From 388d264ff05c914296ce94aeb15cc1cc46f1523e Mon Sep 17 00:00:00 2001
From: Kokel <github@kokelnet.de>
Date: Sat, 6 Feb 2016 00:01:40 +0100
Subject: [PATCH 01/35] gluon-core: add preserve wifi channels feature

This new feature introduces the new uci section 'gluon-core.wireless' with a preserve_channels option:
 * preserve_channels (boolean)

By setting this option to 1 (true) wifi channels will be preserved during upgrades.
---
 docs/features/wlan-configuration.rst                 |  8 ++++++++
 package/gluon-core/files/etc/config/gluon-core       |  1 +
 .../gluon-core/files/lib/gluon/upgrade/200-wireless  | 12 +++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 package/gluon-core/files/etc/config/gluon-core

diff --git a/docs/features/wlan-configuration.rst b/docs/features/wlan-configuration.rst
index ff280eba..1c1e3e54 100644
--- a/docs/features/wlan-configuration.rst
+++ b/docs/features/wlan-configuration.rst
@@ -24,3 +24,11 @@ existing configuration will also be set for the new configuration.
 This allows upgrades to change from IBSS to 11s and vice-versa while retaining the
 "wireless meshing is enabled/disabled" property configured by the user regardless
 of the used mode.
+
+During upgrades the wifi channel of the 2.4GHz and 5GHz radio will be restored to the channel
+configured in the site.conf. If you need to preserve a user defined wifi channel during upgrades
+you can configure this via the uci section ``gluon-core.wireless``::
+
+  uci set gluon-core.@wireless[0].preserve_channels='1'
+
+Keep in mind that nodes running wifi interfaces on custom channels can't mesh with default nodes anymore!
diff --git a/package/gluon-core/files/etc/config/gluon-core b/package/gluon-core/files/etc/config/gluon-core
new file mode 100644
index 00000000..9787ccc9
--- /dev/null
+++ b/package/gluon-core/files/etc/config/gluon-core
@@ -0,0 +1 @@
+config wireless
diff --git a/package/gluon-core/files/lib/gluon/upgrade/200-wireless b/package/gluon-core/files/lib/gluon/upgrade/200-wireless
index b9495d89..2ada9b3c 100755
--- a/package/gluon-core/files/lib/gluon/upgrade/200-wireless
+++ b/package/gluon-core/files/lib/gluon/upgrade/200-wireless
@@ -10,11 +10,21 @@ if not sysconfig.gluon_version then
   uci:delete_all('wireless', 'wifi-iface')
 end
 
+local function get_channel(radio, config)
+  if uci:get_first('gluon-core', 'wireless', 'preserve_channels') then
+    return uci:get('wireless', radio, 'channel') or config.channel
+  else
+    return config.channel
+  end
+end
+
 local function configure_radio(radio, index, config)
   if config then
+    local channel = get_channel(radio, config)
+
     uci:delete('wireless', radio, 'disabled')
 
-    uci:set('wireless', radio, 'channel', config.channel)
+    uci:set('wireless', radio, 'channel', channel)
     uci:set('wireless', radio, 'htmode', 'HT20')
     uci:set('wireless', radio, 'country', site.regdom)
   end

From a07419bbfec8198e6d57e0c44c6afe24fcd818b4 Mon Sep 17 00:00:00 2001
From: Neal Oakey <neal.oakey@bingo-ev.de>
Date: Sun, 14 Feb 2016 20:59:49 +0100
Subject: [PATCH 02/35] fix UBNT XM model detection

---
 .../0048-fix-UBNT-XM-model-detection.patch    | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 patches/openwrt/0048-fix-UBNT-XM-model-detection.patch

diff --git a/patches/openwrt/0048-fix-UBNT-XM-model-detection.patch b/patches/openwrt/0048-fix-UBNT-XM-model-detection.patch
new file mode 100644
index 00000000..4fbdd403
--- /dev/null
+++ b/patches/openwrt/0048-fix-UBNT-XM-model-detection.patch
@@ -0,0 +1,74 @@
+From: Neal Oakey <neal.oakey@bingo-ev.de>
+Date: Sun, 14 Feb 2016 20:58:20 +0100
+Subject: fix UBNT XM model detection
+
+Signed-off-by: Neal Oakey <neal.oakey@bingo-ev.de>
+
+diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
+index d0abf42..f345fae 100755
+--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
++++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
+@@ -64,6 +64,40 @@ wndr3700_board_detect() {
+ 	AR71XX_MODEL="$machine"
+ }
+ 
++ubnt_get_mtd_part_magic() {
++	ar71xx_get_mtd_offset_size_format EEPROM 4118 2 %02x
++}
++
++ubnt_xm_board_detect() {
++	local model
++	local magic
++
++	magic="$(ubnt_get_mtd_part_magic)"
++	case ${magic:0:3} in
++		"e00"|\
++		"e01"|\
++		"e80") # It seams that there are different Versions of the Nanostation
++			model="Ubiquiti NanoStation M"
++			;;
++		"e0a")
++			model="Ubiquiti NanoStation loco M"
++			;;
++		"e1b") # Note: the M5 has not been tested!
++		       #       and the Ti Versions are still missing
++			model="Ubiquiti Rocket M"
++			;;
++		"e20"|\
++		"e2d") # Bullet Ti M
++			model="Ubiquiti Bullet M"
++			;;
++		"e30")
++			model="Ubiquiti PicoStation M"
++			;;
++	esac
++
++	[ ! -z "$model" ] && AR71XX_MODEL="${model}${magic:3:1}"
++}
++
+ cybertan_get_hw_magic() {
+ 	local part
+ 
+@@ -472,12 +506,14 @@ ar71xx_board_detect() {
+ 		;;
+ 	*"Bullet M")
+ 		name="bullet-m"
++		ubnt_xm_board_detect
+ 		;;
+ 	*"Loco M XW")
+ 		name="loco-m-xw"
+ 		;;
+ 	*"Nanostation M")
+ 		name="nanostation-m"
++		ubnt_xm_board_detect
+ 		;;
+ 	*"Nanostation M XW")
+ 		name="nanostation-m-xw"
+@@ -664,6 +700,7 @@ ar71xx_board_detect() {
+ 		;;
+ 	*"Rocket M")
+ 		name="rocket-m"
++		ubnt_xm_board_detect
+ 		;;
+ 	*"Rocket M XW")
+ 		name="rocket-m-xw"

From a7c2f7ab59a7f9383cfada391539377bc9c586be Mon Sep 17 00:00:00 2001
From: Neal Oakey <neal.oakey@bingo-ev.de>
Date: Sun, 14 Feb 2016 23:11:03 +0100
Subject: [PATCH 03/35] add new UBNT images, as the detection now works

---
 targets/ar71xx-generic/profiles.mk | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/targets/ar71xx-generic/profiles.mk b/targets/ar71xx-generic/profiles.mk
index 23eefdd1..9125d9bf 100644
--- a/targets/ar71xx-generic/profiles.mk
+++ b/targets/ar71xx-generic/profiles.mk
@@ -149,12 +149,19 @@ $(eval $(call GluonModel,UBNT,ubnt-air-gateway,ubiquiti-airgateway))
 $(eval $(call GluonModel,UBNT,ubnt-airrouter,ubiquiti-airrouter))
 
 $(eval $(call GluonModel,UBNT,ubnt-bullet-m,ubiquiti-bullet-m))
-$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-loco-m))
-$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-picostation-m))
-$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-rocket-m))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-nanostation-loco-m2))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-nanostation-loco-m5))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-rocket-m2))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-rocket-m5))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-bullet-m2))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-bullet-m5))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-bullet-m,ubiquiti-picostation-m2))
+
+$(eval $(call GluonModel,UBNT,ubnt-nano-m,ubiquiti-nanostation-m))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-nanostation-m,ubiquiti-nanostation-m2))
+$(eval $(call GluonModelAlias,UBNT,ubiquiti-nanostation-m,ubiquiti-nanostation-m5))
 
 $(eval $(call GluonModel,UBNT,ubnt-loco-m-xw,ubiquiti-loco-m-xw))
-$(eval $(call GluonModel,UBNT,ubnt-nano-m,ubiquiti-nanostation-m))
 $(eval $(call GluonModel,UBNT,ubnt-nano-m-xw,ubiquiti-nanostation-m-xw))
 $(eval $(call GluonModel,UBNT,ubnt-uap-pro,ubiquiti-unifi-ap-pro))
 $(eval $(call GluonModel,UBNT,ubnt-unifi,ubiquiti-unifi))

From e4439a3fe40dc0b106c2c22e6c6c403e8a5a5c5e Mon Sep 17 00:00:00 2001
From: viisauksena <viisauksena@users.noreply.github.com>
Date: Tue, 23 Feb 2016 23:33:17 +0100
Subject: [PATCH 04/35] docs: fix typo in authorized keys config example

---
 docs/features/authorized-keys.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/features/authorized-keys.rst b/docs/features/authorized-keys.rst
index b3b0aaf6..2f23ded5 100644
--- a/docs/features/authorized-keys.rst
+++ b/docs/features/authorized-keys.rst
@@ -8,7 +8,7 @@ If you select this package, add a list of authorized keys to ``site.conf`` like
 
   {
     authorized_keys = { 'ssh-rsa AAA.... user1@host',
-                        'ssh-rsa AAA.... user2@host },
+                        'ssh-rsa AAA.... user2@host' },
     hostname_prefix = ...
     ...
 

From 56f1cd5383b8cb44174f618dfb566c8fc9f2262f Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Thu, 25 Feb 2016 22:50:58 +0100
Subject: [PATCH 05/35] firmware-utils: mkfwimage: fix firmware_max_length for
 XM layout

This should fix problems with flashing from AirOS 5.6.x.
---
 ...bvious-bugs-causing-compile-warnings.patch | 64 +++++++++++++++++++
 ...s-split-ubdev01-flash-layout-from-XM.patch | 39 +++++++++++
 ...ix-firmware_max_length-for-XM-layout.patch | 45 +++++++++++++
 3 files changed, 148 insertions(+)
 create mode 100644 patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch
 create mode 100644 patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch
 create mode 100644 patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch

