--- /dev/null
+From 8eefb59de817125eeedde2a2cc1e4ac3660062f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 8 Nov 2018 16:08:29 +0100
+Subject: [PATCH] brcmfmac: fix reporting support for 160 MHz channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Driver can report IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ so it's
+important to provide valid & complete info about supported bands for
+each channel. By default no support for 160 MHz should be assumed unless
+firmware reports it for a given channel later.
+
+This fixes info passed to the userspace. Without that change userspace
+could try to use invalid channel and fail to start an interface.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Cc: stable@vger.kernel.org
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5956,7 +5956,8 @@ static int brcmf_construct_chaninfo(stru
+ * for subsequent chanspecs.
+ */
+ channel->flags = IEEE80211_CHAN_NO_HT40 |
+- IEEE80211_CHAN_NO_80MHZ;
++ IEEE80211_CHAN_NO_80MHZ |
++ IEEE80211_CHAN_NO_160MHZ;
+ ch.bw = BRCMU_CHAN_BW_20;
+ cfg->d11inf.encchspec(&ch);
+ chaninfo = ch.chspec;
+++ /dev/null
-From ae5848cb4511bbbfe0306fcdbe5d9a95cd9546a9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Fri, 26 Oct 2018 13:22:32 +0200
-Subject: [PATCH] brcmutil: print invalid chanspec when WARN-ing
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On one of my devices I got WARNINGs when brcmfmac tried to decode
-chanspec. I couldn't tell if it was some unsupported format or just a
-malformed value passed by a firmware.
-
-Print chanspec value so it's possible to debug a possible problem.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-@@ -128,7 +128,7 @@ static void brcmu_d11n_decchspec(struct
- }
- break;
- default:
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- break;
- }
-
-@@ -140,7 +140,7 @@ static void brcmu_d11n_decchspec(struct
- ch->band = BRCMU_CHAN_BAND_2G;
- break;
- default:
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- break;
- }
- }
-@@ -167,7 +167,7 @@ static void brcmu_d11ac_decchspec(struct
- ch->sb = BRCMU_CHAN_SB_U;
- ch->control_ch_num += CH_10MHZ_APART;
- } else {
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- }
- break;
- case BRCMU_CHSPEC_D11AC_BW_80:
-@@ -188,7 +188,7 @@ static void brcmu_d11ac_decchspec(struct
- ch->control_ch_num += CH_30MHZ_APART;
- break;
- default:
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- break;
- }
- break;
-@@ -222,13 +222,13 @@ static void brcmu_d11ac_decchspec(struct
- ch->control_ch_num += CH_70MHZ_APART;
- break;
- default:
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- break;
- }
- break;
- case BRCMU_CHSPEC_D11AC_BW_8080:
- default:
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- break;
- }
-
-@@ -240,7 +240,7 @@ static void brcmu_d11ac_decchspec(struct
- ch->band = BRCMU_CHAN_BAND_2G;
- break;
- default:
-- WARN_ON_ONCE(1);
-+ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
- break;
- }
- }
--- /dev/null
+From ae5848cb4511bbbfe0306fcdbe5d9a95cd9546a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 26 Oct 2018 13:22:32 +0200
+Subject: [PATCH] brcmutil: print invalid chanspec when WARN-ing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On one of my devices I got WARNINGs when brcmfmac tried to decode
+chanspec. I couldn't tell if it was some unsupported format or just a
+malformed value passed by a firmware.
