From a40d3cddbae51dca6698388dc7910a77fcebe085 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Mon, 8 Feb 2016 22:26:29 +0100
Subject: [PATCH] mac80211: update backport to r48681

---
 include/config                                |     1 -
 ...mac80211-backport-from-trunk-r48681.patch} | 13766 ++++++++++------
 ...la-Technologies-firmware-for-QCA988X.patch |    59 +
 ...1-ath10k-allow-simultaneous-AP-IBSS.patch} |     0
 ...te-NanoStation-Loco-txpower-offsets.patch} |     0
 ...-support-for-tp-link-wr740n-v5.0-EU.patch} |     0
 ...r71xx-add-support-for-TL-WR741ND-v5.patch} |     0
 ...13-sunxi-fix-uboot-install-location.patch} |     0
 ...i-respect-CONFIG_TARGET_IMAGES_GZIP.patch} |     0
 ...mcast-rate-for-mesh-point-interfaces.patch |    47 -
 ...urcefilter-to-disable-source-filter.patch} |     0
 ...TL-WR941ND-v6-international-version.patch} |     0
 ...sh-11s-VIF-together-with-another-VIF.patch |    82 -
 ...-support-for-TP-Link-TL-WR1043ND-v3.patch} |     0
 ...ity-firmware-as-an-additional-choice.patch |    70 -
 ...th10k-calibration-data-load-changes.patch} |     0
 ...k-add-correct-MAC-BB-name-for-ar9561.patch |    35 -
 ...x-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch} |     0
 ...-Added-source-old-to-PKG_SOURCE_URL.patch} |     0
 ...tallation-of-headers-for-host-build.patch} |     0
 ...alloc-instead-of-oom-kill-processes.patch} |     0
 ...id-compile-failure-on-mipsel-targets.patch |    17 -
 ...7-x86-generic-refresh-kernel-config.patch} |     0
 ...6-generic-enable-pata_atiixp-driver.patch} |     0
 targets/ar71xx-generic/profiles.mk            |     2 +-
 25 files changed, 8377 insertions(+), 5702 deletions(-)
 rename patches/openwrt/{0007-mac80211-backport-from-trunk-r47249.patch => 0007-mac80211-backport-from-trunk-r48681.patch} (76%)
 create mode 100644 patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
 rename patches/openwrt/{0008-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch => 0009-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch} (100%)
 rename patches/openwrt/{0009-iwinfo-update-NanoStation-Loco-txpower-offsets.patch => 0010-iwinfo-update-NanoStation-Loco-txpower-offsets.patch} (100%)
 rename patches/openwrt/{0010-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch => 0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch} (100%)
 rename patches/openwrt/{0011-ar71xx-add-support-for-TL-WR741ND-v5.patch => 0012-ar71xx-add-support-for-TL-WR741ND-v5.patch} (100%)
 rename patches/openwrt/{0012-sunxi-fix-uboot-install-location.patch => 0013-sunxi-fix-uboot-install-location.patch} (100%)
 rename patches/openwrt/{0013-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch => 0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch} (100%)
 delete mode 100644 patches/openwrt/0015-mac80211-set-mcast-rate-for-mesh-point-interfaces.patch
 rename patches/openwrt/{0014-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch => 0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch} (100%)
 rename patches/openwrt/{0033-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch => 0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch} (100%)
 delete mode 100644 patches/openwrt/0030-mac80211-fix-crash-when-using-mesh-11s-VIF-together-with-another-VIF.patch
 rename patches/openwrt/{0034-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch => 0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch} (100%)
 delete mode 100644 patches/openwrt/0031-ath10k-add-Candelatech-community-firmware-as-an-additional-choice.patch
 rename patches/openwrt/{0035-ar71xx-backport-ath10k-calibration-data-load-changes.patch => 0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch} (100%)
 delete mode 100644 patches/openwrt/0032-mac80211-ath9k-add-correct-MAC-BB-name-for-ar9561.patch
 rename patches/openwrt/{0036-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch => 0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch} (100%)
 rename patches/openwrt/{0038-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch => 0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch} (100%)
 rename patches/openwrt/{0039-lua-fix-installation-of-headers-for-host-build.patch => 0035-lua-fix-installation-of-headers-for-host-build.patch} (100%)
 rename patches/openwrt/{0040-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch => 0036-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch} (100%)
 delete mode 100644 patches/openwrt/0037-acx-mac80211-mark-as-BROKEN-to-avoid-compile-failure-on-mipsel-targets.patch
 rename patches/openwrt/{0041-x86-generic-refresh-kernel-config.patch => 0037-x86-generic-refresh-kernel-config.patch} (100%)
 rename patches/openwrt/{0042-x86-generic-enable-pata_atiixp-driver.patch => 0038-x86-generic-enable-pata_atiixp-driver.patch} (100%)

diff --git a/include/config b/include/config
index aa949adf8..12f8a7d4a 100644
--- a/include/config
+++ b/include/config
@@ -18,6 +18,5 @@ CONFIG_BUSYBOX_CONFIG_FEATURE_WGET_TIMEOUT=y
 
 CONFIG_ATH_USER_REGD=y
 CONFIG_PACKAGE_ATH_DEBUG=y
-CONFIG_ATH10K_CT_COMMUNITY_FW=y
 
 CONFIG_LUCI_SRCDIET=y
diff --git a/patches/openwrt/0007-mac80211-backport-from-trunk-r47249.patch b/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
similarity index 76%
rename from patches/openwrt/0007-mac80211-backport-from-trunk-r47249.patch
rename to patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
index 5f6e2ad0b..27c6da67d 100644
--- a/patches/openwrt/0007-mac80211-backport-from-trunk-r47249.patch
+++ b/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
@@ -1,9 +1,1156 @@
 From: Matthias Schiffer <mschiffer@universe-factory.net>
 Date: Tue, 23 Dec 2014 18:57:16 +0100
-Subject: mac80211: backport from trunk r47249
+Subject: mac80211: backport from trunk r48681
 
+Backport mac80211 and dependent drivers/firmwares from OpenWrt trunk.
+
+diff --git a/package/firmware/ath10k-firmware/Makefile b/package/firmware/ath10k-firmware/Makefile
+new file mode 100644
+index 0000000..882294c
+--- /dev/null
++++ b/package/firmware/ath10k-firmware/Makefile
+@@ -0,0 +1,104 @@
++#
++# Copyright (C) 2015 OpenWrt.org
++#
++# This is free software, licensed under the GNU General Public License v2.
++# See /LICENSE for more information.
++#
++
++include $(TOPDIR)/rules.mk
++
++PKG_NAME:=ath10k-firmware
++PKG_SOURCE_VERSION:=77f72b5f7dd940386d9e619a17904987759b7186
++PKG_VERSION:=2014-11-13-$(PKG_SOURCE_VERSION)
++PKG_RELEASE:=1
++
++PKG_SOURCE_PROTO:=git
++PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
++PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
++PKG_SOURCE_URL:=https://github.com/kvalo/ath10k-firmware.git
++
++PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
++
++include $(INCLUDE_DIR)/package.mk
++
++WMENU:=Wireless Drivers
++
++define Package/ath10k-firmware-default
++  SECTION:=kernel
++  CATEGORY:=Kernel modules
++  SUBMENU:=$(WMENU)
++  URL:=$(PKG_SOURCE_URL)
++  DEPENDS:=kmod-ath10k
++endef
++
++define Package/ath10k-firmware-qca988x
++$(Package/ath10k-firmware-default)
++  DEFAULT:=PACKAGE_kmod-ath10k
++  TITLE:=ath10k firmware for QCA988x devices
++endef
++
++QCA988X_FIRMWARE_FILE:=firmware-5.bin_10.2.4.97-1
++
++define Download/ath10k-firmware-qca988x
++  URL:=https://www.codeaurora.org/cgit/quic/qsdk/oss/firmware/ath10k-firmware/plain/10.2.4/
++  FILE:=$(QCA988X_FIRMWARE_FILE)
++  MD5SUM:=fcb2fbd42d73a63fbf603505c718cbde
++endef
++$(eval $(call Download,ath10k-firmware-qca988x))
++
++define Package/ath10k-firmware-qca99x0
++$(Package/ath10k-firmware-default)
++  TITLE:=ath10k firmware for QCA99x0 devices
++endef
++
++define Package/ath10k-firmware-qca6174
++$(Package/ath10k-firmware-default)
++  TITLE:=ath10k firmware for QCA6174 devices
++endef
++
++QCA99X0_BOARD_REV:=ddcec9efd245da9365c474f513a855a55f3ac7fe
++QCA99X0_BOARD_FILE:=board-2.bin.$(QCA99X0_BOARD_REV)
++
++define Download/qca99x0-board
++  URL:=https://www.codeaurora.org/cgit/quic/qsdk/oss/firmware/ath10k-firmware/plain/ath10k/QCA99X0/hw2.0
++  URL_FILE:=board-2.bin?id=ddcec9efd245da9365c474f513a855a55f3ac7fe
++  FILE:=$(QCA99X0_BOARD_FILE)
++  MD5SUM:=a2b3c653c2363a5641200051d6333d0a
++endef
++$(eval $(call Download,qca99x0-board))
++
++define Build/Compile
++
++endef
++
++define Package/ath10k-firmware-qca988x/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA988X/hw2.0
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/QCA988X/board.bin \
++		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
++	$(INSTALL_DATA) \
++		$(DL_DIR)/$(QCA988X_FIRMWARE_FILE) \
++		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
++endef
++
++define Package/ath10k-firmware-qca6174/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ath10k
++	$(CP) $(PKG_BUILD_DIR)/QCA6174 $(1)/lib/firmware/ath10k/
++endef
++
++define Package/ath10k-firmware-qca99x0/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA99X0/hw2.0
++	$(INSTALL_DATA) \
++		$(DL_DIR)/$(QCA99X0_BOARD_FILE) \
++		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/board-2.bin
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/QCA99X0/hw2.0/boardData_AR900B_CUS239_5G_v2_001.bin \
++		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/board.bin
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/QCA99X0/hw2.0/firmware-5.bin_10.4.1.00030-1 \
++		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/firmware-5.bin
++endef
++
++$(eval $(call BuildPackage,ath10k-firmware-qca988x))
++$(eval $(call BuildPackage,ath10k-firmware-qca99x0))
++$(eval $(call BuildPackage,ath10k-firmware-qca6174))
+diff --git a/package/firmware/b43legacy-firmware/Makefile b/package/firmware/b43legacy-firmware/Makefile
+new file mode 100644
+index 0000000..ec13c7d
+--- /dev/null
++++ b/package/firmware/b43legacy-firmware/Makefile
+@@ -0,0 +1,72 @@
++#
++# Copyright (C) 2016 OpenWrt.org
++#
++# This is free software, licensed under the GNU General Public License v2.
++# See /LICENSE for more information.
++#
++
++include $(TOPDIR)/rules.mk
++
++PKG_NAME:=b43legacy-firmware
++PKG_VERSION:=3.130.20.0
++PKG_RELEASE:=1
++
++PKG_SOURCE:=wl_apsta-$(PKG_VERSION).o
++PKG_SOURCE_URL:=http://downloads.openwrt.org/sources
++PKG_MD5SUM:=e08665c5c5b66beb9c3b2dd54aa80cb3
++
++include $(INCLUDE_DIR)/package.mk
++
++define Package/b43legacy-firmware
++  SECTION:=firmware
++  CATEGORY:=Firmware
++  URL:=$(PKG_SOURCE_URL)
++  TITLE:=Broadcom bcm43xx b43legacy firmware
++endef
++
++define Package/b43legacy-firmware/config
++  if PACKAGE_b43legacy-firmware
++
++	config B43LEGACY_FW_SQUASH
++		bool "Remove unnecessary firmware files"
++		default y
++		help
++		  This options allows you to remove unnecessary b43legacy firmware files
++		  from the final rootfs image. This can reduce the rootfs size by
++		  up to 50k.
++
++		  If unsure, say Y.
++
++	config B43LEGACY_FW_SQUASH_COREREVS
++		string "Core revisions to include"
++		depends on B43LEGACY_FW_SQUASH
++		default "1,2,3,4"
++		help
++		  This is a comma seperated list of core revision numbers.
++
++		  Example (keep files for rev4 only):
++		    4
++
++		  Example (keep files for rev2 and rev4):
++		    2,4
++
++  endif
++endef
++
++define Build/Prepare
++	mkdir -p $(PKG_BUILD_DIR)
++endef
++
++define Build/Compile
++
++endef
++
++define Package/b43legacy-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	b43-fwcutter --unsupported -w $(1)/lib/firmware/ $(DL_DIR)/$(PKG_SOURCE)
++  ifneq ($(CONFIG_B43LEGACY_FW_SQUASH),)
++	b43-fwsquash.py "G" "$(CONFIG_B43LEGACY_FW_SQUASH_COREREVS)" "$(1)/lib/firmware/b43legacy"
++  endif
++endef
++
++$(eval $(call BuildPackage,b43legacy-firmware))
+diff --git a/package/firmware/ixp4xx-microcode/Makefile b/package/firmware/ixp4xx-microcode/Makefile
+index 52b44f3..1af1248 100644
+--- a/package/firmware/ixp4xx-microcode/Makefile
++++ b/package/firmware/ixp4xx-microcode/Makefile
+@@ -1,4 +1,4 @@
+-# 
++#
+ # Copyright (C) 2007 OpenWrt.org
+ #
+ # This is free software, licensed under the GNU General Public License v2.
+diff --git a/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-a/Makefile b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-a/Makefile
+new file mode 100644
+index 0000000..e8dd659
+--- /dev/null
++++ b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-a/Makefile
+@@ -0,0 +1,47 @@
++# Copyright (C) 2015 OpenWrt.org
++# Copyright (C) 2015 Lantiq Beteiligungs GmbH & Co KG.
++#
++# This is free software, licensed under the GNU General Public License v2.
++# See /LICENSE for more information.
++
++include $(TOPDIR)/rules.mk
++
++PKG_NAME:=dsl_vr9_firmware_xdsl
++PKG_VERSION:=05.07.04.03.00.06_05.07.01.08.00.01_osc
++PKG_RELEASE:=1
++PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
++PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
++PKG_MD5SUM:=4c8d9ca68dda88d3cfc0ca0fb946a63e
++
++include $(INCLUDE_DIR)/package.mk
++
++define Package/dsl-vrx200-firmware-xdsl-a
++  SECTION:=firmware
++  CATEGORY:=Firmware
++  TITLE:=VRX200 / VR9 CPE xDSL Annex A firmware
++  URL:=http://www.lantiq.com/
++  DEPENDS:=@TARGET_lantiq_xrx200
++endef
++
++define Package/dsl-vrx200-firmware-xdsl-a/description
++	VRX200 / VR9 CPE VDSL and ADSL Annex A firmware
++endef
++
++define Build/Prepare
++	rm -rf $(PKG_BUILD_DIR)
++	mkdir -p $(PKG_BUILD_DIR)
++	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(PKG_SOURCE)
++endef
++
++define Build/Compile
++endef
++
++define Package/dsl-vrx200-firmware-xdsl-a/install
++	$(INSTALL_DIR) $(1)/lib/firmware/
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/LICENSE $(1)/lib/firmware/xcpe_574306_571801.LICENSE
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/xcpe_574306_571801.bin $(1)/lib/firmware/
++	ln -s xcpe_574306_571801.bin $(1)/lib/firmware/vdsl.bin
++	ln -s xcpe_574306_571801.bin $(1)/lib/firmware/adsl-a.bin
++endef
++
++$(eval $(call BuildPackage,dsl-vrx200-firmware-xdsl-a))
+diff --git a/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-b/Makefile b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-b/Makefile
+new file mode 100644
+index 0000000..c283da2
+--- /dev/null
++++ b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-b/Makefile
+@@ -0,0 +1,47 @@
++# Copyright (C) 2015 OpenWrt.org
++# Copyright (C) 2015 Lantiq Beteiligungs GmbH & Co KG.
++#
++# This is free software, licensed under the GNU General Public License v2.
++# See /LICENSE for more information.
++
++include $(TOPDIR)/rules.mk
++
++PKG_NAME:=dsl_vr9_firmware_xdsl
++PKG_VERSION:=05.07.03.03.00.06_05.07.01.0C.00.02_osc
++PKG_RELEASE:=1
++PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
++PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
++PKG_MD5SUM:=af5581836cbe574574590c046fe45bab
++
++include $(INCLUDE_DIR)/package.mk
++
++define Package/dsl-vrx200-firmware-xdsl-b
++  SECTION:=firmware
++  CATEGORY:=Firmware
++  TITLE:=VRX200 / VR9 CPE xDSL Annex B firmware
++  URL:=http://www.lantiq.com/
++  DEPENDS:=@TARGET_lantiq_xrx200
++endef
++
++define Package/dsl-vrx200-firmware-xdsl-b/description
++	VRX200 / VR9 CPE VDSL and ADSL Annex B firmware
++endef
++
++define Build/Prepare
++	rm -rf $(PKG_BUILD_DIR)
++	mkdir -p $(PKG_BUILD_DIR)
++	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(PKG_SOURCE)
++endef
++
++define Build/Compile
++endef
++
++define Package/dsl-vrx200-firmware-xdsl-b/install
++	$(INSTALL_DIR) $(1)/lib/firmware/
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/LICENSE $(1)/lib/firmware/xcpe_573306_571C02.LICENSE
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/xcpe_573306_571C02.bin $(1)/lib/firmware/
++	ln -s xcpe_573306_571C02.bin $(1)/lib/firmware/vdsl.bin
++	ln -s xcpe_573306_571C02.bin $(1)/lib/firmware/adsl-b.bin
++endef
++
++$(eval $(call BuildPackage,dsl-vrx200-firmware-xdsl-b))
+diff --git a/package/firmware/linux-firmware/Makefile b/package/firmware/linux-firmware/Makefile
+index 015aff7..2fcd93b 100644
+--- a/package/firmware/linux-firmware/Makefile
++++ b/package/firmware/linux-firmware/Makefile
+@@ -8,56 +8,33 @@
+ include $(TOPDIR)/rules.mk
+ 
+ PKG_NAME:=linux-firmware
+-PKG_SOURCE_VERSION:=f8c22c692bdee57a20b092e647464ff6176df3ed
+-PKG_VERSION:=2014-03-16-$(PKG_SOURCE_VERSION)
++PKG_SOURCE_VERSION:=52442afee9907bc32a058f22bb3295d040677c26
++PKG_VERSION:=2016-01-25-$(PKG_SOURCE_VERSION)
+ PKG_RELEASE:=1
+ 
+ PKG_SOURCE_PROTO:=git
+ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+-PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
++PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_VERSION)
++PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_SUBDIR)
+ PKG_SOURCE_URL:=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
+ PKG_MIRROR_MD5SUM:=ca4d289ad9380471cae376fc7dd3660a
+ 
+ PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
+ 
+-include $(INCLUDE_DIR)/package.mk
+-
+-define Package/r8169-firmware
+-  SECTION:=firmware
+-  CATEGORY:=Firmware
+-  URL:=http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git
+-  TITLE:=RealTek r8169 firmware
+-endef
+-
+-define Build/Compile
++SCAN_DEPS = *.mk
+ 
+-endef
+-
+-define Package/r8169-firmware/install
+-	$(INSTALL_DIR) $(1)/lib/firmware/rtl_nic
+-	$(CP) \
+-		$(PKG_BUILD_DIR)/rtl_nic/* \
+-		$(1)/lib/firmware/rtl_nic
+-endef
+-
+-$(eval $(call BuildPackage,r8169-firmware))
++include $(INCLUDE_DIR)/package.mk
+ 
+-define Package/r8188eu-firmware
++define Package/firmware-default
+   SECTION:=firmware
+   CATEGORY:=Firmware
+   URL:=http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git
+-  TITLE:=RealTek r8188eu firmware
++  TITLE:=$(1)
+ endef
+ 
+ define Build/Compile
+ 
+ endef
+ 
+-define Package/r8188eu-firmware/install
+-	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
+-	$(CP) \
+-		$(PKG_BUILD_DIR)/rtlwifi/rtl8188eufw.bin \
+-		$(1)/lib/firmware/rtlwifi
+-endef
+-
+-$(eval $(call BuildPackage,r8188eu-firmware))
++include $(wildcard ./*.mk)
++#$(eval $(call BuildPackage,linux-firmware))
+diff --git a/package/firmware/linux-firmware/broadcom.mk b/package/firmware/linux-firmware/broadcom.mk
+new file mode 100644
+index 0000000..659dc82
+--- /dev/null
++++ b/package/firmware/linux-firmware/broadcom.mk
+@@ -0,0 +1,45 @@
++Package/brcmfmac-firmware-pcie = $(call Package/firmware-default,Broadcom BCM43xx fullmac PCIe firmware)
++define Package/brcmfmac-firmware-pcie/install
++	$(INSTALL_DIR) $(1)/lib/firmware/brcm
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/brcm/brcmfmac43602-pcie.ap.bin \
++		$(1)/lib/firmware/brcm/brcmfmac43602-pcie.bin
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/brcm/brcmfmac4366b-pcie.bin \
++		$(1)/lib/firmware/brcm/
++endef
++$(eval $(call BuildPackage,brcmfmac-firmware-pcie))
++
++Package/brcmfmac-firmware-sdio = $(call Package/firmware-default,Broadcom BCM43xx fullmac SDIO firmware)
++define Package/brcmfmac-firmware-sdio/install
++	$(INSTALL_DIR) $(1)/lib/firmware/brcm
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/brcm/brcmfmac4329-sdio.bin \
++		$(1)/lib/firmware/brcm/brcmfmac4329-sdio.bin
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/brcm/brcmfmac43362-sdio.bin \
++		$(1)/lib/firmware/brcm/brcmfmac43362-sdio.bin
++endef
++$(eval $(call BuildPackage,brcmfmac-firmware-sdio))
++
++Package/brcmfmac-firmware-usb = $(call Package/firmware-default,Broadcom BCM43xx fullmac USB firmware)
++define Package/brcmfmac-firmware-usb/install
++	$(INSTALL_DIR) $(1)/lib/firmware/brcm
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/brcm/brcmfmac43236b.bin \
++		$(1)/lib/firmware/brcm/
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/brcm/brcmfmac43143.bin \
++		$(1)/lib/firmware/brcm/
++endef
++$(eval $(call BuildPackage,brcmfmac-firmware-usb))
++
++Package/brcmsmac-firmware = $(call Package/firmware-default,Broadcom BCM43xx softmac PCIe firmware)
++define Package/brcmsmac-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/brcm
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx-0.fw \
++		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx_hdr-0.fw \
++		$(1)/lib/firmware/brcm/
++endef
++$(eval $(call BuildPackage,brcmsmac-firmware))
+diff --git a/package/firmware/linux-firmware/intel.mk b/package/firmware/linux-firmware/intel.mk
+new file mode 100644
+index 0000000..f5adfaf
+--- /dev/null
++++ b/package/firmware/linux-firmware/intel.mk
+@@ -0,0 +1,192 @@
++Package/ibt-firmware = $(call Package/firmware-default,Intel bluetooth firmware)
++define Package/ibt-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/intel
++	$(CP) \
++		$(PKG_BUILD_DIR)/intel/*.bseq \
++		$(1)/lib/firmware/intel
++endef
++$(eval $(call BuildPackage,ibt-firmware))
++
++Package/iwl3945-firmware = $(call Package/firmware-default,Intel IWL3945 firmware)
++define Package/iwl3945-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-3945-2.ucode $(1)/lib/firmware
++endef
++$(eval $(call BuildPackage,iwl3945-firmware))
++
++Package/iwl4965-firmware = $(call Package/firmware-default,Intel IWL4965 firmware)
++define Package/iwl4965-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-4965-2.ucode $(1)/lib/firmware
++endef
++$(eval $(call BuildPackage,iwl4965-firmware))
++
++Package/iwlwifi-firmware = $(call Package/firmware-default,Intel wireless firmware)
++define Package/iwlwifi-firmware/config
++  if PACKAGE_iwlwifi-firmware
++	config IWL100_FW
++		bool "Intel 100 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Wireless-N 100
++
++	config IWL1000_FW
++		bool "Intel 1000 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Wireless-N 1000
++
++	config IWL105_FW
++		bool "Intel 105 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Wireless-N 105
++
++	config IWL135_FW
++		bool "Intel 135 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Wireless-N 135
++
++	config IWL2000_FW
++		bool "Intel 2000 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Wireless-N 2200
++
++	config IWL2030_FW
++		bool "Intel 2030 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Wireless-N 2230
++
++	config IWL3160_FW
++		bool "Intel 3160 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Wireless WiFi 3160
++
++	config IWL5000_FW
++		bool "Intel 5000 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
++
++	config IWL5150_FW
++		bool "Intel 5150 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Wireless WiFi 5150AGN
++
++	config IWL6000_FW
++		bool "Intel 6000 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Ultimate-N 6300 and Advanced-N 6200
++
++	config IWL6005_FW
++		bool "Intel 6005 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Advanced-N 6205
++
++	config IWL6030_FW
++		bool "Intel 6030 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Advanced-N 6230, Wireless-N 1030, Wireless-N 130 and Advanced-N 6235
++
++	config IWL6050_FW
++		bool "Intel 6050 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Centrino Advanced-N + WiMAX 6250 and Wireless-N + WiMAX 6150
++
++	config IWL7260_FW
++		bool "Intel 7260 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Dual Band Wireless-N 7260 and Intel Dual Band Wireless-AC 7260
++
++	config IWL7265_FW
++		bool "Intel 7265 Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Wireless 7265, 7265D, 3165
++
++	config IWL8000_FW
++		bool "Intel 8000 Series Firmware"
++		default y
++		help
++		  Download and install firmware for:
++		    Intel Wireless Series 8260, 4165
++  endif
++endef
++define Package/iwlwifi-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++ifneq ($(CONFIG_IWL100_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-100-5.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL1000_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-1000-5.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL105_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-105-6.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL135_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-135-6.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL2000_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-2000-6.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL2030_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-2030-6.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL3160_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-3160-16.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL5000_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-5000-5.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL5150_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-5150-2.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL6000_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6000-4.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL6005_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6000g2a-6.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL6030_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6000g2b-6.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL6050_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6050-5.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL7260_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-7260-16.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL7265_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-7265-16.ucode $(1)/lib/firmware
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-7265D-16.ucode $(1)/lib/firmware
++endif
++ifneq ($(CONFIG_IWL8000_FW),)
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-8000C-16.ucode $(1)/lib/firmware
++endif
++endef
++$(eval $(call BuildPackage,iwlwifi-firmware))
+diff --git a/package/firmware/linux-firmware/marvell.mk b/package/firmware/linux-firmware/marvell.mk
+new file mode 100644
+index 0000000..86c0e6f
+--- /dev/null
++++ b/package/firmware/linux-firmware/marvell.mk
+@@ -0,0 +1,46 @@
++Package/mwl8k-firmware = $(call Package/firmware-default,Marvell 8366/8687 firmware)
++define Package/mwl8k-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/mwl8k
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/mwl8k/fmimage_8366_ap-3.fw \
++		$(PKG_BUILD_DIR)/mwl8k/fmimage_8366.fw \
++		$(PKG_BUILD_DIR)/mwl8k/helper_8366.fw \
++		$(PKG_BUILD_DIR)/mwl8k/fmimage_8687.fw \
++		$(PKG_BUILD_DIR)/mwl8k/helper_8687.fw \
++		$(1)/lib/firmware/mwl8k/
++endef
++$(eval $(call BuildPackage,mwl8k-firmware))
++
++Package/mwifiex-pcie-firmware = $(call Package/firmware-default,Marvell 8897 firmware)
++define Package/mwifiex-pcie-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/mrvl
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/mrvl/pcie8897_uapsta.bin \
++		$(1)/lib/firmware/mrvl/
++endef
++$(eval $(call BuildPackage,mwifiex-pcie-firmware))
++
++Package/libertas-usb-firmware = $(call Package/firmware-default,Marvell 8388/8682 USB firmware)
++define Package/libertas-usb-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/libertas
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/libertas/usb8388_v9.bin \
++		$(PKG_BUILD_DIR)/libertas/usb8682.bin \
++		$(1)/lib/firmware/libertas/
++endef
++$(eval $(call BuildPackage,libertas-usb-firmware))
++
++Package/libertas-sdio-firmware = $(call Package/firmware-default,Marvell 8385/8686/8688 SDIO firmware)
++define Package/libertas-sdio-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/libertas
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/libertas/sd8385_helper.bin \
++		$(PKG_BUILD_DIR)/libertas/sd8385.bin \
++		$(PKG_BUILD_DIR)/libertas/sd8686_v9_helper.bin \
++		$(PKG_BUILD_DIR)/libertas/sd8686_v9.bin \
++		$(PKG_BUILD_DIR)/libertas/sd8688_helper.bin \
++		$(PKG_BUILD_DIR)/libertas/sd8688.bin \
++		$(1)/lib/firmware/libertas
++endef
++$(eval $(call BuildPackage,libertas-sdio-firmware))
++
+diff --git a/package/firmware/linux-firmware/mediatek.mk b/package/firmware/linux-firmware/mediatek.mk
+new file mode 100644
+index 0000000..591ffee
+--- /dev/null
++++ b/package/firmware/linux-firmware/mediatek.mk
+@@ -0,0 +1,43 @@
++Package/mt7601u-firmware = $(call Package/firmware-default,MediaTek MT7601U firmware)
++define Package/mt7601u-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/mt7601u.bin \
++		$(1)/lib/firmware
++endef
++$(eval $(call BuildPackage,mt7601u-firmware))
++
++Package/rt2800-pci-firmware = $(call Package/firmware-default,Ralink RT28xx/3xxx PCI/SoC firmware)
++define Package/rt2800-pci-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/rt2860.bin \
++		$(PKG_BUILD_DIR)/rt3290.bin \
++		$(1)/lib/firmware
++endef
++$(eval $(call BuildPackage,rt2800-pci-firmware))
++
++Package/rt2800-usb-firmware = $(call Package/firmware-default,Ralink RT28xx/3xxx USB firmware)
++define Package/rt2800-usb-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rt2870.bin $(1)/lib/firmware/
++endef
++$(eval $(call BuildPackage,rt2800-usb-firmware))
++
++Package/rt61-pci-firmware = $(call Package/firmware-default,Ralink RT2561 firmware)
++define Package/rt61-pci-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/rt2561.bin \
++		$(PKG_BUILD_DIR)/rt2561s.bin \
++		$(PKG_BUILD_DIR)/rt2661.bin \
++		$(1)/lib/firmware/
++endef
++$(eval $(call BuildPackage,rt61-pci-firmware))
++
++Package/rt73-pci-firmware = $(call Package/firmware-default,Ralink RT2573 firmware)
++define Package/rt73-usb-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rt73.bin $(1)/lib/firmware/
++endef
++$(eval $(call BuildPackage,rt73-pci-firmware))
+diff --git a/package/firmware/linux-firmware/qca.mk b/package/firmware/linux-firmware/qca.mk
+new file mode 100644
+index 0000000..7ad27ef
+--- /dev/null
++++ b/package/firmware/linux-firmware/qca.mk
+@@ -0,0 +1,25 @@
++Package/ar3k-firmware = $(call Package/firmware-default,ath3k firmware)
++define Package/ar3k-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ar3k
++	$(CP) \
++		$(PKG_BUILD_DIR)/ar3k/*.dfu \
++		$(1)/lib/firmware/ar3k
++endef
++$(eval $(call BuildPackage,ar3k-firmware))
++
++Package/ath9k-htc-firmware = $(call Package/firmware-default,AR9271/AR7010 firmware)
++define Package/ath9k-htc-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ath9k_htc
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/ath9k_htc/htc_9271-1.4.0.fw \
++		$(PKG_BUILD_DIR)/ath9k_htc/htc_7010-1.4.0.fw \
++		$(1)/lib/firmware/ath9k_htc
++endef
++$(eval $(call BuildPackage,ath9k-htc-firmware))
++
++Package/carl9170-firmware = $(call Package/firmware-default,AR9170 firmware)
++define Package/carl9170-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/carl9170-1.fw $(1)/lib/firmware
++endef
++$(eval $(call BuildPackage,carl9170-firmware))
+diff --git a/package/firmware/linux-firmware/realtek.mk b/package/firmware/linux-firmware/realtek.mk
+new file mode 100644
+index 0000000..0f8b1ce
+--- /dev/null
++++ b/package/firmware/linux-firmware/realtek.mk
+@@ -0,0 +1,50 @@
++Package/r8169-firmware = $(call Package/firmware-default,RealTek RTL8169 firmware)
++define Package/r8169-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/rtl_nic
++	$(CP) \
++		$(PKG_BUILD_DIR)/rtl_nic/* \
++		$(1)/lib/firmware/rtl_nic
++endef
++$(eval $(call BuildPackage,r8169-firmware))
++
++Package/r8188eu-firmware = $(call Package/firmware-default,RealTek RTL8188EU firmware)
++define Package/r8188eu-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
++	$(CP) \
++		$(PKG_BUILD_DIR)/rtlwifi/rtl8188eufw.bin \
++		$(1)/lib/firmware/rtlwifi
++endef
++$(eval $(call BuildPackage,r8188eu-firmware))
++
++Package/rtl8192ce-firmware = $(call Package/firmware-default,RealTek RTL8192CE firmware)
++define Package/rtl8192ce-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cfw.bin $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cfwU.bin $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cfwU_B.bin $(1)/lib/firmware/rtlwifi
++endef
++$(eval $(call BuildPackage,rtl8192ce-firmware))
++
++Package/rtl8192cu-firmware = $(call Package/firmware-default,RealTek RTL8192CU firmware)
++define Package/rtl8192cu-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw.bin $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw_A.bin $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw_B.bin $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw_TMSC.bin $(1)/lib/firmware/rtlwifi
++endef
++$(eval $(call BuildPackage,rtl8192cu-firmware))
++
++Package/rtl8192de-firmware = $(call Package/firmware-default,RealTek RTL8192DE firmware)
++define Package/rtl8192de-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192defw.bin $(1)/lib/firmware/rtlwifi
++endef
++$(eval $(call BuildPackage,rtl8192de-firmware))
++
++Package/rtl8192se-firmware = $(call Package/firmware-default,RealTek RTL8192SE firmware)
++define KernelPackage/rtl8192se/install
++	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192sefw.bin $(1)/lib/firmware/rtlwifi
++endef
++$(eval $(call BuildPackage,rtl8192se-firmware))
+diff --git a/package/firmware/linux-firmware/ti.mk b/package/firmware/linux-firmware/ti.mk
+new file mode 100644
+index 0000000..a1e12fc
+--- /dev/null
++++ b/package/firmware/linux-firmware/ti.mk
+@@ -0,0 +1,25 @@
++Package/wl12xx-firmware = $(call Package/firmware-default,TI WL12xx firmware)
++define Package/wl12xx-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl127x-fw-5-mr.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl127x-fw-5-plt.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl127x-fw-5-sr.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl1271-nvs.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-fw-5-mr.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-fw-5-plt.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-fw-5-sr.bin \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-nvs.bin \
++		$(1)/lib/firmware/ti-connectivity
++endef
++$(eval $(call BuildPackage,wl12xx-firmware))
++
++Package/wl18xx-firmware = $(call Package/firmware-default,TI WL18xx firmware)
++define Package/wl18xx-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/ti-connectivity/wl18xx-fw-4.bin \
++		$(1)/lib/firmware/ti-connectivity
++endef
++$(eval $(call BuildPackage,wl18xx-firmware))
++
+diff --git a/package/kernel/acx-mac80211/Makefile b/package/kernel/acx-mac80211/Makefile
+index 1820e7a..c5c020d 100644
+--- a/package/kernel/acx-mac80211/Makefile
++++ b/package/kernel/acx-mac80211/Makefile
+@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
+ include $(INCLUDE_DIR)/kernel.mk
+ 
+ PKG_NAME:=acx-mac80211
+-PKG_REV:=v20130127
+-PKG_VERSION:=20130909
++PKG_REV:=b6fc31491020cb01d2cd1acc170cfa03ced7e726
++PKG_VERSION:=20140216
+ PKG_RELEASE:=1
+ 
+ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+-PKG_SOURCE_URL:=git://acx100.git.sourceforge.net/gitroot/acx100/acx-mac80211
++PKG_SOURCE_URL:=git://git.code.sf.net/p/acx100/acx-mac80211
+ PKG_SOURCE_PROTO:=git
+ PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+ PKG_SOURCE_VERSION:=$(PKG_REV)
+@@ -190,7 +190,7 @@ define Build/Compile
+ 		CROSS_COMPILE="$(TARGET_CROSS)" \
+ 		SUBDIRS="$(PKG_BUILD_DIR)" \
+ 		$(PKG_EXTRA_KCONFIG) \
+-		EXTRA_CFLAGS="$(PKG_EXTRA_CFLAGS) -DCONFIG_ACX_MAC80211_VERSION=\"KERNEL_VERSION(3,14,0)\"" \
++		EXTRA_CFLAGS="$(PKG_EXTRA_CFLAGS) -DCONFIG_ACX_MAC80211_VERSION=\"KERNEL_VERSION(4,2,0)\"" \
+ 		LINUXINCLUDE="-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi -I$(STAGING_DIR)/usr/include/mac80211-backport \
+ 			-I$(STAGING_DIR)/usr/include/mac80211/uapi -I$(STAGING_DIR)/usr/include/mac80211 \
+ 			-I$(LINUX_DIR)/include -I$(LINUX_DIR)/include/$(LINUX_UAPI_DIR) \
+diff --git a/package/kernel/acx-mac80211/patches/001-pci-mem-Fix-3.8-build.patch b/package/kernel/acx-mac80211/patches/001-pci-mem-Fix-3.8-build.patch
+deleted file mode 100644
+index fa4a6be..0000000
+--- a/package/kernel/acx-mac80211/patches/001-pci-mem-Fix-3.8-build.patch
++++ /dev/null
+@@ -1,129 +0,0 @@
+-From 8a0f5890019bf43f4bc95ef0754b062ddfcfa9cd Mon Sep 17 00:00:00 2001
+-From: Oliver Winker <oliver@oli1170.net>
+-Date: Sun, 10 Mar 2013 21:04:23 +0100
+-Subject: [PATCH 1/3] pci, mem: Fix 3.8 build
+-
+-__devexit and __devinit not used anymore in 3.8
+-
+-Signed-off-by: Reinhard Karcher <reinhard.karcher@gmx.net>
+-Signed-off-by: Oliver Winker <oliver@oli1170.net>
+----
+- mem.c | 13 ++++++++++++-
+- pci.c | 26 +++++++++++++++++++++++++-
+- 2 files changed, 37 insertions(+), 2 deletions(-)
+-
+---- a/mem.c
+-+++ b/mem.c
+-@@ -2216,7 +2216,11 @@ int acx100mem_ioctl_set_phy_amp_bias(str
+-  * ==================================================
+-  */
+- 
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- static int __devinit acxmem_probe(struct platform_device *pdev)
+-+#else
+-+static int acxmem_probe(struct platform_device *pdev)
+-+#endif
+- {
+- 	acx_device_t *adev = NULL;
+- 	const char *chip_name;
+-@@ -2392,7 +2396,11 @@ static int __devinit acxmem_probe(struct
+-  * pdev - ptr to PCI device structure containing info about pci
+-  * configuration
+-  */
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- static int __devexit acxmem_remove(struct platform_device *pdev)
+-+#else
+-+static int acxmem_remove(struct platform_device *pdev)
+-+#endif
+- {
+- 	struct ieee80211_hw *hw = (struct ieee80211_hw *)
+- 		platform_get_drvdata(pdev);
+-@@ -2594,8 +2602,11 @@ static struct platform_driver acxmem_dri
+- 		.name = "acx-mem",
+- 	},
+- 	.probe = acxmem_probe,
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- 	.remove = __devexit_p(acxmem_remove),
+--
+-+#else
+-+	.remove = acxmem_remove,
+-+#endif
+- #ifdef CONFIG_PM
+- 	.suspend = acxmem_e_suspend,
+- 	.resume = acxmem_e_resume
+---- a/pci.c
+-+++ b/pci.c
+-@@ -1039,7 +1039,11 @@ int acx100pci_ioctl_set_phy_amp_bias(str
+-  * id	- ptr to the device id entry that matched this device
+-  */
+- #ifdef CONFIG_PCI
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- static int __devinit acxpci_probe(struct pci_dev *pdev,
+-+#else
+-+static int acxpci_probe(struct pci_dev *pdev,
+-+#endif
+- 				const struct pci_device_id *id)
+- {
+- 	unsigned long mem_region1 = 0;
+-@@ -1292,7 +1296,11 @@ static int __devinit acxpci_probe(struct
+-  *
+-  * pdev - ptr to PCI device structure containing info about pci configuration
+-  */
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- static void __devexit acxpci_remove(struct pci_dev *pdev)
+-+#else
+-+static void acxpci_remove(struct pci_dev *pdev)
+-+#endif
+- {
+- 	struct ieee80211_hw *hw
+- 		= (struct ieee80211_hw *) pci_get_drvdata(pdev);
+-@@ -1505,7 +1513,11 @@ static struct pci_driver acxpci_driver =
+- 	.name		= "acx_pci",
+- 	.id_table	= acxpci_id_tbl,
+- 	.probe		= acxpci_probe,
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- 	.remove		= __devexit_p(acxpci_remove),
+-+#else
+-+	.remove		= acxpci_remove,
+-+#endif
+- #ifdef CONFIG_PM
+- 	.suspend	= acxpci_e_suspend,
+- 	.resume		= acxpci_e_resume
+-@@ -1603,8 +1615,12 @@ static struct vlynq_device_id acx_vlynq_
+- };
+- 
+- 
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- static __devinit int vlynq_probe(struct vlynq_device *vdev,
+--				 struct vlynq_device_id *id)
+-+#else
+-+static int vlynq_probe(struct vlynq_device *vdev,
+-+#endif
+-+				  struct vlynq_device_id *id)
+- {
+- 	int result = -EIO, i;
+- 	u32 addr;
+-@@ -1785,7 +1801,11 @@ static __devinit int vlynq_probe(struct
+- 	return result;
+- }
+- 
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- static __devexit void vlynq_remove(struct vlynq_device *vdev)
+-+#else
+-+static void vlynq_remove(struct vlynq_device *vdev)
+-+#endif
+- {
+- 	struct ieee80211_hw *hw = vlynq_get_drvdata(vdev);
+- 	acx_device_t *adev = hw2adev(hw);
+-@@ -1851,7 +1871,11 @@ static struct vlynq_driver acxvlynq_driv
+- 	.name = "acx_vlynq",
+- 	.id_table = acx_vlynq_id,
+- 	.probe = vlynq_probe,
+-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+- 	.remove = __devexit_p(vlynq_remove),
+-+#else
+-+	.remove = vlynq_remove,
+-+#endif
+- };
+- #endif /* CONFIG_VLYNQ */
+- 
+diff --git a/package/kernel/acx-mac80211/patches/003-Fix-3.10-build.patch b/package/kernel/acx-mac80211/patches/003-Fix-3.10-build.patch
+deleted file mode 100644
+index c737844..0000000
+--- a/package/kernel/acx-mac80211/patches/003-Fix-3.10-build.patch
++++ /dev/null
+@@ -1,31 +0,0 @@
+-From 1daf4bfdb072b08f3b4e412bbfa9645f88dc0a01 Mon Sep 17 00:00:00 2001
+-From: Oliver Winker <oliver@oli1170.net>
+-Date: Tue, 3 Sep 2013 20:36:36 +0200
+-Subject: [PATCH 3/3] Fix 3.10 build
+-
+-Signed-off-by: Reinhard Karcher <reinhard.karcher@gmx.net>
+-Signed-off-by: Oliver Winker <oliver@oli1170.net>
+----
+- main.c | 7 +++++++
+- 1 file changed, 7 insertions(+)
+-
+---- a/main.c
+-+++ b/main.c
+-@@ -682,10 +682,17 @@ int acx_op_config(struct ieee80211_hw *h
+- 
+- 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+- 		logf1(L_DEBUG, "IEEE80211_CONF_CHANGE_CHANNEL,"
+-+#if CONFIG_ACX_MAC80211_VERSION >= KERNEL_VERSION(3, 10, 0)
+-+			"channel->hw_value=%i\n", conf->chandef.chan->hw_value);
+-+
+-+		acx_set_channel(adev, conf->chandef.chan->hw_value,
+-+				conf->chandef.chan->center_freq);
+-+#else
+- 			"channel->hw_value=%i\n", conf->channel->hw_value);
+- 
+- 		acx_set_channel(adev, conf->channel->hw_value,
+- 				conf->channel->center_freq);
+-+#endif
+- 
+- 		changed_not_done &= ~IEEE80211_CONF_CHANGE_CHANNEL;
+- 	}
+diff --git a/package/kernel/acx-mac80211/patches/004-Fix-3.14-build.patch b/package/kernel/acx-mac80211/patches/004-Fix-3.14-build.patch
+deleted file mode 100644
+index 847b573..0000000
+--- a/package/kernel/acx-mac80211/patches/004-Fix-3.14-build.patch
++++ /dev/null
+@@ -1,22 +0,0 @@
+-From d17fcac710e629463591f6bd09d76b66ec591583 Mon Sep 17 00:00:00 2001
+-From: Hauke Mehrtens <hauke@hauke-m.de>
+-Date: Wed, 5 Feb 2014 20:57:07 +0100
+-Subject: [PATCH] Fix 3.14 build
+-
+-Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+----
+- main.c |    2 ++
+- 1 file changed, 2 insertions(+)
+-
+---- a/main.c
+-+++ b/main.c
+-@@ -500,7 +500,9 @@ int acx_init_ieee80211(acx_device_t *ade
+- 	hw->flags &= ~IEEE80211_HW_RX_INCLUDES_FCS;
+- 	hw->queues = 1;
+- 	hw->wiphy->max_scan_ssids = 1;
+-+#if CONFIG_ACX_MAC80211_VERSION < KERNEL_VERSION(3, 14, 0)
+- 	hw->channel_change_time = 10000;
+-+#endif
+- 
+- 	/* OW TODO Check if RTS/CTS threshold can be included here */
+- 
+diff --git a/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch b/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch
+new file mode 100644
+index 0000000..ee92b94
+--- /dev/null
++++ b/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch
+@@ -0,0 +1,67 @@
++diff --git a/main.c b/main.c
++index bfec856..3c482d9 100644
++--- a/main.c
+++++ b/main.c
++@@ -497,7 +497,7 @@ int acx_free_mechanics(acx_device_t *adev)
++ 
++ int acx_init_ieee80211(acx_device_t *adev, struct ieee80211_hw *hw)
++ {
++-	hw->flags &= ~IEEE80211_HW_RX_INCLUDES_FCS;
+++	__clear_bit(IEEE80211_HW_RX_INCLUDES_FCS, hw->flags);
++ 	hw->queues = 1;
++ 	hw->wiphy->max_scan_ssids = 1;
++ 
++@@ -525,7 +525,7 @@ int acx_init_ieee80211(acx_device_t *adev, struct ieee80211_hw *hw)
++ 	/* We base signal quality on winlevel approach of previous driver
++ 	 * TODO OW 20100615 This should into a common init code
++ 	 */
++-	hw->flags |= IEEE80211_HW_SIGNAL_UNSPEC;
+++	__set_bit(IEEE80211_HW_SIGNAL_UNSPEC, hw->flags);
++ 	hw->max_signal = 100;
++ 
++ 	if (IS_ACX100(adev)) {
++@@ -945,8 +945,8 @@ void acx_op_configure_filter(struct ieee80211_hw *hw,
++ 		changed_flags, *total_flags);
++ 
++ 	/* OWI TODO: Set also FIF_PROBE_REQ ? */
++-	*total_flags &= (FIF_PROMISC_IN_BSS | FIF_ALLMULTI | FIF_FCSFAIL
++-			| FIF_CONTROL | FIF_OTHER_BSS);
+++	*total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_CONTROL
+++			| FIF_OTHER_BSS);
++ 
++ 	logf1(L_DEBUG, "2: *total_flags=0x%08x\n", *total_flags);
++ 
++@@ -1045,9 +1045,10 @@ void acx_op_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
++ }
++ 
++ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++-                   struct cfg80211_scan_request *req)
+++                   struct ieee80211_scan_request *hw_req)
++ {
++ 	acx_device_t *adev = hw2adev(hw);
+++	struct cfg80211_scan_request *req = &hw_req->req;
++ 	struct sk_buff *skb;
++ 	size_t ssid_len = 0;
++ 	u8 *ssid = NULL;
++@@ -1082,7 +1083,7 @@ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++ 		goto out;
++ 	}
++ #else
++-	skb = ieee80211_probereq_get(adev->hw, adev->vif, ssid, ssid_len,
+++	skb = ieee80211_probereq_get(adev->hw, vif->addr, ssid, ssid_len,
++ 		req->ie_len);
++ 	if (!skb) {
++ 		ret = -ENOMEM;
++diff --git a/main.h b/main.h
++index 293f5c8..84ecb9a 100644
++--- a/main.h
+++++ b/main.h
++@@ -62,7 +62,7 @@ void acx_op_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
++ #endif
++ 
++ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++-                   struct cfg80211_scan_request *req);
+++                   struct ieee80211_scan_request *req);
++ 
++ int acx_recover_hw(acx_device_t *adev);
++ 
 diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
-index a1eedce..566e156 100644
+index a1eedce..156ea01 100644
 --- a/package/kernel/mac80211/Makefile
 +++ b/package/kernel/mac80211/Makefile
 @@ -10,11 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
@@ -12,16 +1159,16 @@ index a1eedce..566e156 100644
  
 -PKG_VERSION:=2015-03-09
 -PKG_RELEASE:=3
-+PKG_VERSION:=2015-07-21
++PKG_VERSION:=2016-01-10
 +PKG_RELEASE:=1
  PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
  PKG_BACKPORT_VERSION:=
 -PKG_MD5SUM:=6d4b04e4ce8a1f54dabfb04f4709453c
-+PKG_MD5SUM:=ec529acfb9c942daf8116e5cff47c999
++PKG_MD5SUM:=be5fae2e8d6f7490f9b073374fb895ba
  
  PKG_SOURCE:=compat-wireless-$(PKG_VERSION)$(PKG_BACKPORT_VERSION).tar.bz2
  PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
-@@ -23,15 +23,28 @@ PKG_BUILD_PARALLEL:=1
+@@ -23,15 +23,29 @@ PKG_BUILD_PARALLEL:=1
  PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
  
  PKG_DRIVERS = \
@@ -53,12 +1200,13 @@ index a1eedce..566e156 100644
  	rtlwifi rtlwifi-pci rtlwifi-usb rtl8192c-common rtl8192ce rtl8192se \
 -	rtl8192de rtl8192cu
 +	rtl8192de rtl8192cu \
++	rtl8xxxu \
 +	wlcore wl12xx wl18xx \
 +	zd1211rw
  
  PKG_CONFIG_DEPENDS:= \
  	CONFIG_PACKAGE_kmod-mac80211 \
-@@ -60,7 +73,6 @@ define KernelPackage/mac80211/Default
+@@ -60,7 +74,6 @@ define KernelPackage/mac80211/Default
    SUBMENU:=$(WMENU)
    URL:=https://wireless.wiki.kernel.org/
    MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
@@ -66,21 +1214,45 @@ index a1eedce..566e156 100644
  endef
  
  define KernelPackage/cfg80211
-@@ -109,8 +121,8 @@ Generic IEEE 802.11 Networking Stack (mac80211)
+@@ -97,6 +110,15 @@ define KernelPackage/mac80211/config
+ 		  Select this to see extensive information about
+ 		  the internal state of mac80211 in debugfs.
+ 
++	config PACKAGE_MAC80211_TRACING
++		bool "Enable tracing (mac80211 and supported drivers)"
++		select KERNEL_FTRACE
++		select KERNEL_ENABLE_DEFAULT_TRACERS
++		default n
++		help
++		  Select this to enable tracing of mac80211 and
++		  related wifi drivers (using trace-cmd).
++
+ 	config PACKAGE_MAC80211_MESH
+ 		bool "Enable 802.11s mesh support"
+ 		default y
+@@ -108,833 +130,703 @@ define KernelPackage/mac80211/description
+ Generic IEEE 802.11 Networking Stack (mac80211)
  endef
  
- PKG_LINUX_FIRMWARE_NAME:=linux-firmware
+-PKG_LINUX_FIRMWARE_NAME:=linux-firmware
 -PKG_LINUX_FIRMWARE_VERSION:=f404336ba808cbd57547196e13367079a23b822c
 -PKG_LINUX_FIRMWARE_SOURCE:=$(PKG_LINUX_FIRMWARE_NAME)-2015-03-20-$(PKG_LINUX_FIRMWARE_VERSION).tar.bz2
-+PKG_LINUX_FIRMWARE_VERSION:=6ebf5d57d9f6d0cf05558baef1af2b90a3fe98ed
-+PKG_LINUX_FIRMWARE_SOURCE:=$(PKG_LINUX_FIRMWARE_NAME)-2015-09-03-$(PKG_LINUX_FIRMWARE_VERSION).tar.xz
- PKG_LINUX_FIRMWARE_PROTO:=git
- PKG_LINUX_FIRMWARE_SOURCE_URL:=https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
- PKG_LINUX_FIRMWARE_SUBDIR:=$(PKG_LINUX_FIRMWARE_NAME)-$(PKG_LINUX_FIRMWARE_VERSION)
-@@ -127,723 +139,769 @@ define Download/linux-firmware
- endef
- $(eval $(call Download,linux-firmware))
- 
+-PKG_LINUX_FIRMWARE_PROTO:=git
+-PKG_LINUX_FIRMWARE_SOURCE_URL:=https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
+-PKG_LINUX_FIRMWARE_SUBDIR:=$(PKG_LINUX_FIRMWARE_NAME)-$(PKG_LINUX_FIRMWARE_VERSION)
+-#PKG_LINUX_FIRMWARE_MIRROR_MD5SUM:=e219333f01835c6e556875a9e0deb3f9
+-
+-define Download/linux-firmware
+-  FILE:=$(PKG_LINUX_FIRMWARE_SOURCE)
+-  URL:=$(PKG_LINUX_FIRMWARE_SOURCE_URL)
+-  MD5SUM:=$(PKG_LINUX_FIRMWARE_MD5SUM)
+-  PROTO:=$(PKG_LINUX_FIRMWARE_PROTO)
+-  VERSION:=$(PKG_LINUX_FIRMWARE_VERSION)
+-  SUBDIR:=$(PKG_LINUX_FIRMWARE_SUBDIR)
+-  MIRROR_MD5SUM:=$(PKG_LINUX_FIRMWARE_MIRROR_MD5SUM)
+-endef
+-$(eval $(call Download,linux-firmware))
+-
 -PKG_ATH10K_LINUX_FIRMWARE_NAME:=ath10k-firmware
 -PKG_ATH10K_LINUX_FIRMWARE_VERSION:=da0f85d924226ee30c46e037120621c9e192b39e
 -PKG_ATH10K_LINUX_FIRMWARE_SOURCE:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION).tar.bz2
@@ -88,7 +1260,7 @@ index a1eedce..566e156 100644
 -PKG_ATH10K_LINUX_FIRMWARE_SOURCE_URL:=https://github.com/kvalo/ath10k-firmware.git
 -PKG_ATH10K_LINUX_FIRMWARE_SUBDIR:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION)
 -#PKG_ATH10K_LINUX_FIRMWARE_MIRROR_MD5SUM:=?
- 
+-
 -define Download/ath10k-firmware
 -  FILE:=$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE)
 -  URL:=$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE_URL)
@@ -96,133 +1268,83 @@ index a1eedce..566e156 100644
 -  VERSION:=$(PKG_ATH10K_LINUX_FIRMWARE_VERSION)
 -  SUBDIR:=$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)
 -  #MIRROR_MD5SUM:=$(PKG_ATH10K_LINUX_FIRMWARE_MIRROR_MD5SUM)
-+define KernelPackage/adm8211
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=ADMTek 8211 support
-+  DEPENDS+=@PCI_SUPPORT +kmod-mac80211 +kmod-eeprom-93cx6
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/adm8211.ko
-+  AUTOLOAD:=$(call AutoProbe,adm8211)
- endef
+-endef
 -$(eval $(call Download,ath10k-firmware))
- 
+-
 -# Prism54 drivers
 -P54PCIFW:=2.13.12.0.arm
 -P54USBFW:=2.13.24.0.lm87.arm
 -P54SPIFW:=2.13.0.0.a.13.14.arm
-+define KernelPackage/ath/config
-+  if PACKAGE_kmod-ath
-+	config ATH_USER_REGD
-+		bool "Force Atheros drivers to respect the user's regdomain settings"
-+		help
-+		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
-+		  the regulatory limits and the user is only allowed to restrict the settings
-+		  even further, even if the country allows frequencies or power levels that
-+		  are forbidden by the EEPROM settings.
- 
+-
 -define Download/p54usb
 -  FILE:=$(P54USBFW)
 -  URL:=http://daemonizer.de/prism54/prism54-fw/fw-usb
 -  MD5SUM:=8e8ab005a4f8f0123bcdc51bc25b47f6
 -endef
 -$(eval $(call Download,p54usb))
-+		  Select this option if you want the driver to respect the user's decision about
-+		  regulatory settings.
- 
+-
 -define Download/p54pci
 -  FILE:=$(P54PCIFW)
 -  URL:=http://daemonizer.de/prism54/prism54-fw/fw-softmac
 -  MD5SUM:=ff7536af2092b1c4b21315bd103ef4c4
 -endef
 -$(eval $(call Download,p54pci))
-+	config PACKAGE_ATH_DEBUG
-+		bool "Atheros wireless debugging"
-+		help
-+		  Say Y, if you want to debug atheros wireless drivers.
-+		  Only ath9k & ath10k make use of this.
- 
+-
 -define Download/p54spi
 -  FILE:=$(P54SPIFW)
 -  URL:=http://daemonizer.de/prism54/prism54-fw/stlc4560
 -  MD5SUM:=42661f8ecbadd88012807493f596081d
 -endef
 -$(eval $(call Download,p54spi))
-+	config PACKAGE_ATH_DFS
-+		bool "Enable DFS support"
-+		default y
-+		help
-+		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
-+		  channels in Europe, US, and Japan.
- 
+-
 -define KernelPackage/p54/Default
 -  $(call KernelPackage/mac80211/Default)
 -  TITLE:=Prism54 Drivers
 -endef
-+		  Select this option if you want to use such channels.
- 
+-
 -define KernelPackage/p54/description
 -  Kernel module for Prism54 chipsets (mac80211)
-+  endif
- endef
- 
+-endef
+-
 -define KernelPackage/p54-common
 -  $(call KernelPackage/p54/Default)
 -  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt
 -  TITLE+= (COMMON)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54common.ko
-+define KernelPackage/ath
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros common driver part
-+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath25 +kmod-mac80211
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
-+  MENU:=1
- endef
- 
+-endef
+-
 -define KernelPackage/p54-pci
 -  $(call KernelPackage/p54/Default)
 -  TITLE+= (PCI)
 -  DEPENDS+= @PCI_SUPPORT +kmod-p54-common
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54pci.ko
 -  AUTOLOAD:=$(call AutoProbe,p54pci)
-+define KernelPackage/ath/description
-+ This module contains some common parts needed by Atheros Wireless drivers.
- endef
- 
+-endef
+-
 -define KernelPackage/p54-usb
 -  $(call KernelPackage/p54/Default)
 -  TITLE+= (USB)
 -  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54usb.ko
 -  AUTOLOAD:=$(call AutoProbe,p54usb)
-+define KernelPackage/ath5k
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 5xxx wireless cards support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
-+  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
-+  AUTOLOAD:=$(call AutoProbe,ath5k)
- endef
- 
+-endef
+-
 -define KernelPackage/p54-spi
 -  $(call KernelPackage/p54/Default)
 -  TITLE+= (SPI)
 -  DEPENDS+= @TARGET_omap24xx +kmod-p54-common
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54spi.ko
 -  AUTOLOAD:=$(call AutoProbe,p54spi)
-+define KernelPackage/ath5k/description
-+ This module adds support for wireless adapters based on
-+ Atheros 5xxx chipset.
- endef
- 
+-endef
+-
 -define KernelPackage/rt2x00/Default
-+define KernelPackage/ath9k-common
++define KernelPackage/adm8211
    $(call KernelPackage/mac80211/Default)
 -  TITLE:=Ralink Drivers for RT2x00 cards
-+  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
++  TITLE:=ADMTek 8211 support
++  DEPENDS+=@PCI_SUPPORT +kmod-mac80211 +kmod-eeprom-93cx6
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/admtek/adm8211.ko
++  AUTOLOAD:=$(call AutoProbe,adm8211)
  endef
  
 -define KernelPackage/rt2x00-lib
@@ -231,37 +1353,47 @@ index a1eedce..566e156 100644
 -  TITLE+= (LIB)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00lib.ko
 -  MENU:=1
-+define KernelPackage/ath9k
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 802.11n PCI wireless cards support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-+  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx +kmod-ath9k-common
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
-+  AUTOLOAD:=$(call AutoProbe,ath9k)
- endef
+-endef
++define KernelPackage/ath/config
++  if PACKAGE_kmod-ath
++	config ATH_USER_REGD
++		bool "Force Atheros drivers to respect the user's regdomain settings"
++		help
++		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
++		  the regulatory limits and the user is only allowed to restrict the settings
++		  even further, even if the country allows frequencies or power levels that
++		  are forbidden by the EEPROM settings.
  
 -define KernelPackage/rt2x00-lib/config
 -  if PACKAGE_kmod-rt2x00-lib
--
++		  Select this option if you want the driver to respect the user's decision about
++		  regulatory settings.
+ 
 -	config PACKAGE_RT2X00_LIB_DEBUGFS
 -		bool "Enable rt2x00 debugfs support"
 -		depends on PACKAGE_MAC80211_DEBUGFS
--		help
++	config PACKAGE_ATH_DEBUG
++		bool "Atheros wireless debugging"
+ 		help
 -		  Enable creation of debugfs files for the rt2x00 drivers.
 -		  These debugfs files support both reading and writing of the
 -		  most important register types of the rt2x00 hardware.
--
++		  Say Y, if you want to debug atheros wireless drivers.
++		  Only ath9k & ath10k make use of this.
+ 
 -	config PACKAGE_RT2X00_DEBUG
 -		bool "Enable rt2x00 debug output"
--		help
++	config PACKAGE_ATH_DFS
++		bool "Enable DFS support"
++		default y
+ 		help
 -		  Enable debugging output for all rt2x00 modules
--
++		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
++		  channels in Europe, US, and Japan.
+ 
 -  endif
-+define KernelPackage/ath9k/description
-+This module adds support for wireless adapters based on
-+Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
- endef
+-endef
++		  Select this option if you want to use such channels.
  
 -define KernelPackage/rt2x00-mmio
 -$(call KernelPackage/rt2x00/Default)
@@ -269,8 +1401,8 @@ index a1eedce..566e156 100644
 -  HIDDEN:=1
 -  TITLE+= (MMIO)
 -  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00mmio.ko
--endef
-+define KernelPackage/ath9k/config
++  endif
+ endef
  
 -define KernelPackage/rt2x00-pci
 -$(call KernelPackage/rt2x00/Default)
@@ -279,10 +1411,13 @@ index a1eedce..566e156 100644
 -  TITLE+= (PCI)
 -  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.ko
 -  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
--endef
-+	config ATH9K_SUPPORT_PCOEM
-+		bool "Support chips used in PC OEM cards"
-+		depends on PACKAGE_kmod-ath9k
++define KernelPackage/ath
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Atheros common driver part
++  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath25 +kmod-mac80211
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
++  MENU:=1
+ endef
  
 -define KernelPackage/rt2x00-usb
 -$(call KernelPackage/rt2x00/Default)
@@ -291,6 +1426,8 @@ index a1eedce..566e156 100644
 -  TITLE+= (USB)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00usb.ko
 -  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
++define KernelPackage/ath/description
++ This module contains some common parts needed by Atheros Wireless drivers.
  endef
  
 -define KernelPackage/rt2800-lib
@@ -299,14 +1436,13 @@ index a1eedce..566e156 100644
 -  HIDDEN:=1
 -  TITLE+= (rt2800 LIB)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800lib.ko
-+define KernelPackage/ath9k-htc
++define KernelPackage/ath5k
 +  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 802.11n USB device support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-+  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
-+  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
++  TITLE:=Atheros 5xxx wireless cards support
++  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
++  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
++  AUTOLOAD:=$(call AutoProbe,ath5k)
  endef
  
 -define KernelPackage/rt2400-pci
@@ -315,9 +1451,9 @@ index a1eedce..566e156 100644
 -  TITLE+= (RT2400 PCI)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2400pci.ko
 -  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-+define KernelPackage/ath9k-htc/description
-+This module adds support for wireless adapters based on
-+Atheros USB AR9271 and AR7010 family of chipsets.
++define KernelPackage/ath5k/description
++ This module adds support for wireless adapters based on
++ Atheros 5xxx chipset.
  endef
  
 -define KernelPackage/rt2500-pci
@@ -326,15 +1462,14 @@ index a1eedce..566e156 100644
 -  TITLE+= (RT2500 PCI)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500pci.ko
 -  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-+define KernelPackage/ath10k
++define KernelPackage/ath9k-common
 +  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 802.11ac wireless cards support
-+  URL:=https://wireless.wiki.kernel.org/en/users/Drivers/ath10k
-+  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
++  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
++  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
++  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY
 +  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
-+  AUTOLOAD:=$(call AutoLoad,55,ath10k_core ath10k_pci)
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
  endef
  
 -define KernelPackage/rt2500-usb
@@ -343,10 +1478,14 @@ index a1eedce..566e156 100644
 -  TITLE+= (RT2500 USB)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500usb.ko
 -  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-+define KernelPackage/ath10k/description
-+This module adds support for wireless adapters based on
-+Atheros IEEE 802.11ac family of chipsets. For now only
-+PCI is supported.
++define KernelPackage/ath9k
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Atheros 802.11n PCI wireless cards support
++  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
++  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx +kmod-ath9k-common
++  FILES:= \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
++  AUTOLOAD:=$(call AutoProbe,ath9k)
  endef
  
 -define KernelPackage/rt61-pci
@@ -355,14 +1494,10 @@ index a1eedce..566e156 100644
 -  TITLE+= (RT2x61 PCI)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt61pci.ko
 -  AUTOLOAD:=$(call AutoProbe,rt61pci)
--endef
-+PKG_ATH10K_LINUX_FIRMWARE_NAME:=ath10k-firmware
-+PKG_ATH10K_LINUX_FIRMWARE_VERSION:=b46f3e01a6c1f9150fb4612ef53611d714565842
-+PKG_ATH10K_LINUX_FIRMWARE_SOURCE:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION).tar.bz2
-+PKG_ATH10K_LINUX_FIRMWARE_PROTO:=git
-+PKG_ATH10K_LINUX_FIRMWARE_SOURCE_URL:=https://github.com/kvalo/ath10k-firmware.git
-+PKG_ATH10K_LINUX_FIRMWARE_SUBDIR:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION)
-+#PKG_ATH10K_LINUX_FIRMWARE_MIRROR_MD5SUM:=?
++define KernelPackage/ath9k/description
++This module adds support for wireless adapters based on
++Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
+ endef
  
 -define KernelPackage/rt73-usb
 -  $(call KernelPackage/rt2x00/Default)
@@ -370,15 +1505,8 @@ index a1eedce..566e156 100644
 -  TITLE+= (RT73 USB)
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt73usb.ko
 -  AUTOLOAD:=$(call AutoProbe,rt73usb)
-+define Download/ath10k-firmware
-+  FILE:=$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE)
-+  URL:=$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE_URL)
-+  PROTO:=$(PKG_ATH10K_LINUX_FIRMWARE_PROTO)
-+  VERSION:=$(PKG_ATH10K_LINUX_FIRMWARE_VERSION)
-+  SUBDIR:=$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)
-+  #MIRROR_MD5SUM:=$(PKG_ATH10K_LINUX_FIRMWARE_MIRROR_MD5SUM)
- endef
-+$(eval $(call Download,ath10k-firmware))
+-endef
++define KernelPackage/ath9k/config
  
 -define KernelPackage/rt2800-mmio
 -$(call KernelPackage/rt2x00/Default)
@@ -387,6 +1515,9 @@ index a1eedce..566e156 100644
 -  HIDDEN:=1
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800mmio.ko
 -endef
++	config ATH9K_SUPPORT_PCOEM
++		bool "Support chips used in PC OEM cards"
++		depends on PACKAGE_kmod-ath9k
  
 -define KernelPackage/rt2800-soc
 -$(call KernelPackage/rt2x00/Default)
@@ -396,6 +1527,68 @@ index a1eedce..566e156 100644
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00soc.ko \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800soc.ko
 -  AUTOLOAD:=$(call AutoProbe,rt2800soc)
+ endef
+ 
+-define KernelPackage/rt2800-pci
+-$(call KernelPackage/rt2x00/Default)
+-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio
+-  TITLE+= (RT2860 PCI)
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800pci.ko
+-  AUTOLOAD:=$(call AutoProbe,rt2800pci)
++define KernelPackage/ath9k-htc
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Atheros 802.11n USB device support
++  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
++  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core +ath9k-htc-firmware
++  FILES:= \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
++  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
+ endef
+ 
+-define KernelPackage/rt2800-usb
+-$(call KernelPackage/rt2x00/Default)
+-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt
+-  TITLE+= (RT2870 USB)
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800usb.ko
+-  AUTOLOAD:=$(call AutoProbe,rt2800usb)
++define KernelPackage/ath9k-htc/description
++This module adds support for wireless adapters based on
++Atheros USB AR9271 and AR7010 family of chipsets.
+ endef
+ 
+-define KernelPackage/rtl818x/Default
++define KernelPackage/ath10k
+   $(call KernelPackage/mac80211/Default)
+-  TITLE:=Realtek Drivers for RTL818x devices
+-  URL:=http://wireless.kernel.org/en/users/Drivers/rtl8187
+-  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
++  TITLE:=Atheros 802.11ac wireless cards support
++  URL:=https://wireless.wiki.kernel.org/en/users/Drivers/ath10k
++  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY
++  FILES:= \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
++  AUTOLOAD:=$(call AutoLoad,55,ath10k_core ath10k_pci)
+ endef
+ 
+-define KernelPackage/rtl8180
+-  $(call KernelPackage/rtl818x/Default)
+-  DEPENDS+= @PCI_SUPPORT
+-  TITLE+= (RTL8180 PCI)
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8180/rtl818x_pci.ko
+-  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
++define KernelPackage/ath10k/description
++This module adds support for wireless adapters based on
++Atheros IEEE 802.11ac family of chipsets. For now only
++PCI is supported.
+ endef
+ 
+-define KernelPackage/rtl8187
+-$(call KernelPackage/rtl818x/Default)
+-  DEPENDS+= @USB_SUPPORT +kmod-usb-core
+-  TITLE+= (RTL8187 USB)
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8187/rtl8187.ko
+-  AUTOLOAD:=$(call AutoProbe,rtl8187)
 -endef
 +#Broadcom firmware
 +ifneq ($(CONFIG_B43_FW_6_30),)
@@ -449,19 +1642,13 @@ index a1eedce..566e156 100644
 +  PKG_B43_FWV4_MD5SUM:=e045a135453274e439ae183f8498b0fa
 +endif
  
--define KernelPackage/rt2800-pci
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio
--  TITLE+= (RT2860 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800pci.ko
--  AUTOLOAD:=$(call AutoProbe,rt2800pci)
-+
-+PKG_B43_FWV3_NAME:=wl_apsta
-+PKG_B43_FWV3_VERSION:=3.130.20.0
-+PKG_B43_FWV3_SOURCE:=$(PKG_B43_FWV3_NAME)-$(PKG_B43_FWV3_VERSION).o
-+PKG_B43_FWV3_SOURCE_URL:=http://downloads.openwrt.org/sources/
-+PKG_B43_FWV3_MD5SUM:=e08665c5c5b66beb9c3b2dd54aa80cb3
-+
+-define KernelPackage/rtlwifi/config
+-	config PACKAGE_RTLWIFI_DEBUG
+-		bool "Realtek wireless debugging"
+-		depends on PACKAGE_kmod-rtlwifi
+-		help
+-		  Say Y, if you want to debug realtek wireless drivers.
+ 
 +define Download/b43
 +  FILE:=$(PKG_B43_FWV4_SOURCE)
 +  URL:=$(PKG_B43_FWV4_SOURCE_URL)
@@ -469,26 +1656,13 @@ index a1eedce..566e156 100644
  endef
 +$(eval $(call Download,b43))
  
--define KernelPackage/rt2800-usb
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt
--  TITLE+= (RT2870 USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800usb.ko
--  AUTOLOAD:=$(call AutoProbe,rt2800usb)
-+define Download/b43legacy
-+  FILE:=$(PKG_B43_FWV3_SOURCE)
-+  URL:=$(PKG_B43_FWV3_SOURCE_URL)
-+  MD5SUM:=$(PKG_B43_FWV3_MD5SUM)
- endef
-+$(eval $(call Download,b43legacy))
- 
--define KernelPackage/rtl818x/Default
-+
+-define KernelPackage/rtlwifi
 +define KernelPackage/b43
    $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek Drivers for RTL818x devices
--  URL:=http://wireless.kernel.org/en/users/Drivers/rtl8187
--  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
+-  TITLE:=Realtek common driver part
+-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtlwifi.ko
+-  HIDDEN:=1
 +  TITLE:=Broadcom 43xx wireless support
 +  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
 +  KCONFIG:= \
@@ -498,69 +1672,11 @@ index a1eedce..566e156 100644
 +	@PCI_SUPPORT +kmod-mac80211 \
 +	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
 +	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43/b43.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43/b43.ko
 +  AUTOLOAD:=$(call AutoProbe,b43)
 +  MENU:=1
  endef
  
--define KernelPackage/rtl8180
--  $(call KernelPackage/rtl818x/Default)
--  DEPENDS+= @PCI_SUPPORT
--  TITLE+= (RTL8180 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8180/rtl818x_pci.ko
--  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
--endef
-+define KernelPackage/b43/config
- 
--define KernelPackage/rtl8187
--$(call KernelPackage/rtl818x/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-usb-core
--  TITLE+= (RTL8187 USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8187/rtl8187.ko
--  AUTOLOAD:=$(call AutoProbe,rtl8187)
--endef
-+config PACKAGE_B43_USE_SSB
-+	select PACKAGE_kmod-ssb
-+	tristate
-+	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
- 
--define KernelPackage/rtlwifi/config
--	config PACKAGE_RTLWIFI_DEBUG
--		bool "Realtek wireless debugging"
--		depends on PACKAGE_kmod-rtlwifi
-+config PACKAGE_B43_USE_BCMA
-+	select PACKAGE_kmod-bcma
-+	tristate
-+	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
-+
-+  if PACKAGE_kmod-b43
-+
-+	choice
-+		prompt "b43 firmware version"
-+		default B43_FW_5_100_138
- 		help
--		  Say Y, if you want to debug realtek wireless drivers.
-+		  This option allows you to select the version of the b43 firmware.
- 
--endef
-+	config B43_FW_4_150
-+		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
-+		help
-+		  Old stable firmware for BCM43xx devices.
- 
--define KernelPackage/rtlwifi
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek common driver part
--  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtlwifi.ko
--  HIDDEN:=1
--endef
-+		  If unsure, select this.
- 
 -define KernelPackage/rtlwifi-pci
 -  $(call KernelPackage/mac80211/Default)
 -  TITLE:=Realtek common driver part (PCI support)
@@ -569,10 +1685,7 @@ index a1eedce..566e156 100644
 -  AUTOLOAD:=$(call AutoProbe,rtl_pci)
 -  HIDDEN:=1
 -endef
-+	config B43_FW_4_178
-+		bool "Firmware 478.104 from driver 4.178.10.4"
-+		help
-+		  Older firmware for BCM43xx devices.
++define KernelPackage/b43/config
  
 -define KernelPackage/rtlwifi-usb
 -  $(call KernelPackage/mac80211/Default)
@@ -582,7 +1695,12 @@ index a1eedce..566e156 100644
 -  AUTOLOAD:=$(call AutoProbe,rtl_usb)
 -  HIDDEN:=1
 -endef
-+		  If unsure, select the "stable" firmware.
++config PACKAGE_B43_USE_SSB
++	select PACKAGE_kmod-ssb
++	tristate
++	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
++	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
++	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
  
 -define KernelPackage/rtl8192c-common
 -  $(call KernelPackage/mac80211/Default)
@@ -591,10 +1709,12 @@ index a1eedce..566e156 100644
 -  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192c/rtl8192c-common.ko
 -  HIDDEN:=1
 -endef
-+	config B43_FW_5_10
-+		bool "Firmware 508.1084 from driver 5.10.56.27"
-+		help
-+		  Older firmware for BCM43xx devices.
++config PACKAGE_B43_USE_BCMA
++	select PACKAGE_kmod-bcma
++	tristate
++	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
++	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
++	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
  
 -define KernelPackage/rtl8192ce
 -  $(call KernelPackage/mac80211/Default)
@@ -603,7 +1723,7 @@ index a1eedce..566e156 100644
 -  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192ce.ko
 -  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
 -endef
-+		  If unsure, select the "stable" firmware.
++  if PACKAGE_kmod-b43
  
 -define KernelPackage/rtl8192ce/install
 -	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
@@ -611,10 +1731,11 @@ index a1eedce..566e156 100644
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfwU.bin $(1)/lib/firmware/rtlwifi
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfwU_B.bin $(1)/lib/firmware/rtlwifi
 -endef
-+	config B43_FW_5_100_138
-+		bool "Firmware 666.2 from driver 5.100.138 (stable)"
++	choice
++		prompt "b43 firmware version"
++		default B43_FW_5_100_138
 +		help
-+		  The currently default firmware for BCM43xx devices.
++		  This option allows you to select the version of the b43 firmware.
  
 -define KernelPackage/rtl8192se
 -  $(call KernelPackage/mac80211/Default)
@@ -623,13 +1744,16 @@ index a1eedce..566e156 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192se/rtl8192se.ko
 -  AUTOLOAD:=$(call AutoProbe,rtl8192se)
 -endef
-+		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
++	config B43_FW_4_150
++		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
++		help
++		  Old stable firmware for BCM43xx devices.
  
 -define KernelPackage/rtl8192se/install
 -	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192sefw.bin $(1)/lib/firmware/rtlwifi
 -endef
-+		  If unsure, select the this firmware.
++		  If unsure, select this.
  
 -define KernelPackage/rtl8192de
 -  $(call KernelPackage/mac80211/Default)
@@ -638,16 +1762,16 @@ index a1eedce..566e156 100644
 -  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192de/rtl8192de.ko
 -  AUTOLOAD:=$(call AutoProbe,rtl8192de)
 -endef
-+	config B43_FW_6_30
-+		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
++	config B43_FW_4_178
++		bool "Firmware 478.104 from driver 4.178.10.4"
 +		help
-+		  Newer experimental firmware for BCM43xx devices.
++		  Older firmware for BCM43xx devices.
  
 -define KernelPackage/rtl8192de/install
 -	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192defw.bin $(1)/lib/firmware/rtlwifi
 -endef
-+		  This firmware is mostly untested.
++		  If unsure, select the "stable" firmware.
  
 -define KernelPackage/rtl8192cu
 -  $(call KernelPackage/mac80211/Default)
@@ -656,7 +1780,10 @@ index a1eedce..566e156 100644
 -  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192cu/rtl8192cu.ko
 -  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
 -endef
-+		  If unsure, select the "stable" firmware.
++	config B43_FW_5_10
++		bool "Firmware 508.1084 from driver 5.10.56.27"
++		help
++		  Older firmware for BCM43xx devices.
  
 -define KernelPackage/rtl8192cu/install
 -	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
@@ -665,10 +1792,7 @@ index a1eedce..566e156 100644
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_B.bin $(1)/lib/firmware/rtlwifi
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_TMSC.bin $(1)/lib/firmware/rtlwifi
 -endef
-+	config B43_OPENFIRMWARE
-+		bool "Open FirmWare for WiFi networks"
-+		help
-+		  Opensource firmware for BCM43xx devices.
++		  If unsure, select the "stable" firmware.
  
 -ZD1211FW_NAME:=zd1211-firmware
 -ZD1211FW_VERSION:=1.4
@@ -678,11 +1802,10 @@ index a1eedce..566e156 100644
 -  MD5SUM:=19f28781d76569af8551c9d11294c870
 -endef
 -$(eval $(call Download,zd1211rw))
-+		  Do _not_ select this, unless you know what you are doing.
-+		  The Opensource firmware is not suitable for embedded devices, yet.
-+		  It does not support QoS, which is bad for AccessPoints.
-+		  It does not support hardware crypto acceleration, which is a showstopper
-+		  for embedded devices with low CPU resources.
++	config B43_FW_5_100_138
++		bool "Firmware 666.2 from driver 5.100.138 (stable)"
++		help
++		  The currently default firmware for BCM43xx devices.
  