diff --git a/patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch b/patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch
new file mode 100644
index 00000000..781fd5d4
--- /dev/null
+++ b/patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch
@@ -0,0 +1,64 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 25 Feb 2016 21:39:03 +0100
+Subject: firmware-utils: mkfwimage: add -Wall, fix obvious bugs causing compile warnings
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/tools/firmware-utils/Makefile b/tools/firmware-utils/Makefile
+index bd69cb4..6d88845 100644
+--- a/tools/firmware-utils/Makefile
++++ b/tools/firmware-utils/Makefile
+@@ -32,7 +32,7 @@ define Host/Compile
+ 	$(call cc,mkzynfw)
+ 	$(call cc,lzma2eva,-lz)
+ 	$(call cc,mkcasfw)
+-	$(call cc,mkfwimage,-lz)
++	$(call cc,mkfwimage,-lz -Wall)
+ 	$(call cc,mkfwimage2,-lz)
+ 	$(call cc,imagetag imagetag_cmdline cyg_crc32)
+ 	$(call cc,add_header)
+diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
+index e3a03c1..00bf439 100644
+--- a/tools/firmware-utils/src/mkfwimage.c
++++ b/tools/firmware-utils/src/mkfwimage.c
+@@ -104,8 +104,6 @@ typedef struct part_data {
+ 
+ #define OPTIONS "B:hv:m:o:r:k:"
+ 
+-static int debug = 0;
+-
+ typedef struct image_info {
+ 	char magic[16];
+ 	char version[256];
+@@ -236,9 +234,9 @@ static int create_image_layout(const char* kernelfile, const char* rootfsfile, c
+ 	fw_layout_t* p;
+ 
+ 	p = &fw_layout_data[0];
+-	while ((strlen(p->name) != 0) && (strncmp(p->name, board_name, sizeof(board_name)) != 0))
++	while (*p->name && (strcmp(p->name, board_name) != 0))
+ 		p++;
+-	if (p->name == NULL) {
++	if (!*p->name) {
+ 		printf("BUG! Unable to find default fw layout!\n");
+ 		exit(-1);
+ 	}
+@@ -247,7 +245,7 @@ static int create_image_layout(const char* kernelfile, const char* rootfsfile, c
+ 	strcpy(kernel->partition_name, "kernel");
+ 	kernel->partition_index = 1;
+ 	kernel->partition_baseaddr = p->kern_start;
+-	if ( (kernel->partition_length = filelength(kernelfile)) < 0) return (-1);
++	if ( (kernel->partition_length = filelength(kernelfile)) == (u_int32_t)-1) return (-1);
+ 	kernel->partition_memaddr = p->kern_entry;
+ 	kernel->partition_entryaddr = p->kern_entry;
+ 	strncpy(kernel->filename, kernelfile, sizeof(kernel->filename));
+@@ -263,8 +261,8 @@ static int create_image_layout(const char* kernelfile, const char* rootfsfile, c
+ 	rootfs->partition_entryaddr = 0x00000000;
+ 	strncpy(rootfs->filename, rootfsfile, sizeof(rootfs->filename));
+ 
+-printf("kernel: %d 0x%08x\n", kernel->partition_length, kernel->partition_baseaddr);
+-printf("root: %d 0x%08x\n", rootfs->partition_length, rootfs->partition_baseaddr);
++	printf("kernel: %d 0x%08x\n", kernel->partition_length, kernel->partition_baseaddr);
++	printf("root: %d 0x%08x\n", rootfs->partition_length, rootfs->partition_baseaddr);
+ 	im->part_count = 2;
+ 
+ 	return 0;
diff --git a/patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch b/patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch
new file mode 100644
index 00000000..aa94ff83
--- /dev/null
+++ b/patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch
@@ -0,0 +1,39 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 25 Feb 2016 21:40:19 +0100
+Subject: ar71xx, firmware-utils: split ubdev01 flash layout from XM
+
+The ubdev01 profile defines its own MTDPARTS with smaller firmware
+partition, so give it its own UBNT_BOARD in mkfwimage.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
+index dd224d4..4aaa115 100644
+--- a/target/linux/ar71xx/image/Makefile
++++ b/target/linux/ar71xx/image/Makefile
+@@ -2031,7 +2031,7 @@ $(eval $(call SingleProfile,TPLINK-SAFELOADER,64kraw,CPE510,cpe210-220-510-520,C
+ $(eval $(call SingleProfile,UAPPRO,64k,UAPPRO,ubnt-uap-pro,UAP-PRO,ttyS0,115200,BZ,BZ,ar934x))
+ $(eval $(call SingleProfile,UAPPRO,64k,UBNTUNIFIOUTDOORPLUS,ubnt-unifi-outdoor-plus,UBNT-UOP,ttyS0,115200,BZ,BZ,ar7240))
+ 
+-$(eval $(call SingleProfile,UBDEV,64kraw,UBDEV01,ubdev01,UBNT-UF,ttyS0,115200,XM,XM,ar7240))
++$(eval $(call SingleProfile,UBDEV,64kraw,UBDEV01,ubdev01,UBNT-UF,ttyS0,115200,UBDEV01,XM,ar7240))
+ 
+ $(eval $(call SingleProfile,UBNT,64k,UBNTRS,ubnt-rs,UBNT-RS,ttyS0,115200,RS,RSx,ar7100))
+ $(eval $(call SingleProfile,UBNT,64k,UBNTRSPRO,ubnt-rspro,UBNT-RSPRO,ttyS0,115200,RSPRO,RSPRO,ar7100pro))
+diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
+index 00bf439..5dae284 100644
+--- a/tools/firmware-utils/src/mkfwimage.c
++++ b/tools/firmware-utils/src/mkfwimage.c
+@@ -81,6 +81,12 @@ fw_layout_t fw_layout_data[] = {
+ 		.kern_entry	=	0x80002000,
+ 		.firmware_max_length=	0x006A0000,
+ 	},
++	{
++		.name		=	"UBDEV01",
++		.kern_start	=	0x9f050000,
++		.kern_entry	=	0x80002000,
++		.firmware_max_length=	0x006A0000,
++	},
+ 	{	.name		=	"",
+ 	},
+ };
diff --git a/patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch b/patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch
new file mode 100644
index 00000000..ab1c34db
--- /dev/null
+++ b/patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch
@@ -0,0 +1,45 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 25 Feb 2016 21:42:14 +0100
+Subject: firmware-utils: mkfwimage: fix firmware_max_length for XM layout
+
+The new u-boot version bundled with the 5.6.x firmwares from Ubiquiti gets
+confused by the smaller rootfs partition size; this can lead to various
+issues:
+
+1. We've gotten reports that flashing from the 5.6.x stock firmware to
+   OpenWrt will brick devices; I wasn't able to reproduce this myself
+2. Flashing from 5.5.x stock firmware to OpenWrt and back to stock (via
+   TFTP recovery), following by an update to 5.6.x via web interface can
+   yield a bricked device with the following properties:
+   - It can't be booted without entering commands over a serial console, as
+     u-boot supplies the wrong MTD layout
+   - The web interface won't accept any image with the original flash
+     layout, so stock firmware upgrades are impossible
+   - As the TFTP recovery doesn't update u-boot, returning to the old
+     u-boot from firmware 5.5.x is impossible
+
+To recover from 2., creating an OpenWrt image which doesn't set u-boot as
+read-only and flashing a backup of the old u-boot from there is the only
+way known to me. (Fixing the mtdparts variable in u-boot-env from OpenWrt
+might also work; settings this from u-boot over serial didn't have
+any permanent effect.)
+
+Fix all of this by setting the correct flash layout also used by the stock
+firmware. Flashing has been tested from both firmware 5.5.x and 5.6.x. The
+fixed layout also matches the mtdparts defined by OpenWrt.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
+index 5dae284..d8d5239 100644
+--- a/tools/firmware-utils/src/mkfwimage.c
++++ b/tools/firmware-utils/src/mkfwimage.c
+@@ -79,7 +79,7 @@ fw_layout_t fw_layout_data[] = {
+ 		.name		=	"XM",
+ 		.kern_start	=	0x9f050000,
+ 		.kern_entry	=	0x80002000,
+-		.firmware_max_length=	0x006A0000,
++		.firmware_max_length=	0x00760000,
+ 	},
+ 	{
+ 		.name		=	"UBDEV01",

From 89b3dca8b5319657b37fa5ad736a65bef87f53e9 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Fri, 26 Feb 2016 04:39:50 +0100
Subject: [PATCH 06/35] kernel: disable software protection bits for macronix
 flash chips at init

The bootloader of AirOS 5.6.x doesn't remove the flash protection for us,
so we have to do this ourselves.
---
 ...its-for-macronix-flash-chips-at-init.patch | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch

diff --git a/patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch b/patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch
new file mode 100644
index 00000000..2b16474a
--- /dev/null
+++ b/patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch
@@ -0,0 +1,22 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Fri, 26 Feb 2016 04:24:06 +0100
+Subject: kernel: disable software protection bits for macronix flash chips at init
+
+Backport of r47626
+
+diff --git a/target/linux/generic/patches-3.18/465-m25p80-mx-disable-software-protection.patch b/target/linux/generic/patches-3.18/465-m25p80-mx-disable-software-protection.patch
+new file mode 100644
+index 0000000..d7d7eec
+--- /dev/null
++++ b/target/linux/generic/patches-3.18/465-m25p80-mx-disable-software-protection.patch
+@@ -0,0 +1,10 @@
++--- a/drivers/mtd/spi-nor/spi-nor.c
+++++ b/drivers/mtd/spi-nor/spi-nor.c
++@@ -962,6 +962,7 @@ int spi_nor_scan(struct spi_nor *nor, co
++ 
++ 	if (JEDEC_MFR(info->jedec_id) == CFI_MFR_ATMEL ||
++ 	    JEDEC_MFR(info->jedec_id) == CFI_MFR_INTEL ||
+++	    JEDEC_MFR(info->jedec_id) == CFI_MFR_MACRONIX ||
++ 	    JEDEC_MFR(info->jedec_id) == CFI_MFR_SST) {
++ 		write_enable(nor);
++ 		write_sr(nor, 0);

From 88bdc981088faeba82adb888c4472bfc59c29d96 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Fri, 26 Feb 2016 05:34:23 +0100
Subject: [PATCH 07/35] gluon-status-page: don't reset signal graphs on resize
 events if width hasn't changed

Mobile browsers will often show or hide the address bar while scrolling.
This causes resize events which would often reset the signal graphs.

Fixes #662
---
 package/gluon-status-page/src/js/lib/gui/signalgraph.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/gluon-status-page/src/js/lib/gui/signalgraph.js b/package/gluon-status-page/src/js/lib/gui/signalgraph.js
index 83732158..231ce628 100644
--- a/package/gluon-status-page/src/js/lib/gui/signalgraph.js
+++ b/package/gluon-status-page/src/js/lib/gui/signalgraph.js
@@ -110,7 +110,7 @@ define(function () {
     function resize() {
       var newWidth = canvas.parentNode.clientWidth
 
-      if (newWidth === 0)
+      if (newWidth === 0 || newWidth === canvas.width)
         return
 
       var lastImage = ctx.getImageData(0, 0, newWidth, canvas.height)

From d2ab15660588e93be3bd4baa44988ea4c1dbed2b Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 01:37:21 +0100
Subject: [PATCH 08/35] Update OpenWrt base

---
 modules                                       |   2 +-
 ...-mac80211-backport-from-trunk-r48681.patch | 164 ++++++------------
 2 files changed, 56 insertions(+), 110 deletions(-)

diff --git a/modules b/modules
index 5d951303..471ff93d 100644
--- a/modules
+++ b/modules
@@ -1,7 +1,7 @@
 GLUON_FEEDS='openwrt gluon routing luci'
 
 OPENWRT_REPO=git://git.openwrt.org/15.05/openwrt.git
-OPENWRT_COMMIT=c698aa66043a151ac76d19849be9ee24dfd78b72
+OPENWRT_COMMIT=a03a846c49c067048cd225d476a7adf91ef8ff03
 