+
+Print chanspec value so it's possible to debug a possible problem.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -128,7 +128,7 @@ static void brcmu_d11n_decchspec(struct
+ }
+ break;
+ default:
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ break;
+ }
+
+@@ -140,7 +140,7 @@ static void brcmu_d11n_decchspec(struct
+ ch->band = BRCMU_CHAN_BAND_2G;
+ break;
+ default:
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ break;
+ }
+ }
+@@ -167,7 +167,7 @@ static void brcmu_d11ac_decchspec(struct
+ ch->sb = BRCMU_CHAN_SB_U;
+ ch->control_ch_num += CH_10MHZ_APART;
+ } else {
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ }
+ break;
+ case BRCMU_CHSPEC_D11AC_BW_80:
+@@ -188,7 +188,7 @@ static void brcmu_d11ac_decchspec(struct
+ ch->control_ch_num += CH_30MHZ_APART;
+ break;
+ default:
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ break;
+ }
+ break;
+@@ -222,13 +222,13 @@ static void brcmu_d11ac_decchspec(struct
+ ch->control_ch_num += CH_70MHZ_APART;
+ break;
+ default:
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ break;
+ }
+ break;
+ case BRCMU_CHSPEC_D11AC_BW_8080:
+ default:
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ break;
+ }
+
+@@ -240,7 +240,7 @@ static void brcmu_d11ac_decchspec(struct
+ ch->band = BRCMU_CHAN_BAND_2G;
+ break;
+ default:
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ break;
+ }
+ }
--- /dev/null
+From a4dad0334732f62c67058037d9edb17945bec598 Mon Sep 17 00:00:00 2001
+From: Dan Haab <riproute@gmail.com>
+Date: Fri, 9 Nov 2018 09:38:55 -0700
+Subject: [PATCH] brcmfmac: support STA info struct v7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The newest firmwares provide STA info using v7 of the struct. As v7
+isn't backward compatible, a union is needed.
+
+Even though brcmfmac does not use any of the new info it's important to
+provide the proper struct buffer. Without this change new firmwares will
+fallback to the very limited v3 instead of something in between such as
+v4.
+
+Signed-off-by: Dan Haab <dan.haab@luxul.com>
+Reviewed-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h | 40 ++++++++++++++++++----
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -167,6 +167,8 @@
+ #define BRCMF_MFP_REQUIRED 2
+
+ #define BRCMF_VHT_CAP_MCS_MAP_NSS_MAX 8
++
++#define BRCMF_HE_CAP_MCS_MAP_NSS_MAX 8
+
+ /* join preference types for join_pref iovar */
+ enum brcmf_join_pref_types {
+@@ -565,13 +567,37 @@ struct brcmf_sta_info_le {
+ __le32 rx_pkts_retried; /* # rx with retry bit set */
+ __le32 tx_rate_fallback; /* lowest fallback TX rate */
+
+- /* Fields valid for ver >= 5 */
+- struct {
+- __le32 count; /* # rates in this set */
+- u8 rates[BRCMF_MAXRATES_IN_SET]; /* rates in 500kbps units w/hi bit set if basic */
+- u8 mcs[BRCMF_MCSSET_LEN]; /* supported mcs index bit map */
+- __le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX]; /* supported mcs index bit map per nss */
+- } rateset_adv;
++ union {
++ struct {
++ struct {
++ __le32 count; /* # rates in this set */
++ u8 rates[BRCMF_MAXRATES_IN_SET]; /* rates in 500kbps units w/hi bit set if basic */
++ u8 mcs[BRCMF_MCSSET_LEN]; /* supported mcs index bit map */
++ __le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX]; /* supported mcs index bit map per nss */
++ } rateset_adv;
++ } v5;
++
++ struct {
++ __le32 rx_dur_total; /* total user RX duration (estimated) */
++ __le16 chanspec; /** chanspec this sta is on */
++ __le16 pad_1;
++ struct {
++ __le16 version; /* version */
++ __le16 len; /* length */
++ __le32 count; /* # rates in this set */
++ u8 rates[BRCMF_MAXRATES_IN_SET]; /* rates in 500kbps units w/hi bit set if basic */
++ u8 mcs[BRCMF_MCSSET_LEN]; /* supported mcs index bit map */
++ __le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX]; /* supported mcs index bit map per nss */
++ __le16 he_mcs[BRCMF_HE_CAP_MCS_MAP_NSS_MAX]; /* supported he mcs index bit map per nss */
++ } rateset_adv; /* rateset along with mcs index bitmap */
++ __le16 wpauth; /* authentication type */
++ u8 algo; /* crypto algorithm */
++ u8 pad_2;
++ __le32 tx_rspec; /* Rate of last successful tx frame */
++ __le32 rx_rspec; /* Rate of last successful rx frame */
++ __le32 wnm_cap; /* wnm capabilities */
++ } v7;
++ };
+ };
+
+ struct brcmf_chanspec_list {