 -define KernelPackage/zd1211rw
 -  $(call KernelPackage/mac80211/Default)
@@ -691,7 +1814,7 @@ index a1eedce..566e156 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zd1211rw/zd1211rw.ko
 -  AUTOLOAD:=$(call AutoProbe,zd1211rw)
 -endef
-+		  If unsure, select the "stable" firmware.
++		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
  
 -define KernelPackage/adm8211
 -  $(call KernelPackage/mac80211/Default)
@@ -700,6 +1823,38 @@ index a1eedce..566e156 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/adm8211.ko
 -  AUTOLOAD:=$(call AutoProbe,adm8211)
 -endef
++		  If unsure, select the this firmware.
+ 
+-define KernelPackage/ath/config
+-  if PACKAGE_kmod-ath
+-	config ATH_USER_REGD
+-		bool "Force Atheros drivers to respect the user's regdomain settings"
++	config B43_FW_6_30
++		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
+ 		help
+-		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
+-		  the regulatory limits and the user is only allowed to restrict the settings
+-		  even further, even if the country allows frequencies or power levels that
+-		  are forbidden by the EEPROM settings.
++		  Newer experimental firmware for BCM43xx devices.
++
++		  This firmware is mostly untested.
++
++		  If unsure, select the "stable" firmware.
++
++	config B43_OPENFIRMWARE
++		bool "Open FirmWare for WiFi networks"
++		help
++		  Opensource firmware for BCM43xx devices.
++
++		  Do _not_ select this, unless you know what you are doing.
++		  The Opensource firmware is not suitable for embedded devices, yet.
++		  It does not support QoS, which is bad for AccessPoints.
++		  It does not support hardware crypto acceleration, which is a showstopper
++		  for embedded devices with low CPU resources.
++
++		  If unsure, select the "stable" firmware.
++
 +	endchoice
 +
 +	config B43_FW_SQUASH
@@ -787,68 +1942,37 @@ index a1eedce..566e156 100644
 +		help
 +		  Enable support for using PIO instead of DMA. Unless you have DMA
 +		  transfer problems you don't need this.
-+
-+		  If unsure, say N.
-+
-+	config PACKAGE_B43_PHY_G
-+		bool "Enable support for G-PHYs"
-+		default n if TARGET_brcm47xx_mips74k
-+		default y
-+		help
-+		  Enable support for G-PHY. This includes support for the following devices:
-+		  PCI: BCM4306, BCM4311, BCM4318
-+		  SoC: BCM5352E, BCM4712
- 
--define KernelPackage/ath/config
--  if PACKAGE_kmod-ath
--	config ATH_USER_REGD
--		bool "Force Atheros drivers to respect the user's regdomain settings"
-+		  If unsure, say Y.
-+
-+	config PACKAGE_B43_PHY_N
-+		bool "Enable support for N-PHYs"
-+		default y
- 		help
--		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
--		  the regulatory limits and the user is only allowed to restrict the settings
--		  even further, even if the country allows frequencies or power levels that
--		  are forbidden by the EEPROM settings.
-+		  Enable support for N-PHY. This includes support for the following devices:
-+		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
-+		  SoC: BCM4716, BCM4717, BCM4718
  
 -		  Select this option if you want the driver to respect the user's decision about
 -		  regulatory settings.
-+		  Currently only 11g speed is available.
++		  If unsure, say N.
  
 -	config PACKAGE_ATH_DEBUG
 -		bool "Atheros wireless debugging"
-+		  If unsure, say Y.
-+
-+	config PACKAGE_B43_PHY_LP
-+		bool "Enable support for LP-PHYs"
++	config PACKAGE_B43_PHY_G
++		bool "Enable support for G-PHYs"
 +		default n if TARGET_brcm47xx_mips74k
 +		default y
  		help
 -		  Say Y, if you want to debug atheros wireless drivers.
 -		  Right now only ath9k makes use of this.
-+		  Enable support for LP-PHY. This includes support for the following devices:
-+		  PCI: BCM4312
-+		  SoC: BCM5354
++		  Enable support for G-PHY. This includes support for the following devices:
++		  PCI: BCM4306, BCM4311, BCM4318
++		  SoC: BCM5352E, BCM4712
  
 -	config PACKAGE_ATH_DFS
 -		bool "Enable DFS support"
 +		  If unsure, say Y.
 +
-+	config PACKAGE_B43_PHY_HT
-+		bool "Enable support for HT-PHYs"
-+		default n if TARGET_brcm47xx_legacy
++	config PACKAGE_B43_PHY_N
++		bool "Enable support for N-PHYs"
  		default y
  		help
 -		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
 -		  channels in Europe, US, and Japan.
-+		  Enable support for HT-PHY. This includes support for the following devices:
-+		  PCI: BCM4331
++		  Enable support for N-PHY. This includes support for the following devices:
++		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
++		  SoC: BCM4716, BCM4717, BCM4718
  
 -		  Select this option if you want to use such channels.
 +		  Currently only 11g speed is available.
@@ -864,17 +1988,19 @@ index a1eedce..566e156 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
 -  MENU:=1
 -endef
-+	config PACKAGE_B43_PHY_LCN
-+		bool "Enable support for LCN-PHYs"
-+		depends on BROKEN
-+		default n
++	config PACKAGE_B43_PHY_LP
++		bool "Enable support for LP-PHYs"
++		default n if TARGET_brcm47xx_mips74k
++		default y
 +		help
-+		  Currently broken.
++		  Enable support for LP-PHY. This includes support for the following devices:
++		  PCI: BCM4312
++		  SoC: BCM5354
  
 -define KernelPackage/ath/description
 - This module contains some common parts needed by Atheros Wireless drivers.
 -endef
-+		  If unsure, say N.
++		  If unsure, say Y.
  
 -define KernelPackage/ath5k
 -  $(call KernelPackage/mac80211/Default)
@@ -883,34 +2009,31 @@ index a1eedce..566e156 100644
 -  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
 -  AUTOLOAD:=$(call AutoProbe,ath5k)
-+  endif
- endef
+-endef
++	config PACKAGE_B43_PHY_HT
++		bool "Enable support for HT-PHYs"
++		default n if TARGET_brcm47xx_legacy
++		default y
++		help
++		  Enable support for HT-PHY. This includes support for the following devices:
++		  PCI: BCM4331
  
 -define KernelPackage/ath5k/description
 - This module adds support for wireless adapters based on
 - Atheros 5xxx chipset.
-+define KernelPackage/b43/description
-+Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
- endef
+-endef
++		  Currently only 11g speed is available.
  
 -define KernelPackage/ath9k-common
-+define KernelPackage/b43legacy
-   $(call KernelPackage/mac80211/Default)
+-  $(call KernelPackage/mac80211/Default)
 -  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
 -  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
 -  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@KERNEL_RELAY
 -  FILES:= \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
-+  TITLE:=Broadcom 43xx-legacy wireless support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-+  KCONFIG:= \
-+  	CONFIG_HW_RANDOM=y
-+  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43legacy/b43legacy.ko
-+  AUTOLOAD:=$(call AutoProbe,b43legacy)
-+  MENU:=1
- endef
+-endef
++		  If unsure, say Y.
  
 -define KernelPackage/ath9k
 -  $(call KernelPackage/mac80211/Default)
@@ -921,51 +2044,48 @@ index a1eedce..566e156 100644
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
 -  AUTOLOAD:=$(call AutoProbe,ath9k)
 -endef
-+define KernelPackage/b43legacy/config
-+  if PACKAGE_kmod-b43legacy
++	config PACKAGE_B43_PHY_LCN
++		bool "Enable support for LCN-PHYs"
++		depends on BROKEN
++		default n
++		help
++		  Currently broken.
  
 -define KernelPackage/ath9k/description
 -This module adds support for wireless adapters based on
 -Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
 -endef
-+	config B43LEGACY_FW_SQUASH
-+		bool "Remove unnecessary firmware files"
-+		default y
-+		help
-+		  This options allows you to remove unnecessary b43legacy firmware files
-+		  from the final rootfs image. This can reduce the rootfs size by
-+		  up to 50k.
++		  If unsure, say N.
  
 -define KernelPackage/ath9k/config
-+		  If unsure, say Y.
++  endif
++endef
  
 -	config ATH9K_SUPPORT_PCOEM
 -		bool "Support chips used in PC OEM cards"
 -		depends on PACKAGE_kmod-ath9k
 -	
--endef
-+	config B43LEGACY_FW_SQUASH_COREREVS
-+		string "Core revisions to include"
-+		depends on B43LEGACY_FW_SQUASH
-+		default "1,2,3,4"
-+		help
-+		  This is a comma seperated list of core revision numbers.
++define KernelPackage/b43/description
++Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
+ endef
  
 -define KernelPackage/ath9k-htc
--  $(call KernelPackage/mac80211/Default)
++define KernelPackage/b43legacy
+   $(call KernelPackage/mac80211/Default)
 -  TITLE:=Atheros 802.11n USB device support
 -  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
 -  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core
 -  FILES:= \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
 -  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
-+		  Example (keep files for rev4 only):
-+		    4
-+
-+		  Example (keep files for rev2 and rev4):
-+		    2,4
-+
-+  endif
++  TITLE:=Broadcom 43xx-legacy wireless support
++  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
++  KCONFIG:= \
++  	CONFIG_HW_RANDOM=y
++  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb +b43legacy-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
++  AUTOLOAD:=$(call AutoProbe,b43legacy)
++  MENU:=1
  endef
  
 -define KernelPackage/ath9k-htc/description
@@ -989,7 +2109,7 @@ index a1eedce..566e156 100644
 +  TITLE:=Broadcom IEEE802.11n common driver parts
 +  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
 +  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmutil/brcmutil.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmutil/brcmutil.ko
 +  AUTOLOAD:=$(call AutoProbe,brcmutil)
 +  MENU:=1
  endef
@@ -1066,8 +2186,8 @@ index a1eedce..566e156 100644
 -  )
 +  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
 +  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmsmac/brcmsmac.ko
++  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
 +  AUTOLOAD:=$(call AutoProbe,brcmsmac)
 +  MENU:=1
  endef
@@ -1103,6 +2223,7 @@ index a1eedce..566e156 100644
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas_sdio.ko
 -  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
+-endef
 +	config BRCMSMAC_USE_FW_FROM_WL
 +		bool "Use firmware extracted from broadcom proprietary driver"
 +		default y
@@ -1111,11 +2232,6 @@ index a1eedce..566e156 100644
 +		  version 666.2 extracted from the proprietary Broadcom driver
 +		  is used. This is needed to get core rev 17 used in bcm4716
 +		  to work.
-+
-+		  If unsure, say Y.
-+
-+  endif
- endef
  
 -define KernelPackage/mac80211-hwsim
 -  $(call KernelPackage/mac80211/Default)
@@ -1123,9 +2239,13 @@ index a1eedce..566e156 100644
 -  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
 -  AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
--endef
++		  If unsure, say Y.
++
++  endif
+ endef
  
 -define KernelPackage/net-libipw
++
 +define KernelPackage/brcmfmac
    $(call KernelPackage/mac80211/Default)
 -  TITLE:=libipw for ipw2100 and ipw2200
@@ -1134,8 +2254,11 @@ index a1eedce..566e156 100644
 -  AUTOLOAD:=$(call AutoProbe,libipw)
 +  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
 +  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc +BRCMFMAC_USB:kmod-usb-core
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmfmac/brcmfmac.ko
++  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +kmod-brcmutil \
++	+BRCMFMAC_PCIE:brcmfmac-firmware-pcie \
++	+BRCMFMAC_SDIO:kmod-mmc +BRCMFMAC_SDIO:brcmfmac-firmware-sdio \
++	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
 +  AUTOLOAD:=$(call AutoProbe,brcmfmac)
  endef
  
@@ -1220,7 +2343,7 @@ index a1eedce..566e156 100644
 +define KernelPackage/carl9170
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Driver for Atheros AR9170 USB sticks
-+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT
++  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
 +  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
 +  AUTOLOAD:=$(call AutoProbe,carl9170)
  endef
@@ -1231,8 +2354,9 @@ index a1eedce..566e156 100644
    $(call KernelPackage/mac80211/Default)
    TITLE:=Hermes 802.11b chipset support
 -  DEPENDS:=@PCI_SUPPORT||PCMCIA_SUPPORT +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco.ko
 +  DEPENDS:=@PCI_SUPPORT||PCMCIA_SUPPORT +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT +kmod-crypto-michael-mic
-   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco.ko
    AUTOLOAD:=$(call AutoProbe,orinoco)
  endef
  
@@ -1246,8 +2370,9 @@ index a1eedce..566e156 100644
    $(call KernelPackage/mac80211/Default)
    TITLE:=Intersil Prism 2.5 PCI support
 -  DEPENDS:=@PCI_SUPPORT +kmod-net-hermes
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_pci.ko
 +  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_pci.ko
    AUTOLOAD:=$(call AutoProbe,orinoco_pci)
  endef
  
@@ -1261,8 +2386,9 @@ index a1eedce..566e156 100644
    $(call KernelPackage/mac80211/Default)
    TITLE:=PLX9052 based PCI adaptor
 -  DEPENDS:=@PCI_SUPPORT +kmod-net-hermes
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_plx.ko
 +  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_plx.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_plx.ko
    AUTOLOAD:=$(call AutoProbe,orinoco_plx)
  endef
  
@@ -1276,8 +2402,9 @@ index a1eedce..566e156 100644
    $(call KernelPackage/mac80211/Default)
    TITLE:=Hermes based PCMCIA adaptors
 -  DEPENDS:=@PCMCIA_SUPPORT +kmod-net-hermes @BROKEN
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_cs.ko
 +  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes @BROKEN
-   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_cs.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
    AUTOLOAD:=$(call AutoProbe,orinoco_cs)
  endef
  
@@ -1290,14 +2417,16 @@ index a1eedce..566e156 100644
 +
 +define KernelPackage/iwlwifi
    $(call KernelPackage/mac80211/Default)
-   DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT
+-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT
++  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +iwlwifi-firmware
    TITLE:=Intel AGN Wireless support
    FILES:= \
- 	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/iwlwifi.ko \
+-	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/iwlwifi.ko \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/dvm/iwldvm.ko
 -  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm)
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/dvm/iwldvm.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/mvm/iwlmvm.ko
++	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/dvm/iwldvm.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/mvm/iwlmvm.ko
 +  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm iwlmvm)
    MENU:=1
  endef
@@ -1305,6 +2434,48 @@ index a1eedce..566e156 100644
 -define KernelPackage/iwlagn/description
 - iwlagn kernel module for Intel 5000/5150/1000/6000/6050/6005/6030/100 support
 -endef
+-
+-define KernelPackage/iwlagn/config
+-  if PACKAGE_kmod-iwlagn
+-
+-	config IWL5000_FW
+-		bool "Intel 5000 Firmware"
+-		default y
+-		help
+-		  Download and install firmware for:
+-		    Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
+-
+-	config IWL5150_FW
+-		bool "Intel 5150 Firmware"
+-		default y
+-		help
+-		  Download and install firmware for:
+-		    Intel Wireless WiFi 5150AGN
+-
+-	config IWL1000_FW
+-		bool "Intel 1000 Firmware"
+-		default y
+-		help
+-		  Download and install firmware for:
+-		    Intel Centrino Wireless-N 1000
+-
+-	config IWL6000_FW
+-		bool "Intel 6000 Firmware"
+-		default y
+-		help
+-		  Download and install firmware for:
+-		    Intel Centrino Ultimate-N 6300 and Advanced-N 6200
+-
+-	config IWL6050_FW
+-		bool "Intel 6050 Firmware"
+-		default y
+-		help
+-		  Download and install firmware for:
+-		    Intel Centrino Advanced-N + WiMAX 6250 and Wireless-N + WiMAX 6150
+-
+-	config IWL6005_FW
+-		bool "Intel 6005 Firmware"
+-		default y
 +define KernelPackage/iwlwifi/description
 + iwlwifi kernel module for
 + Intel Wireless WiFi Link 6250AGN Adapter
@@ -1329,224 +2500,133 @@ index a1eedce..566e156 100644
 +
 +	config PACKAGE_IWLWIFI_DEBUG
 +		bool "Enable full debugging output in the iwlwifi driver"
-+		default n
-+		help
-+		  This option will enable debug tracing output for the iwlwifi drivers
- 
--define KernelPackage/iwlagn/config
--  if PACKAGE_kmod-iwlagn
-+		  This will result in the kernel module being ~100k larger.  You can
-+		  control which debug output is sent to the kernel log by setting the
-+		  value in
- 
--	config IWL5000_FW
--		bool "Intel 5000 Firmware"
--		default y
-+			/sys/module/iwlwifi/parameters/debug
-+
-+		  This entry will only exist if this option is enabled.
-+
-+		  To set a value, simply echo an 8-byte hex value to the same file:
-+
-+			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
-+
-+		  You can find the list of debug mask values in:
-+			  drivers/net/wireless/iwlwifi/iwl-debug.h
-+
-+		  If this is your first time using this driver, you should say Y here
-+		  as the debug information can assist others in helping you resolve
-+		  any problems you may encounter.
-+
-+	config PACKAGE_IWLWIFI_DEBUGFS
-+	        bool "iwlwifi debugfs support"
-+		depends on PACKAGE_MAC80211_DEBUGFS
 +		default n
  		help
 -		  Download and install firmware for:
--		    Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
-+		  Enable creation of debugfs files for the iwlwifi drivers. This
-+		  is a low-impact option that allows getting insight into the
-+		  driver's state at runtime.
- 
--	config IWL5150_FW
--		bool "Intel 5150 Firmware"
-+	config IWL100_FW
-+		bool "Intel 100 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
--		    Intel Wireless WiFi 5150AGN
-+		    Intel Centrino Wireless-N 100
- 
- 	config IWL1000_FW
- 		bool "Intel 1000 Firmware"
-@@ -852,89 +910,104 @@ define KernelPackage/iwlagn/config
- 		  Download and install firmware for:
- 		    Intel Centrino Wireless-N 1000
- 
--	config IWL6000_FW
--		bool "Intel 6000 Firmware"
-+	config IWL105_FW
-+		bool "Intel 105 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
--		    Intel Centrino Ultimate-N 6300 and Advanced-N 6200
-+		    Intel Centrino Wireless-N 105
- 
--	config IWL6050_FW
--		bool "Intel 6050 Firmware"
-+	config IWL135_FW
-+		bool "Intel 135 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
--		    Intel Centrino Advanced-N + WiMAX 6250 and Wireless-N + WiMAX 6150
-+		    Intel Centrino Wireless-N 135
- 
--	config IWL6005_FW
--		bool "Intel 6005 Firmware"
-+	config IWL2000_FW
-+		bool "Intel 2000 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
 -		    Intel Centrino Advanced-N 6205
-+		    Intel Centrino Wireless-N 2200
++		  This option will enable debug tracing output for the iwlwifi drivers
  
 -	config IWL6030_FW
 -		bool "Intel 6030 Firmware"
-+	config IWL2030_FW
-+		bool "Intel 2030 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Centrino Advanced-N 6230, Wireless-N 1030, Wireless-N 130 and Advanced-N 6235
-+		    Intel Centrino Wireless-N 2230
++		  This will result in the kernel module being ~100k larger.  You can
++		  control which debug output is sent to the kernel log by setting the
++		  value in
  
 -	config IWL7260_FW
 -		bool "Intel 7260 Firmware"
-+	config IWL3160_FW
-+		bool "Intel 3160 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Dual Band Wireless-N 7260 and Intel Dual Band Wireless-AC 7260
-+		    Intel Wireless WiFi 3160
++			/sys/module/iwlwifi/parameters/debug
  
 -	config IWL7265_FW
 -		bool "Intel 7265 Firmware"
-+	config IWL5000_FW
-+		bool "Intel 5000 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Wireless 7265
-+		    Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
++		  This entry will only exist if this option is enabled.
  
 -	config IWL100_FW
 -		bool "Intel 100 Firmware"
-+	config IWL5150_FW
-+		bool "Intel 5150 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Centrino Wireless-N 100
-+		    Intel Wireless WiFi 5150AGN
++		  To set a value, simply echo an 8-byte hex value to the same file:
  
 -	config IWL2000_FW
 -		bool "Intel 2000 Firmware"
-+	config IWL6000_FW
-+		bool "Intel 6000 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Centrino Wireless-N 2200
-+		    Intel Centrino Ultimate-N 6300 and Advanced-N 6200
++			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
  
 -	config IWL2030_FW
 -		bool "Intel 2030 Firmware"
-+	config IWL6005_FW
-+		bool "Intel 6005 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Centrino Wireless-N 2230
-+		    Intel Centrino Advanced-N 6205
++		  You can find the list of debug mask values in:
++			  drivers/net/wireless/intel/iwlwifi/iwl-debug.h
  
 -	config IWL105_FW
 -		bool "Intel 105 Firmware"
-+	config IWL6030_FW
-+		bool "Intel 6030 Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Centrino Wireless-N 105
-+		    Intel Centrino Advanced-N 6230, Wireless-N 1030, Wireless-N 130 and Advanced-N 6235
++		  If this is your first time using this driver, you should say Y here
++		  as the debug information can assist others in helping you resolve
++		  any problems you may encounter.
  
 -	config IWL135_FW
 -		bool "Intel 135 Firmware"
-+	config IWL6050_FW
-+		bool "Intel 6050 Firmware"
- 		default y
+-		default y
++	config PACKAGE_IWLWIFI_DEBUGFS
++	        bool "iwlwifi debugfs support"
++		depends on PACKAGE_MAC80211_DEBUGFS
++		default n
  		help
- 		  Download and install firmware for:
+-		  Download and install firmware for:
 -		    Intel Centrino Wireless-N 135
-+		    Intel Centrino Advanced-N + WiMAX 6250 and Wireless-N + WiMAX 6150
++		  Enable creation of debugfs files for the iwlwifi drivers. This
++		  is a low-impact option that allows getting insight into the
++		  driver's state at runtime.
  
 -	config IWL3160_FW
 -		bool "Intel 3160 Firmware"
-+	config IWL7260_FW
-+		bool "Intel 7260 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Dual Band Wireless-N 7260 and Intel Dual Band Wireless-AC 7260
-+
-+	config IWL7265_FW
-+		bool "Intel 7265 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Wireless 7265, 7265D, 3165
-+
-+	config IWL8000_FW
-+		bool "Intel 8000 Series Firmware"
- 		default y
- 		help
- 		  Download and install firmware for:
+-		default y
+-		help
+-		  Download and install firmware for:
 -		    Intel Wireless 3160
-+		    Intel Wireless Series 8260, 4165
-+
    endif
  endef
  
-@@ -953,578 +1026,587 @@ endef
+@@ -942,7 +834,7 @@ define KernelPackage/iwl-legacy
+   $(call KernelPackage/mac80211/Default)
+   DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
+   TITLE:=Intel legacy Wireless support
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwlegacy.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
+   AUTOLOAD:=$(call AutoProbe,iwlegacy)
+ endef
+ 
+@@ -952,9 +844,9 @@ endef
+ 
  define KernelPackage/iwl3945
    $(call KernelPackage/mac80211/Default)
-   DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy
--  TITLE:=Intel iwl3945 Wireless support
+-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy
++  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
+   TITLE:=Intel iwl3945 Wireless support
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwl3945.ko
--  AUTOLOAD:=$(call AutoProbe,iwl3945)
--endef
--
--define KernelPackage/iwl3945/description
-- iwl3945 kernel module for Intel 3945 support
--endef
--
--define KernelPackage/iwl4965
--  $(call KernelPackage/mac80211/Default)
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
+   AUTOLOAD:=$(call AutoProbe,iwl3945)
+ endef
+ 
+@@ -964,9 +856,9 @@ endef
+ 
+ define KernelPackage/iwl4965
+   $(call KernelPackage/mac80211/Default)
 -  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT
--  TITLE:=Intel iwl4965 Wireless support
++  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
+   TITLE:=Intel iwl4965 Wireless support
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwl4965.ko
--  AUTOLOAD:=$(call AutoProbe,iwl4965)
--endef
--
--define KernelPackage/iwl4965/description
-- iwl4965 kernel module for Intel 4965 support
--endef
--
--
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
+   AUTOLOAD:=$(call AutoProbe,iwl4965)
+ endef
+ 
+@@ -975,557 +867,562 @@ define KernelPackage/iwl4965/description
+ endef
+ 
+ 
 -define KernelPackage/mwl8k
 -  $(call KernelPackage/mac80211/Default)
 -  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
@@ -1578,10 +2658,13 @@ index a1eedce..566e156 100644
 -
 -
 -define KernelPackage/wlcore
--  $(call KernelPackage/mac80211/Default)
++define KernelPackage/lib80211
+   $(call KernelPackage/mac80211/Default)
 -  TITLE:=TI common driver part
 -  DEPENDS+= @TARGET_omap +kmod-mac80211 +@DRIVER_11N_SUPPORT
--  FILES:= \
++  TITLE:=802.11 Networking stack
++  DEPENDS:=+kmod-cfg80211
+   FILES:= \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
 -	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
 -  AUTOLOAD:=$(call AutoProbe,wlcore wlcore_sdio)
@@ -1598,38 +2681,26 @@ index a1eedce..566e156 100644
 -  DEPENDS+= +kmod-wlcore
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl12xx/wl12xx.ko
 -  AUTOLOAD:=$(call AutoProbe,wl12xx)
-+  TITLE:=Intel iwl3945 Wireless support
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwl3945.ko
-+  AUTOLOAD:=$(call AutoProbe,iwl3945)
- endef
- 
+-endef
+-
 -define KernelPackage/wl12xx/description
 - Kernel modules for TI WL12xx
-+define KernelPackage/iwl3945/description
-+ iwl3945 kernel module for Intel 3945 support
- endef
- 
+-endef
+-
 -define KernelPackage/wl18xx
-+define KernelPackage/iwl4965
-   $(call KernelPackage/mac80211/Default)
+-  $(call KernelPackage/mac80211/Default)
 -  TITLE:=Driver for TI WL18xx
 -  URL:=http://wireless.kernel.org/en/users/Drivers/wl18xx
 -  DEPENDS+= +kmod-wlcore
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl18xx/wl18xx.ko
 -  AUTOLOAD:=$(call AutoProbe,wl18xx)
-+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT
-+  TITLE:=Intel iwl4965 Wireless support
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwl4965.ko
-+  AUTOLOAD:=$(call AutoProbe,iwl4965)
- endef
- 
+-endef
+-
 -define KernelPackage/wl18xx/description
 - Kernel modules for TI WL18xx
-+define KernelPackage/iwl4965/description
-+ iwl4965 kernel module for Intel 4965 support
- endef
- 
- 
+-endef
+-
+-
 -#Broadcom firmware
 -ifneq ($(CONFIG_B43_FW_6_30),)
 -  PKG_B43_FWV4_NAME:=broadcom-wl
@@ -1693,11 +2764,13 @@ index a1eedce..566e156 100644
 -  FILE:=$(PKG_B43_FWV4_SOURCE)
 -  URL:=$(PKG_B43_FWV4_SOURCE_URL)
 -  MD5SUM:=$(PKG_B43_FWV4_MD5SUM)
-+define KernelPackage/lib80211
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=802.11 Networking stack
-+  DEPENDS:=+kmod-cfg80211
-+  FILES:= \
+-endef
+-$(eval $(call Download,b43))
+-
+-define Download/b43legacy
+-  FILE:=$(PKG_B43_FWV3_SOURCE)
+-  URL:=$(PKG_B43_FWV3_SOURCE_URL)
+-  MD5SUM:=$(PKG_B43_FWV3_MD5SUM)
 +	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
 +	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
 +	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_ccmp.ko \
@@ -1709,26 +2782,11 @@ index a1eedce..566e156 100644
 +	lib80211_crypt_tkip \
 +  )
  endef
--$(eval $(call Download,b43))
- 
--define Download/b43legacy
--  FILE:=$(PKG_B43_FWV3_SOURCE)
--  URL:=$(PKG_B43_FWV3_SOURCE_URL)
--  MD5SUM:=$(PKG_B43_FWV3_MD5SUM)
-+define KernelPackage/lib80211/description
-+ Kernel modules for 802.11 Networking stack
-+ Includes:
-+ - lib80211
-+ - lib80211_crypt_wep
-+ - lib80211_crypt_tkip
-+ - lib80211_crytp_ccmp
- endef
 -$(eval $(call Download,b43legacy))
  
- 
+-
 -define KernelPackage/b43
-+define KernelPackage/libipw
-   $(call KernelPackage/mac80211/Default)
+-  $(call KernelPackage/mac80211/Default)
 -  TITLE:=Broadcom 43xx wireless support
 -  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
 -  KCONFIG:= \
@@ -1741,10 +2799,13 @@ index a1eedce..566e156 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43/b43.ko
 -  AUTOLOAD:=$(call AutoProbe,b43)
 -  MENU:=1
-+  TITLE:=libipw for ipw2100 and ipw2200
-+  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/libipw.ko
-+  AUTOLOAD:=$(call AutoProbe,libipw)
++define KernelPackage/lib80211/description
++ Kernel modules for 802.11 Networking stack
++ Includes:
++ - lib80211
++ - lib80211_crypt_wep
++ - lib80211_crypt_tkip
++ - lib80211_crytp_ccmp
  endef
  
 -define KernelPackage/b43/config
@@ -1755,20 +2816,45 @@ index a1eedce..566e156 100644
 -	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
 -	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
 -	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
-+define KernelPackage/libipw/description
-+ Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-+endef
- 
+-
 -config PACKAGE_B43_USE_BCMA
 -	select PACKAGE_kmod-bcma
 -	tristate
 -	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
 -	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
 -	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
+-
+-  if PACKAGE_kmod-b43
+ 
+-	choice
+-		prompt "b43 firmware version"
+-		default B43_FW_5_100_138
+-		help
+-		  This option allows you to select the version of the b43 firmware.
++define KernelPackage/libipw
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=libipw for ipw2100 and ipw2200
++  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
++  AUTOLOAD:=$(call AutoProbe,libipw)
++endef
+ 
+-	config B43_FW_4_150
+-		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
+-		help
+-		  Old stable firmware for BCM43xx devices.
++define KernelPackage/libipw/description
++ Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
++endef
+ 
+-		  If unsure, select this.
 +IPW2100_NAME:=ipw2100-fw
 +IPW2100_VERSION:=1.3
  
--  if PACKAGE_kmod-b43
+-	config B43_FW_4_178
+-		bool "Firmware 478.104 from driver 4.178.10.4"
+-		help
+-		  Older firmware for BCM43xx devices.
 +define Download/ipw2100
 +  URL:=http://bughost.org/firmware/
 +  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
@@ -1776,37 +2862,33 @@ index a1eedce..566e156 100644
 +endef
 +$(eval $(call Download,ipw2100))
  
--	choice
--		prompt "b43 firmware version"
--		default B43_FW_5_100_138
--		help
--		  This option allows you to select the version of the b43 firmware.
+-		  If unsure, select the "stable" firmware.
 +define KernelPackage/ipw2100
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Intel IPW2100 driver
 +  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2100.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
 +  AUTOLOAD:=$(call AutoProbe,ipw2100)
 +endef
  
--	config B43_FW_4_150
--		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
+-	config B43_FW_5_10
+-		bool "Firmware 508.1084 from driver 5.10.56.27"
 -		help
--		  Old stable firmware for BCM43xx devices.
+-		  Older firmware for BCM43xx devices.
 +define KernelPackage/ipw2100/description
 + Kernel support for Intel IPW2100
 + Includes:
 + - ipw2100
 +endef
  
--		  If unsure, select this.
+-		  If unsure, select the "stable" firmware.
 +IPW2200_NAME:=ipw2200-fw
 +IPW2200_VERSION:=3.1
  
--	config B43_FW_4_178
--		bool "Firmware 478.104 from driver 4.178.10.4"
+-	config B43_FW_5_100_138
+-		bool "Firmware 666.2 from driver 5.100.138 (stable)"
 -		help
--		  Older firmware for BCM43xx devices.
+-		  The currently default firmware for BCM43xx devices.
 +define Download/ipw2200
 +  URL:=http://bughost.org/firmware/
 +  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
@@ -1814,53 +2896,53 @@ index a1eedce..566e156 100644
 +endef
 +$(eval $(call Download,ipw2200))
  
--		  If unsure, select the "stable" firmware.
+-		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
 +define KernelPackage/ipw2200
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Intel IPW2200 driver
 +  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2200.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
 +  AUTOLOAD:=$(call AutoProbe,ipw2200)
 +endef
  
--	config B43_FW_5_10
--		bool "Firmware 508.1084 from driver 5.10.56.27"
--		help
--		  Older firmware for BCM43xx devices.
+-		  If unsure, select the this firmware.
 +define KernelPackage/ipw2200/description
 + Kernel support for Intel IPW2200
 + Includes:
 + - ipw2200
 +endef
  
--		  If unsure, select the "stable" firmware.
- 
--	config B43_FW_5_100_138
--		bool "Firmware 666.2 from driver 5.100.138 (stable)"
+-	config B43_FW_6_30
+-		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
 -		help
--		  The currently default firmware for BCM43xx devices.
+-		  Newer experimental firmware for BCM43xx devices.
+ 
+-		  This firmware is mostly untested.
 +define KernelPackage/libertas-usb
 +  $(call KernelPackage/mac80211/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT
++  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware
 +  TITLE:=Marvell 88W8015 Wireless Driver
 +  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/usb8xxx.ko
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
 +  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
 +endef
  
--		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
+-		  If unsure, select the "stable" firmware.
 +define KernelPackage/libertas-sdio
 +  $(call KernelPackage/mac80211/Default)
-+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml
++  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware
 +  TITLE:=Marvell 88W8686 Wireless Driver
 +  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas_sdio.ko
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
 +  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
 +endef
  
--		  If unsure, select the this firmware.
+-	config B43_OPENFIRMWARE
+-		bool "Open FirmWare for WiFi networks"
+-		help
+-		  Opensource firmware for BCM43xx devices.
 +define KernelPackage/mac80211-hwsim
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=mac80211 HW simulation device
@@ -1869,70 +2951,23 @@ index a1eedce..566e156 100644
 +  AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
 +endef
  
--	config B43_FW_6_30
--		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
--		help
--		  Newer experimental firmware for BCM43xx devices.
-+PKG_MT7601U_FW_NAME:=DPO_MT7601U_LinuxSTA
-+PKG_MT7601U_FW_VERSION:=3.0.0.4_20130913
-+PKG_MT7601U_FW_MD5SUM:=5f440dccc8bc952745a191994fc34699
-+PKG_MT7601U_FW_SOURCE:=$(PKG_MT7601U_FW_NAME)_$(PKG_MT7601U_FW_VERSION).tar.bz2
-+PKG_MT7601U_FW_SOURCE_URL:=http://www.mediatek.com/AmazonS3/Downloads/linux/
-+define Download/mt7601u-firmware
-+  FILE:=$(PKG_MT7601U_FW_SOURCE)
-+  URL:=$(PKG_MT7601U_FW_SOURCE_URL)
-+  MD5SUM:=$(PKG_MT7601U_FW_MD5SUM)
-+  SUBDIR:=$(PKG_MT7601U_FW_NAME)_$(PKG_MT7601U_FW_VERSION)
-+endef
-+$(eval $(call Download,mt7601u-firmware))
- 
--		  This firmware is mostly untested.
-+define KernelPackage/mt7601u
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=MT7601U-based USB dongles Wireless Driver
-+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
-+  AUTOLOAD:=$(call AutoProbe,mt7601)
-+endef
- 
--		  If unsure, select the "stable" firmware.
- 
--	config B43_OPENFIRMWARE
--		bool "Open FirmWare for WiFi networks"
--		help
--		  Opensource firmware for BCM43xx devices.
-+define KernelPackage/mwl8k
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
-+  URL:=http://wireless.kernel.org/en/users/Drivers/mwl8k
-+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mwl8k.ko
-+  AUTOLOAD:=$(call AutoProbe,mwl8k)
-+endef
- 
 -		  Do _not_ select this, unless you know what you are doing.
 -		  The Opensource firmware is not suitable for embedded devices, yet.
 -		  It does not support QoS, which is bad for AccessPoints.
 -		  It does not support hardware crypto acceleration, which is a showstopper
 -		  for embedded devices with low CPU resources.
-+define KernelPackage/mwl8k/description
-+ Kernel modules for Marvell TOPDOG 802.11 Wireless cards
-+endef
  
 -		  If unsure, select the "stable" firmware.
- 
--	endchoice
-+define KernelPackage/mwifiex-pcie
++define KernelPackage/mt7601u
 +  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
-+  URL:=http://wireless.kernel.org/en/users/Drivers/mwifiex
-+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/mwifiex/mwifiex.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/mwifiex/mwifiex_pcie.ko
-+  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
++  TITLE:=MT7601U-based USB dongles Wireless Driver
++  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
++  AUTOLOAD:=$(call AutoProbe,mt7601u)
 +endef
  
+-	endchoice
+ 
 -	config B43_FW_SQUASH
 -		bool "Remove unnecessary firmware files"
 -		depends on !B43_OPENFIRMWARE
@@ -1941,11 +2976,19 @@ index a1eedce..566e156 100644
 -		  This options allows you to remove unnecessary b43 firmware files
 -		  from the final rootfs image. This can reduce the rootfs size by
 -		  up to 200k.
-+define KernelPackage/mwifiex-pcie/description
-+ Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
++define KernelPackage/mwl8k
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
++  URL:=http://wireless.kernel.org/en/users/Drivers/mwl8k
++  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
++  AUTOLOAD:=$(call AutoProbe,mwl8k)
 +endef
  
 -		  If unsure, say Y.
++define KernelPackage/mwl8k/description
++ Kernel modules for Marvell TOPDOG 802.11 Wireless cards
++endef
  
 -	config B43_FW_SQUASH_COREREVS
 -		string "Core revisions to include"
@@ -1955,28 +2998,25 @@ index a1eedce..566e156 100644
 -		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
 -		help
 -		  This is a comma seperated list of core revision numbers.
-+# Prism54 drivers
-+P54PCIFW:=2.13.12.0.arm
-+P54USBFW:=2.13.24.0.lm87.arm
-+P54SPIFW:=2.13.0.0.a.13.14.arm
  
 -		  Example (keep files for rev5 only):
 -		    5
-+define Download/p54usb
-+  FILE:=$(P54USBFW)
-+  URL:=http://daemonizer.de/prism54/prism54-fw/fw-usb
-+  MD5SUM:=8e8ab005a4f8f0123bcdc51bc25b47f6
++define KernelPackage/mwifiex-pcie
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
++  URL:=http://wireless.kernel.org/en/users/Drivers/mwifiex
++  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwifiex-pcie-firmware
++  FILES:= \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
++  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
 +endef
-+$(eval $(call Download,p54usb))
  
 -		  Example (keep files for rev5 and rev11):
 -		    5,11
-+define Download/p54pci
-+  FILE:=$(P54PCIFW)
-+  URL:=http://daemonizer.de/prism54/prism54-fw/fw-softmac
-+  MD5SUM:=ff7536af2092b1c4b21315bd103ef4c4
++define KernelPackage/mwifiex-pcie/description
++ Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
 +endef
-+$(eval $(call Download,p54pci))
  
 -	config B43_FW_SQUASH_PHYTYPES
 -		string "PHY types to include"
@@ -1995,6 +3035,38 @@ index a1eedce..566e156 100644
 -		    LCN  => LCN-PHY
 -		    LCN40  => LCN40-PHY
 -		    AC  => AC-PHY
+ 
+-		  Example (keep files for G-PHY only):
+-		    G
++# Prism54 drivers
++P54PCIFW:=2.13.12.0.arm
++P54USBFW:=2.13.24.0.lm87.arm
++P54SPIFW:=2.13.0.0.a.13.14.arm
+ 
+-		  Example (keep files for G-PHY and N-PHY):
+-		    G,N
++define Download/p54usb
++  FILE:=$(P54USBFW)
++  URL:=http://daemonizer.de/prism54/prism54-fw/fw-usb
++  MD5SUM:=8e8ab005a4f8f0123bcdc51bc25b47f6
++endef
++$(eval $(call Download,p54usb))
+ 
+-	choice
+-		prompt "Supported buses"
+-		default PACKAGE_B43_BUSES_BCMA_AND_SSB
+-		help
+-		  This allows choosing buses that b43 should support.
++define Download/p54pci
++  FILE:=$(P54PCIFW)
++  URL:=http://daemonizer.de/prism54/prism54-fw/fw-softmac
++  MD5SUM:=ff7536af2092b1c4b21315bd103ef4c4
++endef
++$(eval $(call Download,p54pci))
+ 
+-	config PACKAGE_B43_BUSES_BCMA_AND_SSB
+-		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
+-		bool "BCMA and SSB"
 +define Download/p54spi
 +  FILE:=$(P54SPIFW)
 +  URL:=http://daemonizer.de/prism54/prism54-fw/stlc4560
@@ -2002,168 +3074,165 @@ index a1eedce..566e156 100644
 +endef
 +$(eval $(call Download,p54spi))
  
--		  Example (keep files for G-PHY only):
--		    G
+-	config PACKAGE_B43_BUSES_BCMA
+-		depends on !TARGET_brcm47xx_legacy
+-		bool "BCMA only"
 +define KernelPackage/p54/Default
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Prism54 Drivers
 +endef
  
--		  Example (keep files for G-PHY and N-PHY):
--		    G,N
+-	config PACKAGE_B43_BUSES_SSB
+-		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
+-		bool "SSB only"
 +define KernelPackage/p54/description
 +  Kernel module for Prism54 chipsets (mac80211)
 +endef
  
--	choice
--		prompt "Supported buses"
--		default PACKAGE_B43_BUSES_BCMA_AND_SSB
--		help
--		  This allows choosing buses that b43 should support.
+-	endchoice
 +define KernelPackage/p54-common
 +  $(call KernelPackage/p54/Default)
 +  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt
 +  TITLE+= (COMMON)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54common.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54common.ko
 +endef
  
--	config PACKAGE_B43_BUSES_BCMA_AND_SSB
--		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
--		bool "BCMA and SSB"
+-	config PACKAGE_B43_DEBUG
+-		bool "Enable debug output and debugfs for b43"
+-		default n
+-		help
+-		  Enable additional debug output and runtime sanity checks for b43
+-		  and enables the debugfs interface.
 +define KernelPackage/p54-pci
 +  $(call KernelPackage/p54/Default)
 +  TITLE+= (PCI)
 +  DEPENDS+= @PCI_SUPPORT +kmod-p54-common
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54pci.ko
 +  AUTOLOAD:=$(call AutoProbe,p54pci)
 +endef
  
--	config PACKAGE_B43_BUSES_BCMA
--		depends on !TARGET_brcm47xx_legacy
--		bool "BCMA only"
+-		  If unsure, say N.
 +define KernelPackage/p54-usb
 +  $(call KernelPackage/p54/Default)
 +  TITLE+= (USB)
 +  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54usb.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54usb.ko
 +  AUTOLOAD:=$(call AutoProbe,p54usb)
 +endef
  
--	config PACKAGE_B43_BUSES_SSB
--		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
--		bool "SSB only"
+-	config PACKAGE_B43_PIO
+-		bool "Enable support for PIO transfer mode"
+-		default n
+-		help
+-		  Enable support for using PIO instead of DMA. Unless you have DMA
+-		  transfer problems you don't need this.
 +define KernelPackage/p54-spi
 +  $(call KernelPackage/p54/Default)
 +  TITLE+= (SPI)
 +  DEPENDS+= @TARGET_omap24xx +kmod-p54-common
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54spi.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54spi.ko
 +  AUTOLOAD:=$(call AutoProbe,p54spi)
 +endef
  
--	endchoice
+-		  If unsure, say N.
 +define KernelPackage/rt2x00/Default
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Ralink Drivers for RT2x00 cards
 +endef
  
--	config PACKAGE_B43_DEBUG
--		bool "Enable debug output and debugfs for b43"
--		default n
+-	config PACKAGE_B43_PHY_G
+-		bool "Enable support for G-PHYs"
+-		default n if TARGET_brcm47xx_mips74k
+-		default y
 -		help
--		  Enable additional debug output and runtime sanity checks for b43
--		  and enables the debugfs interface.
+-		  Enable support for G-PHY. This includes support for the following devices:
+-		  PCI: BCM4306, BCM4311, BCM4318
+-		  SoC: BCM5352E, BCM4712
 +define KernelPackage/rt2x00-lib
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-lib-crc-itu-t
 +  TITLE+= (LIB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00lib.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00lib.ko
 +  MENU:=1
 +endef
  
--		  If unsure, say N.
+-		  If unsure, say Y.
 +define KernelPackage/rt2x00-lib/config
 +  if PACKAGE_kmod-rt2x00-lib
  
--	config PACKAGE_B43_PIO
--		bool "Enable support for PIO transfer mode"
--		default n
+-	config PACKAGE_B43_PHY_N
+-		bool "Enable support for N-PHYs"
+-		default y
 +	config PACKAGE_RT2X00_LIB_DEBUGFS
 +		bool "Enable rt2x00 debugfs support"
 +		depends on PACKAGE_MAC80211_DEBUGFS
  		help
--		  Enable support for using PIO instead of DMA. Unless you have DMA
--		  transfer problems you don't need this.
--
--		  If unsure, say N.
+-		  Enable support for N-PHY. This includes support for the following devices:
+-		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
+-		  SoC: BCM4716, BCM4717, BCM4718
 +		  Enable creation of debugfs files for the rt2x00 drivers.
 +		  These debugfs files support both reading and writing of the
 +		  most important register types of the rt2x00 hardware.
  
--	config PACKAGE_B43_PHY_G
--		bool "Enable support for G-PHYs"
--		default n if TARGET_brcm47xx_mips74k
--		default y
+-		  Currently only 11g speed is available.
 +	config PACKAGE_RT2X00_DEBUG
 +		bool "Enable rt2x00 debug output"
- 		help
--		  Enable support for G-PHY. This includes support for the following devices:
--		  PCI: BCM4306, BCM4311, BCM4318
--		  SoC: BCM5352E, BCM4712
++		help
 +		  Enable debugging output for all rt2x00 modules
  
 -		  If unsure, say Y.
 +  endif
 +endef
  
--	config PACKAGE_B43_PHY_N
--		bool "Enable support for N-PHYs"
+-	config PACKAGE_B43_PHY_LP
+-		bool "Enable support for LP-PHYs"
+-		default n if TARGET_brcm47xx_mips74k
 -		default y
 -		help
--		  Enable support for N-PHY. This includes support for the following devices:
--		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
--		  SoC: BCM4716, BCM4717, BCM4718
+-		  Enable support for LP-PHY. This includes support for the following devices:
+-		  PCI: BCM4312
+-		  SoC: BCM5354
 +define KernelPackage/rt2x00-mmio
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
 +  HIDDEN:=1
 +  TITLE+= (MMIO)
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00mmio.ko
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko
 +endef
  
--		  Currently only 11g speed is available.
+-		  If unsure, say Y.
 +define KernelPackage/rt2x00-pci
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
 +  HIDDEN:=1
 +  TITLE+= (PCI)
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.ko
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
 +endef
  
--		  If unsure, say Y.
+-	config PACKAGE_B43_PHY_HT
+-		bool "Enable support for HT-PHYs"
+-		default n if TARGET_brcm47xx_legacy
+-		default y
+-		help
+-		  Enable support for HT-PHY. This includes support for the following devices:
+-		  PCI: BCM4331
 +define KernelPackage/rt2x00-usb
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
 +  HIDDEN:=1
 +  TITLE+= (USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00usb.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00usb.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
 +endef
  
--	config PACKAGE_B43_PHY_LP
--		bool "Enable support for LP-PHYs"
--		default n if TARGET_brcm47xx_mips74k
--		default y
--		help
--		  Enable support for LP-PHY. This includes support for the following devices:
--		  PCI: BCM4312
--		  SoC: BCM5354
+-		  Currently only 11g speed is available.
 +define KernelPackage/rt2800-lib
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
 +  HIDDEN:=1
 +  TITLE+= (rt2800 LIB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800lib.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
 +endef
  
 -		  If unsure, say Y.
@@ -2171,282 +3240,240 @@ index a1eedce..566e156 100644
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
 +  TITLE+= (RT2400 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2400pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2400pci)
 +endef
  
--	config PACKAGE_B43_PHY_HT
--		bool "Enable support for HT-PHYs"
--		default n if TARGET_brcm47xx_legacy
--		default y
+-	config PACKAGE_B43_PHY_LCN
+-		bool "Enable support for LCN-PHYs"
+-		depends on BROKEN
+-		default n
 -		help
--		  Enable support for HT-PHY. This includes support for the following devices:
--		  PCI: BCM4331
+-		  Currently broken.
 +define KernelPackage/rt2500-pci
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
 +  TITLE+= (RT2500 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2500pci)
 +endef
-+
+ 
+-		  If unsure, say N.
 +define KernelPackage/rt2500-usb
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
 +  TITLE+= (RT2500 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500usb.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2500usb)
 +endef
-+
+ 
+-  endif
 +define KernelPackage/rt2800-mmio
 +$(call KernelPackage/rt2x00/Default)
 +  TITLE += (RT28xx/RT3xxx MMIO)
 +  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
 +  HIDDEN:=1
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800mmio.ko
-+endef
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800mmio.ko
+ endef
  
--		  Currently only 11g speed is available.
+-define KernelPackage/b43/description
+-Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
 +define KernelPackage/rt2800-soc
 +$(call KernelPackage/rt2x00/Default)
 +  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
 +  TITLE += (RT28xx/RT3xxx SoC)
 +  FILES := \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00soc.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800soc.ko
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00soc.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800soc.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2800soc)
-+endef
+ endef
  
--		  If unsure, say Y.
+-define KernelPackage/b43legacy
+-  $(call KernelPackage/mac80211/Default)
+-  TITLE:=Broadcom 43xx-legacy wireless support
+-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
+-  KCONFIG:= \
+-  	CONFIG_HW_RANDOM=y
+-  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43legacy/b43legacy.ko
+-  AUTOLOAD:=$(call AutoProbe,b43legacy)
+-  MENU:=1
 +define KernelPackage/rt2800-pci
 +$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio
++  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio +rt2800-pci-firmware
 +  TITLE+= (RT2860 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2800pci)
-+endef
+ endef
  
--	config PACKAGE_B43_PHY_LCN
--		bool "Enable support for LCN-PHYs"
--		depends on BROKEN
--		default n
--		help
--		  Currently broken.
+-define KernelPackage/b43legacy/config
+-  if PACKAGE_kmod-b43legacy
 +define KernelPackage/rt2800-usb
 +$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt
++  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt +rt2800-usb-firmware
 +  TITLE+= (RT2870 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800usb.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800usb.ko
 +  AUTOLOAD:=$(call AutoProbe,rt2800usb)
 +endef
  
--		  If unsure, say N.
+-	config B43LEGACY_FW_SQUASH
+-		bool "Remove unnecessary firmware files"
+-		default y
+-		help
+-		  This options allows you to remove unnecessary b43legacy firmware files
+-		  from the final rootfs image. This can reduce the rootfs size by
+-		  up to 50k.
  
--  endif
+-		  If unsure, say Y.
 +define KernelPackage/rt61-pci
 +$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
++  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +rt61-pci-firmware
 +  TITLE+= (RT2x61 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt61pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rt61pci)
- endef
++endef
  
--define KernelPackage/b43/description
--Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
+-	config B43LEGACY_FW_SQUASH_COREREVS
+-		string "Core revisions to include"
+-		depends on B43LEGACY_FW_SQUASH
+-		default "1,2,3,4"
+-		help
+-		  This is a comma seperated list of core revision numbers.
 +define KernelPackage/rt73-usb
 +  $(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
++  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +rt73-usb-firmware
 +  TITLE+= (RT73 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt73usb.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
 +  AUTOLOAD:=$(call AutoProbe,rt73usb)
- endef
++endef
  
--define KernelPackage/b43legacy
-+
+-		  Example (keep files for rev4 only):
+-		    4
+ 
+-		  Example (keep files for rev2 and rev4):
+-		    2,4
 +define KernelPackage/rtl818x/Default
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom 43xx-legacy wireless support
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
--  KCONFIG:= \
--  	CONFIG_HW_RANDOM=y
--  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43legacy/b43legacy.ko
--  AUTOLOAD:=$(call AutoProbe,b43legacy)
--  MENU:=1
++  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Realtek Drivers for RTL818x devices
 +  URL:=http://wireless.kernel.org/en/users/Drivers/rtl8187
 +  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
- endef
++endef
  
--define KernelPackage/b43legacy/config
--  if PACKAGE_kmod-b43legacy
--
--	config B43LEGACY_FW_SQUASH
--		bool "Remove unnecessary firmware files"
--		default y
--		help
--		  This options allows you to remove unnecessary b43legacy firmware files
--		  from the final rootfs image. This can reduce the rootfs size by
--		  up to 50k.
+-  endif
 +define KernelPackage/rtl8180
 +  $(call KernelPackage/rtl818x/Default)
 +  DEPENDS+= @PCI_SUPPORT
 +  TITLE+= (RTL8180 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8180/rtl818x_pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
-+endef
+ endef
  
--		  If unsure, say Y.
+-define KernelPackage/b43legacy/description
+-Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
 +define KernelPackage/rtl8187
 +$(call KernelPackage/rtl818x/Default)
 +  DEPENDS+= @USB_SUPPORT +kmod-usb-core
 +  TITLE+= (RTL8187 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8187/rtl8187.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
 +  AUTOLOAD:=$(call AutoProbe,rtl8187)
-+endef
+ endef
  
--	config B43LEGACY_FW_SQUASH_COREREVS
--		string "Core revisions to include"
--		depends on B43LEGACY_FW_SQUASH
--		default "1,2,3,4"
 +define KernelPackage/rtlwifi/config
 +	config PACKAGE_RTLWIFI_DEBUG
 +		bool "Realtek wireless debugging"
 +		depends on PACKAGE_kmod-rtlwifi
- 		help
--		  This is a comma seperated list of core revision numbers.
++		help
 +		  Say Y, if you want to debug realtek wireless drivers.
- 
--		  Example (keep files for rev4 only):
--		    4
++
 +endef
  
--		  Example (keep files for rev2 and rev4):
--		    2,4
+-define KernelPackage/brcmutil
 +define KernelPackage/rtlwifi
-+  $(call KernelPackage/mac80211/Default)
+   $(call KernelPackage/mac80211/Default)
+-  TITLE:=Broadcom IEEE802.11n common driver parts
+-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+-  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
+-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmutil/brcmutil.ko
+-  AUTOLOAD:=$(call AutoProbe,brcmutil)
+-  MENU:=1
 +  TITLE:=Realtek common driver part
 +  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtlwifi.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
 +  HIDDEN:=1
-+endef
+ endef
  
--  endif
+-define KernelPackage/brcmutil/description
+- This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
 +define KernelPackage/rtlwifi-pci
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Realtek common driver part (PCI support)
 +  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl_pci.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
 +  AUTOLOAD:=$(call AutoProbe,rtl_pci)
 +  HIDDEN:=1
  endef
  
--define KernelPackage/b43legacy/description
--Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
+-define KernelPackage/brcmutil/config
+-  if PACKAGE_kmod-brcmutil
 +define KernelPackage/rtlwifi-usb
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Realtek common driver part (USB support)
 +  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl_usb.ko
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
 +  AUTOLOAD:=$(call AutoProbe,rtl_usb)
 +  HIDDEN:=1
- endef
++endef
  
+-	config PACKAGE_BRCM80211_DEBUG
+-		bool "Broadcom wireless driver debugging"
+-		help
+-		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
 +define KernelPackage/rtl8192c-common
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
 +  DEPENDS+= +kmod-rtlwifi
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192c/rtl8192c-common.ko
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
 +  HIDDEN:=1
 +endef
  
--define KernelPackage/brcmutil
+-  endif
 +define KernelPackage/rtl8192ce
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom IEEE802.11n common driver parts
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
--  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmutil/brcmutil.ko
--  AUTOLOAD:=$(call AutoProbe,brcmutil)
--  MENU:=1
++  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Realtek RTL8192CE/RTL8188CE support
-+  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192ce.ko
++  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common +rtl8192ce-firmware
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
 +  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
  endef
  
--define KernelPackage/brcmutil/description
-- This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
-+define KernelPackage/rtl8192ce/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfw.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfwU.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfwU_B.bin $(1)/lib/firmware/rtlwifi
- endef
- 
--define KernelPackage/brcmutil/config
--  if PACKAGE_kmod-brcmutil
-+define KernelPackage/rtl8192se
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192SE/RTL8191SE support
-+  DEPENDS+= +kmod-rtlwifi-pci
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192se/rtl8192se.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192se)
-+endef
- 
--	config PACKAGE_BRCM80211_DEBUG
--		bool "Broadcom wireless driver debugging"
--		help
--		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
-+define KernelPackage/rtl8192se/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192sefw.bin $(1)/lib/firmware/rtlwifi
-+endef
- 
--  endif
-+define KernelPackage/rtl8192de
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192DE/RTL8188DE support
-+  DEPENDS+= +kmod-rtlwifi-pci
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192de/rtl8192de.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192de)
- endef
- 
 -PKG_BRCMSMAC_FW_NAME:=broadcom-wl
 -PKG_BRCMSMAC_FW_VERSION:=5.100.138
 -PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
 -PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
 -PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
 -PKG_BRCMSMAC_FW_MD5SUM:=f4e357b09eaf5d8b1f1920cf3493a555
-+define KernelPackage/rtl8192de/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192defw.bin $(1)/lib/firmware/rtlwifi
++define KernelPackage/rtl8192se
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Realtek RTL8192SE/RTL8191SE support
++  DEPENDS+= +kmod-rtlwifi-pci +rtl8192se-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
++  AUTOLOAD:=$(call AutoProbe,rtl8192se)
 +endef
  
 -define Download/brcmsmac
 -  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
 -  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
 -  MD5SUM:=$(PKG_BRCMSMAC_FW_MD5SUM)
-+define KernelPackage/rtl8192cu
++define KernelPackage/rtl8192de
 +  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192CU/RTL8188CU support
-+  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192cu/rtl8192cu.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
++  TITLE:=Realtek RTL8192DE/RTL8188DE support
++  DEPENDS+= +kmod-rtlwifi-pci +rtl8192de-firmware
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
++  AUTOLOAD:=$(call AutoProbe,rtl8192de)
  endef
 -$(eval $(call Download,brcmsmac))
  
 -define KernelPackage/brcmsmac
-+define KernelPackage/rtl8192cu/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_A.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_B.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_TMSC.bin $(1)/lib/firmware/rtlwifi
-+endef
-+
-+
-+define KernelPackage/wlcore
++define KernelPackage/rtl8192cu
    $(call KernelPackage/mac80211/Default)
 -  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
 -  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
@@ -2454,30 +3481,30 @@ index a1eedce..566e156 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmsmac/brcmsmac.ko
 -  AUTOLOAD:=$(call AutoProbe,brcmsmac)
 -  MENU:=1
-+  TITLE:=TI common driver part
-+  DEPENDS+= @TARGET_omap +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
-+  AUTOLOAD:=$(call AutoProbe,wlcore wlcore_sdio)
++  TITLE:=Realtek RTL8192CU/RTL8188CU support
++  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common +rtl8192cu-firmware
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
++  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
  endef
  
 -define KernelPackage/brcmsmac/description
 - Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
-+define KernelPackage/wlcore/description
-+ This module contains some common parts needed by TI Wireless drivers.
++
++define KernelPackage/rtl8xxxu
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=alternative Realtek RTL8XXXU support
++  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
++  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko
++  AUTOLOAD:=$(call AutoProbe,rtl8xxxu)
  endef
  
 -define KernelPackage/brcmsmac/config
 -  if PACKAGE_kmod-brcmsmac
-+define KernelPackage/wl12xx
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for TI WL12xx
-+  URL:=http://wireless.kernel.org/en/users/Drivers/wl12xx
-+  DEPENDS+= +kmod-wlcore
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl12xx/wl12xx.ko
-+  AUTOLOAD:=$(call AutoProbe,wl12xx)
-+endef
++define KernelPackage/rtl8xxxu/description
++  This is an alternative driver for various Realtek RTL8XXX
++  parts written to utilize the Linux mac80211 stack.
++  The driver is known to work with a number of RTL8723AU,
++  RL8188CU, RTL8188RU, RTL8191CU, and RTL8192CU devices
  
 -	config BRCMSMAC_USE_FW_FROM_WL
 -		bool "Use firmware extracted from broadcom proprietary driver"
@@ -2487,55 +3514,60 @@ index a1eedce..566e156 100644
 -		  version 666.2 extracted from the proprietary Broadcom driver
 -		  is used. This is needed to get core rev 17 used in bcm4716
 -		  to work.
-+define KernelPackage/wl12xx/description
-+ Kernel modules for TI WL12xx
-+endef
++  This driver is under development and has a limited feature
++  set. In particular it does not yet support 40MHz channels
++  and power management. However it should have a smaller
++  memory footprint than the vendor drivers and benetifs
++  from the in kernel mac80211 stack.
++
++  It can coexist with drivers from drivers/staging/rtl8723au,
++  drivers/staging/rtl8192u, and drivers/net/wireless/rtlwifi,
++  but you will need to control which module you wish to load.
  
 -		  If unsure, say Y.
-+define KernelPackage/wl18xx
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for TI WL18xx
-+  URL:=http://wireless.kernel.org/en/users/Drivers/wl18xx
-+  DEPENDS+= +kmod-wlcore
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl18xx/wl18xx.ko
-+  AUTOLOAD:=$(call AutoProbe,wl18xx)
-+endef
++  RTL8XXXU_UNTESTED is enabled
++  This option enables detection of Realtek 8723/8188/8191/8192 WiFi
++  USB devices which have not been tested directly by the driver
++  author or reported to be working by third parties.
  
 -  endif
-+define KernelPackage/wl18xx/description
-+ Kernel modules for TI WL18xx
++  Please report your results!
  endef
  
  
 -define KernelPackage/brcmfmac
--  $(call KernelPackage/mac80211/Default)
++define KernelPackage/wlcore
+   $(call KernelPackage/mac80211/Default)
 -  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
 -  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
 -  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc +BRCMFMAC_USB:kmod-usb-core
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmfmac/brcmfmac.ko
 -  AUTOLOAD:=$(call AutoProbe,brcmfmac)
-+ZD1211FW_NAME:=zd1211-firmware
-+ZD1211FW_VERSION:=1.4
-+define Download/zd1211rw
-+  FILE:=$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
-+  URL:=@SF/zd1211/
-+  MD5SUM:=19f28781d76569af8551c9d11294c870
++  TITLE:=TI common driver part
++  DEPENDS+= @TARGET_omap +kmod-mac80211 +@DRIVER_11N_SUPPORT
++  FILES:= \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
++  AUTOLOAD:=$(call AutoProbe,wlcore wlcore_sdio)
  endef
-+$(eval $(call Download,zd1211rw))
  
 -define KernelPackage/brcmfmac/description
 - Kernel module for Broadcom IEEE802.11n USB Wireless cards
-+define KernelPackage/zd1211rw
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Zydas ZD1211 support
-+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zd1211rw/zd1211rw.ko
-+  AUTOLOAD:=$(call AutoProbe,zd1211rw)
++define KernelPackage/wlcore/description
++ This module contains some common parts needed by TI Wireless drivers.
  endef
  
 -define KernelPackage/brcmfmac/config
 -  if PACKAGE_kmod-brcmfmac
--
++define KernelPackage/wl12xx
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Driver for TI WL12xx
++  URL:=http://wireless.kernel.org/en/users/Drivers/wl12xx
++  DEPENDS+= +kmod-wlcore +wl12xx-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl12xx/wl12xx.ko
++  AUTOLOAD:=$(call AutoProbe,wl12xx)
++endef
+ 
 -	config BRCMFMAC_SDIO
 -		bool "Enable SDIO bus interface support"
 -		default n
@@ -2544,7 +3576,10 @@ index a1eedce..566e156 100644
 -		  Select this option only if you are sure that your
 -		  board has a Broadcom wireless chip atacched to
 -		  that bus.
--
++define KernelPackage/wl12xx/description
++ Kernel modules for TI WL12xx
++endef
+ 
 -	config BRCMFMAC_USB
 -		bool "Enable USB bus interface support"
 -		depends on USB_SUPPORT
@@ -2553,7 +3588,15 @@ index a1eedce..566e156 100644
 -		  Supported USB connected chipsets:
 -		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
 -		  BCM43143, BCM43242, BCM43566, BCM43569
--
++define KernelPackage/wl18xx
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Driver for TI WL18xx
++  URL:=http://wireless.kernel.org/en/users/Drivers/wl18xx
++  DEPENDS+= +kmod-wlcore +wl18xx-firmware
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl18xx/wl18xx.ko
++  AUTOLOAD:=$(call AutoProbe,wl18xx)
++endef
+ 
 -	config BRCMFMAC_PCIE
 -		bool "Enable PCIE bus interface support"
 -		depends on PCI_SUPPORT
@@ -2561,13 +3604,73 @@ index a1eedce..566e156 100644
 -		help
 -		  Supported PCIe connected chipsets:
 -		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
++define KernelPackage/wl18xx/description
++ Kernel modules for TI WL18xx
++endef
  
 -  endif
--endef
++
++ZD1211FW_NAME:=zd1211-firmware
++ZD1211FW_VERSION:=1.4
++define Download/zd1211rw
++  FILE:=$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
++  URL:=@SF/zd1211/
++  MD5SUM:=19f28781d76569af8551c9d11294c870
++endef
++$(eval $(call Download,zd1211rw))
++
++define KernelPackage/zd1211rw
++  $(call KernelPackage/mac80211/Default)
++  TITLE:=Zydas ZD1211 support
++  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
++  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zydas/zd1211rw/zd1211rw.ko
++  AUTOLOAD:=$(call AutoProbe,zd1211rw)
+ endef
  
++
++
  config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
  
-@@ -1602,6 +1684,8 @@ config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
+ config-y:= \
+@@ -1538,6 +1435,20 @@ config-y:= \
+ 	MAC80211_RC_MINSTREL_HT \
+ 	MAC80211_RC_MINSTREL_VHT \
+ 	MAC80211_RC_DEFAULT_MINSTREL \
++	WLAN_VENDOR_ADMTEK \
++	WLAN_VENDOR_ATH \
++	WLAN_VENDOR_ATMEL \
++	WLAN_VENDOR_BROADCOM \
++	WLAN_VENDOR_INTEL \
++	WLAN_VENDOR_INTERSIL \
++	WLAN_VENDOR_MARVELL \
++	WLAN_VENDOR_MEDIATEK \
++	WLAN_VENDOR_RALINK \
++	WLAN_VENDOR_REALTEK \
++	WLAN_VENDOR_RSI \
++	WLAN_VENDOR_ST \
++	WLAN_VENDOR_TI \
++	WLAN_VENDOR_ZYDAS \
+ 
+ config-$(call config_package,cfg80211) += CFG80211
+ 
+@@ -1554,6 +1465,16 @@ ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
+ 	ATH5K_DEBUG
+ endif
+ 
++ifdef CONFIG_PACKAGE_MAC80211_TRACING
++  config-y += \
++	ATH10K_TRACING \
++	ATH6KL_TRACING \
++	ATH_TRACEPOINTS \
++	WIL6210_TRACING \
++	ATH5K_TRACER \
++	IWLWIFI_DEVICE_TRACING
++endif
++
+ config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_CRYPT_CCMP LIB80211_CRYPT_TKIP
+ 
+ config-$(call config_package,ath) += ATH_CARDS ATH_COMMON
+@@ -1602,6 +1523,8 @@ config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
  config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
  
  config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
@@ -2576,7 +3679,7 @@ index a1eedce..566e156 100644
  
  config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
  config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
-@@ -1623,26 +1707,28 @@ config-$(call config_package,rt2800-pci) += RT2800PCI
+@@ -1623,26 +1546,28 @@ config-$(call config_package,rt2800-pci) += RT2800PCI
  config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
  
  config-$(call config_package,rt2800-usb) += RT2800USB
@@ -2614,35 +3717,46 @@ index a1eedce..566e156 100644
  config-y += HERMES_PRISM
  
  config-$(call config_package,adm8211) += ADM8211
-@@ -1702,8 +1788,9 @@ define Build/Prepare
+@@ -1668,12 +1593,15 @@ config-$(call config_package,rtl8192de) += RTL8192DE
+ config-$(call config_package,rtl8192cu) += RTL8192CU
+ config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
+ 
++config-$(call config_package,rtl8xxxu) += RTL8XXXU
++config-y += RTL8XXXU_UNTESTED
++
+ config-$(CONFIG_LEDS_TRIGGERS) += MAC80211_LEDS B43_LEDS B43LEGACY_LEDS
+ 
+ MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
+ 	CROSS_COMPILE="$(KERNEL_CROSS)" \
+ 	ARCH="$(LINUX_KARCH)" \
+-	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include" \
++	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include $(IREMAP_CFLAGS)" \
+ 	KLIB_BUILD="$(LINUX_DIR)" \
+ 	MODPROBE=true \
+ 	KLIB=$(TARGET_MODULES_DIR) \
+@@ -1702,8 +1630,6 @@ define Build/Prepare
  	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
  	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
  	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
 -	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_LINUX_FIRMWARE_SOURCE)
-+	$(TAR) -C $(PKG_BUILD_DIR) -xJf $(DL_DIR)/$(PKG_LINUX_FIRMWARE_SOURCE)
- 	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE)
-+	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_MT7601U_FW_SOURCE)
+-	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE)
  	rm -rf \
  		$(PKG_BUILD_DIR)/include/linux/ssb \
  		$(PKG_BUILD_DIR)/include/linux/bcma \
-@@ -1739,233 +1826,37 @@ define Build/Compile
- 	$(MAKE) $(MAKE_OPTS) allnoconfig
- 	$(call Build/Compile/kmod)
+@@ -1715,7 +1641,8 @@ define Build/Prepare
+ 		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
+ 		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
+ 		$(PKG_BUILD_DIR)/include/linux/spi/libertas_spi.h \
+-		$(PKG_BUILD_DIR)/include/net/ieee80211.h
++		$(PKG_BUILD_DIR)/include/net/ieee80211.h \
++		$(PKG_BUILD_DIR)/backport-include/linux/bcm47xx_nvram.h
+ 
+ 	echo 'compat-wireless-$(PKG_VERSION)-$(PKG_RELEASE)-$(REVISION)' > $(PKG_BUILD_DIR)/compat_version
+ 	$(CP) ./files/regdb.txt $(PKG_BUILD_DIR)/net/wireless/db.txt
+@@ -1753,220 +1680,6 @@ define Build/InstallDev
+ 	rm -f $(1)/usr/include/mac80211-backport/linux/module.h
  endef
--
--define Build/InstallDev
--	mkdir -p \
--		$(1)/usr/include/mac80211 \
--		$(1)/usr/include/mac80211-backport \
--		$(1)/usr/include/mac80211/ath \
--		$(1)/usr/include/net/mac80211
--	$(CP) $(PKG_BUILD_DIR)/net/mac80211/*.h $(PKG_BUILD_DIR)/include/* $(1)/usr/include/mac80211/
--	$(CP) $(PKG_BUILD_DIR)/backport-include/* $(1)/usr/include/mac80211-backport/
--	$(CP) $(PKG_BUILD_DIR)/net/mac80211/rate.h $(1)/usr/include/net/mac80211/
--	$(CP) $(PKG_BUILD_DIR)/drivers/net/wireless/ath/*.h $(1)/usr/include/mac80211/ath/
--	rm -f $(1)/usr/include/mac80211-backport/linux/module.h
--endef
--
+ 
 -define KernelPackage/libertas-usb/install
 -	$(INSTALL_DIR) $(1)/lib/firmware/libertas
 -	$(INSTALL_DATA) \
@@ -2846,54 +3960,60 @@ index a1eedce..566e156 100644
 -ifneq ($(CONFIG_IWL3160_FW),)
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-3160-9.ucode $(1)/lib/firmware
 -endif
-+
-+define Build/InstallDev
-+	mkdir -p \
-+		$(1)/usr/include/mac80211 \
-+		$(1)/usr/include/mac80211-backport \
-+		$(1)/usr/include/mac80211/ath \
-+		$(1)/usr/include/net/mac80211
-+	$(CP) $(PKG_BUILD_DIR)/net/mac80211/*.h $(PKG_BUILD_DIR)/include/* $(1)/usr/include/mac80211/
-+	$(CP) $(PKG_BUILD_DIR)/backport-include/* $(1)/usr/include/mac80211-backport/
-+	$(CP) $(PKG_BUILD_DIR)/net/mac80211/rate.h $(1)/usr/include/net/mac80211/
-+	$(CP) $(PKG_BUILD_DIR)/drivers/net/wireless/ath/*.h $(1)/usr/include/mac80211/ath/
-+	rm -f $(1)/usr/include/mac80211-backport/linux/module.h
- endef
- 
+-endef
+-
 -define KernelPackage/iwl3945/install
-+
-+define KernelPackage/ath9k-htc/install
- 	$(INSTALL_DIR) $(1)/lib/firmware
+-	$(INSTALL_DIR) $(1)/lib/firmware
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-3945-2.ucode $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/htc_9271.fw \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/htc_7010.fw \
-+		$(1)/lib/firmware/
- endef
- 
+-endef
+-
 -define KernelPackage/iwl4965/install
 -	$(INSTALL_DIR) $(1)/lib/firmware
 -	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-4965-2.ucode $(1)/lib/firmware
-+define KernelPackage/ath10k/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA988X/hw2.0
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/ath10k/QCA988X/hw2.0/board.bin \
-+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/10.2.4/untested/firmware-5.bin_10.2.4.70-2 \
-+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
- endef
+-endef
  
  define KernelPackage/b43/install
-@@ -2028,13 +1919,237 @@ ifneq ($(CONFIG_BRCMFMAC_PCIE),)
+ 	rm -rf $(1)/lib/firmware/
+@@ -1990,51 +1703,84 @@ ifneq ($(CONFIG_B43_FW_SQUASH),)
  endif
  endef
  
-+define KernelPackage/carl9170/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/carl9170-1.fw $(1)/lib/firmware
-+endef
-+
+-define KernelPackage/b43legacy/install
+-	$(INSTALL_DIR) $(1)/lib/firmware/
+-	b43-fwcutter --unsupported -w $(1)/lib/firmware/ $(DL_DIR)/$(PKG_B43_FWV3_SOURCE)
+-ifneq ($(CONFIG_B43LEGACY_FW_SQUASH),)
+-	b43-fwsquash.py "G" "$(CONFIG_B43LEGACY_FW_SQUASH_COREREVS)" "$(1)/lib/firmware/b43legacy"
+-endif
+-endef
+-
+ define KernelPackage/brcmsmac/install
+ 	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+ ifeq ($(CONFIG_BRCMSMAC_USE_FW_FROM_WL),y)
+ 	tar xjf "$(DL_DIR)/$(PKG_BRCMSMAC_FW_SOURCE)" -C "$(PKG_BUILD_DIR)"
+ 	b43-fwcutter --brcmsmac -w $(1)/lib/firmware/ $(PKG_BUILD_DIR)/$(PKG_BRCMSMAC_FW_OBJECT)
+-else
+-	$(INSTALL_DATA) \
+-		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx-0.fw \
+-		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx_hdr-0.fw \
+-		$(1)/lib/firmware/brcm/
+ endif
+ endef
+ 
+-define KernelPackage/brcmfmac/install
+-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+-ifneq ($(CONFIG_BRCMFMAC_USB),)
+-	$(INSTALL_DATA) \
+-		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/brcmfmac43236b.bin \
+-		$(1)/lib/firmware/brcm/
+-	$(INSTALL_DATA) \
+-		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/brcmfmac43143.bin \
+-		$(1)/lib/firmware/brcm/
+-endif
+-ifneq ($(CONFIG_BRCMFMAC_PCIE),)
+-	$(INSTALL_DATA) \
+-		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/brcmfmac43602-pcie.ap.bin \
+-		$(1)/lib/firmware/brcm/brcmfmac43602-pcie.bin
+-endif
 +define KernelPackage/cfg80211/install
 +	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
 +	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
@@ -2910,177 +4030,21 @@ index a1eedce..566e156 100644
 +	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
 +endef
 +
-+define KernelPackage/iwlwifi/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+ifneq ($(CONFIG_IWL100_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-100-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL1000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-1000-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL105_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-105-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL135_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-135-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL2000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-2000-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL2030_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-2030-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL3160_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-3160-13.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL5000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-5000-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL5150_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-5150-2.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6000-4.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6005_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6000g2a-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6030_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6000g2b-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6050_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6050-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL7260_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-7260-13.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL7265_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-7265-13.ucode $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-7265D-13.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL8000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-8000C-13.ucode $(1)/lib/firmware
-+endif
-+endef
-+
-+define KernelPackage/iwl3945/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-3945-2.ucode $(1)/lib/firmware
-+endef
-+
-+define KernelPackage/iwl4965/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-4965-2.ucode $(1)/lib/firmware
-+endef
-+
-+define KernelPackage/libertas-usb/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/libertas
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/usb8388_v9.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/usb8682.bin \
-+		$(1)/lib/firmware/libertas/
-+endef
-+
-+define KernelPackage/libertas-sdio/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/libertas
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8385_helper.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8385.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8686_v9_helper.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8686_v9.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8688_helper.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8688.bin \
-+		$(1)/lib/firmware/libertas
-+endef
-+
-+define KernelPackage/mt7601u/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_MT7601U_FW_NAME)_$(PKG_MT7601U_FW_VERSION)/mcu/bin/MT7601.bin \
-+		$(1)/lib/firmware/mt7601u.bin
-+endef
-+
-+define KernelPackage/mwl8k/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/mwl8k
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/fmimage_8366_ap-3.fw \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/fmimage_8366.fw \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/helper_8366.fw \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/fmimage_8687.fw \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/helper_8687.fw \
-+		$(1)/lib/firmware/mwl8k/
-+endef
-+
-+define KernelPackage/mwifiex-pcie/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/mrvl
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mrvl/pcie8897_uapsta.bin \
-+		$(1)/lib/firmware/mrvl/
-+endef
-+
 +define KernelPackage/p54-pci/install
 +	$(INSTALL_DIR) $(1)/lib/firmware
 +	$(INSTALL_DATA) $(DL_DIR)/$(P54PCIFW) $(1)/lib/firmware/isl3886pci
 +endef
 +
-+define KernelPackage/p54-usb/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(DL_DIR)/$(P54USBFW) $(1)/lib/firmware/isl3887usb
-+endef
-+
-+define KernelPackage/p54-spi/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(DL_DIR)/$(P54SPIFW) $(1)/lib/firmware/3826.arm
-+endef
-+
-+define KernelPackage/rt2800-pci/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2860.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt3290.bin \
-+		$(1)/lib/firmware
-+endef
-+
-+define KernelPackage/rt2800-usb/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2870.bin $(1)/lib/firmware/
-+endef
-+
-+define KernelPackage/rt61-pci/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2561.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2561s.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2661.bin \
-+		$(1)/lib/firmware/
-+endef
-+
-+define KernelPackage/rt73-usb/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt73.bin $(1)/lib/firmware/
-+endef
-+
-+define KernelPackage/wl12xx/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl127x-fw-5-mr.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl127x-fw-5-plt.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl127x-fw-5-sr.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl1271-nvs.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-fw-5-mr.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-fw-5-plt.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-fw-5-sr.bin \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-nvs.bin \
-+		$(1)/lib/firmware/ti-connectivity
-+endef
-+
-+define KernelPackage/wl18xx/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl18xx-fw-4.bin \
-+		$(1)/lib/firmware/ti-connectivity
++define KernelPackage/p54-usb/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(DL_DIR)/$(P54USBFW) $(1)/lib/firmware/isl3887usb
 +endef
 +
++define KernelPackage/p54-spi/install
++	$(INSTALL_DIR) $(1)/lib/firmware
++	$(INSTALL_DATA) $(DL_DIR)/$(P54SPIFW) $(1)/lib/firmware/3826.arm
+ endef
+ 
 +define KernelPackage/zd1211rw/install
 +	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
 +	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
@@ -3124,7 +4088,7 @@ index a1eedce..566e156 100644
  $(eval $(call KernelPackage,p54-common))
  $(eval $(call KernelPackage,p54-pci))
  $(eval $(call KernelPackage,p54-usb))
-@@ -2047,12 +2162,12 @@ $(eval $(call KernelPackage,rt2800-lib))
+@@ -2047,12 +1793,12 @@ $(eval $(call KernelPackage,rt2800-lib))
  $(eval $(call KernelPackage,rt2400-pci))
  $(eval $(call KernelPackage,rt2500-pci))
  $(eval $(call KernelPackage,rt2500-usb))
@@ -3139,7 +4103,7 @@ index a1eedce..566e156 100644
  $(eval $(call KernelPackage,rtl8180))
  $(eval $(call KernelPackage,rtl8187))
  $(eval $(call KernelPackage,rtlwifi))
-@@ -2063,32 +2178,7 @@ $(eval $(call KernelPackage,rtl8192ce))
+@@ -2063,32 +1809,8 @@ $(eval $(call KernelPackage,rtl8192ce))
  $(eval $(call KernelPackage,rtl8192se))
  $(eval $(call KernelPackage,rtl8192de))
  $(eval $(call KernelPackage,rtl8192cu))
@@ -3169,15 +4133,70 @@ index a1eedce..566e156 100644
 -$(eval $(call KernelPackage,net-hermes-pci))
 -$(eval $(call KernelPackage,net-hermes-plx))
 -$(eval $(call KernelPackage,net-hermes-pcmcia))
++$(eval $(call KernelPackage,rtl8xxxu))
  $(eval $(call KernelPackage,wlcore))
  $(eval $(call KernelPackage,wl12xx))
  $(eval $(call KernelPackage,wl18xx))
 +$(eval $(call KernelPackage,zd1211rw))
 diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-index 2852f3e..2a8d2f9 100644
+index 2852f3e..02c195e 100644
 --- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
 +++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-@@ -486,7 +486,7 @@ mac80211_prepare_vif() {
+@@ -23,6 +23,7 @@ drv_mac80211_init_device_config() {
+ 	config_add_int rxantenna txantenna antenna_gain txpower distance
+ 	config_add_boolean noscan ht_coex
+ 	config_add_array ht_capab
++	config_add_array channels
+ 	config_add_boolean \
+ 		rxldpc \
+ 		short_gi_80 \
+@@ -89,6 +90,7 @@ mac80211_hostapd_setup_base() {
+ 	json_select config
+ 
+ 	[ "$auto_channel" -gt 0 ] && channel=acs_survey
++	[ "$auto_channel" -gt 0 ] && json_get_values channel_list channels
+ 
+ 	json_get_vars noscan ht_coex
+ 	json_get_values ht_capab_list ht_capab
+@@ -301,6 +303,7 @@ mac80211_hostapd_setup_base() {
+ 	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
+ 	cat >> "$hostapd_conf_file" <<EOF
+ ${channel:+channel=$channel}
++${channel_list:+chanlist=$channel_list}
+ ${noscan:+noscan=$noscan}
+ $base_cfg
+ 
+@@ -391,11 +394,10 @@ mac80211_generate_mac() {
+ find_phy() {
+ 	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
+ 	[ -n "$path" ] && {
+-		for phy in /sys/devices/$path/ieee80211/phy*; do
+-			[ -e "$phy" ] && {
+-				phy="${phy##*/}"
+-				return 0
+-			}
++		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
++			case "$(readlink -f /sys/class/ieee80211/$phy/device)" in
++				*$path) return 0;;
++			esac
+ 		done
+ 	}
+ 	[ -n "$macaddr" ] && {
+@@ -455,12 +457,7 @@ mac80211_prepare_vif() {
+ 			}
+ 		;;
+ 		mesh)
+-			json_get_vars key mesh_id
+-			if [ -n "$key" ]; then
+-				iw phy "$phy" interface add "$ifname" type mp
+-			else
+-				iw phy "$phy" interface add "$ifname" type mp mesh_id "$mesh_id"
+-			fi
++			iw phy "$phy" interface add "$ifname" type mp
+ 		;;
+ 		monitor)
+ 			iw phy "$phy" interface add "$ifname" type monitor
+@@ -486,7 +483,7 @@ mac80211_prepare_vif() {
  		# All interfaces must have unique mac addresses
  		# which can either be explicitly set in the device
  		# section, or automatically generated
@@ -3186,17 +4205,26 @@ index 2852f3e..2a8d2f9 100644
  	fi
  
  	json_select ..
-@@ -525,9 +525,6 @@ mac80211_setup_adhoc_htmode() {
+@@ -501,7 +498,7 @@ mac80211_setup_supplicant() {
+ mac80211_setup_adhoc_htmode() {
+ 	case "$htmode" in
+ 		VHT20|HT20) ibss_htmode=HT20;;
+-		HT40*|VHT40|VHT80|VHT160)
++		HT40*|VHT40|VHT160)
+ 			case "$hwmode" in
+ 				a)
+ 					case "$(( ($channel / 4) % 2 ))" in
+@@ -525,6 +522,9 @@ mac80211_setup_adhoc_htmode() {
  			esac
  			[ "$auto_channel" -gt 0 ] && ibss_htmode="HT40+"
  		;;
--		NONE|NOHT)
--			ibss_htmode="NOHT"
--		;;
- 		*) ibss_htmode="" ;;
- 	esac
- 
-@@ -585,7 +582,7 @@ mac80211_setup_vif() {
++		VHT80)
++			ibss_htmode="80MHZ"
++		;;
+ 		NONE|NOHT)
+ 			ibss_htmode="NOHT"
+ 		;;
+@@ -585,7 +585,7 @@ mac80211_setup_vif() {
  	json_get_vars mode
  	json_get_var vif_txpower txpower
  
