t nvram_len;
  static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
  static int cfe_env;
- extern char *cfe_env_get(char *nv_buf, const char *name);
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
 @@ -59,6 +59,7 @@ void (*_dma_cache_wback)(unsigned long s