 PACKAGES_OPENWRT_REPO=git://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_COMMIT=9622fe984bba3a4547f48bc507ebaba7637eb2b0
diff --git a/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch b/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
index 27c6da67..4c42c057 100644
--- a/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
+++ b/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
@@ -32234,69 +32234,14 @@ index 0000000..7ae8b1d
 ++#endif
 ++
 ++#endif /* __BCM47XX_NVRAM_H */
-diff --git a/target/linux/generic/patches-3.18/031-bcma-from-4.5.patch b/target/linux/generic/patches-3.18/031-bcma-from-4.5.patch
-new file mode 100644
-index 0000000..171395d
---- /dev/null
-+++ b/target/linux/generic/patches-3.18/031-bcma-from-4.5.patch
-@@ -0,0 +1,49 @@
-+--- a/drivers/bcma/main.c
-++++ b/drivers/bcma/main.c
-+@@ -637,11 +637,36 @@ static int bcma_device_uevent(struct dev
-+ 			      core->id.rev, core->id.class);
-+ }
-+ 
-+-static int __init bcma_modinit(void)
-++static unsigned int bcma_bus_registered;
-++
-++/*
-++ * If built-in, bus has to be registered early, before any driver calls
-++ * bcma_driver_register.
-++ * Otherwise registering driver would trigger BUG in driver_register.
-++ */
-++static int __init bcma_init_bus_register(void)
-+ {
-+ 	int err;
-+ 
-++	if (bcma_bus_registered)
-++		return 0;
-++
-+ 	err = bus_register(&bcma_bus_type);
-++	if (!err)
-++		bcma_bus_registered = 1;
-++
-++	return err;
-++}
-++#ifndef MODULE
-++fs_initcall(bcma_init_bus_register);
-++#endif
-++
-++/* Main initialization has to be done with SPI/mtd/NAND/SPROM available */
-++static int __init bcma_modinit(void)
-++{
-++	int err;
-++
-++	err = bcma_init_bus_register();
-+ 	if (err)
-+ 		return err;
-+ 
-+@@ -660,7 +685,7 @@ static int __init bcma_modinit(void)
-+ 
-+ 	return err;
-+ }
-+-fs_initcall(bcma_modinit);
-++module_init(bcma_modinit);
-+ 
-+ static void __exit bcma_modexit(void)
-+ {
 diff --git a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
-new file mode 100644
-index 0000000..a74d9ee
---- /dev/null
+index 8ec73d9..a74d9ee 100644
+--- a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
 +++ b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
-@@ -0,0 +1,444 @@
-+--- a/drivers/bcma/driver_chipcommon.c
-++++ b/drivers/bcma/driver_chipcommon.c
+@@ -1,6 +1,40 @@
+ --- a/drivers/bcma/driver_chipcommon.c
+ +++ b/drivers/bcma/driver_chipcommon.c
+-@@ -190,6 +190,7 @@ u32 bcma_chipco_watchdog_timer_set(struc
 +@@ -15,6 +15,8 @@
 + #include <linux/platform_device.h>
 + #include <linux/bcma/bcma.h>
@@ -32332,13 +32277,13 @@ index 0000000..a74d9ee
 +-		bcma_cc_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
 ++		bcma_pmu_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
 + 	} else {
-+ 		struct bcma_bus *bus = cc->core->bus;
-+ 
-+ 		if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4707 &&
-++		    bus->chipinfo.id != BCMA_CHIP_ID_BCM47094 &&
-+ 		    bus->chipinfo.id != BCMA_CHIP_ID_BCM53018)
-+ 			bcma_core_set_clockmode(cc->core,
-+ 						ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC);
+  		struct bcma_bus *bus = cc->core->bus;
+  
+  		if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4707 &&
+@@ -8,6 +42,232 @@
+  		    bus->chipinfo.id != BCMA_CHIP_ID_BCM53018)
+  			bcma_core_set_clockmode(cc->core,
+  						ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC);
 +@@ -314,9 +322,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcm
 + 	return res;
 + }
@@ -32565,28 +32510,41 @@ index 0000000..a74d9ee
 ++	bcma_pmu_write32(cc, BCMA_CC_PMU_CTL, tmp);
 + }
 + EXPORT_SYMBOL_GPL(bcma_pmu_spuravoid_pllupdate);
-+--- a/drivers/bcma/driver_chipcommon_sflash.c
-++++ b/drivers/bcma/driver_chipcommon_sflash.c
-+@@ -38,6 +38,7 @@ static const struct bcma_sflash_tbl_e bc
-+ 	{ "M25P32", 0x15, 0x10000, 64, },
-+ 	{ "M25P64", 0x16, 0x10000, 128, },
-+ 	{ "M25FL128", 0x17, 0x10000, 256, },
-++	{ "MX25L25635F", 0x18, 0x10000, 512, },
-+ 	{ NULL },
-+ };
-+ 
-+--- a/drivers/bcma/scan.c
-++++ b/drivers/bcma/scan.c
-+@@ -98,6 +98,9 @@ static const struct bcma_device_id_name
-+ 	{ BCMA_CORE_SHIM, "SHIM" },
-+ 	{ BCMA_CORE_PCIE2, "PCIe Gen2" },
-+ 	{ BCMA_CORE_ARM_CR4, "ARM CR4" },
-++	{ BCMA_CORE_GCI, "GCI" },
-++	{ BCMA_CORE_CMEM, "CNDS DDR2/3 memory controller" },
-++	{ BCMA_CORE_ARM_CA7, "ARM CA7" },
-+ 	{ BCMA_CORE_DEFAULT, "Default" },
-+ };
-+ 
+ --- a/drivers/bcma/driver_chipcommon_sflash.c
+ +++ b/drivers/bcma/driver_chipcommon_sflash.c
+ @@ -38,6 +38,7 @@ static const struct bcma_sflash_tbl_e bc
+@@ -18,27 +278,6 @@
+  	{ NULL },
+  };
+  
+---- a/drivers/bcma/driver_gpio.c
+-+++ b/drivers/bcma/driver_gpio.c
+-@@ -229,6 +229,7 @@ int bcma_gpio_init(struct bcma_drv_cc *c
+- 	case BCMA_CHIP_ID_BCM4707:
+- 	case BCMA_CHIP_ID_BCM5357:
+- 	case BCMA_CHIP_ID_BCM53572:
+-+	case BCMA_CHIP_ID_BCM47094:
+- 		chip->ngpio	= 32;
+- 		break;
+- 	default:
+---- a/drivers/bcma/host_pci.c
+-+++ b/drivers/bcma/host_pci.c
+-@@ -294,7 +294,7 @@ static const struct pci_device_id bcma_p
+- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
+- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
+- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) },
+--	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4365) },
+-+	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) },
+- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) },
+- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
+- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
+ --- a/drivers/bcma/scan.c
+ +++ b/drivers/bcma/scan.c
+ @@ -98,6 +98,9 @@ static const struct bcma_device_id_name
+@@ -51,6 +290,32 @@
+  	{ BCMA_CORE_DEFAULT, "Default" },
+  };
+  
 +@@ -315,6 +318,8 @@ static int bcma_get_next_core(struct bcm
 + 		switch (core->id.id) {
 + 		case BCMA_CORE_4706_MAC_GBIT_COMMON:
@@ -32613,25 +32571,13 @@ index 0000000..a74d9ee
 + 		break;
 + #endif
 + #ifdef CONFIG_B43_SSB
-+--- a/include/linux/bcma/bcma.h
-++++ b/include/linux/bcma/bcma.h
-+@@ -151,6 +151,8 @@ struct bcma_host_ops {
-+ #define BCMA_CORE_PCIE2			0x83C	/* PCI Express Gen2 */
-+ #define BCMA_CORE_USB30_DEV		0x83D
-+ #define BCMA_CORE_ARM_CR4		0x83E
-++#define BCMA_CORE_GCI			0x840
-++#define BCMA_CORE_CMEM			0x846	/* CNDS DDR2/3 memory controller */
-+ #define BCMA_CORE_ARM_CA7		0x847
-+ #define BCMA_CORE_SYS_MEM		0x849
-+ #define BCMA_CORE_DEFAULT		0xFFF
-+@@ -199,6 +201,7 @@ struct bcma_host_ops {
-+ #define  BCMA_PKG_ID_BCM4707	1
-+ #define  BCMA_PKG_ID_BCM4708	2
-+ #define  BCMA_PKG_ID_BCM4709	0
-++#define BCMA_CHIP_ID_BCM47094	53030
-+ #define BCMA_CHIP_ID_BCM53018	53018
-+ 
-+ /* Board types (on PCI usually equals to the subsystem dev id) */
+ --- a/include/linux/bcma/bcma.h
+ +++ b/include/linux/bcma/bcma.h
+ @@ -151,6 +151,8 @@ struct bcma_host_ops {
+@@ -70,3 +335,110 @@
+  #define BCMA_CHIP_ID_BCM53018	53018
+  
+  /* Board types (on PCI usually equals to the subsystem dev id) */
 +--- a/include/linux/bcma/bcma_driver_chipcommon.h
 ++++ b/include/linux/bcma/bcma_driver_chipcommon.h
 +@@ -217,6 +217,11 @@

From c9f7a17d3ad0d16e3ff79229ae120193ba480927 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 02:30:34 +0100
Subject: [PATCH 09/35] brcm2708-gpu-fw: move pkg build dir to kernel build dir
 to fix rebuild bugs after cleaning the kernel tree

Backport of r48732
---
 ...-bugs-after-cleaning-the-kernel-tree.patch | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch

diff --git a/patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch b/patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch
new file mode 100644
index 00000000..1fab9e46
--- /dev/null
+++ b/patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch
@@ -0,0 +1,19 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sun, 28 Feb 2016 02:29:56 +0100
+Subject: brcm2708-gpu-fw: move pkg build dir to kernel build dir to fix rebuild bugs after cleaning the kernel tree
+
+Backport of r48732
+
+diff --git a/package/kernel/brcm2708-gpu-fw/Makefile b/package/kernel/brcm2708-gpu-fw/Makefile
+index eee85e0..286984b 100644
+--- a/package/kernel/brcm2708-gpu-fw/Makefile
++++ b/package/kernel/brcm2708-gpu-fw/Makefile
+@@ -16,7 +16,7 @@ PKG_SOURCE:=$(PKG_REV).tar.gz
+ PKG_SOURCE_URL:=https://github.com/Hexxeh/rpi-firmware/archive/
+ PKG_MD5SUM:=f5683c1dcb255714942f7c9fd61b3a0a
+ 
+-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/rpi-firmware-$(PKG_REV)
++PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_NAME)/rpi-firmware-$(PKG_REV)
+ 
+ include $(INCLUDE_DIR)/package.mk
+ 

From 00b620ae516689a20e1e03b4e35225bded18ea8e Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 03:27:49 +0100
Subject: [PATCH 10/35] Update mac80211 backport to r48810

---
 ...mac80211-backport-from-trunk-r48810.patch} | 692 ++++++++++++++----
 1 file changed, 559 insertions(+), 133 deletions(-)
 rename patches/openwrt/{0007-mac80211-backport-from-trunk-r48681.patch => 0007-mac80211-backport-from-trunk-r48810.patch} (98%)

diff --git a/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch b/patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch
similarity index 98%
rename from patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
rename to patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch
index 4c42c057..39e628b4 100644
--- a/patches/openwrt/0007-mac80211-backport-from-trunk-r48681.patch
+++ b/patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch
@@ -1,6 +1,6 @@
 From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Tue, 23 Dec 2014 18:57:16 +0100
-Subject: mac80211: backport from trunk r48681
+Date: Sun, 28 Feb 2016 03:14:24 +0100
+Subject: mac80211: backport from trunk r48810
 
 Backport mac80211 and dependent drivers/firmwares from OpenWrt trunk.
 
@@ -630,10 +630,10 @@ index 0000000..f5adfaf
 +$(eval $(call BuildPackage,iwlwifi-firmware))
 diff --git a/package/firmware/linux-firmware/marvell.mk b/package/firmware/linux-firmware/marvell.mk
 new file mode 100644
-index 0000000..86c0e6f
+index 0000000..752a8e0
 --- /dev/null
 +++ b/package/firmware/linux-firmware/marvell.mk
-@@ -0,0 +1,46 @@
+@@ -0,0 +1,56 @@
 +Package/mwl8k-firmware = $(call Package/firmware-default,Marvell 8366/8687 firmware)
 +define Package/mwl8k-firmware/install
 +	$(INSTALL_DIR) $(1)/lib/firmware/mwl8k
@@ -680,6 +680,16 @@ index 0000000..86c0e6f
 +endef
 +$(eval $(call BuildPackage,libertas-sdio-firmware))
 +
++Package/libertas-spi-firmware = $(call Package/firmware-default,Marvell 8686 SPI firmware)
++define Package/libertas-spi-firmware/install
++	$(INSTALL_DIR) $(1)/lib/firmware/libertas
++	$(INSTALL_DATA) \
++		$(PKG_BUILD_DIR)/libertas/gspi8686_v9_helper.bin \
++		$(PKG_BUILD_DIR)/libertas/gspi8686_v9.bin \
++		$(1)/lib/firmware/libertas
++endef
++$(eval $(call BuildPackage,libertas-spi-firmware))
++
 diff --git a/package/firmware/linux-firmware/mediatek.mk b/package/firmware/linux-firmware/mediatek.mk
 new file mode 100644
 index 0000000..591ffee
@@ -1150,7 +1160,7 @@ index 0000000..ee92b94
 + int acx_recover_hw(acx_device_t *adev);
 + 
 diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
-index a1eedce..156ea01 100644
+index a1eedce..525537c 100644
 --- a/package/kernel/mac80211/Makefile
 +++ b/package/kernel/mac80211/Makefile
 @@ -10,11 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
@@ -1187,7 +1197,7 @@ index a1eedce..156ea01 100644
 +	iwl-legacy iwl3945 iwl4965 iwlwifi \
 +	lib80211 \
 +	libipw ipw2100 ipw2200 \
-+	libertas-sdio libertas-usb \
++	libertas-sdio libertas-usb libertas-spi \
 +	mac80211-hwsim \
 +	mt7601u \
 +	mwl8k mwifiex-pcie \
@@ -2623,7 +2633,7 @@ index a1eedce..156ea01 100644
    AUTOLOAD:=$(call AutoProbe,iwl4965)
  endef
  
-@@ -975,557 +867,562 @@ define KernelPackage/iwl4965/description
+@@ -975,557 +867,576 @@ define KernelPackage/iwl4965/description
  endef
  