@@ -3205,7 +4233,21 @@ index 2852f3e..2a8d2f9 100644
  		wireless_setup_vif_failed IFUP_ERROR
  		json_select ..
  		return
-@@ -641,7 +638,7 @@ mac80211_interface_cleanup() {
+@@ -606,6 +606,13 @@ mac80211_setup_vif() {
+ 					wireless_vif_parse_encryption
+ 					mac80211_setup_supplicant || failed=1
+ 				fi
++			else
++				json_get_vars mesh_id mcast_rate
++
++				mcval=
++				[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
++
++				iw dev "$ifname" mesh join "$mesh_id" ${mcval:+mcast-rate $mcval}
+ 			fi
+ 
+ 			for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
+@@ -641,7 +648,7 @@ mac80211_interface_cleanup() {
  	local phy="$1"
  
  	for wdev in $(list_phy_interfaces "$phy"); do
@@ -3214,515 +4256,36 @@ index 2852f3e..2a8d2f9 100644
  		iw dev "$wdev" del
  	done
  }
-diff --git a/package/kernel/mac80211/files/regdb.txt b/package/kernel/mac80211/files/regdb.txt
-index 463ace3..84413fd 100644
---- a/package/kernel/mac80211/files/regdb.txt
-+++ b/package/kernel/mac80211/files/regdb.txt
-@@ -2,7 +2,7 @@
- country 00:
- 	(2402 - 2472 @ 40), (20)
- 	# Channel 12 - 13.
--	(2457 - 2482 @ 20), (20), NO-IR, AUTO-BW
-+	(2457 - 2482 @ 40), (20), NO-IR
- 	# Channel 14. Only JP enables this and for 802.11b only
- 	(2474 - 2494 @ 20), (20), NO-IR, NO-OFDM
- 	# Channel 36 - 48
-@@ -22,7 +22,7 @@ country AD:
- 	(5170 - 5250 @ 80), (20)
- 	(5250 - 5330 @ 80), (20), DFS
- 	(5490 - 5710 @ 80), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country AE: DFS-FCC
-@@ -82,7 +82,7 @@ country AT: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country AU: DFS-ETSI
-@@ -108,7 +108,7 @@ country BA: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country BB: DFS-FCC
-@@ -126,7 +126,7 @@ country BE: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country BF: DFS-FCC
-@@ -141,13 +141,13 @@ country BG: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 5 GHz Short Range Devices, ref:
-+	# 5 gHz Short Range Devices, ref:
- 	# Etsi EN 300 440-1
- 	# Etsi EN 300 440-2
- 	# http://crc.bg/files/_bg/Spisak_2015.pdf
- 	# http://crc.bg/files/_bg/Pravila_2015_resh24.pdf
- 	(5725 - 5875 @ 80), (14)
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country BH: DFS-JP
-@@ -216,8 +216,7 @@ country CA: DFS-FCC
- 	(2402 - 2472 @ 40), (30)
- 	(5170 - 5250 @ 80), (17), AUTO-BW
- 	(5250 - 5330 @ 80), (24), DFS, AUTO-BW
--	(5490 - 5600 @ 80), (24), DFS
--	(5650 - 5730 @ 80), (24), DFS
-+	(5490 - 5730 @ 160), (24), DFS
- 	(5735 - 5835 @ 80), (30)
- 
- # Source:
-@@ -234,7 +233,7 @@ country CH: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country CI: DFS-FCC
-@@ -255,7 +254,7 @@ country CN: DFS-FCC
- 	(5170 - 5250 @ 80), (23), AUTO-BW
- 	(5250 - 5330 @ 80), (23), DFS, AUTO-BW
- 	(5735 - 5835 @ 80), (30)
--	# 60 GHz band channels 1,4: 28dBm, channels 2,3: 44dBm
-+	# 60 gHz band channels 1,4: 28dBm, channels 2,3: 44dBm
- 	# ref: http://www.miit.gov.cn/n11293472/n11505629/n11506593/n11960250/n11960606/n11960700/n12330791.files/n12330790.pdf
- 	(57240 - 59400 @ 2160), (28)
- 	(59400 - 63720 @ 2160), (44)
-@@ -287,7 +286,7 @@ country CY: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- # Data from http://www.ctu.eu/164/download/VOR/VOR-12-08-2005-34.pdf
-@@ -299,7 +298,7 @@ country CZ: DFS-ETSI
- 	(5150 - 5250 @ 80), (200 mW), NO-OUTDOOR, AUTO-BW
- 	(5250 - 5350 @ 80), (100 mW), NO-OUTDOOR, DFS, AUTO-BW
- 	(5470 - 5725 @ 160), (500 mW), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- # Data from "Frequenznutzungsplan" (as published in April 2008), downloaded from
-@@ -323,7 +322,7 @@ country DE: DFS-ETSI
- 	(5250 - 5350 @ 80), (100 mW), NO-OUTDOOR, DFS, AUTO-BW
- 	# entries 308002, 309001 and 310003
- 	(5470 - 5725 @ 160), (500 mW), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country DK: DFS-ETSI
-@@ -331,7 +330,7 @@ country DK: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- # Source:
-@@ -366,7 +365,7 @@ country EE: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country EG: DFS-ETSI
-@@ -386,7 +385,7 @@ country ES: DFS-ETSI
- 	(5150 - 5250 @ 80), (200 mW), NO-OUTDOOR, AUTO-BW
- 	(5250 - 5350 @ 80), (100 mW), NO-OUTDOOR, DFS, AUTO-BW
- 	(5470 - 5725 @ 160), (500 mW), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country ET: DFS-ETSI
-@@ -396,11 +395,11 @@ country ET: DFS-ETSI
- 	(5490 - 5710 @ 160), (27), DFS
- 
- country FI: DFS-ETSI
--	(2400 - 2483.5 @ 40), (20)
--	(5150 - 5250 @ 80), (23), NO-OUTDOOR, AUTO-BW
--	(5250 - 5350 @ 80), (20), NO-OUTDOOR, DFS, AUTO-BW
--	(5470 - 5725 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	(2402 - 2482 @ 40), (20)
-+	(5170 - 5250 @ 80), (20), AUTO-BW
-+	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
-+	(5490 - 5710 @ 160), (27), DFS
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country FM: DFS-FCC
-@@ -415,7 +414,7 @@ country FR: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country GB: DFS-ETSI
-@@ -423,7 +422,7 @@ country GB: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country GD: DFS-FCC
-@@ -437,7 +436,7 @@ country GE: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
- 	(5170 - 5250 @ 80), (18), AUTO-BW
- 	(5250 - 5330 @ 80), (18), DFS, AUTO-BW
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country GF: DFS-ETSI
-@@ -455,9 +454,9 @@ country GH: DFS-FCC
- 
- country GL: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
--	(5170 - 5250 @ 80), (20), AUTO-BW
--	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
--	(5490 - 5710 @ 160), (27), DFS
-+	(5170 - 5250 @ 80), (20)
-+	(5250 - 5330 @ 80), (20), DFS
-+	(5490 - 5710 @ 80), (27), DFS
- 
- country GP: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
-@@ -470,7 +469,7 @@ country GR: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country GT: DFS-FCC
-@@ -490,7 +489,7 @@ country GY:
- 	(2402 - 2482 @ 40), (30)
- 	(5735 - 5835 @ 80), (30)
- 
--country HK: DFS-ETSI
-+country HK:
- 	(2402 - 2482 @ 40), (20)
- 	(5170 - 5250 @ 80), (17), AUTO-BW
- 	(5250 - 5330 @ 80), (24), DFS, AUTO-BW
-@@ -505,11 +504,11 @@ country HN: DFS-FCC
- 	(5735 - 5835 @ 80), (30)
- 
- country HR: DFS-ETSI
--	(2400 - 2483.5 @ 40), (20)
--	(5150 - 5250 @ 80), (23), NO-OUTDOOR, AUTO-BW
--	(5250 - 5350 @ 80), (20), NO-OUTDOOR, DFS, AUTO-BW
--	(5470 - 5725 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	(2402 - 2482 @ 40), (20)
-+	(5170 - 5250 @ 80), (20), AUTO-BW
-+	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
-+	(5490 - 5710 @ 160), (27), DFS
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country HT: DFS-FCC
-@@ -524,7 +523,7 @@ country HU: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country ID: DFS-JP
-@@ -537,7 +536,7 @@ country IE: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country IL: DFS-ETSI
-@@ -560,7 +559,7 @@ country IS: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country IT: DFS-ETSI
-@@ -568,7 +567,7 @@ country IT: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country JM: DFS-FCC
-@@ -687,7 +686,7 @@ country LT: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country LU: DFS-ETSI
-@@ -695,7 +694,7 @@ country LU: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country LV: DFS-ETSI
-@@ -703,7 +702,7 @@ country LV: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country MA: DFS-ETSI
-@@ -751,7 +750,7 @@ country MK: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country MN: DFS-FCC
-@@ -794,7 +793,7 @@ country MT: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country MU: DFS-FCC
-@@ -827,10 +826,9 @@ country MX: DFS-FCC
- 
- country MY: DFS-FCC
- 	(2402 - 2482 @ 40), (20)
--	(5170 - 5250 @ 80), (24), AUTO-BW
--	(5250 - 5330 @ 80), (24), DFS, AUTO-BW
--	(5490 - 5650 @ 160), (24), DFS
--	(5735 - 5835 @ 80), (24)
-+	(5170 - 5250 @ 80), (17), AUTO-BW
-+	(5250 - 5330 @ 80), (23), DFS, AUTO-BW
-+	(5735 - 5835 @ 80), (30)
- 
- country NG: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
-@@ -849,7 +847,7 @@ country NL: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), NO-OUTDOOR, AUTO-BW
- 	(5250 - 5330 @ 80), (20), NO-OUTDOOR, DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- # Data from http://www.lovdata.no/dokument/SF/forskrift/2012-01-19-77
-@@ -864,7 +862,7 @@ country NO: DFS-ETSI
- 	(5470 - 5795 @ 160), (500 mW), DFS
- 	(5815 - 5850 @ 35), (2000 mW), DFS
- 	(17100 - 17300 @ 200), (100 mW)
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country NP: DFS-JP
-@@ -928,7 +926,7 @@ country PL: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country PM: DFS-ETSI
-@@ -949,7 +947,7 @@ country PT: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country PW: DFS-FCC
-@@ -981,7 +979,7 @@ country RO: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- 
-@@ -991,15 +989,15 @@ country RS: DFS-ETSI
- 	(2400 - 2483.5 @ 40), (100 mW)
- 	(5150 - 5350 @ 40), (200 mW), NO-OUTDOOR
- 	(5470 - 5725 @ 20), (1000 mW), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country RU: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
--	(5170 - 5250 @ 80), (20), AUTO-BW
--	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
--	(5650 - 5730 @ 80), (30), DFS
--	(5735 - 5835 @ 80), (30)
-+	(5170 - 5250 @ 40), (20)
-+	(5250 - 5330 @ 40), (20), DFS
-+	(5650 - 5730 @ 40), (30), DFS
-+	(5735 - 5835 @ 40), (30)
- 	# 60 GHz band channels 1-4, ref: Changes to NLA 124_Order â„–129_22042015.pdf
- 	(57000 - 66000 @ 2160), (40)
- 
-@@ -1021,7 +1019,7 @@ country SE: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country SG: DFS-FCC
-@@ -1036,7 +1034,7 @@ country SI: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country SK: DFS-ETSI
-@@ -1044,7 +1042,7 @@ country SK: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- # Source:
-@@ -1109,7 +1107,7 @@ country TR: DFS-ETSI
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
- 	(5490 - 5710 @ 160), (27), DFS
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country TT: DFS-FCC
-@@ -1119,20 +1117,12 @@ country TT: DFS-FCC
- 	(5490 - 5730 @ 160), (24), DFS
- 	(5735 - 5835 @ 80), (30)
- 
--# Source:
--# Table of Frequency Allocations of Republic of China (Taiwan) / Nov 2014:
--#   http://www.motc.gov.tw/websitedowndoc?file=post/201411171137330.doc& \
--#      filedisplay=Table+of+radio+frequency+allocation.doc
--# LP0002 Low-power Radio-frequency Devices Technical Regulations / 28 Jun 2011:
--#   http://www.ncc.gov.tw/english/show_file.aspx?table_name=news&file_sn=681
--#   (section 3.10.1, 4.7)
--country TW: DFS-FCC
--	(2400 - 2483.5 @ 40), (30)
--	# Follow US 5.15 ~ 5.25 GHz: 30 dBm for master mode, 23 dBm for clients
--	(5150 - 5250 @ 80), (23), AUTO-BW
--	(5250 - 5350 @ 80), (23), DFS, AUTO-BW
--	(5470 - 5725 @ 160), (23), DFS
--	(5725 - 5850 @ 80), (30)
-+country TW: DFS-JP
-+	(2402 - 2472 @ 40), (30)
-+	(5270 - 5330 @ 40), (17), DFS
-+	(5490 - 5590 @ 80), (30), DFS
-+	(5650 - 5710 @ 40), (30), DFS
-+	(5735 - 5835 @ 80), (30)
-  
- country TZ:
- 	(2402 - 2482 @ 40), (20)
-@@ -1147,11 +1137,10 @@ country TZ:
- # disputable definitions there.
- country UA: DFS-ETSI
- 	(2400 - 2483.5 @ 40), (20), NO-OUTDOOR
--	(5150 - 5250 @ 80), (20), NO-OUTDOOR, AUTO-BW
--	(5250 - 5350 @ 80), (20), DFS, NO-OUTDOOR, AUTO-BW
--	(5490 - 5670 @ 160), (20), DFS
-+	(5150 - 5350 @ 40), (20), NO-OUTDOOR
-+	(5490 - 5670 @ 80), (20), DFS
- 	(5735 - 5835 @ 80), (20)
--	# 60 GHz band channels 1-4, ref: Etsi En 302 567
-+	# 60 gHz band channels 1-4, ref: Etsi En 302 567
- 	(57000 - 66000 @ 2160), (40)
- 
- country UG: DFS-FCC
-@@ -1163,8 +1152,7 @@ country UG: DFS-FCC
- 
- country US: DFS-FCC
- 	(2402 - 2472 @ 40), (30)
--	# 5.15 ~ 5.25 GHz: 30 dBm for master mode, 23 dBm for clients
--	(5170 - 5250 @ 80), (23), AUTO-BW
-+	(5170 - 5250 @ 80), (17), AUTO-BW
- 	(5250 - 5330 @ 80), (23), DFS, AUTO-BW
- 	(5490 - 5730 @ 160), (23), DFS
- 	(5735 - 5835 @ 80), (30)
-@@ -1175,8 +1163,9 @@ country US: DFS-FCC
- 
- country UY: DFS-FCC
- 	(2402 - 2482 @ 40), (20)
--	(5170 - 5250 @ 80), (23), AUTO-BW
--	(5250 - 5330 @ 80), (23), DFS, AUTO-BW
-+	(5170 - 5250 @ 80), (17), AUTO-BW
-+	(5250 - 5330 @ 80), (24), DFS, AUTO-BW
-+	(5490 - 5730 @ 160), (24), DFS
- 	(5735 - 5835 @ 80), (30)
- 
- # Source:
-@@ -1252,7 +1241,7 @@ country ZA: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
- 	(5170 - 5250 @ 80), (20), AUTO-BW
- 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
--	(5490 - 5710 @ 160), (30)
-+	(5490 - 5710 @ 160), (27), DFS
- 
- country ZW: DFS-ETSI
- 	(2402 - 2482 @ 40), (20)
+diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+index ea229d6..06f3b8b 100644
+--- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
++++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+@@ -9,11 +9,10 @@ lookup_phy() {
+ 	local devpath
+ 	config_get devpath "$device" path
+ 	[ -n "$devpath" ] && {
+-		for _phy in /sys/devices/$devpath/ieee80211/phy*; do
+-			[ -e "$_phy" ] && {
+-				phy="${_phy##*/}"
+-				return
+-			}
++		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
++			case "$(readlink -f /sys/class/ieee80211/$phy/device)" in
++				*$devpath) return;;
++			esac
+ 		done
+ 	}
+ 
+@@ -102,6 +101,9 @@ detect_mac80211() {
+ 		fi
+ 		if [ -n "$path" ]; then
+ 			path="${path##/sys/devices/}"
++			case "$path" in
++				platform*/pci*) path="${path##platform/}";;
++			esac
+ 			dev_id="	option path	'$path'"
+ 		else
+ 			dev_id="	option macaddr	$(cat /sys/class/ieee80211/${dev}/macaddress)"
 diff --git a/package/kernel/mac80211/patches/001-fix_build.patch b/package/kernel/mac80211/patches/001-fix_build.patch
 index 818983e..402649d 100644
 --- a/package/kernel/mac80211/patches/001-fix_build.patch
@@ -3766,6 +4329,69 @@ index 818983e..402649d 100644
  +	print=0									;\
  +	for v in $$kvers ; do							\
  +		if [ "$$print" = "1" ] ; then					\
+diff --git a/package/kernel/mac80211/patches/002-change_allconfig.patch b/package/kernel/mac80211/patches/002-change_allconfig.patch
+index 91ad20f..bd5bebf 100644
+--- a/package/kernel/mac80211/patches/002-change_allconfig.patch
++++ b/package/kernel/mac80211/patches/002-change_allconfig.patch
+@@ -1,6 +1,6 @@
+ --- a/kconf/conf.c
+ +++ b/kconf/conf.c
+-@@ -578,40 +578,12 @@ int main(int ac, char **av)
++@@ -593,40 +593,12 @@ int main(int ac, char **av)
+  	case oldconfig:
+  	case listnewconfig:
+  	case olddefconfig:
+@@ -42,3 +42,23 @@
+  		break;
+  	default:
+  		break;
++--- a/kconf/confdata.c
+++++ b/kconf/confdata.c
++@@ -1169,6 +1169,8 @@ bool conf_set_all_new_symbols(enum conf_
++ 	}
++ 	bool has_changed = false;
++ 
+++	sym_clear_all_valid();
+++
++ 	for_all_symbols(i, sym) {
++ 		if (sym_has_value(sym) || (sym->flags & SYMBOL_VALID))
++ 			continue;
++@@ -1212,8 +1214,6 @@ bool conf_set_all_new_symbols(enum conf_
++ 
++ 	}
++ 
++-	sym_clear_all_valid();
++-
++ 	/*
++ 	 * We have different type of choice blocks.
++ 	 * If curr.tri equals to mod then we can select several
+diff --git a/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch b/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch
+new file mode 100644
+index 0000000..9adfd8f
+--- /dev/null
++++ b/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch
+@@ -0,0 +1,21 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Thu, 28 Jan 2016 15:16:35 +0100
++Subject: [PATCH] backports: add skb_free_frag()
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/backport-include/linux/skbuff.h
+++++ b/backport-include/linux/skbuff.h
++@@ -300,4 +300,11 @@ int skb_ensure_writable(struct sk_buff *
++ 
++ #endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0) */
++ 
+++#if LINUX_VERSION_CODE < KERNEL_VERSION(4,2,0)
+++static inline void skb_free_frag(void *data)
+++{
+++	put_page(virt_to_head_page(data));
+++}
+++#endif
+++
++ #endif /* __BACKPORT_SKBUFF_H */
 diff --git a/package/kernel/mac80211/patches/004-backports_debugfs_fix.patch b/package/kernel/mac80211/patches/004-backports_debugfs_fix.patch
 deleted file mode 100644
 index d48a723..0000000
@@ -3782,6 +4408,32 @@ index d48a723..0000000
 - 
 - #if defined(CONFIG_DEBUG_FS)
 - struct dentry *debugfs_create_devm_seqfile(struct device *dev, const char *name,
+diff --git a/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch b/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch
+new file mode 100644
+index 0000000..9b672a8
+--- /dev/null
++++ b/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch
+@@ -0,0 +1,20 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Thu, 28 Jan 2016 15:19:22 +0100
++Subject: [PATCH] backports: add napi_alloc_frag
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/backport-include/linux/netdevice.h
+++++ b/backport-include/linux/netdevice.h
++@@ -232,6 +232,10 @@ static inline void backport_unregister_n
++ #define unregister_netdevice_many LINUX_BACKPORT(unregister_netdevice_many)
++ #endif
++ 
+++#if LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0)
+++#define napi_alloc_frag netdev_alloc_frag
+++#endif
+++
++ /*
++  * Complicated way of saying: We only backport netdev_rss_key stuff on kernels
++  * that either already have net_get_random_once() (>= 3.13) or where we've been
 diff --git a/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch b/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch
 deleted file mode 100644
 index e07f323..0000000
@@ -3847,45 +4499,37 @@ index e5310bc..0000000
 -+#define MPLS_LS_TTL_SHIFT       0
 -+
 -+#endif /* _UAPI_MPLS_H */
-diff --git a/package/kernel/mac80211/patches/020-backports-do-not-add-debugfs_create_devm_seqfile-on-.patch b/package/kernel/mac80211/patches/020-backports-do-not-add-debugfs_create_devm_seqfile-on-.patch
-new file mode 100644
-index 0000000..97f678c
---- /dev/null
-+++ b/package/kernel/mac80211/patches/020-backports-do-not-add-debugfs_create_devm_seqfile-on-.patch
-@@ -0,0 +1,33 @@
-+From e15e9231e7a9f81f5264d294fd3fd96a20d92516 Mon Sep 17 00:00:00 2001
-+From: Hauke Mehrtens <hauke@hauke-m.de>
-+Date: Sat, 25 Jul 2015 15:19:17 +0200
-+Subject: [PATCH 3/3] backports: do not add debugfs_create_devm_seqfile() on
-+ recent kernel versions
-+
-+An #ifdef for the kernel version was missing around the header of
-+debugfs_create_devm_seqfile() and the LINUX_BACKPORT() was also not
-+done.
-+
-+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
-+---
-+ backport/backport-include/linux/debugfs.h | 3 +++
-+ 1 file changed, 3 insertions(+)
-+
-+--- a/backport-include/linux/debugfs.h
-++++ b/backport-include/linux/debugfs.h
-+@@ -5,6 +5,8 @@
-+ #include <linux/device.h>
-+ #include <generated/utsrelease.h>
-+ 
-++#if LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0)
-++#define debugfs_create_devm_seqfile LINUX_BACKPORT(debugfs_create_devm_seqfile)
-+ #if defined(CONFIG_DEBUG_FS)
-+ struct dentry *debugfs_create_devm_seqfile(struct device *dev, const char *name,
-+ 					   struct dentry *parent,
-+@@ -20,5 +22,6 @@ static inline struct dentry *debugfs_cre
-+ 	return ERR_PTR(-ENODEV);
-+ }
-+ #endif /* CONFIG_DEBUG_FS */
-++#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0) */
-+ 
-+ #endif /* __BACKPORT_DEBUGFS_H_ */
+diff --git a/package/kernel/mac80211/patches/030-rt2x00_options.patch b/package/kernel/mac80211/patches/030-rt2x00_options.patch
+index 35b5b5d..a4ca884 100644
+--- a/package/kernel/mac80211/patches/030-rt2x00_options.patch
++++ b/package/kernel/mac80211/patches/030-rt2x00_options.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/Kconfig
+-+++ b/drivers/net/wireless/rt2x00/Kconfig
++--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
+++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
+ @@ -225,36 +225,37 @@ config RT2800SOC
+  
+  
+@@ -43,5 +43,5 @@
+ -	tristate
+ +	tristate "RT2x00 support"
+  	depends on m
+- 	select BPAUTO_AVERAGE
+  
++ config RT2X00_LIB_FIRMWARE
+diff --git a/package/kernel/mac80211/patches/040-brcmutil_option.patch b/package/kernel/mac80211/patches/040-brcmutil_option.patch
+index 8a6cae6..167332d 100644
+--- a/package/kernel/mac80211/patches/040-brcmutil_option.patch
++++ b/package/kernel/mac80211/patches/040-brcmutil_option.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/brcm80211/Kconfig
+-+++ b/drivers/net/wireless/brcm80211/Kconfig
++--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
+++++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
+ @@ -1,5 +1,5 @@
+  config BRCMUTIL
+ -	tristate
 diff --git a/package/kernel/mac80211/patches/045-bcma-from-4.1.patch b/package/kernel/mac80211/patches/045-bcma-from-4.1.patch
 deleted file mode 100644
 index dce217f..0000000
@@ -3996,19 +4640,52 @@ index dce217f..0000000
 - 			      true);
 - 
 - 	/*
+diff --git a/package/kernel/mac80211/patches/050-lib80211_option.patch b/package/kernel/mac80211/patches/050-lib80211_option.patch
+index 5fe5558..3fc8c05 100644
+--- a/package/kernel/mac80211/patches/050-lib80211_option.patch
++++ b/package/kernel/mac80211/patches/050-lib80211_option.patch
+@@ -1,6 +1,6 @@
+ --- a/net/wireless/Kconfig
+ +++ b/net/wireless/Kconfig
+-@@ -174,7 +174,7 @@ config CFG80211_WEXT_EXPORT
++@@ -171,7 +171,7 @@ config CFG80211_WEXT_EXPORT
+  	  wext compatibility symbols to be exported.
+  
+  config LIB80211
+@@ -9,7 +9,7 @@
+  	depends on m
+  	default n
+  	help
+-@@ -184,15 +184,15 @@ config LIB80211
++@@ -181,15 +181,15 @@ config LIB80211
+  	  Drivers should select this themselves if needed.
+  
+  config LIB80211_CRYPT_WEP
 diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
-index d307949..4fbab23 100644
+index d307949..fd1e1cf 100644
 --- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
 +++ b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
-@@ -1,6 +1,6 @@
+@@ -1,9 +1,9 @@
  --- a/.local-symbols
  +++ b/.local-symbols
 -@@ -344,40 +344,3 @@ USB_CDC_PHONET=
-+@@ -449,43 +449,6 @@ USB_CDC_PHONET=
-  USB_IPHETH=
+- USB_IPHETH=
++@@ -476,44 +476,6 @@ USB_IPHETH=
   USB_SIERRA_NET=
   USB_VL600=
-@@ -32,26 +32,18 @@
++ USB_NET_CH9200=
+ -SSB_POSSIBLE=
+ -SSB=
+ -SSB_SPROM=
+@@ -15,6 +15,7 @@
+ -SSB_PCMCIAHOST=
+ -SSB_SDIOHOST_POSSIBLE=
+ -SSB_SDIOHOST=
++-SSB_HOST_SOC=
+ -SSB_SILENT=
+ -SSB_DEBUG=
+ -SSB_SERIAL=
+@@ -32,28 +33,20 @@
  -BCMA_BLOCKIO=
  -BCMA_HOST_PCI_POSSIBLE=
  -BCMA_HOST_PCI=
@@ -4033,13 +4710,17 @@ index d307949..4fbab23 100644
 - #obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
 - obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
 - #obj-$(CPTCFG_NFC) += net/nfc/
+---- a/drivers/net/wireless/b43/main.c
+-+++ b/drivers/net/wireless/b43/main.c
 + NFC=
 + NFC_DIGITAL=
 + NFC_NCI=
- --- a/drivers/net/wireless/b43/main.c
- +++ b/drivers/net/wireless/b43/main.c
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
  @@ -2866,7 +2866,7 @@ static struct ssb_device *b43_ssb_gpio_d
-@@ -63,7 +55,7 @@
+  {
+  	struct ssb_bus *bus = dev->dev->sdev->bus;
+@@ -63,7 +56,7 @@
   	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
   #else
   	return bus->chipco.dev;
@@ -4048,7 +4729,40 @@ index d307949..4fbab23 100644
   	}
   	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
   		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
-@@ -116,12 +108,23 @@
+@@ -72,8 +65,8 @@
+  	if (dev->dev->bus_type == B43_BUS_SSB &&
+  	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
+  	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
+---- a/drivers/net/wireless/b43legacy/main.c
+-+++ b/drivers/net/wireless/b43legacy/main.c
++--- a/drivers/net/wireless/broadcom/b43legacy/main.c
+++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+ @@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
+  	if (dev->dev->id.revision >= 2)
+  		mask  |= 0x0010; /* FIXME: This is redundant. */
+@@ -92,8 +85,8 @@
+  	pcidev = bus->pcicore.dev;
+  #endif
+  	gpiodev = bus->chipco.dev ? : pcidev;
+---- a/drivers/net/wireless/brcm80211/brcmsmac/Makefile
+-+++ b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
+ @@ -43,6 +43,6 @@ brcmsmac-y := \
+  	brcms_trace_events.o \
+  	debug.o
+@@ -102,8 +95,8 @@
+ +brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
+  
+  obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
+---- a/drivers/net/wireless/brcm80211/brcmsmac/led.h
+-+++ b/drivers/net/wireless/brcm80211/brcmsmac/led.h
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
+ @@ -22,7 +22,7 @@ struct brcms_led {
+  	bool active_low;
+  };
+@@ -116,12 +109,23 @@
  --- a/Kconfig.sources
  +++ b/Kconfig.sources
  @@ -9,9 +9,6 @@ source "$BACKPORT_DIR/drivers/net/wirele
@@ -4075,6 +4789,27 @@ index d307949..4fbab23 100644
 + obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
 + obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
 + obj-$(CPTCFG_NFC) += net/nfc/
+diff --git a/package/kernel/mac80211/patches/070-ath_common_config.patch b/package/kernel/mac80211/patches/070-ath_common_config.patch
+index c6e9cd8..41774fe 100644
+--- a/package/kernel/mac80211/patches/070-ath_common_config.patch
++++ b/package/kernel/mac80211/patches/070-ath_common_config.patch
+@@ -1,10 +1,9 @@
+ --- a/drivers/net/wireless/ath/Kconfig
+ +++ b/drivers/net/wireless/ath/Kconfig
+-@@ -6,6 +6,7 @@ menuconfig ATH_CARDS
+- 	tristate "Atheros Wireless Cards"
++@@ -1,5 +1,5 @@
++ config ATH_COMMON
++-	tristate
+++	tristate "ath.ko"
+  	depends on m
+- 	depends on CFG80211 && (!UML || BROKEN)
+-+	select ATH_COMMON
+- 	---help---
+- 	  This will enable the support for the Atheros wireless drivers.
+- 	  ath5k, ath9k, ath9k_htc and ar9170 drivers share some common code, this option
++ 
++ config WLAN_VENDOR_ATH
 diff --git a/package/kernel/mac80211/patches/090-linux_3_18_12_compat.patch b/package/kernel/mac80211/patches/090-linux_3_18_12_compat.patch
 deleted file mode 100644
 index 85c5280..0000000
@@ -4112,7 +4847,7 @@ index 85c5280..0000000
 - u8 netdev_rss_key[NETDEV_RSS_KEY_LEN];
 diff --git a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
 new file mode 100644
-index 0000000..07dde54
+index 0000000..02f46c7
 --- /dev/null
 +++ b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
 @@ -0,0 +1,376 @@
@@ -4125,11 +4860,11 @@ index 0000000..07dde54
 +-	select BPAUTO_CRYPTO_CCM
 +-	depends on CRYPTO_GCM
 + 	depends on CRC32
-+ 	select BPAUTO_AVERAGE
 + 	---help---
++ 	  This option enables the hardware independent IEEE 802.11
 +--- a/net/mac80211/Makefile
 ++++ b/net/mac80211/Makefile
-+@@ -15,9 +15,7 @@ mac80211-y := \
++@@ -16,9 +16,7 @@ mac80211-y := \
 + 	michael.o \
 + 	tkip.o \
 + 	aes_ccm.o \
@@ -4438,7 +5173,7 @@ index 0000000..07dde54
 + 		struct {
 +--- a/net/mac80211/wpa.c
 ++++ b/net/mac80211/wpa.c
-+@@ -304,7 +304,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
++@@ -307,7 +307,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
 + }
 + 
 + 
@@ -4448,7 +5183,7 @@ index 0000000..07dde54
 + {
 + 	__le16 mask_fc;
 + 	int a4_included, mgmt;
-+@@ -334,14 +335,8 @@ static void ccmp_special_blocks(struct s
++@@ -337,14 +338,8 @@ static void ccmp_special_blocks(struct s
 + 	else
 + 		qos_tid = 0;
 + 
@@ -4465,7 +5200,7 @@ index 0000000..07dde54
 + 
 + 	/* Nonce: Nonce Flags | A2 | PN
 + 	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-+@@ -349,6 +344,8 @@ static void ccmp_special_blocks(struct s
++@@ -352,6 +347,8 @@ static void ccmp_special_blocks(struct s
 + 	b_0[1] = qos_tid | (mgmt << 4);
 + 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
 + 	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
@@ -4474,7 +5209,7 @@ index 0000000..07dde54
 + 
 + 	/* AAD (extra authenticate-only data) / masked 802.11 header
 + 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-+@@ -460,7 +457,7 @@ static int ccmp_encrypt_skb(struct ieee8
++@@ -463,7 +460,7 @@ static int ccmp_encrypt_skb(struct ieee8
 + 		return 0;
 + 
 + 	pos += IEEE80211_CCMP_HDR_LEN;
@@ -4483,7 +5218,7 @@ index 0000000..07dde54
 + 	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
 + 				  skb_put(skb, mic_len), mic_len);
 + 
-+@@ -531,7 +528,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
++@@ -534,7 +531,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
 + 			u8 aad[2 * AES_BLOCK_SIZE];
 + 			u8 b_0[AES_BLOCK_SIZE];
 + 			/* hardware didn't decrypt/verify MIC */
@@ -6554,7 +7289,7 @@ index ceca952..0000000
 --
 - #endif /* WPA_H */
 diff --git a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
-index 41a3c4f..cff6d89 100644
+index 41a3c4f..d1d9fbd 100644
 --- a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
 +++ b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
 @@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
@@ -6562,50 +7297,80 @@ index 41a3c4f..cff6d89 100644
  --- a/net/mac80211/cfg.c
  +++ b/net/mac80211/cfg.c
 -@@ -856,7 +856,6 @@ static int ieee80211_stop_ap(struct wiph
-+@@ -886,7 +886,6 @@ static int ieee80211_stop_ap(struct wiph
++@@ -846,7 +846,6 @@ static int ieee80211_stop_ap(struct wiph
   	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
   
   	__sta_info_flush(sdata, true);
 diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
-index de79bd2..5fc9454 100644
+index de79bd2..2855a88 100644
 --- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
 +++ b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
-@@ -18,7 +18,7 @@
+@@ -1,6 +1,6 @@
+ --- a/net/mac80211/main.c
+ +++ b/net/mac80211/main.c
+-@@ -287,7 +287,7 @@ void ieee80211_restart_hw(struct ieee802
++@@ -291,7 +291,7 @@ void ieee80211_restart_hw(struct ieee802
+  }
+  EXPORT_SYMBOL(ieee80211_restart_hw);
+  
+@@ -9,7 +9,7 @@
+  static int ieee80211_ifa_changed(struct notifier_block *nb,
+  				 unsigned long data, void *arg)
+  {
+-@@ -346,7 +346,7 @@ static int ieee80211_ifa_changed(struct
++@@ -350,7 +350,7 @@ static int ieee80211_ifa_changed(struct
+  }
+  #endif
+  
+@@ -18,9 +18,9 @@
   static int ieee80211_ifa6_changed(struct notifier_block *nb,
   				  unsigned long data, void *arg)
   {
 -@@ -1057,14 +1057,14 @@ int ieee80211_register_hw(struct ieee802
-+@@ -1086,14 +1086,14 @@ int ieee80211_register_hw(struct ieee802
-  	if (result)
-  		goto fail_pm_qos;
+- 	if (result)
+- 		goto fail_pm_qos;
++@@ -1087,14 +1087,14 @@ int ieee80211_register_hw(struct ieee802
++ 
++ 	rtnl_unlock();
   
+ -#ifdef CONFIG_INET
+ +#ifdef __disabled__CONFIG_INET
 @@ -35,7 +35,7 @@
   	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
   	result = register_inet6addr_notifier(&local->ifa6_notifier);
   	if (result)
 -@@ -1073,13 +1073,13 @@ int ieee80211_register_hw(struct ieee802
-+@@ -1102,13 +1102,13 @@ int ieee80211_register_hw(struct ieee802
++@@ -1103,13 +1103,13 @@ int ieee80211_register_hw(struct ieee802
   
   	return 0;
   
-@@ -52,7 +52,7 @@
+@@ -50,12 +50,12 @@
+ -#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
+ +#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
    fail_ifa:
-  	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
-  			       &local->network_latency_notifier);
+- 	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
+- 			       &local->network_latency_notifier);
 -@@ -1124,10 +1124,10 @@ void ieee80211_unregister_hw(struct ieee
-+@@ -1141,10 +1141,10 @@ void ieee80211_unregister_hw(struct ieee
++ #endif
++ 	rtnl_lock();
++@@ -1137,10 +1137,10 @@ void ieee80211_unregister_hw(struct ieee
++ 	tasklet_kill(&local->tx_pending_tasklet);
++ 	tasklet_kill(&local->tasklet);
   
