diff --git a/package/broadcom-wl/Makefile b/package/broadcom-wl/Makefile
index 273c103ff3..f589417644 100644
--- a/package/broadcom-wl/Makefile
+++ b/package/broadcom-wl/Makefile
@@ -9,14 +9,14 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=broadcom-wl
-PKG_VERSION:=5.10.56.27.1
+PKG_VERSION:=5.10.56.27.3
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(ARCH).tar.bz2
 PKG_SOURCE_URL:=http://downloads.openwrt.org/sources
 
-PKG_MD5SUM.mipsel:=9f42cfa9c46ee1b0e04dc2d3ab9bc8cd
-PKG_MD5SUM.mips:=9dcc902af0fcac5f34b6656982e82c21
+PKG_MD5SUM.mipsel:=800365b5e5088d5368f8b1e65df8ba8a
+PKG_MD5SUM.mips:=7a0425e9fb1e03c136564c99daf1ce16
 PKG_MD5SUM:=$(PKG_MD5SUM.$(ARCH))
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/broadcom-wl/patches/002-ctype.patch b/package/broadcom-wl/patches/002-ctype.patch
deleted file mode 100644
index 16d13df30c..0000000000
--- a/package/broadcom-wl/patches/002-ctype.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- a/shared/Makefile
-+++ b/shared/Makefile
-@@ -19,7 +19,7 @@ LDFLAGS += -L.
- AR=ar
- RANLIB=ranlib
- 
--OBJS := shutils.o wl.o wl_linux.o linux_timer.o
-+OBJS := shutils.o wl.o wl_linux.o linux_timer.o ctype.o
- all: libshared.a
- 
- clean:
---- /dev/null
-+++ b/shared/ctype.c
-@@ -0,0 +1,16 @@
-+#include <features.h>
-+
-+#ifndef __UCLIBC__
-+extern void **__ctype_b_loc();
-+extern void **__ctype_tolower_loc();
-+
-+void *__ctype_b;
-+void *__ctype_tolower;
-+
-+static void init(void) __attribute__((constructor));
-+static void init(void)
-+{
-+    __ctype_b = *__ctype_b_loc();
-+    __ctype_tolower = *__ctype_tolower_loc();
-+}
-+#endif
diff --git a/package/broadcom-wl/patches/910-fallback-sprom.patch b/package/broadcom-wl/patches/910-fallback-sprom.patch
new file mode 100644
index 0000000000..2bcd77b9a8
--- /dev/null
+++ b/package/broadcom-wl/patches/910-fallback-sprom.patch
@@ -0,0 +1,88 @@
+--- a/driver/bcmsrom.c
++++ b/driver/bcmsrom.c
+@@ -39,6 +39,10 @@
+ #include <sbsdpcmdev.h>
+ #endif 
+ 
++#ifdef CONFIG_SSB
++#include <linux/ssb/ssb.h>
++#endif
++
+ #ifdef WLTEST
+ #include <sbsprom.h>
+ #endif /* WLTEST */
+@@ -2058,6 +2062,11 @@ BCMATTACHFN(initvars_srom_pci)(si_t *sih
+ 	bool flash = FALSE;
+ 	int err = 0;
+ 
++#ifdef CONFIG_SSB
++	struct ssb_sprom *fbrom;
++	char eabuf[18];
++#endif
++
+ 	/*
+ 	 * Apply CRC over SROM content regardless SROM is present or not,
+ 	 * and use variable <devpath>sromrev's existance in flash to decide
+@@ -2120,6 +2129,62 @@ BCMATTACHFN(initvars_srom_pci)(si_t *sih
+ 			goto varscont;
+ 		}
+ 
++#ifdef CONFIG_SSB
++		base = vp = MALLOC(osh, MAXSZ_NVRAM_VARS);
++
++		if( base != NULL )
++		{
++			varbuf_init(&b, base, MAXSZ_NVRAM_VARS);
++
++			/* Try to load ssb fallback sprom */
++			if ((fbrom = ssb_get_fallback_sprom()) != NULL)
++			{
++				printk("Got version %i SPROM from SSB\n", fbrom->revision);
++
++				varbuf_append(&b, vstr_sromrev, fbrom->revision);
++				varbuf_append(&b, vstr_boardrev, fbrom->board_rev);
++
++				/* ToDo: map fbrom->country_code */
++				varbuf_append(&b, vstr_noccode);
++
++				varbuf_append(&b, vstr_aa2g, fbrom->ant_available_bg);
++
++				varbuf_append(&b, vstr_pa0b[0], fbrom->pa0b0);
++				varbuf_append(&b, vstr_pa1b[0], fbrom->pa1b0);
++				varbuf_append(&b, vstr_pa0b[1], fbrom->pa0b1);
++				varbuf_append(&b, vstr_pa1b[1], fbrom->pa1b1);
++				varbuf_append(&b, vstr_pa0b[2], fbrom->pa0b2);
++				varbuf_append(&b, vstr_pa1b[2], fbrom->pa1b2);
++
++				varbuf_append(&b, vstr_pa0maxpwr, fbrom->maxpwr_bg);
++				varbuf_append(&b, vstr_pa0itssit, fbrom->itssi_bg);
++
++				varbuf_append(&b, vstr_boardflags, (fbrom->boardflags_hi << 16) | fbrom->boardflags_lo);
++				varbuf_append(&b, vstr_boardflags2, (fbrom->boardflags2_hi << 16) | fbrom->boardflags2_lo);
++
++				snprintf(eabuf, sizeof(eabuf), "%02x:%02x:%02x:%02x:%02x:%02x",
++					fbrom->il0mac[0], fbrom->il0mac[1], fbrom->il0mac[2],
++					fbrom->il0mac[3], fbrom->il0mac[4], fbrom->il0mac[5]
++				);
++
++				varbuf_append(&b, vstr_macaddr, eabuf);
++			}
++
++			/* final nullbyte terminator */
++			ASSERT(b.size >= 1);
++			vp = b.buf;
++			*vp++ = '\0';
++
++			ASSERT((vp - base) <= MAXSZ_NVRAM_VARS);
++			goto varsdone;
++		}
++		else
++		{
++			err = -2;
++			goto errout;
++		}
++#endif
++
+ 		BS_ERROR(("SROM CRC Error\n"));
+ 
+ #if defined(WLTEST)