  
@@ -2764,13 +2774,6 @@ index a1eedce..156ea01 100644
 -  FILE:=$(PKG_B43_FWV4_SOURCE)
 -  URL:=$(PKG_B43_FWV4_SOURCE_URL)
 -  MD5SUM:=$(PKG_B43_FWV4_MD5SUM)
--endef
--$(eval $(call Download,b43))
--
--define Download/b43legacy
--  FILE:=$(PKG_B43_FWV3_SOURCE)
--  URL:=$(PKG_B43_FWV3_SOURCE_URL)
--  MD5SUM:=$(PKG_B43_FWV3_MD5SUM)
 +	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
 +	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
 +	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_ccmp.ko \
@@ -2782,11 +2785,26 @@ index a1eedce..156ea01 100644
 +	lib80211_crypt_tkip \
 +  )
  endef
+-$(eval $(call Download,b43))
+ 
+-define Download/b43legacy
+-  FILE:=$(PKG_B43_FWV3_SOURCE)
+-  URL:=$(PKG_B43_FWV3_SOURCE_URL)
+-  MD5SUM:=$(PKG_B43_FWV3_MD5SUM)
++define KernelPackage/lib80211/description
++ Kernel modules for 802.11 Networking stack
++ Includes:
++ - lib80211
++ - lib80211_crypt_wep
++ - lib80211_crypt_tkip
++ - lib80211_crytp_ccmp
+ endef
 -$(eval $(call Download,b43legacy))
  
--
+ 
 -define KernelPackage/b43
--  $(call KernelPackage/mac80211/Default)
++define KernelPackage/libipw
+   $(call KernelPackage/mac80211/Default)
 -  TITLE:=Broadcom 43xx wireless support
 -  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
 -  KCONFIG:= \
@@ -2799,15 +2817,8 @@ index a1eedce..156ea01 100644
 -  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43/b43.ko
 -  AUTOLOAD:=$(call AutoProbe,b43)
 -  MENU:=1
-+define KernelPackage/lib80211/description
-+ Kernel modules for 802.11 Networking stack
-+ Includes:
-+ - lib80211
-+ - lib80211_crypt_wep
-+ - lib80211_crypt_tkip
-+ - lib80211_crytp_ccmp
- endef
- 
+-endef
+-
 -define KernelPackage/b43/config
 -
 -config PACKAGE_B43_USE_SSB
@@ -2825,36 +2836,29 @@ index a1eedce..156ea01 100644
 -	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
 -
 -  if PACKAGE_kmod-b43
- 
--	choice
--		prompt "b43 firmware version"
--		default B43_FW_5_100_138
--		help
--		  This option allows you to select the version of the b43 firmware.
-+define KernelPackage/libipw
-+  $(call KernelPackage/mac80211/Default)
 +  TITLE:=libipw for ipw2100 and ipw2200
 +  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
 +  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
 +  AUTOLOAD:=$(call AutoProbe,libipw)
 +endef
  
--	config B43_FW_4_150
--		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
+-	choice
+-		prompt "b43 firmware version"
+-		default B43_FW_5_100_138
 -		help
--		  Old stable firmware for BCM43xx devices.
+-		  This option allows you to select the version of the b43 firmware.
 +define KernelPackage/libipw/description
 + Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
 +endef
  
--		  If unsure, select this.
+-	config B43_FW_4_150
+-		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
+-		help
+-		  Old stable firmware for BCM43xx devices.
 +IPW2100_NAME:=ipw2100-fw
 +IPW2100_VERSION:=1.3
  
--	config B43_FW_4_178
--		bool "Firmware 478.104 from driver 4.178.10.4"
--		help
--		  Older firmware for BCM43xx devices.
+-		  If unsure, select this.
 +define Download/ipw2100
 +  URL:=http://bughost.org/firmware/
 +  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
@@ -2862,7 +2866,10 @@ index a1eedce..156ea01 100644
 +endef
 +$(eval $(call Download,ipw2100))
  
--		  If unsure, select the "stable" firmware.
+-	config B43_FW_4_178
+-		bool "Firmware 478.104 from driver 4.178.10.4"
+-		help
+-		  Older firmware for BCM43xx devices.
 +define KernelPackage/ipw2100
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Intel IPW2100 driver
@@ -2871,24 +2878,21 @@ index a1eedce..156ea01 100644
 +  AUTOLOAD:=$(call AutoProbe,ipw2100)
 +endef
  
--	config B43_FW_5_10
--		bool "Firmware 508.1084 from driver 5.10.56.27"
--		help
--		  Older firmware for BCM43xx devices.
+-		  If unsure, select the "stable" firmware.
 +define KernelPackage/ipw2100/description
 + Kernel support for Intel IPW2100
 + Includes:
 + - ipw2100
 +endef
  
--		  If unsure, select the "stable" firmware.
+-	config B43_FW_5_10
+-		bool "Firmware 508.1084 from driver 5.10.56.27"
+-		help
+-		  Older firmware for BCM43xx devices.
 +IPW2200_NAME:=ipw2200-fw
 +IPW2200_VERSION:=3.1
  
--	config B43_FW_5_100_138
--		bool "Firmware 666.2 from driver 5.100.138 (stable)"
--		help
--		  The currently default firmware for BCM43xx devices.
+-		  If unsure, select the "stable" firmware.
 +define Download/ipw2200
 +  URL:=http://bughost.org/firmware/
 +  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
@@ -2896,7 +2900,10 @@ index a1eedce..156ea01 100644
 +endef
 +$(eval $(call Download,ipw2200))
  
--		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
+-	config B43_FW_5_100_138
+-		bool "Firmware 666.2 from driver 5.100.138 (stable)"
+-		help
+-		  The currently default firmware for BCM43xx devices.
 +define KernelPackage/ipw2200
 +  $(call KernelPackage/mac80211/Default)
 +  TITLE:=Intel IPW2200 driver
@@ -2905,19 +2912,19 @@ index a1eedce..156ea01 100644
 +  AUTOLOAD:=$(call AutoProbe,ipw2200)
 +endef
  
--		  If unsure, select the this firmware.
+-		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
 +define KernelPackage/ipw2200/description
 + Kernel support for Intel IPW2200
 + Includes:
 + - ipw2200
 +endef
  
+-		  If unsure, select the this firmware.
+ 
 -	config B43_FW_6_30
 -		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
 -		help
 -		  Newer experimental firmware for BCM43xx devices.
- 
--		  This firmware is mostly untested.
 +define KernelPackage/libertas-usb
 +  $(call KernelPackage/mac80211/Default)
 +  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware
@@ -2928,7 +2935,7 @@ index a1eedce..156ea01 100644
 +  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
 +endef
  
--		  If unsure, select the "stable" firmware.
+-		  This firmware is mostly untested.
 +define KernelPackage/libertas-sdio
 +  $(call KernelPackage/mac80211/Default)
 +  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware
@@ -2939,6 +2946,21 @@ index a1eedce..156ea01 100644
 +  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
 +endef
  
+-		  If unsure, select the "stable" firmware.
++define KernelPackage/libertas-spi
++  $(call KernelPackage/mac80211/Default)
++  SUBMENU:=Wireless Drivers
++  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-spi-firmware
++  KCONFIG := \
++	CONFIG_SPI=y \
++	CONFIG_SPI_MASTER=y
++  TITLE:=Marvell 88W8686 SPI Wireless Driver
++  FILES:= \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
++	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
++  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
++endef
+ 
 -	config B43_OPENFIRMWARE
 -		bool "Open FirmWare for WiFi networks"
 -		help
@@ -3632,7 +3654,7 @@ index a1eedce..156ea01 100644
  config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
  
  config-y:= \
-@@ -1538,6 +1435,20 @@ config-y:= \
+@@ -1538,6 +1449,20 @@ config-y:= \
  	MAC80211_RC_MINSTREL_HT \
  	MAC80211_RC_MINSTREL_VHT \
  	MAC80211_RC_DEFAULT_MINSTREL \
@@ -3653,7 +3675,7 @@ index a1eedce..156ea01 100644
  
  config-$(call config_package,cfg80211) += CFG80211
  
-@@ -1554,6 +1465,16 @@ ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
+@@ -1554,6 +1479,16 @@ ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
  	ATH5K_DEBUG
  endif
  
@@ -3670,7 +3692,7 @@ index a1eedce..156ea01 100644
  config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_CRYPT_CCMP LIB80211_CRYPT_TKIP
  
  config-$(call config_package,ath) += ATH_CARDS ATH_COMMON
-@@ -1602,6 +1523,8 @@ config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
+@@ -1602,6 +1537,8 @@ config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
  config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
  
  config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
@@ -3679,7 +3701,7 @@ index a1eedce..156ea01 100644
  
  config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
  config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
-@@ -1623,26 +1546,28 @@ config-$(call config_package,rt2800-pci) += RT2800PCI
+@@ -1623,31 +1560,34 @@ config-$(call config_package,rt2800-pci) += RT2800PCI
  config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
  
  config-$(call config_package,rt2800-usb) += RT2800USB
@@ -3717,7 +3739,13 @@ index a1eedce..156ea01 100644
  config-y += HERMES_PRISM
  
  config-$(call config_package,adm8211) += ADM8211
-@@ -1668,12 +1593,15 @@ config-$(call config_package,rtl8192de) += RTL8192DE
+ config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
+ config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
++config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
+ config-$(call config_package,mwl8k) += MWL8K
+ config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
+ config-$(call config_package,rtl8180) += RTL8180
+@@ -1668,12 +1608,15 @@ config-$(call config_package,rtl8192de) += RTL8192DE
  config-$(call config_package,rtl8192cu) += RTL8192CU
  config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
  
@@ -3734,7 +3762,7 @@ index a1eedce..156ea01 100644
  	KLIB_BUILD="$(LINUX_DIR)" \
  	MODPROBE=true \
  	KLIB=$(TARGET_MODULES_DIR) \
-@@ -1702,8 +1630,6 @@ define Build/Prepare
+@@ -1702,8 +1645,6 @@ define Build/Prepare
  	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
  	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
  	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
@@ -3743,7 +3771,7 @@ index a1eedce..156ea01 100644
  	rm -rf \
  		$(PKG_BUILD_DIR)/include/linux/ssb \
  		$(PKG_BUILD_DIR)/include/linux/bcma \
-@@ -1715,7 +1641,8 @@ define Build/Prepare
+@@ -1715,7 +1656,8 @@ define Build/Prepare
  		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
  		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
  		$(PKG_BUILD_DIR)/include/linux/spi/libertas_spi.h \
@@ -3753,7 +3781,7 @@ index a1eedce..156ea01 100644
  
  	echo 'compat-wireless-$(PKG_VERSION)-$(PKG_RELEASE)-$(REVISION)' > $(PKG_BUILD_DIR)/compat_version
  	$(CP) ./files/regdb.txt $(PKG_BUILD_DIR)/net/wireless/db.txt
-@@ -1753,220 +1680,6 @@ define Build/InstallDev
+@@ -1753,220 +1695,6 @@ define Build/InstallDev
  	rm -f $(1)/usr/include/mac80211-backport/linux/module.h
  endef
  
@@ -3974,7 +4002,7 @@ index a1eedce..156ea01 100644
  
  define KernelPackage/b43/install
  	rm -rf $(1)/lib/firmware/
-@@ -1990,51 +1703,84 @@ ifneq ($(CONFIG_B43_FW_SQUASH),)
+@@ -1990,51 +1718,85 @@ ifneq ($(CONFIG_B43_FW_SQUASH),)
  endif
  endef
  