-  	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
-  			       &local->network_latency_notifier);
+- 	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
+- 			       &local->network_latency_notifier);
+ -#ifdef CONFIG_INET
+ +#ifdef __disabled__CONFIG_INET
+  	unregister_inetaddr_notifier(&local->ifa_notifier);
 diff --git a/package/kernel/mac80211/patches/210-ap_scan.patch b/package/kernel/mac80211/patches/210-ap_scan.patch
-index 47dcec3..29f05c4 100644
+index 47dcec3..a99cbd2 100644
 --- a/package/kernel/mac80211/patches/210-ap_scan.patch
 +++ b/package/kernel/mac80211/patches/210-ap_scan.patch
 @@ -1,6 +1,6 @@
  --- a/net/mac80211/cfg.c
  +++ b/net/mac80211/cfg.c
 -@@ -1963,7 +1963,7 @@ static int ieee80211_scan(struct wiphy *
-+@@ -2008,7 +2008,7 @@ static int ieee80211_scan(struct wiphy *
++@@ -1999,7 +1999,7 @@ static int ieee80211_scan(struct wiphy *
   		 * the  frames sent while scanning on other channel will be
   		 * lost)
   		 */
@@ -7536,7 +8301,7 @@ index 237121b..0000000
 - void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
 diff --git a/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch b/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch
 new file mode 100644
-index 0000000..4faac0d
+index 0000000..a160dc4
 --- /dev/null
 +++ b/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch
 @@ -0,0 +1,121 @@
@@ -7555,7 +8320,7 @@ index 0000000..4faac0d
 +
 +--- a/drivers/net/wireless/ath/ath9k/xmit.c
 ++++ b/drivers/net/wireless/ath/ath9k/xmit.c
-+@@ -147,10 +147,25 @@ static void ath_send_bar(struct ath_atx_
++@@ -136,10 +136,25 @@ static void ath_send_bar(struct ath_atx_
 + }
 + 
 + static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
@@ -7582,7 +8347,7 @@ index 0000000..4faac0d
 + }
 + 
 + static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
-+@@ -1430,7 +1445,7 @@ ath_tx_form_burst(struct ath_softc *sc,
++@@ -1419,7 +1434,7 @@ ath_tx_form_burst(struct ath_softc *sc,
 + 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
 + 			break;
 + 
@@ -7591,7 +8356,7 @@ index 0000000..4faac0d
 + 	} while (1);
 + }
 + 
-+@@ -1461,7 +1476,7 @@ static bool ath_tx_sched_aggr(struct ath
++@@ -1450,7 +1465,7 @@ static bool ath_tx_sched_aggr(struct ath
 + 		return false;
 + 	}
 + 
@@ -7600,7 +8365,7 @@ index 0000000..4faac0d
 + 	if (aggr)
 + 		last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
 + 					tid_q, &aggr_len);
-+@@ -1653,7 +1668,7 @@ void ath9k_release_buffered_frames(struc
++@@ -1647,7 +1662,7 @@ void ath9k_release_buffered_frames(struc
 + 
 + 			__skb_unlink(bf->bf_mpdu, tid_q);
 + 			list_add_tail(&bf->list, &bf_q);
@@ -7609,7 +8374,7 @@ index 0000000..4faac0d
 + 			if (bf_isampdu(bf)) {
 + 				ath_tx_addto_baw(sc, tid, bf);
 + 				bf->bf_state.bf_type &= ~BUF_AGGR;
-+@@ -2318,7 +2333,7 @@ int ath_tx_start(struct ieee80211_hw *hw
++@@ -2293,7 +2308,7 @@ int ath_tx_start(struct ieee80211_hw *hw
 + 	struct ath_txq *txq = txctl->txq;
 + 	struct ath_atx_tid *tid = NULL;
 + 	struct ath_buf *bf;
@@ -7618,7 +8383,7 @@ index 0000000..4faac0d
 + 	int q, ret;
 + 
 + 	if (vif)
-+@@ -2365,13 +2380,13 @@ int ath_tx_start(struct ieee80211_hw *hw
++@@ -2346,13 +2361,13 @@ int ath_tx_start(struct ieee80211_hw *hw
 + 		if (!txctl->an)
 + 			txctl->an = &avp->mcast_node;
 + 		queue = true;
@@ -7634,7 +8399,7 @@ index 0000000..4faac0d
 + 		ath_txq_unlock(sc, txq);
 + 		txq = sc->tx.uapsdq;
 + 		ath_txq_lock(sc, txq);
-+@@ -2409,7 +2424,7 @@ int ath_tx_start(struct ieee80211_hw *hw
++@@ -2390,7 +2405,7 @@ int ath_tx_start(struct ieee80211_hw *hw
 + 	if (txctl->paprd)
 + 		bf->bf_state.bfs_paprd_timestamp = jiffies;
 + 
@@ -7643,7 +8408,7 @@ index 0000000..4faac0d
 + 	ath_tx_send_normal(sc, txq, tid, skb);
 + 
 + out:
-+@@ -2448,7 +2463,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw
++@@ -2429,7 +2444,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw
 + 			break;
 + 
 + 		bf->bf_lastbf = bf;
@@ -7652,7 +8417,7 @@ index 0000000..4faac0d
 + 		ath_buf_set_rate(sc, bf, &info, fi->framelen, false);
 + 		duration += info.rates[0].PktDuration;
 + 		if (bf_tail)
-+@@ -2968,7 +2983,7 @@ int ath9k_tx99_send(struct ath_softc *sc
++@@ -2932,7 +2947,7 @@ int ath9k_tx99_send(struct ath_softc *sc
 + 		return -EINVAL;
 + 	}
 + 
@@ -7792,68 +8557,6 @@ index 465d943..0000000
 - 	spinlock_t lock;
 - 
 - 	struct work_struct drv_deliver_wk;
-diff --git a/package/kernel/mac80211/patches/302-ath10k-Delay-device-access-after-cold-reset.patch b/package/kernel/mac80211/patches/302-ath10k-Delay-device-access-after-cold-reset.patch
-new file mode 100644
-index 0000000..820aa9a
---- /dev/null
-+++ b/package/kernel/mac80211/patches/302-ath10k-Delay-device-access-after-cold-reset.patch
-@@ -0,0 +1,56 @@
-+From: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
-+Date: Fri, 3 Jul 2015 11:45:42 +0530
-+Subject: [PATCH] ath10k: Delay device access after cold reset
-+
-+It is observed that during cold reset pcie access right
-+after a write operation to SOC_GLOBAL_RESET_ADDRESS causes
-+Data Bus Error and system hard lockup. The reason
-+for bus error is that pcie needs some time to get
-+back to stable state for any transaction during cold reset. Add
-+delay of 20 msecs after write of SOC_GLOBAL_RESET_ADDRESS
-+to fix this issue.
-+
-+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath10k/pci.c
-++++ b/drivers/net/wireless/ath/ath10k/pci.c
-+@@ -2761,7 +2761,6 @@ static int ath10k_pci_wait_for_target_in
-+ 
-+ static int ath10k_pci_cold_reset(struct ath10k *ar)
-+ {
-+-	int i;
-+ 	u32 val;
-+ 
-+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot cold reset\n");
-+@@ -2777,23 +2776,18 @@ static int ath10k_pci_cold_reset(struct
-+ 	val |= 1;
-+ 	ath10k_pci_reg_write32(ar, SOC_GLOBAL_RESET_ADDRESS, val);
-+ 
-+-	for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-+-		if (ath10k_pci_reg_read32(ar, RTC_STATE_ADDRESS) &
-+-					  RTC_STATE_COLD_RESET_MASK)
-+-			break;
-+-		msleep(1);
-+-	}
-++	/* After writing into SOC_GLOBAL_RESET to put device into
-++	 * reset and pulling out of reset pcie may not be stable
-++	 * for any immediate pcie register access and cause bus error,
-++	 * add delay before any pcie access request to fix this issue.
-++	 */
-++	msleep(20);
-+ 
-+ 	/* Pull Target, including PCIe, out of RESET. */
-+ 	val &= ~1;
-+ 	ath10k_pci_reg_write32(ar, SOC_GLOBAL_RESET_ADDRESS, val);
-+ 
-+-	for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-+-		if (!(ath10k_pci_reg_read32(ar, RTC_STATE_ADDRESS) &
-+-					    RTC_STATE_COLD_RESET_MASK))
-+-			break;
-+-		msleep(1);
-+-	}
-++	msleep(20);
-+ 
-+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot cold reset complete\n");
-+ 
 diff --git a/package/kernel/mac80211/patches/302-ath9k-restart-only-triggering-DFS-detector-line.patch b/package/kernel/mac80211/patches/302-ath9k-restart-only-triggering-DFS-detector-line.patch
 deleted file mode 100644
 index e54e16e..0000000
@@ -7881,6 +8584,107 @@ index e54e16e..0000000
 - 			return true;
 - 		}
 - 	}
+diff --git a/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch b/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch
+new file mode 100644
+index 0000000..22b987a
+--- /dev/null
++++ b/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch
+@@ -0,0 +1,95 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Thu, 14 Jan 2016 03:14:03 +0100
++Subject: [PATCH] ath9k_hw: add low power tx gain table for AR953x
++
++Used in some newer TP-Link AR9533 devices.
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
++@@ -698,6 +698,9 @@ static void ar9003_tx_gain_table_mode2(s
++ 	else if (AR_SREV_9340(ah))
++ 		INIT_INI_ARRAY(&ah->iniModesTxGain,
++ 			ar9340Modes_low_ob_db_tx_gain_table_1p0);
+++	else if (AR_SREV_9531_11(ah))
+++		INIT_INI_ARRAY(&ah->iniModesTxGain,
+++			       qca953x_1p1_modes_no_xpa_low_power_tx_gain_table);
++ 	else if (AR_SREV_9485_11_OR_LATER(ah))
++ 		INIT_INI_ARRAY(&ah->iniModesTxGain,
++ 			ar9485Modes_low_ob_db_tx_gain_1_1);
++--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
++@@ -757,6 +757,71 @@ static const u32 qca953x_1p1_modes_xpa_t
++ 	{0x00016448, 0x6c927a70},
++ };
++ 
+++static const u32 qca953x_1p1_modes_no_xpa_low_power_tx_gain_table[][2] = {
+++	/* Addr      allmodes  */
+++	{0x0000a2dc, 0xfff55592},
+++	{0x0000a2e0, 0xfff99924},
+++	{0x0000a2e4, 0xfffe1e00},
+++	{0x0000a2e8, 0xffffe000},
+++	{0x0000a410, 0x000050d6},
+++	{0x0000a500, 0x00000069},
+++	{0x0000a504, 0x0400006b},
+++	{0x0000a508, 0x0800006d},
+++	{0x0000a50c, 0x0c000269},
+++	{0x0000a510, 0x1000026b},
+++	{0x0000a514, 0x1400026d},
+++	{0x0000a518, 0x18000669},
+++	{0x0000a51c, 0x1c00066b},
+++	{0x0000a520, 0x1d000a68},
+++	{0x0000a524, 0x21000a6a},
+++	{0x0000a528, 0x25000a6c},
+++	{0x0000a52c, 0x29000a6e},
+++	{0x0000a530, 0x2d0012a9},
+++	{0x0000a534, 0x310012ab},
+++	{0x0000a538, 0x350012ad},
+++	{0x0000a53c, 0x39001b0a},
+++	{0x0000a540, 0x3d001b0c},
+++	{0x0000a544, 0x41001b0e},
+++	{0x0000a548, 0x43001bae},
+++	{0x0000a54c, 0x45001914},
+++	{0x0000a550, 0x47001916},
+++	{0x0000a554, 0x49001b96},
+++	{0x0000a558, 0x49001b96},
+++	{0x0000a55c, 0x49001b96},
+++	{0x0000a560, 0x49001b96},
+++	{0x0000a564, 0x49001b96},
+++	{0x0000a568, 0x49001b96},
+++	{0x0000a56c, 0x49001b96},
+++	{0x0000a570, 0x49001b96},
+++	{0x0000a574, 0x49001b96},
+++	{0x0000a578, 0x49001b96},
+++	{0x0000a57c, 0x49001b96},
+++	{0x0000a600, 0x00000000},
+++	{0x0000a604, 0x00000000},
+++	{0x0000a608, 0x00000000},
+++	{0x0000a60c, 0x00000000},
+++	{0x0000a610, 0x00000000},
+++	{0x0000a614, 0x00000000},
+++	{0x0000a618, 0x00804201},
+++	{0x0000a61c, 0x01408201},
+++	{0x0000a620, 0x01408502},
+++	{0x0000a624, 0x01408502},
+++	{0x0000a628, 0x01408502},
+++	{0x0000a62c, 0x01408502},
+++	{0x0000a630, 0x01408502},
+++	{0x0000a634, 0x01408502},
+++	{0x0000a638, 0x01408502},
+++	{0x0000a63c, 0x01408502},
+++	{0x0000b2dc, 0xfff55592},
+++	{0x0000b2e0, 0xfff99924},
+++	{0x0000b2e4, 0xfffe1e00},
+++	{0x0000b2e8, 0xffffe000},
+++	{0x00016044, 0x044922db},
+++	{0x00016048, 0x6c927a70},
+++	{0x00016444, 0x044922db},
+++	{0x00016448, 0x6c927a70},
+++};
+++
++ static const u32 qca953x_2p0_baseband_core[][2] = {
++ 	/* Addr      allmodes  */
++ 	{0x00009800, 0xafe68e30},
 diff --git a/package/kernel/mac80211/patches/303-ath9k-add-DFS-support-for-extension-channel.patch b/package/kernel/mac80211/patches/303-ath9k-add-DFS-support-for-extension-channel.patch
 deleted file mode 100644
 index ed268ea..0000000
@@ -7963,445 +8767,231 @@ index ed268ea..0000000
 - }
 -+#undef PRI_CH_RADAR_FOUND
 -+#undef EXT_CH_RADAR_FOUND
-diff --git a/package/kernel/mac80211/patches/303-ath9k-add-fast-xmit-support.patch b/package/kernel/mac80211/patches/303-ath9k-add-fast-xmit-support.patch
+diff --git a/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch b/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch
 new file mode 100644
-index 0000000..139015c
+index 0000000..7bb7435
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/303-ath9k-add-fast-xmit-support.patch
-@@ -0,0 +1,17 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Mon, 11 May 2015 18:35:20 +0200
-+Subject: [PATCH] ath9k: add fast-xmit support
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
++++ b/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch
+@@ -0,0 +1,156 @@
++From: Eli Cooper <elicooper@gmx.com>
++Date: Thu, 14 Jan 2016 00:07:12 +0800
++Subject: [PATCH] rt2x00: fix monitor mode regression
 +
-+--- a/drivers/net/wireless/ath/ath9k/init.c
-++++ b/drivers/net/wireless/ath/ath9k/init.c
-+@@ -826,6 +826,7 @@ static void ath9k_set_hw_capab(struct at
-+ 	ieee80211_hw_set(hw, SIGNAL_DBM);
-+ 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
-+ 	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
-++	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
-+ 
-+ 	if (ath9k_ps_enable)
-+ 		ieee80211_hw_set(hw, SUPPORTS_PS);
-diff --git a/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch b/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch
-deleted file mode 100644
-index e1eab64..0000000
---- a/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch
-+++ /dev/null
-@@ -1,19 +0,0 @@
--From: Zefir Kurtisi <zefir.kurtisi@neratec.com>
--Date: Tue, 10 Mar 2015 17:49:31 +0100
--Subject: [PATCH] ath9k: allow 40MHz radar detection width
--
--Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
-----
--
----- a/drivers/net/wireless/ath/ath9k/init.c
--+++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -763,7 +763,8 @@ static const struct ieee80211_iface_comb
-- 		.num_different_channels = 1,
-- 		.beacon_int_infra_match = true,
-- 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
---					BIT(NL80211_CHAN_WIDTH_20),
--+					BIT(NL80211_CHAN_WIDTH_20) |
--+					BIT(NL80211_CHAN_WIDTH_40),
-- 	}
-- #endif
-- };
-diff --git a/package/kernel/mac80211/patches/304-ath9k-remove-struct-ath_atx_ac.patch b/package/kernel/mac80211/patches/304-ath9k-remove-struct-ath_atx_ac.patch
-new file mode 100644
-index 0000000..9f04276
---- /dev/null
-+++ b/package/kernel/mac80211/patches/304-ath9k-remove-struct-ath_atx_ac.patch
-@@ -0,0 +1,385 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Sat, 4 Apr 2015 18:39:06 +0200
-+Subject: [PATCH] ath9k: remove struct ath_atx_ac
++Since commit df1404650ccbfeb76a84f301f22316be0d00a864 monitor mode for rt2x00
++has been made effectively useless because the hardware filter is configured to
++drop packets whose intended recipient is not the device, regardless of the
++presence of monitor mode interfaces.
 +
-+struct ath_atx_ac contains a list of active TIDs belonging to one WMM AC.
-+This patch changes the code to track active station TIDs in the txq directly.
++This patch fixes this regression by adding explicit monitor mode support, and
++configuring the hardware filter accordingly.
 +
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++Signed-off-by: Eli Cooper <elicooper@gmx.com>
 +---
 +
-+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
-++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-+@@ -173,14 +173,6 @@ struct ath_txq {
-+ 	struct sk_buff_head complete_q;
-+ };
-+ 
-+-struct ath_atx_ac {
-+-	struct ath_txq *txq;
-+-	struct list_head list;
-+-	struct list_head tid_q;
-+-	bool clear_ps_filter;
-+-	bool sched;
-+-};
-+-
-+ struct ath_frame_info {
-+ 	struct ath_buf *bf;
-+ 	u16 framelen;
-+@@ -243,7 +235,7 @@ struct ath_atx_tid {
-+ 	struct sk_buff_head buf_q;
-+ 	struct sk_buff_head retry_q;
-+ 	struct ath_node *an;
-+-	struct ath_atx_ac *ac;
-++	struct ath_txq *txq;
-+ 	unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
-+ 	u16 seq_start;
-+ 	u16 seq_next;
-+@@ -255,6 +247,7 @@ struct ath_atx_tid {
-+ 	s8 bar_index;
-+ 	bool sched;
-+ 	bool active;
-++	bool clear_ps_filter;
-+ };
-+ 
-+ struct ath_node {
-+@@ -262,7 +255,6 @@ struct ath_node {
-+ 	struct ieee80211_sta *sta; /* station struct we're part of */
-+ 	struct ieee80211_vif *vif; /* interface with which we're associated */
-+ 	struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
-+-	struct ath_atx_ac ac[IEEE80211_NUM_ACS];
-+ 
-+ 	u16 maxampdu;
-+ 	u8 mpdudensity;
-+--- a/drivers/net/wireless/ath/ath9k/xmit.c
-++++ b/drivers/net/wireless/ath/ath9k/xmit.c
-+@@ -106,7 +106,6 @@ void ath_txq_unlock_complete(struct ath_
-+ static void ath_tx_queue_tid(struct ath_softc *sc, struct ath_txq *txq,
-+ 			     struct ath_atx_tid *tid)
-+ {
-+-	struct ath_atx_ac *ac = tid->ac;
-+ 	struct list_head *list;
-+ 	struct ath_vif *avp = (struct ath_vif *) tid->an->vif->drv_priv;
-+ 	struct ath_chanctx *ctx = avp->chanctx;
-+@@ -118,15 +117,8 @@ static void ath_tx_queue_tid(struct ath_
-+ 		return;
-+ 
-+ 	tid->sched = true;
-+-	list_add_tail(&tid->list, &ac->tid_q);
-+-
-+-	if (ac->sched)
-+-		return;
-+-
-+-	ac->sched = true;
-+-
-+ 	list = &ctx->acq[TID_TO_WME_AC(tid->tidno)];
-+-	list_add_tail(&ac->list, list);
-++	list_add_tail(&tid->list, list);
-+ }
-+ 
-+ static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
-+@@ -223,7 +215,7 @@ static struct sk_buff *ath_tid_dequeue(s
-+ static void
-+ ath_tx_tid_change_state(struct ath_softc *sc, struct ath_atx_tid *tid)
-+ {
-+-	struct ath_txq *txq = tid->ac->txq;
-++	struct ath_txq *txq = tid->txq;
-+ 	struct ieee80211_tx_info *tx_info;
-+ 	struct sk_buff *skb, *tskb;
-+ 	struct ath_buf *bf;
-+@@ -252,7 +244,7 @@ ath_tx_tid_change_state(struct ath_softc
-+ 
-+ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
-+ {
-+-	struct ath_txq *txq = tid->ac->txq;
-++	struct ath_txq *txq = tid->txq;
-+ 	struct sk_buff *skb;
-+ 	struct ath_buf *bf;
-+ 	struct list_head bf_head;
-+@@ -659,7 +651,7 @@ static void ath_tx_complete_aggr(struct
-+ 			ath_tx_queue_tid(sc, txq, tid);
-+ 
-+ 			if (ts->ts_status & (ATH9K_TXERR_FILT | ATH9K_TXERR_XRETRY))
-+-				tid->ac->clear_ps_filter = true;
-++				tid->clear_ps_filter = true;
-+ 		}
-+ 	}
-+ 
-+@@ -749,7 +741,7 @@ static u32 ath_lookup_rate(struct ath_so
-+ 	struct ieee80211_tx_rate *rates;
-+ 	u32 max_4ms_framelen, frmlen;
-+ 	u16 aggr_limit, bt_aggr_limit, legacy = 0;
-+-	int q = tid->ac->txq->mac80211_qnum;
-++	int q = tid->txq->mac80211_qnum;
-+ 	int i;
-+ 
-+ 	skb = bf->bf_mpdu;
-+@@ -1486,8 +1478,8 @@ static bool ath_tx_sched_aggr(struct ath
-+ 	if (list_empty(&bf_q))
-+ 		return false;
-+ 
-+-	if (tid->ac->clear_ps_filter || tid->an->no_ps_filter) {
-+-		tid->ac->clear_ps_filter = false;
-++	if (tid->clear_ps_filter || tid->an->no_ps_filter) {
-++		tid->clear_ps_filter = false;
-+ 		tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+ 	}
-+ 
-+@@ -1506,7 +1498,7 @@ int ath_tx_aggr_start(struct ath_softc *
-+ 
-+ 	an = (struct ath_node *)sta->drv_priv;
-+ 	txtid = ATH_AN_2_TID(an, tid);
-+-	txq = txtid->ac->txq;
-++	txq = txtid->txq;
-+ 
-+ 	ath_txq_lock(sc, txq);
-+ 
-+@@ -1540,7 +1532,7 @@ void ath_tx_aggr_stop(struct ath_softc *
-+ {
-+ 	struct ath_node *an = (struct ath_node *)sta->drv_priv;
-+ 	struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
-+-	struct ath_txq *txq = txtid->ac->txq;
-++	struct ath_txq *txq = txtid->txq;
-+ 
-+ 	ath_txq_lock(sc, txq);
-+ 	txtid->active = false;
-+@@ -1553,7 +1545,6 @@ void ath_tx_aggr_sleep(struct ieee80211_
-+ 		       struct ath_node *an)
-+ {
-+ 	struct ath_atx_tid *tid;
-+-	struct ath_atx_ac *ac;
-+ 	struct ath_txq *txq;
-+ 	bool buffered;
-+ 	int tidno;
-+@@ -1561,8 +1552,7 @@ void ath_tx_aggr_sleep(struct ieee80211_
-+ 	for (tidno = 0, tid = &an->tid[tidno];
-+ 	     tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-+ 
-+-		ac = tid->ac;
-+-		txq = ac->txq;
-++		txq = tid->txq;
-+ 
-+ 		ath_txq_lock(sc, txq);
-+ 
-+@@ -1576,11 +1566,6 @@ void ath_tx_aggr_sleep(struct ieee80211_
-+ 		tid->sched = false;
-+ 		list_del(&tid->list);
-+ 
-+-		if (ac->sched) {
-+-			ac->sched = false;
-+-			list_del(&ac->list);
-+-		}
-+-
-+ 		ath_txq_unlock(sc, txq);
-+ 
-+ 		ieee80211_sta_set_buffered(sta, tidno, buffered);
-+@@ -1590,18 +1575,16 @@ void ath_tx_aggr_sleep(struct ieee80211_
-+ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
-+ {
-+ 	struct ath_atx_tid *tid;
-+-	struct ath_atx_ac *ac;
-+ 	struct ath_txq *txq;
-+ 	int tidno;
-+ 
-+ 	for (tidno = 0, tid = &an->tid[tidno];
-+ 	     tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-+ 
-+-		ac = tid->ac;
-+-		txq = ac->txq;
-++		txq = tid->txq;
-+ 
-+ 		ath_txq_lock(sc, txq);
-+-		ac->clear_ps_filter = true;
-++		tid->clear_ps_filter = true;
-+ 
-+ 		if (ath_tid_has_buffered(tid)) {
-+ 			ath_tx_queue_tid(sc, txq, tid);
-+@@ -1621,7 +1604,7 @@ void ath_tx_aggr_resume(struct ath_softc
-+ 
-+ 	an = (struct ath_node *)sta->drv_priv;
-+ 	tid = ATH_AN_2_TID(an, tidno);
-+-	txq = tid->ac->txq;
-++	txq = tid->txq;
-+ 
-+ 	ath_txq_lock(sc, txq);
-+ 
-+@@ -1660,7 +1643,7 @@ void ath9k_release_buffered_frames(struc
-+ 
-+ 		tid = ATH_AN_2_TID(an, i);
-+ 
-+-		ath_txq_lock(sc, tid->ac->txq);
-++		ath_txq_lock(sc, tid->txq);
-+ 		while (nframes > 0) {
-+ 			bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid, &tid_q);
-+ 			if (!bf)
-+@@ -1684,7 +1667,7 @@ void ath9k_release_buffered_frames(struc
-+ 			if (an->sta && !ath_tid_has_buffered(tid))
-+ 				ieee80211_sta_set_buffered(an->sta, i, false);
-+ 		}
-+-		ath_txq_unlock_complete(sc, tid->ac->txq);
-++		ath_txq_unlock_complete(sc, tid->txq);
-+ 	}
-+ 
-+ 	if (list_empty(&bf_q))
-+@@ -1933,9 +1916,8 @@ void ath_tx_cleanupq(struct ath_softc *s
-+ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
-+ {
-+ 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-+-	struct ath_atx_ac *ac, *last_ac;
-+ 	struct ath_atx_tid *tid, *last_tid;
-+-	struct list_head *ac_list;
-++	struct list_head *tid_list;
-+ 	bool sent = false;
-+ 
-+ 	if (txq->mac80211_qnum < 0)
-+@@ -1945,63 +1927,46 @@ void ath_txq_schedule(struct ath_softc *
-+ 		return;
-+ 
-+ 	spin_lock_bh(&sc->chan_lock);
-+-	ac_list = &sc->cur_chan->acq[txq->mac80211_qnum];
-++	tid_list = &sc->cur_chan->acq[txq->mac80211_qnum];
-+ 
-+-	if (list_empty(ac_list)) {
-++	if (list_empty(tid_list)) {
-+ 		spin_unlock_bh(&sc->chan_lock);
-+ 		return;
-+ 	}
-+ 
-+ 	rcu_read_lock();
-+ 
-+-	last_ac = list_entry(ac_list->prev, struct ath_atx_ac, list);
-+-	while (!list_empty(ac_list)) {
-++	last_tid = list_entry(tid_list->prev, struct ath_atx_tid, list);
-++	while (!list_empty(tid_list)) {
-+ 		bool stop = false;
-+ 
-+ 		if (sc->cur_chan->stopped)
-+ 			break;
-+ 
-+-		ac = list_first_entry(ac_list, struct ath_atx_ac, list);
-+-		last_tid = list_entry(ac->tid_q.prev, struct ath_atx_tid, list);
-+-		list_del(&ac->list);
-+-		ac->sched = false;
-+-
-+-		while (!list_empty(&ac->tid_q)) {
-+-
-+-			tid = list_first_entry(&ac->tid_q, struct ath_atx_tid,
-+-					       list);
-+-			list_del(&tid->list);
-+-			tid->sched = false;
-+-
-+-			if (ath_tx_sched_aggr(sc, txq, tid, &stop))
-+-				sent = true;
-+-
-+-			/*
-+-			 * add tid to round-robin queue if more frames
-+-			 * are pending for the tid
-+-			 */
-+-			if (ath_tid_has_buffered(tid))
-+-				ath_tx_queue_tid(sc, txq, tid);
-++		tid = list_first_entry(tid_list, struct ath_atx_tid, list);
-++		list_del(&tid->list);
-++		tid->sched = false;
-+ 
-+-			if (stop || tid == last_tid)
-+-				break;
-+-		}
-++		if (ath_tx_sched_aggr(sc, txq, tid, &stop))
-++			sent = true;
-+ 
-+-		if (!list_empty(&ac->tid_q) && !ac->sched) {
-+-			ac->sched = true;
-+-			list_add_tail(&ac->list, ac_list);
-+-		}
-++		/*
-++		 * add tid to round-robin queue if more frames
-++		 * are pending for the tid
-++		 */
-++		if (ath_tid_has_buffered(tid))
-++			ath_tx_queue_tid(sc, txq, tid);
-+ 
-+ 		if (stop)
-+ 			break;
-+ 
-+-		if (ac == last_ac) {
-++		if (tid == last_tid) {
-+ 			if (!sent)
-+ 				break;
++--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
++@@ -273,8 +273,10 @@ static void rt2400pci_config_filter(stru
++ 			   !(filter_flags & FIF_PLCPFAIL));
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_CONTROL,
++ 			   !(filter_flags & FIF_CONTROL));
++-	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME, 1);
+++	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME,
+++			   !rt2x00dev->is_monitoring);
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_TODS,
+++			   !rt2x00dev->is_monitoring &&
++ 			   !rt2x00dev->intf_ap_count);
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
++ 	rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
++--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
++@@ -274,8 +274,10 @@ static void rt2500pci_config_filter(stru
++ 			   !(filter_flags & FIF_PLCPFAIL));
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_CONTROL,
++ 			   !(filter_flags & FIF_CONTROL));
++-	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME, 1);
+++	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME,
+++			   !rt2x00dev->is_monitoring);
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_TODS,
+++			   !rt2x00dev->is_monitoring &&
++ 			   !rt2x00dev->intf_ap_count);
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
++ 	rt2x00_set_field32(&reg, RXCSR0_DROP_MCAST,
++--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
++@@ -437,8 +437,10 @@ static void rt2500usb_config_filter(stru
++ 			   !(filter_flags & FIF_PLCPFAIL));
++ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CONTROL,
++ 			   !(filter_flags & FIF_CONTROL));
++-	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME, 1);
+++	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME,
+++			   !rt2x00dev->is_monitoring);
++ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_TODS,
+++			   !rt2x00dev->is_monitoring &&
++ 			   !rt2x00dev->intf_ap_count);
++ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_VERSION_ERROR, 1);
++ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_MULTICAST,
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -1490,7 +1490,8 @@ void rt2800_config_filter(struct rt2x00_
++ 			   !(filter_flags & FIF_FCSFAIL));
++ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
++ 			   !(filter_flags & FIF_PLCPFAIL));
++-	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME, 1);
+++	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
+++			   !rt2x00dev->is_monitoring);
++ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
++ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
++ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -844,11 +844,13 @@ struct rt2x00_dev {
++ 	 *  - Open sta interface count.
++ 	 *  - Association count.
++ 	 *  - Beaconing enabled count.
+++	 *  - Whether the device is monitoring.
++ 	 */
++ 	unsigned int intf_ap_count;
++ 	unsigned int intf_sta_count;
++ 	unsigned int intf_associated;
++ 	unsigned int intf_beaconing;
+++	bool is_monitoring;
 + 
-+ 			sent = false;
-+-			last_ac = list_entry(ac_list->prev,
-+-					     struct ath_atx_ac, list);
-++			last_tid = list_entry(tid_list->prev,
-++					      struct ath_atx_tid, list);
-+ 		}
++ 	/*
++ 	 * Interface combinations
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00config.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00config.c
++@@ -244,6 +244,16 @@ void rt2x00lib_config(struct rt2x00_dev
++ 	    (ieee80211_flags & IEEE80211_CONF_CHANGE_PS))
++ 		cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
++ 
+++	if (ieee80211_flags & IEEE80211_CONF_CHANGE_MONITOR) {
+++		if (conf->flags & IEEE80211_CONF_MONITOR) {
+++			rt2x00_dbg(rt2x00dev, "Monitor mode is enabled\n");
+++			rt2x00dev->is_monitoring = true;
+++		} else {
+++			rt2x00_dbg(rt2x00dev, "Monitor mode is disabled\n");
+++			rt2x00dev->is_monitoring = false;
+++		}
+++	}
+++
++ 	/*
++ 	 * Start configuration.
++ 	 */
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++@@ -1204,6 +1204,7 @@ int rt2x00lib_start(struct rt2x00_dev *r
++ 	rt2x00dev->intf_ap_count = 0;
++ 	rt2x00dev->intf_sta_count = 0;
++ 	rt2x00dev->intf_associated = 0;
+++	rt2x00dev->is_monitoring = false;
++ 
++ 	/* Enable the radio */
++ 	retval = rt2x00lib_enable_radio(rt2x00dev);
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++@@ -385,11 +385,6 @@ void rt2x00mac_configure_filter(struct i
++ 			*total_flags |= FIF_PSPOLL;
 + 	}
 + 
-+@@ -2391,10 +2356,10 @@ int ath_tx_start(struct ieee80211_hw *hw
-+ 		txq = sc->tx.uapsdq;
-+ 		ath_txq_lock(sc, txq);
-+ 	} else if (txctl->an && queue) {
-+-		WARN_ON(tid->ac->txq != txctl->txq);
-++		WARN_ON(tid->txq != txctl->txq);
-+ 
-+ 		if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
-+-			tid->ac->clear_ps_filter = true;
-++			tid->clear_ps_filter = true;
-+ 
-+ 		/*
-+ 		 * Add this frame to software queue for scheduling later
-+@@ -2888,7 +2853,6 @@ int ath_tx_init(struct ath_softc *sc, in
-+ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
-+ {
-+ 	struct ath_atx_tid *tid;
-+-	struct ath_atx_ac *ac;
-+ 	int tidno, acno;
-+ 
-+ 	for (tidno = 0, tid = &an->tid[tidno];
-+@@ -2901,24 +2865,16 @@ void ath_tx_node_init(struct ath_softc *
-+ 		tid->baw_head  = tid->baw_tail = 0;
-+ 		tid->sched     = false;
-+ 		tid->active	   = false;
-++		tid->clear_ps_filter = true;
-+ 		__skb_queue_head_init(&tid->buf_q);
-+ 		__skb_queue_head_init(&tid->retry_q);
-+ 		acno = TID_TO_WME_AC(tidno);
-+-		tid->ac = &an->ac[acno];
-+-	}
-+-
-+-	for (acno = 0, ac = &an->ac[acno];
-+-	     acno < IEEE80211_NUM_ACS; acno++, ac++) {
-+-		ac->sched    = false;
-+-		ac->clear_ps_filter = true;
-+-		ac->txq = sc->tx.txq_map[acno];
-+-		INIT_LIST_HEAD(&ac->tid_q);
-++		tid->txq = sc->tx.txq_map[acno];
++-	/*
++-	 * Check if there is any work left for us.
++-	 */
++-	if (rt2x00dev->packet_filter == *total_flags)
++-		return;
++ 	rt2x00dev->packet_filter = *total_flags;
++ 
++ 	rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
++--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
++@@ -530,8 +530,10 @@ static void rt61pci_config_filter(struct
++ 			   !(filter_flags & FIF_PLCPFAIL));
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
++ 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
++-	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME, 1);
+++	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
+++			   !rt2x00dev->is_monitoring);
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
+++			   !rt2x00dev->is_monitoring &&
++ 			   !rt2x00dev->intf_ap_count);
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
++--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c
++@@ -480,8 +480,10 @@ static void rt73usb_config_filter(struct
++ 			   !(filter_flags & FIF_PLCPFAIL));
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
++ 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
++-	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME, 1);
+++	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
+++			   !rt2x00dev->is_monitoring);
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
+++			   !rt2x00dev->is_monitoring &&
++ 			   !rt2x00dev->intf_ap_count);
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
++ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
+diff --git a/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch b/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch
+deleted file mode 100644
+index e1eab64..0000000
+--- a/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch
++++ /dev/null
+@@ -1,19 +0,0 @@
+-From: Zefir Kurtisi <zefir.kurtisi@neratec.com>
+-Date: Tue, 10 Mar 2015 17:49:31 +0100
+-Subject: [PATCH] ath9k: allow 40MHz radar detection width
+-
+-Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
+----
+-
+---- a/drivers/net/wireless/ath/ath9k/init.c
+-+++ b/drivers/net/wireless/ath/ath9k/init.c
+-@@ -763,7 +763,8 @@ static const struct ieee80211_iface_comb
+- 		.num_different_channels = 1,
+- 		.beacon_int_infra_match = true,
+- 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+--					BIT(NL80211_CHAN_WIDTH_20),
+-+					BIT(NL80211_CHAN_WIDTH_20) |
+-+					BIT(NL80211_CHAN_WIDTH_40),
+- 	}
+- #endif
+- };
+diff --git a/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch b/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch
+new file mode 100644
+index 0000000..049059a
+--- /dev/null
++++ b/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch
+@@ -0,0 +1,32 @@
++From: Miaoqing Pan <miaoqing@codeaurora.org>
++Date: Fri, 15 Jan 2016 18:17:17 +0800
++Subject: [PATCH] ath9k: avoid ANI restart if no trigger
++
++Fixes commit 54da20d83f0e ("ath9k_hw: improve ANI processing and rx desensitizing parameters")
++
++Call ath9k_ani_restart() only when the phy error rate reach the
++ANI immunity threshold. Sync the logic with internal code base.
++
++Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/ath/ath9k/ani.c
+++++ b/drivers/net/wireless/ath/ath9k/ani.c
++@@ -444,14 +444,16 @@ void ath9k_hw_ani_monitor(struct ath_hw
++ 		    ofdmPhyErrRate < ah->config.ofdm_trig_low) {
++ 			ath9k_hw_ani_lower_immunity(ah);
++ 			aniState->ofdmsTurn = !aniState->ofdmsTurn;
+++			ath9k_ani_restart(ah);
++ 		} else if (ofdmPhyErrRate > ah->config.ofdm_trig_high) {
++ 			ath9k_hw_ani_ofdm_err_trigger(ah);
++ 			aniState->ofdmsTurn = false;
+++			ath9k_ani_restart(ah);
++ 		} else if (cckPhyErrRate > ah->config.cck_trig_high) {
++ 			ath9k_hw_ani_cck_err_trigger(ah);
++ 			aniState->ofdmsTurn = true;
+++			ath9k_ani_restart(ah);
++ 		}
++-		ath9k_ani_restart(ah);
 + 	}
 + }
-+ 
-+ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
-+ {
-+-	struct ath_atx_ac *ac;
-+ 	struct ath_atx_tid *tid;
-+ 	struct ath_txq *txq;
-+ 	int tidno;
-+@@ -2926,8 +2882,7 @@ void ath_tx_node_cleanup(struct ath_soft
-+ 	for (tidno = 0, tid = &an->tid[tidno];
-+ 	     tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-+ 
-+-		ac = tid->ac;
-+-		txq = ac->txq;
-++		txq = tid->txq;
-+ 
-+ 		ath_txq_lock(sc, txq);
-+ 
-+@@ -2936,11 +2891,6 @@ void ath_tx_node_cleanup(struct ath_soft
-+ 			tid->sched = false;
-+ 		}
-+ 
-+-		if (ac->sched) {
-+-			list_del(&ac->list);
-+-			tid->ac->sched = false;
-+-		}
-+-
-+ 		ath_tid_drain(sc, txq, tid);
-+ 		tid->active = false;
-+ 
++ EXPORT_SYMBOL(ath9k_hw_ani_monitor);
 diff --git a/package/kernel/mac80211/patches/305-ath5k-channel-change-fix.patch b/package/kernel/mac80211/patches/305-ath5k-channel-change-fix.patch
 deleted file mode 100644
 index 4cfa53f..0000000
@@ -8545,102 +9135,103 @@ index 4cfa53f..0000000
 - 	mode = channel->hw_value;
 - 	switch (mode) {
 - 	case AR5K_MODE_11A:
-diff --git a/package/kernel/mac80211/patches/305-ath9k-remove-the-sched-field-in-struct-ath_atx_tid.patch b/package/kernel/mac80211/patches/305-ath9k-remove-the-sched-field-in-struct-ath_atx_tid.patch
+diff --git a/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch b/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch
 new file mode 100644
-index 0000000..ec860dc
+index 0000000..a1ac67c
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/305-ath9k-remove-the-sched-field-in-struct-ath_atx_tid.patch
-@@ -0,0 +1,90 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Sat, 4 Apr 2015 18:42:33 +0200
-+Subject: [PATCH] ath9k: remove the sched field in struct ath_atx_tid
++++ b/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch
+@@ -0,0 +1,91 @@
++From: Miaoqing Pan <miaoqing@codeaurora.org>
++Date: Fri, 15 Jan 2016 18:17:18 +0800
++Subject: [PATCH] ath9k: clean up ANI per-channel pointer checking
 +
-+Use list_empty(&tid->list) instead
++commit c24bd3620c50 ("ath9k: Do not maintain ANI state per-channel")
++removed per-channel handling, the code to check 'curchan' also
++should be removed as never used.
 +
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
 +---
 +
-+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
-++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-+@@ -245,7 +245,6 @@ struct ath_atx_tid {
-+ 	int baw_tail;   /* next unused tx buffer slot */
++--- a/drivers/net/wireless/ath/ath9k/ani.c
+++++ b/drivers/net/wireless/ath/ath9k/ani.c
++@@ -126,12 +126,8 @@ static void ath9k_hw_update_mibstats(str
 + 
-+ 	s8 bar_index;
-+-	bool sched;
-+ 	bool active;
-+ 	bool clear_ps_filter;
-+ };
-+--- a/drivers/net/wireless/ath/ath9k/xmit.c
-++++ b/drivers/net/wireless/ath/ath9k/xmit.c
-+@@ -113,12 +113,9 @@ static void ath_tx_queue_tid(struct ath_
-+ 	if (!ctx)
-+ 		return;
-+ 
-+-	if (tid->sched)
-+-		return;
++ static void ath9k_ani_restart(struct ath_hw *ah)
++ {
++-	struct ar5416AniState *aniState;
 +-
-+-	tid->sched = true;
-+ 	list = &ctx->acq[TID_TO_WME_AC(tid->tidno)];
-+-	list_add_tail(&tid->list, list);
-++	if (list_empty(&tid->list))
-++		list_add_tail(&tid->list, list);
-+ }
++-	if (!ah->curchan)
++-		return;
+++	struct ar5416AniState *aniState = &ah->ani;
 + 
-+ static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
-+@@ -1556,15 +1553,14 @@ void ath_tx_aggr_sleep(struct ieee80211_
++-	aniState = &ah->ani;
++ 	aniState->listenTime = 0;
 + 
-+ 		ath_txq_lock(sc, txq);
++ 	ENABLE_REGWRITE_BUFFER(ah);
++@@ -221,12 +217,7 @@ static void ath9k_hw_set_ofdm_nil(struct
 + 
-+-		if (!tid->sched) {
-++		if (list_empty(&tid->list)) {
-+ 			ath_txq_unlock(sc, txq);
-+ 			continue;
-+ 		}
++ static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
++ {
++-	struct ar5416AniState *aniState;
++-
++-	if (!ah->curchan)
++-		return;
++-
++-	aniState = &ah->ani;
+++	struct ar5416AniState *aniState = &ah->ani;
 + 
-+ 		buffered = ath_tid_has_buffered(tid);
++ 	if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
++ 		ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1, false);
++@@ -281,12 +272,7 @@ static void ath9k_hw_set_cck_nil(struct
 + 
-+-		tid->sched = false;
-+-		list_del(&tid->list);
-++		list_del_init(&tid->list);
++ static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
++ {
++-	struct ar5416AniState *aniState;
++-
++-	if (!ah->curchan)
++-		return;
++-
++-	aniState = &ah->ani;
+++	struct ar5416AniState *aniState = &ah->ani;
++ 
++ 	if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
++ 		ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1,
++@@ -299,9 +285,7 @@ static void ath9k_hw_ani_cck_err_trigger
++  */
++ static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
++ {
++-	struct ar5416AniState *aniState;
++-
++-	aniState = &ah->ani;
+++	struct ar5416AniState *aniState = &ah->ani;
 + 
-+ 		ath_txq_unlock(sc, txq);
++ 	/* lower OFDM noise immunity */
++ 	if (aniState->ofdmNoiseImmunityLevel > 0 &&
++@@ -329,7 +313,7 @@ void ath9k_ani_reset(struct ath_hw *ah,
++ 	struct ath_common *common = ath9k_hw_common(ah);
++ 	int ofdm_nil, cck_nil;
 + 
-+@@ -1944,8 +1940,7 @@ void ath_txq_schedule(struct ath_softc *
-+ 			break;
++-	if (!ah->curchan)
+++	if (!chan)
++ 		return;
 + 
-+ 		tid = list_first_entry(tid_list, struct ath_atx_tid, list);
-+-		list_del(&tid->list);
-+-		tid->sched = false;
-++		list_del_init(&tid->list);
-+ 
-+ 		if (ath_tx_sched_aggr(sc, txq, tid, &stop))
-+ 			sent = true;
-+@@ -2863,11 +2858,11 @@ void ath_tx_node_init(struct ath_softc *
-+ 		tid->seq_start = tid->seq_next = 0;
-+ 		tid->baw_size  = WME_MAX_BA;
-+ 		tid->baw_head  = tid->baw_tail = 0;
-+-		tid->sched     = false;
-+ 		tid->active	   = false;
-+ 		tid->clear_ps_filter = true;
-+ 		__skb_queue_head_init(&tid->buf_q);
-+ 		__skb_queue_head_init(&tid->retry_q);
-++		INIT_LIST_HEAD(&tid->list);
-+ 		acno = TID_TO_WME_AC(tidno);
-+ 		tid->txq = sc->tx.txq_map[acno];
-+ 	}
-+@@ -2886,10 +2881,8 @@ void ath_tx_node_cleanup(struct ath_soft
++ 	BUG_ON(aniState == NULL);
++@@ -416,14 +400,10 @@ static bool ath9k_hw_ani_read_counters(s
 + 
-+ 		ath_txq_lock(sc, txq);
++ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
++ {
++-	struct ar5416AniState *aniState;
+++	struct ar5416AniState *aniState = &ah->ani;
++ 	struct ath_common *common = ath9k_hw_common(ah);
++ 	u32 ofdmPhyErrRate, cckPhyErrRate;
 + 
-+-		if (tid->sched) {
-+-			list_del(&tid->list);
-+-			tid->sched = false;
-+-		}
-++		if (!list_empty(&tid->list))
-++			list_del_init(&tid->list);
++-	if (!ah->curchan)
++-		return;
++-
++-	aniState = &ah->ani;
++ 	if (!ath9k_hw_ani_read_counters(ah))
++ 		return;
 + 
-+ 		ath_tid_drain(sc, txq, tid);
-+ 		tid->active = false;
 diff --git a/package/kernel/mac80211/patches/306-ath5k-fix-reset-race.patch b/package/kernel/mac80211/patches/306-ath5k-fix-reset-race.patch
 deleted file mode 100644
 index 85a1904..0000000
@@ -8743,173 +9334,76 @@ index 85a1904..0000000
 - 	ath5k_beacon_config(ah);
 - 	/* intrs are enabled by ath5k_beacon_config */
 - 
-diff --git a/package/kernel/mac80211/patches/306-mac80211-Deinline-rate_control_rate_init-rate_contro.patch b/package/kernel/mac80211/patches/306-mac80211-Deinline-rate_control_rate_init-rate_contro.patch
+diff --git a/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch b/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch
 new file mode 100644
-index 0000000..928c93b
+index 0000000..cf8194a
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/306-mac80211-Deinline-rate_control_rate_init-rate_contro.patch
-@@ -0,0 +1,161 @@
-+From: Denys Vlasenko <dvlasenk@redhat.com>
-+Date: Wed, 15 Jul 2015 14:56:06 +0200
-+Subject: [PATCH] mac80211: Deinline rate_control_rate_init,
-+ rate_control_rate_update
-+
-+With this .config: http://busybox.net/~vda/kernel_config,
-+after deinlining these functions have sizes and callsite counts
-+as follows:
-+
-+rate_control_rate_init: 554 bytes, 8 calls
-+rate_control_rate_update: 1596 bytes, 5 calls
-+
-+Total size reduction: about 11 kbytes.
-+
-+Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
-+CC: John Linville <linville@tuxdriver.com>
-+CC: Michal Kazior <michal.kazior@tieto.com>
-+CC: Johannes Berg <johannes.berg@intel.com>
-+Cc: linux-wireless@vger.kernel.org
-+Cc: netdev@vger.kernel.org
-+CC: linux-kernel@vger.kernel.org
++++ b/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch
+@@ -0,0 +1,31 @@
++From: Miaoqing Pan <miaoqing@codeaurora.org>
++Date: Fri, 15 Jan 2016 18:17:19 +0800
++Subject: [PATCH] ath9k: do not reset while BB panic(0x4000409) on ar9561
++
++BB panic(0x4000409) observed while AP enabling/disabling
++bursting.
++
++Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
 +---
 +
-+--- a/net/mac80211/rate.c
-++++ b/net/mac80211/rate.c
-+@@ -29,6 +29,65 @@ module_param(ieee80211_default_rc_algo,
-+ MODULE_PARM_DESC(ieee80211_default_rc_algo,
-+ 		 "Default rate control algorithm for mac80211 to use");
-+ 
-++void rate_control_rate_init(struct sta_info *sta)
-++{
-++	struct ieee80211_local *local = sta->sdata->local;
-++	struct rate_control_ref *ref = sta->rate_ctrl;
-++	struct ieee80211_sta *ista = &sta->sta;
-++	void *priv_sta = sta->rate_ctrl_priv;
-++	struct ieee80211_supported_band *sband;
-++	struct ieee80211_chanctx_conf *chanctx_conf;
-++
-++	ieee80211_sta_set_rx_nss(sta);
-++
-++	if (!ref)
-++		return;
-++
-++	rcu_read_lock();
-++
-++	chanctx_conf = rcu_dereference(sta->sdata->vif.chanctx_conf);
-++	if (WARN_ON(!chanctx_conf)) {
-++		rcu_read_unlock();
-++		return;
-++	}
-++
-++	sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
-++
-++	spin_lock_bh(&sta->rate_ctrl_lock);
-++	ref->ops->rate_init(ref->priv, sband, &chanctx_conf->def, ista,
-++			    priv_sta);
-++	spin_unlock_bh(&sta->rate_ctrl_lock);
-++	rcu_read_unlock();
-++	set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
-++}
-++
-++void rate_control_rate_update(struct ieee80211_local *local,
-++				    struct ieee80211_supported_band *sband,
-++				    struct sta_info *sta, u32 changed)
-++{
-++	struct rate_control_ref *ref = local->rate_ctrl;
-++	struct ieee80211_sta *ista = &sta->sta;
-++	void *priv_sta = sta->rate_ctrl_priv;
-++	struct ieee80211_chanctx_conf *chanctx_conf;
-++
-++	if (ref && ref->ops->rate_update) {
-++		rcu_read_lock();
-++
-++		chanctx_conf = rcu_dereference(sta->sdata->vif.chanctx_conf);
-++		if (WARN_ON(!chanctx_conf)) {
-++			rcu_read_unlock();
-++			return;
-++		}
-++
-++		spin_lock_bh(&sta->rate_ctrl_lock);
-++		ref->ops->rate_update(ref->priv, sband, &chanctx_conf->def,
-++				      ista, priv_sta, changed);
-++		spin_unlock_bh(&sta->rate_ctrl_lock);
-++		rcu_read_unlock();
-++	}
-++	drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
-++}
-++
-+ int ieee80211_rate_control_register(const struct rate_control_ops *ops)
-+ {
-+ 	struct rate_control_alg *alg;
-+--- a/net/mac80211/rate.h
-++++ b/net/mac80211/rate.h
-+@@ -71,64 +71,10 @@ rate_control_tx_status_noskb(struct ieee
-+ 	spin_unlock_bh(&sta->rate_ctrl_lock);
-+ }
-+ 
-+-static inline void rate_control_rate_init(struct sta_info *sta)
-+-{
-+-	struct ieee80211_local *local = sta->sdata->local;
-+-	struct rate_control_ref *ref = sta->rate_ctrl;
-+-	struct ieee80211_sta *ista = &sta->sta;
-+-	void *priv_sta = sta->rate_ctrl_priv;
-+-	struct ieee80211_supported_band *sband;
-+-	struct ieee80211_chanctx_conf *chanctx_conf;
-+-
-+-	ieee80211_sta_set_rx_nss(sta);
-+-
-+-	if (!ref)
-+-		return;
-+-
-+-	rcu_read_lock();
-+-
-+-	chanctx_conf = rcu_dereference(sta->sdata->vif.chanctx_conf);
-+-	if (WARN_ON(!chanctx_conf)) {
-+-		rcu_read_unlock();
-+-		return;
-+-	}
-+-
-+-	sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
-+-
-+-	spin_lock_bh(&sta->rate_ctrl_lock);
-+-	ref->ops->rate_init(ref->priv, sband, &chanctx_conf->def, ista,
-+-			    priv_sta);
-+-	spin_unlock_bh(&sta->rate_ctrl_lock);
-+-	rcu_read_unlock();
-+-	set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
-+-}
-+-
-+-static inline void rate_control_rate_update(struct ieee80211_local *local,
-++void rate_control_rate_init(struct sta_info *sta);
-++void rate_control_rate_update(struct ieee80211_local *local,
-+ 				    struct ieee80211_supported_band *sband,
-+-				    struct sta_info *sta, u32 changed)
-+-{
-+-	struct rate_control_ref *ref = local->rate_ctrl;
-+-	struct ieee80211_sta *ista = &sta->sta;
-+-	void *priv_sta = sta->rate_ctrl_priv;
-+-	struct ieee80211_chanctx_conf *chanctx_conf;
-+-
-+-	if (ref && ref->ops->rate_update) {
-+-		rcu_read_lock();
-+-
-+-		chanctx_conf = rcu_dereference(sta->sdata->vif.chanctx_conf);
-+-		if (WARN_ON(!chanctx_conf)) {
-+-			rcu_read_unlock();
-+-			return;
-+-		}
-+-
-+-		spin_lock_bh(&sta->rate_ctrl_lock);
-+-		ref->ops->rate_update(ref->priv, sband, &chanctx_conf->def,
-+-				      ista, priv_sta, changed);
-+-		spin_unlock_bh(&sta->rate_ctrl_lock);
-+-		rcu_read_unlock();
-+-	}
-+-	drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
-+-}
-++				    struct sta_info *sta, u32 changed);
-+ 
-+ static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
-+ 					   struct sta_info *sta, gfp_t gfp)
++--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++@@ -2071,7 +2071,8 @@ void ar9003_hw_attach_phy_ops(struct ath
++  *             to be disabled.
++  *
++  * 0x04000409: Packet stuck on receive.
++- *             Full chip reset is required for all chips except AR9340.
+++ *             Full chip reset is required for all chips except
+++ *	       AR9340, AR9531 and AR9561.
++  */
++ 
++ /*
++@@ -2100,7 +2101,7 @@ bool ar9003_hw_bb_watchdog_check(struct
++ 	case 0x04000b09:
++ 		return true;
++ 	case 0x04000409:
++-		if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
+++		if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah))
++ 			return false;
++ 		else
++ 			return true;
+diff --git a/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch b/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch
+new file mode 100644
+index 0000000..80b781c
+--- /dev/null
++++ b/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch
+@@ -0,0 +1,27 @@
++From: Miaoqing Pan <miaoqing@codeaurora.org>
++Date: Fri, 15 Jan 2016 18:17:20 +0800
++Subject: [PATCH] ath9k: fix inconsistent use of tab and space in
++ indentation
++
++Minor changes for indenting.
++
++Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++@@ -5485,11 +5485,11 @@ unsigned int ar9003_get_paprd_scale_fact
++ 			  AR9300_PAPRD_SCALE_1);
++ 	else {
++ 		if (chan->channel >= 5700)
++-		return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
++-			  AR9300_PAPRD_SCALE_1);
+++			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
+++				  AR9300_PAPRD_SCALE_1);
++ 		else if (chan->channel >= 5400)
++ 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
++-				   AR9300_PAPRD_SCALE_2);
+++				  AR9300_PAPRD_SCALE_2);
++ 		else
++ 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
++ 				  AR9300_PAPRD_SCALE_1);
 diff --git a/package/kernel/mac80211/patches/307-ath9k-fix-tracking-of-enabled-AP-beacons.patch b/package/kernel/mac80211/patches/307-ath9k-fix-tracking-of-enabled-AP-beacons.patch
 deleted file mode 100644
 index ab9771e..0000000
@@ -8992,164 +9486,77 @@ index ab9771e..0000000
 - 	bool ibss_creator;
 - 	u32 nexttbtt;
 - 	u32 intval;
-diff --git a/package/kernel/mac80211/patches/307-mac80211-Deinline-drv_sta_state.patch b/package/kernel/mac80211/patches/307-mac80211-Deinline-drv_sta_state.patch
+diff --git a/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch b/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch
 new file mode 100644
-index 0000000..474c409
+index 0000000..d408866
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/307-mac80211-Deinline-drv_sta_state.patch
-@@ -0,0 +1,116 @@
-+From: Denys Vlasenko <dvlasenk@redhat.com>
-+Date: Wed, 15 Jul 2015 14:56:05 +0200
-+Subject: [PATCH] mac80211: Deinline drv_sta_state
-+
-+With this .config: http://busybox.net/~vda/kernel_config,
-+after deinlining the function size is 3132 bytes and there are
-+7 callsites.
-+
-+Total size reduction: about 20 kbytes.
-+
-+Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
-+CC: John Linville <linville@tuxdriver.com>
-+CC: Michal Kazior <michal.kazior@tieto.com>
-+Cc: Johannes Berg <johannes.berg@intel.com>
-+Cc: linux-wireless@vger.kernel.org
-+Cc: netdev@vger.kernel.org
-+CC: linux-kernel@vger.kernel.org
-+---
-+ create mode 100644 net/mac80211/driver-ops.c
++++ b/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch
+@@ -0,0 +1,65 @@
++From: Miaoqing Pan <miaoqing@codeaurora.org>
++Date: Fri, 15 Jan 2016 18:17:21 +0800
++Subject: [PATCH] ath9k: fix data bus error on ar9300 and ar9580
 +
-+--- a/net/mac80211/Makefile
-++++ b/net/mac80211/Makefile
-+@@ -3,6 +3,7 @@ obj-$(CPTCFG_MAC80211) += mac80211.o
-+ # mac80211 objects
-+ mac80211-y := \
-+ 	main.o status.o \
-++	driver-ops.o \
-+ 	sta_info.o \
-+ 	wep.o \
-+ 	wpa.o \
-+--- /dev/null
-++++ b/net/mac80211/driver-ops.c
-+@@ -0,0 +1,41 @@
-++/*
-++ * This program is free software; you can redistribute it and/or modify
-++ * it under the terms of the GNU General Public License version 2 as
-++ * published by the Free Software Foundation.
-++ */
-++#include <net/mac80211.h>
-++#include "ieee80211_i.h"
-++#include "trace.h"
-++#include "driver-ops.h"
-++
-++__must_check
-++int drv_sta_state(struct ieee80211_local *local,
-++		  struct ieee80211_sub_if_data *sdata,
-++		  struct sta_info *sta,
-++		  enum ieee80211_sta_state old_state,
-++		  enum ieee80211_sta_state new_state)
-++{
-++	int ret = 0;
-++
-++	might_sleep();
-++
-++	sdata = get_bss_sdata(sdata);
-++	if (!check_sdata_in_driver(sdata))
-++		return -EIO;
-++
-++	trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
-++	if (local->ops->sta_state) {
-++		ret = local->ops->sta_state(&local->hw, &sdata->vif, &sta->sta,
-++					    old_state, new_state);
-++	} else if (old_state == IEEE80211_STA_AUTH &&
-++		   new_state == IEEE80211_STA_ASSOC) {
-++		ret = drv_sta_add(local, sdata, &sta->sta);
-++		if (ret == 0)
-++			sta->uploaded = true;
-++	} else if (old_state == IEEE80211_STA_ASSOC &&
-++		   new_state == IEEE80211_STA_AUTH) {
-++		drv_sta_remove(local, sdata, &sta->sta);
-++	}
-++	trace_drv_return_int(local, ret);
-++	return ret;
-++}
-+--- a/net/mac80211/driver-ops.h
-++++ b/net/mac80211/driver-ops.h
-+@@ -573,37 +573,12 @@ static inline void drv_sta_pre_rcu_remov
-+ 	trace_drv_return_void(local);
-+ }
-+ 
-+-static inline __must_check
-++__must_check
-+ int drv_sta_state(struct ieee80211_local *local,
-+ 		  struct ieee80211_sub_if_data *sdata,
-+ 		  struct sta_info *sta,
-+ 		  enum ieee80211_sta_state old_state,
-+-		  enum ieee80211_sta_state new_state)
-+-{
-+-	int ret = 0;
-+-
-+-	might_sleep();
-+-
-+-	sdata = get_bss_sdata(sdata);
-+-	if (!check_sdata_in_driver(sdata))
-+-		return -EIO;
-+-
-+-	trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
-+-	if (local->ops->sta_state) {
-+-		ret = local->ops->sta_state(&local->hw, &sdata->vif, &sta->sta,
-+-					    old_state, new_state);
-+-	} else if (old_state == IEEE80211_STA_AUTH &&
-+-		   new_state == IEEE80211_STA_ASSOC) {
-+-		ret = drv_sta_add(local, sdata, &sta->sta);
-+-		if (ret == 0)
-+-			sta->uploaded = true;
-+-	} else if (old_state == IEEE80211_STA_ASSOC &&
-+-		   new_state == IEEE80211_STA_AUTH) {
-+-		drv_sta_remove(local, sdata, &sta->sta);
-+-	}
-+-	trace_drv_return_int(local, ret);
-+-	return ret;
-+-}
-++		  enum ieee80211_sta_state new_state);
-+ 
-+ static inline void drv_sta_rc_update(struct ieee80211_local *local,
-+ 				     struct ieee80211_sub_if_data *sdata,
-diff --git a/package/kernel/mac80211/patches/308-ath9k-Fix-NF-CCA-limits-for-AR9287-and-AR9227.patch b/package/kernel/mac80211/patches/308-ath9k-Fix-NF-CCA-limits-for-AR9287-and-AR9227.patch
-new file mode 100644
-index 0000000..1a3a9d4
---- /dev/null
-+++ b/package/kernel/mac80211/patches/308-ath9k-Fix-NF-CCA-limits-for-AR9287-and-AR9227.patch
-@@ -0,0 +1,30 @@
-+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
-+Date: Wed, 22 Jul 2015 10:42:43 +0200
-+Subject: [PATCH] ath9k: Fix NF CCA limits for AR9287 and AR9227
++One crash issue be found on ar9300: RTC_RC reg read leads crash, leading
++the data bus error, due to RTC_RC reg write not happen properly.
++
++Warm Reset trigger in continuous beacon stuck for one of the customer for
++other chip, noticed the MAC was stuck in RTC reset. After analysis noticed
++DMA did not complete when RTC was put in reset.
++
++So, before resetting the MAC need to make sure there are no pending DMA
++transactions because this reset does not reset all parts of the chip.
 +
-+The FreeBSD driver [0] uses the same 2G values as for the AR9280 chips.
-+Using the same values in ath9k results in much better throughput for me.
++The 12th and 11th bit of MAC _DMA_CFG register used to do that.
++	12 cfg_halt_ack 0x0
++		0 DMA has not yet halted
++		1 DMA has halted
++	11 cfg_halt_req 0x0
++		0 DMA logic operates normally
++		1 Request DMA logic to stop so software can reset the MAC
 +
-+Before this patch I had a huge amount of packet loss (sometimes up to
-+40%) and the max transfer speed was somewhere around 5Mbit/s. With this
-+patch applied I have zero packet loss and ten times the throughput.
-+My device uses a AR9227 which is the PCI variant of the AR9287.
++The Bit [12] of this register indicates when the halt has taken effect or
++not. the DMA halt IS NOT recoverable; once software sets bit [11] to
++request a DMA halt, software must wait for bit [12] to be set and reset
++the MAC.
 +
-+[0] http://bxr.su/FreeBSD/sys/dev/ath/ath_hal/ar9002/ar9287.h
++So, the same thing we implemented for ar9580 chip.
 +
-+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
++Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
 +---
 +
-+--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
-++++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
-+@@ -610,8 +610,8 @@
-+ #define AR_PHY_CCA_MIN_GOOD_VAL_9271_2GHZ      -127
-+ #define AR_PHY_CCA_MAX_GOOD_VAL_9271_2GHZ      -116
-+ 
-+-#define AR_PHY_CCA_NOM_VAL_9287_2GHZ           -120
-++#define AR_PHY_CCA_NOM_VAL_9287_2GHZ           -112
-+ #define AR_PHY_CCA_MIN_GOOD_VAL_9287_2GHZ    -127
-+-#define AR_PHY_CCA_MAX_GOOD_VAL_9287_2GHZ    -110
-++#define AR_PHY_CCA_MAX_GOOD_VAL_9287_2GHZ    -97
++--- a/drivers/net/wireless/ath/ath9k/hw.c
+++++ b/drivers/net/wireless/ath/ath9k/hw.c
++@@ -1368,6 +1368,16 @@ static bool ath9k_hw_set_reset(struct at
++ 	if (ath9k_hw_mci_is_enabled(ah))
++ 		ar9003_mci_check_gpm_offset(ah);
++ 
+++	/* DMA HALT added to resolve ar9300 and ar9580 bus error during
+++	 * RTC_RC reg read
+++	 */
+++	if (AR_SREV_9300(ah) || AR_SREV_9580(ah)) {
+++		REG_SET_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
+++		ath9k_hw_wait(ah, AR_CFG, AR_CFG_HALT_ACK, AR_CFG_HALT_ACK,
+++			      20 * AH_WAIT_TIMEOUT);
+++		REG_CLR_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
+++	}
+++
++ 	REG_WRITE(ah, AR_RTC_RC, rst_flags);
++ 
++ 	REGWRITE_BUFFER_FLUSH(ah);
++--- a/drivers/net/wireless/ath/ath9k/reg.h
+++++ b/drivers/net/wireless/ath/ath9k/reg.h
++@@ -34,8 +34,10 @@
++ #define AR_CFG_SWRG          0x00000010
++ #define AR_CFG_AP_ADHOC_INDICATION 0x00000020
++ #define AR_CFG_PHOK          0x00000100
++-#define AR_CFG_CLK_GATE_DIS  0x00000400
++ #define AR_CFG_EEBS          0x00000200
+++#define AR_CFG_CLK_GATE_DIS  0x00000400
+++#define AR_CFG_HALT_REQ	     0x00000800
+++#define AR_CFG_HALT_ACK	     0x00001000
++ #define AR_CFG_PCI_MASTER_REQ_Q_THRESH         0x00060000
++ #define AR_CFG_PCI_MASTER_REQ_Q_THRESH_S       17
 + 
-+ #endif
 diff --git a/package/kernel/mac80211/patches/308-mac80211-minstrel_ht-fix-rounding-issue-in-MCS-durat.patch b/package/kernel/mac80211/patches/308-mac80211-minstrel_ht-fix-rounding-issue-in-MCS-durat.patch
 deleted file mode 100644
 index d132636..0000000
@@ -9227,32 +9634,75 @@ index 945fbce..0000000
 - 
 - 	ah->ani_function = ATH9K_ANI_ALL;
 - 	if (!AR_SREV_9300_20_OR_LATER(ah))
-diff --git a/package/kernel/mac80211/patches/309-mac80211-make-local-tx_headroom-a-multiple-of-4.patch b/package/kernel/mac80211/patches/309-mac80211-make-local-tx_headroom-a-multiple-of-4.patch
+diff --git a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch
 new file mode 100644
-index 0000000..e8e9617
+index 0000000..d9511c8
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/309-mac80211-make-local-tx_headroom-a-multiple-of-4.patch
-@@ -0,0 +1,20 @@
++++ b/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch
+@@ -0,0 +1,19 @@
 +From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 30 Jul 2015 14:12:25 +0200
-+Subject: [PATCH] mac80211: make local->tx_headroom a multiple of 4
++Date: Fri, 15 Jan 2016 15:59:45 +0100
++Subject: [PATCH] brcmfmac: add missing include
 +
-+This ensures that mac80211 generated management frames and beacons are
-+aligned before being passed to the driver
++linux/module.h is required for defining module parameters
 +
 +Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +---
 +
-+--- a/net/mac80211/main.c
-++++ b/net/mac80211/main.c
-+@@ -1031,6 +1031,7 @@ int ieee80211_register_hw(struct ieee802
-+ 	 */
-+ 	local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
-+ 				   IEEE80211_TX_STATUS_HEADROOM);
-++	local->tx_headroom = ALIGN(local->tx_headroom, 4);
-+ 
-+ 	debugfs_hw_add(local);
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++@@ -17,6 +17,7 @@
++ #include <linux/kernel.h>
++ #include <linux/string.h>
++ #include <linux/netdevice.h>
+++#include <linux/module.h>
++ #include <brcmu_wifi.h>
++ #include <brcmu_utils.h>
++ #include "core.h"
+diff --git a/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch b/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
+new file mode 100644
+index 0000000..287d6e1
+--- /dev/null
++++ b/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
+@@ -0,0 +1,38 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Thu, 21 Jan 2016 16:28:44 +0100
++Subject: [PATCH] ath9k_hw: ignore eeprom magic mismatch on flash based devices
++
++Many AR913x based devices (maybe others too) do not have a valid EEPROM
++magic in their calibration data partition.
++
++Fixes: 6fa658fd5ab2 ("ath9k: Simplify and fix eeprom endianness swapping")
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++++ b/drivers/net/wireless/ath/ath9k/eeprom.c
++@@ -150,18 +150,18 @@ int ath9k_hw_nvram_swap_data(struct ath_
++ 		return -EIO;
++ 	}
 + 
++-	if (magic == AR5416_EEPROM_MAGIC) {
++-		*swap_needed = false;
++-	} else if (swab16(magic) == AR5416_EEPROM_MAGIC) {
+++	*swap_needed = false;
+++	if (swab16(magic) == AR5416_EEPROM_MAGIC) {
++ 		if (ah->ah_flags & AH_NO_EEP_SWAP) {
++ 			ath_info(common,
++ 				 "Ignoring endianness difference in EEPROM magic bytes.\n");
++-
++-			*swap_needed = false;
++ 		} else {
++ 			*swap_needed = true;
++ 		}
++-	} else {
+++	} else if (magic != AR5416_EEPROM_MAGIC) {
+++		if (ath9k_hw_use_flash(ah))
+++			return 0;
+++
++ 		ath_err(common,
++ 			"Invalid EEPROM Magic (0x%04x).\n", magic);
++ 		return -EINVAL;
 diff --git a/package/kernel/mac80211/patches/310-mac80211-don-t-look-up-stations-for-multicast-addres.patch b/package/kernel/mac80211/patches/310-mac80211-don-t-look-up-stations-for-multicast-addres.patch
 deleted file mode 100644
 index bd3050e..0000000
@@ -9280,97 +9730,67 @@ index bd3050e..0000000
 - 		tx->sta = sta_info_get(sdata, hdr->addr1);
 - 
 - 	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
-diff --git a/package/kernel/mac80211/patches/310-mac80211-fix-invalid-read-in-minstrel_sort_best_tp_r.patch b/package/kernel/mac80211/patches/310-mac80211-fix-invalid-read-in-minstrel_sort_best_tp_r.patch
+diff --git a/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch b/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch
 new file mode 100644
-index 0000000..51a315c
+index 0000000..070efa9
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/310-mac80211-fix-invalid-read-in-minstrel_sort_best_tp_r.patch
-@@ -0,0 +1,34 @@
-+From: Adrien Schildknecht <adrien+dev@schischi.me>
-+Date: Tue, 28 Jul 2015 10:30:16 +0200
-+Subject: [PATCH] mac80211: fix invalid read in minstrel_sort_best_tp_rates()
-+
-+At the last iteration of the loop, j may equal zero and thus
-+tp_list[j - 1] causes an invalid read.
-+Changed the logic of the loop so that j - 1 is always >= 0.
++++ b/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch
+@@ -0,0 +1,55 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Fri, 22 Jan 2016 01:05:56 +0100
++Subject: [PATCH] ath9k: do not limit the number of DFS interfaces to 1
 +
-+Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +---
 +
-+--- a/net/mac80211/rc80211_minstrel.c
-++++ b/net/mac80211/rc80211_minstrel.c
-+@@ -92,14 +92,15 @@ int minstrel_get_tp_avg(struct minstrel_
-+ static inline void
-+ minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
-+ {
-+-	int j = MAX_THR_RATES;
-+-	struct minstrel_rate_stats *tmp_mrs = &mi->r[j - 1].stats;
-++	int j;
-++	struct minstrel_rate_stats *tmp_mrs;
-+ 	struct minstrel_rate_stats *cur_mrs = &mi->r[i].stats;
-+ 
-+-	while (j > 0 && (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) >
-+-	       minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))) {
-+-		j--;
-++	for (j = MAX_THR_RATES; j > 0; --j) {
-+ 		tmp_mrs = &mi->r[tp_list[j - 1]].stats;
-++		if (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) <=
-++		    minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))
-++			break;
-+ 	}
++--- a/drivers/net/wireless/ath/ath9k/init.c
+++++ b/drivers/net/wireless/ath/ath9k/init.c
++@@ -751,14 +751,6 @@ static const struct ieee80211_iface_comb
 + 
-+ 	if (j < MAX_THR_RATES - 1)
-diff --git a/package/kernel/mac80211/patches/311-brcmfmac-dhd_sdio.c-use-existing-atomic_or-primitive.patch b/package/kernel/mac80211/patches/311-brcmfmac-dhd_sdio.c-use-existing-atomic_or-primitive.patch
-new file mode 100644
-index 0000000..e44f121
---- /dev/null
-+++ b/package/kernel/mac80211/patches/311-brcmfmac-dhd_sdio.c-use-existing-atomic_or-primitive.patch
-@@ -0,0 +1,45 @@
-+From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
-+Date: Thu, 9 Jul 2015 13:43:18 +0530
-+Subject: [PATCH] brcmfmac: dhd_sdio.c: use existing atomic_or primitive
-+
-+There's already a generic implementation so use that instead.
-+
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
-+@@ -2564,15 +2564,6 @@ static inline void brcmf_sdio_clrintr(st
-+ 	}
-+ }
++ #endif /* CPTCFG_ATH9K_CHANNEL_CONTEXT */
 + 
-+-static void atomic_orr(int val, atomic_t *v)
-+-{
-+-	int old_val;
-+-
-+-	old_val = atomic_read(v);
-+-	while (atomic_cmpxchg(v, old_val, val | old_val) != old_val)
-+-		old_val = atomic_read(v);
-+-}
++-static const struct ieee80211_iface_limit if_dfs_limits[] = {
++-	{ .max = 1,	.types = BIT(NL80211_IFTYPE_AP) |
++-#ifdef CPTCFG_MAC80211_MESH
++-				 BIT(NL80211_IFTYPE_MESH_POINT) |
++-#endif
++-				 BIT(NL80211_IFTYPE_ADHOC) },
++-};
 +-
-+ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
-+ {
-+ 	struct brcmf_core *buscore;
-+@@ -2595,7 +2586,7 @@ static int brcmf_sdio_intr_rstatus(struc
-+ 	if (val) {
-+ 		brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
-+ 		bus->sdcnt.f1regdata++;
-+-		atomic_orr(val, &bus->intstatus);
-++		atomic_or(val, &bus->intstatus);
-+ 	}
-+ 
-+ 	return ret;
-+@@ -2712,7 +2703,7 @@ static void brcmf_sdio_dpc(struct brcmf_
-+ 
-+ 	/* Keep still-pending events for next scheduling */
-+ 	if (intstatus)
-+-		atomic_orr(intstatus, &bus->intstatus);
-++		atomic_or(intstatus, &bus->intstatus);
-+ 
-+ 	brcmf_sdio_clrintr(bus);
++ static const struct ieee80211_iface_combination if_comb[] = {
++ 	{
++ 		.limits = if_limits,
++@@ -766,6 +758,11 @@ static const struct ieee80211_iface_comb
++ 		.max_interfaces = 2048,
++ 		.num_different_channels = 1,
++ 		.beacon_int_infra_match = true,
+++#ifdef CPTCFG_ATH9K_DFS_CERTIFIED
+++		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+++					BIT(NL80211_CHAN_WIDTH_20) |
+++					BIT(NL80211_CHAN_WIDTH_40),
+++#endif
++ 	},
++ 	{
++ 		.limits = wds_limits,
++@@ -774,18 +771,6 @@ static const struct ieee80211_iface_comb
++ 		.num_different_channels = 1,
++ 		.beacon_int_infra_match = true,
++ 	},
++-#ifdef CPTCFG_ATH9K_DFS_CERTIFIED
++-	{
++-		.limits = if_dfs_limits,
++-		.n_limits = ARRAY_SIZE(if_dfs_limits),
++-		.max_interfaces = 1,
++-		.num_different_channels = 1,
++-		.beacon_int_infra_match = true,
++-		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
++-					BIT(NL80211_CHAN_WIDTH_20) |
++-					BIT(NL80211_CHAN_WIDTH_40),
++-	}
++-#endif
++ };
 + 
++ #ifdef CPTCFG_ATH9K_CHANNEL_CONTEXT
 diff --git a/package/kernel/mac80211/patches/311-mac80211-remove-drop_unencrypted-code.patch b/package/kernel/mac80211/patches/311-mac80211-remove-drop_unencrypted-code.patch
 deleted file mode 100644
 index b2475b9..0000000
@@ -9507,58 +9927,6 @@ index b2475b9..0000000
 - 
 - 	if (tx->key) {
 - 		bool skip_hw = false;
-diff --git a/package/kernel/mac80211/patches/312-brcmfmac-check-all-combinations-when-setting-wiphy-s.patch b/package/kernel/mac80211/patches/312-brcmfmac-check-all-combinations-when-setting-wiphy-s.patch
-new file mode 100644
-index 0000000..bb27115
---- /dev/null
-+++ b/package/kernel/mac80211/patches/312-brcmfmac-check-all-combinations-when-setting-wiphy-s.patch
-@@ -0,0 +1,46 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Thu, 20 Aug 2015 00:16:42 +0200
-+Subject: [PATCH] brcmfmac: check all combinations when setting wiphy's
-+ addresses
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+Broadcom is working on better reflection of interface combinations. With
-+upcoming patches we may have 1st combination supporting less interfaces
-+than others.
-+To don't run out of addresses check all combinations to find the one
-+with the greatest max_interfaces value.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-+@@ -5786,7 +5786,9 @@ static void brcmf_wiphy_wowl_params(stru
-+ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
-+ {
-+ 	struct brcmf_pub *drvr = ifp->drvr;
-++	const struct ieee80211_iface_combination *combo;
-+ 	struct ieee80211_supported_band *band;
-++	u16 max_interfaces = 0;
-+ 	__le32 bandlist[3];
-+ 	u32 n_bands;
-+ 	int err, i;
-+@@ -5799,8 +5801,13 @@ static int brcmf_setup_wiphy(struct wiph
-+ 	if (err)
-+ 		return err;
-+ 
-+-	for (i = 0; i < wiphy->iface_combinations->max_interfaces &&
-+-	     i < ARRAY_SIZE(drvr->addresses); i++) {
-++	for (i = 0, combo = wiphy->iface_combinations;
-++	     i < wiphy->n_iface_combinations; i++, combo++) {
-++		max_interfaces = max(max_interfaces, combo->max_interfaces);
-++	}
-++
-++	for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
-++	     i++) {
-+ 		u8 *addr = drvr->addresses[i].addr;
-+ 
-+ 		memcpy(addr, drvr->mac, ETH_ALEN);
 diff --git a/package/kernel/mac80211/patches/312-mac80211-don-t-look-up-destination-station-twice.patch b/package/kernel/mac80211/patches/312-mac80211-don-t-look-up-destination-station-twice.patch
 deleted file mode 100644
 index 02a7fab..0000000
@@ -9636,216 +10004,39 @@ index 02a7fab..0000000
 - 		sta = sta_info_get(sdata, hdr.addr1);
 - 		if (sta) {
 - 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-diff --git a/package/kernel/mac80211/patches/313-brcmfmac-correct-interface-combination-info.patch b/package/kernel/mac80211/patches/313-brcmfmac-correct-interface-combination-info.patch
+diff --git a/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch
 new file mode 100644
-index 0000000..baee295
+index 0000000..61cafc7
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/313-brcmfmac-correct-interface-combination-info.patch
-@@ -0,0 +1,204 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Thu, 20 Aug 2015 22:06:03 +0200
-+Subject: [PATCH] brcmfmac: correct interface combination info
-+
-+The interface combination provided by brcmfmac did not truly reflect
-+the combinations supported by driver and/or firmware.
++++ b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch
+@@ -0,0 +1,27 @@
++From: Michal Kazior <michal.kazior@tieto.com>
++Date: Thu, 21 Jan 2016 14:23:07 +0100
++Subject: [PATCH] mac80211: fix txq queue related crashes
 +
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++The driver can access the queue simultanously
++while mac80211 tears down the interface. Without
++spinlock protection this could lead to corrupting
++sk_buff_head and subsequently to an invalid
++pointer dereference.
++
++Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation")
++Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-+@@ -5695,63 +5695,132 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
-+ 	}
-+ };
-+ 
-++/**
-++ * brcmf_setup_ifmodes() - determine interface modes and combinations.
-++ *
-++ * @wiphy: wiphy object.
-++ * @ifp: interface object needed for feat module api.
-++ *
-++ * The interface modes and combinations are determined dynamically here
-++ * based on firmware functionality.
-++ *
-++ * no p2p and no mbss:
-++ *
-++ *	#STA <= 1, #AP <= 1, channels = 1, 2 total
-++ *
-++ * no p2p and mbss:
-++ *
-++ *	#STA <= 1, #AP <= 1, channels = 1, 2 total
-++ *	#AP <= 4, matching BI, channels = 1, 4 total
-++ *
-++ * p2p, no mchan, and mbss:
-++ *
-++ *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
-++ *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
-++ *	#AP <= 4, matching BI, channels = 1, 4 total
-++ *
-++ * p2p, mchan, and mbss:
-++ *
-++ *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
-++ *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
-++ *	#AP <= 4, matching BI, channels = 1, 4 total
-++ */
-+ static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
-+ {
-+ 	struct ieee80211_iface_combination *combo = NULL;
-+-	struct ieee80211_iface_limit *limits = NULL;
-+-	int i = 0, max_iface_cnt;
-++	struct ieee80211_iface_limit *c0_limits = NULL;
-++	struct ieee80211_iface_limit *p2p_limits = NULL;
-++	struct ieee80211_iface_limit *mbss_limits = NULL;
-++	bool mbss, p2p;
-++	int i, c, n_combos;
-+ 
-+-	combo = kzalloc(sizeof(*combo), GFP_KERNEL);
-++	mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
-++	p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
-++
-++	n_combos = 1 + !!p2p + !!mbss;
-++	combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
-+ 	if (!combo)
-+ 		goto err;
-+ 
-+-	limits = kzalloc(sizeof(*limits) * 4, GFP_KERNEL);
-+-	if (!limits)
-++	c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
-++	if (!c0_limits)
-+ 		goto err;
-+ 
-++	if (p2p) {
-++		p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
-++		if (!p2p_limits)
-++			goto err;
-++	}
-++
-++	if (mbss) {
-++		mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
-++		if (!mbss_limits)
-++			goto err;
-++	}
-++
-+ 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
-+ 				 BIT(NL80211_IFTYPE_ADHOC) |
-+ 				 BIT(NL80211_IFTYPE_AP);
-+ 
-+-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
-+-		combo->num_different_channels = 2;
-+-	else
-+-		combo->num_different_channels = 1;
-+-
-+-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
-+-		limits[i].max = 1;
-+-		limits[i++].types = BIT(NL80211_IFTYPE_STATION);
-+-		limits[i].max = 4;
-+-		limits[i++].types = BIT(NL80211_IFTYPE_AP);
-+-		max_iface_cnt = 5;
-+-	} else {
-+-		limits[i].max = 2;
-+-		limits[i++].types = BIT(NL80211_IFTYPE_STATION) |
-+-				    BIT(NL80211_IFTYPE_AP);
-+-		max_iface_cnt = 2;
-+-	}
-+-
-+-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P)) {
-++	c = 0;
-++	i = 0;
-++	combo[c].num_different_channels = 1;
-++	c0_limits[i].max = 1;
-++	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
-++	if (p2p) {
-++		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
-++			combo[c].num_different_channels = 2;
-+ 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
-+ 					  BIT(NL80211_IFTYPE_P2P_GO) |
-+ 					  BIT(NL80211_IFTYPE_P2P_DEVICE);
-+-		limits[i].max = 1;
-+-		limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
-+-				    BIT(NL80211_IFTYPE_P2P_GO);
-+-		limits[i].max = 1;
-+-		limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
-+-		max_iface_cnt += 2;
-+-	}
-+-	combo->max_interfaces = max_iface_cnt;
-+-	combo->limits = limits;
-+-	combo->n_limits = i;
-++		c0_limits[i].max = 1;
-++		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
-++		c0_limits[i].max = 1;
-++		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
-++				       BIT(NL80211_IFTYPE_P2P_GO);
-++	} else {
-++		c0_limits[i].max = 1;
-++		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
-++	}
-++	combo[c].max_interfaces = i;
-++	combo[c].n_limits = i;
-++	combo[c].limits = c0_limits;
-++
-++	if (p2p) {
-++		c++;
-++		i = 0;
-++		combo[c].num_different_channels = 1;
-++		p2p_limits[i].max = 1;
-++		p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
-++		p2p_limits[i].max = 1;
-++		p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
-++		p2p_limits[i].max = 1;
-++		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
-++		p2p_limits[i].max = 1;
-++		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
-++		combo[c].max_interfaces = i;
-++		combo[c].n_limits = i;
-++		combo[c].limits = p2p_limits;
-++	}
-+ 
-++	if (mbss) {
-++		c++;
-++		combo[c].beacon_int_infra_match = true;
-++		combo[c].num_different_channels = 1;
-++		mbss_limits[0].max = 4;
-++		mbss_limits[0].types = BIT(NL80211_IFTYPE_AP);
-++		combo[c].max_interfaces = 4;
-++		combo[c].n_limits = 1;
-++		combo[c].limits = mbss_limits;
-++	}
-++	wiphy->n_iface_combinations = n_combos;
-+ 	wiphy->iface_combinations = combo;
-+-	wiphy->n_iface_combinations = 1;
-+ 	return 0;
-+ 
-+ err:
-+-	kfree(limits);
-++	kfree(c0_limits);
-++	kfree(p2p_limits);
-++	kfree(mbss_limits);
-+ 	kfree(combo);
-+ 	return -ENOMEM;
-+ }
-+@@ -6080,11 +6149,15 @@ static void brcmf_cfg80211_reg_notifier(
-+ 
-+ static void brcmf_free_wiphy(struct wiphy *wiphy)
-+ {
-++	int i;
++--- a/net/mac80211/iface.c
+++++ b/net/mac80211/iface.c
++@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct iee
++ 	if (sdata->vif.txq) {
++ 		struct txq_info *txqi = to_txq_info(sdata->vif.txq);
++ 
+++		spin_lock_bh(&txqi->queue.lock);
++ 		ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
+++		spin_unlock_bh(&txqi->queue.lock);
 ++
-+ 	if (!wiphy)
-+ 		return;
++ 		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
++ 	}
 + 
-+-	if (wiphy->iface_combinations)
-+-		kfree(wiphy->iface_combinations->limits);
-++	if (wiphy->iface_combinations) {
-++		for (i = 0; i < wiphy->n_iface_combinations; i++)
-++			kfree(wiphy->iface_combinations[i].limits);
-++	}
-+ 	kfree(wiphy->iface_combinations);
-+ 	if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
-+ 		kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
 diff --git a/package/kernel/mac80211/patches/313-mac80211-drop-4-addr-VLAN-frames-earlier-if-not-conn.patch b/package/kernel/mac80211/patches/313-mac80211-drop-4-addr-VLAN-frames-earlier-if-not-conn.patch
 deleted file mode 100644
 index 4125351..0000000
@@ -9879,99 +10070,178 @@ index 4125351..0000000
 - 		}
 - 		ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
 - 					u.ap);
-diff --git a/package/kernel/mac80211/patches/314-brcmfmac-add-debugfs-entry-for-msgbuf-statistics.patch b/package/kernel/mac80211/patches/314-brcmfmac-add-debugfs-entry-for-msgbuf-statistics.patch
+diff --git a/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch
 new file mode 100644
-index 0000000..9768ef2
+index 0000000..844d43b
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/314-brcmfmac-add-debugfs-entry-for-msgbuf-statistics.patch
-@@ -0,0 +1,87 @@
-+From: Franky Lin <frankyl@broadcom.com>
-+Date: Thu, 20 Aug 2015 22:06:04 +0200
-+Subject: [PATCH] brcmfmac: add debugfs entry for msgbuf statistics
++++ b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch
+@@ -0,0 +1,57 @@
++From: Michal Kazior <michal.kazior@tieto.com>
++Date: Mon, 25 Jan 2016 14:43:24 +0100
++Subject: [PATCH] mac80211: fix unnecessary frame drops in mesh fwding
 +
-+Expose ring buffer read/write pointers and other useful statistics
-+through debugfs.
++The ieee80211_queue_stopped() expects hw queue
++number but it was given raw WMM AC number instead.
 +
-+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Franky Lin <frankyl@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++This could cause frame drops and problems with
++traffic in some cases - most notably if driver
++doesn't map AC numbers to queue numbers 1:1 and
++uses ieee80211_stop_queues() and
++ieee80211_wake_queue() only without ever calling
++ieee80211_wake_queues().
++
++On ath10k it was possible to hit this problem in
++the following case:
++
++  1. wlan0 uses queue 0
++     (ath10k maps queues per vif)
++  2. offchannel uses queue 15
++  3. queues 1-14 are unused
++  4. ieee80211_stop_queues()
++  5. ieee80211_wake_queue(q=0)
++  6. ieee80211_wake_queue(q=15)
++     (other queues are not woken up because both
++      driver and mac80211 know other queues are
++      unused)
++  7. ieee80211_rx_h_mesh_fwding()
++  8. ieee80211_select_queue_80211() returns 2
++  9. ieee80211_queue_stopped(q=2) returns true
++ 10. frame is dropped (oops!)
++
++Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
++Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
++---
++
++--- a/net/mac80211/rx.c
+++++ b/net/mac80211/rx.c
++@@ -2235,7 +2235,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
++ 	struct ieee80211_local *local = rx->local;
++ 	struct ieee80211_sub_if_data *sdata = rx->sdata;
++ 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++-	u16 q, hdrlen;
+++	u16 ac, q, hdrlen;
++ 
++ 	hdr = (struct ieee80211_hdr *) skb->data;
++ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++@@ -2304,7 +2304,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
++ 	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
++ 		return RX_CONTINUE;
++ 
++-	q = ieee80211_select_queue_80211(sdata, skb, hdr);
+++	ac = ieee80211_select_queue_80211(sdata, skb, hdr);
+++	q = sdata->vif.hw_queue[ac];
++ 	if (ieee80211_queue_stopped(&local->hw, q)) {
++ 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
++ 		return RX_DROP_MONITOR;
+diff --git a/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch
+new file mode 100644
+index 0000000..5b3efbd
+--- /dev/null
++++ b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch
+@@ -0,0 +1,103 @@
++From: Sachin Kulkarni <Sachin.Kulkarni@imgtec.com>
++Date: Tue, 12 Jan 2016 14:30:19 +0530
++Subject: [PATCH] mac80211: Requeue work after scan complete for all VIF
++ types.
++
++During a sw scan ieee80211_iface_work ignores work items for all vifs.
++However after the scan complete work is requeued only for STA, ADHOC
++and MESH iftypes.
++
++This occasionally results in event processing getting delayed/not
++processed for iftype AP when it coexists with a STA. This can result
++in data halt and eventually disconnection on the AP interface.
++
++Signed-off-by: Sachin Kulkarni <Sachin.Kulkarni@imgtec.com>
++Cc: linux-wireless@vger.kernel.org
++Cc: johannes@sipsolutions.net
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-+@@ -1360,6 +1360,60 @@ void brcmf_msgbuf_delete_flowring(struct
++--- a/net/mac80211/ibss.c
+++++ b/net/mac80211/ibss.c
++@@ -1731,7 +1731,6 @@ void ieee80211_ibss_notify_scan_complete
++ 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
++ 			continue;
++ 		sdata->u.ibss.last_scan_completed = jiffies;
++-		ieee80211_queue_work(&local->hw, &sdata->work);
 + 	}
++ 	mutex_unlock(&local->iflist_mtx);
++ }
++--- a/net/mac80211/mesh.c
+++++ b/net/mac80211/mesh.c
++@@ -1369,17 +1369,6 @@ out:
++ 	sdata_unlock(sdata);
 + }
 + 
-++#ifdef DEBUG
-++static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
-++{
-++	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
-++	struct brcmf_pub *drvr = bus_if->drvr;
-++	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
-++	struct brcmf_commonring *commonring;
-++	u16 i;
-++	struct brcmf_flowring_ring *ring;
-++	struct brcmf_flowring_hash *hash;
-++
-++	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
-++	seq_printf(seq, "h2d_ctl_submit: rp %4u, wp %4u, depth %4u\n",
-++		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
-++	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
-++	seq_printf(seq, "h2d_rx_submit:  rp %4u, wp %4u, depth %4u\n",
-++		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
-++	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
-++	seq_printf(seq, "d2h_ctl_cmplt:  rp %4u, wp %4u, depth %4u\n",
-++		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
-++	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
-++	seq_printf(seq, "d2h_tx_cmplt:   rp %4u, wp %4u, depth %4u\n",
-++		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
-++	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
-++	seq_printf(seq, "d2h_rx_cmplt:   rp %4u, wp %4u, depth %4u\n",
-++		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
-++
-++	seq_printf(seq, "\nh2d_flowrings: depth %u\n",
-++		   BRCMF_H2D_TXFLOWRING_MAX_ITEM);
-++	seq_puts(seq, "Active flowrings:\n");
-++	hash = msgbuf->flow->hash;
-++	for (i = 0; i < msgbuf->flow->nrofrings; i++) {
-++		if (!msgbuf->flow->rings[i])
-++			continue;
-++		ring = msgbuf->flow->rings[i];
-++		if (ring->status != RING_OPEN)
-++			continue;
-++		commonring = msgbuf->flowrings[i];
-++		hash = &msgbuf->flow->hash[ring->hash_id];
-++		seq_printf(seq, "id %3u: rp %4u, wp %4u, qlen %4u, blocked %u\n"
-++				"        ifidx %u, fifo %u, da %pM\n",
-++				i, commonring->r_ptr, commonring->w_ptr,
-++				skb_queue_len(&ring->skblist), ring->blocked,
-++				hash->ifidx, hash->fifo, hash->mac);
-++	}
-++
-++	return 0;
-++}
-++#else
-++static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
-++{
-++	return 0;
-++}
-++#endif
++-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
++-{
++-	struct ieee80211_sub_if_data *sdata;
++-
++-	rcu_read_lock();
++-	list_for_each_entry_rcu(sdata, &local->interfaces, list)
++-		if (ieee80211_vif_is_mesh(&sdata->vif) &&
++-		    ieee80211_sdata_running(sdata))
++-			ieee80211_queue_work(&local->hw, &sdata->work);
++-	rcu_read_unlock();
++-}
 + 
-+ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
++ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 + {
-+@@ -1460,6 +1514,8 @@ int brcmf_proto_msgbuf_attach(struct brc
-+ 	spin_lock_init(&msgbuf->flowring_work_lock);
-+ 	INIT_LIST_HEAD(&msgbuf->work_queue);
++--- a/net/mac80211/mesh.h
+++++ b/net/mac80211/mesh.h
++@@ -362,14 +362,10 @@ static inline bool mesh_path_sel_is_hwmp
++ 	return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
++ }
 + 
-++	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
-++
-+ 	return 0;
++-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
++-
++ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
++ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
++ void ieee80211s_stop(void);
++ #else
++-static inline void
++-ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
++ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
++ { return false; }
++ static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
++--- a/net/mac80211/mlme.c
+++++ b/net/mac80211/mlme.c
++@@ -3978,8 +3978,6 @@ static void ieee80211_restart_sta_timer(
++ 		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
++ 			ieee80211_queue_work(&sdata->local->hw,
++ 					     &sdata->u.mgd.monitor_work);
++-		/* and do all the other regular work too */
++-		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
++ 	}
++ }
++ 
++--- a/net/mac80211/scan.c
+++++ b/net/mac80211/scan.c
++@@ -314,6 +314,7 @@ static void __ieee80211_scan_completed(s
++ 	bool was_scanning = local->scanning;
++ 	struct cfg80211_scan_request *scan_req;
++ 	struct ieee80211_sub_if_data *scan_sdata;
+++	struct ieee80211_sub_if_data *sdata;
++ 
++ 	lockdep_assert_held(&local->mtx);
++ 
++@@ -373,7 +374,15 @@ static void __ieee80211_scan_completed(s
 + 
-+ fail:
++ 	ieee80211_mlme_notify_scan_completed(local);
++ 	ieee80211_ibss_notify_scan_completed(local);
++-	ieee80211_mesh_notify_scan_completed(local);
+++
+++	/* Requeue all the work that might have been ignored while
+++	 * the scan was in progress
+++	 */
+++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+++		if (ieee80211_sdata_running(sdata))
+++			ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+++	}
+++
++ 	if (was_scanning)
++ 		ieee80211_start_next_roc(local);
++ }
 diff --git a/package/kernel/mac80211/patches/314-mac80211-mesh-avoid-pointless-station-lookup.patch b/package/kernel/mac80211/patches/314-mac80211-mesh-avoid-pointless-station-lookup.patch
 deleted file mode 100644
 index 9105a64..0000000
@@ -10011,95 +10281,6 @@ index 9105a64..0000000
 - 		sta = sta_info_get(sdata, hdr.addr1);
 - 		if (sta) {
 - 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-diff --git a/package/kernel/mac80211/patches/315-brcmfmac-make-use-of-cfg80211_check_combinations.patch b/package/kernel/mac80211/patches/315-brcmfmac-make-use-of-cfg80211_check_combinations.patch
-new file mode 100644
-index 0000000..281f02b
---- /dev/null
-+++ b/package/kernel/mac80211/patches/315-brcmfmac-make-use-of-cfg80211_check_combinations.patch
-@@ -0,0 +1,83 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Thu, 20 Aug 2015 22:06:05 +0200
-+Subject: [PATCH] brcmfmac: make use of cfg80211_check_combinations()
-+
-+Use cfg80211_check_combinations() so we can bail out early when an
-+interface add or change results in an invalid combination.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-+@@ -469,6 +469,36 @@ brcmf_find_wpsie(const u8 *parse, u32 le
-+ 	return NULL;
-+ }
-+ 
-++static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
-++				     struct brcmf_cfg80211_vif *vif,
-++				     enum nl80211_iftype new_type)
-++{
-++	int iftype_num[NUM_NL80211_IFTYPES];
-++	struct brcmf_cfg80211_vif *pos;
-++
-++	memset(&iftype_num[0], 0, sizeof(iftype_num));
-++	list_for_each_entry(pos, &cfg->vif_list, list)
-++		if (pos == vif)
-++			iftype_num[new_type]++;
-++		else
-++			iftype_num[pos->wdev.iftype]++;
-++
-++	return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
-++}
-++
-++static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
-++				  enum nl80211_iftype new_type)
-++{
-++	int iftype_num[NUM_NL80211_IFTYPES];
-++	struct brcmf_cfg80211_vif *pos;
-++
-++	memset(&iftype_num[0], 0, sizeof(iftype_num));
-++	list_for_each_entry(pos, &cfg->vif_list, list)
-++		iftype_num[pos->wdev.iftype]++;
-++
-++	iftype_num[new_type]++;
-++	return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
-++}
-+ 
-+ static void convert_key_from_CPU(struct brcmf_wsec_key *key,
-+ 				 struct brcmf_wsec_key_le *key_le)
-+@@ -663,8 +693,14 @@ static struct wireless_dev *brcmf_cfg802
-+ 						     struct vif_params *params)
-+ {
-+ 	struct wireless_dev *wdev;
-++	int err;
-+ 
-+ 	brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
-++	err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
-++	if (err) {
-++		brcmf_err("iface validation failed: err=%d\n", err);
-++		return ERR_PTR(err);
-++	}
-+ 	switch (type) {
-+ 	case NL80211_IFTYPE_ADHOC:
-+ 	case NL80211_IFTYPE_STATION:
-+@@ -823,8 +859,12 @@ brcmf_cfg80211_change_iface(struct wiphy
-+ 	s32 ap = 0;
-+ 	s32 err = 0;
-+ 
-+-	brcmf_dbg(TRACE, "Enter, ndev=%p, type=%d\n", ndev, type);
-+-
-++	brcmf_dbg(TRACE, "Enter, idx=%d, type=%d\n", ifp->bssidx, type);
-++	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
-++	if (err) {
-++		brcmf_err("iface validation failed: err=%d\n", err);
-++		return err;
-++	}
-+ 	switch (type) {
-+ 	case NL80211_IFTYPE_MONITOR:
-+ 	case NL80211_IFTYPE_WDS:
 diff --git a/package/kernel/mac80211/patches/315-mac80211-avoid-duplicate-TX-path-station-lookup.patch b/package/kernel/mac80211/patches/315-mac80211-avoid-duplicate-TX-path-station-lookup.patch
 deleted file mode 100644
 index d143025..0000000
@@ -10373,60 +10554,69 @@ index d143025..0000000
 -+	ieee80211_xmit(sdata, NULL, skb);
 - 	local_bh_enable();
 - }
-diff --git a/package/kernel/mac80211/patches/316-brcmfmac-block-the-correct-flowring-when-backup-queu.patch b/package/kernel/mac80211/patches/316-brcmfmac-block-the-correct-flowring-when-backup-queu.patch
+diff --git a/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch
 new file mode 100644
-index 0000000..2d5f7b9
+index 0000000..52fecb9
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/316-brcmfmac-block-the-correct-flowring-when-backup-queu.patch
-@@ -0,0 +1,48 @@
-+From: Franky Lin <frankyl@broadcom.com>
-+Date: Thu, 20 Aug 2015 22:06:06 +0200
-+Subject: [PATCH] brcmfmac: block the correct flowring when backup queue
-+ overflow
-+
-+brcmf_flowring_block blocks the last active flowring under the same
-+interface instead of the one provided by caller. This could lead to a
-+dead lock of netif stop if there are more than one flowring under the
-+interface and the traffic is high enough so brcmf_flowring_enqueue can
-+not unblock the ring right away.
++++ b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch
+@@ -0,0 +1,57 @@
++From: Sara Sharon <sara.sharon@intel.com>
++Date: Mon, 25 Jan 2016 15:46:35 +0200
++Subject: [PATCH] mac80211: fix ibss scan parameters
 +
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Signed-off-by: Franky Lin <frankyl@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++When joining IBSS a full scan should be initiated in order to search
++for existing cell, unless the fixed_channel parameter was set.
++A default channel to create the IBSS on if no cell was found is
++provided as well.
++However - a scan is initiated only on the default channel provided
++regardless of whether ifibss->fixed_channel is set or not, with the
++obvious result of the cell not joining existing IBSS cell that is
++on another channel.
++
++Fixes: 76bed0f43b27 ("mac80211: IBSS fix scan request")
++Signed-off-by: Sara Sharon <sara.sharon@intel.com>
++Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
-+@@ -194,11 +194,15 @@ static void brcmf_flowring_block(struct
-+ 	spin_lock_irqsave(&flow->block_lock, flags);
++--- a/net/mac80211/ibss.c
+++++ b/net/mac80211/ibss.c
++@@ -7,6 +7,7 @@
++  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
++  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
++  * Copyright 2013-2014  Intel Mobile Communications GmbH
+++ * Copyright(c) 2016 Intel Deutschland GmbH
++  *
++  * This program is free software; you can redistribute it and/or modify
++  * it under the terms of the GNU General Public License version 2 as
++@@ -1483,14 +1484,21 @@ static void ieee80211_sta_find_ibss(stru
++ 
++ 		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
++ 
++-		num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
++-							 &ifibss->chandef,
++-							 channels,
++-							 ARRAY_SIZE(channels));
++ 		scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
++-		ieee80211_request_ibss_scan(sdata, ifibss->ssid,
++-					    ifibss->ssid_len, channels, num,
++-					    scan_width);
+++
+++		if (ifibss->fixed_channel) {
+++			num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
+++								 &ifibss->chandef,
+++								 channels,
+++								 ARRAY_SIZE(channels));
+++			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
+++						    ifibss->ssid_len, channels,
+++						    num, scan_width);
+++		} else {
+++			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
+++						    ifibss->ssid_len, NULL,
+++						    0, scan_width);
+++		}
++ 	} else {
++ 		int interval = IEEE80211_SCAN_INTERVAL;
 + 
-+ 	ring = flow->rings[flowid];
-++	if (ring->blocked == blocked) {
-++		spin_unlock_irqrestore(&flow->block_lock, flags);
-++		return;
-++	}
-+ 	ifidx = brcmf_flowring_ifidx_get(flow, flowid);
-+ 
-+ 	currently_blocked = false;
-+ 	for (i = 0; i < flow->nrofrings; i++) {
-+-		if (flow->rings[i]) {
-++		if ((flow->rings[i]) && (i != flowid)) {
-+ 			ring = flow->rings[i];
-+ 			if ((ring->status == RING_OPEN) &&
-+ 			    (brcmf_flowring_ifidx_get(flow, i) == ifidx)) {
-+@@ -209,8 +213,8 @@ static void brcmf_flowring_block(struct
-+ 			}
-+ 		}
-+ 	}
-+-	ring->blocked = blocked;
-+-	if (currently_blocked == blocked) {
-++	flow->rings[flowid]->blocked = blocked;
-++	if (currently_blocked) {
-+ 		spin_unlock_irqrestore(&flow->block_lock, flags);
-+ 		return;
-+ 	}
 diff --git a/package/kernel/mac80211/patches/316-mac80211-reduce-log-spam-from-ieee80211_handle_pwr_c.patch b/package/kernel/mac80211/patches/316-mac80211-reduce-log-spam-from-ieee80211_handle_pwr_c.patch
 deleted file mode 100644
 index 77a82c2..0000000
@@ -10471,6 +10661,62 @@ index 77a82c2..0000000
 - 		new_ap_level = pwr_level_cisco;
 - 	}
 - 
+diff --git a/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch
+new file mode 100644
+index 0000000..e78df36
+--- /dev/null
++++ b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch
+@@ -0,0 +1,50 @@
++From: Chris Bainbridge <chris.bainbridge@gmail.com>
++Date: Wed, 27 Jan 2016 15:46:18 +0000
++Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values
++
++Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes:
++
++[    7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
++[    7.976608] load of value 2 is not a valid value for type '_Bool'
++[    7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
++[    7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015
++[    7.976616] Workqueue: phy0 rt2x00usb_work_rxdone
++[    7.976619]  0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
++[    7.976622]  ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
++[    7.976626]  ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
++[    7.976629] Call Trace:
++[    7.976633]  [<ffffffff8181d866>] dump_stack+0x45/0x5f
++[    7.976637]  [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
++[    7.976642]  [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
++[    7.976646]  [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
++[    7.976650]  [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
++[    7.976654]  [<ffffffff81cb27ce>] ? usb_hcd_map_urb_for_dma+0x65e/0x960
++[    7.976659]  [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
++[    7.976663]  [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990
++[    7.976667]  [<ffffffff81c5fb85>] rt2x00lib_rxdone+0x305/0xbd0
++[    7.976670]  [<ffffffff811ac23f>] ? dequeue_task_fair+0x64f/0x1de0
++[    7.976674]  [<ffffffff811a1516>] ? sched_clock_cpu+0xe6/0x150
++[    7.976678]  [<ffffffff81c6c45c>] rt2x00usb_work_rxdone+0x7c/0x140
++[    7.976682]  [<ffffffff8117aef6>] process_one_work+0x226/0x860
++[    7.976686]  [<ffffffff8117b58c>] worker_thread+0x5c/0x680
++[    7.976690]  [<ffffffff8117b530>] ? process_one_work+0x860/0x860
++[    7.976693]  [<ffffffff81184f86>] kthread+0xf6/0x150
++[    7.976697]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
++[    7.976700]  [<ffffffff822a94df>] ret_from_fork+0x3f/0x70
++[    7.976703]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
++
++Link: https://lkml.org/lkml/2016/1/26/230
++Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
++---
++
++--- a/net/mac80211/agg-rx.c
+++++ b/net/mac80211/agg-rx.c
++@@ -327,7 +327,7 @@ void __ieee80211_start_rx_ba_session(str
++ 	}
++ 
++ 	/* prepare A-MPDU MLME for Rx aggregation */
++-	tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
+++	tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
++ 	if (!tid_agg_rx)
++ 		goto end;
++ 
 diff --git a/package/kernel/mac80211/patches/317-brcmfmac-Fix-race-condition-in-msgbuf-ioctl-processi.patch b/package/kernel/mac80211/patches/317-brcmfmac-Fix-race-condition-in-msgbuf-ioctl-processi.patch
 deleted file mode 100644
 index e005fe7..0000000
@@ -10512,64 +10758,57 @@ index e005fe7..0000000
 - }
 - 
 - 
-diff --git a/package/kernel/mac80211/patches/317-brcmfmac-bump-highest-event-number-for-4339-firmware.patch b/package/kernel/mac80211/patches/317-brcmfmac-bump-highest-event-number-for-4339-firmware.patch
+diff --git a/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch b/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch
 new file mode 100644
-index 0000000..7378401
+index 0000000..5bf53b9
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/317-brcmfmac-bump-highest-event-number-for-4339-firmware.patch
-@@ -0,0 +1,52 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Thu, 20 Aug 2015 22:06:07 +0200
-+Subject: [PATCH] brcmfmac: bump highest event number for 4339 firmware
-+
-+The event mask length is determined by the highest event number
-+that is specified in the driver. When this length is shorter than
-+firmware expects setting event mask will fail and device becomes
-+pretty useless. This issue was reported with bcm4339 firmware that
-+was recently released.
-+
-+Reported-by: Pontus Fuchs <pontusf@broadcom.com>
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++++ b/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch
+@@ -0,0 +1,45 @@
++From: Konstantin Khlebnikov <koct9i@gmail.com>
++Date: Fri, 29 Jan 2016 11:35:12 +0300
++Subject: [PATCH] mac80211: minstrel_ht: fix out-of-bound in
++ minstrel_ht_set_best_prob_rate
++
++Patch fixes this splat
++
++BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
++[mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
++
++Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
++Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
-+@@ -85,7 +85,6 @@ struct brcmf_event;
-+ 	BRCMF_ENUM_DEF(IF, 54) \
-+ 	BRCMF_ENUM_DEF(P2P_DISC_LISTEN_COMPLETE, 55) \
-+ 	BRCMF_ENUM_DEF(RSSI, 56) \
-+-	BRCMF_ENUM_DEF(PFN_SCAN_COMPLETE, 57) \
-+ 	BRCMF_ENUM_DEF(EXTLOG_MSG, 58) \
-+ 	BRCMF_ENUM_DEF(ACTION_FRAME, 59) \
-+ 	BRCMF_ENUM_DEF(ACTION_FRAME_COMPLETE, 60) \
-+@@ -103,8 +102,7 @@ struct brcmf_event;
-+ 	BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
-+ 	BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
-+ 	BRCMF_ENUM_DEF(TDLS_PEER_EVENT, 92) \
-+-	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
-+-	BRCMF_ENUM_DEF(PSTA_PRIMARY_INTF_IND, 128)
-++	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
-+ 
-+ #define BRCMF_ENUM_DEF(id, val) \
-+ 	BRCMF_E_##id = (val),
-+@@ -112,7 +110,11 @@ struct brcmf_event;
-+ /* firmware event codes sent by the dongle */
-+ enum brcmf_fweh_event_code {
-+ 	BRCMF_FWEH_EVENT_ENUM_DEFLIST
-+-	BRCMF_E_LAST
-++	/* this determines event mask length which must match
-++	 * minimum length check in device firmware so it is
-++	 * hard-coded here.
-++	 */
-++	BRCMF_E_LAST = 139
-+ };
-+ #undef BRCMF_ENUM_DEF
++--- a/net/mac80211/rc80211_minstrel_ht.c
+++++ b/net/mac80211/rc80211_minstrel_ht.c
++@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct mi
++ 	    (max_tp_group != MINSTREL_CCK_GROUP))
++ 		return;
 + 
+++	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
+++	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
+++	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
+++
++ 	if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
++ 		cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
++ 						    mrs->prob_ewma);
++ 		if (cur_tp_avg > tmp_tp_avg)
++ 			mi->max_prob_rate = index;
++ 
++-		max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
++-		max_gpr_idx = mg->max_group_prob_rate %	MCS_GROUP_RATES;
++-		max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
++ 		max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
++ 							max_gpr_idx,
++ 							max_gpr_prob);
++@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct mi
++ 	} else {
++ 		if (mrs->prob_ewma > tmp_prob)
++ 			mi->max_prob_rate = index;
++-		if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
+++		if (mrs->prob_ewma > max_gpr_prob)
++ 			mg->max_group_prob_rate = index;
++ 	}
++ }
 diff --git a/package/kernel/mac80211/patches/318-brcmfmac-Update-msgbuf-commonring-size-for-improved-.patch b/package/kernel/mac80211/patches/318-brcmfmac-Update-msgbuf-commonring-size-for-improved-.patch
 deleted file mode 100644
 index c2cd1c5..0000000
@@ -10606,6 +10845,47 @@ index c2cd1c5..0000000
 - #define BRCMF_H2D_TXFLOWRING_MAX_ITEM			512
 - 
 - #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE	40
+diff --git a/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch b/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch
+new file mode 100644
+index 0000000..655dc4b
+--- /dev/null
++++ b/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch
+@@ -0,0 +1,35 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Tue, 2 Feb 2016 14:39:08 +0100
++Subject: [PATCH] mac80211: move A-MSDU skb_linearize call to
++ ieee80211_amsdu_to_8023s
++
++Prepararation for zero-copy A-MSDU support with page fragment SKBs
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
++---
++
++--- a/net/mac80211/rx.c
+++++ b/net/mac80211/rx.c
++@@ -2203,9 +2203,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
++ 	skb->dev = dev;
++ 	__skb_queue_head_init(&frame_list);
++ 
++-	if (skb_linearize(skb))
++-		return RX_DROP_UNUSABLE;
++-
++ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
++ 				 rx->sdata->vif.type,
++ 				 rx->local->hw.extra_tx_headroom, true);
++--- a/net/wireless/util.c
+++++ b/net/wireless/util.c
++@@ -657,6 +657,9 @@ void ieee80211_amsdu_to_8023s(struct sk_
++ 	int remaining, err;
++ 	u8 dst[ETH_ALEN], src[ETH_ALEN];
++ 
+++	if (skb_linearize(skb))
+++		goto out;
+++
++ 	if (has_80211_header) {
++ 		err = ieee80211_data_to_8023(skb, addr, iftype);
++ 		if (err)
 diff --git a/package/kernel/mac80211/patches/319-ath9k_htc-add-new-WMI_REG_RMW_CMDID-command.patch b/package/kernel/mac80211/patches/319-ath9k_htc-add-new-WMI_REG_RMW_CMDID-command.patch
 deleted file mode 100644
 index 6af69eb..0000000
@@ -10919,150 +11199,198 @@ index 6af69eb..0000000
 - };
 - 
 - struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv);
-diff --git a/package/kernel/mac80211/patches/319-brcmfmac-consolidate-ifp-lookup-in-driver-core.patch b/package/kernel/mac80211/patches/319-brcmfmac-consolidate-ifp-lookup-in-driver-core.patch
+diff --git a/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch b/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch
 new file mode 100644
-index 0000000..97444b3
+index 0000000..b646ab3
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/319-brcmfmac-consolidate-ifp-lookup-in-driver-core.patch
-@@ -0,0 +1,138 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:53 +0200
-+Subject: [PATCH] brcmfmac: consolidate ifp lookup in driver core
-+
-+In rx path the firmware provide an interface index which is used to
-+map to a struct brcmf_if instance. However, this involves some trick
-+that is done in two places. This is changed by having driver core
-+providing brcmf_get_ifp() function.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++++ b/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch
+@@ -0,0 +1,186 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Tue, 2 Feb 2016 14:39:09 +0100
++Subject: [PATCH] cfg80211: add function for 802.3 conversion with separate
++ output buffer
++
++Use skb_copy_bits in preparation for allowing fragmented skbs
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
-+@@ -276,6 +276,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-+ 			 struct sk_buff *pktbuf)
++--- a/net/wireless/util.c
+++++ b/net/wireless/util.c
++@@ -393,9 +393,9 @@ unsigned int ieee80211_get_hdrlen_from_s
++ }
++ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
++ 
++-unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+++static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
 + {
-+ 	struct brcmf_proto_bcdc_header *h;
-++	struct brcmf_if *ifp;
-+ 
-+ 	brcmf_dbg(BCDC, "Enter\n");
-+ 
-+@@ -289,30 +290,21 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-+ 	trace_brcmf_bcdchdr(pktbuf->data);
-+ 	h = (struct brcmf_proto_bcdc_header *)(pktbuf->data);
-+ 
-+-	*ifidx = BCDC_GET_IF_IDX(h);
-+-	if (*ifidx >= BRCMF_MAX_IFS) {
-+-		brcmf_err("rx data ifnum out of range (%d)\n", *ifidx);
-++	ifp = brcmf_get_ifp(drvr, BCDC_GET_IF_IDX(h));
-++	if (IS_ERR_OR_NULL(ifp)) {
-++		brcmf_dbg(INFO, "no matching ifp found\n");
-+ 		return -EBADE;
-+ 	}
-+-	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
-+-	 * events this is easy because it contains the bssidx which maps
-+-	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
-+-	 * bssidx 1 is used for p2p0 and no data can be received or
-+-	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
-+-	 */
-+-	if (*ifidx)
-+-		(*ifidx)++;
-+-
-+ 	if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
-+ 	    BCDC_PROTO_VER) {
-+ 		brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
-+-			  brcmf_ifname(drvr, *ifidx), h->flags);
-++			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
-+ 		return -EBADE;
++-	int ae = meshhdr->flags & MESH_FLAGS_AE;
+++	int ae = flags & MESH_FLAGS_AE;
++ 	/* 802.11-2012, 8.2.4.7.3 */
++ 	switch (ae) {
++ 	default:
++@@ -407,21 +407,31 @@ unsigned int ieee80211_get_mesh_hdrlen(s
++ 		return 18;
 + 	}
++ }
+++
+++unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+++{
+++	return __ieee80211_get_mesh_hdrlen(meshhdr->flags);
+++}
++ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
 + 
-+ 	if (h->flags & BCDC_FLAG_SUM_GOOD) {
-+ 		brcmf_dbg(BCDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
-+-			  brcmf_ifname(drvr, *ifidx), h->flags);
-++			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
-+ 		pktbuf->ip_summed = CHECKSUM_UNNECESSARY;
++-int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
++-			   enum nl80211_iftype iftype)
+++static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr,
+++				    const u8 *addr, enum nl80211_iftype iftype)
++ {
++ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
++-	u16 hdrlen, ethertype;
++-	u8 *payload;
++-	u8 dst[ETH_ALEN];
++-	u8 src[ETH_ALEN] __aligned(2);
+++	struct {
+++		u8 hdr[ETH_ALEN] __aligned(2);
+++		__be16 proto;
+++	} payload;
+++	struct ethhdr tmp;
+++	u16 hdrlen;
+++	u8 mesh_flags = 0;
++ 
++ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
++ 		return -1;
++ 
++ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+++	if (skb->len < hdrlen + 8)
+++		return -1;
++ 
++ 	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
++ 	 * header
++@@ -432,8 +442,11 @@ int ieee80211_data_to_8023(struct sk_buf
++ 	 *   1     0   BSSID SA    DA    n/a
++ 	 *   1     1   RA    TA    DA    SA
++ 	 */
++-	memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
++-	memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
+++	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
+++	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
+++
+++	if (iftype == NL80211_IFTYPE_MESH_POINT)
+++		skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
++ 
++ 	switch (hdr->frame_control &
++ 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
++@@ -450,44 +463,31 @@ int ieee80211_data_to_8023(struct sk_buf
++ 			     iftype != NL80211_IFTYPE_STATION))
++ 			return -1;
++ 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
++-			struct ieee80211s_hdr *meshdr =
++-				(struct ieee80211s_hdr *) (skb->data + hdrlen);
++-			/* make sure meshdr->flags is on the linear part */
++-			if (!pskb_may_pull(skb, hdrlen + 1))
++-				return -1;
++-			if (meshdr->flags & MESH_FLAGS_AE_A4)
+++			if (mesh_flags & MESH_FLAGS_AE_A4)
++ 				return -1;
++-			if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
+++			if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
++ 				skb_copy_bits(skb, hdrlen +
++ 					offsetof(struct ieee80211s_hdr, eaddr1),
++-				       	dst, ETH_ALEN);
++-				skb_copy_bits(skb, hdrlen +
++-					offsetof(struct ieee80211s_hdr, eaddr2),
++-				        src, ETH_ALEN);
+++					tmp.h_dest, 2 * ETH_ALEN);
++ 			}
++-			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+++			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
++ 		}
++ 		break;
++ 	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
++ 		if ((iftype != NL80211_IFTYPE_STATION &&
++ 		     iftype != NL80211_IFTYPE_P2P_CLIENT &&
++ 		     iftype != NL80211_IFTYPE_MESH_POINT) ||
++-		    (is_multicast_ether_addr(dst) &&
++-		     ether_addr_equal(src, addr)))
+++		    (is_multicast_ether_addr(tmp.h_dest) &&
+++		     ether_addr_equal(tmp.h_source, addr)))
++ 			return -1;
++ 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
++-			struct ieee80211s_hdr *meshdr =
++-				(struct ieee80211s_hdr *) (skb->data + hdrlen);
++-			/* make sure meshdr->flags is on the linear part */
++-			if (!pskb_may_pull(skb, hdrlen + 1))
++-				return -1;
++-			if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
+++			if (mesh_flags & MESH_FLAGS_AE_A5_A6)
++ 				return -1;
++-			if (meshdr->flags & MESH_FLAGS_AE_A4)
+++			if (mesh_flags & MESH_FLAGS_AE_A4)
++ 				skb_copy_bits(skb, hdrlen +
++ 					offsetof(struct ieee80211s_hdr, eaddr1),
++-					src, ETH_ALEN);
++-			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+++					tmp.h_source, ETH_ALEN);
+++			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
++ 		}
++ 		break;
++ 	case cpu_to_le16(0):
++@@ -498,33 +498,33 @@ int ieee80211_data_to_8023(struct sk_buf
++ 		break;
 + 	}
 + 
-+@@ -320,12 +312,15 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-+ 
-+ 	skb_pull(pktbuf, BCDC_HEADER_LEN);
-+ 	if (do_fws)
-+-		brcmf_fws_hdrpull(drvr, *ifidx, h->data_offset << 2, pktbuf);
-++		brcmf_fws_hdrpull(drvr, ifp->ifidx, h->data_offset << 2,
-++				  pktbuf);
-+ 	else
-+ 		skb_pull(pktbuf, h->data_offset << 2);
++-	if (!pskb_may_pull(skb, hdrlen + 8))
++-		return -1;
++-
++-	payload = skb->data + hdrlen;
++-	ethertype = (payload[6] << 8) | payload[7];
+++	skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
+++	tmp.h_proto = payload.proto;
++ 
++-	if (likely((ether_addr_equal(payload, rfc1042_header) &&
++-		    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
++-		   ether_addr_equal(payload, bridge_tunnel_header))) {
+++	if (likely((ether_addr_equal(payload.hdr, rfc1042_header) &&
+++		    tmp.h_proto != htons(ETH_P_AARP) &&
+++		    tmp.h_proto != htons(ETH_P_IPX)) ||
+++		   ether_addr_equal(payload.hdr, bridge_tunnel_header)))
++ 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
++ 		 * replace EtherType */
++-		skb_pull(skb, hdrlen + 6);
++-		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
++-		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
++-	} else {
++-		struct ethhdr *ehdr;
++-		__be16 len;
+++		hdrlen += ETH_ALEN + 2;
+++	else
+++		tmp.h_proto = htons(skb->len);
 + 
-+ 	if (pktbuf->len == 0)
-+ 		return -ENODATA;
++-		skb_pull(skb, hdrlen);
++-		len = htons(skb->len);
+++	pskb_pull(skb, hdrlen);
+++
+++	if (!ehdr)
++ 		ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
++-		memcpy(ehdr->h_dest, dst, ETH_ALEN);
++-		memcpy(ehdr->h_source, src, ETH_ALEN);
++-		ehdr->h_proto = len;
++-	}
+++	memcpy(ehdr, &tmp, sizeof(tmp));
 ++
-++	*ifidx = ifp->ifidx;
 + 	return 0;
 + }
-+ 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -83,6 +83,25 @@ char *brcmf_ifname(struct brcmf_pub *drv
-+ 	return "<if_none>";
-+ }
-+ 
-++struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
-++{
-++	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
-++		brcmf_err("ifidx %d out of range\n", ifidx);
-++		return ERR_PTR(-ERANGE);
-++	}
 ++
-++	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
-++	 * events this is easy because it contains the bssidx which maps
-++	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
-++	 * bssidx 1 is used for p2p0 and no data can be received or
-++	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
-++	 */
-++	if (ifidx)
-++		ifidx++;
-++
-++	return drvr->iflist[ifidx];
+++int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+++			   enum nl80211_iftype iftype)
+++{
+++	return __ieee80211_data_to_8023(skb, NULL, addr, iftype);
 ++}
-++
-+ static void _brcmf_set_multicast_list(struct work_struct *work)
-+ {
-+ 	struct brcmf_if *ifp;
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
-+@@ -202,7 +202,7 @@ int brcmf_netdev_wait_pend8021x(struct b
-+ 
-+ /* Return pointer to interface name */
-+ char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
-+-
-++struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-+ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-+ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-+ 			      char *name, u8 *mac_addr);
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-+@@ -1081,16 +1081,8 @@ brcmf_msgbuf_rx_skb(struct brcmf_msgbuf
-+ {
-+ 	struct brcmf_if *ifp;
++ EXPORT_SYMBOL(ieee80211_data_to_8023);
 + 
-+-	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
-+-	 * events this is easy because it contains the bssidx which maps
-+-	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
-+-	 * bssidx 1 is used for p2p0 and no data can be received or
-+-	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
-+-	 */
-+-	if (ifidx)
-+-		(ifidx)++;
-+-	ifp = msgbuf->drvr->iflist[ifidx];
-+-	if (!ifp || !ifp->ndev) {
-++	ifp = brcmf_get_ifp(msgbuf->drvr, ifidx);
-++	if (IS_ERR_OR_NULL(ifp) || !ifp->ndev) {
-+ 		brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
-+ 		brcmu_pkt_buf_free_skb(skb);
-+ 		return;
++ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
 diff --git a/package/kernel/mac80211/patches/320-ath9k-ar9271_hw_pa_cal-use-defs-instead-of-magin-num.patch b/package/kernel/mac80211/patches/320-ath9k-ar9271_hw_pa_cal-use-defs-instead-of-magin-num.patch
 deleted file mode 100644
 index c4dd1af..0000000
@@ -11158,234 +11486,171 @@ index c4dd1af..0000000
 - 	regVal = REG_READ(ah, 0x9808);
 - 	regVal &= (~(0x1 << 27));
 - 	REG_WRITE(ah, 0x9808, regVal);
-diff --git a/package/kernel/mac80211/patches/320-brcmfmac-make-brcmf_proto_hdrpull-return-struct-brcm.patch b/package/kernel/mac80211/patches/320-brcmfmac-make-brcmf_proto_hdrpull-return-struct-brcm.patch
+diff --git a/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch b/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch
 new file mode 100644
-index 0000000..632714c
+index 0000000..2eeed22
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/320-brcmfmac-make-brcmf_proto_hdrpull-return-struct-brcm.patch
-@@ -0,0 +1,222 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:54 +0200
-+Subject: [PATCH] brcmfmac: make brcmf_proto_hdrpull() return struct
-+ brcmf_if instance
-+
-+Avoid spreading the ifidx in the driver, but have it return the
-+struct brcmf_if instance.
++++ b/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch
+@@ -0,0 +1,159 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Tue, 2 Feb 2016 14:39:10 +0100
++Subject: [PATCH] cfg80211: add support for non-linear skbs in
++ ieee80211_amsdu_to_8023s
 +
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
-+@@ -272,11 +272,11 @@ brcmf_proto_bcdc_hdrpush(struct brcmf_pu
-+ }
-+ 
-+ static int
-+-brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
-+-			 struct sk_buff *pktbuf)
-++brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws,
-++			 struct sk_buff *pktbuf, struct brcmf_if **ifp)
-+ {
-+ 	struct brcmf_proto_bcdc_header *h;
-+-	struct brcmf_if *ifp;
-++	struct brcmf_if *tmp_if;
-+ 
-+ 	brcmf_dbg(BCDC, "Enter\n");
-+ 
-+@@ -290,21 +290,21 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-+ 	trace_brcmf_bcdchdr(pktbuf->data);
-+ 	h = (struct brcmf_proto_bcdc_header *)(pktbuf->data);
-+ 
-+-	ifp = brcmf_get_ifp(drvr, BCDC_GET_IF_IDX(h));
-+-	if (IS_ERR_OR_NULL(ifp)) {
-++	tmp_if = brcmf_get_ifp(drvr, BCDC_GET_IF_IDX(h));
-++	if (!tmp_if) {
-+ 		brcmf_dbg(INFO, "no matching ifp found\n");
-+ 		return -EBADE;
-+ 	}
-+ 	if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
-+ 	    BCDC_PROTO_VER) {
-+ 		brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
-+-			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
-++			  brcmf_ifname(drvr, tmp_if->ifidx), h->flags);
-+ 		return -EBADE;
-+ 	}
-+ 
-+ 	if (h->flags & BCDC_FLAG_SUM_GOOD) {
-+ 		brcmf_dbg(BCDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
-+-			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
-++			  brcmf_ifname(drvr, tmp_if->ifidx), h->flags);
-+ 		pktbuf->ip_summed = CHECKSUM_UNNECESSARY;
-+ 	}
-+ 
-+@@ -312,7 +312,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-+ 
-+ 	skb_pull(pktbuf, BCDC_HEADER_LEN);
-+ 	if (do_fws)
-+-		brcmf_fws_hdrpull(drvr, ifp->ifidx, h->data_offset << 2,
-++		brcmf_fws_hdrpull(drvr, tmp_if->ifidx, h->data_offset << 2,
-+ 				  pktbuf);
-+ 	else
-+ 		skb_pull(pktbuf, h->data_offset << 2);
-+@@ -320,7 +320,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-+ 	if (pktbuf->len == 0)
-+ 		return -ENODATA;
-+ 
-+-	*ifidx = ifp->ifidx;
-++	*ifp = tmp_if;
-+ 	return 0;
-+ }
-+ 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -87,7 +87,7 @@ struct brcmf_if *brcmf_get_ifp(struct br
-+ {
-+ 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
-+ 		brcmf_err("ifidx %d out of range\n", ifidx);
-+-		return ERR_PTR(-ERANGE);
-++		return NULL;
-+ 	}
-+ 
-+ 	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
-+@@ -539,17 +539,15 @@ void brcmf_rx_frame(struct device *dev,
-+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+ 	struct brcmf_pub *drvr = bus_if->drvr;
-+ 	struct brcmf_skb_reorder_data *rd;
-+-	u8 ifidx;
-+ 	int ret;
-+ 
-+ 	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
-+ 
-+ 	/* process and remove protocol-specific header */
-+-	ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
-+-	ifp = drvr->iflist[ifidx];
-++	ret = brcmf_proto_hdrpull(drvr, true, skb, &ifp);
-+ 
-+ 	if (ret || !ifp || !ifp->ndev) {
-+-		if ((ret != -ENODATA) && ifp)
-++		if (ret != -ENODATA && ifp)
-+ 			ifp->stats.rx_errors++;
-+ 		brcmu_pkt_buf_free_skb(skb);
-+ 		return;
-+@@ -592,17 +590,17 @@ void brcmf_txcomplete(struct device *dev
-+ {
-+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+ 	struct brcmf_pub *drvr = bus_if->drvr;
-+-	u8 ifidx;
-++	struct brcmf_if *ifp;
-+ 
-+ 	/* await txstatus signal for firmware if active */
-+ 	if (brcmf_fws_fc_active(drvr->fws)) {
-+ 		if (!success)
-+ 			brcmf_fws_bustxfail(drvr->fws, txp);
-+ 	} else {
-+-		if (brcmf_proto_hdrpull(drvr, false, &ifidx, txp))
-++		if (brcmf_proto_hdrpull(drvr, false, txp, &ifp))
-+ 			brcmu_pkt_buf_free_skb(txp);
-+ 		else
-+-			brcmf_txfinalize(drvr, txp, ifidx, success);
-++			brcmf_txfinalize(drvr, txp, ifp->ifidx, success);
-+ 	}
++--- a/net/wireless/util.c
+++++ b/net/wireless/util.c
++@@ -644,73 +644,75 @@ int ieee80211_data_from_8023(struct sk_b
 + }
++ EXPORT_SYMBOL(ieee80211_data_from_8023);
 + 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-+@@ -1448,7 +1448,7 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-+ 	struct sk_buff *skb;
-+ 	struct brcmf_skbuff_cb *skcb;
-+ 	struct brcmf_fws_mac_descriptor *entry = NULL;
-+-	u8 ifidx;
-++	struct brcmf_if *ifp;
-+ 
-+ 	brcmf_dbg(DATA, "flags %d\n", flags);
-+ 
-+@@ -1497,15 +1497,16 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-+ 	}
-+ 	brcmf_fws_macdesc_return_req_credit(skb);
+++static struct sk_buff *
+++__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
+++		       int offset, int len)
+++{
+++	struct sk_buff *frame;
+++
+++	if (skb->len - offset < len)
+++		return NULL;
+++
+++	/*
+++	 * Allocate and reserve two bytes more for payload
+++	 * alignment since sizeof(struct ethhdr) is 14.
+++	 */
+++	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + len);
+++
+++	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+++	skb_copy_bits(skb, offset, skb_put(frame, len), len);
+++
+++	return frame;
+++}
 + 
-+-	if (brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb)) {
-++	ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
-++	if (ret) {
-+ 		brcmu_pkt_buf_free_skb(skb);
-+ 		return -EINVAL;
++ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
++ 			      const u8 *addr, enum nl80211_iftype iftype,
++ 			      const unsigned int extra_headroom,
++ 			      bool has_80211_header)
++ {
+++	unsigned int hlen = ALIGN(extra_headroom, 4);
++ 	struct sk_buff *frame = NULL;
++ 	u16 ethertype;
++ 	u8 *payload;
++-	const struct ethhdr *eth;
++-	int remaining, err;
++-	u8 dst[ETH_ALEN], src[ETH_ALEN];
++-
++-	if (skb_linearize(skb))
++-		goto out;
+++	int offset = 0, remaining, err;
+++	struct ethhdr eth;
+++	bool reuse_skb = true;
+++	bool last = false;
++ 
++ 	if (has_80211_header) {
++-		err = ieee80211_data_to_8023(skb, addr, iftype);
+++		err = __ieee80211_data_to_8023(skb, &eth, addr, iftype);
++ 		if (err)
++ 			goto out;
++-
++-		/* skip the wrapping header */
++-		eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
++-		if (!eth)
++-			goto out;
++-	} else {
++-		eth = (struct ethhdr *) skb->data;
 + 	}
-+ 	if (!remove_from_hanger)
-+-		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifidx,
-++		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifp->ifidx,
-+ 						    genbit, seq);
-+ 	if (remove_from_hanger || ret)
-+-		brcmf_txfinalize(fws->drvr, skb, ifidx, true);
-++		brcmf_txfinalize(fws->drvr, skb, ifp->ifidx, true);
 + 
-+ 	return 0;
-+ }
-+@@ -1848,7 +1849,7 @@ static int brcmf_fws_commit_skb(struct b
-+ 		entry->transit_count--;
-+ 		if (entry->suppressed)
-+ 			entry->suppr_transit_count--;
-+-		brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
-++		(void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL);
-+ 		goto rollback;
-+ 	}
++-	while (skb != frame) {
+++	while (!last) {
+++		unsigned int subframe_len;
+++		int len;
++ 		u8 padding;
++-		__be16 len = eth->h_proto;
++-		unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
++-
++-		remaining = skb->len;
++-		memcpy(dst, eth->h_dest, ETH_ALEN);
++-		memcpy(src, eth->h_source, ETH_ALEN);
++ 
+++		skb_copy_bits(skb, offset, &eth, sizeof(eth));
+++		len = ntohs(eth.h_proto);
+++		subframe_len = sizeof(struct ethhdr) + len;
++ 		padding = (4 - subframe_len) & 0x3;
+++
++ 		/* the last MSDU has no padding */
+++		remaining = skb->len - offset;
++ 		if (subframe_len > remaining)
++ 			goto purge;
++ 
++-		skb_pull(skb, sizeof(struct ethhdr));
+++		offset += sizeof(struct ethhdr);
++ 		/* reuse skb for the last subframe */
++-		if (remaining <= subframe_len + padding)
+++		last = remaining <= subframe_len + padding;
+++		if (!skb_is_nonlinear(skb) && last) {
+++			skb_pull(skb, offset);
++ 			frame = skb;
++-		else {
++-			unsigned int hlen = ALIGN(extra_headroom, 4);
++-			/*
++-			 * Allocate and reserve two bytes more for payload
++-			 * alignment since sizeof(struct ethhdr) is 14.
++-			 */
++-			frame = dev_alloc_skb(hlen + subframe_len + 2);
+++			reuse_skb = true;
+++		} else {
+++			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len);
++ 			if (!frame)
++ 				goto purge;
++ 
++-			skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
++-			memcpy(skb_put(frame, ntohs(len)), skb->data,
++-				ntohs(len));
++-
++-			eth = (struct ethhdr *)skb_pull(skb, ntohs(len) +
++-							padding);
++-			if (!eth) {
++-				dev_kfree_skb(frame);
++-				goto purge;
++-			}
+++			offset += len + padding;
++ 		}
 + 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-+@@ -522,7 +522,7 @@ static int brcmf_msgbuf_set_dcmd(struct
++ 		skb_reset_network_header(frame);
++@@ -719,24 +721,20 @@ void ieee80211_amsdu_to_8023s(struct sk_
 + 
++ 		payload = frame->data;
++ 		ethertype = (payload[6] << 8) | payload[7];
++-
++ 		if (likely((ether_addr_equal(payload, rfc1042_header) &&
++ 			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
++ 			   ether_addr_equal(payload, bridge_tunnel_header))) {
++-			/* remove RFC1042 or Bridge-Tunnel
++-			 * encapsulation and replace EtherType */
++-			skb_pull(frame, 6);
++-			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
++-			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
++-		} else {
++-			memcpy(skb_push(frame, sizeof(__be16)), &len,
++-				sizeof(__be16));
++-			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
++-			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+++			eth.h_proto = htons(ethertype);
+++			skb_pull(frame, ETH_ALEN + 2);
++ 		}
+++
+++		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
++ 		__skb_queue_tail(list, frame);
++ 	}
 + 
-+ static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
-+-				u8 *ifidx, struct sk_buff *skb)
-++				struct sk_buff *skb, struct brcmf_if **ifp)
-+ {
-+ 	return -ENODEV;
-+ }
-+@@ -1082,7 +1082,7 @@ brcmf_msgbuf_rx_skb(struct brcmf_msgbuf
-+ 	struct brcmf_if *ifp;
-+ 
-+ 	ifp = brcmf_get_ifp(msgbuf->drvr, ifidx);
-+-	if (IS_ERR_OR_NULL(ifp) || !ifp->ndev) {
-++	if (!ifp || !ifp->ndev) {
-+ 		brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
-+ 		brcmu_pkt_buf_free_skb(skb);
-+ 		return;
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/proto.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/proto.h
-+@@ -24,8 +24,8 @@ enum proto_addr_mode {
-+ 
-+ 
-+ struct brcmf_proto {
-+-	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
-+-		       struct sk_buff *skb);
-++	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
-++		       struct sk_buff *skb, struct brcmf_if **ifp);
-+ 	int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
-+ 			  void *buf, uint len);
-+ 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
-+@@ -46,9 +46,19 @@ int brcmf_proto_attach(struct brcmf_pub
-+ void brcmf_proto_detach(struct brcmf_pub *drvr);
-+ 
-+ static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
-+-				      u8 *ifidx, struct sk_buff *skb)
-++				      struct sk_buff *skb,
-++				      struct brcmf_if **ifp)
-+ {
-+-	return drvr->proto->hdrpull(drvr, do_fws, ifidx, skb);
-++	struct brcmf_if *tmp = NULL;
+++	if (!reuse_skb)
+++		dev_kfree_skb(skb);
 ++
-++	/* assure protocol is always called with
-++	 * non-null initialized pointer.
-++	 */
-++	if (ifp)
-++		*ifp = NULL;
-++	else
-++		ifp = &tmp;
-++	return drvr->proto->hdrpull(drvr, do_fws, skb, ifp);
-+ }
-+ static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
-+ 					 uint cmd, void *buf, uint len)
++ 	return;
++ 
++  purge:
 diff --git a/package/kernel/mac80211/patches/321-ath9k-ar9271_hw_pa_cal-use-proper-makroses.patch b/package/kernel/mac80211/patches/321-ath9k-ar9271_hw_pa_cal-use-proper-makroses.patch
 deleted file mode 100644
 index f05287d..0000000
@@ -11471,251 +11736,857 @@ index f05287d..0000000
 - 	for (i = 0; i < ARRAY_SIZE(regList); i++)
 - 		REG_WRITE(ah, regList[i][0], regList[i][1]);
 - 
-diff --git a/package/kernel/mac80211/patches/321-brcmfmac-change-parameters-for-brcmf_remove_interfac.patch b/package/kernel/mac80211/patches/321-brcmfmac-change-parameters-for-brcmf_remove_interfac.patch
+diff --git a/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch b/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch
 new file mode 100644
-index 0000000..3360cbc
+index 0000000..c4155a1
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/321-brcmfmac-change-parameters-for-brcmf_remove_interfac.patch
-@@ -0,0 +1,87 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:55 +0200
-+Subject: [PATCH] brcmfmac: change parameters for
-+ brcmf_remove_interface()
++++ b/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch
+@@ -0,0 +1,155 @@
++From: Sven Eckelmann <sven@narfation.org>
++Date: Tue, 26 Jan 2016 17:11:13 +0100
++Subject: [PATCH] mac80211: Parse legacy and HT rate in injected frames
++
++Drivers/devices without their own rate control algorithm can get the
++information what rates they should use from either the radiotap header of
++injected frames or from the rate control algorithm. But the parsing of the
++legacy rate information from the radiotap header was removed in commit
++e6a9854b05c1 ("mac80211/drivers: rewrite the rate control API").
++
++The removal of this feature heavily reduced the usefulness of frame
++injection when wanting to simulate specific transmission behavior. Having
++rate parsing together with MCS rates and retry support allows a fine
++grained selection of the tx behavior of injected frames for these kind of
++tests.
++
++Signed-off-by: Sven Eckelmann <sven@narfation.org>
++Cc: Simon Wunderlich <sw@simonwunderlich.de>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
++---
++
++--- a/include/net/mac80211.h
+++++ b/include/net/mac80211.h
++@@ -708,12 +708,14 @@ enum mac80211_tx_info_flags {
++  *	protocol frame (e.g. EAP)
++  * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
++  *	frame (PS-Poll or uAPSD).
+++ * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
++  *
++  * These flags are used in tx_info->control.flags.
++  */
++ enum mac80211_tx_control_flags {
++ 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
++ 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
+++	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
++ };
++ 
++ /*
++--- a/net/mac80211/tx.c
+++++ b/net/mac80211/tx.c
++@@ -710,6 +710,10 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
++ 
++ 	info->control.short_preamble = txrc.short_preamble;
++ 
+++	/* don't ask rate control when rate already injected via radiotap */
+++	if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
+++		return TX_CONTINUE;
+++
++ 	if (tx->sta)
++ 		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
++ 
++@@ -1665,15 +1669,24 @@ void ieee80211_xmit(struct ieee80211_sub
++ 	ieee80211_tx(sdata, sta, skb, false);
++ }
++ 
++-static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
+++static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
+++					struct sk_buff *skb)
++ {
++ 	struct ieee80211_radiotap_iterator iterator;
++ 	struct ieee80211_radiotap_header *rthdr =
++ 		(struct ieee80211_radiotap_header *) skb->data;
++ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+++	struct ieee80211_supported_band *sband =
+++		local->hw.wiphy->bands[info->band];
++ 	int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
++ 						   NULL);
++ 	u16 txflags;
+++	u16 rate = 0;
+++	bool rate_found = false;
+++	u8 rate_retries = 0;
+++	u16 rate_flags = 0;
+++	u8 mcs_known, mcs_flags;
+++	int i;
++ 
++ 	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
++ 		       IEEE80211_TX_CTL_DONTFRAG;
++@@ -1724,6 +1737,35 @@ static bool ieee80211_parse_tx_radiotap(
++ 				info->flags |= IEEE80211_TX_CTL_NO_ACK;
++ 			break;
++ 
+++		case IEEE80211_RADIOTAP_RATE:
+++			rate = *iterator.this_arg;
+++			rate_flags = 0;
+++			rate_found = true;
+++			break;
+++
+++		case IEEE80211_RADIOTAP_DATA_RETRIES:
+++			rate_retries = *iterator.this_arg;
+++			break;
+++
+++		case IEEE80211_RADIOTAP_MCS:
+++			mcs_known = iterator.this_arg[0];
+++			mcs_flags = iterator.this_arg[1];
+++			if (!(mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_MCS))
+++				break;
+++
+++			rate_found = true;
+++			rate = iterator.this_arg[2];
+++			rate_flags = IEEE80211_TX_RC_MCS;
+++
+++			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_GI &&
+++			    mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
+++				rate_flags |= IEEE80211_TX_RC_SHORT_GI;
+++
+++			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
+++			    mcs_flags & IEEE80211_RADIOTAP_MCS_BW_40)
+++				rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+++			break;
+++
++ 		/*
++ 		 * Please update the file
++ 		 * Documentation/networking/mac80211-injection.txt
++@@ -1738,6 +1780,32 @@ static bool ieee80211_parse_tx_radiotap(
++ 	if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
++ 		return false;
++ 
+++	if (rate_found) {
+++		info->control.flags |= IEEE80211_TX_CTRL_RATE_INJECT;
+++
+++		for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+++			info->control.rates[i].idx = -1;
+++			info->control.rates[i].flags = 0;
+++			info->control.rates[i].count = 0;
+++		}
+++
+++		if (rate_flags & IEEE80211_TX_RC_MCS) {
+++			info->control.rates[0].idx = rate;
+++		} else {
+++			for (i = 0; i < sband->n_bitrates; i++) {
+++				if (rate * 5 != sband->bitrates[i].bitrate)
+++					continue;
+++
+++				info->control.rates[0].idx = i;
+++				break;
+++			}
+++		}
+++
+++		info->control.rates[0].flags = rate_flags;
+++		info->control.rates[0].count = min_t(u8, rate_retries + 1,
+++						     local->hw.max_rate_tries);
+++	}
+++
++ 	/*
++ 	 * remove the radiotap header
++ 	 * iterator->_max_length was sanity-checked against
++@@ -1819,7 +1887,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
++ 		      IEEE80211_TX_CTL_INJECTED;
++ 
++ 	/* process and remove the injection radiotap header */
++-	if (!ieee80211_parse_tx_radiotap(skb))
+++	if (!ieee80211_parse_tx_radiotap(local, skb))
++ 		goto fail;
++ 
++ 	rcu_read_lock();
+diff --git a/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch b/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch
+deleted file mode 100644
+index 7247369..0000000
+--- a/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch
++++ /dev/null
+@@ -1,48 +0,0 @@
+-From: Oleksij Rempel <linux@rempel-privat.de>
+-Date: Sun, 22 Mar 2015 19:29:49 +0100
+-Subject: [PATCH] ath9k: ar9271_hw_pa_cal: use RMW buffer
+-
+-Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
+-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+----
+-
+---- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+-+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+-@@ -436,13 +436,14 @@ static void ar9271_hw_pa_cal(struct ath_
+- 		{ AR9285_AN_RF2G2, 0 },
+- 		{ AR9285_AN_TOP2, 0 },
+- 		{ AR9285_AN_RF2G8, 0 },
+--		{ AR9285_AN_RF2G7, 0 } ,
+--		{ AR9285_AN_RF2G3, 0 } ,
+-+		{ AR9285_AN_RF2G7, 0 },
+-+		{ AR9285_AN_RF2G3, 0 },
+- 	};
+- 
+- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
+- 		regList[i][1] = REG_READ(ah, regList[i][0]);
+- 
+-+	ENABLE_REG_RMW_BUFFER(ah);
+- 	/* 7834, b1=0 */
+- 	REG_CLR_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
+- 	/* 9808, b27=1 */
+-@@ -476,6 +477,7 @@ static void ar9271_hw_pa_cal(struct ath_
+- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
+- 	/* 7828, b0-11, ccom=fff */
+- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9271_AN_RF2G3_CCOMP, 0xfff);
+-+	REG_RMW_BUFFER_FLUSH(ah);
+- 
+- 	/* Set:
+- 	 * localmode=1,bmode=1,bmoderxtx=1,synthon=1,
+-@@ -514,10 +516,12 @@ static void ar9271_hw_pa_cal(struct ath_
+- 	}
+- 
+- 
+-+	ENABLE_REG_RMW_BUFFER(ah);
+- 	/* 7834, b1=1 */
+- 	REG_SET_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
+- 	/* 9808, b27=0 */
+- 	REG_CLR_BIT(ah, 0x9808, 1 << 27);
+-+	REG_RMW_BUFFER_FLUSH(ah);
+- 
+- 	ENABLE_REGWRITE_BUFFER(ah);
+- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
+diff --git a/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
+new file mode 100644
+index 0000000..d55f772
+--- /dev/null
++++ b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
+@@ -0,0 +1,292 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Fri, 5 Feb 2016 01:38:51 +0100
++Subject: [PATCH] mac80211: add A-MSDU tx support
++
++Requires software tx queueing support. frag_list support (for zero-copy)
++is optional.
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/include/net/mac80211.h
+++++ b/include/net/mac80211.h
++@@ -709,6 +709,7 @@ enum mac80211_tx_info_flags {
++  * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
++  *	frame (PS-Poll or uAPSD).
++  * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
+++ * @IEEE80211_TX_CTRL_AMSDU: This frame is an A-MSDU frame
++  *
++  * These flags are used in tx_info->control.flags.
++  */
++@@ -716,6 +717,7 @@ enum mac80211_tx_control_flags {
++ 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
++ 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
++ 	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
+++	IEEE80211_TX_CTRL_AMSDU			= BIT(3),
++ };
++ 
++ /*
++@@ -1961,6 +1963,12 @@ struct ieee80211_txq {
++  *	order and does not need to manage its own reorder buffer or BA session
++  *	timeout.
++  *
+++ * @IEEE80211_HW_TX_AMSDU: Hardware (or driver) supports software aggregated
+++ *	A-MSDU frames. Requires software tx queueing support.
+++ *
+++ * @IEEE80211_HW_TX_FRAG_LIST: Hardware (or driver) supports sending frag_list
+++ *	skbs, needed for zero-copy software A-MSDU.
+++ *
++  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
++  */
++ enum ieee80211_hw_flags {
++@@ -1998,6 +2006,8 @@ enum ieee80211_hw_flags {
++ 	IEEE80211_HW_BEACON_TX_STATUS,
++ 	IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR,
++ 	IEEE80211_HW_SUPPORTS_REORDERING_BUFFER,
+++	IEEE80211_HW_TX_AMSDU,
+++	IEEE80211_HW_TX_FRAG_LIST,
++ 
++ 	/* keep last, obviously */
++ 	NUM_IEEE80211_HW_FLAGS
++@@ -2070,6 +2080,8 @@ enum ieee80211_hw_flags {
++  *	size is smaller (an example is LinkSys WRT120N with FW v1.0.07
++  *	build 002 Jun 18 2012).
++  *
+++ * @max_tx_fragments: maximum fragments per (A-)MSDU.
+++ *
++  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
++  *	(if %IEEE80211_HW_QUEUE_CONTROL is set)
++  *
++@@ -2124,6 +2136,7 @@ struct ieee80211_hw {
++ 	u8 max_rate_tries;
++ 	u8 max_rx_aggregation_subframes;
++ 	u8 max_tx_aggregation_subframes;
+++	u8 max_tx_fragments;
++ 	u8 offchannel_tx_hw_queue;
++ 	u8 radiotap_mcs_details;
++ 	u16 radiotap_vht_details;
++--- a/net/mac80211/agg-tx.c
+++++ b/net/mac80211/agg-tx.c
++@@ -935,6 +935,7 @@ void ieee80211_process_addba_resp(struct
++ 				  size_t len)
++ {
++ 	struct tid_ampdu_tx *tid_tx;
+++	struct ieee80211_txq *txq;
++ 	u16 capab, tid;
++ 	u8 buf_size;
++ 	bool amsdu;
++@@ -945,6 +946,10 @@ void ieee80211_process_addba_resp(struct
++ 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
++ 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
++ 
+++	txq = sta->sta.txq[tid];
+++	if (!amsdu && txq)
+++		set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags);
+++
++ 	mutex_lock(&sta->ampdu_mlme.mtx);
++ 
++ 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
++--- a/net/mac80211/debugfs.c
+++++ b/net/mac80211/debugfs.c
++@@ -127,6 +127,8 @@ static const char *hw_flag_names[NUM_IEE
++ 	FLAG(BEACON_TX_STATUS),
++ 	FLAG(NEEDS_UNIQUE_STA_ADDR),
++ 	FLAG(SUPPORTS_REORDERING_BUFFER),
+++	FLAG(TX_AMSDU),
+++	FLAG(TX_FRAG_LIST),
++ 
++ 	/* keep last for the build bug below */
++ 	(void *)0x1
++--- a/net/mac80211/ieee80211_i.h
+++++ b/net/mac80211/ieee80211_i.h
++@@ -799,6 +799,7 @@ struct mac80211_qos_map {
++ enum txq_info_flags {
++ 	IEEE80211_TXQ_STOP,
++ 	IEEE80211_TXQ_AMPDU,
+++	IEEE80211_TXQ_NO_AMSDU,
++ };
++ 
++ struct txq_info {
++--- a/net/mac80211/tx.c
+++++ b/net/mac80211/tx.c
++@@ -1318,6 +1318,10 @@ struct sk_buff *ieee80211_tx_dequeue(str
++ out:
++ 	spin_unlock_bh(&txqi->queue.lock);
++ 
+++	if (skb && skb_has_frag_list(skb) &&
+++	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
+++		skb_linearize(skb);
+++
++ 	return skb;
++ }
++ EXPORT_SYMBOL(ieee80211_tx_dequeue);
++@@ -2757,6 +2761,158 @@ void ieee80211_clear_fast_xmit(struct st
++ 		kfree_rcu(fast_tx, rcu_head);
++ }
++ 
+++static int ieee80211_amsdu_pad(struct sk_buff *skb, int subframe_len)
+++{
+++	int amsdu_len = subframe_len + sizeof(struct ethhdr);
+++	int padding = (4 - amsdu_len) & 3;
+++
+++	if (padding)
+++		memset(skb_put(skb, padding), 0, padding);
+++
+++	return padding;
+++}
+++
+++static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
+++					 struct ieee80211_fast_tx *fast_tx,
+++					 struct sk_buff *skb)
+++{
+++	struct ieee80211_local *local = sdata->local;
+++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+++	struct ieee80211_hdr *hdr;
+++	struct ethhdr amsdu_hdr;
+++	int hdr_len = fast_tx->hdr_len - sizeof(rfc1042_header);
+++	int subframe_len = skb->len - hdr_len;
+++	void *data;
+++	u8 *qc;
+++
+++	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
+++		return true;
+++
+++	if (skb_headroom(skb) < sizeof(amsdu_hdr) || skb_tailroom(skb) < 3) {
+++		I802_DEBUG_INC(local->tx_expand_skb_head);
+++
+++		if (pskb_expand_head(skb, sizeof(amsdu_hdr), 3, GFP_ATOMIC)) {
+++			wiphy_debug(local->hw.wiphy,
+++				    "failed to reallocate TX buffer\n");
+++			return false;
+++		}
+++	}
+++
+++	subframe_len += ieee80211_amsdu_pad(skb, subframe_len);
+++
+++	amsdu_hdr.h_proto = cpu_to_be16(subframe_len);
+++	memcpy(amsdu_hdr.h_source, skb->data + fast_tx->sa_offs, ETH_ALEN);
+++	memcpy(amsdu_hdr.h_dest, skb->data + fast_tx->da_offs, ETH_ALEN);
+++
+++	data = skb_push(skb, sizeof(amsdu_hdr));
+++	memmove(data, data + sizeof(amsdu_hdr), hdr_len);
+++	memcpy(data + hdr_len, &amsdu_hdr, sizeof(amsdu_hdr));
+++
+++	hdr = data;
+++	qc = ieee80211_get_qos_ctl(hdr);
+++	*qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+++
+++	info->control.flags |= IEEE80211_TX_CTRL_AMSDU;
+++
+++	return true;
+++}
+++
+++static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+++				      struct sta_info *sta,
+++				      struct ieee80211_fast_tx *fast_tx,
+++				      struct sk_buff *skb)
+++{
+++	struct ieee80211_local *local = sdata->local;
+++	u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+++	struct ieee80211_txq *txq = sta->sta.txq[tid];
+++	struct txq_info *txqi;
+++	struct sk_buff **frag_tail, *head;
+++	int subframe_len = skb->len - ETH_ALEN;
+++	u8 max_subframes = sta->sta.max_amsdu_subframes;
+++	int max_frags = local->hw.max_tx_fragments;
+++	int max_amsdu_len;
+++	__be16 len;
+++	void *data;
+++	bool ret = false;
+++	int n = 1, nfrags;
+++
+++	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
+++		return false;
+++
+++	if (!txq)
+++		return false;
+++
+++	txqi = to_txq_info(txq);
+++	if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
+++		return false;
+++
+++	spin_lock_bh(&txqi->queue.lock);
+++
+++	head = skb_peek_tail(&txqi->queue);
+++	if (!head)
+++		goto out;
+++
+++	if (skb->len + head->len > max_amsdu_len)
+++		goto out;
+++
+++	/*
+++	 * HT A-MPDU limits maximum MPDU size to 4095 bytes. Since aggregation
+++	 * sessions are started/stopped without txq flush, use the limit here
+++	 * to avoid having to de-aggregate later.
+++	 */
+++	if (skb->len + head->len > 4095 &&
+++	    !sta->sta.vht_cap.vht_supported)
+++		goto out;
+++
+++	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+++		goto out;
+++
+++	nfrags = 1 + skb_shinfo(skb)->nr_frags;
+++	nfrags += 1 + skb_shinfo(head)->nr_frags;
+++	frag_tail = &skb_shinfo(head)->frag_list;
+++	while (*frag_tail) {
+++		nfrags += 1 + skb_shinfo(*frag_tail)->nr_frags;
+++		frag_tail = &(*frag_tail)->next;
+++		n++;
+++	}
+++
+++	if (max_subframes && n > max_subframes)
+++		goto out;
+++
+++	if (max_frags && nfrags > max_frags)
+++		goto out;
+++
+++	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 3) {
+++		I802_DEBUG_INC(local->tx_expand_skb_head);
+++
+++		if (pskb_expand_head(skb, 8, 3, GFP_ATOMIC)) {
+++			wiphy_debug(local->hw.wiphy,
+++				    "failed to reallocate TX buffer\n");
+++			goto out;
+++		}
+++	}
+++
+++	subframe_len += ieee80211_amsdu_pad(skb, subframe_len);
+++
+++	ret = true;
+++	data = skb_push(skb, ETH_ALEN + 2);
+++	memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
+++
+++	data += 2 * ETH_ALEN;
+++	len = cpu_to_be16(subframe_len);
+++	memcpy(data, &len, 2);
+++	memcpy(data + 2, rfc1042_header, ETH_ALEN);
+++
+++	head->len += skb->len;
+++	head->data_len += skb->len;
+++	*frag_tail = skb;
+++
+++out:
+++	spin_unlock_bh(&txqi->queue.lock);
+++
+++	return ret;
+++}
+++
++ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++ 				struct net_device *dev, struct sta_info *sta,
++ 				struct ieee80211_fast_tx *fast_tx,
++@@ -2811,6 +2967,10 @@ static bool ieee80211_xmit_fast(struct i
++ 
++ 	ieee80211_tx_stats(dev, skb->len + extra_head);
++ 
+++	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
+++	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
+++		return true;
+++
++ 	/* will not be crypto-handled beyond what we do here, so use false
++ 	 * as the may-encrypt argument for the resize to not account for
++ 	 * more room than we already have in 'extra_head'
+diff --git a/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch b/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
+new file mode 100644
+index 0000000..d7018da
+--- /dev/null
++++ b/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
+@@ -0,0 +1,51 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Tue, 26 Jan 2016 17:57:01 +0100
++Subject: [PATCH] brcmfmac: analyze descriptors of current component only
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++So far we were looking for address descriptors without a check for
++crossing current component border. In case of dealing with unsupported
++descriptor or descriptor missing at all the code would incorrectly get
++data from another component.
++
++Consider this binary-described component from BCM4366 EROM:
++4bf83b01	TAG==CI		CID==0x83b
++20080201	TAG==CI		PORTS==0+1	WRAPPERS==0+1
++18400035	TAG==ADDR	SZ_SZD		TYPE_SLAVE
++00050000
++18107085	TAG==ADDR	SZ_4K		TYPE_SWRAP
++
++Driver was assigning invalid base address to this core:
++brcmfmac:  [6 ] core 0x83b:32 base 0x18109000 wrap 0x18107000
++which came from totally different component defined in EROM:
++43b36701	TAG==CI		CID==0x367
++00000201	TAG==CI		PORTS==0+1	WRAPPERS==0+0
++18109005	TAG==ADDR	SZ_4K		TYPE_SLAVE
++
++This change will also allow us to support components without wrapper
++address in the future.
++
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++@@ -803,7 +803,14 @@ static int brcmf_chip_dmp_get_regaddr(st
++ 				*eromaddr -= 4;
++ 				return -EFAULT;
++ 			}
++-		} while (desc != DMP_DESC_ADDRESS);
+++		} while (desc != DMP_DESC_ADDRESS &&
+++			 desc != DMP_DESC_COMPONENT);
+++
+++		/* stop if we crossed current component border */
+++		if (desc == DMP_DESC_COMPONENT) {
+++			*eromaddr -= 4;
+++			return 0;
+++		}
++ 
++ 		/* skip upper 32-bit address descriptor */
++ 		if (val & DMP_DESC_ADDRSIZE_GT32)
+diff --git a/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch b/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch
+new file mode 100644
+index 0000000..045ab49
+--- /dev/null
++++ b/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch
+@@ -0,0 +1,28 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Tue, 26 Jan 2016 17:57:02 +0100
++Subject: [PATCH] brcmfmac: allow storing PMU core without wrapper address
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++Separated PMU core can be found in new devices and should be used for
++accessing PMU registers (which were routed through ChipCommon so far).
++This core is one of exceptions that doesn't have or need wrapper address
++to be still safely accessible.
++
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++@@ -883,7 +883,8 @@ int brcmf_chip_dmp_erom_scan(struct brcm
++ 		rev = (val & DMP_COMP_REVISION) >> DMP_COMP_REVISION_S;
++ 
++ 		/* need core with ports */
++-		if (nmw + nsw == 0)
+++		if (nmw + nsw == 0 &&
+++		    id != BCMA_CORE_PMU)
++ 			continue;
++ 
++ 		/* try to obtain register address info */
+diff --git a/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch b/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch
+new file mode 100644
+index 0000000..7b7ba4f
+--- /dev/null
++++ b/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch
+@@ -0,0 +1,43 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Tue, 26 Jan 2016 17:57:03 +0100
++Subject: [PATCH] brcmfmac: read extended capabilities of ChipCommon core
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++This is an extra bitfield with info about some present hardware.
++
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++@@ -1025,6 +1025,9 @@ static int brcmf_chip_setup(struct brcmf
++ 	/* get chipcommon capabilites */
++ 	pub->cc_caps = chip->ops->read32(chip->ctx,
++ 					 CORE_CC_REG(base, capabilities));
+++	pub->cc_caps_ext = chip->ops->read32(chip->ctx,
+++					     CORE_CC_REG(base,
+++							 capabilities_ext));
++ 
++ 	/* get pmu caps & rev */
++ 	if (pub->cc_caps & CC_CAP_PMU) {
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
++@@ -27,6 +27,7 @@
++  * @chip: chip identifier.
++  * @chiprev: chip revision.
++  * @cc_caps: chipcommon core capabilities.
+++ * @cc_caps_ext: chipcommon core extended capabilities.
++  * @pmucaps: PMU capabilities.
++  * @pmurev: PMU revision.
++  * @rambase: RAM base address (only applicable for ARM CR4 chips).
++@@ -38,6 +39,7 @@ struct brcmf_chip {
++ 	u32 chip;
++ 	u32 chiprev;
++ 	u32 cc_caps;
+++	u32 cc_caps_ext;
++ 	u32 pmucaps;
++ 	u32 pmurev;
++ 	u32 rambase;
+diff --git a/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch b/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch
+new file mode 100644
+index 0000000..2af6fd9
+--- /dev/null
++++ b/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch
+@@ -0,0 +1,148 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Tue, 26 Jan 2016 17:57:04 +0100
++Subject: [PATCH] brcmfmac: access PMU registers using standalone PMU core if
++ available
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
 +
-+Just pass the interface to be removed, ie. the struct brcmf_if instance.
++On recent Broadcom chipsets PMU is present as separated core and it
++can't be accessed using ChipCommon anymore as it fails with e.g.:
++[   18.198412] Unhandled fault: imprecise external abort (0x1406) at 0xb6da200f
 +
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Add a new helper function that will return a proper core that should be
++used for accessing PMU registers.
++
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-+@@ -4983,7 +4983,7 @@ brcmf_notify_connect_status_ap(struct br
-+ 		brcmf_dbg(CONN, "AP mode link down\n");
-+ 		complete(&cfg->vif_disabled);
-+ 		if (ifp->vif->mbss)
-+-			brcmf_remove_interface(ifp->drvr, ifp->bssidx);
-++			brcmf_remove_interface(ifp);
-+ 		return 0;
-+ 	}
-+ 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -887,12 +887,13 @@ static void brcmf_del_if(struct brcmf_pu
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++@@ -1014,6 +1014,7 @@ static int brcmf_chip_setup(struct brcmf
++ {
++ 	struct brcmf_chip *pub;
++ 	struct brcmf_core_priv *cc;
+++	struct brcmf_core *pmu;
++ 	u32 base;
++ 	u32 val;
++ 	int ret = 0;
++@@ -1030,9 +1031,10 @@ static int brcmf_chip_setup(struct brcmf
++ 							 capabilities_ext));
++ 
++ 	/* get pmu caps & rev */
+++	pmu = brcmf_chip_get_pmu(pub); /* after reading cc_caps_ext */
++ 	if (pub->cc_caps & CC_CAP_PMU) {
++ 		val = chip->ops->read32(chip->ctx,
++-					CORE_CC_REG(base, pmucapabilities));
+++					CORE_CC_REG(pmu->base, pmucapabilities));
++ 		pub->pmurev = val & PCAP_REV_MASK;
++ 		pub->pmucaps = val;
 + 	}
++@@ -1131,6 +1133,23 @@ struct brcmf_core *brcmf_chip_get_chipco
++ 	return &cc->pub;
 + }
 + 
-+-void brcmf_remove_interface(struct brcmf_pub *drvr, u32 bssidx)
-++void brcmf_remove_interface(struct brcmf_if *ifp)
-+ {
-+-	if (drvr->iflist[bssidx]) {
-+-		brcmf_fws_del_interface(drvr->iflist[bssidx]);
-+-		brcmf_del_if(drvr, bssidx);
-+-	}
-++	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bssidx] != ifp))
-++		return;
+++struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub)
+++{
+++	struct brcmf_core *cc = brcmf_chip_get_chipcommon(pub);
+++	struct brcmf_core *pmu;
 ++
-++	brcmf_fws_del_interface(ifp);
-++	brcmf_del_if(ifp->drvr, ifp->bssidx);
-+ }
+++	/* See if there is separated PMU core available */
+++	if (cc->rev >= 35 &&
+++	    pub->cc_caps_ext & BCMA_CC_CAP_EXT_AOB_PRESENT) {
+++		pmu = brcmf_chip_get_core(pub, BCMA_CORE_PMU);
+++		if (pmu)
+++			return pmu;
+++	}
+++
+++	/* Fallback to ChipCommon core for older hardware */
+++	return cc;
+++}
+++
++ bool brcmf_chip_iscoreup(struct brcmf_core *pub)
++ {
++ 	struct brcmf_core_priv *core;
++@@ -1301,6 +1320,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
++ {
++ 	u32 base, addr, reg, pmu_cc3_mask = ~0;
++ 	struct brcmf_chip_priv *chip;
+++	struct brcmf_core *pmu = brcmf_chip_get_pmu(pub);
 + 
-+ int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr)
-+@@ -1122,7 +1123,7 @@ void brcmf_detach(struct device *dev)
-+ 
-+ 	/* make sure primary interface removed last */
-+ 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
-+-		brcmf_remove_interface(drvr, i);
-++		brcmf_remove_interface(drvr->iflist[i]);
-+ 
-+ 	brcmf_cfg80211_detach(drvr->config);
-+ 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
-+@@ -206,7 +206,7 @@ struct brcmf_if *brcmf_get_ifp(struct br
-+ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-+ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-+ 			      char *name, u8 *mac_addr);
-+-void brcmf_remove_interface(struct brcmf_pub *drvr, u32 bssidx);
-++void brcmf_remove_interface(struct brcmf_if *ifp);
-+ int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
-+ void brcmf_txflowblock_if(struct brcmf_if *ifp,
-+ 			  enum brcmf_netif_stop_reason reason, bool state);
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
-+@@ -222,7 +222,7 @@ static void brcmf_fweh_handle_if_event(s
-+ 	err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
-+ 
-+ 	if (ifp && ifevent->action == BRCMF_E_IF_DEL)
-+-		brcmf_remove_interface(drvr, ifevent->bssidx);
-++		brcmf_remove_interface(ifp);
-+ }
++ 	brcmf_dbg(TRACE, "Enter\n");
 + 
-+ /**
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
-+@@ -2140,7 +2140,7 @@ static void brcmf_p2p_delete_p2pdev(stru
-+ {
-+ 	cfg80211_unregister_wdev(&vif->wdev);
-+ 	p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-+-	brcmf_remove_interface(vif->ifp->drvr, vif->ifp->bssidx);
-++	brcmf_remove_interface(vif->ifp);
-+ 	brcmf_free_vif(vif);
-+ }
++@@ -1320,9 +1340,9 @@ bool brcmf_chip_sr_capable(struct brcmf_
++ 	case BRCM_CC_4335_CHIP_ID:
++ 	case BRCM_CC_4339_CHIP_ID:
++ 		/* read PMU chipcontrol register 3 */
++-		addr = CORE_CC_REG(base, chipcontrol_addr);
+++		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
++ 		chip->ops->write32(chip->ctx, addr, 3);
++-		addr = CORE_CC_REG(base, chipcontrol_data);
+++		addr = CORE_CC_REG(pmu->base, chipcontrol_data);
++ 		reg = chip->ops->read32(chip->ctx, addr);
++ 		return (reg & pmu_cc3_mask) != 0;
++ 	case BRCM_CC_43430_CHIP_ID:
++@@ -1330,12 +1350,12 @@ bool brcmf_chip_sr_capable(struct brcmf_
++ 		reg = chip->ops->read32(chip->ctx, addr);
++ 		return reg != 0;
++ 	default:
++-		addr = CORE_CC_REG(base, pmucapabilities_ext);
+++		addr = CORE_CC_REG(pmu->base, pmucapabilities_ext);
++ 		reg = chip->ops->read32(chip->ctx, addr);
++ 		if ((reg & PCAPEXT_SR_SUPPORTED_MASK) == 0)
++ 			return false;
++ 
++-		addr = CORE_CC_REG(base, retention_ctl);
+++		addr = CORE_CC_REG(pmu->base, retention_ctl);
++ 		reg = chip->ops->read32(chip->ctx, addr);
++ 		return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
++ 			       PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
++@@ -85,6 +85,7 @@ struct brcmf_chip *brcmf_chip_attach(voi
++ void brcmf_chip_detach(struct brcmf_chip *chip);
++ struct brcmf_core *brcmf_chip_get_core(struct brcmf_chip *chip, u16 coreid);
++ struct brcmf_core *brcmf_chip_get_chipcommon(struct brcmf_chip *chip);
+++struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub);
++ bool brcmf_chip_iscoreup(struct brcmf_core *core);
++ void brcmf_chip_coredisable(struct brcmf_core *core, u32 prereset, u32 reset);
++ void brcmf_chip_resetcore(struct brcmf_core *core, u32 prereset, u32 reset,
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++@@ -3615,7 +3615,6 @@ brcmf_sdio_drivestrengthinit(struct brcm
++ 	const struct sdiod_drive_str *str_tab = NULL;
++ 	u32 str_mask;
++ 	u32 str_shift;
++-	u32 base;
++ 	u32 i;
++ 	u32 drivestrength_sel = 0;
++ 	u32 cc_data_temp;
++@@ -3658,14 +3657,15 @@ brcmf_sdio_drivestrengthinit(struct brcm
++ 	}
 + 
-diff --git a/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch b/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch
-deleted file mode 100644
-index 7247369..0000000
---- a/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch
-+++ /dev/null
-@@ -1,48 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:49 +0100
--Subject: [PATCH] ath9k: ar9271_hw_pa_cal: use RMW buffer
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--@@ -436,13 +436,14 @@ static void ar9271_hw_pa_cal(struct ath_
-- 		{ AR9285_AN_RF2G2, 0 },
-- 		{ AR9285_AN_TOP2, 0 },
-- 		{ AR9285_AN_RF2G8, 0 },
---		{ AR9285_AN_RF2G7, 0 } ,
---		{ AR9285_AN_RF2G3, 0 } ,
--+		{ AR9285_AN_RF2G7, 0 },
--+		{ AR9285_AN_RF2G3, 0 },
-- 	};
-- 
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-- 		regList[i][1] = REG_READ(ah, regList[i][0]);
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	/* 7834, b1=0 */
-- 	REG_CLR_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
-- 	/* 9808, b27=1 */
--@@ -476,6 +477,7 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
-- 	/* 7828, b0-11, ccom=fff */
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9271_AN_RF2G3_CCOMP, 0xfff);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	/* Set:
-- 	 * localmode=1,bmode=1,bmoderxtx=1,synthon=1,
--@@ -514,10 +516,12 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	}
-- 
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	/* 7834, b1=1 */
-- 	REG_SET_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
-- 	/* 9808, b27=0 */
-- 	REG_CLR_BIT(ah, 0x9808, 1 << 27);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	ENABLE_REGWRITE_BUFFER(ah);
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-diff --git a/package/kernel/mac80211/patches/322-brcmfmac-only-call-brcmf_cfg80211_detach-when-attach.patch b/package/kernel/mac80211/patches/322-brcmfmac-only-call-brcmf_cfg80211_detach-when-attach.patch
++ 	if (str_tab != NULL) {
+++		struct brcmf_core *pmu = brcmf_chip_get_pmu(ci);
+++
++ 		for (i = 0; str_tab[i].strength != 0; i++) {
++ 			if (drivestrength >= str_tab[i].strength) {
++ 				drivestrength_sel = str_tab[i].sel;
++ 				break;
++ 			}
++ 		}
++-		base = brcmf_chip_get_chipcommon(ci)->base;
++-		addr = CORE_CC_REG(base, chipcontrol_addr);
+++		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
++ 		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
++ 		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
++ 		cc_data_temp &= ~str_mask;
++@@ -3835,8 +3835,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
++ 		goto fail;
++ 
++ 	/* set PMUControl so a backplane reset does PMU state reload */
++-	reg_addr = CORE_CC_REG(brcmf_chip_get_chipcommon(bus->ci)->base,
++-			       pmucontrol);
+++	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
++ 	reg_val = brcmf_sdiod_regrl(bus->sdiodev, reg_addr, &err);
++ 	if (err)
++ 		goto fail;
+diff --git a/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch b/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch
 new file mode 100644
-index 0000000..2b61f4e
+index 0000000..35887fc
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/322-brcmfmac-only-call-brcmf_cfg80211_detach-when-attach.patch
-@@ -0,0 +1,92 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:56 +0200
-+Subject: [PATCH] brcmfmac: only call brcmf_cfg80211_detach() when attach
-+ was successful
++++ b/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch
+@@ -0,0 +1,38 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Tue, 26 Jan 2016 17:57:05 +0100
++Subject: [PATCH] brcmfmac: add support for 14e4:4365 PCI ID with BCM4366
++ chipset
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
 +
-+In brcmf_bus_start() the function brcmf_cfg80211_attach() is called which
-+may fail. If this happens we should not call brcmf_cfg80211_detach() in
-+the failure path as it will result in NULL pointer dereference:
++On Broadcom ARM routers BCM4366 cards are available with 14e4:4365 ID.
++Unfortunately this ID was already used by Broadcom for cards with
++BCM43142, a totally different chipset requiring SoftMAC driver. To avoid
++a conflict between brcmfmac and bcma use more specific ID entry with
++subvendor and subdevice specified.
 +
-+  brcmf_fweh_activate_events: Set event_msgs error (-5)
-+  brcmf_bus_start: failed: -5
-+  brcmf_sdio_firmware_callback: dongle is not responding
-+  BUG: unable to handle kernel NULL pointer dereference at 0000000000000068
-+  IP: [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
-+  PGD 0
-+  Oops: 0000 [#1] SMP
-+  Modules linked in: brcmfmac(O) brcmutil(O) cfg80211 auth_rpcgss
-+  CPU: 1 PID: 45 Comm: kworker/1:1 Tainted: G           O
-+  Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
-+  Workqueue: events request_firmware_work_func
-+  task: ffff880036c09ac0 ti: ffff880036dd4000 task.ti: ffff880036dd4000
-+  RIP: 0010:[<ffffffff811e8f08>]  [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
-+  RSP: 0018:ffff880036dd7a28  EFLAGS: 00010246
-+  RAX: ffff880036c09ac0 RBX: 0000000000000000 RCX: 000000007fffffff
-+  RDX: 0000000000000000 RSI: ffffffff816578b9 RDI: 0000000000000000
-+  RBP: ffff880036dd7a48 R08: 0000000000000000 R09: ffff880036c0b340
-+  R10: 00000000000002ec R11: ffff880036dd7b08 R12: ffffffff816578b9
-+  R13: 0000000000000000 R14: ffffffff816578b9 R15: ffff8800c6c87000
-+  FS:  0000000000000000(0000) GS:ffff88012bc40000(0000) knlGS:0000000000000000
-+  CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
-+  CR2: 0000000000000068 CR3: 0000000001a0b000 CR4: 00000000000006e0
-+  Stack:
-+   0000000000000000 ffffffff816578b9 0000000000000000 ffff8800c0d003c8
-+   ffff880036dd7a78 ffffffff811e8ff5 0000000ffffffff1 ffffffff81a9b060
-+   ffff8800c789f880 ffff8800c0d00000 ffff880036dd7a98 ffffffff811ebe0d
-+  Call Trace:
-+   [<ffffffff811e8ff5>] kernfs_find_and_get_ns+0x35/0x60
-+   [<ffffffff811ebe0d>] sysfs_unmerge_group+0x1d/0x60
-+   [<ffffffff81404ef2>] dpm_sysfs_remove+0x22/0x60
-+   [<ffffffff813f9db9>] device_del+0x49/0x240
-+   [<ffffffff815da768>] rfkill_unregister+0x58/0xc0
-+   [<ffffffffa06bd91b>] wiphy_unregister+0xab/0x2f0 [cfg80211]
-+   [<ffffffffa0742fe3>] brcmf_cfg80211_detach+0x23/0x50 [brcmfmac]
-+   [<ffffffffa074d986>] brcmf_detach+0x86/0xe0 [brcmfmac]
-+   [<ffffffffa0757de8>] brcmf_sdio_remove+0x48/0x120 [brcmfmac]
-+   [<ffffffffa0758ed9>] brcmf_sdiod_remove+0x29/0xd0 [brcmfmac]
-+   [<ffffffffa0759031>] brcmf_ops_sdio_remove+0xb1/0x110 [brcmfmac]
-+   [<ffffffffa001c267>] sdio_bus_remove+0x37/0x100 [mmc_core]
-+   [<ffffffff813fe026>] __device_release_driver+0x96/0x130
-+   [<ffffffff813fe0e3>] device_release_driver+0x23/0x30
-+   [<ffffffffa0754bc8>] brcmf_sdio_firmware_callback+0x2a8/0x5d0 [brcmfmac]
-+   [<ffffffffa074deaf>] brcmf_fw_request_nvram_done+0x15f/0x5e0 [brcmfmac]
-+   [<ffffffff8140142f>] ? devres_add+0x3f/0x50
-+   [<ffffffff810642b5>] ? usermodehelper_read_unlock+0x15/0x20
-+   [<ffffffff81400000>] ? platform_match+0x70/0xa0
-+   [<ffffffff8140f400>] request_firmware_work_func+0x30/0x60
-+   [<ffffffff8106828c>] process_one_work+0x14c/0x3d0
-+   [<ffffffff8106862a>] worker_thread+0x11a/0x450
-+   [<ffffffff81068510>] ? process_one_work+0x3d0/0x3d0
-+   [<ffffffff8106d692>] kthread+0xd2/0xf0
-+   [<ffffffff8106d5c0>] ? kthread_create_on_node+0x180/0x180
-+   [<ffffffff815ed35f>] ret_from_fork+0x3f/0x70
-+   [<ffffffff8106d5c0>] ? kthread_create_on_node+0x180/0x180
-+  Code: e9 40 fe ff ff 48 89 d8 eb 87 66 0f 1f 84 00 00 00 00 00 66 66 66 66
-+	90 55 48 89 e5 41 56 49 89 f6 41 55 49 89 d5 31 d2 41 54 53 <0f> b7
-+	47 68 48 8b 5f 48 66 c1 e8 05 83 e0 01 4d 85 ed 0f b6 c8
-+  RIP  [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
-+   RSP <ffff880036dd7a28>
-+  CR2: 0000000000000068
-+  ---[ end trace 87d6ec0d3fe46740 ]---
-+
-+Reported-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -1049,7 +1049,10 @@ int brcmf_bus_start(struct device *dev)
-+ fail:
-+ 	if (ret < 0) {
-+ 		brcmf_err("failed: %d\n", ret);
-+-		brcmf_cfg80211_detach(drvr->config);
-++		if (drvr->config) {
-++			brcmf_cfg80211_detach(drvr->config);
-++			drvr->config = NULL;
-++		}
-+ 		if (drvr->fws) {
-+ 			brcmf_fws_del_interface(ifp);
-+ 			brcmf_fws_deinit(drvr);
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++@@ -1951,6 +1951,9 @@ static const struct dev_pm_ops brcmf_pci
++ 
++ #define BRCMF_PCIE_DEVICE(dev_id)	{ BRCM_PCIE_VENDOR_ID_BROADCOM, dev_id,\
++ 	PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
+++#define BRCMF_PCIE_DEVICE_SUB(dev_id, subvend, subdev)	{ \
+++	BRCM_PCIE_VENDOR_ID_BROADCOM, dev_id,\
+++	subvend, subdev, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
++ 
++ static struct pci_device_id brcmf_pcie_devid_table[] = {
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
++@@ -1966,6 +1969,7 @@ static struct pci_device_id brcmf_pcie_d
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID),
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID),
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID),
+++	BRCMF_PCIE_DEVICE_SUB(0x4365, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4365),
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_DEVICE_ID),
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID),
++ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID),
 diff --git a/package/kernel/mac80211/patches/323-ath9k-add-multi_read-to-be-compatible-with-ath9k_htc.patch b/package/kernel/mac80211/patches/323-ath9k-add-multi_read-to-be-compatible-with-ath9k_htc.patch
 deleted file mode 100644
 index 246bb9d..0000000
@@ -11757,117 +12628,6 @@ index 246bb9d..0000000
 - 	ah->reg_ops.write = ath9k_iowrite32;
 - 	ah->reg_ops.rmw = ath9k_reg_rmw;
 - 	pCap = &ah->caps;
-diff --git a/package/kernel/mac80211/patches/323-brcmfmac-correct-detection-of-p2pdev-interface-event.patch b/package/kernel/mac80211/patches/323-brcmfmac-correct-detection-of-p2pdev-interface-event.patch
-new file mode 100644
-index 0000000..868b0a8
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-brcmfmac-correct-detection-of-p2pdev-interface-event.patch
-@@ -0,0 +1,105 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:57 +0200
-+Subject: [PATCH] brcmfmac: correct detection of p2pdev interface event
-+
-+The p2pdev interface is setup in firmware resulting in a interface
-+event. This event has role and no-if flag. When role is p2p client
-+and no-if flag is set it indicates that this is the p2pdev interface.
-+This info is used in handling the event and adding interface in the
-+driver.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+---
-+
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -795,7 +795,7 @@ fail:
-+ }
-+ 
-+ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-+-			      char *name, u8 *mac_addr)
-++			      bool is_p2pdev, char *name, u8 *mac_addr)
-+ {
-+ 	struct brcmf_if *ifp;
-+ 	struct net_device *ndev;
-+@@ -821,7 +821,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-+ 		}
-+ 	}
-+ 
-+-	if (!brcmf_p2p_enable && bssidx == 1) {
-++	if (!brcmf_p2p_enable && is_p2pdev) {
-+ 		/* this is P2P_DEVICE interface */
-+ 		brcmf_dbg(INFO, "allocate non-netdev interface\n");
-+ 		ifp = kzalloc(sizeof(*ifp), GFP_KERNEL);
-+@@ -999,12 +999,12 @@ int brcmf_bus_start(struct device *dev)
-+ 	brcmf_dbg(TRACE, "\n");
-+ 
-+ 	/* add primary networking interface */
-+-	ifp = brcmf_add_if(drvr, 0, 0, "wlan%d", NULL);
-++	ifp = brcmf_add_if(drvr, 0, 0, false, "wlan%d", NULL);
-+ 	if (IS_ERR(ifp))
-+ 		return PTR_ERR(ifp);
-+ 
-+ 	if (brcmf_p2p_enable)
-+-		p2p_ifp = brcmf_add_if(drvr, 1, 0, "p2p%d", NULL);
-++		p2p_ifp = brcmf_add_if(drvr, 1, 0, false, "p2p%d", NULL);
-+ 	else
-+ 		p2p_ifp = NULL;
-+ 	if (IS_ERR(p2p_ifp))
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
-+@@ -205,7 +205,7 @@ char *brcmf_ifname(struct brcmf_pub *drv
-+ struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-+ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-+ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-+-			      char *name, u8 *mac_addr);
-++			      bool is_p2pdev, char *name, u8 *mac_addr);
-+ void brcmf_remove_interface(struct brcmf_if *ifp);
-+ int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
-+ void brcmf_txflowblock_if(struct brcmf_if *ifp,
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
-+@@ -179,6 +179,7 @@ static void brcmf_fweh_handle_if_event(s
-+ {
-+ 	struct brcmf_if_event *ifevent = data;
-+ 	struct brcmf_if *ifp;
-++	bool is_p2pdev;
-+ 	int err = 0;
-+ 
-+ 	brcmf_dbg(EVENT, "action: %u idx: %u bsscfg: %u flags: %u role: %u\n",
-+@@ -186,18 +187,16 @@ static void brcmf_fweh_handle_if_event(s
-+ 		  ifevent->flags, ifevent->role);
-+ 
-+ 	/* The P2P Device interface event must not be ignored
-+-	 * contrary to what firmware tells us. The only way to
-+-	 * distinguish the P2P Device is by looking at the ifidx
-+-	 * and bssidx received.
-++	 * contrary to what firmware tells us.
-+ 	 */
-+-	if (!(ifevent->ifidx == 0 && ifevent->bssidx == 1) &&
-+-	    (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) {
-++	is_p2pdev = (ifevent->flags & BRCMF_E_IF_FLAG_NOIF) &&
-++		    ifevent->role == BRCMF_E_IF_ROLE_P2P_CLIENT;
-++	if (!is_p2pdev && (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) {
-+ 		brcmf_dbg(EVENT, "event can be ignored\n");
-+ 		return;
-+ 	}
-+ 	if (ifevent->ifidx >= BRCMF_MAX_IFS) {
-+-		brcmf_err("invalid interface index: %u\n",
-+-			  ifevent->ifidx);
-++		brcmf_err("invalid interface index: %u\n", ifevent->ifidx);
-+ 		return;
-+ 	}
-+ 
-+@@ -207,7 +206,7 @@ static void brcmf_fweh_handle_if_event(s
-+ 		brcmf_dbg(EVENT, "adding %s (%pM)\n", emsg->ifname,
-+ 			  emsg->addr);
-+ 		ifp = brcmf_add_if(drvr, ifevent->bssidx, ifevent->ifidx,
-+-				   emsg->ifname, emsg->addr);
-++				   is_p2pdev, emsg->ifname, emsg->addr);
-+ 		if (IS_ERR(ifp))
-+ 			return;
-+ 		brcmf_fws_add_interface(ifp);
 diff --git a/package/kernel/mac80211/patches/324-ath9k-add-new-function-ath9k_hw_read_array.patch b/package/kernel/mac80211/patches/324-ath9k-add-new-function-ath9k_hw_read_array.patch
 deleted file mode 100644
 index 2eda1c9..0000000
@@ -11943,138 +12703,44 @@ index 2eda1c9..0000000
 - u32 ath9k_hw_reverse_bits(u32 val, u32 n);
 - u16 ath9k_hw_computetxtime(struct ath_hw *ah,
 - 			   u8 phy, int kbps,
-diff --git a/package/kernel/mac80211/patches/324-brcmfmac-use-brcmf_get_ifp-to-map-ifidx-to-struct-br.patch b/package/kernel/mac80211/patches/324-brcmfmac-use-brcmf_get_ifp-to-map-ifidx-to-struct-br.patch
+diff --git a/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch b/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch
 new file mode 100644
-index 0000000..abd6681
+index 0000000..6ce60f1
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/324-brcmfmac-use-brcmf_get_ifp-to-map-ifidx-to-struct-br.patch
-@@ -0,0 +1,126 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:58 +0200
-+Subject: [PATCH] brcmfmac: use brcmf_get_ifp() to map ifidx to struct
-+ brcmf_if instance
-+
-+The knowledge on how to map the interface index to a struct brcmf_if
-+instance is in brcmf_get_ifp() so use that function when only the
-+interface index is known instead of accessing brcmf_pub::iflist
-+directly.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++++ b/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch
+@@ -0,0 +1,32 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Sun, 31 Jan 2016 12:14:34 +0100
++Subject: [PATCH] brcmfmac: treat NULL character in NVRAM as separator
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++Platform NVRAM (stored on a flash partition) has entries separated by a
++NULL (\0) char. Our parsing code switches from VALUE state to IDLE
++whenever it meets a NULL (\0). When that happens our IDLE handler should
++simply consume it and analyze whatever is placed ahead.
++
++This fixes harmless warnings spamming debugging output:
++[  155.165624] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=20: ignoring invalid character
++[  155.180806] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=44: ignoring invalid character
++[  155.195971] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=63: ignoring invalid character
++
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
-+@@ -149,7 +149,7 @@ static s32 brcmf_btcoex_params_read(stru
-+ static void brcmf_btcoex_boost_wifi(struct brcmf_btcoex_info *btci,
-+ 				    bool trump_sco)
-+ {
-+-	struct brcmf_if *ifp = btci->cfg->pub->iflist[0];
-++	struct brcmf_if *ifp = brcmf_get_ifp(btci->cfg->pub, 0);
-+ 
-+ 	if (trump_sco && !btci->saved_regs_part2) {
-+ 		/* this should reduce eSCO agressive
-+@@ -468,7 +468,7 @@ int brcmf_btcoex_set_mode(struct brcmf_c
-+ {
-+ 	struct brcmf_cfg80211_info *cfg = wiphy_priv(vif->wdev.wiphy);
-+ 	struct brcmf_btcoex_info *btci = cfg->btcoex;
-+-	struct brcmf_if *ifp = cfg->pub->iflist[0];
-++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
-+ 
-+ 	switch (mode) {
-+ 	case BRCMF_BTCOEX_DISABLED:
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-+@@ -6213,7 +6213,7 @@ static void brcmf_free_wiphy(struct wiph
-+ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
-+ 						  struct device *busdev)
-+ {
-+-	struct net_device *ndev = drvr->iflist[0]->ndev;
-++	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
-+ 	struct brcmf_cfg80211_info *cfg;
-+ 	struct wiphy *wiphy;
-+ 	struct brcmf_cfg80211_vif *vif;
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
-+@@ -121,7 +121,7 @@ static void brcmf_feat_iovar_int_set(str
-+ 
-+ void brcmf_feat_attach(struct brcmf_pub *drvr)
-+ {
-+-	struct brcmf_if *ifp = drvr->iflist[0];
-++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
-+ 
-+ 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
-+ 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
-+@@ -221,7 +221,7 @@ static void brcmf_flowring_block(struct
-+ 
-+ 	bus_if = dev_get_drvdata(flow->dev);
-+ 	drvr = bus_if->drvr;
-+-	ifp = drvr->iflist[ifidx];
-++	ifp = brcmf_get_ifp(drvr, ifidx);
-+ 	brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW, blocked);
-+ 
-+ 	spin_unlock_irqrestore(&flow->block_lock, flags);
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
-+@@ -334,7 +334,7 @@ void brcmf_fweh_attach(struct brcmf_pub
-+ void brcmf_fweh_detach(struct brcmf_pub *drvr)
-+ {
-+ 	struct brcmf_fweh_info *fweh = &drvr->fweh;
-+-	struct brcmf_if *ifp = drvr->iflist[0];
-++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
-+ 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
-+ 
-+ 	if (ifp) {
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-+@@ -972,7 +972,7 @@ static void
-+ brcmf_fws_flow_control_check(struct brcmf_fws_info *fws, struct pktq *pq,
-+ 			     u8 if_id)
-+ {
-+-	struct brcmf_if *ifp = fws->drvr->iflist[!if_id ? 0 : if_id + 1];
-++	struct brcmf_if *ifp = brcmf_get_ifp(fws->drvr, if_id);
-+ 
-+ 	if (WARN_ON(!ifp))
-+ 		return;
-+@@ -2118,6 +2118,7 @@ static int brcmf_debugfs_fws_stats_read(
-+ int brcmf_fws_init(struct brcmf_pub *drvr)
-+ {
-+ 	struct brcmf_fws_info *fws;
-++	struct brcmf_if *ifp;
-+ 	u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
-+ 	int rc;
-+ 	u32 mode;
-+@@ -2177,21 +2178,22 @@ int brcmf_fws_init(struct brcmf_pub *drv
-+ 	 * continue. Set mode back to none indicating not enabled.
-+ 	 */
-+ 	fws->fw_signals = true;
-+-	if (brcmf_fil_iovar_int_set(drvr->iflist[0], "tlv", tlv)) {
-++	ifp = brcmf_get_ifp(drvr, 0);
-++	if (brcmf_fil_iovar_int_set(ifp, "tlv", tlv)) {
-+ 		brcmf_err("failed to set bdcv2 tlv signaling\n");
-+ 		fws->fcmode = BRCMF_FWS_FCMODE_NONE;
-+ 		fws->fw_signals = false;
-+ 	}
-+ 
-+-	if (brcmf_fil_iovar_int_set(drvr->iflist[0], "ampdu_hostreorder", 1))
-++	if (brcmf_fil_iovar_int_set(ifp, "ampdu_hostreorder", 1))
-+ 		brcmf_dbg(INFO, "enabling AMPDU host-reorder failed\n");
-+ 
-+ 	/* Enable seq number reuse, if supported */
-+-	if (brcmf_fil_iovar_int_get(drvr->iflist[0], "wlfc_mode", &mode) == 0) {
-++	if (brcmf_fil_iovar_int_get(ifp, "wlfc_mode", &mode) == 0) {
-+ 		if (BRCMF_FWS_MODE_GET_REUSESEQ(mode)) {
-+ 			mode = 0;
-+ 			BRCMF_FWS_MODE_SET_REUSESEQ(mode, 1);
-+-			if (brcmf_fil_iovar_int_set(drvr->iflist[0],
-++			if (brcmf_fil_iovar_int_set(ifp,
-+ 						    "wlfc_mode", mode) == 0) {
-+ 				BRCMF_FWS_MODE_SET_REUSESEQ(fws->mode, 1);
-+ 			}
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++@@ -93,7 +93,7 @@ static enum nvram_parser_state brcmf_nvr
++ 	c = nvp->data[nvp->pos];
++ 	if (c == '\n')
++ 		return COMMENT;
++-	if (is_whitespace(c))
+++	if (is_whitespace(c) || c == '\0')
++ 		goto proceed;
++ 	if (c == '#')
++ 		return COMMENT;
 diff --git a/package/kernel/mac80211/patches/325-ath9k-ar9271_hw_pa_cal-use-REG_READ_ARRAY.patch b/package/kernel/mac80211/patches/325-ath9k-ar9271_hw_pa_cal-use-REG_READ_ARRAY.patch
 deleted file mode 100644
 index 4e4888f..0000000
@@ -12105,134 +12771,146 @@ index 4e4888f..0000000
 - 
 - 	ENABLE_REG_RMW_BUFFER(ah);
 - 	/* 7834, b1=0 */
-diff --git a/package/kernel/mac80211/patches/325-brcmfmac-pass-struct-brcmf_if-instance-in-brcmf_txfi.patch b/package/kernel/mac80211/patches/325-brcmfmac-pass-struct-brcmf_if-instance-in-brcmf_txfi.patch
+diff --git a/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch b/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch
 new file mode 100644
-index 0000000..23a7b6f
+index 0000000..012dea1
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/325-brcmfmac-pass-struct-brcmf_if-instance-in-brcmf_txfi.patch
-@@ -0,0 +1,122 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:14:59 +0200
-+Subject: [PATCH] brcmfmac: pass struct brcmf_if instance in
-+ brcmf_txfinalize()
-+
-+Most call sites of brcmf_txfinalize already have struct brcmf_if
-+instance so pass that to brcmf_txfinalize() as the function
-+needs it anyway.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++++ b/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch
+@@ -0,0 +1,41 @@
++From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
++Date: Mon, 25 Jan 2016 11:47:29 +0100
++Subject: [PATCH] brcmfmac: sdio: Increase the default timeouts a bit
++
++On a Radxa Rock2 board with a Ampak AP6335 (Broadcom 4339 core) it seems
++the card responds very quickly most of the time, unfortunately during
++initialisation it sometimes seems to take just a bit over 2 seconds to
++respond.
++
++This results intialization failing with message like:
++  brcmf_c_preinit_dcmds: Retreiving cur_etheraddr failed, -52
++  brcmf_bus_start: failed: -52
++  brcmf_sdio_firmware_callback: dongle is not responding
++
++Increasing the timeout to allow for a bit more headroom allows the
++card to initialize reliably.
++
++A quick search online after diagnosing/fixing this showed that Google
++has a similar patch in their ChromeOS tree, so this doesn't seem
++specific to the board I'm using.
++
++Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
++Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
++Acked-by: Arend van Spriel <arend@broadcom.com>
++Reviewed-by: Douglas Anderson <dianders@chromium.org>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -560,17 +560,11 @@ void brcmf_rx_frame(struct device *dev,
-+ 		brcmf_netif_rx(ifp, skb);
-+ }
-+ 
-+-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
-+-		      bool success)
-++void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success)
-+ {
-+-	struct brcmf_if *ifp;
-+ 	struct ethhdr *eh;
-+ 	u16 type;
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++@@ -45,8 +45,8 @@
++ #include "chip.h"
++ #include "firmware.h"
 + 
-+-	ifp = drvr->iflist[ifidx];
-+-	if (!ifp)
-+-		goto done;
-+-
-+ 	eh = (struct ethhdr *)(txp->data);
-+ 	type = ntohs(eh->h_proto);
-+ 
-+@@ -582,7 +576,7 @@ void brcmf_txfinalize(struct brcmf_pub *
++-#define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2000)
++-#define CTL_DONE_TIMEOUT	msecs_to_jiffies(2000)
+++#define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+++#define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
 + 
-+ 	if (!success)
-+ 		ifp->stats.tx_errors++;
-+-done:
-++
-+ 	brcmu_pkt_buf_free_skb(txp);
-+ }
++ #ifdef DEBUG
 + 
-+@@ -600,7 +594,7 @@ void brcmf_txcomplete(struct device *dev
-+ 		if (brcmf_proto_hdrpull(drvr, false, txp, &ifp))
-+ 			brcmu_pkt_buf_free_skb(txp);
-+ 		else
-+-			brcmf_txfinalize(drvr, txp, ifp->ifidx, success);
-++			brcmf_txfinalize(ifp, txp, success);
+diff --git a/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch b/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch
+new file mode 100644
+index 0000000..71f7a40
+--- /dev/null
++++ b/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch
+@@ -0,0 +1,87 @@
++From: Miaoqing Pan <miaoqing@codeaurora.org>
++Date: Fri, 5 Feb 2016 09:45:50 +0800
++Subject: [PATCH] ath9k: make NF load complete quickly and reliably
++
++Make NF load complete quickly and reliably. NF load execution
++is delayed by HW to end of frame if frame Rx or Tx is ongoing.
++Increasing timeout to max frame duration. If NF cal is ongoing
++before NF load, stop it before load, and restart it afterwards.
++
++Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/ath/ath9k/calib.c
+++++ b/drivers/net/wireless/ath/ath9k/calib.c
++@@ -241,6 +241,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
++ 	u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
++ 	struct ath_common *common = ath9k_hw_common(ah);
++ 	s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
+++	u32 bb_agc_ctl = REG_READ(ah, AR_PHY_AGC_CONTROL);
++ 
++ 	if (ah->caldata)
++ 		h = ah->caldata->nfCalHist;
++@@ -264,6 +265,16 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
 + 	}
-+ }
 + 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
-+@@ -210,8 +210,7 @@ void brcmf_remove_interface(struct brcmf
-+ int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
-+ void brcmf_txflowblock_if(struct brcmf_if *ifp,
-+ 			  enum brcmf_netif_stop_reason reason, bool state);
-+-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
-+-		      bool success);
-++void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
-+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
-+ 
-+ /* Sets dongle media info (drv_version, mac address). */
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-+@@ -1506,7 +1506,7 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-+ 		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifp->ifidx,
-+ 						    genbit, seq);
-+ 	if (remove_from_hanger || ret)
-+-		brcmf_txfinalize(fws->drvr, skb, ifp->ifidx, true);
-++		brcmf_txfinalize(ifp, skb, true);
++ 	/*
+++	 * stop NF cal if ongoing to ensure NF load completes immediately
+++	 * (or after end rx/tx frame if ongoing)
+++	 */
+++	if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
+++		REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
+++		REG_RMW_BUFFER_FLUSH(ah);
+++		ENABLE_REG_RMW_BUFFER(ah);
+++	}
+++
+++	/*
++ 	 * Load software filtered NF value into baseband internal minCCApwr
++ 	 * variable.
++ 	 */
++@@ -276,18 +287,33 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
 + 
-+ 	return 0;
-+ }
-+@@ -1905,7 +1905,7 @@ int brcmf_fws_process_skb(struct brcmf_i
-+ 	if (fws->avoid_queueing) {
-+ 		rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
-+ 		if (rc < 0)
-+-			brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
-++			brcmf_txfinalize(ifp, skb, false);
-+ 		return rc;
++ 	/*
++ 	 * Wait for load to complete, should be fast, a few 10s of us.
++-	 * The max delay was changed from an original 250us to 10000us
++-	 * since 250us often results in NF load timeout and causes deaf
++-	 * condition during stress testing 12/12/2009
+++	 * The max delay was changed from an original 250us to 22.2 msec.
+++	 * This would increase timeout to the longest possible frame
+++	 * (11n max length 22.1 msec)
++ 	 */
++-	for (j = 0; j < 10000; j++) {
+++	for (j = 0; j < 22200; j++) {
++ 		if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
++-		     AR_PHY_AGC_CONTROL_NF) == 0)
+++			      AR_PHY_AGC_CONTROL_NF) == 0)
++ 			break;
++ 		udelay(10);
 + 	}
 + 
-+@@ -1929,7 +1929,7 @@ int brcmf_fws_process_skb(struct brcmf_i
-+ 		brcmf_fws_schedule_deq(fws);
-+ 	} else {
-+ 		brcmf_err("drop skb: no hanger slot\n");
-+-		brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
-++		brcmf_txfinalize(ifp, skb, false);
-+ 		rc = -ENOMEM;
-+ 	}
-+ 	brcmf_fws_unlock(fws);
-+@@ -2009,8 +2009,9 @@ static void brcmf_fws_dequeue_worker(str
-+ 				ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
-+ 				brcmf_fws_lock(fws);
-+ 				if (ret < 0)
-+-					brcmf_txfinalize(drvr, skb, ifidx,
-+-							 false);
-++					brcmf_txfinalize(brcmf_get_ifp(drvr,
-++								       ifidx),
-++							 skb, false);
-+ 				if (fws->bus_flow_blocked)
-+ 					break;
-+ 			}
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
-+@@ -873,7 +873,11 @@ brcmf_msgbuf_process_txstatus(struct brc
-+ 	commonring = msgbuf->flowrings[flowid];
-+ 	atomic_dec(&commonring->outstanding_tx);
-+ 
-+-	brcmf_txfinalize(msgbuf->drvr, skb, tx_status->msg.ifidx, true);
-++	/* Hante: i believe this was a bug as tx_status->msg.ifidx was used
-++	 * in brcmf_txfinalize as index in drvr->iflist. Can you confirm/deny?
++ 	/*
+++	 * Restart NF so it can continue.
 ++	 */
-++	brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
-++			 skb, true);
-+ }
-+ 
-+ 
+++	if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
+++		ENABLE_REG_RMW_BUFFER(ah);
+++		if (bb_agc_ctl & AR_PHY_AGC_CONTROL_ENABLE_NF)
+++			REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+++				    AR_PHY_AGC_CONTROL_ENABLE_NF);
+++		if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NO_UPDATE_NF)
+++			REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+++				    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
+++		REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
+++		REG_RMW_BUFFER_FLUSH(ah);
+++	}
+++
+++	/*
++ 	 * We timed out waiting for the noisefloor to load, probably due to an
++ 	 * in-progress rx. Simply return here and allow the load plenty of time
++ 	 * to complete before the next calibration interval.  We need to avoid
++@@ -296,7 +322,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
++ 	 * here, the baseband nf cal will just be capped by our present
++ 	 * noisefloor until the next calibration timer.
++ 	 */
++-	if (j == 10000) {
+++	if (j == 22200) {
++ 		ath_dbg(common, ANY,
++ 			"Timeout while waiting for nf to load: AR_PHY_AGC_CONTROL=0x%x\n",
++ 			REG_READ(ah, AR_PHY_AGC_CONTROL));
 diff --git a/package/kernel/mac80211/patches/326-ath9k-use-one-shot-read-in-ath9k_hw_update_mibstats.patch b/package/kernel/mac80211/patches/326-ath9k-use-one-shot-read-in-ath9k_hw_update_mibstats.patch
 deleted file mode 100644
 index a22cd1d..0000000
@@ -12278,104 +12956,6 @@ index a22cd1d..0000000
 - }
 - 
 - static void ath9k_ani_restart(struct ath_hw *ah)
-diff --git a/package/kernel/mac80211/patches/326-brcmfmac-add-mapping-for-interface-index-to-bsscfg-i.patch b/package/kernel/mac80211/patches/326-brcmfmac-add-mapping-for-interface-index-to-bsscfg-i.patch
-new file mode 100644
-index 0000000..8ddc0a6
---- /dev/null
-+++ b/package/kernel/mac80211/patches/326-brcmfmac-add-mapping-for-interface-index-to-bsscfg-i.patch
-@@ -0,0 +1,92 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:15:00 +0200
-+Subject: [PATCH] brcmfmac: add mapping for interface index to bsscfg
-+ index
-+
-+Because the P2P Device interface in firmware uses the same interface
-+index as the primary interface we use the bsscfg index as index in the
-+struct brcmf_pub::iflist. However, in the data path we get the interface
-+index and not the bsscfg index. So we need a mapping of interface index
-+to bsscfg index, which can be determined upon handle adding the interface.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+---
-+
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -85,21 +85,20 @@ char *brcmf_ifname(struct brcmf_pub *drv
-+ 
-+ struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
-+ {
-++	struct brcmf_if *ifp;
-++	s32 bssidx;
-++
-+ 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
-+ 		brcmf_err("ifidx %d out of range\n", ifidx);
-+ 		return NULL;
-+ 	}
-+ 
-+-	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
-+-	 * events this is easy because it contains the bssidx which maps
-+-	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
-+-	 * bssidx 1 is used for p2p0 and no data can be received or
-+-	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
-+-	 */
-+-	if (ifidx)
-+-		ifidx++;
-++	ifp = NULL;
-++	bssidx = drvr->if2bss[ifidx];
-++	if (bssidx >= 0)
-++		ifp = drvr->iflist[bssidx];
-+ 
-+-	return drvr->iflist[ifidx];
-++	return ifp;
-+ }
-+ 
-+ static void _brcmf_set_multicast_list(struct work_struct *work)
-+@@ -831,6 +830,8 @@ struct brcmf_if *brcmf_add_if(struct brc
-+ 
-+ 		ifp = netdev_priv(ndev);
-+ 		ifp->ndev = ndev;
-++		/* store mapping ifidx to bssidx */
-++		drvr->if2bss[ifidx] = bssidx;
-+ 	}
-+ 
-+ 	ifp->drvr = drvr;
-+@@ -855,6 +856,7 @@ static void brcmf_del_if(struct brcmf_pu
-+ 	struct brcmf_if *ifp;
-+ 
-+ 	ifp = drvr->iflist[bssidx];
-++	drvr->if2bss[ifp->ifidx] = -1;
-+ 	drvr->iflist[bssidx] = NULL;
-+ 	if (!ifp) {
-+ 		brcmf_err("Null interface, idx=%d\n", bssidx);
-+@@ -862,6 +864,7 @@ static void brcmf_del_if(struct brcmf_pu
-+ 	}
-+ 	brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifp->ifidx);
-+ 	if (ifp->ndev) {
-++		drvr->if2bss[ifp->ifidx] = -1;
-+ 		if (bssidx == 0) {
-+ 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
-+ 				rtnl_lock();
-+@@ -926,6 +929,7 @@ int brcmf_attach(struct device *dev)
-+ 	if (!drvr)
-+ 		return -ENOMEM;
-+ 
-++	memset(drvr->if2bss, 0xFF, sizeof(drvr->if2bss));
-+ 	mutex_init(&drvr->proto_block);
-+ 
-+ 	/* Link to bus module */
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
-+@@ -122,6 +122,7 @@ struct brcmf_pub {
-+ 	struct mac_address addresses[BRCMF_MAX_IFS];
-+ 
-+ 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
-++	s32 if2bss[BRCMF_MAX_IFS];
-+ 
-+ 	struct mutex proto_block;
-+ 	unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
 diff --git a/package/kernel/mac80211/patches/327-ath9k-ath9k_hw_loadnf-use-REG_RMW.patch b/package/kernel/mac80211/patches/327-ath9k-ath9k_hw_loadnf-use-REG_RMW.patch
 deleted file mode 100644
 index e5a362f..0000000
@@ -12453,115 +13033,66 @@ index e5a362f..0000000
 - 
 - 	return 0;
 - }
-diff --git a/package/kernel/mac80211/patches/327-brcmfmac-add-dedicated-debug-level-for-firmware-cons.patch b/package/kernel/mac80211/patches/327-brcmfmac-add-dedicated-debug-level-for-firmware-cons.patch
+diff --git a/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch b/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch
 new file mode 100644
-index 0000000..a0a798b
+index 0000000..f7f9df9
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/327-brcmfmac-add-dedicated-debug-level-for-firmware-cons.patch
-@@ -0,0 +1,103 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:15:01 +0200
-+Subject: [PATCH] brcmfmac: add dedicated debug level for firmware
-+ console logging
-+
-+Both PCIe and SDIO devices have the possibility to log the firmware
-+console output in kernel log. For PCIe it is logged when PCIE debug
-+level is enabled. For SDIO it is logged when user specifies a non-zero
-+console interval through debugfs. This patch tries to make it a
-+bit more consistent. The firmware console output is only logged when
-+FWCON debug level is enabled.
-+
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++++ b/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch
+@@ -0,0 +1,54 @@
++From: Henning Rogge <hrogge@gmail.com>
++Date: Wed, 3 Feb 2016 13:58:36 +0100
++Subject: [PATCH] mac80211: Remove MPP table entries with MPath
++
++Make the mesh_path_del() function remove all mpp table entries
++that are proxied by the removed mesh path.
++
++Acked-by: Bob Copeland <me@bobcopeland.com>
++Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
-+@@ -37,6 +37,7 @@
-+ #define BRCMF_SDIO_VAL		0x00020000
-+ #define BRCMF_MSGBUF_VAL	0x00040000
-+ #define BRCMF_PCIE_VAL		0x00080000
-++#define BRCMF_FWCON_VAL		0x00100000
-+ 
-+ /* set default print format */
-+ #undef pr_fmt
-+@@ -78,6 +79,7 @@ do {								\
-+ #define BRCMF_GLOM_ON()		(brcmf_msg_level & BRCMF_GLOM_VAL)
-+ #define BRCMF_EVENT_ON()	(brcmf_msg_level & BRCMF_EVENT_VAL)
-+ #define BRCMF_FIL_ON()		(brcmf_msg_level & BRCMF_FIL_VAL)
-++#define BRCMF_FWCON_ON()	(brcmf_msg_level & BRCMF_FWCON_VAL)
-+ 
-+ #else /* defined(DEBUG) || defined(CPTCFG_BRCM_TRACING) */
-+ 
-+@@ -90,6 +92,7 @@ do {								\
-+ #define BRCMF_GLOM_ON()		0
-+ #define BRCMF_EVENT_ON()	0
-+ #define BRCMF_FIL_ON()		0
-++#define BRCMF_FWCON_ON()	0
-+ 
-+ #endif /* defined(DEBUG) || defined(CPTCFG_BRCM_TRACING) */
-+ 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
-+@@ -644,7 +644,7 @@ static void brcmf_pcie_bus_console_init(
-+ 	addr = console->base_addr + BRCMF_CONSOLE_BUFSIZE_OFFSET;
-+ 	console->bufsize = brcmf_pcie_read_tcm32(devinfo, addr);
-+ 
-+-	brcmf_dbg(PCIE, "Console: base %x, buf %x, size %d\n",
-++	brcmf_dbg(FWCON, "Console: base %x, buf %x, size %d\n",
-+ 		  console->base_addr, console->buf_addr, console->bufsize);
++--- a/net/mac80211/mesh_pathtbl.c
+++++ b/net/mac80211/mesh_pathtbl.c
++@@ -835,6 +835,29 @@ void mesh_path_flush_by_nexthop(struct s
++ 	rcu_read_unlock();
 + }
 + 
-+@@ -656,6 +656,9 @@ static void brcmf_pcie_bus_console_read(
-+ 	u8 ch;
-+ 	u32 newidx;
-+ 
-++	if (!BRCMF_FWCON_ON())
-++		return;
+++static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
+++			       const u8 *proxy)
+++{
+++	struct mesh_table *tbl;
+++	struct mesh_path *mpp;
+++	struct mpath_node *node;
+++	int i;
 ++
-+ 	console = &devinfo->shared.console;
-+ 	addr = console->base_addr + BRCMF_CONSOLE_WRITEIDX_OFFSET;
-+ 	newidx = brcmf_pcie_read_tcm32(devinfo, addr);
-+@@ -677,7 +680,7 @@ static void brcmf_pcie_bus_console_read(
-+ 		}
-+ 		if (ch == '\n') {
-+ 			console->log_str[console->log_idx] = 0;
-+-			brcmf_dbg(PCIE, "CONSOLE: %s", console->log_str);
-++			pr_debug("CONSOLE: %s", console->log_str);
-+ 			console->log_idx = 0;
-+ 		}
-+ 	}
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
-+@@ -123,6 +123,7 @@ struct rte_console {
-+ 
-+ #define BRCMF_FIRSTREAD	(1 << 6)
-+ 
-++#define BRCMF_CONSOLE	10	/* watchdog interval to poll console */
-+ 
-+ /* SBSDIO_DEVICE_CTL */
-+ 
-+@@ -3204,6 +3205,8 @@ static void brcmf_sdio_debugfs_create(st
-+ 	if (IS_ERR_OR_NULL(dentry))
-+ 		return;
+++	rcu_read_lock();
+++	read_lock_bh(&pathtbl_resize_lock);
+++	tbl = resize_dereference_mpp_paths();
+++	for_each_mesh_entry(tbl, node, i) {
+++		mpp = node->mpath;
+++		if (ether_addr_equal(mpp->mpp, proxy)) {
+++			spin_lock(&tbl->hashwlock[i]);
+++			__mesh_path_del(tbl, node);
+++			spin_unlock(&tbl->hashwlock[i]);
+++		}
+++	}
+++	read_unlock_bh(&pathtbl_resize_lock);
+++	rcu_read_unlock();
+++}
+++
++ static void table_flush_by_iface(struct mesh_table *tbl,
++ 				 struct ieee80211_sub_if_data *sdata)
++ {
++@@ -892,6 +915,9 @@ int mesh_path_del(struct ieee80211_sub_i
++ 	int hash_idx;
++ 	int err = 0;
 + 
-++	bus->console_interval = BRCMF_CONSOLE;
+++	/* flush relevant mpp entries first */
+++	mpp_flush_by_proxy(sdata, addr);
 ++
-+ 	brcmf_debugfs_add_entry(drvr, "forensics", brcmf_sdio_forensic_read);
-+ 	brcmf_debugfs_add_entry(drvr, "counters",
-+ 				brcmf_debugfs_sdio_count_read);
-+@@ -3613,7 +3616,7 @@ static void brcmf_sdio_bus_watchdog(stru
-+ 	}
-+ #ifdef DEBUG
-+ 	/* Poll for console output periodically */
-+-	if (bus->sdiodev->state == BRCMF_SDIOD_DATA &&
-++	if (bus->sdiodev->state == BRCMF_SDIOD_DATA && BRCMF_FWCON_ON() &&
-+ 	    bus->console_interval != 0) {
-+ 		bus->console.count += BRCMF_WD_POLL_MS;
-+ 		if (bus->console.count >= bus->console_interval) {
++ 	read_lock_bh(&pathtbl_resize_lock);
++ 	tbl = resize_dereference_mesh_paths();
++ 	hash_idx = mesh_table_hash(addr, sdata, tbl);
 diff --git a/package/kernel/mac80211/patches/328-ath9k-write-buffer-related-optimisation-in-ar5008_hw.patch b/package/kernel/mac80211/patches/328-ath9k-write-buffer-related-optimisation-in-ar5008_hw.patch
 deleted file mode 100644
 index 01c8011..0000000
@@ -12595,46 +13126,116 @@ index 01c8011..0000000
 - 	REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
 - 	REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
 - 
-diff --git a/package/kernel/mac80211/patches/328-brcmfmac-remove-ifidx-parameter-from-brcmf_fws_txsta.patch b/package/kernel/mac80211/patches/328-brcmfmac-remove-ifidx-parameter-from-brcmf_fws_txsta.patch
+diff --git a/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch b/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch
 new file mode 100644
-index 0000000..53e7ede
+index 0000000..740993c
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/328-brcmfmac-remove-ifidx-parameter-from-brcmf_fws_txsta.patch
-@@ -0,0 +1,34 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:15:02 +0200
-+Subject: [PATCH] brcmfmac: remove ifidx parameter from
-+ brcmf_fws_txstatus_suppressed()
++++ b/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch
+@@ -0,0 +1,104 @@
++From: Henning Rogge <hrogge@gmail.com>
++Date: Wed, 3 Feb 2016 13:58:37 +0100
++Subject: [PATCH] mac80211: let unused MPP table entries timeout
 +
-+The brcmf_fws_txstatus_suppressed() function prototype specifies an
-+ifidx parameter which is not used within the function implementation.
++Remember the last time when a mpp table entry is used for
++rx or tx and remove them after MESH_PATH_EXPIRE time.
 +
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Acked-by: Bob Copeland <me@bobcopeland.com>
++Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-+@@ -1398,7 +1398,7 @@ done:
++--- a/net/mac80211/mesh_pathtbl.c
+++++ b/net/mac80211/mesh_pathtbl.c
++@@ -942,6 +942,46 @@ enddel:
++ }
++ 
++ /**
+++ * mpp_path_del - delete a mesh proxy path from the table
+++ *
+++ * @addr: addr address (ETH_ALEN length)
+++ * @sdata: local subif
+++ *
+++ * Returns: 0 if successful
+++ */
+++static int mpp_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
+++{
+++	struct mesh_table *tbl;
+++	struct mesh_path *mpath;
+++	struct mpath_node *node;
+++	struct hlist_head *bucket;
+++	int hash_idx;
+++	int err = 0;
+++
+++	read_lock_bh(&pathtbl_resize_lock);
+++	tbl = resize_dereference_mpp_paths();
+++	hash_idx = mesh_table_hash(addr, sdata, tbl);
+++	bucket = &tbl->hash_buckets[hash_idx];
+++
+++	spin_lock(&tbl->hashwlock[hash_idx]);
+++	hlist_for_each_entry(node, bucket, list) {
+++		mpath = node->mpath;
+++		if (mpath->sdata == sdata &&
+++		    ether_addr_equal(addr, mpath->dst)) {
+++			__mesh_path_del(tbl, node);
+++			goto enddel;
+++		}
+++	}
+++
+++	err = -ENXIO;
+++enddel:
+++	mesh_paths_generation++;
+++	spin_unlock(&tbl->hashwlock[hash_idx]);
+++	read_unlock_bh(&pathtbl_resize_lock);
+++	return err;
+++}
+++
+++/**
++  * mesh_path_tx_pending - sends pending frames in a mesh path queue
++  *
++  * @mpath: mesh path to activate
++@@ -1157,6 +1197,17 @@ void mesh_path_expire(struct ieee80211_s
++ 		     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
++ 			mesh_path_del(mpath->sdata, mpath->dst);
++ 	}
+++
+++	tbl = rcu_dereference(mpp_paths);
+++	for_each_mesh_entry(tbl, node, i) {
+++		if (node->mpath->sdata != sdata)
+++			continue;
+++		mpath = node->mpath;
+++		if ((!(mpath->flags & MESH_PATH_FIXED)) &&
+++		    time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
+++			mpp_path_del(mpath->sdata, mpath->dst);
+++	}
+++
++ 	rcu_read_unlock();
 + }
 + 
-+ static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
-+-					 struct sk_buff *skb, u8 ifidx,
-++					 struct sk_buff *skb,
-+ 					 u32 genbit, u16 seq)
-+ {
-+ 	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
-+@@ -1503,7 +1503,7 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-+ 		return -EINVAL;
-+ 	}
-+ 	if (!remove_from_hanger)
-+-		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifp->ifidx,
-++		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
-+ 						    genbit, seq);
-+ 	if (remove_from_hanger || ret)
-+ 		brcmf_txfinalize(ifp, skb, true);
++--- a/net/mac80211/rx.c
+++++ b/net/mac80211/rx.c
++@@ -2291,6 +2291,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
++ 			spin_lock_bh(&mppath->state_lock);
++ 			if (!ether_addr_equal(mppath->mpp, mpp_addr))
++ 				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
+++			mppath->exp_time = jiffies;
++ 			spin_unlock_bh(&mppath->state_lock);
++ 		}
++ 		rcu_read_unlock();
++--- a/net/mac80211/tx.c
+++++ b/net/mac80211/tx.c
++@@ -2171,8 +2171,11 @@ static struct sk_buff *ieee80211_build_h
++ 					mpp_lookup = true;
++ 			}
++ 
++-			if (mpp_lookup)
+++			if (mpp_lookup) {
++ 				mppath = mpp_path_lookup(sdata, skb->data);
+++				if (mppath)
+++					mppath->exp_time = jiffies;
+++			}
++ 
++ 			if (mppath && mpath)
++ 				mesh_path_del(mpath->sdata, mpath->dst);
 diff --git a/package/kernel/mac80211/patches/329-ath9k-ath9k_hw_set_4k_power_cal_tabl-use-rmw-buffer.patch b/package/kernel/mac80211/patches/329-ath9k-ath9k_hw_set_4k_power_cal_tabl-use-rmw-buffer.patch
 deleted file mode 100644
 index e5219f2..0000000
@@ -12667,109 +13268,155 @@ index e5219f2..0000000
 - 
 - 	for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
 - 		regChainOffset = i * 0x1000;
-diff --git a/package/kernel/mac80211/patches/329-brcmfmac-change-prototype-for-brcmf_fws_hdrpull.patch b/package/kernel/mac80211/patches/329-brcmfmac-change-prototype-for-brcmf_fws_hdrpull.patch
+diff --git a/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch b/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch
 new file mode 100644
-index 0000000..bb05235
+index 0000000..0c36b1d
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/329-brcmfmac-change-prototype-for-brcmf_fws_hdrpull.patch
-@@ -0,0 +1,97 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:15:03 +0200
-+Subject: [PATCH] brcmfmac: change prototype for brcmf_fws_hdrpull()
++++ b/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch
+@@ -0,0 +1,143 @@
++From: Henning Rogge <hrogge@gmail.com>
++Date: Wed, 3 Feb 2016 13:58:38 +0100
++Subject: [PATCH] mac80211: Unify mesh and mpp path removal function
 +
-+Instead of passing ifidx and drvr just pass struct brcmf_if pointer
-+which holds both parameters.
++mpp_path_del() and mesh_path_del() are mostly the same function.
++Move common code into a new static function.
 +
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Acked-by: Bob Copeland <me@bobcopeland.com>
++Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
-+@@ -312,8 +312,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
++--- a/net/mac80211/mesh_pathtbl.c
+++++ b/net/mac80211/mesh_pathtbl.c
++@@ -55,16 +55,21 @@ int mpp_paths_generation;
++ static DEFINE_RWLOCK(pathtbl_resize_lock);
 + 
-+ 	skb_pull(pktbuf, BCDC_HEADER_LEN);
-+ 	if (do_fws)
-+-		brcmf_fws_hdrpull(drvr, tmp_if->ifidx, h->data_offset << 2,
-+-				  pktbuf);
-++		brcmf_fws_hdrpull(tmp_if, h->data_offset << 2, pktbuf);
-+ 	else
-+ 		skb_pull(pktbuf, h->data_offset << 2);
 + 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
-+@@ -1616,11 +1616,10 @@ static int brcmf_fws_notify_bcmc_credit_
-+ 	return 0;
+++static inline struct mesh_table *resize_dereference_paths(
+++	struct mesh_table __rcu *table)
+++{
+++	return rcu_dereference_protected(table,
+++					lockdep_is_held(&pathtbl_resize_lock));
+++}
+++
++ static inline struct mesh_table *resize_dereference_mesh_paths(void)
++ {
++-	return rcu_dereference_protected(mesh_paths,
++-		lockdep_is_held(&pathtbl_resize_lock));
+++	return resize_dereference_paths(mesh_paths);
 + }
 + 
-+-int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
-+-		      struct sk_buff *skb)
-++void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
++ static inline struct mesh_table *resize_dereference_mpp_paths(void)
 + {
-+ 	struct brcmf_skb_reorder_data *rd;
-+-	struct brcmf_fws_info *fws = drvr->fws;
-++	struct brcmf_fws_info *fws = ifp->drvr->fws;
-+ 	u8 *signal_data;
-+ 	s16 data_len;
-+ 	u8 type;
-+@@ -1630,20 +1629,20 @@ int brcmf_fws_hdrpull(struct brcmf_pub *
-+ 	s32 err;
-+ 
-+ 	brcmf_dbg(HDRS, "enter: ifidx %d, skblen %u, sig %d\n",
-+-		  ifidx, skb->len, signal_len);
-++		  ifp->ifidx, skb->len, siglen);
-+ 
-+-	WARN_ON(signal_len > skb->len);
-++	WARN_ON(siglen > skb->len);
-+ 
-+-	if (!signal_len)
-+-		return 0;
-++	if (!siglen)
-++		return;
-+ 	/* if flow control disabled, skip to packet data and leave */
-+ 	if ((!fws) || (!fws->fw_signals)) {
-+-		skb_pull(skb, signal_len);
-+-		return 0;
-++		skb_pull(skb, siglen);
-++		return;
-+ 	}
++-	return rcu_dereference_protected(mpp_paths,
++-		lockdep_is_held(&pathtbl_resize_lock));
+++	return resize_dereference_paths(mpp_paths);
++ }
 + 
-+ 	fws->stats.header_pulls++;
-+-	data_len = signal_len;
-++	data_len = siglen;
-+ 	signal_data = skb->data;
++ /*
++@@ -899,14 +904,17 @@ void mesh_path_flush_by_iface(struct iee
++ }
 + 
-+ 	status = BRCMF_FWS_RET_OK_NOSCHEDULE;
-+@@ -1731,14 +1730,12 @@ int brcmf_fws_hdrpull(struct brcmf_pub *
-+ 	/* signalling processing result does
-+ 	 * not affect the actual ethernet packet.
-+ 	 */
-+-	skb_pull(skb, signal_len);
-++	skb_pull(skb, siglen);
++ /**
++- * mesh_path_del - delete a mesh path from the table
+++ * table_path_del - delete a path from the mesh or mpp table
++  *
++- * @addr: dst address (ETH_ALEN length)
+++ * @tbl: mesh or mpp path table
++  * @sdata: local subif
+++ * @addr: dst address (ETH_ALEN length)
++  *
++  * Returns: 0 if successful
++  */
++-int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
+++static int table_path_del(struct mesh_table __rcu *rcu_tbl,
+++			  struct ieee80211_sub_if_data *sdata,
+++			  const u8 *addr)
++ {
++ 	struct mesh_table *tbl;
++ 	struct mesh_path *mpath;
++@@ -915,11 +923,7 @@ int mesh_path_del(struct ieee80211_sub_i
++ 	int hash_idx;
++ 	int err = 0;
 + 
-+ 	/* this may be a signal-only packet
-+ 	 */
-+ 	if (skb->len == 0)
-+ 		fws->stats.header_only_pkt++;
++-	/* flush relevant mpp entries first */
++-	mpp_flush_by_proxy(sdata, addr);
++-
++-	read_lock_bh(&pathtbl_resize_lock);
++-	tbl = resize_dereference_mesh_paths();
+++	tbl = resize_dereference_paths(rcu_tbl);
++ 	hash_idx = mesh_table_hash(addr, sdata, tbl);
++ 	bucket = &tbl->hash_buckets[hash_idx];
++ 
++@@ -935,9 +939,30 @@ int mesh_path_del(struct ieee80211_sub_i
++ 
++ 	err = -ENXIO;
++ enddel:
++-	mesh_paths_generation++;
++ 	spin_unlock(&tbl->hashwlock[hash_idx]);
+++	return err;
+++}
+++
+++/**
+++ * mesh_path_del - delete a mesh path from the table
+++ *
+++ * @addr: dst address (ETH_ALEN length)
+++ * @sdata: local subif
+++ *
+++ * Returns: 0 if successful
+++ */
+++int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
+++{
+++	int err = 0;
+++
+++	/* flush relevant mpp entries first */
+++	mpp_flush_by_proxy(sdata, addr);
+++
+++	read_lock_bh(&pathtbl_resize_lock);
+++	err = table_path_del(mesh_paths, sdata, addr);
+++	mesh_paths_generation++;
++ 	read_unlock_bh(&pathtbl_resize_lock);
+++
++ 	return err;
++ }
++ 
++@@ -951,33 +976,13 @@ enddel:
++  */
++ static int mpp_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
++ {
++-	struct mesh_table *tbl;
++-	struct mesh_path *mpath;
++-	struct mpath_node *node;
++-	struct hlist_head *bucket;
++-	int hash_idx;
++ 	int err = 0;
++ 
++ 	read_lock_bh(&pathtbl_resize_lock);
++-	tbl = resize_dereference_mpp_paths();
++-	hash_idx = mesh_table_hash(addr, sdata, tbl);
++-	bucket = &tbl->hash_buckets[hash_idx];
++-
++-	spin_lock(&tbl->hashwlock[hash_idx]);
++-	hlist_for_each_entry(node, bucket, list) {
++-		mpath = node->mpath;
++-		if (mpath->sdata == sdata &&
++-		    ether_addr_equal(addr, mpath->dst)) {
++-			__mesh_path_del(tbl, node);
++-			goto enddel;
++-		}
++-	}
 +-
-+-	return 0;
++-	err = -ENXIO;
++-enddel:
++-	mesh_paths_generation++;
++-	spin_unlock(&tbl->hashwlock[hash_idx]);
+++	err = table_path_del(mpp_paths, sdata, addr);
+++	mpp_paths_generation++;
++ 	read_unlock_bh(&pathtbl_resize_lock);
+++
++ 	return err;
 + }
 + 
-+ static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
-+@@ -21,8 +21,7 @@
-+ int brcmf_fws_init(struct brcmf_pub *drvr);
-+ void brcmf_fws_deinit(struct brcmf_pub *drvr);
-+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
-+-int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
-+-		      struct sk_buff *skb);
-++void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
-+ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb);
-+ 
-+ void brcmf_fws_reset_interface(struct brcmf_if *ifp);
 diff --git a/package/kernel/mac80211/patches/330-ath9k-use-rmw-buffer-in-ath9k_hw_set_operating_mode-.patch b/package/kernel/mac80211/patches/330-ath9k-use-rmw-buffer-in-ath9k_hw_set_operating_mode-.patch
 deleted file mode 100644
 index 6ce3f40..0000000
@@ -12819,111 +13466,63 @@ index 6ce3f40..0000000
 - 
 - 	ath9k_hw_init_bb(ah, chan);
 - 
-diff --git a/package/kernel/mac80211/patches/330-brcmfmac-introduce-brcmf_net_detach-function.patch b/package/kernel/mac80211/patches/330-brcmfmac-introduce-brcmf_net_detach-function.patch
+diff --git a/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch b/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch
 new file mode 100644
-index 0000000..0651a2f
+index 0000000..4dc6d66
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/330-brcmfmac-introduce-brcmf_net_detach-function.patch
-@@ -0,0 +1,99 @@
-+From: Arend van Spriel <arend@broadcom.com>
-+Date: Wed, 26 Aug 2015 22:15:04 +0200
-+Subject: [PATCH] brcmfmac: introduce brcmf_net_detach() function
-+
-+In case of error during brcmf_bus_start() the network interfaces were
-+freed using free_netdev(). However, the interfaces may have additional
-+memory allocated which is not freed. The netdev has destructor set to
-+brcmf_cfg80211_free_netdev() which frees the additional memory if
-+allocated and call free_netdev(). The brcmf_net_detach() either calls
-+brcmf_cfg80211_free_netdev() directly or uses unregister_netdev() when
-+struct net_device::reg_state indicates the netdev was registered.
-+
-+Reported-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
-+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
++++ b/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch
+@@ -0,0 +1,51 @@
++From: Sven Eckelmann <sven.eckelmann@open-mesh.com>
++Date: Tue, 2 Feb 2016 08:12:26 +0100
++Subject: [PATCH] mac80211: minstrel: Change expected throughput unit back to
++ Kbps
++
++The change from cur_tp to the function
++minstrel_get_tp_avg/minstrel_ht_get_tp_avg changed the unit used for the
++current throughput. For example in minstrel_ht the correct
++conversion between them would be:
++
++    mrs->cur_tp / 10 == minstrel_ht_get_tp_avg(..).
++
++This factor 10 must also be included in the calculation of
++minstrel_get_expected_throughput and minstrel_ht_get_expected_throughput to
++return values with the unit [Kbps] instead of [10Kbps]. Otherwise routing
++algorithms like B.A.T.M.A.N. V will make incorrect decision based on these
++values. Its kernel based implementation expects expected_throughput always
++to have the unit [Kbps] and not sometimes [10Kbps] and sometimes [Kbps].
++
++The same requirement has iw or olsrdv2's nl80211 based statistics module
++which retrieve the same data via NL80211_STA_INFO_TX_BITRATE.
++
++Cc: stable@vger.kernel.org
++Fixes: 6a27b2c40b48 ("mac80211: restructure per-rate throughput calculation into function")
++Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
++Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
-+@@ -4747,7 +4747,8 @@ void brcmf_cfg80211_free_netdev(struct n
-+ 	ifp = netdev_priv(ndev);
-+ 	vif = ifp->vif;
-+ 
-+-	brcmf_free_vif(vif);
-++	if (vif)
-++		brcmf_free_vif(vif);
-+ 	free_netdev(ndev);
-+ }
-+ 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
-+@@ -718,8 +718,6 @@ int brcmf_net_attach(struct brcmf_if *if
-+ 	}
-+ 
-+ 	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
-+-
-+-	ndev->destructor = brcmf_cfg80211_free_netdev;
-+ 	return 0;
-+ 
-+ fail:
-+@@ -729,6 +727,14 @@ fail:
-+ 	return -EBADE;
-+ }
-+ 
-++static void brcmf_net_detach(struct net_device *ndev)
-++{
-++	if (ndev->reg_state == NETREG_REGISTERED)
-++		unregister_netdev(ndev);
-++	else
-++		brcmf_cfg80211_free_netdev(ndev);
-++}
-++
-+ static int brcmf_net_p2p_open(struct net_device *ndev)
-+ {
-+ 	brcmf_dbg(TRACE, "Enter\n");
-+@@ -805,8 +811,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-+ 			  ifp->ndev->name);
-+ 		if (ifidx) {
-+ 			netif_stop_queue(ifp->ndev);
-+-			unregister_netdev(ifp->ndev);
-+-			free_netdev(ifp->ndev);
-++			brcmf_net_detach(ifp->ndev);
-+ 			drvr->iflist[bssidx] = NULL;
-+ 		} else {
-+ 			brcmf_err("ignore IF event\n");
-+@@ -828,6 +833,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-+ 		if (!ndev)
-+ 			return ERR_PTR(-ENOMEM);
-+ 
-++		ndev->destructor = brcmf_cfg80211_free_netdev;
-+ 		ifp = netdev_priv(ndev);
-+ 		ifp->ndev = ndev;
-+ 		/* store mapping ifidx to bssidx */
-+@@ -879,8 +885,7 @@ static void brcmf_del_if(struct brcmf_pu
-+ 			cancel_work_sync(&ifp->setmacaddr_work);
-+ 			cancel_work_sync(&ifp->multicast_work);
-+ 		}
-+-		/* unregister will take care of freeing it */
-+-		unregister_netdev(ifp->ndev);
-++		brcmf_net_detach(ifp->ndev);
-+ 	}
++--- a/net/mac80211/rc80211_minstrel.c
+++++ b/net/mac80211/rc80211_minstrel.c
++@@ -711,7 +711,7 @@ static u32 minstrel_get_expected_through
++ 	 * computing cur_tp
++ 	 */
++ 	tmp_mrs = &mi->r[idx].stats;
++-	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma);
+++	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma) * 10;
++ 	tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024;
++ 
++ 	return tmp_cur_tp;
++--- a/net/mac80211/rc80211_minstrel_ht.c
+++++ b/net/mac80211/rc80211_minstrel_ht.c
++@@ -1335,7 +1335,8 @@ static u32 minstrel_ht_get_expected_thro
++ 	prob = mi->groups[i].rates[j].prob_ewma;
++ 
++ 	/* convert tp_avg from pkt per second in kbps */
++-	tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * AVG_PKT_SIZE * 8 / 1024;
+++	tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * 10;
+++	tp_avg = tp_avg * AVG_PKT_SIZE * 8 / 1024;
++ 
++ 	return tp_avg;
 + }
-+ 
-+@@ -1056,11 +1061,11 @@ fail:
-+ 			brcmf_fws_deinit(drvr);
-+ 		}
-+ 		if (drvr->iflist[0]) {
-+-			free_netdev(ifp->ndev);
-++			brcmf_net_detach(ifp->ndev);
-+ 			drvr->iflist[0] = NULL;
-+ 		}
-+ 		if (p2p_ifp) {
-+-			free_netdev(p2p_ifp->ndev);
-++			brcmf_net_detach(p2p_ifp->ndev);
-+ 			drvr->iflist[1] = NULL;
-+ 		}
-+ 		return ret;
 diff --git a/package/kernel/mac80211/patches/331-ath9k-ath9k_hw_4k_set_board_values-use-rmw-buffer.patch b/package/kernel/mac80211/patches/331-ath9k-ath9k_hw_4k_set_board_values-use-rmw-buffer.patch
 deleted file mode 100644
 index edd6160..0000000
@@ -12956,244 +13555,319 @@ index edd6160..0000000
 - 	}
 - }
 - 
-diff --git a/package/kernel/mac80211/patches/331-brcmfmac-Reset-PCIE-devices-after-recognition.patch b/package/kernel/mac80211/patches/331-brcmfmac-Reset-PCIE-devices-after-recognition.patch
+diff --git a/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch b/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch
 new file mode 100644
-index 0000000..5a7e447
+index 0000000..1fd016f
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/331-brcmfmac-Reset-PCIE-devices-after-recognition.patch
-@@ -0,0 +1,193 @@
++++ b/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch
+@@ -0,0 +1,307 @@
 +From: Hante Meuleman <meuleman@broadcom.com>
-+Date: Thu, 27 Aug 2015 16:14:06 +0200
-+Subject: [PATCH] brcmfmac: Reset PCIE devices after recognition.
++Date: Sun, 7 Feb 2016 18:08:24 +0100
++Subject: [PATCH] brcmfmac: Increase nr of supported flowrings.
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++New generation devices have firmware which has more than 256 flowrings.
++E.g. following debugging message comes from 14e4:4365 BCM4366:
++[  194.606245] brcmfmac: brcmf_pcie_init_ringbuffers Nr of flowrings is 264
++
++At various code places (related to flowrings) we were using u8 which
++could lead to storing wrong number or infinite loops when indexing with
++this type. This issue was quite easy to spot in brcmf_flowring_detach
++where it led to infinite loop e.g. on failed initialization.
++
++This patch switches code to proper types and increases the maximum
++number of supported flowrings to 512.
 +
-+When PCIE type devices are being FW reloaded without being properly
-+reset then the device ends up in a locked state, requiring the
-+device to be completely powered down. This patch adds a reset
-+through watchdog at the moment the device (cores) has been
-+recognized. This will solve warm reboot issues.
++Originally this change was sent in September 2015, but back it was
++causing a regression on BCM43602 resulting in:
++Unable to handle kernel NULL pointer dereference at virtual address ...
 +
-+Cc: Rafal Milecki <zajec5@gmail.com>
++The reason for this regression was missing update (s/u8/u16) of struct
++brcmf_flowring_ring. This problem was handled in 9f64df9 ("brcmfmac: Fix
++bug in flowring management."). Starting with that it's safe to apply
++this original patch as it doesn't cause a regression anymore.
++
++This patch fixes an infinite loop on BCM4366 which is supported since
++4.4 so it makes sense to apply it to stable 4.4+.
++
++Cc: <stable@vger.kernel.org> # 4.4+
 +Reviewed-by: Arend Van Spriel <arend@broadcom.com>
 +Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
 +Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
 +Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
 +Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 +---
 +
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
-+@@ -101,6 +101,9 @@
-+ /* ARM Cortex M3 core, ID 0x82a */
-+ #define BCM4329_CORE_ARM_BASE		0x18002000
-+ 
-++/* Max possibly supported memory size (limited by IO mapped memory) */
-++#define BRCMF_CHIP_MAX_MEMSIZE		(4 * 1024 * 1024)
-++
-+ #define CORE_SB(base, field) \
-+ 		(base + SBCONFIGOFF + offsetof(struct sbconfig, field))
-+ #define	SBCOREREV(sbidh) \
-+@@ -687,6 +690,12 @@ static int brcmf_chip_get_raminfo(struct
-+ 		brcmf_err("RAM size is undetermined\n");
-+ 		return -ENOMEM;
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
++@@ -32,7 +32,7 @@
++ #define BRCMF_FLOWRING_LOW		(BRCMF_FLOWRING_HIGH - 256)
++ #define BRCMF_FLOWRING_INVALID_IFIDX	0xff
++ 
++-#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
+++#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16)
++ #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
++ 
++ static const u8 brcmf_flowring_prio2fifo[] = {
++@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
++ 			  u8 prio, u8 ifidx)
++ {
++ 	struct brcmf_flowring_hash *hash;
++-	u8 hash_idx;
+++	u16 hash_idx;
++ 	u32 i;
++ 	bool found;
++ 	bool sta;
++@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
 + 	}
-++
-++	if (ci->pub.ramsize > BRCMF_CHIP_MAX_MEMSIZE) {
-++		brcmf_err("RAM size is incorrect\n");
-++		return -ENOMEM;
-++	}
-++
-+ 	return 0;
++ 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
++ 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
+++	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
++ 	found = false;
++ 	hash = flow->hash;
++ 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
++@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
++ 			break;
++ 		}
++ 		hash_idx++;
+++		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
++ 	}
++ 	if (found)
++ 		return hash[hash_idx].flowid;
++@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_f
++ {
++ 	struct brcmf_flowring_ring *ring;
++ 	struct brcmf_flowring_hash *hash;
++-	u8 hash_idx;
+++	u16 hash_idx;
++ 	u32 i;
++ 	bool found;
++ 	u8 fifo;
++@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_f
++ 	}
++ 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
++ 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
+++	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
++ 	found = false;
++ 	hash = flow->hash;
++ 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
++@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_f
++ 			break;
++ 		}
++ 		hash_idx++;
+++		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
++ 	}
++ 	if (found) {
++ 		for (i = 0; i < flow->nrofrings; i++) {
++@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_f
 + }
 + 
-+@@ -899,6 +908,15 @@ static int brcmf_chip_recognition(struct
 + 
-+ 	/* assure chip is passive for core access */
-+ 	brcmf_chip_set_passive(&ci->pub);
-++
-++	/* Call bus specific reset function now. Cores have been determined
-++	 * but further access may require a chip specific reset at this point.
-++	 */
-++	if (ci->ops->reset) {
-++		ci->ops->reset(ci->ctx, &ci->pub);
-++		brcmf_chip_set_passive(&ci->pub);
-++	}
-++
-+ 	return brcmf_chip_get_raminfo(ci);
++-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
+++u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid)
++ {
++ 	struct brcmf_flowring_ring *ring;
++ 
++@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowr
 + }
 + 
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.h
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.h
-+@@ -73,6 +73,7 @@ struct brcmf_buscore_ops {
-+ 	u32 (*read32)(void *ctx, u32 addr);
-+ 	void (*write32)(void *ctx, u32 addr, u32 value);
-+ 	int (*prepare)(void *ctx);
-++	int (*reset)(void *ctx, struct brcmf_chip *chip);
-+ 	int (*setup)(void *ctx, struct brcmf_chip *chip);
-+ 	void (*activate)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
-+ };
-+--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
-++++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
-+@@ -74,6 +74,8 @@ enum brcmf_pcie_state {
-+ #define BRCMF_PCIE_REG_INTMASK			0x94
-+ #define BRCMF_PCIE_REG_SBMBX			0x98
 + 
-++#define BRCMF_PCIE_REG_LINK_STATUS_CTRL		0xBC
-++
-+ #define BRCMF_PCIE_PCIE2REG_INTMASK		0x24
-+ #define BRCMF_PCIE_PCIE2REG_MAILBOXINT		0x48
-+ #define BRCMF_PCIE_PCIE2REG_MAILBOXMASK		0x4C
-+@@ -466,6 +468,7 @@ brcmf_pcie_select_core(struct brcmf_pcie
++-static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
+++static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
++ 				 bool blocked)
++ {
++ 	struct brcmf_flowring_ring *ring;
++@@ -228,10 +232,10 @@ static void brcmf_flowring_block(struct
++ }
 + 
-+ static void brcmf_pcie_reset_device(struct brcmf_pciedev_info *devinfo)
++ 
++-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
+++void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
 + {
-++	struct brcmf_core *core;
-+ 	u16 cfg_offset[] = { BRCMF_PCIE_CFGREG_STATUS_CMD,
-+ 			     BRCMF_PCIE_CFGREG_PM_CSR,
-+ 			     BRCMF_PCIE_CFGREG_MSI_CAP,
-+@@ -484,32 +487,38 @@ static void brcmf_pcie_reset_device(stru
-+ 	if (!devinfo->ci)
-+ 		return;
++ 	struct brcmf_flowring_ring *ring;
++-	u8 hash_idx;
+++	u16 hash_idx;
++ 	struct sk_buff *skb;
 + 
-++	/* Disable ASPM */
-+ 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-+-	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR,
-+-			       BRCMF_PCIE_CFGREG_LINK_STATUS_CTRL);
-+-	lsc = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA);
-++	pci_read_config_dword(devinfo->pdev, BRCMF_PCIE_REG_LINK_STATUS_CTRL,
-++			      &lsc);
-+ 	val = lsc & (~BRCMF_PCIE_LINK_STATUS_CTRL_ASPM_ENAB);
-+-	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA, val);
-++	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_LINK_STATUS_CTRL,
-++			       val);
-+ 
-++	/* Watchdog reset */
-+ 	brcmf_pcie_select_core(devinfo, BCMA_CORE_CHIPCOMMON);
-+ 	WRITECC32(devinfo, watchdog, 4);
-+ 	msleep(100);
-+ 
-++	/* Restore ASPM */
-+ 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-+-	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR,
-+-			       BRCMF_PCIE_CFGREG_LINK_STATUS_CTRL);
-+-	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA, lsc);
-++	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_LINK_STATUS_CTRL,
-++			       lsc);
-+ 
-+-	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-+-	for (i = 0; i < ARRAY_SIZE(cfg_offset); i++) {
-+-		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR,
-+-				       cfg_offset[i]);
-+-		val = brcmf_pcie_read_reg32(devinfo,
-+-					    BRCMF_PCIE_PCIE2REG_CONFIGDATA);
-+-		brcmf_dbg(PCIE, "config offset 0x%04x, value 0x%04x\n",
-+-			  cfg_offset[i], val);
-+-		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA,
-+-				       val);
-++	core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
-++	if (core->rev <= 13) {
-++		for (i = 0; i < ARRAY_SIZE(cfg_offset); i++) {
-++			brcmf_pcie_write_reg32(devinfo,
-++					       BRCMF_PCIE_PCIE2REG_CONFIGADDR,
-++					       cfg_offset[i]);
-++			val = brcmf_pcie_read_reg32(devinfo,
-++				BRCMF_PCIE_PCIE2REG_CONFIGDATA);
-++			brcmf_dbg(PCIE, "config offset 0x%04x, value 0x%04x\n",
-++				  cfg_offset[i], val);
-++			brcmf_pcie_write_reg32(devinfo,
-++					       BRCMF_PCIE_PCIE2REG_CONFIGDATA,
-++					       val);
-++		}
-+ 	}
++ 	ring = flow->rings[flowid];
++@@ -253,7 +257,7 @@ void brcmf_flowring_delete(struct brcmf_
 + }
 + 
-+@@ -519,8 +528,6 @@ static void brcmf_pcie_attach(struct brc
-+ 	u32 config;
 + 
-+ 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-+-	if (brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_INTMASK) != 0)
-+-		brcmf_pcie_reset_device(devinfo);
-+ 	/* BAR1 window may not be sized properly */
-+ 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-+ 	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR, 0x4e0);
-+@@ -1636,6 +1643,23 @@ static int brcmf_pcie_buscoreprep(void *
++-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
+++u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
++ 			   struct sk_buff *skb)
++ {
++ 	struct brcmf_flowring_ring *ring;
++@@ -279,7 +283,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_
 + }
 + 
 + 
-++static int brcmf_pcie_buscore_reset(void *ctx, struct brcmf_chip *chip)
-++{
-++	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)ctx;
-++	u32 val;
-++
-++	devinfo->ci = chip;
-++	brcmf_pcie_reset_device(devinfo);
-++
-++	val = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT);
-++	if (val != 0xffffffff)
-++		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT,
-++				       val);
-++
-++	return 0;
-++}
++-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
+++struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid)
++ {
++ 	struct brcmf_flowring_ring *ring;
++ 	struct sk_buff *skb;
++@@ -300,7 +304,7 @@ struct sk_buff *brcmf_flowring_dequeue(s
++ }
++ 
++ 
++-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
+++void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
++ 			     struct sk_buff *skb)
++ {
++ 	struct brcmf_flowring_ring *ring;
++@@ -311,7 +315,7 @@ void brcmf_flowring_reinsert(struct brcm
++ }
++ 
++ 
++-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
+++u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid)
++ {
++ 	struct brcmf_flowring_ring *ring;
++ 
++@@ -326,7 +330,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flo
++ }
++ 
++ 
++-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
+++void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid)
++ {
++ 	struct brcmf_flowring_ring *ring;
++ 
++@@ -340,10 +344,10 @@ void brcmf_flowring_open(struct brcmf_fl
++ }
++ 
++ 
++-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid)
+++u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid)
++ {
++ 	struct brcmf_flowring_ring *ring;
++-	u8 hash_idx;
+++	u16 hash_idx;
++ 
++ 	ring = flow->rings[flowid];
++ 	hash_idx = ring->hash_id;
++@@ -384,7 +388,7 @@ void brcmf_flowring_detach(struct brcmf_
++ 	struct brcmf_pub *drvr = bus_if->drvr;
++ 	struct brcmf_flowring_tdls_entry *search;
++ 	struct brcmf_flowring_tdls_entry *remove;
++-	u8 flowid;
+++	u16 flowid;
++ 
++ 	for (flowid = 0; flowid < flow->nrofrings; flowid++) {
++ 		if (flow->rings[flowid])
++@@ -408,7 +412,7 @@ void brcmf_flowring_configure_addr_mode(
++ 	struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
++ 	struct brcmf_pub *drvr = bus_if->drvr;
++ 	u32 i;
++-	u8 flowid;
+++	u16 flowid;
++ 
++ 	if (flow->addr_mode[ifidx] != addr_mode) {
++ 		for (i = 0; i < ARRAY_SIZE(flow->hash); i++) {
++@@ -434,7 +438,7 @@ void brcmf_flowring_delete_peer(struct b
++ 	struct brcmf_flowring_tdls_entry *prev;
++ 	struct brcmf_flowring_tdls_entry *search;
++ 	u32 i;
++-	u8 flowid;
+++	u16 flowid;
++ 	bool sta;
++ 
++ 	sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT);
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
++@@ -16,7 +16,7 @@
++ #define BRCMFMAC_FLOWRING_H
++ 
++ 
++-#define BRCMF_FLOWRING_HASHSIZE		256
+++#define BRCMF_FLOWRING_HASHSIZE		512		/* has to be 2^x */
++ #define BRCMF_FLOWRING_INVALID_ID	0xFFFFFFFF
++ 
++ 
++@@ -24,7 +24,7 @@ struct brcmf_flowring_hash {
++ 	u8 mac[ETH_ALEN];
++ 	u8 fifo;
++ 	u8 ifidx;
++-	u8 flowid;
+++	u16 flowid;
++ };
++ 
++ enum ring_status {
++@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_f
++ 			  u8 prio, u8 ifidx);
++ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
++ 			  u8 prio, u8 ifidx);
++-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid);
++-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid);
++-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid);
++-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
+++void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid);
+++void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid);
+++u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid);
+++u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
++ 			   struct sk_buff *skb);
++-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid);
++-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
+++struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid);
+++void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
++ 			     struct sk_buff *skb);
++-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid);
++-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid);
+++u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid);
+++u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid);
++ struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings);
++ void brcmf_flowring_detach(struct brcmf_flowring *flow);
++ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++@@ -677,7 +677,7 @@ static u32 brcmf_msgbuf_flowring_create(
++ }
++ 
++ 
++-static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
+++static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
++ {
++ 	struct brcmf_flowring *flow = msgbuf->flow;
++ 	struct brcmf_commonring *commonring;
++@@ -1310,7 +1310,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct
++ }
++ 
++ 
++-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
+++void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
++ {
++ 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
++ 	struct msgbuf_tx_flowring_delete_req *delete;
++@@ -1415,6 +1415,13 @@ int brcmf_proto_msgbuf_attach(struct brc
++ 	u32 count;
++ 
++ 	if_msgbuf = drvr->bus_if->msgbuf;
 ++
+++	if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
+++		brcmf_err("driver not configured for this many flowrings %d\n",
+++			  if_msgbuf->nrof_flowrings);
+++		if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
+++	}
 ++
-+ static void brcmf_pcie_buscore_activate(void *ctx, struct brcmf_chip *chip,
-+ 					u32 rstvec)
-+ {
-+@@ -1647,6 +1671,7 @@ static void brcmf_pcie_buscore_activate(
-+ 
-+ static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
-+ 	.prepare = brcmf_pcie_buscoreprep,
-++	.reset = brcmf_pcie_buscore_reset,
-+ 	.activate = brcmf_pcie_buscore_activate,
-+ 	.read32 = brcmf_pcie_buscore_read32,
-+ 	.write32 = brcmf_pcie_buscore_write32,
-+@@ -1814,7 +1839,6 @@ brcmf_pcie_remove(struct pci_dev *pdev)
-+ 		brcmf_pcie_intr_disable(devinfo);
-+ 
-+ 	brcmf_detach(&pdev->dev);
-+-	brcmf_pcie_reset_device(devinfo);
-+ 
-+ 	kfree(bus->bus_priv.pcie);
-+ 	kfree(bus->msgbuf->flowrings);
-diff --git a/package/kernel/mac80211/patches/332-ath10k-fix-DMA-related-firmware-crashes-on-multiple-.patch b/package/kernel/mac80211/patches/332-ath10k-fix-DMA-related-firmware-crashes-on-multiple-.patch
-new file mode 100644
-index 0000000..52b7fa9
---- /dev/null
-+++ b/package/kernel/mac80211/patches/332-ath10k-fix-DMA-related-firmware-crashes-on-multiple-.patch
-@@ -0,0 +1,33 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Sun, 13 Sep 2015 22:26:10 +0200
-+Subject: [PATCH] ath10k: fix DMA related firmware crashes on multiple devices
-+
-+Some platforms really don't like DMA bursts of 256 bytes, and this
-+causes the firmware to crash when sending beacons.
-+Also, changing this based on the firmware version does not seem to make
-+much sense, so use 128 bytes for all versions.
-+
-+Cc: stable@vger.kernel.org
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath10k/hw.h
-++++ b/drivers/net/wireless/ath/ath10k/hw.h
-+@@ -340,7 +340,7 @@ enum ath10k_hw_rate_cck {
-+ #define TARGET_10X_MAX_FRAG_ENTRIES		0
-+ 
-+ /* 10.2 parameters */
-+-#define TARGET_10_2_DMA_BURST_SIZE		1
-++#define TARGET_10_2_DMA_BURST_SIZE		0
-+ 
-+ /* Target specific defines for WMI-TLV firmware */
-+ #define TARGET_TLV_NUM_VDEVS			4
-+@@ -397,7 +397,7 @@ enum ath10k_hw_rate_cck {
-+ 
-+ #define TARGET_10_4_TX_DBG_LOG_SIZE		1024
-+ #define TARGET_10_4_NUM_WDS_ENTRIES		32
-+-#define TARGET_10_4_DMA_BURST_SIZE		1
-++#define TARGET_10_4_DMA_BURST_SIZE		0
-+ #define TARGET_10_4_MAC_AGGR_DELIM		0
-+ #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
-+ #define TARGET_10_4_VOW_CONFIG			0
++ 	msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
++ 	if (!msgbuf)
++ 		goto fail;
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
++@@ -33,7 +33,7 @@
++ 
++ 
++ int brcmf_proto_msgbuf_rx_trigger(struct device *dev);
++-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid);
+++void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid);
++ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr);
++ void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr);
++ #else
 diff --git a/package/kernel/mac80211/patches/332-ath9k-ath9k_hw_analog_shift_rmw-use-REG_RMW.patch b/package/kernel/mac80211/patches/332-ath9k-ath9k_hw_analog_shift_rmw-use-REG_RMW.patch
 deleted file mode 100644
 index 3ce4428..0000000
@@ -13227,45 +13901,34 @@ index 3ce4428..0000000
 - 
 - 	if (ah->config.analog_shiftreg)
 - 		udelay(100);
-diff --git a/package/kernel/mac80211/patches/333-ath9k-enable-hw-manual-peak-calibration-for-QCA9561.patch b/package/kernel/mac80211/patches/333-ath9k-enable-hw-manual-peak-calibration-for-QCA9561.patch
+diff --git a/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch b/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch
 new file mode 100644
-index 0000000..faf6cdc
+index 0000000..e414f23
 --- /dev/null
-+++ b/package/kernel/mac80211/patches/333-ath9k-enable-hw-manual-peak-calibration-for-QCA9561.patch
-@@ -0,0 +1,33 @@
-+From: Miaoqing Pan <miaoqing@qca.qualcomm.com>
-+Date: Tue, 1 Sep 2015 10:56:09 +0800
-+Subject: [PATCH] ath9k: enable hw manual peak calibration for QCA9561
++++ b/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch
+@@ -0,0 +1,22 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Mon, 8 Feb 2016 14:24:36 +0100
++Subject: [PATCH] cfg80211: fix faulty variable initialization in
++ ieee80211_amsdu_to_8023s
 +
-+This patch fix https://lists.openwrt.org/pipermail/openwrt-devel/
-+2015-August/034979.html. As the peak detect calibration is set
-+incorrectly.
++reuse_skb is set to true if the code decides to use the last segment.
++Fixes a memory leak
 +
-+Signed-off-by: Miaoqing Pan <miaoqing@qca.qualcomm.com>
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +---
 +
-+--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+@@ -1249,7 +1249,8 @@ static void ar9003_hw_manual_peak_cal(st
-+ 		REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-+ 			      AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR, 0x0);
-+ 
-+-	if (AR_SREV_9003_PCOEM(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
-++	if (AR_SREV_9003_PCOEM(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
-++	    AR_SREV_9561(ah)) {
-+ 		if (is_2g)
-+ 			REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-+ 				      AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR,
-+@@ -1640,7 +1641,8 @@ static bool ar9003_hw_init_cal_soc(struc
-+ 
-+ skip_tx_iqcal:
-+ 	if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
-+-		if (AR_SREV_9330_11(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
-++		if (AR_SREV_9330_11(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah) ||
-++		    AR_SREV_9561(ah)) {
-+ 			for (i = 0; i < AR9300_MAX_CHAINS; i++) {
-+ 				if (!(ah->rxchainmask & (1 << i)))
-+ 					continue;
++--- a/net/wireless/util.c
+++++ b/net/wireless/util.c
++@@ -676,7 +676,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
++ 	u8 *payload;
++ 	int offset = 0, remaining, err;
++ 	struct ethhdr eth;
++-	bool reuse_skb = true;
+++	bool reuse_skb = false;
++ 	bool last = false;
++ 
++ 	if (has_80211_header) {
 diff --git a/package/kernel/mac80211/patches/333-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_4k_set_.patch b/package/kernel/mac80211/patches/333-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_4k_set_.patch
 deleted file mode 100644
 index 8f12b36..0000000
@@ -13319,6 +13982,144 @@ index 8f12b36..0000000
 - }
 - 
 - /*
+diff --git a/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch b/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch
+new file mode 100644
+index 0000000..6e2d0cf
+--- /dev/null
++++ b/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch
+@@ -0,0 +1,132 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Mon, 8 Feb 2016 14:33:19 +0100
++Subject: [PATCH] cfg80211: reuse existing page fragments in A-MSDU rx
++
++This massively reduces data copying and thus improves rx performance
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/net/wireless/util.c
+++++ b/net/wireless/util.c
++@@ -644,23 +644,93 @@ int ieee80211_data_from_8023(struct sk_b
++ }
++ EXPORT_SYMBOL(ieee80211_data_from_8023);
++ 
+++static void
+++__frame_add_frag(struct sk_buff *skb, struct page *page,
+++		 void *ptr, int len, int size)
+++{
+++	struct skb_shared_info *sh = skb_shinfo(skb);
+++	int page_offset;
+++
+++	atomic_inc(&page->_count);
+++	page_offset = ptr - page_address(page);
+++	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
+++}
+++
+++static void
+++__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
+++			    int offset, int len)
+++{
+++	struct skb_shared_info *sh = skb_shinfo(skb);
+++	const skb_frag_t *frag = &sh->frags[-1];
+++	struct page *frag_page;
+++	void *frag_ptr;
+++	int frag_len, frag_size;
+++	int head_size = skb->len - skb->data_len;
+++	int cur_len;
+++
+++	frag_page = virt_to_head_page(skb->head);
+++	frag_ptr = skb->data;
+++	frag_size = head_size;
+++
+++	while (offset >= frag_size) {
+++		offset -= frag_size;
+++		frag++;
+++		frag_page = skb_frag_page(frag);
+++		frag_ptr = skb_frag_address(frag);
+++		frag_size = skb_frag_size(frag);
+++	}
+++
+++	frag_ptr += offset;
+++	frag_len = frag_size - offset;
+++
+++	cur_len = min(len, frag_len);
+++
+++	__frame_add_frag(frame, frag_page, frag_ptr, cur_len, frag_size);
+++	len -= cur_len;
+++
+++	while (len > 0) {
+++		frag++;
+++		frag_len = skb_frag_size(frag);
+++		cur_len = min(len, frag_len);
+++		__frame_add_frag(frame, skb_frag_page(frag),
+++				 skb_frag_address(frag), cur_len, frag_len);
+++		len -= cur_len;
+++	}
+++}
+++
++ static struct sk_buff *
++ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
++-		       int offset, int len)
+++		       int offset, int len, bool reuse_frag)
++ {
++ 	struct sk_buff *frame;
+++	int cur_len = len;
++ 
++ 	if (skb->len - offset < len)
++ 		return NULL;
++ 
++ 	/*
+++	 * When reusing framents, copy some data to the head to simplify
+++	 * ethernet header handling and speed up protocol header processing
+++	 * in the stack later.
+++	 */
+++	if (reuse_frag)
+++		cur_len = min_t(int, len, 32);
+++
+++	/*
++ 	 * Allocate and reserve two bytes more for payload
++ 	 * alignment since sizeof(struct ethhdr) is 14.
++ 	 */
++-	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + len);
+++	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
++ 
++ 	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
++-	skb_copy_bits(skb, offset, skb_put(frame, len), len);
+++	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
+++
+++	len -= cur_len;
+++	if (!len)
+++		return frame;
+++
+++	offset += cur_len;
+++	__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
++ 
++ 	return frame;
++ }
++@@ -676,6 +746,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
++ 	u8 *payload;
++ 	int offset = 0, remaining, err;
++ 	struct ethhdr eth;
+++	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
++ 	bool reuse_skb = false;
++ 	bool last = false;
++ 
++@@ -703,12 +774,13 @@ void ieee80211_amsdu_to_8023s(struct sk_
++ 		offset += sizeof(struct ethhdr);
++ 		/* reuse skb for the last subframe */
++ 		last = remaining <= subframe_len + padding;
++-		if (!skb_is_nonlinear(skb) && last) {
+++		if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
++ 			skb_pull(skb, offset);
++ 			frame = skb;
++ 			reuse_skb = true;
++ 		} else {
++-			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len);
+++			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
+++						       reuse_frag);
++ 			if (!frame)
++ 				goto purge;
++ 
 diff --git a/package/kernel/mac80211/patches/334-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_def_set.patch b/package/kernel/mac80211/patches/334-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_def_set.patch
 deleted file mode 100644
 index f26e059..0000000
@@ -13386,41 +14187,12 @@ index f26e059..0000000
 -+			AR_PHY_RXGAIN_TXRX_ATTEN);
 -+		REG_RMW(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
 -+			SM(pModal->rxTxMarginCh[i], AR_PHY_GAIN_2GHZ_RXTX_MARGIN),
--+			AR_PHY_GAIN_2GHZ_RXTX_MARGIN);
-- 	}
--+	REG_RMW_BUFFER_FLUSH(ah);
-- }
-- 
-- static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
-diff --git a/package/kernel/mac80211/patches/334-mac80211-fix-tx-sequence-number-assignment-with-soft.patch b/package/kernel/mac80211/patches/334-mac80211-fix-tx-sequence-number-assignment-with-soft.patch
-new file mode 100644
-index 0000000..b19e7ee
---- /dev/null
-+++ b/package/kernel/mac80211/patches/334-mac80211-fix-tx-sequence-number-assignment-with-soft.patch
-@@ -0,0 +1,23 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 24 Sep 2015 14:10:07 +0200
-+Subject: [PATCH] mac80211: fix tx sequence number assignment with software
-+ queue + fast-xmit
-+
-+When using software queueing, tx sequence number assignment happens at
-+ieee80211_tx_dequeue time, so the fast-xmit codepath must not do that.
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/mac80211/tx.c
-++++ b/net/mac80211/tx.c
-+@@ -2766,7 +2766,8 @@ static bool ieee80211_xmit_fast(struct i
-+ 
-+ 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
-+ 		*ieee80211_get_qos_ctl(hdr) = tid;
-+-		hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
-++		if (!sta->sta.txq[0])
-++			hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
-+ 	} else {
-+ 		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
-+ 		hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
+-+			AR_PHY_GAIN_2GHZ_RXTX_MARGIN);
+- 	}
+-+	REG_RMW_BUFFER_FLUSH(ah);
+- }
+- 
+- static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
 diff --git a/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch b/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch
 deleted file mode 100644
 index 5e63a80..0000000
@@ -13815,57 +14587,6 @@ index c9eb900..0000000
 - #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
 - 
 - #define SDIO_VENDOR_ID_INTEL			0x0089
-diff --git a/package/kernel/mac80211/patches/335-mac80211-fix-handling-of-PS-filtering-with-fast-xmit.patch b/package/kernel/mac80211/patches/335-mac80211-fix-handling-of-PS-filtering-with-fast-xmit.patch
-new file mode 100644
-index 0000000..7aef205
---- /dev/null
-+++ b/package/kernel/mac80211/patches/335-mac80211-fix-handling-of-PS-filtering-with-fast-xmit.patch
-@@ -0,0 +1,45 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 24 Sep 2015 14:11:40 +0200
-+Subject: [PATCH] mac80211: fix handling of PS filtering with fast-xmit
-+
-+Fixes dropped packets in the tx path in case a non-PS station triggers
-+the tx filter.
-+
-+Cc: stable@vger.kernel.org # 4.2
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/mac80211/status.c
-++++ b/net/mac80211/status.c
-+@@ -101,6 +101,7 @@ static void ieee80211_handle_filtered_fr
-+ 	 * when it wakes up for the next time.
-+ 	 */
-+ 	set_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT);
-++	ieee80211_clear_fast_xmit(sta);
-+ 
-+ 	/*
-+ 	 * This code races in the following way:
-+--- a/net/mac80211/tx.c
-++++ b/net/mac80211/tx.c
-+@@ -1217,8 +1217,10 @@ ieee80211_tx_prepare(struct ieee80211_su
-+ 
-+ 	if (!tx->sta)
-+ 		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+-	else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
-++	else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) {
-+ 		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-++		ieee80211_check_fast_xmit(tx->sta);
-++	}
-+ 
-+ 	info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
-+ 
-+@@ -2450,7 +2452,8 @@ void ieee80211_check_fast_xmit(struct st
-+ 
-+ 	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
-+ 	    test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
-+-	    test_sta_flag(sta, WLAN_STA_PS_DELIVER))
-++	    test_sta_flag(sta, WLAN_STA_PS_DELIVER) ||
-++	    test_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT))
-+ 		goto out;
-+ 
-+ 	if (sdata->noack_map)
 diff --git a/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch b/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch
 deleted file mode 100644
 index 7a688c4..0000000
@@ -14853,34 +15574,6 @@ index 1b10dbb..0000000
 - 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
 - 				/* Leave the device in state where it is
 - 				 * 'passive'. This is done by resetting all
-diff --git a/package/kernel/mac80211/patches/336-ath9k-declare-required-extra-tx-headroom.patch b/package/kernel/mac80211/patches/336-ath9k-declare-required-extra-tx-headroom.patch
-new file mode 100644
-index 0000000..4d88591
---- /dev/null
-+++ b/package/kernel/mac80211/patches/336-ath9k-declare-required-extra-tx-headroom.patch
-@@ -0,0 +1,22 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 24 Sep 2015 16:57:37 +0200
-+Subject: [PATCH] ath9k: declare required extra tx headroom
-+
-+ath9k inserts padding between the 802.11 header and the data area (to
-+align it). Since it didn't declare this extra required headroom, this
-+led to some nasty issues like randomly dropped packets in some setups.
-+
-+Cc: stable@vger.kernel.org
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/init.c
-++++ b/drivers/net/wireless/ath/ath9k/init.c
-+@@ -875,6 +875,7 @@ static void ath9k_set_hw_capab(struct at
-+ 	hw->max_rate_tries = 10;
-+ 	hw->sta_data_size = sizeof(struct ath_node);
-+ 	hw->vif_data_size = sizeof(struct ath_vif);
-++	hw->extra_tx_headroom = 4;
-+ 
-+ 	hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
-+ 	hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
 diff --git a/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch b/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch
 deleted file mode 100644
 index af76f13..0000000
@@ -15430,49 +16123,6 @@ index a62cfdf..0000000
 - 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
 - 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
 - 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
-diff --git a/package/kernel/mac80211/patches/337-nl80211-put-current-TX-power-in-interface-info.patch b/package/kernel/mac80211/patches/337-nl80211-put-current-TX-power-in-interface-info.patch
-new file mode 100644
-index 0000000..df2cc4b
---- /dev/null
-+++ b/package/kernel/mac80211/patches/337-nl80211-put-current-TX-power-in-interface-info.patch
-@@ -0,0 +1,37 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Mon, 31 Aug 2015 22:59:38 +0200
-+Subject: [PATCH] nl80211: put current TX power in interface info
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+Many drivers implement reading current TX power (using either cfg80211
-+or ieee80211 op) but userspace can't get it using nl80211. Right now the
-+only way to access it is to call some wext ioctl.
-+Let's put TX power in interface info reply (callback is wdev specific)
-+just like we do with current channel.
-+To be consistent (e.g. NL80211_CMD_SET_WIPHY) let's use mBm as na unit.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/wireless/nl80211.c
-++++ b/net/wireless/nl80211.c
-+@@ -2406,6 +2406,16 @@ static int nl80211_send_iface(struct sk_
-+ 		}
-+ 	}
-+ 
-++	if (rdev->ops->get_tx_power) {
-++		int dbm, ret;
-++
-++		ret = rdev_get_tx_power(rdev, wdev, &dbm);
-++		if (ret == 0 &&
-++		    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
-++				DBM_TO_MBM(dbm)))
-++			goto nla_put_failure;
-++	}
-++
-+ 	if (wdev->ssid_len) {
-+ 		if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
-+ 			goto nla_put_failure;
 diff --git a/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch b/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch
 deleted file mode 100644
 index 366ff85..0000000
@@ -15507,33 +16157,6 @@ index 366ff85..0000000
 - 
 - 	/* set chip related quirks */
 - 	switch (drvr->bus_if->chip) {
-diff --git a/package/kernel/mac80211/patches/338-mac80211-initialize-tid-field-in-struct-ieee80211_tx.patch b/package/kernel/mac80211/patches/338-mac80211-initialize-tid-field-in-struct-ieee80211_tx.patch
-new file mode 100644
-index 0000000..2f492e0
---- /dev/null
-+++ b/package/kernel/mac80211/patches/338-mac80211-initialize-tid-field-in-struct-ieee80211_tx.patch
-@@ -0,0 +1,21 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Mon, 5 Oct 2015 17:41:25 +0200
-+Subject: [PATCH] mac80211: initialize tid field in struct ieee80211_txq
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/mac80211/util.c
-++++ b/net/mac80211/util.c
-+@@ -3288,9 +3288,11 @@ void ieee80211_init_tx_queue(struct ieee
-+ 	if (sta) {
-+ 		txqi->txq.sta = &sta->sta;
-+ 		sta->sta.txq[tid] = &txqi->txq;
-++		txqi->txq.tid = tid;
-+ 		txqi->txq.ac = ieee802_1d_to_ac[tid & 7];
-+ 	} else {
-+ 		sdata->vif.txq = &txqi->txq;
-++		txqi->txq.tid = 0;
-+ 		txqi->txq.ac = IEEE80211_AC_BE;
-+ 	}
-+ }
 diff --git a/package/kernel/mac80211/patches/339-0001-brcmfmac-use-static-superset-of-channels-for-wiphy-b.patch b/package/kernel/mac80211/patches/339-0001-brcmfmac-use-static-superset-of-channels-for-wiphy-b.patch
 deleted file mode 100644
 index 6e461f6..0000000
@@ -27670,39 +28293,59 @@ index 298f722..72e9a41 100644
   
   /** Returns string describing opmode, or NULL if unknown mode. */
 diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
-index 2dac505..f918c18 100644
+index 2dac505..7351353 100644
 --- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
 +++ b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
-@@ -59,7 +59,7 @@
+@@ -47,9 +47,9 @@
+  
+ --- a/drivers/net/wireless/ath/Kconfig
+ +++ b/drivers/net/wireless/ath/Kconfig
+-@@ -22,6 +22,9 @@ menuconfig ATH_CARDS
++@@ -23,6 +23,9 @@ config WLAN_VENDOR_ATH
+  
+- if ATH_CARDS
++ if WLAN_VENDOR_ATH
+  
+ +config ATH_USER_REGD
+ +	bool "Do not enforce EEPROM regulatory restrictions"
+@@ -59,9 +59,9 @@
   	---help---
  --- a/.local-symbols
  +++ b/.local-symbols
 -@@ -89,6 +89,7 @@ RTL8187_LEDS=
-+@@ -137,6 +137,7 @@ RTL8187_LEDS=
++@@ -125,6 +125,7 @@ ADM8211=
   ATH_COMMON=
-  ATH_CARDS=
+- ATH_CARDS=
++ WLAN_VENDOR_ATH=
   ATH_DEBUG=
+ +ATH_USER_REGD=
+  ATH_TRACEPOINTS=
 diff --git a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
-index 1476953..8b52ac3 100644
+index 1476953..1ef5545 100644
 --- a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
 +++ b/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
 @@ -1,6 +1,6 @@
  --- a/net/wireless/reg.c
  +++ b/net/wireless/reg.c
 -@@ -2368,6 +2368,8 @@ void regulatory_hint_country_ie(struct w
-+@@ -2390,6 +2390,8 @@ void regulatory_hint_country_ie(struct w
++@@ -2411,6 +2411,8 @@ void regulatory_hint_country_ie(struct w
   	enum environment_cap env = ENVIRON_ANY;
   	struct regulatory_request *request = NULL, *lr;
   