@@ -4077,6 +4105,7 @@ index a1eedce..156ea01 100644
  $(eval $(call KernelPackage,libertas-usb))
  $(eval $(call KernelPackage,libertas-sdio))
 -$(eval $(call KernelPackage,cfg80211))
++$(eval $(call KernelPackage,libertas-spi))
 +$(eval $(call KernelPackage,libipw))
 +$(eval $(call KernelPackage,ipw2100))
 +$(eval $(call KernelPackage,ipw2200))
@@ -4088,7 +4117,7 @@ index a1eedce..156ea01 100644
  $(eval $(call KernelPackage,p54-common))
  $(eval $(call KernelPackage,p54-pci))
  $(eval $(call KernelPackage,p54-usb))
-@@ -2047,12 +1793,12 @@ $(eval $(call KernelPackage,rt2800-lib))
+@@ -2047,12 +1809,12 @@ $(eval $(call KernelPackage,rt2800-lib))
  $(eval $(call KernelPackage,rt2400-pci))
  $(eval $(call KernelPackage,rt2500-pci))
  $(eval $(call KernelPackage,rt2500-usb))
@@ -4103,7 +4132,7 @@ index a1eedce..156ea01 100644
  $(eval $(call KernelPackage,rtl8180))
  $(eval $(call KernelPackage,rtl8187))
  $(eval $(call KernelPackage,rtlwifi))
-@@ -2063,32 +1809,8 @@ $(eval $(call KernelPackage,rtl8192ce))
+@@ -2063,32 +1825,8 @@ $(eval $(call KernelPackage,rtl8192ce))
  $(eval $(call KernelPackage,rtl8192se))
  $(eval $(call KernelPackage,rtl8192de))
  $(eval $(call KernelPackage,rtl8192cu))
@@ -9606,6 +9635,155 @@ index d132636..0000000
 - 
 - #define BW_20			0
 - #define BW_40			1
+diff --git a/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
+new file mode 100644
+index 0000000..d9511c8
+--- /dev/null
++++ b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
+@@ -0,0 +1,19 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Fri, 15 Jan 2016 15:59:45 +0100
++Subject: [PATCH] brcmfmac: add missing include
++
++linux/module.h is required for defining module parameters
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++@@ -17,6 +17,7 @@
++ #include <linux/kernel.h>
++ #include <linux/string.h>
++ #include <linux/netdevice.h>
+++#include <linux/module.h>
++ #include <brcmu_wifi.h>
++ #include <brcmu_utils.h>
++ #include "core.h"
+diff --git a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
+new file mode 100644
+index 0000000..711e019
+--- /dev/null
++++ b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
+@@ -0,0 +1,118 @@
++From: Hante Meuleman <meuleman@broadcom.com>
++Date: Tue, 19 Jan 2016 12:39:24 +0100
++Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash
++
++With commit 7d34b0560567 ("brcmfmac: Move all module parameters to
++one place") a bug was introduced causing a null pointer exception.
++This patch fixes the bug by initializing the sg table till after
++the settings have been initialized.
++
++Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place")
++Reported-by: Marc Zyngier <marc.zyngier@arm.com>
++Tested-by: Marc Zyngier <marc.zyngier@arm.com>
++Reviewed-by: Arend Van Spriel <arend@broadcom.com>
++Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
++Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
++Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
++Signed-off-by: Arend van Spriel <arend@broadcom.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
++ 	return 0;
++ }
++ 
++-static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
+++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
++ {
+++	struct sdio_func *func;
+++	struct mmc_host *host;
+++	uint max_blocks;
++ 	uint nents;
++ 	int err;
++ 
+++	func = sdiodev->func[2];
+++	host = func->card->host;
+++	sdiodev->sg_support = host->max_segs > 1;
+++	max_blocks = min_t(uint, host->max_blk_count, 511u);
+++	sdiodev->max_request_size = min_t(uint, host->max_req_size,
+++					  max_blocks * func->cur_blksize);
+++	sdiodev->max_segment_count = min_t(uint, host->max_segs,
+++					   SG_MAX_SINGLE_ALLOC);
+++	sdiodev->max_segment_size = host->max_seg_size;
+++
++ 	if (!sdiodev->sg_support)
++ 		return;
++ 
++@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc
++ 
++ static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
++ {
++-	struct sdio_func *func;
++-	struct mmc_host *host;
++-	uint max_blocks;
++ 	int ret = 0;
++ 
++ 	sdiodev->num_funcs = 2;
++@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm
++ 		goto out;
++ 	}
++ 
++-	/*
++-	 * determine host related variables after brcmf_sdiod_probe()
++-	 * as func->cur_blksize is properly set and F2 init has been
++-	 * completed successfully.
++-	 */
++-	func = sdiodev->func[2];
++-	host = func->card->host;
++-	sdiodev->sg_support = host->max_segs > 1;
++-	max_blocks = min_t(uint, host->max_blk_count, 511u);
++-	sdiodev->max_request_size = min_t(uint, host->max_req_size,
++-					  max_blocks * func->cur_blksize);
++-	sdiodev->max_segment_count = min_t(uint, host->max_segs,
++-					   SG_MAX_SINGLE_ALLOC);
++-	sdiodev->max_segment_size = host->max_seg_size;
++-
++-	/* allocate scatter-gather table. sg support
++-	 * will be disabled upon allocation failure.
++-	 */
++-	brcmf_sdiod_sgtable_alloc(sdiodev);
++-
++ 	ret = brcmf_sdiod_freezer_attach(sdiodev);
++ 	if (ret)
++ 		goto out;
++@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm
++ 		ret = -ENODEV;
++ 		goto out;
++ 	}
++-	brcmf_sdiod_host_fixup(host);
+++	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
++ out:
++ 	if (ret)
++ 		brcmf_sdiod_remove(sdiodev);
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
++ 		goto fail;
++ 	}
++ 
+++	/* allocate scatter-gather table. sg support
+++	 * will be disabled upon allocation failure.
+++	 */
+++	brcmf_sdiod_sgtable_alloc(bus->sdiodev);
+++
++ 	/* Query the F2 block size, set roundup accordingly */
++ 	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
++ 	bus->roundup = min(max_roundup, bus->blocksize);
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
++ 
++ /* Issue an abort to the specified function */
++ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
+++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
++ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
++ 			      enum brcmf_sdiod_state state);
++ #ifdef CONFIG_PM_SLEEP
 diff --git a/package/kernel/mac80211/patches/309-ath9k-disable-TPC-support-again-for-now.patch b/package/kernel/mac80211/patches/309-ath9k-disable-TPC-support-again-for-now.patch
 deleted file mode 100644
 index 945fbce..0000000
@@ -9634,31 +9812,6 @@ index 945fbce..0000000
 - 
 - 	ah->ani_function = ATH9K_ANI_ALL;
 - 	if (!AR_SREV_9300_20_OR_LATER(ah))
-diff --git a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch
-new file mode 100644
-index 0000000..d9511c8
---- /dev/null
-+++ b/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch
-@@ -0,0 +1,19 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Fri, 15 Jan 2016 15:59:45 +0100
-+Subject: [PATCH] brcmfmac: add missing include
-+
-+linux/module.h is required for defining module parameters
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+@@ -17,6 +17,7 @@
-+ #include <linux/kernel.h>
-+ #include <linux/string.h>
-+ #include <linux/netdevice.h>
-++#include <linux/module.h>
-+ #include <brcmu_wifi.h>
-+ #include <brcmu_utils.h>
-+ #include "core.h"
 diff --git a/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch b/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
 new file mode 100644
 index 0000000..287d6e1
@@ -11953,10 +12106,10 @@ index 7247369..0000000
 - 	for (i = 0; i < ARRAY_SIZE(regList); i++)
 diff --git a/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
 new file mode 100644
-index 0000000..d55f772
+index 0000000..e7bfb9c
 --- /dev/null
 +++ b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
-@@ -0,0 +1,292 @@
+@@ -0,0 +1,317 @@
 +From: Felix Fietkau <nbd@openwrt.org>
 +Date: Fri, 5 Feb 2016 01:38:51 +0100
 +Subject: [PATCH] mac80211: add A-MSDU tx support
@@ -11985,12 +12138,31 @@ index 0000000..d55f772
 + };
 + 
 + /*
-+@@ -1961,6 +1963,12 @@ struct ieee80211_txq {
++@@ -1728,6 +1730,7 @@ struct ieee80211_sta_rates {
++  *		  size is min(max_amsdu_len, 7935) bytes.
++  *	Both additional HT limits must be enforced by the low level driver.
++  *	This is defined by the spec (IEEE 802.11-2012 section 8.3.2.2 NOTE 2).
+++ * @max_rc_amsdu_len: Maximum A-MSDU size in bytes recommended by rate control.
++  * @txq: per-TID data TX queues (if driver uses the TXQ abstraction)
++  */
++ struct ieee80211_sta {
++@@ -1748,6 +1751,7 @@ struct ieee80211_sta {
++ 	bool mfp;
++ 	u8 max_amsdu_subframes;
++ 	u16 max_amsdu_len;
+++	u16 max_rc_amsdu_len;
++ 
++ 	struct ieee80211_txq *txq[IEEE80211_NUM_TIDS];
++ 
++@@ -1961,6 +1965,15 @@ struct ieee80211_txq {
 +  *	order and does not need to manage its own reorder buffer or BA session
 +  *	timeout.
 +  *
 ++ * @IEEE80211_HW_TX_AMSDU: Hardware (or driver) supports software aggregated
-++ *	A-MSDU frames. Requires software tx queueing support.
+++ *	A-MSDU frames. Requires software tx queueing and fast-xmit support.
+++ *	When not using minstrel/minstrel_ht rate control, the driver should
+++ *	limit the maximum A-MSDU size based on the current tx rate by setting
+++ *	max_rc_amsdu_len in struct ieee80211_sta.
 ++ *
 ++ * @IEEE80211_HW_TX_FRAG_LIST: Hardware (or driver) supports sending frag_list
 ++ *	skbs, needed for zero-copy software A-MSDU.
@@ -11998,7 +12170,7 @@ index 0000000..d55f772
 +  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
 +  */
 + enum ieee80211_hw_flags {
-+@@ -1998,6 +2006,8 @@ enum ieee80211_hw_flags {
++@@ -1998,6 +2011,8 @@ enum ieee80211_hw_flags {
 + 	IEEE80211_HW_BEACON_TX_STATUS,
 + 	IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR,
 + 	IEEE80211_HW_SUPPORTS_REORDERING_BUFFER,
@@ -12007,16 +12179,17 @@ index 0000000..d55f772
 + 
 + 	/* keep last, obviously */
 + 	NUM_IEEE80211_HW_FLAGS
-+@@ -2070,6 +2080,8 @@ enum ieee80211_hw_flags {
++@@ -2070,6 +2085,9 @@ enum ieee80211_hw_flags {
 +  *	size is smaller (an example is LinkSys WRT120N with FW v1.0.07
 +  *	build 002 Jun 18 2012).
 +  *
-++ * @max_tx_fragments: maximum fragments per (A-)MSDU.
+++ * @max_tx_fragments: maximum number of tx buffers per (A)-MSDU, sum
+++ *	of 1 + skb_shinfo(skb)->nr_frags for each skb in the frag_list.
 ++ *
 +  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
 +  *	(if %IEEE80211_HW_QUEUE_CONTROL is set)
 +  *
-+@@ -2124,6 +2136,7 @@ struct ieee80211_hw {
++@@ -2124,6 +2142,7 @@ struct ieee80211_hw {
 + 	u8 max_rate_tries;
 + 	u8 max_rx_aggregation_subframes;
 + 	u8 max_tx_aggregation_subframes;
@@ -12079,19 +12252,33 @@ index 0000000..d55f772
 + 	return skb;
 + }
 + EXPORT_SYMBOL(ieee80211_tx_dequeue);
-+@@ -2757,6 +2761,158 @@ void ieee80211_clear_fast_xmit(struct st
++@@ -2757,6 +2761,163 @@ void ieee80211_clear_fast_xmit(struct st
 + 		kfree_rcu(fast_tx, rcu_head);
 + }
 + 
-++static int ieee80211_amsdu_pad(struct sk_buff *skb, int subframe_len)
+++static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
+++					struct sk_buff *skb, int headroom,
+++					int *subframe_len)
 ++{
-++	int amsdu_len = subframe_len + sizeof(struct ethhdr);
+++	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
 ++	int padding = (4 - amsdu_len) & 3;
 ++
-++	if (padding)
-++		memset(skb_put(skb, padding), 0, padding);
+++	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
+++		I802_DEBUG_INC(local->tx_expand_skb_head);
 ++
-++	return padding;
+++		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
+++			wiphy_debug(local->hw.wiphy,
+++				    "failed to reallocate TX buffer\n");
+++			return false;
+++		}
+++	}
+++
+++	if (padding) {
+++		*subframe_len += padding;
+++		memset(skb_put(skb, padding), 0, padding);
+++	}
+++
+++	return true;
 ++}
 ++
 ++static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
@@ -12107,20 +12294,15 @@ index 0000000..d55f772
 ++	void *data;
 ++	u8 *qc;
 ++
+++	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
+++		return false;
+++
 ++	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
 ++		return true;
 ++
-++	if (skb_headroom(skb) < sizeof(amsdu_hdr) || skb_tailroom(skb) < 3) {
-++		I802_DEBUG_INC(local->tx_expand_skb_head);
-++
-++		if (pskb_expand_head(skb, sizeof(amsdu_hdr), 3, GFP_ATOMIC)) {
-++			wiphy_debug(local->hw.wiphy,
-++				    "failed to reallocate TX buffer\n");
-++			return false;
-++		}
-++	}
-++
-++	subframe_len += ieee80211_amsdu_pad(skb, subframe_len);
+++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(amsdu_hdr),
+++					 &subframe_len))
+++		return false;
 ++
 ++	amsdu_hdr.h_proto = cpu_to_be16(subframe_len);
 ++	memcpy(amsdu_hdr.h_source, skb->data + fast_tx->sa_offs, ETH_ALEN);
@@ -12152,7 +12334,7 @@ index 0000000..d55f772
 ++	int subframe_len = skb->len - ETH_ALEN;
 ++	u8 max_subframes = sta->sta.max_amsdu_subframes;