-@@ -9,7 +9,7 @@
+@@ -9,11 +9,11 @@
   	/* IE len must be evenly divisible by 2 */
   	if (country_ie_len & 0x01)
   		return;
 -@@ -2571,6 +2573,7 @@ static void restore_regulatory_settings(
-+@@ -2596,6 +2598,7 @@ static void restore_regulatory_settings(
++@@ -2617,6 +2619,7 @@ static void restore_regulatory_settings(
   
   void regulatory_hint_disconnect(void)
   {
+ +	return;
+- 	REG_DBG_PRINT("All devices are disconnected, going to restore regulatory settings\n");
++ 	pr_debug("All devices are disconnected, going to restore regulatory settings\n");
+  	restore_regulatory_settings(false);
+  }
 diff --git a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
 index 93760f9..1a62484 100644
 --- a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -27716,7 +28359,7 @@ index 93760f9..1a62484 100644
   	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
   				 BIT(NL80211_IFTYPE_P2P_GO) },
 diff --git a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
-index aa521d2..42d43a4 100644
+index aa521d2..924b62e 100644
 --- a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
 +++ b/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
 @@ -121,7 +121,7 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
@@ -27724,22 +28367,10 @@ index aa521d2..42d43a4 100644
  --- a/drivers/net/wireless/ath/ath5k/ath5k.h
  +++ b/drivers/net/wireless/ath/ath5k/ath5k.h
 -@@ -1371,6 +1371,7 @@ struct ath5k_hw {
-+@@ -1370,6 +1370,7 @@ struct ath5k_hw {
++@@ -1372,6 +1372,7 @@ struct ath5k_hw {
   	u8			ah_coverage_class;
   	bool			ah_ack_bitrate_high;
   	u8			ah_bwmode;
-diff --git a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
-index 5892c3e..5a3e37c 100644
---- a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
-+++ b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/init.c
- +++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -1024,23 +1024,23 @@ static int __init ath9k_init(void)
-+@@ -1032,23 +1032,23 @@ static int __init ath9k_init(void)
-  {
-  	int error;
-  
 diff --git a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
 index ed2cfee..d2a3b96 100644
 --- a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
@@ -27785,51 +28416,79 @@ index 40b5c81..c84d1bc 100644
   	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
   	switch (ah->hw_version.devid) {
 diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
-index 0c50a0b..99bf7e8 100644
+index 0c50a0b..e151a12 100644
 --- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
 +++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+@@ -1,6 +1,6 @@
+ --- a/include/net/cfg80211.h
+ +++ b/include/net/cfg80211.h
+-@@ -2320,6 +2320,7 @@ struct cfg80211_qos_map {
++@@ -2363,6 +2363,7 @@ struct cfg80211_qos_map {
+   *	(as advertised by the nl80211 feature flag.)
+   * @get_tx_power: store the current TX power into the dbm variable;
+   *	return 0 if successful
+@@ -8,7 +8,7 @@
+   *
+   * @set_wds_peer: set the WDS peer for a WDS interface
+   *
+-@@ -2576,6 +2577,7 @@ struct cfg80211_ops {
++@@ -2624,6 +2625,7 @@ struct cfg80211_ops {
+  				enum nl80211_tx_power_setting type, int mbm);
+  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+  				int *dbm);
 @@ -18,7 +18,7 @@
   				const u8 *addr);
  --- a/include/net/mac80211.h
  +++ b/include/net/mac80211.h
 -@@ -1171,6 +1171,7 @@ enum ieee80211_smps_mode {
-+@@ -1252,6 +1252,7 @@ enum ieee80211_smps_mode {
++@@ -1286,6 +1286,7 @@ enum ieee80211_smps_mode {
    *
    * @power_level: requested transmit power (in dBm), backward compatibility
    *	value only that is set to the minimum of all interfaces
-@@ -26,7 +26,7 @@
+@@ -26,19 +26,19 @@
    *
    * @chandef: the channel definition to tune to
    * @radar_enabled: whether radar detection is enabled
 -@@ -1192,6 +1193,7 @@ struct ieee80211_conf {
-+@@ -1273,6 +1274,7 @@ struct ieee80211_conf {
++@@ -1306,6 +1307,7 @@ enum ieee80211_smps_mode {
++ struct ieee80211_conf {
   	u32 flags;
   	int power_level, dynamic_ps_timeout;
-  	int max_sleep_period;
-@@ -36,7 +36,7 @@
+- 	int max_sleep_period;
+ +	int max_antenna_gain;
+  
+  	u16 listen_interval;
   	u8 ps_dtim_period;
  --- a/include/uapi/linux/nl80211.h
  +++ b/include/uapi/linux/nl80211.h
 -@@ -1760,6 +1760,9 @@ enum nl80211_commands {
-+@@ -1761,6 +1761,9 @@ enum nl80211_commands {
-   * @NL80211_ATTR_REG_INDOOR: flag attribute, if set indicates that the device
-   *      is operating in an indoor environment.
+-  * @NL80211_ATTR_REG_INDOOR: flag attribute, if set indicates that the device
+-  *      is operating in an indoor environment.
++@@ -1790,6 +1790,9 @@ enum nl80211_commands {
++  *	between scans. The scan plans are executed sequentially.
++  *	Each scan plan is a nested attribute of &enum nl80211_sched_scan_plan.
    *
-@@ -46,7 +46,7 @@
+ + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
+ + *	transmit power to stay within regulatory limits. u32, dBi.
+@@ -46,9 +46,9 @@
    * @NUM_NL80211_ATTR: total number of nl80211_attrs available
    * @NL80211_ATTR_MAX: highest attribute number currently defined
    * @__NL80211_ATTR_AFTER_LAST: internal use
 -@@ -2129,6 +2132,8 @@ enum nl80211_attrs {
-+@@ -2130,6 +2133,8 @@ enum nl80211_attrs {
-  
-  	NL80211_ATTR_REG_INDOOR,
+- 
+- 	NL80211_ATTR_REG_INDOOR,
++@@ -2164,6 +2167,8 @@ enum nl80211_attrs {
++ 	NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
++ 	NL80211_ATTR_SCHED_SCAN_PLANS,
   
+ +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
+ +
 @@ -57,7 +57,7 @@
   	__NL80211_ATTR_AFTER_LAST,
  --- a/net/mac80211/cfg.c
  +++ b/net/mac80211/cfg.c
 -@@ -2208,6 +2208,19 @@ static int ieee80211_get_tx_power(struct
-+@@ -2233,6 +2233,19 @@ static int ieee80211_get_tx_power(struct
++@@ -2229,6 +2229,19 @@ static int ieee80211_get_tx_power(struct
   	return 0;
   }
   
@@ -27838,7 +28497,7 @@ index 0c50a0b..99bf7e8 100644
   				  const u8 *addr)
   {
 -@@ -3771,6 +3784,7 @@ const struct cfg80211_ops mac80211_confi
-+@@ -3845,6 +3858,7 @@ const struct cfg80211_ops mac80211_confi
++@@ -3403,6 +3416,7 @@ const struct cfg80211_ops mac80211_confi
   	.set_wiphy_params = ieee80211_set_wiphy_params,
   	.set_tx_power = ieee80211_set_tx_power,
   	.get_tx_power = ieee80211_get_tx_power,
@@ -27856,7 +28515,7 @@ index 0c50a0b..99bf7e8 100644
  --- a/net/mac80211/main.c
  +++ b/net/mac80211/main.c
 -@@ -98,7 +98,7 @@ static u32 ieee80211_hw_conf_chan(struct
-+@@ -95,7 +95,7 @@ static u32 ieee80211_hw_conf_chan(struct
++@@ -93,7 +93,7 @@ static u32 ieee80211_hw_conf_chan(struct
   	struct ieee80211_sub_if_data *sdata;
   	struct cfg80211_chan_def chandef = {};
   	u32 changed = 0;
@@ -27865,7 +28524,7 @@ index 0c50a0b..99bf7e8 100644
   
   	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
 -@@ -155,6 +155,12 @@ static u32 ieee80211_hw_conf_chan(struct
-+@@ -152,6 +152,12 @@ static u32 ieee80211_hw_conf_chan(struct
++@@ -150,6 +150,12 @@ static u32 ieee80211_hw_conf_chan(struct
   	}
   	rcu_read_unlock();
   
@@ -27874,7 +28533,7 @@ index 0c50a0b..99bf7e8 100644
   		changed |= IEEE80211_CONF_CHANGE_POWER;
   		local->hw.conf.power_level = power;
 -@@ -578,6 +584,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
-+@@ -581,6 +587,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
++@@ -586,6 +592,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
   					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
   	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
   					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -27883,7 +28542,7 @@ index 0c50a0b..99bf7e8 100644
  --- a/net/wireless/nl80211.c
  +++ b/net/wireless/nl80211.c
 -@@ -400,6 +400,7 @@ static const struct nla_policy nl80211_p
-+@@ -402,6 +402,7 @@ static const struct nla_policy nl80211_p
++@@ -403,6 +403,7 @@ static const struct nla_policy nl80211_p
   	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
   	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
   	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
@@ -27892,51 +28551,93 @@ index 0c50a0b..99bf7e8 100644
   
   /* policy for the key attributes */
 -@@ -2206,6 +2207,20 @@ static int nl80211_set_wiphy(struct sk_b
-+@@ -2207,6 +2208,20 @@ static int nl80211_set_wiphy(struct sk_b
++@@ -2220,6 +2221,20 @@ static int nl80211_set_wiphy(struct sk_b
   		if (result)
   			return result;
   	}
 diff --git a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
-index 7512811..3cfffa0 100644
+index 7512811..5a5e464 100644
 --- a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
 +++ b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/ath9k.h
- +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
--@@ -814,6 +814,9 @@ static inline int ath9k_dump_btcoex(stru
-+@@ -806,6 +806,9 @@ static inline int ath9k_dump_btcoex(stru
-  void ath_init_leds(struct ath_softc *sc);
-  void ath_deinit_leds(struct ath_softc *sc);
-  void ath_fill_led_pin(struct ath_softc *sc);
-@@ -10,7 +10,7 @@
-  #else
-  static inline void ath_init_leds(struct ath_softc *sc)
-  {
--@@ -953,6 +956,13 @@ void ath_ant_comb_scan(struct ath_softc
-+@@ -945,6 +948,13 @@ void ath_ant_comb_scan(struct ath_softc
-  
-  #define ATH9K_NUM_CHANCTX  2 /* supports 2 operating channels */
-  
 @@ -24,7 +24,7 @@
   struct ath_softc {
   	struct ieee80211_hw *hw;
   	struct device *dev;
 -@@ -1004,9 +1014,8 @@ struct ath_softc {
-+@@ -996,9 +1006,8 @@ struct ath_softc {
++@@ -1005,9 +1015,8 @@ struct ath_softc {
   	spinlock_t chan_lock;
   
   #ifdef CPTCFG_MAC80211_LEDS
-@@ -165,7 +165,7 @@
+@@ -54,7 +54,8 @@
+ +			  (brightness != LED_OFF) ^ led->gpio->active_low);
+ +	ath9k_ps_restore(sc);
+ +}
+-+
++ 
++-	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
+ +static int ath_add_led(struct ath_softc *sc, struct ath_led *led)
+ +{
+ +	const struct gpio_led *gpio = led->gpio;
+@@ -63,8 +64,7 @@
+ +	led->cdev.name = gpio->name;
+ +	led->cdev.default_trigger = gpio->default_trigger;
+ +	led->cdev.brightness_set = ath_led_brightness;
+- 
+--	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
+++
+ +	ret = led_classdev_register(wiphy_dev(sc->hw->wiphy), &led->cdev);
+ +	if (ret < 0)
+ +		return ret;
+@@ -159,7 +159,7 @@
+ +		trigger = ieee80211_get_radio_led_name(sc->hw);
+  
+ -	sc->led_registered = true;
+-+	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, 1);
+++	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
+  }
+  
   void ath_fill_led_pin(struct ath_softc *sc)
- --- a/drivers/net/wireless/ath/ath9k/init.c
- +++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -936,7 +936,7 @@ int ath9k_init_device(u16 devid, struct
-+@@ -944,7 +944,7 @@ int ath9k_init_device(u16 devid, struct
+diff --git a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
+index dc33cd0..7c10ea6 100644
+--- a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
++++ b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
+@@ -59,7 +59,7 @@
+ @@ -120,6 +141,12 @@ void ath_init_leds(struct ath_softc *sc)
+  		trigger = ieee80211_get_radio_led_name(sc->hw);
   
-  #ifdef CPTCFG_MAC80211_LEDS
-  	/* must be initialized before ieee80211_register_hw */
+- 	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, 1);
++ 	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
+ +
+ +	if (!pdata)
+ +		return;
+diff --git a/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
+new file mode 100644
+index 0000000..6d62a2b
+--- /dev/null
++++ b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
+@@ -0,0 +1,20 @@
++--- a/include/linux/ath9k_platform.h
+++++ b/include/linux/ath9k_platform.h
++@@ -36,6 +36,7 @@ struct ath9k_platform_data {
++ 	bool tx_gain_buffalo;
++ 	bool disable_2ghz;
++ 	bool disable_5ghz;
+++	bool led_active_high;
++ 
++ 	int (*get_mac_revision)(void);
++ 	int (*external_reset)(void);
++--- a/drivers/net/wireless/ath/ath9k/init.c
+++++ b/drivers/net/wireless/ath/ath9k/init.c
++@@ -577,6 +577,7 @@ static int ath9k_init_softc(u16 devid, s
++ 		ah->external_reset = pdata->external_reset;
++ 		ah->disable_2ghz = pdata->disable_2ghz;
++ 		ah->disable_5ghz = pdata->disable_5ghz;
+++		ah->config.led_active_high = pdata->led_active_high;
++ 		if (!pdata->endian_check)
++ 			ah->ah_flags |= AH_NO_EEP_SWAP;
++ 	}
 diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
-index 08c5a0f..2b2c763 100644
+index 08c5a0f..e83c6bf 100644
 --- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
 +++ b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
 @@ -62,7 +62,7 @@
@@ -27971,7 +28672,7 @@ index 08c5a0f..2b2c763 100644
  --- a/drivers/net/wireless/ath/ath9k/hw.c
  +++ b/drivers/net/wireless/ath/ath9k/hw.c
 -@@ -1804,6 +1804,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
-+@@ -1808,6 +1808,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
++@@ -1819,6 +1819,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
   }
   EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
   
@@ -27980,12 +28681,12 @@ index 08c5a0f..2b2c763 100644
   		   struct ath9k_hw_cal_data *caldata, bool fastcc)
   {
 -@@ -2012,6 +2026,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-+@@ -2016,6 +2030,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
++@@ -2027,6 +2041,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
   		ar9003_hw_disable_phy_restart(ah);
   
   	ath9k_hw_apply_gpio_override(ah);
 diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
-index 8c9b34c..fddaf56 100644
+index 8c9b34c..d7bb5a1 100644
 --- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
 +++ b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
 @@ -1,6 +1,6 @@
@@ -28005,12 +28706,30 @@ index 8c9b34c..fddaf56 100644
   			struct ath_hw_antcomb_conf *antconf);
   	void (*antdiv_comb_conf_set)(struct ath_hw *ah,
   			struct ath_hw_antcomb_conf *antconf);
+@@ -18,7 +18,7 @@
+  	void (*spectral_scan_trigger)(struct ath_hw *ah);
+ --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+ +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+-@@ -1999,6 +1999,26 @@ void ar9003_hw_init_rate_txpower(struct
++@@ -1998,6 +1998,26 @@ void ar9003_hw_init_rate_txpower(struct
+  	}
+  }
+  
+@@ -45,7 +45,7 @@
+  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
+  {
+  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+-@@ -2035,6 +2055,7 @@ void ar9003_hw_attach_phy_ops(struct ath
++@@ -2034,6 +2054,7 @@ void ar9003_hw_attach_phy_ops(struct ath
+  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
+  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
+  
 @@ -55,7 +55,7 @@
   	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
  --- a/drivers/net/wireless/ath/ath9k/init.c
  +++ b/drivers/net/wireless/ath/ath9k/init.c
 -@@ -703,7 +703,8 @@ static void ath9k_init_txpower_limits(st
-+@@ -710,7 +710,8 @@ static void ath9k_init_txpower_limits(st
++@@ -711,7 +711,8 @@ static void ath9k_init_txpower_limits(st
   	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
   		ath9k_init_band_txpower(sc, IEEE80211_BAND_5GHZ);
   
@@ -28019,7 +28738,7 @@ index 8c9b34c..fddaf56 100644
   
   static const struct ieee80211_iface_limit if_limits[] = {
 -@@ -896,6 +897,18 @@ static void ath9k_set_hw_capab(struct at
-+@@ -904,6 +905,18 @@ static void ath9k_set_hw_capab(struct at
++@@ -897,6 +898,18 @@ static void ath9k_set_hw_capab(struct at
   	SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
   }
   
@@ -28028,7 +28747,7 @@ index 8c9b34c..fddaf56 100644
   		    const struct ath_bus_ops *bus_ops)
   {
 -@@ -941,6 +954,8 @@ int ath9k_init_device(u16 devid, struct
-+@@ -949,6 +962,8 @@ int ath9k_init_device(u16 devid, struct
++@@ -942,6 +955,8 @@ int ath9k_init_device(u16 devid, struct
   		ARRAY_SIZE(ath9k_tpt_blink));
   #endif
   
@@ -28051,7 +28770,7 @@ index 8c9b34c..fddaf56 100644
   	    return ret;
   
 diff --git a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
-index 240b898..6ca642a 100644
+index 240b898..8768c5d 100644
 --- a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
 +++ b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
 @@ -1,6 +1,6 @@
@@ -28067,7 +28786,7 @@ index 240b898..6ca642a 100644
   /* Chip Revisions */
   /******************/
 -@@ -1382,6 +1395,9 @@ static bool ath9k_hw_set_reset(struct at
-+@@ -1386,6 +1399,9 @@ static bool ath9k_hw_set_reset(struct at
++@@ -1397,6 +1410,9 @@ static bool ath9k_hw_set_reset(struct at
   	if (AR_SREV_9100(ah))
   		udelay(50);
   
@@ -28076,7 +28795,7 @@ index 240b898..6ca642a 100644
   }
   
 -@@ -1481,6 +1497,9 @@ static bool ath9k_hw_chip_reset(struct a
-+@@ -1485,6 +1501,9 @@ static bool ath9k_hw_chip_reset(struct a
++@@ -1496,6 +1512,9 @@ static bool ath9k_hw_chip_reset(struct a
   		ar9003_hw_internal_regulator_apply(ah);
   	ath9k_hw_init_pll(ah, chan);
   
@@ -28085,7 +28804,7 @@ index 240b898..6ca642a 100644
   }
   
 -@@ -1782,8 +1801,14 @@ static int ath9k_hw_do_fastcc(struct ath
-+@@ -1786,8 +1805,14 @@ static int ath9k_hw_do_fastcc(struct ath
++@@ -1797,8 +1816,14 @@ static int ath9k_hw_do_fastcc(struct ath
   	if (AR_SREV_9271(ah))
   		ar9002_hw_load_ani_reg(ah, chan);
   
@@ -28094,12 +28813,12 @@ index 240b898..6ca642a 100644
   }
   
 -@@ -2037,6 +2062,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-+@@ -2041,6 +2066,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
++@@ -2052,6 +2077,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
   		ath9k_hw_set_radar_params(ah);
   	}
   
 diff --git a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
-index 9610372..bc0aca6 100644
+index 9610372..3d24ccd 100644
 --- a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
 +++ b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
 @@ -1,6 +1,6 @@
@@ -28110,12 +28829,36 @@ index 9610372..bc0aca6 100644
   		 * on == 0 means more noise imm
   		 */
   		u32 on = param ? 1 : 0;
+@@ -79,7 +79,7 @@
+  static const u8 ofdm2pwr[] = {
+  	ALL_TARGET_LEGACY_6_24,
+  	ALL_TARGET_LEGACY_6_24,
+-@@ -1090,11 +1076,6 @@ static bool ar9003_hw_ani_control(struct
++@@ -1089,11 +1075,6 @@ static bool ar9003_hw_ani_control(struct
+  	struct ath_common *common = ath9k_hw_common(ah);
+  	struct ath9k_channel *chan = ah->curchan;
+  	struct ar5416AniState *aniState = &ah->ani;
+@@ -91,7 +91,7 @@
+  	s32 value, value2;
+  
+  	switch (cmd & ah->ani_function) {
+-@@ -1108,61 +1089,6 @@ static bool ar9003_hw_ani_control(struct
++@@ -1107,61 +1088,6 @@ static bool ar9003_hw_ani_control(struct
+  		 */
+  		u32 on = param ? 1 : 0;
+  
 diff --git a/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch b/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch
-index c0dc4fe..15863a6 100644
+index c0dc4fe..bd81555 100644
 --- a/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch
 +++ b/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch
-@@ -20,32 +20,14 @@ Changes since v1: ---
-  drivers/net/wireless/rt2x00/rt2800lib.h |   11 +++++++++++
+@@ -16,36 +16,18 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+ Changes since v1: ---
+ ---
+- drivers/net/wireless/rt2x00/rt2800.h    |   13 -------------
+- drivers/net/wireless/rt2x00/rt2800lib.h |   11 +++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   13 -------------
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.h |   11 +++++++++++
   2 files changed, 11 insertions(+), 13 deletions(-)
  
 ---- a/drivers/net/wireless/rt2x00/rt2800.h
@@ -28138,9 +28881,11 @@ index c0dc4fe..15863a6 100644
 --};
 --
 - #endif /* RT2800_H */
- --- a/drivers/net/wireless/rt2x00/rt2800lib.h
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.h
+---- a/drivers/net/wireless/rt2x00/rt2800lib.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
 -@@ -20,6 +20,17 @@
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +@@ -20,6 +20,20 @@
   #ifndef RT2800LIB_H
   #define RT2800LIB_H
@@ -28160,8 +28905,8 @@ index c0dc4fe..15863a6 100644
   struct rt2800_ops {
   	void (*register_read)(struct rt2x00_dev *rt2x00dev,
   			      const unsigned int offset, u32 *value);
-+--- a/drivers/net/wireless/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +@@ -2969,18 +2969,4 @@ enum rt2800_eeprom_word {
 + #define WCID_END	222
 + #define STA_IDS_SIZE	(WCID_END - WCID_START + 2)
@@ -28182,15 +28927,25 @@ index c0dc4fe..15863a6 100644
 +-
 + #endif /* RT2800_H */
 diff --git a/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch b/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
-index 6bad6ac..9165eec 100644
+index 6bad6ac..8245909 100644
 --- a/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
 +++ b/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
-@@ -24,7 +24,7 @@ Changes since v1:
- 
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -18,13 +18,13 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ Changes since v1:
+   - don't enable the new flag for RT3071 and RT5592
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    4 ++++
+- drivers/net/wireless/rt2x00/rt2800lib.h |   13 +++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    4 ++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.h |   13 +++++++++++++
+  2 files changed, 17 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7747,6 +7747,7 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -7721,6 +7721,7 @@ static int rt2800_probe_rt(struct rt2x00
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7722,6 +7722,7 @@ static int rt2800_probe_rt(struct rt2x00
   
   int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
   {
@@ -28199,17 +28954,21 @@ index 6bad6ac..9165eec 100644
   	u32 reg;
   
 -@@ -7754,6 +7755,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7728,6 +7729,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++@@ -7729,6 +7730,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	if (retval)
   		return retval;
   
-@@ -44,9 +44,9 @@ Changes since v1:
+@@ -42,11 +42,11 @@ Changes since v1:
+  	/*
+  	 * Allocate eeprom data.
   	 */
- --- a/drivers/net/wireless/rt2x00/rt2800lib.h
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.h
+---- a/drivers/net/wireless/rt2x00/rt2800lib.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
 -@@ -20,6 +20,10 @@
 - #ifndef RT2800LIB_H
 - #define RT2800LIB_H
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +@@ -22,6 +22,10 @@
 + 
 + #include "rt2800.h"
@@ -28237,9 +28996,36 @@ index 6bad6ac..9165eec 100644
   };
   
 diff --git a/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch b/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
-index 9f8dfcc..5671515 100644
+index 9f8dfcc..7abfcd1 100644
 --- a/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
 +++ b/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
+@@ -17,17 +17,17 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+ Changes since v1: ---
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c  |   55 +++++++++++++++++++++++++++++-
+- drivers/net/wireless/rt2x00/rt2800lib.h  |   32 +++++++++++++++++
+- drivers/net/wireless/rt2x00/rt2800mmio.c |   26 ++++++++++++++
+- drivers/net/wireless/rt2x00/rt2800mmio.h |    4 +++
+- drivers/net/wireless/rt2x00/rt2800pci.c  |   14 ++++++++
+- drivers/net/wireless/rt2x00/rt2800soc.c  |    3 ++
+- drivers/net/wireless/rt2x00/rt2800usb.c  |   31 +++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c  |   55 +++++++++++++++++++++++++++++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.h  |   32 +++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   26 ++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800mmio.h |    4 +++
++ drivers/net/wireless/ralink/rt2x00/rt2800pci.c  |   14 ++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800soc.c  |    3 ++
++ drivers/net/wireless/ralink/rt2x00/rt2800usb.c  |   31 +++++++++++++++++
+  7 files changed, 164 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -451,11 +451,13 @@ void rt2800_mcu_request(struct rt2x00_de
+  		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
+  		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
 @@ -175,7 +175,7 @@ Changes since v1: ---
   
   	/*
@@ -28254,7 +29040,7 @@ index 9f8dfcc..5671515 100644
   
   	/*
 -@@ -4908,14 +4941,19 @@ static int rt2800_init_registers(struct
-+@@ -4884,14 +4917,19 @@ static int rt2800_init_registers(struct
++@@ -4885,14 +4918,19 @@ static int rt2800_init_registers(struct
   	/*
   	 * ASIC will keep garbage value after boot, clear encryption keys.
   	 */
@@ -28263,7 +29049,7 @@ index 9f8dfcc..5671515 100644
   
   	/*
 -@@ -5041,8 +5079,10 @@ static int rt2800_wait_bbp_ready(struct
-+@@ -5017,8 +5055,10 @@ static int rt2800_wait_bbp_ready(struct
++@@ -5018,8 +5056,10 @@ static int rt2800_wait_bbp_ready(struct
   	 * BBP was enabled after firmware was loaded,
   	 * but we need to reactivate it now.
   	 */
@@ -28272,7 +29058,7 @@ index 9f8dfcc..5671515 100644
   
   	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
 -@@ -6738,11 +6778,19 @@ int rt2800_enable_radio(struct rt2x00_de
-+@@ -6714,11 +6754,19 @@ int rt2800_enable_radio(struct rt2x00_de
++@@ -6715,11 +6755,19 @@ int rt2800_enable_radio(struct rt2x00_de
   	/*
   	 * Send signal during boot time to initialize firmware.
   	 */
@@ -28281,7 +29067,7 @@ index 9f8dfcc..5671515 100644
   
   	/*
 -@@ -7751,6 +7799,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7725,6 +7773,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++@@ -7726,6 +7774,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	int retval;
   	u32 reg;
   
@@ -28291,7 +29077,7 @@ index 9f8dfcc..5671515 100644
   		return retval;
 -@@ -7830,8 +7880,11 @@ void rt2800_get_tkip_seq(struct ieee8021
 - 	u32 offset;
-+@@ -7808,8 +7858,11 @@ void rt2800_get_key_seq(struct ieee80211
++@@ -7809,8 +7859,11 @@ void rt2800_get_key_seq(struct ieee80211
 + 		return;
   
 - 	offset = MAC_IVEIV_ENTRY(hw_key_idx);
@@ -28304,12 +29090,14 @@ index 9f8dfcc..5671515 100644
   
 - 	memcpy(iv16, &iveiv_entry.iv[0], sizeof(*iv16));
 - 	memcpy(iv32, &iveiv_entry.iv[4], sizeof(*iv32));
-+ 	memcpy(&seq->tkip.iv16, &iveiv_entry.iv[0], 2);
-+ 	memcpy(&seq->tkip.iv32, &iveiv_entry.iv[4], 4);
- --- a/drivers/net/wireless/rt2x00/rt2800lib.h
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.h
+---- a/drivers/net/wireless/rt2x00/rt2800lib.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
 -@@ -35,6 +35,11 @@ struct rt2800_drv_data {
 - 	unsigned int tbtt_tick;
++ 	memcpy(&seq->tkip.iv16, &iveiv_entry.iv[0], 2);
++ 	memcpy(&seq->tkip.iv32, &iveiv_entry.iv[4], 4);
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +@@ -38,6 +38,11 @@ struct rt2800_drv_data {
 + 	DECLARE_BITMAP(sta_ids, STA_IDS_SIZE);
   
@@ -28333,6 +29121,61 @@ index 9f8dfcc..5671515 100644
   	return test_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
   }
   
+@@ -315,8 +315,8 @@ Changes since v1: ---
+  static inline void rt2800_register_read(struct rt2x00_dev *rt2x00dev,
+  					const unsigned int offset,
+  					u32 *value)
+---- a/drivers/net/wireless/rt2x00/rt2800mmio.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800mmio.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+ @@ -820,8 +820,10 @@ int rt2800mmio_init_registers(struct rt2
+  	rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
+  	rt2x00mmio_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+@@ -359,8 +359,8 @@ Changes since v1: ---
+  MODULE_AUTHOR(DRV_PROJECT);
+  MODULE_VERSION(DRV_VERSION);
+  MODULE_DESCRIPTION("rt2800 MMIO library");
+---- a/drivers/net/wireless/rt2x00/rt2800mmio.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800mmio.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
+ @@ -160,4 +160,8 @@ int rt2800mmio_init_registers(struct rt2
+  /* Device state switch handlers. */
+  int rt2800mmio_enable_radio(struct rt2x00_dev *rt2x00dev);
+@@ -370,8 +370,8 @@ Changes since v1: ---
+ +void rt2800mmio_shmem_unlock(struct rt2x00_dev *rt2x00dev);
+ +
+  #endif /* RT2800MMIO_H */
+---- a/drivers/net/wireless/rt2x00/rt2800pci.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+ @@ -69,7 +69,9 @@ static void rt2800pci_mcu_status(struct
+  		return;
+  
+@@ -444,8 +444,8 @@ Changes since v1: ---
+  };
+  
+  static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
+---- a/drivers/net/wireless/rt2x00/rt2800soc.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+ @@ -176,6 +176,9 @@ static const struct rt2800_ops rt2800soc
+  	.drv_write_firmware	= rt2800soc_write_firmware,
+  	.drv_init_registers	= rt2800mmio_init_registers,
+@@ -456,8 +456,8 @@ Changes since v1: ---
+  };
+  
+  static const struct rt2x00lib_ops rt2800soc_rt2x00_ops = {
+---- a/drivers/net/wireless/rt2x00/rt2800usb.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+ @@ -51,6 +51,27 @@ static bool rt2800usb_hwcrypt_disabled(s
+  	return modparam_nohwcrypt;
+  }
 @@ -486,7 +486,7 @@ Changes since v1: ---
   /*
    * Queue handlers.
@@ -28369,16 +29212,58 @@ index 9f8dfcc..5671515 100644
   	.drv_write_firmware	= rt2800usb_write_firmware,
   	.drv_init_registers	= rt2800usb_init_registers,
   	.drv_get_txwi		= rt2800usb_get_txwi,
+diff --git a/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch b/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch
+index b8c1914..985a3b9 100644
+--- a/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch
++++ b/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch
+@@ -23,12 +23,12 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+ Changes since v1: ---
+ ---
+- drivers/net/wireless/rt2x00/rt2800.h    |    3 +++
+- drivers/net/wireless/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    3 +++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
+  2 files changed, 47 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -574,6 +574,7 @@
+  #define PBF_SYS_CTRL			0x0400
+  #define PBF_SYS_CTRL_READY		FIELD32(0x00000080)
+@@ -46,8 +46,8 @@ Changes since v1: ---
+  #define BEACON_BASE_TO_OFFSET(_base)	(((_base) - 0x4000) / 64)
+  
+  /*
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -82,6 +82,39 @@ static inline bool rt2800_is_305x_soc(st
+  	return false;
+  }
 diff --git a/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch b/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
-index e7eb630..d04998a 100644
+index e7eb630..02b2acf 100644
 --- a/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
 +++ b/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
-@@ -24,7 +24,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- 
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -18,13 +18,13 @@ new field with the actually used value.
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    5 ++++-
+- drivers/net/wireless/rt2x00/rt2800lib.h |    1 +
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    5 ++++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.h |    1 +
+  2 files changed, 5 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -4638,6 +4638,7 @@ EXPORT_SYMBOL_GPL(rt2800_link_tuner);
-+@@ -4614,6 +4614,7 @@ EXPORT_SYMBOL_GPL(rt2800_link_tuner);
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -4615,6 +4615,7 @@ EXPORT_SYMBOL_GPL(rt2800_link_tuner);
    */
   static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
   {
@@ -28387,7 +29272,7 @@ index e7eb630..d04998a 100644
   	u16 eeprom;
   	unsigned int i;
 -@@ -5003,7 +5004,7 @@ static int rt2800_init_registers(struct
-+@@ -4979,7 +4980,7 @@ static int rt2800_init_registers(struct
++@@ -4980,7 +4981,7 @@ static int rt2800_init_registers(struct
   	/*
   	 * Clear all beacons
   	 */
@@ -28396,15 +29281,19 @@ index e7eb630..d04998a 100644
   
   	if (rt2x00_is_usb(rt2x00dev)) {
 -@@ -7852,6 +7853,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7826,6 +7827,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++@@ -7827,6 +7828,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	if (rt2x00_rt(rt2x00dev, RT3593))
   		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
   
-@@ -52,11 +52,11 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -50,13 +50,13 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+  	/*
+  	 * Allocate eeprom data.
   	 */
- --- a/drivers/net/wireless/rt2x00/rt2800lib.h
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.h
+---- a/drivers/net/wireless/rt2x00/rt2800lib.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
 -@@ -33,6 +33,7 @@ struct rt2800_drv_data {
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +@@ -35,6 +35,7 @@ struct rt2800_drv_data {
   	u8 txmixer_gain_24g;
   	u8 txmixer_gain_5g;
@@ -28415,54 +29304,131 @@ index e7eb630..d04998a 100644
   	unsigned long rt2800_flags;
 - 
 diff --git a/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch b/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch
-index b79b4be..f5231f0 100644
+index b79b4be..4e735d3 100644
 --- a/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch
 +++ b/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch
-@@ -34,7 +34,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: init additional beacon offset registers
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800.h    |   14 ++++++++++++++
+- drivers/net/wireless/rt2x00/rt2800lib.c |   24 ++++++++++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   14 ++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   24 ++++++++++++++++++++++++
+  2 files changed, 38 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -629,6 +629,20 @@
+   */
+  #define PBF_DBG				0x043c
+@@ -32,9 +32,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+  /*
+   * RF registers
    */
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -4650,6 +4650,30 @@ static int rt2800_init_registers(struct
-+@@ -4626,6 +4626,30 @@ static int rt2800_init_registers(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -4627,6 +4627,30 @@ static int rt2800_init_registers(struct
   	if (ret)
   		return ret;
   
 diff --git a/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch b/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
-index 180c5e3..4b21eae 100644
+index 180c5e3..e909272 100644
 --- a/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
 +++ b/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix max supported beacon count for RT3593
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    5 ++++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    5 ++++-
+  1 file changed, 4 insertions(+), 1 deletion(-)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7877,7 +7877,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7851,7 +7851,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7852,7 +7852,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	if (rt2x00_rt(rt2x00dev, RT3593))
   		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
   
+diff --git a/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch b/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
+index 8a10c6e..565e39d 100644
+--- a/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
++++ b/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
+@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: allow to build rt2800soc module for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/Kconfig |    2 +-
++ drivers/net/wireless/ralink/rt2x00/Kconfig |    2 +-
+  1 file changed, 1 insertion(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/Kconfig
+-+++ b/drivers/net/wireless/rt2x00/Kconfig
++--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
+++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
+ @@ -210,7 +210,7 @@ endif
+  config RT2800SOC
+  	tristate "Ralink WiSoC support"
 diff --git a/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch b/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
-index 31aa34a..e77cd86 100644
+index 31aa34a..7fe38e0 100644
 --- a/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
 +++ b/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable support for RT3883
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    1 +
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
+  1 file changed, 1 insertion(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7847,6 +7847,7 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -7821,6 +7821,7 @@ static int rt2800_probe_rt(struct rt2x00
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7822,6 +7822,7 @@ static int rt2800_probe_rt(struct rt2x00
   	case RT3390:
   	case RT3572:
   	case RT3593:
 diff --git a/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch b/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
-index a90c590..780c1dd 100644
+index a90c590..253a0c0 100644
 --- a/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
 +++ b/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
-@@ -31,7 +31,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add rf_vals for RF3853
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800.h    |    4 +-
+- drivers/net/wireless/rt2x00/rt2800lib.c |   65 +++++++++++++++++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    4 +-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   65 +++++++++++++++++++++++++++++++
+  2 files changed, 68 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -48,7 +48,8 @@
+   * RF2853 2.4G/5G 3T3R
+   * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
+@@ -29,9 +29,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+  #define RF5360				0x5360
+  #define RF5362				0x5362
   #define RF5370				0x5370
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7465,6 +7465,66 @@ static const struct rf_channel rf_vals_3
-+@@ -7441,6 +7441,66 @@ static const struct rf_channel rf_vals_3
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7442,6 +7442,66 @@ static const struct rf_channel rf_vals_3
   	{173, 0x61, 0, 9},
   };
   
@@ -28471,20 +29437,28 @@ index a90c590..780c1dd 100644
   	/* Channel, N, K, mod, R */
   	{1, 482, 4, 10, 3},
 -@@ -7694,6 +7754,11 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -7668,6 +7728,11 @@ static int rt2800_probe_hw_mode(struct r
++@@ -7669,6 +7729,11 @@ static int rt2800_probe_hw_mode(struct r
   		spec->channels = rf_vals_3x;
   		break;
   
 diff --git a/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch b/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
-index ab2673b..858dece 100644
+index ab2673b..f15c22b 100644
 --- a/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
 +++ b/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable VCO calibration for RF3853
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    2 ++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
+  1 file changed, 2 insertions(+)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -4402,6 +4402,7 @@ void rt2800_vco_calibration(struct rt2x0
-+@@ -4378,6 +4378,7 @@ void rt2800_vco_calibration(struct rt2x0
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -4379,6 +4379,7 @@ void rt2800_vco_calibration(struct rt2x0
   	case RF3053:
   	case RF3070:
   	case RF3290:
@@ -28493,20 +29467,28 @@ index ab2673b..858dece 100644
   	case RF5362:
   	case RF5370:
 -@@ -7873,6 +7874,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -7847,6 +7848,7 @@ static int rt2800_probe_hw_mode(struct r
++@@ -7848,6 +7849,7 @@ static int rt2800_probe_hw_mode(struct r
   	case RF3053:
   	case RF3070:
   	case RF3290:
 diff --git a/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch b/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch
-index 05ed444..ed82e44 100644
+index 05ed444..c120f2c 100644
 --- a/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch
 +++ b/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch
-@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add channel configuration function for
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |  208 +++++++++++++++++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  208 +++++++++++++++++++++++++++++++
+  1 file changed, 208 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -2649,6 +2649,211 @@ static void rt2800_config_channel_rf3053
-+@@ -2625,6 +2625,211 @@ static void rt2800_config_channel_rf3053
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -2626,6 +2626,211 @@ static void rt2800_config_channel_rf3053
   	}
   }
   
@@ -28515,33 +29497,62 @@ index 05ed444..ed82e44 100644
   #define POWER_BOUND_5G		0x2b
   
 -@@ -3261,6 +3466,9 @@ static void rt2800_config_channel(struct
-+@@ -3237,6 +3442,9 @@ static void rt2800_config_channel(struct
++@@ -3238,6 +3443,9 @@ static void rt2800_config_channel(struct
   	case RF3322:
   		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
   		break;
 diff --git a/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch b/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch
-index 3b50775..33cbc4c 100644
+index 3b50775..f006304 100644
 --- a/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch
 +++ b/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable RF3853 support
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    1 +
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
+  1 file changed, 1 insertion(+)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7430,6 +7430,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7406,6 +7406,7 @@ static int rt2800_init_eeprom(struct rt2
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7407,6 +7407,7 @@ static int rt2800_init_eeprom(struct rt2
   	case RF3290:
   	case RF3320:
   	case RF3322:
 diff --git a/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch b/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
-index 4dfb068..c3a4798 100644
+index 4dfb068..a56bfa8 100644
 --- a/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
 +++ b/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
-@@ -35,7 +35,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add MAC register initialization for
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800.h    |   14 ++++++++++++++
+- drivers/net/wireless/rt2x00/rt2800lib.c |   19 ++++++++++++++++---
++ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   14 ++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   19 ++++++++++++++++---
+  2 files changed, 30 insertions(+), 3 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -1588,6 +1588,20 @@
+  #define TX_PWR_CFG_9_STBC7_CH2		FIELD32(0x00000f00)
+  
+@@ -33,9 +33,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+   * RX_FILTER_CFG: RX configuration register.
+   */
   #define RX_FILTER_CFG			0x1400
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -5005,6 +5005,12 @@ static int rt2800_init_registers(struct
-+@@ -4981,6 +4981,12 @@ static int rt2800_init_registers(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -4982,6 +4982,12 @@ static int rt2800_init_registers(struct
   			rt2800_register_write(rt2x00dev, TX_SW_CFG2,
   					      0x00000000);
   		}
@@ -28550,7 +29561,7 @@ index 4dfb068..c3a4798 100644
   		   rt2x00_rt(rt2x00dev, RT5392) ||
   		   rt2x00_rt(rt2x00dev, RT5592)) {
 -@@ -5035,9 +5041,11 @@ static int rt2800_init_registers(struct
-+@@ -5011,9 +5017,11 @@ static int rt2800_init_registers(struct
++@@ -5012,9 +5018,11 @@ static int rt2800_init_registers(struct
   
   	rt2800_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
   	rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
@@ -28559,20 +29570,47 @@ index 4dfb068..c3a4798 100644
   	else
   		rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
 -@@ -5190,6 +5198,11 @@ static int rt2800_init_registers(struct
-+@@ -5166,6 +5174,11 @@ static int rt2800_init_registers(struct
++@@ -5167,6 +5175,11 @@ static int rt2800_init_registers(struct
   	reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
   	rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
   
+diff --git a/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch b/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
+index 837c025..d68ad50 100644
+--- a/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
++++ b/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
+@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800soc: fix rt2800soc_disable_radio for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800soc.c |    9 ++++++++-
++ drivers/net/wireless/ralink/rt2x00/rt2800soc.c |    9 ++++++++-
+  1 file changed, 8 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800soc.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+ @@ -51,9 +51,16 @@ static bool rt2800soc_hwcrypt_disabled(s
+  
+  static void rt2800soc_disable_radio(struct rt2x00_dev *rt2x00dev)
 diff --git a/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch b/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
-index 6663b78..e647777 100644
+index 6663b78..9532632 100644
 --- a/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
 +++ b/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
-@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add BBP register initialization for
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
+  1 file changed, 44 insertions(+)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -5808,6 +5808,47 @@ static void rt2800_init_bbp_3593(struct
-+@@ -5784,6 +5784,47 @@ static void rt2800_init_bbp_3593(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -5785,6 +5785,47 @@ static void rt2800_init_bbp_3593(struct
   		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
   }
   
@@ -28581,20 +29619,41 @@ index 6663b78..e647777 100644
   {
   	int ant, div_mode;
 -@@ -6026,6 +6067,9 @@ static void rt2800_init_bbp(struct rt2x0
-+@@ -6002,6 +6043,9 @@ static void rt2800_init_bbp(struct rt2x0
++@@ -6003,6 +6044,9 @@ static void rt2800_init_bbp(struct rt2x0
   	case RT3593:
   		rt2800_init_bbp_3593(rt2x00dev);
   		return;
 diff --git a/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch b/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
-index 6e66f14..0fec3cd 100644
+index 6e66f14..936fa35 100644
 --- a/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
 +++ b/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
-@@ -21,7 +21,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add RFCSR initialization for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800.h    |    1 +
+- drivers/net/wireless/rt2x00/rt2800lib.c |  141 +++++++++++++++++++++++++++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    1 +
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  141 +++++++++++++++++++++++++++++++
+  2 files changed, 142 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -2171,6 +2171,7 @@ struct mac_iveiv_entry {
+  /*
+   * RFCSR 2:
+@@ -19,9 +19,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+  #define RFCSR2_RESCAL_EN		FIELD8(0x80)
+  
   /*
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -6843,6 +6843,144 @@ static void rt2800_init_rfcsr_3593(struc
-+@@ -6819,6 +6819,144 @@ static void rt2800_init_rfcsr_3593(struc
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -6820,6 +6820,144 @@ static void rt2800_init_rfcsr_3593(struc
   	/* TODO: enable stream mode support */
   }
   
@@ -28603,33 +29662,68 @@ index 6e66f14..0fec3cd 100644
   {
   	rt2800_rf_init_calibration(rt2x00dev, 2);
 -@@ -7074,6 +7212,9 @@ static void rt2800_init_rfcsr(struct rt2
-+@@ -7050,6 +7188,9 @@ static void rt2800_init_rfcsr(struct rt2
++@@ -7051,6 +7189,9 @@ static void rt2800_init_rfcsr(struct rt2
   	case RT3390:
   		rt2800_init_rfcsr_3390(rt2x00dev);
   		break;
+diff --git a/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch b/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
+index 57af961..ae899f7 100644
+--- a/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
++++ b/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
+@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use the extended EEPROM map for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -342,7 +342,8 @@ static unsigned int rt2800_eeprom_word_i
+  		      wiphy_name(rt2x00dev->hw->wiphy), word))
+  		return 0;
 diff --git a/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch b/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
-index 9390f7e..c9d1e06 100644
+index 9390f7e..bcaf676 100644
 --- a/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
 +++ b/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: force rf type to RF3853 on RT3883
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    2 ++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
+  1 file changed, 2 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7611,6 +7611,8 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7587,6 +7587,8 @@ static int rt2800_init_eeprom(struct rt2
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7588,6 +7588,8 @@ static int rt2800_init_eeprom(struct rt2
   	    rt2x00_rt(rt2x00dev, RT5390) ||
   	    rt2x00_rt(rt2x00dev, RT5392))
   		rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
 diff --git a/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch b/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
-index 1cba4f6..12b9c33 100644
+index 1cba4f6..3169c10 100644
 --- a/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
 +++ b/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add channel configuration code for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |   72 +++++++++++++++++++++++++++++--
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   72 +++++++++++++++++++++++++++++--
+  1 file changed, 69 insertions(+), 3 deletions(-)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -3429,6 +3429,36 @@ static char rt2800_txpower_to_dev(struct
-+@@ -3405,6 +3405,36 @@ static char rt2800_txpower_to_dev(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -3406,6 +3406,36 @@ static char rt2800_txpower_to_dev(struct
   		return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER);
   }
   
@@ -28638,7 +29732,7 @@ index 1cba4f6..12b9c33 100644
   				  struct ieee80211_conf *conf,
   				  struct rf_channel *rf,
 -@@ -3447,6 +3477,12 @@ static void rt2800_config_channel(struct
-+@@ -3423,6 +3453,12 @@ static void rt2800_config_channel(struct
++@@ -3424,6 +3454,12 @@ static void rt2800_config_channel(struct
   			rt2800_txpower_to_dev(rt2x00dev, rf->channel,
   					      info->default_power3);
   
@@ -28647,7 +29741,7 @@ index 1cba4f6..12b9c33 100644
   	case RF2020:
   	case RF3020:
 -@@ -3530,6 +3566,15 @@ static void rt2800_config_channel(struct
-+@@ -3506,6 +3542,15 @@ static void rt2800_config_channel(struct
++@@ -3507,6 +3543,15 @@ static void rt2800_config_channel(struct
   		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
   		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
   		rt2800_bbp_write(rt2x00dev, 77, 0x98);
@@ -28656,7 +29750,7 @@ index 1cba4f6..12b9c33 100644
   		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
   		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
 -@@ -3542,6 +3587,7 @@ static void rt2800_config_channel(struct
-+@@ -3518,6 +3563,7 @@ static void rt2800_config_channel(struct
++@@ -3519,6 +3564,7 @@ static void rt2800_config_channel(struct
   		    !rt2x00_rt(rt2x00dev, RT5392)) {
   			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
   				rt2800_bbp_write(rt2x00dev, 82, 0x62);
@@ -28665,7 +29759,7 @@ index 1cba4f6..12b9c33 100644
   			} else {
   				if (rt2x00_rt(rt2x00dev, RT3593))
 -@@ -3550,19 +3596,22 @@ static void rt2800_config_channel(struct
-+@@ -3526,19 +3572,22 @@ static void rt2800_config_channel(struct
++@@ -3527,19 +3573,22 @@ static void rt2800_config_channel(struct
   					rt2800_bbp_write(rt2x00dev, 82, 0x84);
   				rt2800_bbp_write(rt2x00dev, 75, 0x50);
   			}
@@ -28674,46 +29768,70 @@ index 1cba4f6..12b9c33 100644
   
   		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
 -@@ -3684,6 +3733,23 @@ static void rt2800_config_channel(struct
-+@@ -3660,6 +3709,23 @@ static void rt2800_config_channel(struct
++@@ -3661,6 +3710,23 @@ static void rt2800_config_channel(struct
   
   		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
   
 diff --git a/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch b/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
-index 1773128..3f40b4e 100644
+index 1773128..fa646d2 100644
 --- a/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
 +++ b/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix txpower_to_dev function for RT3883
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    6 ++++--
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
+  1 file changed, 4 insertions(+), 2 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -3416,13 +3416,15 @@ static char rt2800_txpower_to_dev(struct
-+@@ -3392,13 +3392,15 @@ static char rt2800_txpower_to_dev(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -3393,13 +3393,15 @@ static char rt2800_txpower_to_dev(struct
   				  unsigned int channel,
   				  char txpower)
   {
 diff --git a/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch b/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
-index 36f0a4c..52baeec 100644
+index 36f0a4c..c068769 100644
 --- a/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
 +++ b/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
-@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct txpower calculation function
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -4635,7 +4635,8 @@ static void rt2800_config_txpower(struct
-+@@ -4611,7 +4611,8 @@ static void rt2800_config_txpower(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -4612,7 +4612,8 @@ static void rt2800_config_txpower(struct
   				  struct ieee80211_channel *chan,
   				  int power_level)
   {
 diff --git a/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch b/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
-index 8119f97..b9dafc6 100644
+index 8119f97..74d80de 100644
 --- a/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
 +++ b/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
-@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: hardcode txmixer gain values to zero for
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    6 ++++--
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
+  1 file changed, 4 insertions(+), 2 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7493,7 +7493,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
-+@@ -7469,7 +7469,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7470,7 +7470,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
   {
   	u16 word;
   
@@ -28722,46 +29840,108 @@ index 8119f97..b9dafc6 100644
   
   	rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG, &word);
 -@@ -7507,7 +7508,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
-+@@ -7483,7 +7484,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
++@@ -7484,7 +7485,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
   {
   	u16 word;
   
+diff --git a/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch b/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
+index 53435aa..1259286 100644
+--- a/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
++++ b/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
+@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct [RT]XWI size for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    1 +
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
+  1 file changed, 1 insertion(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -558,6 +558,7 @@ void rt2800_get_txwi_rxwi_size(struct rt
+  {
+  	switch (rt2x00dev->chip.rt) {
+diff --git a/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch b/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch
+index 08f3f88..0dcc027 100644
+--- a/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch
++++ b/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch
+@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct beacon base for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -983,7 +983,8 @@ EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
+  static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
+  					  unsigned int index)
 diff --git a/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch b/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
-index dfbdee7..f09f803 100644
+index dfbdee7..6ce224a 100644
 --- a/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
 +++ b/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct beacon count for RT3883
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -8428,7 +8428,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -8402,7 +8402,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -8403,7 +8403,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	if (rt2x00_rt(rt2x00dev, RT3593))
   		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
   
 diff --git a/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch b/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
-index 22f7110..f7d23fc 100644
+index 22f7110..3936368 100644
 --- a/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
 +++ b/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix antenna configuration for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -1961,7 +1961,8 @@ void rt2800_config_ant(struct rt2x00_dev
-+@@ -1937,7 +1937,8 @@ void rt2800_config_ant(struct rt2x00_dev
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -1938,7 +1938,8 @@ void rt2800_config_ant(struct rt2x00_dev
   	rt2800_bbp_write(rt2x00dev, 3, r3);
   	rt2800_bbp_write(rt2x00dev, 1, r1);
   
 diff --git a/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch b/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
-index 9945f38..4da750e 100644
+index 9945f38..f028587 100644
 --- a/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
 +++ b/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix LNA gain configuration for RT3883
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    6 ++++--
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
+  1 file changed, 4 insertions(+), 2 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -1984,7 +1984,8 @@ static void rt2800_config_lna_gain(struc
-+@@ -1960,7 +1960,8 @@ static void rt2800_config_lna_gain(struc
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -1961,7 +1961,8 @@ static void rt2800_config_lna_gain(struc
   		rt2800_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
   		lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
   	} else if (libconf->rf.channel <= 128) {
@@ -28770,20 +29950,28 @@ index 9945f38..4da750e 100644
   			lna_gain = rt2x00_get_field16(eeprom,
   						      EEPROM_EXT_LNA2_A1);
 -@@ -1994,7 +1995,8 @@ static void rt2800_config_lna_gain(struc
-+@@ -1970,7 +1971,8 @@ static void rt2800_config_lna_gain(struc
++@@ -1971,7 +1972,8 @@ static void rt2800_config_lna_gain(struc
   						      EEPROM_RSSI_BG2_LNA_A1);
   		}
   	} else {
 diff --git a/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch b/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
-index beadea8..628b237 100644
+index beadea8..ab8c625 100644
 --- a/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
 +++ b/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix VGC setup for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |   11 +++++++++--
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   11 +++++++++--
+  1 file changed, 9 insertions(+), 2 deletions(-)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -4835,7 +4835,8 @@ static u8 rt2800_get_default_vgc(struct
-+@@ -4811,7 +4811,8 @@ static u8 rt2800_get_default_vgc(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -4812,7 +4812,8 @@ static u8 rt2800_get_default_vgc(struct
   		else
   			vgc = 0x2e + rt2x00dev->lna_gain;
   	} else { /* 5GHZ band */
@@ -28792,7 +29980,7 @@ index beadea8..628b237 100644
   		else if (rt2x00_rt(rt2x00dev, RT5592))
   			vgc = 0x24 + (2 * rt2x00dev->lna_gain);
 -@@ -4855,7 +4856,8 @@ static inline void rt2800_set_vgc(struct
-+@@ -4831,7 +4832,8 @@ static inline void rt2800_set_vgc(struct
++@@ -4832,7 +4833,8 @@ static inline void rt2800_set_vgc(struct
   {
   	if (qual->vgc_level != vgc_level) {
   		if (rt2x00_rt(rt2x00dev, RT3572) ||
@@ -28801,20 +29989,28 @@ index beadea8..628b237 100644
   						       vgc_level);
   		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
 -@@ -4902,6 +4904,11 @@ void rt2800_link_tuner(struct rt2x00_dev
-+@@ -4878,6 +4880,11 @@ void rt2800_link_tuner(struct rt2x00_dev
++@@ -4879,6 +4881,11 @@ void rt2800_link_tuner(struct rt2x00_dev
   		}
   		break;
   
 diff --git a/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch b/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
-index a6c0f58..216b8b6 100644
+index a6c0f58..49830a1 100644
 --- a/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
 +++ b/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix EEPROM LNA validation for RT3883
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    9 ++++++---
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    9 ++++++---
+  1 file changed, 6 insertions(+), 3 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7630,7 +7630,8 @@ static int rt2800_validate_eeprom(struct
-+@@ -7606,7 +7606,8 @@ static int rt2800_validate_eeprom(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7607,7 +7607,8 @@ static int rt2800_validate_eeprom(struct
   	rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &word);
   	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
   		rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
@@ -28823,7 +30019,7 @@ index a6c0f58..216b8b6 100644
   		    rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
   			rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
 -@@ -7650,7 +7651,8 @@ static int rt2800_validate_eeprom(struct
-+@@ -7626,7 +7627,8 @@ static int rt2800_validate_eeprom(struct
++@@ -7627,7 +7628,8 @@ static int rt2800_validate_eeprom(struct
   	rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &word);
   	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
   		rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
@@ -28832,45 +30028,141 @@ index a6c0f58..216b8b6 100644
   		    rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
   			rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
 -@@ -7658,7 +7660,8 @@ static int rt2800_validate_eeprom(struct
-+@@ -7634,7 +7636,8 @@ static int rt2800_validate_eeprom(struct
++@@ -7635,7 +7637,8 @@ static int rt2800_validate_eeprom(struct
   	}
   	rt2800_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
   
 diff --git a/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch b/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
-index 910f9ec..515086f 100644
+index 910f9ec..6e22847 100644
 --- a/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
 +++ b/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix txpower compensation for RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 +++
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 +++
+  1 file changed, 3 insertions(+)
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -4005,6 +4005,9 @@ static u8 rt2800_compensate_txpower(stru
-+@@ -3981,6 +3981,9 @@ static u8 rt2800_compensate_txpower(stru
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -3982,6 +3982,9 @@ static u8 rt2800_compensate_txpower(stru
   	if (rt2x00_rt(rt2x00dev, RT3593))
   		return min_t(u8, txpower, 0xc);
   
 diff --git a/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch b/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
-index bcdfc67..77e3f1b 100644
+index bcdfc67..25753af 100644
 --- a/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
 +++ b/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
-@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable RT2800_HAS_HIGH_SHARED_MEM for
  
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -8441,7 +8441,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -8415,7 +8415,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -8416,7 +8416,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	if (retval)
   		return retval;
   
+diff --git a/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch b/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch
+index dc06e6a..4f2e754 100644
+--- a/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch
++++ b/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch
+@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use high memory for beacons on RT3883
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
++ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+  1 file changed, 2 insertions(+), 1 deletion(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -97,7 +97,8 @@ static inline void rt2800_shared_mem_sel
+  
+  static inline bool rt2800_beacon_uses_high_mem(struct rt2x00_dev *rt2x00dev)
+diff --git a/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch b/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
+index 212eb4e..a497b5e 100644
+--- a/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
++++ b/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800mmio: add a workaround for spurious
+ 
+ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
+- drivers/net/wireless/rt2x00/rt2x00.h     |    5 +++
++ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
++ drivers/net/wireless/ralink/rt2x00/rt2x00.h     |    5 +++
+  2 files changed, 65 insertions(+), 12 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800mmio.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800mmio.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+ @@ -415,9 +415,9 @@ void rt2800mmio_autowake_tasklet(unsigne
+  }
+  EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
+@@ -120,9 +120,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+  		/*
+  		 * Never disable the TX_FIFO_STATUS interrupt.
+  		 */
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
+-@@ -987,6 +987,11 @@ struct rt2x00_dev {
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -991,6 +991,11 @@ struct rt2x00_dev {
+  	int rf_channel;
+  
+  	/*
+diff --git a/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch b/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch
+index 08c8fa6..a407161 100644
+--- a/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch
++++ b/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00pci.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00pci.c
+ @@ -94,8 +94,10 @@ int rt2x00pci_probe(struct pci_dev *pci_
+  
+  	pci_set_master(pci_dev);
+diff --git a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
+index 8c71075..7a183a4 100644
+--- a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
++++ b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
+@@ -20,8 +20,8 @@
+ +};
+ +
+ +#endif /* _RT2X00_PLATFORM_H */
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+ @@ -38,6 +38,7 @@
+  #include <linux/kfifo.h>
+  #include <linux/hrtimer.h>
 diff --git a/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
-index 8f650a2..44b629f 100644
+index 8f650a2..bc056cd 100644
 --- a/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
 +++ b/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
-@@ -1,13 +1,13 @@
+@@ -1,15 +1,15 @@
  --- a/.local-symbols
  +++ b/.local-symbols
 -@@ -263,6 +263,7 @@ RT2X00_LIB_FIRMWARE=
-+@@ -312,6 +312,7 @@ RT2X00_LIB_FIRMWARE=
++@@ -329,6 +329,7 @@ RT2X00_LIB_FIRMWARE=
   RT2X00_LIB_CRYPTO=
   RT2X00_LIB_LEDS=
   RT2X00_LIB_DEBUGFS=
@@ -28878,16 +30170,44 @@ index 8f650a2..44b629f 100644
   RT2X00_DEBUG=
 - RTL_CARDS=
 - RTL8192CE=
-+ WL_MEDIATEK=
-+ MT7601U=
- --- a/drivers/net/wireless/rt2x00/Kconfig
- +++ b/drivers/net/wireless/rt2x00/Kconfig
+---- a/drivers/net/wireless/rt2x00/Kconfig
+-+++ b/drivers/net/wireless/rt2x00/Kconfig
++ WLAN_VENDOR_REALTEK=
++ RTL8180=
++--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
+++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
  @@ -69,6 +69,7 @@ config RT2800PCI
-@@ -48,7 +48,7 @@
+  	select RT2X00_LIB_MMIO
+  	select RT2X00_LIB_PCI
+@@ -26,7 +26,7 @@
+  	select RT2800_LIB
+  	select RT2800_LIB_MMIO
+  	---help---
+-@@ -266,6 +268,9 @@ config RT2X00_LIB_FIRMWARE
++@@ -265,6 +267,9 @@ config RT2X00_LIB_FIRMWARE
+  config RT2X00_LIB_CRYPTO
+  	bool
+  
+@@ -36,8 +36,8 @@
+  config RT2X00_LIB_LEDS
+  	bool
+  	default y if (RT2X00_LIB=y && LEDS_CLASS=y) || (RT2X00_LIB=m && LEDS_CLASS!=n)
+---- a/drivers/net/wireless/rt2x00/Makefile
+-+++ b/drivers/net/wireless/rt2x00/Makefile
++--- a/drivers/net/wireless/ralink/rt2x00/Makefile
+++++ b/drivers/net/wireless/ralink/rt2x00/Makefile
+ @@ -7,6 +7,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
+  rt2x00lib-$(CPTCFG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
+  rt2x00lib-$(CPTCFG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
+@@ -46,9 +46,9 @@
+  
+  obj-$(CPTCFG_RT2X00_LIB)		+= rt2x00lib.o
   obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
- --- a/drivers/net/wireless/rt2x00/rt2800lib.h
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.h
+---- a/drivers/net/wireless/rt2x00/rt2800lib.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
 -@@ -43,6 +43,8 @@ struct rt2800_drv_data {
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +@@ -46,6 +46,8 @@ struct rt2800_drv_data {
   	} shmem_lock;
   };
@@ -28901,37 +30221,235 @@ index 8f650a2..44b629f 100644
   {
   	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
   
+@@ -73,8 +73,8 @@
+  	return rt2800ops->read_eeprom(rt2x00dev);
+  }
+  
+---- a/drivers/net/wireless/rt2x00/rt2800soc.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+ @@ -102,19 +102,6 @@ static int rt2800soc_set_device_state(st
+  	return retval;
+  }
+@@ -103,9 +103,9 @@
+  	.hwcrypt_disabled	= rt2800soc_hwcrypt_disabled,
+  	.drv_write_firmware	= rt2800soc_write_firmware,
+  	.drv_init_registers	= rt2800mmio_init_registers,
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
+-@@ -695,6 +695,7 @@ enum rt2x00_capability_flags {
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -697,6 +697,7 @@ enum rt2x00_capability_flags {
+  	REQUIRE_HT_TX_DESC,
+  	REQUIRE_PS_AUTOWAKE,
+  	REQUIRE_DELAYED_RFKILL,
+@@ -113,7 +113,7 @@
+  
+  	/*
+  	 * Capabilities
+-@@ -964,6 +965,11 @@ struct rt2x00_dev {
++@@ -968,6 +969,11 @@ struct rt2x00_dev {
+  	const struct firmware *fw;
+  
+  	/*
+@@ -125,9 +125,9 @@
+  	 * FIFO for storing tx status reports between isr and tasklet.
+  	 */
+  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
+---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+-@@ -1334,6 +1334,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++@@ -1335,6 +1335,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
+  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
+  
+@@ -138,7 +138,7 @@
+  	/*
+  	 * Let the driver probe the device to detect the capabilities.
+  	 */
+-@@ -1474,6 +1478,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
++@@ -1475,6 +1479,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+  	 * Free the driver data.
+  	 */
+  	kfree(rt2x00dev->drv_data);
+@@ -151,7 +151,7 @@
+  EXPORT_SYMBOL_GPL(rt2x00lib_remove_dev);
+  
+ --- /dev/null
+-+++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+ @@ -0,0 +1,111 @@
+ +/*
+ +	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+@@ -264,8 +264,8 @@
+ +	release_firmware(rt2x00dev->eeprom_file);
+ +	rt2x00dev->eeprom_file = NULL;
+ +}
+---- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
+ @@ -320,6 +320,22 @@ static inline void rt2x00lib_free_firmwa
+  #endif /* CPTCFG_RT2X00_LIB_FIRMWARE */
+  
+@@ -289,8 +289,8 @@
+   * Debugfs handlers.
+   */
+  #ifdef CPTCFG_RT2X00_LIB_DEBUGFS
+---- a/drivers/net/wireless/rt2x00/rt2x00soc.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+ @@ -92,6 +92,7 @@ int rt2x00soc_probe(struct platform_devi
+  	rt2x00dev->hw = hw;
+  	rt2x00dev->irq = platform_get_irq(pdev, 0);
+diff --git a/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch
+index 4bc6f37..9dffef1 100644
+--- a/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch
++++ b/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2x00eeprom.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+ @@ -26,6 +26,7 @@
+  
+  #include <linux/kernel.h>
+diff --git a/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+index 75f0415..5dceff8 100644
+--- a/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
++++ b/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: load eeprom on SoC from a mtd device defines inside
+ 
+ Signed-off-by: John Crispin <blogic@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/Kconfig     |    1 +
+- drivers/net/wireless/rt2x00/rt2800pci.c |   44 ++++++++++++++++++++++++++-----
++ drivers/net/wireless/ralink/rt2x00/Kconfig     |    1 +
++ drivers/net/wireless/ralink/rt2x00/rt2800pci.c |   44 ++++++++++++++++++++++++++-----
+  2 files changed, 39 insertions(+), 6 deletions(-)
+ 
+---- a/drivers/net/wireless/rt2x00/Kconfig
+-+++ b/drivers/net/wireless/rt2x00/Kconfig
++--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
+++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
+ @@ -219,6 +219,7 @@ config RT2800SOC
+  	select RT2X00_LIB_EEPROM
+  	select RT2800_LIB
+@@ -20,8 +20,8 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
+  	---help---
+  	  This adds support for Ralink WiSoC devices.
+  	  Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
+---- a/drivers/net/wireless/rt2x00/rt2x00eeprom.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+ @@ -26,11 +26,66 @@
+  
+  #include <linux/kernel.h>
+@@ -79,7 +79,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
+ +	if (!ret) {
+ +		rt2x00dev->eeprom_file = &mtd_fw;
+ +		mtd_fw.size = len;
+-+		mtd_fw.data = rt2x00dev->eeprom;
+++		mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
+ +	}
+ +#endif
+ +
+diff --git a/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
+index 70f7b78..d923e05 100644
+--- a/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
++++ b/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
+@@ -10,8 +10,8 @@
+  };
+  
+  #endif /* _RT2X00_PLATFORM_H */
+---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+ @@ -940,6 +940,22 @@ static int rt2x00lib_probe_hw_modes(stru
+  	unsigned int num_rates;
+  	unsigned int i;
+@@ -35,9 +35,9 @@
+  	num_rates = 0;
+  	if (spec->supported_rates & SUPPORT_RATE_CCK)
+  		num_rates += 4;
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
+-@@ -403,6 +403,7 @@ struct hw_mode_spec {
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -405,6 +405,7 @@ struct hw_mode_spec {
+  	unsigned int supported_bands;
+  #define SUPPORT_BAND_2GHZ	0x00000001
+  #define SUPPORT_BAND_5GHZ	0x00000002
 diff --git a/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
-index a35bd55..16a579d 100644
+index a35bd55..a645ba1 100644
 --- a/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
 +++ b/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
-@@ -41,7 +41,7 @@
+@@ -8,8 +8,8 @@
+  
+  	int disable_2ghz;
+  	int disable_5ghz;
+---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+ @@ -931,6 +931,18 @@ static void rt2x00lib_rate(struct ieee80
+  		entry->flags |= IEEE80211_RATE_SHORT_PREAMBLE;
+  }
+@@ -29,9 +29,9 @@
+  static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
+  				    struct hw_mode_spec *spec)
+  {
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
+-@@ -1410,6 +1410,7 @@ static inline void rt2x00debug_dump_fram
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -1414,6 +1414,7 @@ static inline void rt2x00debug_dump_fram
+   */
+  u32 rt2x00lib_get_bssidx(struct rt2x00_dev *rt2x00dev,
+  			 struct ieee80211_vif *vif);
+@@ -39,8 +39,8 @@
+  
+  /*
    * Interrupt context handlers.
- --- a/drivers/net/wireless/rt2x00/rt61pci.c
- +++ b/drivers/net/wireless/rt2x00/rt61pci.c
--@@ -2392,6 +2392,7 @@ static int rt61pci_validate_eeprom(struc
-+@@ -2390,6 +2390,7 @@ static int rt61pci_validate_eeprom(struc
+---- a/drivers/net/wireless/rt2x00/rt61pci.c
+-+++ b/drivers/net/wireless/rt2x00/rt61pci.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+ @@ -2392,6 +2392,7 @@ static int rt61pci_validate_eeprom(struc
   	u32 reg;
   	u16 word;
-  	u8 *mac;
-@@ -49,7 +49,7 @@
-  	s8 value;
-  
-  	rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
--@@ -2412,7 +2413,11 @@ static int rt61pci_validate_eeprom(struc
-+@@ -2410,7 +2411,11 @@ static int rt61pci_validate_eeprom(struc
-  	/*
-  	 * Start validation of the data that has been read.
-  	 */
+diff --git a/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
+index 63a8641..3fdaae7 100644
+--- a/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
++++ b/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+ @@ -26,6 +26,7 @@
+  #include <linux/module.h>
+  #include <linux/slab.h>
 diff --git a/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch b/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
-index 067d2ea..39b1ccc 100644
+index 067d2ea..c69d330 100644
 --- a/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
 +++ b/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
 @@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -3552,11 +3552,18 @@ static void rt2800_config_channel(struct
-+@@ -3528,11 +3528,18 @@ static void rt2800_config_channel(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -3529,11 +3529,18 @@ static void rt2800_config_channel(struct
   	/*
   	 * Change BBP settings
   	 */
@@ -28940,7 +30458,7 @@ index 067d2ea..39b1ccc 100644
   		if (rf->channel > 14) {
   			/* Disable CCK Packet detection on 5GHz */
 -@@ -6618,6 +6625,12 @@ static void rt2800_init_rfcsr_3290(struc
-+@@ -6594,6 +6601,12 @@ static void rt2800_init_rfcsr_3290(struc
++@@ -6595,6 +6602,12 @@ static void rt2800_init_rfcsr_3290(struc
   
   static void rt2800_init_rfcsr_3352(struct rt2x00_dev *rt2x00dev)
   {
@@ -28949,7 +30467,7 @@ index 067d2ea..39b1ccc 100644
   
   	rt2800_rfcsr_write(rt2x00dev, 0, 0xf0);
 -@@ -6653,15 +6666,30 @@ static void rt2800_init_rfcsr_3352(struc
-+@@ -6629,15 +6642,30 @@ static void rt2800_init_rfcsr_3352(struc
++@@ -6630,15 +6643,30 @@ static void rt2800_init_rfcsr_3352(struc
   	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
   	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
   	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
@@ -28958,7 +30476,7 @@ index 067d2ea..39b1ccc 100644
   	rt2800_rfcsr_write(rt2x00dev, 44, 0xdb);
   	rt2800_rfcsr_write(rt2x00dev, 45, 0xdb);
 -@@ -6669,15 +6697,20 @@ static void rt2800_init_rfcsr_3352(struc
-+@@ -6645,15 +6673,20 @@ static void rt2800_init_rfcsr_3352(struc
++@@ -6646,15 +6674,20 @@ static void rt2800_init_rfcsr_3352(struc
   	rt2800_rfcsr_write(rt2x00dev, 47, 0x0d);
   	rt2800_rfcsr_write(rt2x00dev, 48, 0x14);
   	rt2800_rfcsr_write(rt2x00dev, 49, 0x00);
@@ -28967,7 +30485,7 @@ index 067d2ea..39b1ccc 100644
   	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
   	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
 -@@ -7698,6 +7731,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7674,6 +7707,7 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7675,6 +7708,7 @@ static int rt2800_init_eeprom(struct rt2
   	 * RT53xx: defined in "EEPROM_CHIP_ID" field
   	 */
   	if (rt2x00_rt(rt2x00dev, RT3290) ||
@@ -28976,7 +30494,7 @@ index 067d2ea..39b1ccc 100644
   	    rt2x00_rt(rt2x00dev, RT5392))
   		rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
 -@@ -7793,7 +7827,8 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7769,7 +7803,8 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7770,7 +7804,8 @@ static int rt2800_init_eeprom(struct rt2
   	/*
   	 * Detect if this device has Bluetooth co-existence.
   	 */
@@ -28985,19 +30503,45 @@ index 067d2ea..39b1ccc 100644
   
   	/*
 -@@ -7822,6 +7857,22 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7798,6 +7833,22 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7799,6 +7834,22 @@ static int rt2800_init_eeprom(struct rt2
   					EIRP_MAX_TX_POWER_LIMIT)
   		__set_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags);
   
+@@ -137,8 +137,8 @@
+  	return 0;
+  }
+  
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -2335,6 +2335,12 @@ struct mac_iveiv_entry {
+  #define RFCSR36_RF_BS			FIELD8(0x80)
+  
+@@ -198,9 +198,9 @@
+  
+  /*
+   * EEPROM frequency
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
+-@@ -715,6 +715,8 @@ enum rt2x00_capability_flags {
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -717,6 +717,8 @@ enum rt2x00_capability_flags {
+  	CAPABILITY_DOUBLE_ANTENNA,
+  	CAPABILITY_BT_COEXIST,
+  	CAPABILITY_VCO_RECALIBRATION,
 diff --git a/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch b/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
-index 1dcca36..dcecba4 100644
+index 1dcca36..b44fe90 100644
 --- a/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
 +++ b/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
 @@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -8209,6 +8209,27 @@ static const struct rf_channel rf_vals_5
-+@@ -8185,6 +8185,27 @@ static const struct rf_channel rf_vals_5
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -8186,6 +8186,27 @@ static const struct rf_channel rf_vals_5
   	{196, 83, 0, 12, 1},
   };
   
@@ -29006,7 +30550,7 @@ index 1dcca36..dcecba4 100644
   {
   	struct hw_mode_spec *spec = &rt2x00dev->spec;
 -@@ -8297,7 +8318,10 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8271,7 +8292,10 @@ static int rt2800_probe_hw_mode(struct r
++@@ -8272,7 +8293,10 @@ static int rt2800_probe_hw_mode(struct r
   	case RF5390:
   	case RF5392:
   		spec->num_channels = 14;
@@ -29015,7 +30559,7 @@ index 1dcca36..dcecba4 100644
   
   	case RF3052:
 -@@ -8481,6 +8505,19 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -8455,6 +8479,19 @@ static int rt2800_probe_rt(struct rt2x00
++@@ -8456,6 +8480,19 @@ static int rt2800_probe_rt(struct rt2x00
   	return 0;
   }
   
@@ -29024,33 +30568,94 @@ index 1dcca36..dcecba4 100644
   {
   	struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
 -@@ -8523,6 +8560,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -8497,6 +8534,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
++@@ -8498,6 +8535,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
   	rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
   
   	/*
+@@ -76,9 +76,9 @@
+  	 * Initialize hw specifications.
+  	 */
+  	retval = rt2800_probe_hw_mode(rt2x00dev);
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
+-@@ -398,6 +398,7 @@ static inline struct rt2x00_intf* vif_to
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++@@ -400,6 +400,7 @@ static inline struct rt2x00_intf* vif_to
+   * @channels: Device/chipset specific channel values (See &struct rf_channel).
+   * @channels_info: Additional information for channels (See &struct channel_info).
+   * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
+@@ -86,7 +86,7 @@
+   */
+  struct hw_mode_spec {
+  	unsigned int supported_bands;
+-@@ -414,6 +415,7 @@ struct hw_mode_spec {
++@@ -416,6 +417,7 @@ struct hw_mode_spec {
+  	const struct channel_info *channels_info;
+  
+  	struct ieee80211_sta_ht_cap ht;
+diff --git a/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+index 1970efc..e4b028b 100644
+--- a/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
++++ b/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+@@ -8,11 +8,11 @@ devicetree.
+ 
+ Signed-off-by: John Crispin <blogic@openwrt.org>
+ ---
+- drivers/net/wireless/rt2x00/rt2800pci.c |    7 +++++++
++ drivers/net/wireless/ralink/rt2x00/rt2800pci.c |    7 +++++++
+  1 file changed, 7 insertions(+)
+ 
+---- a/drivers/net/wireless/rt2x00/rt2800soc.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+ @@ -237,10 +237,17 @@ static int rt2800soc_probe(struct platfo
+  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
+  }
 diff --git a/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch b/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
-index c779a17..9f11862 100644
+index c779a17..8e3bd2a 100644
 --- a/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
 +++ b/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -36,6 +36,7 @@
+  #include <linux/kernel.h>
+  #include <linux/module.h>
 @@ -8,7 +8,7 @@
   
   #include "rt2x00.h"
   #include "rt2800lib.h"
 -@@ -8507,13 +8508,14 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -8481,13 +8482,14 @@ static int rt2800_probe_rt(struct rt2x00
++@@ -8482,13 +8483,14 @@ static int rt2800_probe_rt(struct rt2x00
   
   int rt2800_probe_clk(struct rt2x00_dev *rt2x00dev)
   {
 diff --git a/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch b/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
-index 840b3bc..9679d71 100644
+index 840b3bc..faa5879 100644
 --- a/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
 +++ b/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
-@@ -10,7 +10,7 @@
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -74,6 +74,7 @@
+  #define RF3070				0x3070
+  #define RF3290				0x3290
+@@ -8,9 +8,9 @@
+  #define RF5360				0x5360
+  #define RF5362				0x5362
   #define RF5370				0x5370
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -3038,6 +3038,13 @@ static void rt2800_config_channel_rf53xx
-+@@ -3014,6 +3014,13 @@ static void rt2800_config_channel_rf53xx
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -3015,6 +3015,13 @@ static void rt2800_config_channel_rf53xx
   
   				rt2800_rfcsr_write(rt2x00dev, 59,
   						   r59_non_bt[idx]);
@@ -29059,7 +30664,7 @@ index 840b3bc..9679d71 100644
   		}
   	}
 -@@ -3516,6 +3523,7 @@ static void rt2800_config_channel(struct
-+@@ -3492,6 +3499,7 @@ static void rt2800_config_channel(struct
++@@ -3493,6 +3500,7 @@ static void rt2800_config_channel(struct
   		rt2800_config_channel_rf3853(rt2x00dev, conf, rf, info);
   		break;
   	case RF3070:
@@ -29068,7 +30673,7 @@ index 840b3bc..9679d71 100644
   	case RF5362:
   	case RF5370:
 -@@ -3534,6 +3542,7 @@ static void rt2800_config_channel(struct
-+@@ -3510,6 +3518,7 @@ static void rt2800_config_channel(struct
++@@ -3511,6 +3519,7 @@ static void rt2800_config_channel(struct
   	if (rt2x00_rf(rt2x00dev, RF3070) ||
   	    rt2x00_rf(rt2x00dev, RF3290) ||
   	    rt2x00_rf(rt2x00dev, RF3322) ||
@@ -29077,7 +30682,7 @@ index 840b3bc..9679d71 100644
   	    rt2x00_rf(rt2x00dev, RF5362) ||
   	    rt2x00_rf(rt2x00dev, RF5370) ||
 -@@ -3812,7 +3821,8 @@ static void rt2800_config_channel(struct
-+@@ -3788,7 +3797,8 @@ static void rt2800_config_channel(struct
++@@ -3789,7 +3798,8 @@ static void rt2800_config_channel(struct
   	/*
   	 * Clear update flag
   	 */
@@ -29086,7 +30691,7 @@ index 840b3bc..9679d71 100644
   		rt2x00_set_field8(&bbp, BBP49_UPDATE_FLAG, 0);
   		rt2800_bbp_write(rt2x00dev, 49, bbp);
 -@@ -4698,6 +4708,7 @@ void rt2800_vco_calibration(struct rt2x0
-+@@ -4674,6 +4684,7 @@ void rt2800_vco_calibration(struct rt2x0
++@@ -4675,6 +4685,7 @@ void rt2800_vco_calibration(struct rt2x0
   	case RF3070:
   	case RF3290:
   	case RF3853:
@@ -29095,7 +30700,7 @@ index 840b3bc..9679d71 100644
   	case RF5362:
   	case RF5370:
 -@@ -5111,6 +5122,8 @@ static int rt2800_init_registers(struct
-+@@ -5087,6 +5098,8 @@ static int rt2800_init_registers(struct
++@@ -5088,6 +5099,8 @@ static int rt2800_init_registers(struct
   		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
   		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
   		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
@@ -29104,7 +30709,7 @@ index 840b3bc..9679d71 100644
   		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
   		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
 -@@ -5766,9 +5779,13 @@ static void rt2800_init_bbp_3352(struct
-+@@ -5742,9 +5755,13 @@ static void rt2800_init_bbp_3352(struct
++@@ -5743,9 +5756,13 @@ static void rt2800_init_bbp_3352(struct
   
   	rt2800_bbp_write(rt2x00dev, 82, 0x62);
   
@@ -29113,7 +30718,7 @@ index 840b3bc..9679d71 100644
   	rt2800_bbp_write(rt2x00dev, 86, 0x38);
   
 -@@ -5782,9 +5799,13 @@ static void rt2800_init_bbp_3352(struct
-+@@ -5758,9 +5775,13 @@ static void rt2800_init_bbp_3352(struct
++@@ -5759,9 +5776,13 @@ static void rt2800_init_bbp_3352(struct
   
   	rt2800_bbp_write(rt2x00dev, 104, 0x92);
   
@@ -29122,7 +30727,7 @@ index 840b3bc..9679d71 100644
   	rt2800_bbp_write(rt2x00dev, 120, 0x50);
   
 -@@ -5809,6 +5830,13 @@ static void rt2800_init_bbp_3352(struct
-+@@ -5785,6 +5806,13 @@ static void rt2800_init_bbp_3352(struct
++@@ -5786,6 +5807,13 @@ static void rt2800_init_bbp_3352(struct
   	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
   
   	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
@@ -29131,7 +30736,7 @@ index 840b3bc..9679d71 100644
   
   static void rt2800_init_bbp_3390(struct rt2x00_dev *rt2x00dev)
 -@@ -6150,6 +6178,7 @@ static void rt2800_init_bbp(struct rt2x0
-+@@ -6126,6 +6154,7 @@ static void rt2800_init_bbp(struct rt2x0
++@@ -6127,6 +6155,7 @@ static void rt2800_init_bbp(struct rt2x0
   		rt2800_init_bbp_3290(rt2x00dev);
   		break;
   	case RT3352:
@@ -29140,7 +30745,7 @@ index 840b3bc..9679d71 100644
   		break;
   	case RT3390:
 -@@ -7101,6 +7130,76 @@ static void rt2800_init_rfcsr_3883(struc
-+@@ -7077,6 +7106,76 @@ static void rt2800_init_rfcsr_3883(struc
++@@ -7078,6 +7107,76 @@ static void rt2800_init_rfcsr_3883(struc
   	rt2800_rfcsr_write(rt2x00dev, 20, rfcsr);
   }
   
@@ -29149,7 +30754,7 @@ index 840b3bc..9679d71 100644
   {
   	rt2800_rf_init_calibration(rt2x00dev, 2);
 -@@ -7341,6 +7440,9 @@ static void rt2800_init_rfcsr(struct rt2
-+@@ -7317,6 +7416,9 @@ static void rt2800_init_rfcsr(struct rt2
++@@ -7318,6 +7417,9 @@ static void rt2800_init_rfcsr(struct rt2
   	case RT3593:
   		rt2800_init_rfcsr_3593(rt2x00dev);
   		break;
@@ -29158,7 +30763,7 @@ index 840b3bc..9679d71 100644
   		rt2800_init_rfcsr_5390(rt2x00dev);
   		break;
 -@@ -7600,6 +7702,12 @@ static int rt2800_validate_eeprom(struct
-+@@ -7576,6 +7678,12 @@ static int rt2800_validate_eeprom(struct
++@@ -7577,6 +7679,12 @@ static int rt2800_validate_eeprom(struct
   		rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RF_TYPE, RF2820);
   		rt2800_eeprom_write(rt2x00dev, EEPROM_NIC_CONF0, word);
   		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
@@ -29167,7 +30772,7 @@ index 840b3bc..9679d71 100644
   		   rt2x00_rt(rt2x00dev, RT2872)) {
   		/*
 -@@ -7738,6 +7846,8 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7714,6 +7822,8 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7715,6 +7823,8 @@ static int rt2800_init_eeprom(struct rt2
   		rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
   	else if (rt2x00_rt(rt2x00dev, RT3883))
   		rf = RF3853;
@@ -29176,7 +30781,7 @@ index 840b3bc..9679d71 100644
   		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
   
 -@@ -7757,6 +7867,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7733,6 +7843,7 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7734,6 +7844,7 @@ static int rt2800_init_eeprom(struct rt2
   	case RF3320:
   	case RF3322:
   	case RF3853:
@@ -29185,7 +30790,7 @@ index 840b3bc..9679d71 100644
   	case RF5362:
   	case RF5370:
 -@@ -8312,6 +8423,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8286,6 +8397,7 @@ static int rt2800_probe_hw_mode(struct r
++@@ -8287,6 +8398,7 @@ static int rt2800_probe_hw_mode(struct r
   	case RF3290:
   	case RF3320:
   	case RF3322:
@@ -29194,7 +30799,7 @@ index 840b3bc..9679d71 100644
   	case RF5362:
   	case RF5370:
 -@@ -8451,6 +8563,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8425,6 +8537,7 @@ static int rt2800_probe_hw_mode(struct r
++@@ -8426,6 +8538,7 @@ static int rt2800_probe_hw_mode(struct r
   	case RF3070:
   	case RF3290:
   	case RF3853:
@@ -29203,76 +30808,315 @@ index 840b3bc..9679d71 100644
   	case RF5362:
   	case RF5370:
 -@@ -8491,6 +8604,7 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -8465,6 +8578,7 @@ static int rt2800_probe_rt(struct rt2x00
++@@ -8466,6 +8579,7 @@ static int rt2800_probe_rt(struct rt2x00
   	case RT3572:
   	case RT3593:
   	case RT3883:
+@@ -264,8 +264,8 @@
+  	case RT5390:
+  	case RT5392:
+  	case RT5592:
+---- a/drivers/net/wireless/rt2x00/rt2x00.h
+-+++ b/drivers/net/wireless/rt2x00/rt2x00.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+ @@ -169,6 +169,7 @@ struct rt2x00_chip {
+  #define RT3572		0x3572
+  #define RT3593		0x3593
 diff --git a/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch
-index 13f2048..b085c5e 100644
+index 13f2048..6094a61 100644
 --- a/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch
 +++ b/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -37,6 +37,7 @@
+  #include <linux/module.h>
+  #include <linux/slab.h>
 @@ -8,7 +8,7 @@
   
   #include "rt2x00.h"
   #include "rt2800lib.h"
 -@@ -7957,6 +7958,17 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7933,6 +7934,17 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7934,6 +7935,17 @@ static int rt2800_init_eeprom(struct rt2
   	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
   	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
   
+@@ -26,8 +26,8 @@
+  	rt2x00dev->led_mcu_reg = eeprom;
+  #endif /* CPTCFG_RT2X00_LIB_LEDS */
+  
+---- a/drivers/net/wireless/rt2x00/rt2x00leds.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00leds.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00leds.c
+ @@ -109,6 +109,9 @@ static int rt2x00leds_register_led(struc
+  	led->led_dev.name = name;
+  	led->led_dev.brightness = LED_OFF;
+diff --git a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
+index 2dbfd10..55452b9 100644
+--- a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
++++ b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
+@@ -1,6 +1,6 @@
+---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+-@@ -1283,7 +1283,7 @@ static inline void rt2x00lib_set_if_comb
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++@@ -1284,7 +1284,7 @@ static inline void rt2x00lib_set_if_comb
+  	 */
+  	if_limit = &rt2x00dev->if_limits_ap;
+  	if_limit->max = rt2x00dev->ops->max_ap_intf;
 diff --git a/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch b/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch
-index aaa8367..259cb1f 100644
+index aaa8367..8ddf425 100644
 --- a/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch
 +++ b/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch
 @@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -7841,10 +7841,11 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7817,10 +7817,11 @@ static int rt2800_init_eeprom(struct rt2
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -7818,10 +7818,11 @@ static int rt2800_init_eeprom(struct rt2
   	 * RT53xx: defined in "EEPROM_CHIP_ID" field
   	 */
   	if (rt2x00_rt(rt2x00dev, RT3290) ||
 diff --git a/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch b/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
-index bb2fc1c..77d63fe 100644
+index bb2fc1c..e3e4c98 100644
 --- a/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
 +++ b/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
-@@ -11,7 +11,7 @@
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -2321,6 +2321,8 @@ struct mac_iveiv_entry {
+  #define RFCSR30_RX_H20M			FIELD8(0x04)
+  #define RFCSR30_RX_VCM			FIELD8(0x18)
+@@ -9,9 +9,9 @@
+  
+  /*
    * RFCSR 31:
- --- a/drivers/net/wireless/rt2x00/rt2800lib.c
- +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 -@@ -3551,8 +3551,13 @@ static void rt2800_config_channel(struct
-+@@ -3527,8 +3527,13 @@ static void rt2800_config_channel(struct
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++@@ -3528,8 +3528,13 @@ static void rt2800_config_channel(struct
   	    rt2x00_rf(rt2x00dev, RF5390) ||
   	    rt2x00_rf(rt2x00dev, RF5392)) {
   		rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
+diff --git a/package/kernel/mac80211/patches/622-rt2x00-fix-beacon-bit-balance.patch b/package/kernel/mac80211/patches/622-rt2x00-fix-beacon-bit-balance.patch
+new file mode 100644
+index 0000000..3cf6268
+--- /dev/null
++++ b/package/kernel/mac80211/patches/622-rt2x00-fix-beacon-bit-balance.patch
+@@ -0,0 +1,47 @@
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++@@ -627,12 +627,8 @@ void rt2x00mac_bss_info_changed(struct i
++ 		} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
++ 			rt2x00dev->intf_beaconing++;
++ 			intf->enable_beacon = true;
++-			/*
++-			 * Upload beacon to the H/W. This is only required on
++-			 * USB devices. PCI devices fetch beacons periodically.
++-			 */
++-			if (rt2x00_is_usb(rt2x00dev))
++-				rt2x00queue_update_beacon(rt2x00dev, vif);
+++
+++			rt2x00queue_update_beacon(rt2x00dev, vif);
++ 
++ 			if (rt2x00dev->intf_beaconing == 1) {
++ 				/*
++--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++@@ -144,7 +144,8 @@ static void rt2x00lib_intf_scheduled_ite
++ 
++ 	if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags)) {
++ 		mutex_lock(&intf->beacon_skb_mutex);
++-		rt2x00queue_update_beacon(rt2x00dev, vif);
+++		if (intf->enable_beacon)
+++			rt2x00queue_update_beacon(rt2x00dev, vif);
++ 		mutex_unlock(&intf->beacon_skb_mutex);
++ 	}
++ }
++@@ -207,6 +208,7 @@ static void rt2x00lib_beaconupdate_iter(
++ 					struct ieee80211_vif *vif)
++ {
++ 	struct rt2x00_dev *rt2x00dev = data;
+++	struct rt2x00_intf *intf = vif_to_intf(vif);
++ 
++ 	if (vif->type != NL80211_IFTYPE_AP &&
++ 	    vif->type != NL80211_IFTYPE_ADHOC &&
++@@ -220,7 +222,8 @@ static void rt2x00lib_beaconupdate_iter(
++ 	 * never be called for USB devices.
++ 	 */
++ 	WARN_ON(rt2x00_is_usb(rt2x00dev));
++-	rt2x00queue_update_beacon(rt2x00dev, vif);
+++	if (intf->enable_beacon)
+++		rt2x00queue_update_beacon(rt2x00dev, vif);
++ }
++ 
++ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
+diff --git a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+index f2a7663..a901a44 100644
+--- a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
++++ b/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+@@ -1,6 +1,6 @@
+---- a/drivers/net/wireless/mwl8k.c
+-+++ b/drivers/net/wireless/mwl8k.c
+-@@ -5678,6 +5678,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
++--- a/drivers/net/wireless/marvell/mwl8k.c
+++++ b/drivers/net/wireless/marvell/mwl8k.c
++@@ -5681,6 +5681,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
+  
+  static const struct pci_device_id mwl8k_pci_id_table[] = {
 diff --git a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
-index 9e29034..3b8b756 100644
+index 9e29034..fd885cc 100644
 --- a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
 +++ b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/libertas/cfg.c
- +++ b/drivers/net/wireless/libertas/cfg.c
--@@ -2084,6 +2084,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
-+@@ -2083,6 +2083,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/libertas/cfg.c
+-+++ b/drivers/net/wireless/libertas/cfg.c
++--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++++ b/drivers/net/wireless/marvell/libertas/cfg.c
+ @@ -2084,6 +2084,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
   		goto err_wiphy_new;
   	}
+@@ -9,8 +9,8 @@
+  	lbs_deb_leave(LBS_DEB_CFG80211);
+  	return wdev;
   