 ++	int max_frags = local->hw.max_tx_fragments;
-++	int max_amsdu_len;
+++	int max_amsdu_len = sta->sta.max_amsdu_len;
 ++	__be16 len;
 ++	void *data;
 ++	bool ret = false;
@@ -12168,6 +12350,10 @@ index 0000000..d55f772
 ++	if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
 ++		return false;
 ++
+++	if (sta->sta.max_rc_amsdu_len)
+++		max_amsdu_len = min_t(int, max_amsdu_len,
+++				      sta->sta.max_rc_amsdu_len);
+++
 ++	spin_lock_bh(&txqi->queue.lock);
 ++
 ++	head = skb_peek_tail(&txqi->queue);
@@ -12204,17 +12390,9 @@ index 0000000..d55f772
 ++	if (max_frags && nfrags > max_frags)
 ++		goto out;
 ++
-++	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 3) {
-++		I802_DEBUG_INC(local->tx_expand_skb_head);
-++
-++		if (pskb_expand_head(skb, 8, 3, GFP_ATOMIC)) {
-++			wiphy_debug(local->hw.wiphy,
-++				    "failed to reallocate TX buffer\n");
-++			goto out;
-++		}
-++	}
-++
-++	subframe_len += ieee80211_amsdu_pad(skb, subframe_len);
+++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
+++					 &subframe_len))
+++		return false;
 ++
 ++	ret = true;
 ++	data = skb_push(skb, ETH_ALEN + 2);
@@ -12223,7 +12401,7 @@ index 0000000..d55f772
 ++	data += 2 * ETH_ALEN;
 ++	len = cpu_to_be16(subframe_len);
 ++	memcpy(data, &len, 2);
-++	memcpy(data + 2, rfc1042_header, ETH_ALEN);
+++	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
 ++
 ++	head->len += skb->len;
 ++	head->data_len += skb->len;
@@ -12238,7 +12416,7 @@ index 0000000..d55f772
 + static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
 + 				struct net_device *dev, struct sta_info *sta,
 + 				struct ieee80211_fast_tx *fast_tx,
-+@@ -2811,6 +2967,10 @@ static bool ieee80211_xmit_fast(struct i
++@@ -2811,6 +2972,10 @@ static bool ieee80211_xmit_fast(struct i
 + 
 + 	ieee80211_tx_stats(dev, skb->len + extra_head);
 + 
@@ -12249,6 +12427,76 @@ index 0000000..d55f772
 + 	/* will not be crypto-handled beyond what we do here, so use false
 + 	 * as the may-encrypt argument for the resize to not account for
 + 	 * more room than we already have in 'extra_head'
+diff --git a/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch b/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
+new file mode 100644
+index 0000000..9277b2c
+--- /dev/null
++++ b/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
+@@ -0,0 +1,64 @@
++From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
++Date: Wed, 20 Jan 2016 16:46:04 +0100
++Subject: [PATCH] brcmfmac: fix setting primary channel for 80 MHz width
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++First of all it changes the way we calculate primary channel offset. If
++we use e.g. 80 MHz channel with primary frequency 5180 MHz (which means
++center frequency is 5210 MHz) it makes sense to calculate primary offset
++as -30 MHz.
++Then it fixes values we compare primary_offset with. We were comparing
++offset in MHz against -2 or 2 which was resulting in picking a wrong
++primary channel.
++
++Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
++Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
++---
++
++--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++@@ -247,7 +247,7 @@ static u16 chandef_to_chanspec(struct br
++ 	brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
++ 		  ch->chan->center_freq, ch->center_freq1, ch->width);
++ 	ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
++-	primary_offset = ch->center_freq1 - ch->chan->center_freq;
+++	primary_offset = ch->chan->center_freq - ch->center_freq1;
++ 	switch (ch->width) {
++ 	case NL80211_CHAN_WIDTH_20:
++ 	case NL80211_CHAN_WIDTH_20_NOHT:
++@@ -256,24 +256,21 @@ static u16 chandef_to_chanspec(struct br
++ 		break;
++ 	case NL80211_CHAN_WIDTH_40:
++ 		ch_inf.bw = BRCMU_CHAN_BW_40;
++-		if (primary_offset < 0)
+++		if (primary_offset > 0)
++ 			ch_inf.sb = BRCMU_CHAN_SB_U;
++ 		else
++ 			ch_inf.sb = BRCMU_CHAN_SB_L;
++ 		break;
++ 	case NL80211_CHAN_WIDTH_80:
++ 		ch_inf.bw = BRCMU_CHAN_BW_80;
++-		if (primary_offset < 0) {
++-			if (primary_offset < -CH_10MHZ_APART)
++-				ch_inf.sb = BRCMU_CHAN_SB_UU;
++-			else
++-				ch_inf.sb = BRCMU_CHAN_SB_UL;
++-		} else {
++-			if (primary_offset > CH_10MHZ_APART)
++-				ch_inf.sb = BRCMU_CHAN_SB_LL;
++-			else
++-				ch_inf.sb = BRCMU_CHAN_SB_LU;
++-		}
+++		if (primary_offset == -30)
+++			ch_inf.sb = BRCMU_CHAN_SB_LL;
+++		else if (primary_offset == -10)
+++			ch_inf.sb = BRCMU_CHAN_SB_LU;
+++		else if (primary_offset == 10)
+++			ch_inf.sb = BRCMU_CHAN_SB_UL;
+++		else
+++			ch_inf.sb = BRCMU_CHAN_SB_UU;
++ 		break;
++ 	case NL80211_CHAN_WIDTH_80P80:
++ 	case NL80211_CHAN_WIDTH_160:
 diff --git a/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch b/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
 new file mode 100644
 index 0000000..d7018da
@@ -14193,6 +14441,48 @@ index f26e059..0000000
 - }
 - 
 - static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
+diff --git a/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
+new file mode 100644
+index 0000000..f8f4f09
+--- /dev/null
++++ b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
+@@ -0,0 +1,36 @@
++From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
++Date: Wed, 10 Feb 2016 16:08:17 +0100
++Subject: [PATCH] mac80211: fix wiphy supported_band access
++
++Fix wiphy supported_band access in tx radiotap parsing. In particular,
++info->band is always set to 0 (IEEE80211_BAND_2GHZ) since it has not
++assigned yet. This cause a kernel crash on 5GHz only devices.
++Move ieee80211_parse_tx_radiotap() after info->band assignment
++
++Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
++---
++
++--- a/net/mac80211/tx.c
+++++ b/net/mac80211/tx.c
++@@ -1890,10 +1890,6 @@ netdev_tx_t ieee80211_monitor_start_xmit
++ 	info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
++ 		      IEEE80211_TX_CTL_INJECTED;
++ 
++-	/* process and remove the injection radiotap header */
++-	if (!ieee80211_parse_tx_radiotap(local, skb))
++-		goto fail;
++-
++ 	rcu_read_lock();
++ 
++ 	/*
++@@ -1955,6 +1951,10 @@ netdev_tx_t ieee80211_monitor_start_xmit
++ 		goto fail_rcu;
++ 
++ 	info->band = chandef->chan->band;
+++	/* process and remove the injection radiotap header */
+++	if (!ieee80211_parse_tx_radiotap(local, skb))
+++		goto fail_rcu;
+++
++ 	ieee80211_xmit(sdata, NULL, skb);
++ 	rcu_read_unlock();
++ 
 diff --git a/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch b/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch
 deleted file mode 100644
 index 5e63a80..0000000
@@ -14587,6 +14877,73 @@ index c9eb900..0000000
 - #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
 - 
 - #define SDIO_VENDOR_ID_INTEL			0x0089
+diff --git a/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch b/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch
+new file mode 100644
+index 0000000..acaacf7
+--- /dev/null
++++ b/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch
+@@ -0,0 +1,61 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Thu, 18 Feb 2016 19:30:05 +0100
++Subject: [PATCH] mac80211: minstrel_ht: set A-MSDU tx limits based on selected
++ max_prob_rate
++
++Prevents excessive A-MSDU aggregation at low data rates or bad
++conditions.
++
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/net/mac80211/rc80211_minstrel_ht.c
+++++ b/net/mac80211/rc80211_minstrel_ht.c
++@@ -883,6 +883,39 @@ minstrel_ht_set_rate(struct minstrel_pri
++ 	ratetbl->rate[offset].flags = flags;
++ }
++ 
+++static int
+++minstrel_ht_get_max_amsdu_len(struct minstrel_ht_sta *mi)
+++{
+++	int group = mi->max_prob_rate / MCS_GROUP_RATES;
+++	const struct mcs_group *g = &minstrel_mcs_groups[group];
+++	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
+++
+++	/* Disable A-MSDU if max_prob_rate is bad */
+++	if (mi->groups[group].rates[rate].prob_ewma < MINSTREL_FRAC(50, 100))
+++		return 1;
+++
+++	/* If the rate is slower than single-stream MCS1, make A-MSDU limit small */
+++	if (g->duration[rate] > MCS_DURATION(1, 0, 52))
+++		return 500;
+++
+++	/*
+++	 * If the rate is slower than single-stream MCS4, limit A-MSDU to usual
+++	 * data packet size
+++	 */
+++	if (g->duration[rate] > MCS_DURATION(1, 0, 104))
+++		return 1500;
+++
+++	/*
+++	 * If the rate is slower than single-stream MCS7, limit A-MSDU to twice
+++	 * the usual data packet size
+++	 */
+++	if (g->duration[rate] > MCS_DURATION(1, 0, 260))
+++		return 3000;
+++
+++	/* unlimited */
+++	return 0;
+++}
+++
++ static void
++ minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
++ {
++@@ -907,6 +940,7 @@ minstrel_ht_update_rates(struct minstrel
++ 		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
++ 	}
++ 
+++	mi->sta->max_rc_amsdu_len = minstrel_ht_get_max_amsdu_len(mi);
++ 	rates->rate[i].idx = -1;
++ 	rate_control_set_rates(mp->hw, mi->sta, rates);
++ }
 diff --git a/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch b/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch
 deleted file mode 100644
 index 7a688c4..0000000
@@ -15574,6 +15931,43 @@ index 1b10dbb..0000000
 - 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
 - 				/* Leave the device in state where it is
 - 				 * 'passive'. This is done by resetting all
+diff --git a/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch b/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch
+new file mode 100644
+index 0000000..32a2ad6
+--- /dev/null
++++ b/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch
+@@ -0,0 +1,31 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Thu, 18 Feb 2016 19:45:33 +0100
++Subject: [PATCH] mac80211: minstrel_ht: set default tx aggregation timeout to
++ 0
++
++The value 5000 was put here with the addition of the timeout field to
++ieee80211_start_tx_ba_session. It was originally added in mac80211 to
++save resources for drivers like iwlwifi, which only supports a limited
++number of concurrent aggregation sessions.
++
++Since iwlwifi does not use minstrel_ht and other drivers don't need
++this, 0 is a better default - especially since there have been
++recent reports of aggregation setup related issues reproduced with
++ath9k. This should improve stability without causing any adverse
++effects.
++
++Cc: stable@vger.kernel.org
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/net/mac80211/rc80211_minstrel_ht.c
+++++ b/net/mac80211/rc80211_minstrel_ht.c
++@@ -692,7 +692,7 @@ minstrel_aggr_check(struct ieee80211_sta
++ 	if (likely(sta->ampdu_mlme.tid_tx[tid]))
++ 		return;
++ 
++-	ieee80211_start_tx_ba_session(pubsta, tid, 5000);
+++	ieee80211_start_tx_ba_session(pubsta, tid, 0);
++ }
++ 
++ static void
 diff --git a/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch b/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch
 deleted file mode 100644
 index af76f13..0000000
@@ -16123,6 +16517,38 @@ index a62cfdf..0000000
 - 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
 - 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
 - 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
+diff --git a/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch b/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch
+new file mode 100644
+index 0000000..229351b
+--- /dev/null
++++ b/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch
+@@ -0,0 +1,26 @@
++From: Felix Fietkau <nbd@openwrt.org>
++Date: Wed, 24 Feb 2016 12:03:13 +0100
++Subject: [PATCH] mac80211: minstrel_ht: fix a logic error in RTS/CTS handling
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++RTS/CTS needs to be enabled if the rate is a fallback rate *or* if it's
++a dual-stream rate and the sta is in dynamic SMPS mode.
++
++Fixes: a3ebb4e1b763 ("mac80211: minstrel_ht: handle peers in dynamic SMPS")
++Reported-by: Matías Richart <mrichart@fing.edu.uy>
++Signed-off-by: Felix Fietkau <nbd@openwrt.org>
++---
++
++--- a/net/mac80211/rc80211_minstrel_ht.c
+++++ b/net/mac80211/rc80211_minstrel_ht.c
++@@ -872,7 +872,7 @@ minstrel_ht_set_rate(struct minstrel_pri
++ 	 *  - if station is in dynamic SMPS (and streams > 1)
++ 	 *  - for fallback rates, to increase chances of getting through
++ 	 */
++-	if (offset > 0 &&
+++	if (offset > 0 ||
++ 	    (mi->sta->smps_mode == IEEE80211_SMPS_DYNAMIC &&
++ 	     group->streams > 1)) {
++ 		ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
 diff --git a/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch b/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch
 deleted file mode 100644
 index 366ff85..0000000
@@ -31431,7 +31857,7 @@ index 14f8a00..95d93ae 100644
   	fwctx->bus_nr = bus_nr;
   