+---- a/drivers/net/wireless/libertas/main.c
+-+++ b/drivers/net/wireless/libertas/main.c
++--- a/drivers/net/wireless/marvell/libertas/main.c
+++++ b/drivers/net/wireless/marvell/libertas/main.c
+ @@ -987,6 +987,7 @@ struct lbs_private *lbs_add_card(void *c
+  		goto err_adapter;
+  	}
 diff --git a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
-index 252fa81..dace56b 100644
+index 252fa81..b67a95f 100644
 --- a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
 +++ b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/libertas/cfg.c
- +++ b/drivers/net/wireless/libertas/cfg.c
--@@ -2174,6 +2174,8 @@ int lbs_cfg_register(struct lbs_private
-+@@ -2173,6 +2173,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/libertas/cfg.c
+-+++ b/drivers/net/wireless/libertas/cfg.c
++--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++++ b/drivers/net/wireless/marvell/libertas/cfg.c
+ @@ -2174,6 +2174,8 @@ int lbs_cfg_register(struct lbs_private
   	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
   	wdev->wiphy->reg_notifier = lbs_reg_notifier;
+diff --git a/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch b/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch
+new file mode 100644
+index 0000000..74cd448
+--- /dev/null
++++ b/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch
+@@ -0,0 +1,17 @@
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
++@@ -1215,10 +1215,10 @@ void b43_wireless_core_phy_pll_reset(str
++ 	case B43_BUS_BCMA:
++ 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
++ 
++-		bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
++-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
++-		bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
++-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
+++		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
+++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
+++		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
+++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
++ 		break;
++ #endif
++ #ifdef CPTCFG_B43_SSB
+diff --git a/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch b/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
+index 95867ef..fd9e6fd 100644
+--- a/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
++++ b/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/b43/b43.h
+-+++ b/drivers/net/wireless/b43/b43.h
++--- a/drivers/net/wireless/broadcom/b43/b43.h
+++++ b/drivers/net/wireless/broadcom/b43/b43.h
+ @@ -839,6 +839,7 @@ struct b43_wldev {
+  	bool qos_enabled;		/* TRUE, if QoS is used. */
+  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
+@@ -8,9 +8,9 @@
+  
+  	/* PHY/Radio device. */
+  	struct b43_phy phy;
+---- a/drivers/net/wireless/b43/main.c
+-+++ b/drivers/net/wireless/b43/main.c
+-@@ -76,6 +76,11 @@ MODULE_FIRMWARE("b43/ucode16_mimo.fw");
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
++@@ -75,6 +75,11 @@ MODULE_FIRMWARE("b43/ucode16_mimo.fw");
+  MODULE_FIRMWARE("b43/ucode5.fw");
+  MODULE_FIRMWARE("b43/ucode9.fw");
+  
+diff --git a/package/kernel/mac80211/patches/810-b43_no_pio.patch b/package/kernel/mac80211/patches/810-b43_no_pio.patch
+index 0979100..79428c2 100644
+--- a/package/kernel/mac80211/patches/810-b43_no_pio.patch
++++ b/package/kernel/mac80211/patches/810-b43_no_pio.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/b43/Makefile
+-+++ b/drivers/net/wireless/b43/Makefile
++--- a/drivers/net/wireless/broadcom/b43/Makefile
+++++ b/drivers/net/wireless/broadcom/b43/Makefile
+ @@ -17,7 +17,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
+  b43-y				+= sysfs.o
+  b43-y				+= xmit.o
+@@ -9,8 +9,8 @@
+  b43-y				+= rfkill.o
+  b43-y				+= ppr.o
+  b43-$(CPTCFG_B43_LEDS)		+= leds.o
+---- a/drivers/net/wireless/b43/main.c
+-+++ b/drivers/net/wireless/b43/main.c
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
+ @@ -2008,10 +2008,12 @@ static void b43_do_interrupt_thread(stru
+  			dma_reason[0], dma_reason[1],
+  			dma_reason[2], dma_reason[3],
+@@ -24,8 +24,8 @@
+  		b43_controller_restart(dev, "DMA error");
+  		return;
+  	}
+---- a/drivers/net/wireless/b43/pio.h
+-+++ b/drivers/net/wireless/b43/pio.h
++--- a/drivers/net/wireless/broadcom/b43/pio.h
+++++ b/drivers/net/wireless/broadcom/b43/pio.h
+ @@ -150,7 +150,7 @@ static inline void b43_piorx_write32(str
+  	b43_write32(q->dev, q->mmio_base + offset, value);
+  }
+@@ -73,9 +73,9 @@
+ +#endif /* CPTCFG_B43_PIO */
+  
+  #endif /* B43_PIO_H_ */
+---- a/drivers/net/wireless/b43/Kconfig
+-+++ b/drivers/net/wireless/b43/Kconfig
+-@@ -118,7 +118,7 @@ config B43_BCMA_PIO
++--- a/drivers/net/wireless/broadcom/b43/Kconfig
+++++ b/drivers/net/wireless/broadcom/b43/Kconfig
++@@ -98,7 +98,7 @@ config B43_BCMA_PIO
+  	default y
   
+  config B43_PIO
 diff --git a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
-index ac58dba..dd82ce5 100644
+index ac58dba..06c731f 100644
 --- a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
 +++ b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/b43/main.c
+-+++ b/drivers/net/wireless/b43/main.c
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
+ @@ -1648,7 +1648,7 @@ static void b43_write_beacon_template(st
+  				  len, ram_offset, shm_size_offset, rate);
+  
 @@ -9,7 +9,7 @@
   	antenna = b43_antenna_to_phyctl(antenna);
   	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
@@ -29336,46 +31180,270 @@ index ac58dba..dd82ce5 100644
   
   	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
   
+@@ -118,8 +118,8 @@
+  	wl->hw_registred = false;
+  	hw->max_rates = 2;
+  	SET_IEEE80211_DEV(hw, dev->dev);
+---- a/drivers/net/wireless/b43/b43.h
+-+++ b/drivers/net/wireless/b43/b43.h
++--- a/drivers/net/wireless/broadcom/b43/b43.h
+++++ b/drivers/net/wireless/broadcom/b43/b43.h
+ @@ -840,6 +840,8 @@ struct b43_wldev {
+  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
+  	bool use_pio;			/* TRUE if next init should use PIO */
+diff --git a/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch b/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch
+index 9c51ac6..5899706 100644
+--- a/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch
++++ b/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/b43/dma.h
+-+++ b/drivers/net/wireless/b43/dma.h
++--- a/drivers/net/wireless/broadcom/b43/dma.h
+++++ b/drivers/net/wireless/broadcom/b43/dma.h
+ @@ -169,7 +169,7 @@ struct b43_dmadesc_generic {
+  
+  /* DMA engine tuning knobs */
+diff --git a/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch b/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
+index d4f9a88..8d0c041 100644
+--- a/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
++++ b/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/b43/main.c
+-+++ b/drivers/net/wireless/b43/main.c
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
+ @@ -2899,6 +2899,14 @@ static int b43_gpio_init(struct b43_wlde
+  	} else if (dev->dev->chip_id == 0x5354) {
+  		/* Don't allow overtaking buttons GPIOs */
+diff --git a/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch
+index 9d1d419..ef7f3c9 100644
+--- a/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch
++++ b/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch
+@@ -1,6 +1,6 @@
+---- a/drivers/net/wireless/b43/main.c
+-+++ b/drivers/net/wireless/b43/main.c
+-@@ -118,7 +118,7 @@ static int b43_modparam_pio = 0;
++--- a/drivers/net/wireless/broadcom/b43/main.c
+++++ b/drivers/net/wireless/broadcom/b43/main.c
++@@ -117,7 +117,7 @@ static int b43_modparam_pio = 0;
+  module_param_named(pio, b43_modparam_pio, int, 0644);
+  MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
+  
+diff --git a/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch b/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
+index 185c427..3c93386 100644
+--- a/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
++++ b/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+-+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/channel.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/channel.c
+ @@ -58,19 +58,12 @@
+  				 (((c) < 149) ? 3 : 4))))
+  
 diff --git a/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch b/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch
-index 44bb779..dbfb158 100644
+deleted file mode 100644
+index 44bb779..0000000
 --- a/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch
-+++ b/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch
-@@ -69,9 +69,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  	}
- --- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
- +++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
++++ /dev/null
+@@ -1,80 +0,0 @@
+-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+-Date: Mon, 8 Jun 2015 16:59:31 +0200
+-Subject: [PATCH] brcmfmac: use bcm47xx platform NVRAM as fallback
+-MIME-Version: 1.0
+-Content-Type: text/plain; charset=UTF-8
+-Content-Transfer-Encoding: 8bit
+-
+-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+----
+-
+---- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+-+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+-@@ -19,6 +19,9 @@
+- #include <linux/device.h>
+- #include <linux/firmware.h>
+- #include <linux/module.h>
+-+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
+-+#include <linux/bcm47xx_nvram.h>
+-+#endif
+- 
+- #include "debug.h"
+- #include "firmware.h"
+-@@ -424,17 +427,42 @@ struct brcmf_fw {
+- static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+- {
+- 	struct brcmf_fw *fwctx = ctx;
+-+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
+-+	const u8 *bcm47xx_nvram = NULL;
+-+	size_t bcm47xx_nvram_len;
+-+#endif
+-+	const u8 *data = NULL;
+-+	size_t data_len;
+- 	u32 nvram_length = 0;
+- 	void *nvram = NULL;
+- 
+- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
+--	if (!fw && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+-+	if (fw) {
+-+		data = fw->data;
+-+		data_len = fw->size;
+-+	}
+-+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
+-+	else {
+-+		bcm47xx_nvram = bcm47xx_nvram_get_contents(&bcm47xx_nvram_len);
+-+		if (bcm47xx_nvram) {
+-+			data = bcm47xx_nvram;
+-+			data_len = bcm47xx_nvram_len;
+-+			brcmf_err("Found platform NVRAM (%zu B)\n", data_len);
+-+		}
+-+	}
+-+#endif
+-+	if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+- 		goto fail;
+- 
+--	if (fw) {
+--		nvram = brcmf_fw_nvram_strip(fw->data, fw->size, &nvram_length,
+-+	if (data) {
+-+		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
+- 					     fwctx->domain_nr, fwctx->bus_nr);
+--		release_firmware(fw);
+-+		if (fw)
+-+			release_firmware(fw);
+-+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
+-+		if (bcm47xx_nvram)
+-+			bcm47xx_nvram_release_contents(bcm47xx_nvram);
+-+#endif
+- 		if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+- 			goto fail;
+- 	}
+---- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
+-+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
 -@@ -19,6 +19,8 @@
 - 
 - #include <linux/net.h>	/* net_ratelimit() */
-+@@ -17,6 +17,8 @@
-+ #ifndef BRCMFMAC_DEBUG_H
-+ #define BRCMFMAC_DEBUG_H
-  
- +#include <linux/net.h>
- +
+- 
+-+#include <linux/net.h>
+-+
+- /* message levels */
+- #define BRCMF_TRACE_VAL		0x00000002
+- #define BRCMF_INFO_VAL		0x00000004
 diff --git a/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch
-index 14f8a00..685a5f9 100644
+index 14f8a00..95d93ae 100644
 --- a/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch
 +++ b/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch
-@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+@@ -11,9 +11,9 @@ module loads successfully.
+ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+ ---
  
- --- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
- +++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
+---- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+-+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
 -@@ -1226,6 +1226,7 @@ static int __init brcmfmac_module_init(v
-+@@ -1213,6 +1213,7 @@ static int __init brcmfmac_module_init(v
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++@@ -1332,6 +1332,7 @@ static int __init brcmfmac_module_init(v
   #endif
   	if (!schedule_work(&brcmf_driver_work))
   		return -EBUSY;
+@@ -21,9 +21,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  
+  	return 0;
+  }
+---- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+-+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+-@@ -422,13 +422,14 @@ struct brcmf_fw {
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++@@ -418,6 +418,7 @@ struct brcmf_fw {
+  	u16 bus_nr;
+  	void (*done)(struct device *dev, const struct firmware *fw,
+  		     void *nvram_image, u32 nvram_len);
+@@ -31,16 +31,8 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  };
+  
+  static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+- {
+- 	struct brcmf_fw *fwctx = ctx;
+- #if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
+--	const u8 *bcm47xx_nvram = NULL;
+-+	u8 *bcm47xx_nvram = NULL;
+- 	size_t bcm47xx_nvram_len;
+- #endif
+- 	const u8 *data = NULL;
+-@@ -468,6 +469,8 @@ static void brcmf_fw_request_nvram_done(
+- 	}
++@@ -452,6 +453,8 @@ static void brcmf_fw_request_nvram_done(
++ 		goto fail;
+  
+  	fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
+ +	if (fwctx->completion)
+@@ -48,7 +40,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  	kfree(fwctx);
+  	return;
+  
+-@@ -475,6 +478,8 @@ fail:
++@@ -459,6 +462,8 @@ fail:
+  	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+  	release_firmware(fwctx->code);
+  	device_release_driver(fwctx->dev);
+@@ -57,7 +49,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  	kfree(fwctx);
+  }
+  
+-@@ -490,6 +495,8 @@ static void brcmf_fw_request_code_done(c
++@@ -474,6 +479,8 @@ static void brcmf_fw_request_code_done(c
+  	/* only requested code so done here */
+  	if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
+  		fwctx->done(fwctx->dev, fw, NULL, 0);
+@@ -66,16 +58,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  		kfree(fwctx);
+  		return;
+  	}
+-@@ -504,6 +511,8 @@ static void brcmf_fw_request_code_done(c
+- 	/* when nvram is optional call .done() callback here */
+- 	if (fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL) {
+- 		fwctx->done(fwctx->dev, fw, NULL, 0);
+-+		if (fwctx->completion)
+-+			complete(fwctx->completion);
+- 		kfree(fwctx);
+- 		return;
+- 	}
+-@@ -513,6 +522,8 @@ static void brcmf_fw_request_code_done(c
++@@ -491,6 +498,8 @@ static void brcmf_fw_request_code_done(c
+  fail:
+  	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+  	device_release_driver(fwctx->dev);
+@@ -84,7 +67,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  	kfree(fwctx);
+  }
+  
+-@@ -524,6 +535,8 @@ int brcmf_fw_get_firmwares_pcie(struct d
++@@ -502,6 +511,8 @@ int brcmf_fw_get_firmwares_pcie(struct d
+  				u16 domain_nr, u16 bus_nr)
+  {
+  	struct brcmf_fw *fwctx;
+@@ -93,7 +76,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+  
+  	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
+  	if (!fw_cb || !code)
+-@@ -544,9 +557,17 @@ int brcmf_fw_get_firmwares_pcie(struct d
++@@ -522,9 +533,17 @@ int brcmf_fw_get_firmwares_pcie(struct d
+  	fwctx->domain_nr = domain_nr;
+  	fwctx->bus_nr = bus_nr;
+  
 diff --git a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
-index 32c4a6f..5fdfa37 100644
+index 32c4a6f..9aeb97e 100644
 --- a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
 +++ b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
-@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+@@ -8,9 +8,9 @@ Content-Transfer-Encoding: 8bit
+ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+ ---
  
- --- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
- +++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+---- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+-+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
 -@@ -608,9 +608,37 @@ static struct wireless_dev *brcmf_cfg802
-+@@ -692,9 +692,37 @@ static struct wireless_dev *brcmf_cfg802
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++@@ -618,9 +618,37 @@ static struct wireless_dev *brcmf_cfg802
   						     u32 *flags,
   						     struct vif_params *params)
   {
@@ -29595,16 +31663,67 @@ index 856dea8..0000000
 - 	kfree(glue);
 - }
 - 
+diff --git a/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch b/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch
+index e6b2d7b..bc9f799 100644
+--- a/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch
++++ b/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/Kconfig
+-+++ b/drivers/net/wireless/rt2x00/Kconfig
++--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
+++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
+ @@ -211,7 +211,7 @@ endif
+  config RT2800SOC
+  	tristate "Ralink WiSoC support"
 diff --git a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
-index 501910f..b0536ce 100644
+index 501910f..f2e21ea 100644
 --- a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
 +++ b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
+@@ -1,5 +1,5 @@
+---- a/drivers/net/wireless/rt2x00/rt2800.h
+-+++ b/drivers/net/wireless/rt2x00/rt2800.h
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+ @@ -81,6 +81,7 @@
+  #define RF5372				0x5372
+  #define RF5390				0x5390
+@@ -62,8 +62,8 @@
+  /* TX_PWR_CFG_7 */
+  #define TX_PWR_CFG_7			0x13d4
+  #define TX_PWR_CFG_7_OFDM54_CH0		FIELD32(0x0000000f)
+---- a/drivers/net/wireless/rt2x00/rt2800lib.c
+-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
++--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+ @@ -61,6 +61,8 @@
+  	rt2800_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
+  #define WAIT_FOR_RFCSR(__dev, __reg) \
+@@ -91,7 +91,8 @@
+ +			rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM_MT7620, word);
+ +			rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE_MT7620, 1);
+ +			rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY_MT7620, 1);
+-+
++ 
++-		rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+ +			rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+ +		}
+ +		break;
+@@ -103,8 +104,7 @@
+ +			rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+ +			rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 1);
+ +			rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+- 
+--		rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+++
+ +			rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
+ +		}
+ +		break;
 @@ -210,7 +210,7 @@
   	case RT5592:
   		*txwi_size = TXWI_DESC_SIZE_5WORDS;
   		*rxwi_size = RXWI_DESC_SIZE_6WORDS;
 -@@ -3326,6 +3399,312 @@ static void rt2800_config_channel_rf55xx
-+@@ -3302,6 +3375,312 @@ static void rt2800_config_channel_rf55xx
++@@ -3303,6 +3376,312 @@ static void rt2800_config_channel_rf55xx
   	rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x19 : 0x7F);
   }
   
@@ -29629,7 +31748,7 @@ index 501910f..b0536ce 100644
   					   const unsigned int word,
   					   const u8 value)
 -@@ -3482,7 +3861,7 @@ static void rt2800_config_channel(struct
-+@@ -3458,7 +3837,7 @@ static void rt2800_config_channel(struct
++@@ -3459,7 +3838,7 @@ static void rt2800_config_channel(struct
   				  struct channel_info *info)
   {
   	u32 reg;
@@ -29638,7 +31757,7 @@ index 501910f..b0536ce 100644
   
   	info->default_power1 = rt2800_txpower_to_dev(rt2x00dev, rf->channel,
 -@@ -3536,6 +3915,9 @@ static void rt2800_config_channel(struct
-+@@ -3512,6 +3891,9 @@ static void rt2800_config_channel(struct
++@@ -3513,6 +3892,9 @@ static void rt2800_config_channel(struct
   	case RF5592:
   		rt2800_config_channel_rf55xx(rt2x00dev, conf, rf, info);
   		break;
@@ -29647,7 +31766,7 @@ index 501910f..b0536ce 100644
   		rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
   	}
 -@@ -3638,7 +4020,7 @@ static void rt2800_config_channel(struct
-+@@ -3614,7 +3996,7 @@ static void rt2800_config_channel(struct
++@@ -3615,7 +3997,7 @@ static void rt2800_config_channel(struct
   		else if (rt2x00_rt(rt2x00dev, RT3593) ||
   			 rt2x00_rt(rt2x00dev, RT3883))
   			rt2800_bbp_write(rt2x00dev, 82, 0x82);
@@ -29656,7 +31775,7 @@ index 501910f..b0536ce 100644
   
   		if (rt2x00_rt(rt2x00dev, RT3593) ||
 -@@ -3660,7 +4042,7 @@ static void rt2800_config_channel(struct
-+@@ -3636,7 +4018,7 @@ static void rt2800_config_channel(struct
++@@ -3637,7 +4019,7 @@ static void rt2800_config_channel(struct
   	if (rt2x00_rt(rt2x00dev, RT3572))
   		rt2800_rfcsr_write(rt2x00dev, 8, 0);
   
@@ -29665,7 +31784,7 @@ index 501910f..b0536ce 100644
   	switch (rt2x00dev->default_ant.tx_chain_num) {
   	case 3:
 -@@ -3709,6 +4091,7 @@ static void rt2800_config_channel(struct
-+@@ -3685,6 +4067,7 @@ static void rt2800_config_channel(struct
++@@ -3686,6 +4068,7 @@ static void rt2800_config_channel(struct
   
   	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
   	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
@@ -29674,7 +31793,7 @@ index 501910f..b0536ce 100644
   	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
   
 -@@ -4725,6 +5108,14 @@ void rt2800_vco_calibration(struct rt2x0
-+@@ -4701,6 +5084,14 @@ void rt2800_vco_calibration(struct rt2x0
++@@ -4702,6 +5085,14 @@ void rt2800_vco_calibration(struct rt2x0
   		rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
   		rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
   		break;
@@ -29683,7 +31802,7 @@ index 501910f..b0536ce 100644
   		return;
   	}
 -@@ -5125,9 +5516,42 @@ static int rt2800_init_registers(struct
-+@@ -5101,9 +5492,42 @@ static int rt2800_init_registers(struct
++@@ -5102,9 +5493,42 @@ static int rt2800_init_registers(struct
   	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
   		   rt2x00_rt(rt2x00dev, RT5392) ||
   		   rt2x00_rt(rt2x00dev, RT5592)) {
@@ -29692,7 +31811,7 @@ index 501910f..b0536ce 100644
   		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
   	} else {
 -@@ -6159,6 +6583,225 @@ static void rt2800_init_bbp_5592(struct
-+@@ -6135,6 +6559,225 @@ static void rt2800_init_bbp_5592(struct
++@@ -6136,6 +6560,225 @@ static void rt2800_init_bbp_5592(struct
   		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
   }
   
@@ -29701,7 +31820,7 @@ index 501910f..b0536ce 100644
   {
   	unsigned int i;
 -@@ -6201,7 +6844,10 @@ static void rt2800_init_bbp(struct rt2x0
-+@@ -6177,7 +6820,10 @@ static void rt2800_init_bbp(struct rt2x0
++@@ -6178,7 +6821,10 @@ static void rt2800_init_bbp(struct rt2x0
   		return;
   	case RT5390:
   	case RT5392:
@@ -29710,7 +31829,7 @@ index 501910f..b0536ce 100644
   	case RT5592:
   		rt2800_init_bbp_5592(rt2x00dev);
 -@@ -7415,6 +8061,295 @@ static void rt2800_init_rfcsr_5592(struc
-+@@ -7391,6 +8037,296 @@ static void rt2800_init_rfcsr_5592(struc
++@@ -7392,6 +8038,296 @@ static void rt2800_init_rfcsr_5592(struc
   	rt2800_led_open_drain_enable(rt2x00dev);
   }
   
@@ -29736,7 +31855,7 @@ index 501910f..b0536ce 100644
   {
   	if (rt2800_is_305x_soc(rt2x00dev)) {
 -@@ -7450,7 +8385,10 @@ static void rt2800_init_rfcsr(struct rt2
-+@@ -7426,7 +8362,10 @@ static void rt2800_init_rfcsr(struct rt2
++@@ -7427,7 +8363,10 @@ static void rt2800_init_rfcsr(struct rt2
   		rt2800_init_rfcsr_5350(rt2x00dev);
   		break;
   	case RT5390:
@@ -29745,7 +31864,7 @@ index 501910f..b0536ce 100644
   	case RT5392:
   		rt2800_init_rfcsr_5392(rt2x00dev);
 -@@ -7882,6 +8820,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7858,6 +8797,7 @@ static int rt2800_init_eeprom(struct rt2
++@@ -7859,6 +8798,7 @@ static int rt2800_init_eeprom(struct rt2
   	case RF5390:
   	case RF5392:
   	case RF5592:
@@ -29754,7 +31873,7 @@ index 501910f..b0536ce 100644
   	default:
   		rt2x00_err(rt2x00dev, "Invalid RF chipset 0x%04x detected\n",
 -@@ -8448,6 +9387,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8422,6 +9362,7 @@ static int rt2800_probe_hw_mode(struct r
++@@ -8423,6 +9363,7 @@ static int rt2800_probe_hw_mode(struct r
   	case RF5372:
   	case RF5390:
   	case RF5392:
@@ -29763,7 +31882,7 @@ index 501910f..b0536ce 100644
   		if (spec->clk_is_20mhz)
   			spec->channels = rf_vals_xtal20mhz_3x;
 -@@ -8588,6 +9528,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8562,6 +9503,7 @@ static int rt2800_probe_hw_mode(struct r
++@@ -8563,6 +9504,7 @@ static int rt2800_probe_hw_mode(struct r
   	case RF5372:
   	case RF5390:
   	case RF5392:
@@ -29794,7 +31913,7 @@ index 4c04d4f..0000000
 - 
 - 	return 0;
 diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
-index eed3814..93196e1 100644
+index eed3814..8c6d720 100644
 --- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
 +++ b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
 @@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
@@ -29802,19 +31921,19 @@ index eed3814..93196e1 100644
  --- a/drivers/net/wireless/ath/ath10k/core.c
  +++ b/drivers/net/wireless/ath/ath10k/core.c
 -@@ -1323,6 +1323,16 @@ int ath10k_core_register(struct ath10k *
-+@@ -1520,6 +1520,16 @@ int ath10k_core_register(struct ath10k *
++@@ -1914,6 +1914,16 @@ int ath10k_core_register(struct ath10k *
   	ar->chip_id = chip_id;
   	queue_work(ar->workqueue, &ar->register_work);
   
 diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
-index 8003f86..34910a0 100644
+index 8003f86..281b447 100644
 --- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
 +++ b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
 @@ -1,6 +1,6 @@
  --- a/drivers/net/wireless/ath/ath10k/mac.c
  +++ b/drivers/net/wireless/ath/ath10k/mac.c
 -@@ -5416,6 +5416,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
-+@@ -6804,6 +6804,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
++@@ -7141,6 +7141,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
   	return arvif_iter.arvif;
   }
   
@@ -29823,19 +31942,19 @@ index 8003f86..34910a0 100644
   {
   	static const u32 cipher_suites[] = {
 -@@ -5590,6 +5605,12 @@ int ath10k_mac_register(struct ath10k *a
-+@@ -7025,6 +7040,12 @@ int ath10k_mac_register(struct ath10k *a
++@@ -7357,6 +7372,12 @@ int ath10k_mac_register(struct ath10k *a
   	ar->hw->wiphy->cipher_suites = cipher_suites;
   	ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
   
 diff --git a/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
 new file mode 100644
-index 0000000..75d8212
+index 0000000..357faee
 --- /dev/null
 +++ b/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
 @@ -0,0 +1,20 @@
-+--- a/drivers/net/wireless/mwl8k.c
-++++ b/drivers/net/wireless/mwl8k.c
-+@@ -6261,6 +6261,8 @@ static int mwl8k_probe(struct pci_dev *p
++--- a/drivers/net/wireless/marvell/mwl8k.c
+++++ b/drivers/net/wireless/marvell/mwl8k.c
++@@ -6264,6 +6264,8 @@ static int mwl8k_probe(struct pci_dev *p
 + 
 + 	priv->running_bsses = 0;
 + 
@@ -29844,7 +31963,7 @@ index 0000000..75d8212
 + 	return rc;
 + 
 + err_stop_firmware:
-+@@ -6294,8 +6296,6 @@ static void mwl8k_remove(struct pci_dev
++@@ -6297,8 +6299,6 @@ static void mwl8k_remove(struct pci_dev
 + 		return;
 + 	priv = hw->priv;
 + 
@@ -29853,6 +31972,41 @@ index 0000000..75d8212
 + 	if (priv->fw_state == FW_STATE_ERROR) {
 + 		mwl8k_hw_reset(priv);
 + 		goto unmap;
+diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
+index 5ede95a..c098832 100644
+--- a/package/kernel/mt76/Makefile
++++ b/package/kernel/mt76/Makefile
+@@ -1,7 +1,7 @@
+ include $(TOPDIR)/rules.mk
+ 
+ PKG_NAME:=mt76
+-PKG_VERSION:=2015-10-12
++PKG_VERSION:=2016-02-08
+ PKG_RELEASE=1
+ 
+ PKG_LICENSE:=GPLv2
+@@ -10,7 +10,7 @@ PKG_LICENSE_FILES:=
+ PKG_SOURCE_URL:=https://github.com/openwrt/mt76
+ PKG_SOURCE_PROTO:=git
+ PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+-PKG_SOURCE_VERSION:=2f31d1e329dc43074a05782624195860c45b099a
++PKG_SOURCE_VERSION:=84a312645c7b805255e6d7b6191e9f62142985d9
+ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
+ 
+ PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
+@@ -23,8 +23,10 @@ define KernelPackage/mt76
+   SUBMENU:=Wireless Drivers
+   TITLE:=MediaTek MT76x2 wireless driver
+   DEPENDS:=+kmod-mac80211 +@DRIVER_11N_SUPPORT @PCI_SUPPORT
+-  FILES:=$(PKG_BUILD_DIR)/mt76pci.ko
+-  AUTOLOAD:=$(call AutoLoad,50,mac80211 mt76pci)
++  FILES:=\
++	$(PKG_BUILD_DIR)/mt76.ko \
++	$(PKG_BUILD_DIR)/mt76x2e.ko
++  AUTOLOAD:=$(call AutoLoad,50,mac80211 mt76 mt76x2e)
+ endef
+ 
+ NOSTDINC_FLAGS = \
 diff --git a/package/kernel/mt76/patches/001-backport_ieee80211_hw_set.patch b/package/kernel/mt76/patches/001-backport_ieee80211_hw_set.patch
 deleted file mode 100644
 index e94574d..0000000
@@ -29871,3 +32025,717 @@ index e94574d..0000000
 - static bool
 - mt76_wait_for_mac(struct mt76_dev *dev)
 - {
+diff --git a/package/kernel/mt76/patches/002-disable_fast_xmit.patch b/package/kernel/mt76/patches/002-disable_fast_xmit.patch
+deleted file mode 100644
+index f7a011b..0000000
+--- a/package/kernel/mt76/patches/002-disable_fast_xmit.patch
++++ /dev/null
+@@ -1,10 +0,0 @@
+---- a/init.c
+-+++ b/init.c
+-@@ -816,7 +816,6 @@ int mt76_register_device(struct mt76_dev
+- 	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
+- 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
+- 	ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
+--	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
+- 
+- 	hw->sta_data_size = sizeof(struct mt76_sta);
+- 	hw->vif_data_size = sizeof(struct mt76_vif);
+diff --git a/package/kernel/mwlwifi/patches/100-drop_old_api.patch b/package/kernel/mwlwifi/patches/100-drop_old_api.patch
+new file mode 100644
+index 0000000..d2e149e
+--- /dev/null
++++ b/package/kernel/mwlwifi/patches/100-drop_old_api.patch
+@@ -0,0 +1,92 @@
++--- a/main.c
+++++ b/main.c
++@@ -418,11 +418,7 @@ static void mwl_set_ht_caps(struct mwl_p
++ 	band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
++ 	band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
++ 
++-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
++-	hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
++-#else
++ 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
++-#endif
++ 	band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
++ 	band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_4;
++ 
++@@ -524,29 +520,16 @@ static int mwl_wl_init(struct mwl_priv *
++ 	hw->queues = SYSADPT_TX_WMM_QUEUES;
++ 
++ 	/* Set rssi values to dBm */
++-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
++-	hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_HAS_RATE_CONTROL;
++-#else
++ 	ieee80211_hw_set(hw, SIGNAL_DBM);
++ 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
++-#endif
++ 
++ 	/* Ask mac80211 not to trigger PS mode
++ 	 * based on PM bit of incoming frames.
++ 	 */
++-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
++-	hw->flags |= IEEE80211_HW_AP_LINK_PS;
++-#else
++ 	ieee80211_hw_set(hw, AP_LINK_PS);
++-#endif
++ 
++-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
++-	hw->flags |= IEEE80211_HW_SUPPORTS_PER_STA_GTK |
++-		     IEEE80211_HW_MFP_CAPABLE;
++-#else
++ 	ieee80211_hw_set(hw, SUPPORTS_PER_STA_GTK);
++ 	ieee80211_hw_set(hw, MFP_CAPABLE);
++-#endif
++ 
++ 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
++ 
++--- a/dev.h
+++++ b/dev.h
++@@ -484,10 +484,6 @@ static inline struct mwl_sta *mwl_dev_ge
++ 	return (struct mwl_sta *)&sta->drv_priv;
++ }
++ 
++-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)
++-#define ether_addr_copy(dst, src) memcpy(dst, src, ETH_ALEN)
++-#endif
++-
++ /* Defined in mac80211.c. */
++ extern const struct ieee80211_ops mwl_mac80211_ops;
++ 
++--- a/mac80211.c
+++++ b/mac80211.c
++@@ -572,19 +572,11 @@ static int mwl_mac80211_get_survey(struc
++ 	return 0;
++ }
++ 
++-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 3, 0)
++-static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
++-				     struct ieee80211_vif *vif,
++-				     enum ieee80211_ampdu_mlme_action action,
++-				     struct ieee80211_sta *sta,
++-				     u16 tid, u16 *ssn, u8 buf_size)
++-#else
++ static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
++ 				     struct ieee80211_vif *vif,
++ 				     enum ieee80211_ampdu_mlme_action action,
++ 				     struct ieee80211_sta *sta,
++ 				     u16 tid, u16 *ssn, u8 buf_size, bool amsdu)
++-#endif
++ {
++ 	int rc = 0;
++ 	struct mwl_priv *priv = hw->priv;
++--- a/rx.c
+++++ b/rx.c
++@@ -232,10 +232,8 @@ static inline void mwl_rx_prepare_status
++ 		status->flag |= RX_FLAG_VHT;
++ 		if (bw == RX_RATE_INFO_HT40)
++ 			status->flag |= RX_FLAG_40MHZ;
++-#if LINUX_VERSION_CODE > KERNEL_VERSION(3, 18, 0)
++ 		if (bw == RX_RATE_INFO_HT80)
++ 			status->vht_flag |= RX_VHT_FLAG_80MHZ;
++-#endif
++ 		if (gi == RX_RATE_INFO_SHORT_INTERVAL)
++ 			status->flag |= RX_FLAG_SHORT_GI;
++ 		status->vht_nss = (nss + 1);
+diff --git a/package/kernel/mwlwifi/patches/110-api_sync.patch b/package/kernel/mwlwifi/patches/110-api_sync.patch
+new file mode 100644
+index 0000000..ed3e06a
+--- /dev/null
++++ b/package/kernel/mwlwifi/patches/110-api_sync.patch
+@@ -0,0 +1,19 @@
++--- a/mac80211.c
+++++ b/mac80211.c
++@@ -597,10 +597,13 @@ static int mwl_mac80211_get_survey(struc
++ 
++ static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
++ 				     struct ieee80211_vif *vif,
++-				     enum ieee80211_ampdu_mlme_action action,
++-				     struct ieee80211_sta *sta,
++-				     u16 tid, u16 *ssn, u8 buf_size, bool amsdu)
+++				     struct ieee80211_ampdu_params *params)
++ {
+++	enum ieee80211_ampdu_mlme_action action = params->action;
+++	struct ieee80211_sta *sta = params->sta;
+++	u16 tid = params->tid;
+++	u16 *ssn = &params->ssn;
+++	u8 buf_size = params->buf_size;
++ 	int rc = 0;
++ 	struct mwl_priv *priv = hw->priv;
++ 	struct mwl_ampdu_stream *stream;
+diff --git a/target/linux/generic/files/include/linux/ath9k_platform.h b/target/linux/generic/files/include/linux/ath9k_platform.h
+index 9fa7016..30ce216 100644
+--- a/target/linux/generic/files/include/linux/ath9k_platform.h
++++ b/target/linux/generic/files/include/linux/ath9k_platform.h
+@@ -36,6 +36,7 @@ struct ath9k_platform_data {
+ 	bool tx_gain_buffalo;
+ 	bool disable_2ghz;
+ 	bool disable_5ghz;
++	bool led_active_high;
+ 
+ 	int (*get_mac_revision)(void);
+ 	int (*external_reset)(void);
+diff --git a/target/linux/generic/patches-3.18/030-backport_bcm47xx_nvram.patch b/target/linux/generic/patches-3.18/030-backport_bcm47xx_nvram.patch
+new file mode 100644
+index 0000000..7ae8b1d
+--- /dev/null
++++ b/target/linux/generic/patches-3.18/030-backport_bcm47xx_nvram.patch
+@@ -0,0 +1,52 @@
++--- /dev/null
+++++ b/include/linux/bcm47xx_nvram.h
++@@ -0,0 +1,49 @@
+++/*
+++ *  This program is free software; you can redistribute  it and/or modify it
+++ *  under  the terms of  the GNU General  Public License as published by the
+++ *  Free Software Foundation;  either version 2 of the  License, or (at your
+++ *  option) any later version.
+++ */
+++
+++#ifndef __BCM47XX_NVRAM_H
+++#define __BCM47XX_NVRAM_H
+++
+++#include <linux/types.h>
+++#include <linux/kernel.h>
+++#include <linux/vmalloc.h>
+++
+++#ifdef CONFIG_BCM47XX_NVRAM
+++int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+++int bcm47xx_nvram_gpio_pin(const char *name);
+++char *bcm47xx_nvram_get_contents(size_t *val_len);
+++static inline void bcm47xx_nvram_release_contents(char *nvram)
+++{
+++	vfree(nvram);
+++};
+++#else
+++static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+++{
+++	return -ENOTSUPP;
+++};
+++static inline int bcm47xx_nvram_getenv(const char *name, char *val,
+++				       size_t val_len)
+++{
+++	return -ENOTSUPP;
+++};
+++static inline int bcm47xx_nvram_gpio_pin(const char *name)
+++{
+++	return -ENOTSUPP;
+++};
+++
+++static inline char *bcm47xx_nvram_get_contents(size_t *val_len)
+++{
+++	return NULL;
+++};
+++
+++static inline void bcm47xx_nvram_release_contents(char *nvram)
+++{
+++};
+++#endif
+++
+++#endif /* __BCM47XX_NVRAM_H */
+diff --git a/target/linux/generic/patches-3.18/031-bcma-from-4.5.patch b/target/linux/generic/patches-3.18/031-bcma-from-4.5.patch
+new file mode 100644
+index 0000000..171395d
+--- /dev/null
++++ b/target/linux/generic/patches-3.18/031-bcma-from-4.5.patch
+@@ -0,0 +1,49 @@
++--- a/drivers/bcma/main.c
+++++ b/drivers/bcma/main.c
++@@ -637,11 +637,36 @@ static int bcma_device_uevent(struct dev
++ 			      core->id.rev, core->id.class);
++ }
++ 
++-static int __init bcma_modinit(void)
+++static unsigned int bcma_bus_registered;
+++
+++/*
+++ * If built-in, bus has to be registered early, before any driver calls
+++ * bcma_driver_register.
+++ * Otherwise registering driver would trigger BUG in driver_register.
+++ */
+++static int __init bcma_init_bus_register(void)
++ {
++ 	int err;
++ 
+++	if (bcma_bus_registered)
+++		return 0;
+++
++ 	err = bus_register(&bcma_bus_type);
+++	if (!err)
+++		bcma_bus_registered = 1;
+++
+++	return err;
+++}
+++#ifndef MODULE
+++fs_initcall(bcma_init_bus_register);
+++#endif
+++
+++/* Main initialization has to be done with SPI/mtd/NAND/SPROM available */
+++static int __init bcma_modinit(void)
+++{
+++	int err;
+++
+++	err = bcma_init_bus_register();
++ 	if (err)
++ 		return err;
++ 
++@@ -660,7 +685,7 @@ static int __init bcma_modinit(void)
++ 
++ 	return err;
++ }
++-fs_initcall(bcma_modinit);
+++module_init(bcma_modinit);
++ 
++ static void __exit bcma_modexit(void)
++ {
+diff --git a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
+new file mode 100644
+index 0000000..a74d9ee
+--- /dev/null
++++ b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
+@@ -0,0 +1,444 @@
++--- a/drivers/bcma/driver_chipcommon.c
+++++ b/drivers/bcma/driver_chipcommon.c
++@@ -15,6 +15,8 @@
++ #include <linux/platform_device.h>
++ #include <linux/bcma/bcma.h>
++ 
+++static void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
+++
++ static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
++ 					 u32 mask, u32 value)
++ {
++@@ -115,6 +117,8 @@ int bcma_chipco_watchdog_register(struct
++ 
++ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
++ {
+++	struct bcma_bus *bus = cc->core->bus;
+++
++ 	if (cc->early_setup_done)
++ 		return;
++ 
++@@ -129,6 +133,9 @@ void bcma_core_chipcommon_early_init(str
++ 	if (cc->capabilities & BCMA_CC_CAP_PMU)
++ 		bcma_pmu_early_init(cc);
++ 
+++	if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
+++		bcma_chipco_serial_init(cc);
+++
++ 	cc->early_setup_done = true;
++ }
++ 
++@@ -185,11 +192,12 @@ u32 bcma_chipco_watchdog_timer_set(struc
++ 			ticks = 2;
++ 		else if (ticks > maxt)
++ 			ticks = maxt;
++-		bcma_cc_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
++ 	} else {
++ 		struct bcma_bus *bus = cc->core->bus;
++ 
++ 		if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4707 &&
+++		    bus->chipinfo.id != BCMA_CHIP_ID_BCM47094 &&
++ 		    bus->chipinfo.id != BCMA_CHIP_ID_BCM53018)
++ 			bcma_core_set_clockmode(cc->core,
++ 						ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC);
++@@ -314,9 +322,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcm
++ 	return res;
++ }
++ 
++-#ifdef CONFIG_BCMA_DRIVER_MIPS
++-void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
+++static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
++ {
+++#if IS_BUILTIN(CONFIG_BCM47XX)
++ 	unsigned int irq;
++ 	u32 baud_base;
++ 	u32 i;
++@@ -358,5 +366,5 @@ void bcma_chipco_serial_init(struct bcma
++ 		ports[i].baud_base = baud_base;
++ 		ports[i].reg_shift = 0;
++ 	}
+++#endif /* CONFIG_BCM47XX */
++ }
++-#endif /* CONFIG_BCMA_DRIVER_MIPS */
++--- a/drivers/bcma/driver_chipcommon_pmu.c
+++++ b/drivers/bcma/driver_chipcommon_pmu.c
++@@ -15,44 +15,44 @@
++ 
++ u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset)
++ {
++-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
++-	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
++-	return bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
+++	bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_ADDR);
+++	return bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_DATA);
++ }
++ EXPORT_SYMBOL_GPL(bcma_chipco_pll_read);
++ 
++ void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset, u32 value)
++ {
++-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
++-	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
++-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
+++	bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_ADDR);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, value);
++ }
++ EXPORT_SYMBOL_GPL(bcma_chipco_pll_write);
++ 
++ void bcma_chipco_pll_maskset(struct bcma_drv_cc *cc, u32 offset, u32 mask,
++ 			     u32 set)
++ {
++-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
++-	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
++-	bcma_cc_maskset32(cc, BCMA_CC_PLLCTL_DATA, mask, set);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
+++	bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_ADDR);
+++	bcma_pmu_maskset32(cc, BCMA_CC_PMU_PLLCTL_DATA, mask, set);
++ }
++ EXPORT_SYMBOL_GPL(bcma_chipco_pll_maskset);
++ 
++ void bcma_chipco_chipctl_maskset(struct bcma_drv_cc *cc,
++ 				 u32 offset, u32 mask, u32 set)
++ {
++-	bcma_cc_write32(cc, BCMA_CC_CHIPCTL_ADDR, offset);
++-	bcma_cc_read32(cc, BCMA_CC_CHIPCTL_ADDR);
++-	bcma_cc_maskset32(cc, BCMA_CC_CHIPCTL_DATA, mask, set);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_CHIPCTL_ADDR, offset);
+++	bcma_pmu_read32(cc, BCMA_CC_PMU_CHIPCTL_ADDR);
+++	bcma_pmu_maskset32(cc, BCMA_CC_PMU_CHIPCTL_DATA, mask, set);
++ }
++ EXPORT_SYMBOL_GPL(bcma_chipco_chipctl_maskset);
++ 
++ void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc, u32 offset, u32 mask,
++ 				u32 set)
++ {
++-	bcma_cc_write32(cc, BCMA_CC_REGCTL_ADDR, offset);
++-	bcma_cc_read32(cc, BCMA_CC_REGCTL_ADDR);
++-	bcma_cc_maskset32(cc, BCMA_CC_REGCTL_DATA, mask, set);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_REGCTL_ADDR, offset);
+++	bcma_pmu_read32(cc, BCMA_CC_PMU_REGCTL_ADDR);
+++	bcma_pmu_maskset32(cc, BCMA_CC_PMU_REGCTL_DATA, mask, set);
++ }
++ EXPORT_SYMBOL_GPL(bcma_chipco_regctl_maskset);
++ 
++@@ -60,18 +60,18 @@ static u32 bcma_pmu_xtalfreq(struct bcma
++ {
++ 	u32 ilp_ctl, alp_hz;
++ 
++-	if (!(bcma_cc_read32(cc, BCMA_CC_PMU_STAT) &
+++	if (!(bcma_pmu_read32(cc, BCMA_CC_PMU_STAT) &
++ 	      BCMA_CC_PMU_STAT_EXT_LPO_AVAIL))
++ 		return 0;
++ 
++-	bcma_cc_write32(cc, BCMA_CC_PMU_XTAL_FREQ,
++-			BIT(BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT));
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_XTAL_FREQ,
+++			 BIT(BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT));
++ 	usleep_range(1000, 2000);
++ 
++-	ilp_ctl = bcma_cc_read32(cc, BCMA_CC_PMU_XTAL_FREQ);
+++	ilp_ctl = bcma_pmu_read32(cc, BCMA_CC_PMU_XTAL_FREQ);
++ 	ilp_ctl &= BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK;
++ 
++-	bcma_cc_write32(cc, BCMA_CC_PMU_XTAL_FREQ, 0);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_XTAL_FREQ, 0);
++ 
++ 	alp_hz = ilp_ctl * 32768 / 4;
++ 	return (alp_hz + 50000) / 100000 * 100;
++@@ -127,8 +127,8 @@ static void bcma_pmu2_pll_init0(struct b
++ 		mask = (u32)~(BCMA_RES_4314_HT_AVAIL |
++ 			      BCMA_RES_4314_MACPHY_CLK_AVAIL);
++ 
++-		bcma_cc_mask32(cc, BCMA_CC_PMU_MINRES_MSK, mask);
++-		bcma_cc_mask32(cc, BCMA_CC_PMU_MAXRES_MSK, mask);
+++		bcma_pmu_mask32(cc, BCMA_CC_PMU_MINRES_MSK, mask);
+++		bcma_pmu_mask32(cc, BCMA_CC_PMU_MAXRES_MSK, mask);
++ 		bcma_wait_value(cc->core, BCMA_CLKCTLST,
++ 				BCMA_CLKCTLST_HAVEHT, 0, 20000);
++ 		break;
++@@ -140,7 +140,7 @@ static void bcma_pmu2_pll_init0(struct b
++ 
++ 	/* Flush */
++ 	if (cc->pmu.rev >= 2)
++-		bcma_cc_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);
+++		bcma_pmu_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);
++ 
++ 	/* TODO: Do we need to update OTP? */
++ }
++@@ -195,9 +195,9 @@ static void bcma_pmu_resources_init(stru
++ 
++ 	/* Set the resource masks. */
++ 	if (min_msk)
++-		bcma_cc_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
++ 	if (max_msk)
++-		bcma_cc_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
++ 
++ 	/*
++ 	 * Add some delay; allow resources to come up and settle.
++@@ -269,23 +269,33 @@ static void bcma_pmu_workarounds(struct
++ 
++ void bcma_pmu_early_init(struct bcma_drv_cc *cc)
++ {
+++	struct bcma_bus *bus = cc->core->bus;
++ 	u32 pmucap;
++ 
++-	pmucap = bcma_cc_read32(cc, BCMA_CC_PMU_CAP);
+++	if (cc->core->id.rev >= 35 &&
+++	    cc->capabilities_ext & BCMA_CC_CAP_EXT_AOB_PRESENT) {
+++		cc->pmu.core = bcma_find_core(bus, BCMA_CORE_PMU);
+++		if (!cc->pmu.core)
+++			bcma_warn(bus, "Couldn't find expected PMU core");
+++	}
+++	if (!cc->pmu.core)
+++		cc->pmu.core = cc->core;
+++
+++	pmucap = bcma_pmu_read32(cc, BCMA_CC_PMU_CAP);
++ 	cc->pmu.rev = (pmucap & BCMA_CC_PMU_CAP_REVISION);
++ 
++-	bcma_debug(cc->core->bus, "Found rev %u PMU (capabilities 0x%08X)\n",
++-		   cc->pmu.rev, pmucap);
+++	bcma_debug(bus, "Found rev %u PMU (capabilities 0x%08X)\n", cc->pmu.rev,
+++		   pmucap);
++ }
++ 
++ void bcma_pmu_init(struct bcma_drv_cc *cc)
++ {
++ 	if (cc->pmu.rev == 1)
++-		bcma_cc_mask32(cc, BCMA_CC_PMU_CTL,
++-			      ~BCMA_CC_PMU_CTL_NOILPONW);
+++		bcma_pmu_mask32(cc, BCMA_CC_PMU_CTL,
+++				~BCMA_CC_PMU_CTL_NOILPONW);
++ 	else
++-		bcma_cc_set32(cc, BCMA_CC_PMU_CTL,
++-			     BCMA_CC_PMU_CTL_NOILPONW);
+++		bcma_pmu_set32(cc, BCMA_CC_PMU_CTL,
+++			       BCMA_CC_PMU_CTL_NOILPONW);
++ 
++ 	bcma_pmu_pll_init(cc);
++ 	bcma_pmu_resources_init(cc);
++@@ -472,8 +482,8 @@ u32 bcma_pmu_get_cpu_clock(struct bcma_d
++ static void bcma_pmu_spuravoid_pll_write(struct bcma_drv_cc *cc, u32 offset,
++ 					 u32 value)
++ {
++-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
++-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, value);
++ }
++ 
++ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
++@@ -497,20 +507,20 @@ void bcma_pmu_spuravoid_pllupdate(struct
++ 		       bus->chipinfo.id == BCMA_CHIP_ID_BCM53572) ? 6 : 0;
++ 
++ 		/* RMW only the P1 divider */
++-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR,
++ 				BCMA_CC_PMU_PLL_CTL0 + phypll_offset);
++-		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+++		tmp = bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_DATA);
++ 		tmp &= (~(BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK));
++ 		tmp |= (bcm5357_bcm43236_p1div[spuravoid] << BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT);
++-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, tmp);
++ 
++ 		/* RMW only the int feedback divider */
++-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR,
++ 				BCMA_CC_PMU_PLL_CTL2 + phypll_offset);
++-		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+++		tmp = bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_DATA);
++ 		tmp &= ~(BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK);
++ 		tmp |= (bcm5357_bcm43236_ndiv[spuravoid]) << BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT;
++-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
+++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, tmp);
++ 
++ 		tmp = BCMA_CC_PMU_CTL_PLL_UPD;
++ 		break;
++@@ -646,7 +656,7 @@ void bcma_pmu_spuravoid_pllupdate(struct
++ 		break;
++ 	}
++ 
++-	tmp |= bcma_cc_read32(cc, BCMA_CC_PMU_CTL);
++-	bcma_cc_write32(cc, BCMA_CC_PMU_CTL, tmp);
+++	tmp |= bcma_pmu_read32(cc, BCMA_CC_PMU_CTL);
+++	bcma_pmu_write32(cc, BCMA_CC_PMU_CTL, tmp);
++ }
++ EXPORT_SYMBOL_GPL(bcma_pmu_spuravoid_pllupdate);
++--- a/drivers/bcma/driver_chipcommon_sflash.c
+++++ b/drivers/bcma/driver_chipcommon_sflash.c
++@@ -38,6 +38,7 @@ static const struct bcma_sflash_tbl_e bc
++ 	{ "M25P32", 0x15, 0x10000, 64, },
++ 	{ "M25P64", 0x16, 0x10000, 128, },
++ 	{ "M25FL128", 0x17, 0x10000, 256, },
+++	{ "MX25L25635F", 0x18, 0x10000, 512, },
++ 	{ NULL },
++ };
++ 
++--- a/drivers/bcma/scan.c
+++++ b/drivers/bcma/scan.c
++@@ -98,6 +98,9 @@ static const struct bcma_device_id_name
++ 	{ BCMA_CORE_SHIM, "SHIM" },
++ 	{ BCMA_CORE_PCIE2, "PCIe Gen2" },
++ 	{ BCMA_CORE_ARM_CR4, "ARM CR4" },
+++	{ BCMA_CORE_GCI, "GCI" },
+++	{ BCMA_CORE_CMEM, "CNDS DDR2/3 memory controller" },
+++	{ BCMA_CORE_ARM_CA7, "ARM CA7" },
++ 	{ BCMA_CORE_DEFAULT, "Default" },
++ };
++ 
++@@ -315,6 +318,8 @@ static int bcma_get_next_core(struct bcm
++ 		switch (core->id.id) {
++ 		case BCMA_CORE_4706_MAC_GBIT_COMMON:
++ 		case BCMA_CORE_NS_CHIPCOMMON_B:
+++		case BCMA_CORE_PMU:
+++		case BCMA_CORE_GCI:
++ 		/* Not used yet: case BCMA_CORE_OOB_ROUTER: */
++ 			break;
++ 		default:
++--- a/drivers/net/wireless/b43/main.c
+++++ b/drivers/net/wireless/b43/main.c
++@@ -1215,10 +1215,10 @@ void b43_wireless_core_phy_pll_reset(str
++ 	case B43_BUS_BCMA:
++ 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
++ 
++-		bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
++-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
++-		bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
++-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
+++		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
+++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
+++		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
+++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
++ 		break;
++ #endif
++ #ifdef CONFIG_B43_SSB
++--- a/include/linux/bcma/bcma.h
+++++ b/include/linux/bcma/bcma.h
++@@ -151,6 +151,8 @@ struct bcma_host_ops {
++ #define BCMA_CORE_PCIE2			0x83C	/* PCI Express Gen2 */
++ #define BCMA_CORE_USB30_DEV		0x83D
++ #define BCMA_CORE_ARM_CR4		0x83E
+++#define BCMA_CORE_GCI			0x840
+++#define BCMA_CORE_CMEM			0x846	/* CNDS DDR2/3 memory controller */
++ #define BCMA_CORE_ARM_CA7		0x847
++ #define BCMA_CORE_SYS_MEM		0x849
++ #define BCMA_CORE_DEFAULT		0xFFF
++@@ -199,6 +201,7 @@ struct bcma_host_ops {
++ #define  BCMA_PKG_ID_BCM4707	1
++ #define  BCMA_PKG_ID_BCM4708	2
++ #define  BCMA_PKG_ID_BCM4709	0
+++#define BCMA_CHIP_ID_BCM47094	53030
++ #define BCMA_CHIP_ID_BCM53018	53018
++ 
++ /* Board types (on PCI usually equals to the subsystem dev id) */
++--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++++ b/include/linux/bcma/bcma_driver_chipcommon.h
++@@ -217,6 +217,11 @@
++ #define	 BCMA_CC_CLKDIV_JTAG_SHIFT	8
++ #define	 BCMA_CC_CLKDIV_UART		0x000000FF
++ #define BCMA_CC_CAP_EXT			0x00AC		/* Capabilities */
+++#define  BCMA_CC_CAP_EXT_SECI_PRESENT	0x00000001
+++#define  BCMA_CC_CAP_EXT_GSIO_PRESENT	0x00000002
+++#define  BCMA_CC_CAP_EXT_GCI_PRESENT	0x00000004
+++#define  BCMA_CC_CAP_EXT_SECI_PUART_PRESENT		0x00000008    /* UART present */
+++#define  BCMA_CC_CAP_EXT_AOB_PRESENT	0x00000040
++ #define BCMA_CC_PLLONDELAY		0x00B0		/* Rev >= 4 only */
++ #define BCMA_CC_FREFSELDELAY		0x00B4		/* Rev >= 4 only */
++ #define BCMA_CC_SLOWCLKCTL		0x00B8		/* 6 <= Rev <= 9 only */
++@@ -351,12 +356,12 @@
++ #define BCMA_CC_PMU_RES_REQTS		0x0640 /* PMU res req timer sel */
++ #define BCMA_CC_PMU_RES_REQT		0x0644 /* PMU res req timer */
++ #define BCMA_CC_PMU_RES_REQM		0x0648 /* PMU res req mask */
++-#define BCMA_CC_CHIPCTL_ADDR		0x0650
++-#define BCMA_CC_CHIPCTL_DATA		0x0654
++-#define BCMA_CC_REGCTL_ADDR		0x0658
++-#define BCMA_CC_REGCTL_DATA		0x065C
++-#define BCMA_CC_PLLCTL_ADDR		0x0660
++-#define BCMA_CC_PLLCTL_DATA		0x0664
+++#define BCMA_CC_PMU_CHIPCTL_ADDR	0x0650
+++#define BCMA_CC_PMU_CHIPCTL_DATA	0x0654
+++#define BCMA_CC_PMU_REGCTL_ADDR		0x0658
+++#define BCMA_CC_PMU_REGCTL_DATA		0x065C
+++#define BCMA_CC_PMU_PLLCTL_ADDR		0x0660
+++#define BCMA_CC_PMU_PLLCTL_DATA		0x0664
++ #define BCMA_CC_PMU_STRAPOPT		0x0668 /* (corerev >= 28) */
++ #define BCMA_CC_PMU_XTAL_FREQ		0x066C /* (pmurev >= 10) */
++ #define  BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK	0x00001FFF
++@@ -566,6 +571,7 @@
++  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
++  */
++ struct bcma_chipcommon_pmu {
+++	struct bcma_device *core;	/* Can be separated core or just ChipCommon one */
++ 	u8 rev;			/* PMU revision */
++ 	u32 crystalfreq;	/* The active crystal frequency (in kHz) */
++ };
++@@ -663,6 +669,19 @@ struct bcma_drv_cc_b {
++ #define bcma_cc_maskset32(cc, offset, mask, set) \
++ 	bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
++ 
+++/* PMU registers access */
+++#define bcma_pmu_read32(cc, offset) \
+++	bcma_read32((cc)->pmu.core, offset)
+++#define bcma_pmu_write32(cc, offset, val) \
+++	bcma_write32((cc)->pmu.core, offset, val)
+++
+++#define bcma_pmu_mask32(cc, offset, mask) \
+++	bcma_pmu_write32(cc, offset, bcma_pmu_read32(cc, offset) & (mask))
+++#define bcma_pmu_set32(cc, offset, set) \
+++	bcma_pmu_write32(cc, offset, bcma_pmu_read32(cc, offset) | (set))
+++#define bcma_pmu_maskset32(cc, offset, mask, set) \
+++	bcma_pmu_write32(cc, offset, (bcma_pmu_read32(cc, offset) & (mask)) | (set))
+++
++ extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
++ 
++ extern u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc);
++--- a/drivers/bcma/bcma_private.h
+++++ b/drivers/bcma/bcma_private.h
++@@ -47,7 +47,6 @@ void bcma_core_chipcommon_early_init(str
++ void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
++ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
++ #ifdef CONFIG_BCMA_DRIVER_MIPS
++-void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
++ extern struct platform_device bcma_pflash_dev;
++ #endif /* CONFIG_BCMA_DRIVER_MIPS */
++ 
++--- a/drivers/bcma/driver_gpio.c
+++++ b/drivers/bcma/driver_gpio.c
++@@ -229,6 +229,7 @@ int bcma_gpio_init(struct bcma_drv_cc *c
++ 	case BCMA_CHIP_ID_BCM4707:
++ 	case BCMA_CHIP_ID_BCM5357:
++ 	case BCMA_CHIP_ID_BCM53572:
+++	case BCMA_CHIP_ID_BCM47094:
++ 		chip->ngpio	= 32;
++ 		break;
++ 	default:
++--- a/drivers/bcma/driver_mips.c
+++++ b/drivers/bcma/driver_mips.c
++@@ -328,12 +328,9 @@ static void bcma_core_mips_flash_detect(
++ 
++ void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
++ {
++-	struct bcma_bus *bus = mcore->core->bus;
++-
++ 	if (mcore->early_setup_done)
++ 		return;
++ 
++-	bcma_chipco_serial_init(&bus->drv_cc);
++ 	bcma_core_mips_flash_detect(mcore);
++ 
++ 	mcore->early_setup_done = true;
++--- a/drivers/bcma/host_pci.c
+++++ b/drivers/bcma/host_pci.c
++@@ -294,7 +294,7 @@ static const struct pci_device_id bcma_p
++ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
++ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
++ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) },
++-	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4365) },
+++	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) },
++ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) },
++ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
++ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
diff --git a/patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch b/patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
new file mode 100644
index 000000000..5f6976fea
--- /dev/null
+++ b/patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
@@ -0,0 +1,59 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Tue, 9 Feb 2016 18:22:29 +0100
+Subject: ath10k-firmware: add Candela Technologies firmware for QCA988X
+
+diff --git a/package/firmware/ath10k-firmware/Makefile b/package/firmware/ath10k-firmware/Makefile
+index 882294c..c6e6f2d 100644
+--- a/package/firmware/ath10k-firmware/Makefile
++++ b/package/firmware/ath10k-firmware/Makefile
+@@ -46,6 +46,26 @@ define Download/ath10k-firmware-qca988x
+ endef
+ $(eval $(call Download,ath10k-firmware-qca988x))
+ 
++
++define Package/ath10k-firmware-qca988x-ct
++$(Package/ath10k-firmware-default)
++  TITLE:=ath10k firmware for QCA988x devices (Candela Technologies version)
++  CONFLICTS:=ath10k-firmware-qca988x
++endef
++
++QCA988X_CT_FIRMWARE_FILE:=firmware-5-ct-full-community.bin
++
++define Download/ath10k-firmware-qca988x-ct
++  # See http://www.candelatech.com/ath10k.php
++  #URL:=http://www.candelatech.com/downloads/ath10k-10-2/
++  # Update to beta version (will switch back to official URL after v2 release)
++  URL:=https://home.universe-factory.net/neoraider/
++  FILE:=$(QCA988X_CT_FIRMWARE_FILE)
++  MD5SUM:=9aa205cfd6b98e695ca8e9ae6d1bcb6b
++endef
++$(eval $(call Download,ath10k-firmware-qca988x-ct))
++
++
+ define Package/ath10k-firmware-qca99x0
+ $(Package/ath10k-firmware-default)
+   TITLE:=ath10k firmware for QCA99x0 devices
+@@ -81,6 +101,16 @@ define Package/ath10k-firmware-qca988x/install
+ 		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
+ endef
+ 
++define Package/ath10k-firmware-qca988x-ct/install
++	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA988X/hw2.0
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/QCA988X/board.bin \
++		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
++	$(INSTALL_DATA) \
++		$(DL_DIR)/$(QCA988X_CT_FIRMWARE_FILE) \
++		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
++endef
++
+ define Package/ath10k-firmware-qca6174/install
+ 	$(INSTALL_DIR) $(1)/lib/firmware/ath10k
+ 	$(CP) $(PKG_BUILD_DIR)/QCA6174 $(1)/lib/firmware/ath10k/
+@@ -100,5 +130,6 @@ define Package/ath10k-firmware-qca99x0/install
+ endef
+ 
+ $(eval $(call BuildPackage,ath10k-firmware-qca988x))
++$(eval $(call BuildPackage,ath10k-firmware-qca988x-ct))
+ $(eval $(call BuildPackage,ath10k-firmware-qca99x0))
+ $(eval $(call BuildPackage,ath10k-firmware-qca6174))
diff --git a/patches/openwrt/0008-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch b/patches/openwrt/0009-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch
similarity index 100%
rename from patches/openwrt/0008-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch
rename to patches/openwrt/0009-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch
diff --git a/patches/openwrt/0009-iwinfo-update-NanoStation-Loco-txpower-offsets.patch b/patches/openwrt/0010-iwinfo-update-NanoStation-Loco-txpower-offsets.patch
similarity index 100%
rename from patches/openwrt/0009-iwinfo-update-NanoStation-Loco-txpower-offsets.patch
rename to patches/openwrt/0010-iwinfo-update-NanoStation-Loco-txpower-offsets.patch
diff --git a/patches/openwrt/0010-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch b/patches/openwrt/0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch
similarity index 100%
rename from patches/openwrt/0010-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch
rename to patches/openwrt/0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch
diff --git a/patches/openwrt/0011-ar71xx-add-support-for-TL-WR741ND-v5.patch b/patches/openwrt/0012-ar71xx-add-support-for-TL-WR741ND-v5.patch
similarity index 100%
rename from patches/openwrt/0011-ar71xx-add-support-for-TL-WR741ND-v5.patch
rename to patches/openwrt/0012-ar71xx-add-support-for-TL-WR741ND-v5.patch
diff --git a/patches/openwrt/0012-sunxi-fix-uboot-install-location.patch b/patches/openwrt/0013-sunxi-fix-uboot-install-location.patch
similarity index 100%
rename from patches/openwrt/0012-sunxi-fix-uboot-install-location.patch
rename to patches/openwrt/0013-sunxi-fix-uboot-install-location.patch
diff --git a/patches/openwrt/0013-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch b/patches/openwrt/0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch
similarity index 100%
rename from patches/openwrt/0013-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch
rename to patches/openwrt/0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch
diff --git a/patches/openwrt/0015-mac80211-set-mcast-rate-for-mesh-point-interfaces.patch b/patches/openwrt/0015-mac80211-set-mcast-rate-for-mesh-point-interfaces.patch
deleted file mode 100644
index 2f57a812c..000000000
--- a/patches/openwrt/0015-mac80211-set-mcast-rate-for-mesh-point-interfaces.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From: Nils Schneider <nils@nilsschneider.net>
-Date: Fri, 24 Jul 2015 21:52:12 +0200
-Subject: mac80211: set mcast-rate for mesh point interfaces
-
-In order to set the multicast rate for mesh point interfaces the "mesh join"
-was made explicit and moved to mac80211_setup_vif(), similar to how it is
-done for IBSS interfaces.
-
-Previously, the mesh join was made implicit in case authentication (i.e.
-$key) was not used when creating the interface in mac80211_prepare_vif(),
-while using authentication would create the interface first, then join
-later in mac80211_setup_vif() by starting authsae.
-
-Signed-off-by: Nils Schneider <nils@nilsschneider.net>
-
-diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-index 2a8d2f9..8d31a80 100644
---- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-@@ -455,12 +455,7 @@ mac80211_prepare_vif() {
- 			}
- 		;;
- 		mesh)
--			json_get_vars key mesh_id
--			if [ -n "$key" ]; then
--				iw phy "$phy" interface add "$ifname" type mp
--			else
--				iw phy "$phy" interface add "$ifname" type mp mesh_id "$mesh_id"
--			fi
-+			iw phy "$phy" interface add "$ifname" type mp
- 		;;
- 		monitor)
- 			iw phy "$phy" interface add "$ifname" type monitor
-@@ -603,6 +598,13 @@ mac80211_setup_vif() {
- 					wireless_vif_parse_encryption
- 					mac80211_setup_supplicant || failed=1
- 				fi
-+			else
-+				json_get_vars mesh_id mcast_rate
-+
-+				mcval=
-+				[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
-+
-+				iw dev "$ifname" mesh join "$mesh_id" ${mcval:+mcast-rate $mcval}
- 			fi
- 
- 			for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
diff --git a/patches/openwrt/0014-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch b/patches/openwrt/0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch
similarity index 100%
rename from patches/openwrt/0014-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch
rename to patches/openwrt/0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch
diff --git a/patches/openwrt/0033-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch b/patches/openwrt/0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch
similarity index 100%
rename from patches/openwrt/0033-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch
rename to patches/openwrt/0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch
diff --git a/patches/openwrt/0030-mac80211-fix-crash-when-using-mesh-11s-VIF-together-with-another-VIF.patch b/patches/openwrt/0030-mac80211-fix-crash-when-using-mesh-11s-VIF-together-with-another-VIF.patch
deleted file mode 100644
index ce907a22a..000000000
--- a/patches/openwrt/0030-mac80211-fix-crash-when-using-mesh-11s-VIF-together-with-another-VIF.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sat, 24 Oct 2015 21:53:10 +0200
-Subject: mac80211: fix crash when using mesh (11s) VIF together with another VIF
-
-Using a 802.11s mesh VIF together with a different VIF (e.g. IBSS) led to
-a panic.
-
-Steps to reproduce:
-
-    rmmod mac80211_hwsim
-    insmod /lib/modules/3.18.21/mac80211_hwsim.ko channels=2
-    iw phy phy2 interface add ibss2 type ibss
-    iw phy phy2 interface add mesh2 type mp
-    iw phy phy3 interface add ibss3 type ibss
-    iw phy phy3 interface add mesh3 type mp
-    ip link set ibss2 up
-    ip link set mesh2 up
-    ip link set ibss3 up
-    ip link set mesh3 up
-    iw dev ibss2 ibss join foo 2412
-    iw dev ibss3 ibss join foo 2412
-    # Ensure that ibss2 and ibss3 are associated, otherwise leave and join
-    # on ibss3 again
-    iw dev mesh2 mesh join bar
-    iw dev mesh3 mesh join bar
-
-The patch has also been submitted upstream.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/package/kernel/mac80211/patches/339-mac80211-fix-crash-on-mesh-local-link-ID-generation-.patch b/package/kernel/mac80211/patches/339-mac80211-fix-crash-on-mesh-local-link-ID-generation-.patch
-new file mode 100644
-index 0000000..5784b98
---- /dev/null
-+++ b/package/kernel/mac80211/patches/339-mac80211-fix-crash-on-mesh-local-link-ID-generation-.patch
-@@ -0,0 +1,46 @@
-+From 604f8b1964b8380eddf1f03dbdafa7a1c13d80d6 Mon Sep 17 00:00:00 2001
-+Message-Id: <604f8b1964b8380eddf1f03dbdafa7a1c13d80d6.1445716231.git.mschiffer@universe-factory.net>
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 24 Oct 2015 21:25:51 +0200
-+Subject: [PATCH] mac80211: fix crash on mesh local link ID generation with
-+ VIFs
-+
-+llid_in_use needs to be limited to stations of the same VIF, otherwise it
-+will cause a NULL deref as the sta_info of non-mesh-VIFs don't have
-+sta->mesh set.
-+
-+Steps to reproduce:
-+
-+   modprobe mac80211_hwsim channels=2
-+   iw phy phy0 interface add ibss0 type ibss
-+   iw phy phy0 interface add mesh0 type mp
-+   iw phy phy1 interface add ibss1 type ibss
-+   iw phy phy1 interface add mesh1 type mp
-+   ip link set ibss0 up
-+   ip link set mesh0 up
-+   ip link set ibss1 up
-+   ip link set mesh1 up
-+   iw dev ibss0 ibss join foo 2412
-+   iw dev ibss1 ibss join foo 2412
-+   # Ensure that ibss0 and ibss1 are actually associated; I often need to
-+   # leave and join the cell on ibss1 a second time.
-+   iw dev mesh0 mesh join bar
-+   iw dev mesh1 mesh join bar # crash
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ net/mac80211/mesh_plink.c | 3 +++
-+ 1 file changed, 3 insertions(+)
-+
-+--- a/net/mac80211/mesh_plink.c
-++++ b/net/mac80211/mesh_plink.c
-+@@ -646,6 +646,9 @@ static bool llid_in_use(struct ieee80211
-+ 
-+ 	rcu_read_lock();
-+ 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
-++		if (sdata != sta->sdata)
-++			continue;
-++
-+ 		if (!memcmp(&sta->mesh->llid, &llid, sizeof(llid))) {
-+ 			in_use = true;
-+ 			break;
diff --git a/patches/openwrt/0034-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch b/patches/openwrt/0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch
similarity index 100%
rename from patches/openwrt/0034-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch
rename to patches/openwrt/0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch
diff --git a/patches/openwrt/0031-ath10k-add-Candelatech-community-firmware-as-an-additional-choice.patch b/patches/openwrt/0031-ath10k-add-Candelatech-community-firmware-as-an-additional-choice.patch
deleted file mode 100644
index 335f550a7..000000000
--- a/patches/openwrt/0031-ath10k-add-Candelatech-community-firmware-as-an-additional-choice.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Tue, 10 Mar 2015 13:17:14 +0100
-Subject: ath10k: add Candelatech community firmware as an additional choice
-
-diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
-index 566e156..1dc1816 100644
---- a/package/kernel/mac80211/Makefile
-+++ b/package/kernel/mac80211/Makefile
-@@ -270,6 +270,29 @@ Atheros IEEE 802.11ac family of chipsets. For now only
- PCI is supported.
- endef
- 
-+define KernelPackage/ath10k/config
-+  if PACKAGE_kmod-ath10k
-+	choice
-+		prompt "ath10k firmware flavour"
-+		default ATH10K_AP_FW
-+		help
-+		This option allows you to choose between different ath10k firmwares.
-+
-+	config ATH10K_AP_FW
-+		bool "Firmware optimized for AP operation"
-+		help
-+		Use the ath10k firmware optimized for access point operation.
-+		Supports only AP mode, will crash in IBSS (ad-hoc) mode.
-+
-+	config ATH10K_CT_COMMUNITY_FW
-+		bool "Firmware by Candela Technologies (community version)"
-+		help
-+		Supports both AP and IBSS (ad-hoc) mode. Doesn't support
-+		encryption when using multiple VIFs.
-+	endchoice
-+   endif
-+ endef
-+
- PKG_ATH10K_LINUX_FIRMWARE_NAME:=ath10k-firmware
- PKG_ATH10K_LINUX_FIRMWARE_VERSION:=b46f3e01a6c1f9150fb4612ef53611d714565842
- PKG_ATH10K_LINUX_FIRMWARE_SOURCE:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION).tar.bz2
-@@ -288,6 +311,14 @@ define Download/ath10k-firmware
- endef
- $(eval $(call Download,ath10k-firmware))
- 
-+ATH10K_CT_COMMUNITY_FW:=firmware-2-ct-full-community-14.bin
-+define Download/ath10k-firmware-ct-community
-+  FILE:=$(ATH10K_CT_COMMUNITY_FW)
-+  URL:=http://www.candelatech.com/downloads/
-+  MD5SUM:=800799459c20c1683138c74b3ba58f25
-+endef
-+$(eval $(call Download,ath10k-firmware-ct-community))
-+
- 
- #Broadcom firmware
- ifneq ($(CONFIG_B43_FW_6_30),)
-@@ -1854,9 +1885,16 @@ define KernelPackage/ath10k/install
- 	$(INSTALL_DATA) \
- 		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/ath10k/QCA988X/hw2.0/board.bin \
- 		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
-+ifeq ($(CONFIG_ATH10K_AP_FW),y)
- 	$(INSTALL_DATA) \
- 		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/10.2.4/untested/firmware-5.bin_10.2.4.70-2 \
- 		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
-+endif
-+ifeq ($(CONFIG_ATH10K_CT_COMMUNITY_FW),y)
-+	$(INSTALL_DATA) \
-+		$(DL_DIR)/$(ATH10K_CT_COMMUNITY_FW) \
-+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-2.bin
-+endif
- endef
- 
- define KernelPackage/b43/install
diff --git a/patches/openwrt/0035-ar71xx-backport-ath10k-calibration-data-load-changes.patch b/patches/openwrt/0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch
similarity index 100%
rename from patches/openwrt/0035-ar71xx-backport-ath10k-calibration-data-load-changes.patch
rename to patches/openwrt/0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch
diff --git a/patches/openwrt/0032-mac80211-ath9k-add-correct-MAC-BB-name-for-ar9561.patch b/patches/openwrt/0032-mac80211-ath9k-add-correct-MAC-BB-name-for-ar9561.patch
deleted file mode 100644
index b82614fcb..000000000
--- a/patches/openwrt/0032-mac80211-ath9k-add-correct-MAC-BB-name-for-ar9561.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Tue, 1 Sep 2015 19:59:16 +0200
-Subject: mac80211: ath9k: add correct MAC/BB name for ar9561
-
-diff --git a/package/kernel/mac80211/patches/546-ath9k_add-correct-MAC-BB-name-for-ar9561.patch b/package/kernel/mac80211/patches/546-ath9k_add-correct-MAC-BB-name-for-ar9561.patch
-new file mode 100644
-index 0000000..a2a2c78
---- /dev/null
-+++ b/package/kernel/mac80211/patches/546-ath9k_add-correct-MAC-BB-name-for-ar9561.patch
-@@ -0,0 +1,25 @@
-+From 1165dd900cc8de3addbc8bef7e6196b07799d25e Mon Sep 17 00:00:00 2001
-+From: Miaoqing Pan <miaoqing@qca.qualcomm.com>
-+Date: Wed, 12 Aug 2015 14:20:46 +0800
-+Subject: ath9k: add correct MAC/BB name for ar9561
-+
-+MAC/BB name is"????" if the MAC/BB is unknown.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@qca.qualcomm.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+
-+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
-+index a31a680..1dd0339 100644
-+--- a/drivers/net/wireless/ath/ath9k/hw.c
-++++ b/drivers/net/wireless/ath/ath9k/hw.c
-+@@ -3186,6 +3186,7 @@ static struct {
-+ 	{ AR_SREV_VERSION_9550,         "9550" },
-+ 	{ AR_SREV_VERSION_9565,         "9565" },
-+ 	{ AR_SREV_VERSION_9531,         "9531" },
-++	{ AR_SREV_VERSION_9561,         "9561" },
-+ };
-+ 
-+ /* For devices with external radios */
-+-- 
-+cgit v0.10.2
-+
diff --git a/patches/openwrt/0036-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch b/patches/openwrt/0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch
similarity index 100%
rename from patches/openwrt/0036-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch
rename to patches/openwrt/0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch
diff --git a/patches/openwrt/0038-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch b/patches/openwrt/0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch
similarity index 100%
rename from patches/openwrt/0038-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch
rename to patches/openwrt/0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch
diff --git a/patches/openwrt/0039-lua-fix-installation-of-headers-for-host-build.patch b/patches/openwrt/0035-lua-fix-installation-of-headers-for-host-build.patch
similarity index 100%
rename from patches/openwrt/0039-lua-fix-installation-of-headers-for-host-build.patch
rename to patches/openwrt/0035-lua-fix-installation-of-headers-for-host-build.patch
diff --git a/patches/openwrt/0040-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch b/patches/openwrt/0036-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch
similarity index 100%
rename from patches/openwrt/0040-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch
rename to patches/openwrt/0036-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch
diff --git a/patches/openwrt/0037-acx-mac80211-mark-as-BROKEN-to-avoid-compile-failure-on-mipsel-targets.patch b/patches/openwrt/0037-acx-mac80211-mark-as-BROKEN-to-avoid-compile-failure-on-mipsel-targets.patch
deleted file mode 100644
index 93353f10a..000000000
--- a/patches/openwrt/0037-acx-mac80211-mark-as-BROKEN-to-avoid-compile-failure-on-mipsel-targets.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sat, 28 Nov 2015 22:40:40 +0100
-Subject: acx-mac80211: mark as BROKEN to avoid compile failure on mipsel targets
-
-diff --git a/package/kernel/acx-mac80211/Makefile b/package/kernel/acx-mac80211/Makefile
-index 1820e7a..fb17a46 100644
---- a/package/kernel/acx-mac80211/Makefile
-+++ b/package/kernel/acx-mac80211/Makefile
-@@ -30,7 +30,7 @@ include $(INCLUDE_DIR)/package.mk
- define KernelPackage/acx-mac80211
-   SUBMENU:=Wireless Drivers
-   TITLE:=ACX1xx mac80211 driver
--  DEPENDS:=@(PCI_SUPPORT||TARGET_ar7) @!TARGET_cobalt @mipsel +kmod-mac80211
-+  DEPENDS:=@(PCI_SUPPORT||TARGET_ar7) @!TARGET_cobalt @mipsel +kmod-mac80211 @BROKEN
-   FILES:=$(PKG_BUILD_DIR)/acx-mac80211.ko
-   AUTOLOAD:=$(call AutoLoad,50,mac80211 acx-mac80211)
-   MAINTAINER:=Florian Fainelli <florian@openwrt.org>
diff --git a/patches/openwrt/0041-x86-generic-refresh-kernel-config.patch b/patches/openwrt/0037-x86-generic-refresh-kernel-config.patch
similarity index 100%
rename from patches/openwrt/0041-x86-generic-refresh-kernel-config.patch
rename to patches/openwrt/0037-x86-generic-refresh-kernel-config.patch
diff --git a/patches/openwrt/0042-x86-generic-enable-pata_atiixp-driver.patch b/patches/openwrt/0038-x86-generic-enable-pata_atiixp-driver.patch
similarity index 100%
rename from patches/openwrt/0042-x86-generic-enable-pata_atiixp-driver.patch
rename to patches/openwrt/0038-x86-generic-enable-pata_atiixp-driver.patch
diff --git a/targets/ar71xx-generic/profiles.mk b/targets/ar71xx-generic/profiles.mk
index 7a17e33b8..43fb17b5f 100644
--- a/targets/ar71xx-generic/profiles.mk
+++ b/targets/ar71xx-generic/profiles.mk
@@ -142,7 +142,7 @@ $(eval $(call GluonModel,TLWR2543,tl-wr2543-v1,tp-link-tl-wr2543n-nd-v1))
 
 ifeq ($(BROKEN),1)
 # Archer C5 v1, C7 v2
-$(eval $(call GluonProfile,ARCHERC7,kmod-ath10k))
+$(eval $(call GluonProfile,ARCHERC7,kmod-ath10k ath10k-firmware-qca988x-ct))
 $(eval $(call GluonModel,ARCHERC7,archer-c5,tp-link-archer-c5-v1)) # BROKEN: ath10k
 $(eval $(call GluonModel,ARCHERC7,archer-c7-v2,tp-link-archer-c7-v2)) # BROKEN: ath10k
 endif
-- 
GitLab