 diff --git a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
-index 32c4a6f..9aeb97e 100644
+index 32c4a6f..4295b4b 100644
 --- a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
 +++ b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
 @@ -8,9 +8,9 @@ Content-Transfer-Encoding: 8bit
@@ -31443,7 +31869,7 @@ index 32c4a6f..9aeb97e 100644
 -@@ -608,9 +608,37 @@ static struct wireless_dev *brcmf_cfg802
 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+@@ -618,9 +618,37 @@ static struct wireless_dev *brcmf_cfg802
++@@ -615,9 +615,37 @@ static struct wireless_dev *brcmf_cfg802
   						     u32 *flags,
   						     struct vif_params *params)
   {

From ec1c82566a20c10535a9aade5da0bfb6c8a1b09b Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 03:30:14 +0100
Subject: [PATCH 11/35] scripts/patch.sh: add --committer-date-is-author-date
 to `git am`

This option will make the generated commit IDs deterministic, greatly
reducing the number of repository objects created when calling `make
update` repeatedly.
---
 scripts/patch.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/patch.sh b/scripts/patch.sh
index 5f6e0b66..b89d6eb4 100755
--- a/scripts/patch.sh
+++ b/scripts/patch.sh
@@ -10,7 +10,7 @@ for module in $GLUON_MODULES; do
 	git checkout -B patching base
 
 	for patch in "$GLUONDIR"/patches/$module/*.patch; do
-		if ! git -c user.name='Gluon Patch Manager' -c user.email='gluon@void.example.com' am --whitespace=nowarn "$patch"; then
+		if ! git -c user.name='Gluon Patch Manager' -c user.email='gluon@void.example.com' am --whitespace=nowarn --committer-date-is-author-date "$patch"; then
 			git am --abort
 			git checkout patched
 			git branch -D patching

From b6c576645f4a4790e7ffe73bccf47c520a99e011 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 04:41:39 +0100
Subject: [PATCH 12/35] kernel/gpio_keys: load module on pre-init

fix rescue mode on wdr4900

Backport of r48793
---
 ...el-gpio_keys-load-module-on-pre-init.patch | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch

diff --git a/patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch b/patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch
new file mode 100644
index 00000000..cba048f6
--- /dev/null
+++ b/patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch
@@ -0,0 +1,21 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sun, 28 Feb 2016 03:42:29 +0100
+Subject: kernel/gpio_keys: load module on pre-init
+
+fix rescue mode on wdr4900
+
+Backport of r48793
+
+diff --git a/package/kernel/linux/modules/input.mk b/package/kernel/linux/modules/input.mk
+index 86ff33c..eed9aa2 100644
+--- a/package/kernel/linux/modules/input.mk
++++ b/package/kernel/linux/modules/input.mk
+@@ -75,7 +75,7 @@ define KernelPackage/input-gpio-keys
+ 	CONFIG_KEYBOARD_GPIO \
+ 	CONFIG_INPUT_KEYBOARD=y
+   FILES:=$(LINUX_DIR)/drivers/input/keyboard/gpio_keys.ko
+-  AUTOLOAD:=$(call AutoProbe,gpio_keys)
++  AUTOLOAD:=$(call AutoProbe,gpio_keys,1)
+ endef
+ 
+ define KernelPackage/input-gpio-keys/description

From ff574cfe6564374ac7e5cce57b2955039a029f44 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 05:00:50 +0100
Subject: [PATCH 13/35] ar71xx/lzma-loader: fix O32 ABI conformance

Backport of r48279
---
 ...-lzma-loader-fix-O32-ABI-conformance.patch | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch

diff --git a/patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch b/patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch
new file mode 100644
index 00000000..2d08f3b4
--- /dev/null
+++ b/patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch
@@ -0,0 +1,36 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sun, 28 Feb 2016 04:49:51 +0100
+Subject: ar71xx/lzma-loader: fix O32 ABI conformance
+
+According to the calling convention of the o32 ABI the caller
+function must reserve stack space for $a0-$a3 registers in case
+the callee needs to save its arguments.
+
+The assembly code of the loader does not reserve stack space for
+these registers thus when the 'loader_main' function needs to save
+its arguments, those will be stored in the 'workspace' area instead
+of the stack.
+
+Because the workspace area is also used by other part of the code, the
+saved register values gets overwritten and this often leads to failed
+kernel boots.
+
+Fix the code to reserve stack space for the registers to avoid this
+error.
+
+Backport of r48279
+
+diff --git a/target/linux/ar71xx/image/lzma-loader/src/head.S b/target/linux/ar71xx/image/lzma-loader/src/head.S
+index 543996a..47a7c9b 100644
+--- a/target/linux/ar71xx/image/lzma-loader/src/head.S
++++ b/target/linux/ar71xx/image/lzma-loader/src/head.S
+@@ -109,6 +109,9 @@ __bss_check:
+ 	/* Setup new "C" stack */
+ 	la	sp, _stack
+ 
++	/* reserve stack space for a0-a3 registers */
++	subu	sp, 16
++
+ 	/* jump to the decompressor routine */
+ 	la	t0, loader_main
+ 	jr	t0

From c7a957ca9f5b05803736e31d537d9a583fb9d8a5 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sat, 27 Feb 2016 20:37:46 +0100
Subject: [PATCH 14/35] ar71xx-generic: add support for Onion Omega

---
 targets/ar71xx-generic/profiles.mk | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/targets/ar71xx-generic/profiles.mk b/targets/ar71xx-generic/profiles.mk
index cb1d0ca4..7dd6bc5e 100644
--- a/targets/ar71xx-generic/profiles.mk
+++ b/targets/ar71xx-generic/profiles.mk
@@ -264,3 +264,9 @@ $(eval $(call GluonModel,MYNETN600,mynet-n600,wd-my-net-n600))
 # WD MyNet N750
 $(eval $(call GluonProfile,MYNETN750))
 $(eval $(call GluonModel,MYNETN750,mynet-n750,wd-my-net-n750))
+
+## Onion
+
+# Omega
+$(eval $(call GluonProfile,OMEGA))
+$(eval $(call GluonModel,OMEGA,onion-omega,onion-omega))

From 1e78665b12cc4fc7d5ea03c6b23f099c5ef44f3e Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 20:01:19 +0100
Subject: [PATCH 15/35] Add contrib/depdot.sh

This script will analyze the dependencies of Gluon's packages and output
them as a dot graph.
---
 contrib/depdot.sh | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100755 contrib/depdot.sh

diff --git a/contrib/depdot.sh b/contrib/depdot.sh
new file mode 100755
index 00000000..c065ea57
--- /dev/null
+++ b/contrib/depdot.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Script to output the dependency graph of Gluon's packages
+# Limitations:
+#  * Works only if directory names and package names are the same (true for all Gluon packages)
+#  * Doesn't show dependencies through virtual packages correctly
+
+
+
+shopt -s nullglob
+
+
+pushd "$(dirname "$0")/.." >/dev/null
+
+
+escape_name() {
+	echo -n "_$1" | tr -c '[:alnum:]' _
+}
+
+print_node () {
+	echo "$(escape_name "$1") [label=\"$1\", shape=box];"
+}
+
+print_dep() {
+	echo "$(escape_name "$1") -> $(escape_name "$2");"
+}
+
+echo 'digraph G {'
+
+for makefile in ./package/*/Makefile; do
+	dir="$(dirname "$makefile")"
+	package="$(basename "$dir")"
+
+	deps=$(grep -w DEPENDS "$makefile" | cut -d= -f2 | tr -d +)
+
+	print_node "$package"
+	for dep in $deps; do
+		print_node "$dep"
+		print_dep "$package" "$dep"
+	done
+done | sort -u
+
+popd >/dev/null
+
+echo '}'

From bb8d1783b38d1d1a1fcfb5500ef41d11cc978418 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 28 Feb 2016 22:38:19 +0100
Subject: [PATCH 16/35] gluon-config-mode-*, gluon-luci-portconfig: improve
 validation

Make bandwidth limits unsigned; trim numbers, the validator accepts
trailing whitespace.
---
 .../lib/gluon/config-mode/wizard/0400-geo-location.lua |  6 +++---
 .../lib/gluon/config-mode/wizard/0300-mesh-vpn.lua     |  8 ++++----
 .../usr/lib/lua/luci/model/cbi/admin/portconfig.lua    | 10 +++++-----
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/package/gluon-config-mode-geo-location/files/lib/gluon/config-mode/wizard/0400-geo-location.lua b/package/gluon-config-mode-geo-location/files/lib/gluon/config-mode/wizard/0400-geo-location.lua
index a3ac089d..e8c9976d 100644
--- a/package/gluon-config-mode-geo-location/files/lib/gluon/config-mode/wizard/0400-geo-location.lua
+++ b/package/gluon-config-mode-geo-location/files/lib/gluon/config-mode/wizard/0400-geo-location.lua
@@ -45,10 +45,10 @@ function M.handle(data)
 
   uci:set("gluon-node-info", sname, "share_location", data._location)
   if data._location and data._latitude ~= nil and data._longitude ~= nil then
-    uci:set("gluon-node-info", sname, "latitude", data._latitude)
-    uci:set("gluon-node-info", sname, "longitude", data._longitude)
+    uci:set("gluon-node-info", sname, "latitude", data._latitude:trim())
+    uci:set("gluon-node-info", sname, "longitude", data._longitude:trim())
     if data._altitude ~= nil then
-      uci:set("gluon-node-info", sname, "altitude", data._altitude)
+      uci:set("gluon-node-info", sname, "altitude", data._altitude:trim())
     else
       uci:delete("gluon-node-info", sname, "altitude")
     end
diff --git a/package/gluon-config-mode-mesh-vpn/files/lib/gluon/config-mode/wizard/0300-mesh-vpn.lua b/package/gluon-config-mode-mesh-vpn/files/lib/gluon/config-mode/wizard/0300-mesh-vpn.lua
index 9e2f4008..104e2437 100644
--- a/package/gluon-config-mode-mesh-vpn/files/lib/gluon/config-mode/wizard/0300-mesh-vpn.lua
+++ b/package/gluon-config-mode-mesh-vpn/files/lib/gluon/config-mode/wizard/0300-mesh-vpn.lua
@@ -28,13 +28,13 @@ function M.section(form)
   o:depends("_limit_enabled", "1")
   o.value = uci:get("simple-tc", "mesh_vpn", "limit_ingress")
   o.rmempty = false
-  o.datatype = "integer"
+  o.datatype = "uinteger"
 
   o = s:option(cbi.Value, "_limit_egress", i18n.translate("Upstream (kbit/s)"))
   o:depends("_limit_enabled", "1")
   o.value = uci:get("simple-tc", "mesh_vpn", "limit_egress")
   o.rmempty = false
-  o.datatype = "integer"
+  o.datatype = "uinteger"
 end
 
 function M.handle(data)
@@ -49,11 +49,11 @@ function M.handle(data)
     uci:set("simple-tc", "mesh_vpn", "ifname", "mesh-vpn")
 
     if data._limit_ingress ~= nil then
-      uci:set("simple-tc", "mesh_vpn", "limit_ingress", data._limit_ingress)
+      uci:set("simple-tc", "mesh_vpn", "limit_ingress", data._limit_ingress:trim())
     end
 
     if data._limit_egress ~= nil then
-      uci:set("simple-tc", "mesh_vpn", "limit_egress", data._limit_egress)
+      uci:set("simple-tc", "mesh_vpn", "limit_egress", data._limit_egress:trim())
     end
 
     uci:commit("simple-tc")
diff --git a/package/gluon-luci-portconfig/files/usr/lib/lua/luci/model/cbi/admin/portconfig.lua b/package/gluon-luci-portconfig/files/usr/lib/lua/luci/model/cbi/admin/portconfig.lua
index c9b57d4b..994f3077 100644
--- a/package/gluon-luci-portconfig/files/usr/lib/lua/luci/model/cbi/admin/portconfig.lua
+++ b/package/gluon-luci-portconfig/files/usr/lib/lua/luci/model/cbi/admin/portconfig.lua
@@ -99,9 +99,9 @@ function f.handle(self, state, data)
   if state == FORM_VALID then
     uci:set("network", "wan", "proto", data.ipv4)
     if data.ipv4 == "static" then
-      uci:set("network", "wan", "ipaddr", data.ipv4_addr)
-      uci:set("network", "wan", "netmask", data.ipv4_netmask)
-      uci:set("network", "wan", "gateway", data.ipv4_gateway)
+      uci:set("network", "wan", "ipaddr", data.ipv4_addr:trim())
+      uci:set("network", "wan", "netmask", data.ipv4_netmask:trim())
+      uci:set("network", "wan", "gateway", data.ipv4_gateway:trim())
     else
       uci:delete("network", "wan", "ipaddr")
       uci:delete("network", "wan", "netmask")
@@ -110,8 +110,8 @@ function f.handle(self, state, data)
 
     uci:set("network", "wan6", "proto", data.ipv6)
     if data.ipv6 == "static" then
-      uci:set("network", "wan6", "ip6addr", data.ipv6_addr)
-      uci:set("network", "wan6", "ip6gw", data.ipv6_gateway)
+      uci:set("network", "wan6", "ip6addr", data.ipv6_addr:trim())
+      uci:set("network", "wan6", "ip6gw", data.ipv6_gateway:trim())
     else
       uci:delete("network", "wan6", "ip6addr")
       uci:delete("network", "wan6", "ip6gw")

From 79bc3a8d4b07f3ac3807d732edf14889174e63dd Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Mon, 29 Feb 2016 01:12:20 +0100
Subject: [PATCH 17/35] gluon-status-page: fix neighbour purging

notUpdated is a Set, to a for-in loop doesn't work.

Fixes #657
---
 package/gluon-status-page/src/js/lib/gui/neighbours.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/gluon-status-page/src/js/lib/gui/neighbours.js b/package/gluon-status-page/src/js/lib/gui/neighbours.js
index 396c56fe..ff782506 100644
--- a/package/gluon-status-page/src/js/lib/gui/neighbours.js
+++ b/package/gluon-status-page/src/js/lib/gui/neighbours.js
@@ -198,11 +198,11 @@ function (Helper, SignalGraph, Signal) {
         notUpdated.delete(id)
       }
 
-      for (id in notUpdated) {
+      notUpdated.forEach(function (id) {
         managedNeighbours[id].views.forEach( function (d) { d.destroy() })
         colors.push(managedNeighbours[id].color)
         delete managedNeighbours[id]
-      }
+      })
     }
 
 

From 19a7380e7496d3749997c16958a2a949d6517d7d Mon Sep 17 00:00:00 2001
From: Matthias Ludwig <matthias.ludwig@elektrobit.com>
Date: Mon, 29 Feb 2016 11:23:01 +0100
Subject: [PATCH 18/35] ar71xx-generic: add support for TP-Link MR13U

---
 targets/ar71xx-generic/profiles.mk | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/targets/ar71xx-generic/profiles.mk b/targets/ar71xx-generic/profiles.mk
index 7dd6bc5e..394722e8 100644
--- a/targets/ar71xx-generic/profiles.mk
+++ b/targets/ar71xx-generic/profiles.mk
@@ -117,6 +117,10 @@ $(eval $(call GluonModel,TLWA901,tl-wa901nd-v1,tp-link-tl-wa901n-nd-v1))
 $(eval $(call GluonModel,TLWA901,tl-wa901nd-v2,tp-link-tl-wa901n-nd-v2))
 $(eval $(call GluonModel,TLWA901,tl-wa901nd-v3,tp-link-tl-wa901n-nd-v3))
 
+# TL-MR13U v1
+$(eval $(call GluonProfile,TLMR13U))
+$(eval $(call GluonModel,TLMR13U,tl-mr13u-v1,tp-link-tl-mr13u-v1))
+
 # TL-MR3020 v1
 $(eval $(call GluonProfile,TLMR3020))
 $(eval $(call GluonModel,TLMR3020,tl-mr3020-v1,tp-link-tl-mr3020-v1))

From 6e452f207a747adf64de2f1fa7250a6a7a663a30 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Wed, 24 Feb 2016 22:20:18 +0100
Subject: [PATCH 19/35] gluon-status-page: don't use internationalization API

It is not supported by all browsers yet.

Also change load display always to display 2 decimal digits (as it is read
from the kernel with 2 decimal digits).

Fixes #606
---
 .../src/js/lib/gui/statistics.js              |  8 +++----
 .../gluon-status-page/src/js/lib/helper.js    | 21 +++++++++++++++++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/package/gluon-status-page/src/js/lib/gui/statistics.js b/package/gluon-status-page/src/js/lib/gui/statistics.js
index 7f09323c..3dcf5a52 100644
--- a/package/gluon-status-page/src/js/lib/gui/statistics.js
+++ b/package/gluon-status-page/src/js/lib/gui/statistics.js
@@ -171,7 +171,7 @@ define(["lib/helper"], function (Helper) {
   }
 
   function prettyPackets(d) {
-    var v = new Intl.NumberFormat("de-DE", {maximumFractionDigits: 0}).format(d)
+    var v = Helper.formatNumberFixed(d, 0)
     return v + " Pakete/s"
   }
 
@@ -183,7 +183,7 @@ define(["lib/helper"], function (Helper) {
       prefix++
     }
 
-    d = new Intl.NumberFormat("de-DE", {maximumSignificantDigits: 3}).format(d)
+    d = Helper.formatNumber(d, 3)
     return d + " " + prefixes[prefix]
   }
 
@@ -220,11 +220,11 @@ define(["lib/helper"], function (Helper) {
   }
 
   function prettyNVRAM(usage) {
-    return new Intl.NumberFormat("de-DE", {maximumSignificantDigits: 3}).format(usage * 100) + "% belegt"
+    return Helper.formatNumber(usage * 100, 3) + "% belegt"
   }
 
   function prettyLoad(load) {
-    return new Intl.NumberFormat("de-DE", {maximumSignificantDigits: 3}).format(load)
+    return Helper.formatNumberFixed(load, 2)
   }
 
   function prettyRAM(memory) {
diff --git a/package/gluon-status-page/src/js/lib/helper.js b/package/gluon-status-page/src/js/lib/helper.js
index 6b39bc0a..c0c0ce2f 100644
--- a/package/gluon-status-page/src/js/lib/helper.js
+++ b/package/gluon-status-page/src/js/lib/helper.js
@@ -51,6 +51,25 @@ define([ "bacon" ], function (Bacon) {
     return dictGet(dict[k], key)
   }
 
+  function localizeNumber(d) {
+    var sep = ','
+    return d.replace('.', sep)
+  }
+
+  function formatNumberFixed(d, digits) {
+    return localizeNumber(d.toFixed(digits))
+  }
+
+  function formatNumber(d, digits) {
+    digits--
+
+    for (var v = d; v >= 10 && digits > 0; v /= 10)
+      digits--
+
+    // avoid toPrecision as it might produce strings in exponential notation
+    return formatNumberFixed(d, digits)
+  }
+
   function haversine() {
     var radians = Array.prototype.map.call(arguments, function(deg) { return deg / 180.0 * Math.PI })
     var lat1 = radians[0], lon1 = radians[1], lat2 = radians[2], lon2 = radians[3]
@@ -66,6 +85,8 @@ define([ "bacon" ], function (Bacon) {
          , request: request
          , getJSON: getJSON
          , dictGet: dictGet
+         , formatNumber: formatNumber
+         , formatNumberFixed: formatNumberFixed
          , haversine: haversine
          }
 })

From 289b5992339420757859432593cf8b31827b9978 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Wed, 24 Feb 2016 22:32:22 +0100
Subject: [PATCH 20/35] gluon-status-page: unify prefix list of prettyBytes and
 prettyBits

---
 package/gluon-status-page/src/js/lib/gui/statistics.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/package/gluon-status-page/src/js/lib/gui/statistics.js b/package/gluon-status-page/src/js/lib/gui/statistics.js
index 3dcf5a52..af984e6e 100644
--- a/package/gluon-status-page/src/js/lib/gui/statistics.js
+++ b/package/gluon-status-page/src/js/lib/gui/statistics.js
@@ -178,7 +178,7 @@ define(["lib/helper"], function (Helper) {
   function prettyPrefix(prefixes, step, d) {
     var prefix = 0
 
-    while (d > step && prefix < 4) {
+    while (d > step && prefix < prefixes.length - 1) {
       d /= step
       prefix++
     }
@@ -187,12 +187,16 @@ define(["lib/helper"], function (Helper) {
     return d + " " + prefixes[prefix]
   }
 
+  function prettySize(d) {
+    return prettyPrefix([ "", "k", "M", "G", "T" ], 1024, d)
+  }
+
   function prettyBits(d) {
-    return prettyPrefix([ "bps", "kbps", "Mbps", "Gbps" ], 1024, d * 8)
+    return prettySize(d * 8) + "bps"
   }
 
   function prettyBytes(d) {
-    return prettyPrefix([ "B", "kB", "MB", "GB", "TB" ], 1024, d)
+    return prettySize(d) + "B"
   }
 
   function prettyUptime(seconds) {

From 6f23ef9eb7d4187bfe3978e839f6a609f578f1bf Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Tue, 1 Mar 2016 12:52:12 +0100
Subject: [PATCH 21/35] Update OpenWrt base

We got most of our patches backported by upstream :)
---
 modules                                       |     2 +-
 ...a-Technologies-firmware-for-QCA988X.patch} |     8 +-
 ...l-filename-part-than-the-output-file.patch |    68 -
 ...1-ath10k-allow-simultaneous-AP-IBSS.patch} |     0
 ...-mac80211-backport-from-trunk-r48810.patch | 33113 ----------------
 ...te-NanoStation-Loco-txpower-offsets.patch} |     0
 ...apd-prevent-channel-switch-for-5GHz.patch} |     0
 ...uner-support-for-UniFi-Outdoor-Plus.patch} |     0
 ...d-support-for-tp-link-wr740n-v5.0-EU.patch |    39 -
 ...s-with-prohibited-blackholed-source.patch} |     0
 ...ar71xx-add-support-for-TL-WR741ND-v5.patch |    35 -
 ...tallation-of-headers-for-host-build.patch} |     0
 ...alloc-instead-of-oom-kill-processes.patch} |     0
 ...013-sunxi-fix-uboot-install-location.patch |   131 -
 ...=> 0014-fix-UBNT-XM-model-detection.patch} |     0
 ...xi-respect-CONFIG_TARGET_IMAGES_GZIP.patch |    21 -
 ...ourcefilter-to-disable-source-filter.patch |    62 -
 ...P-Link-TL-WR841N-ND-v9-Compex-WPJ531.patch |    57 -
 ...ar71xx-rework-patch-for-qca953x-956x.patch |   807 -
 ...pagate-the-real-postinst-return-code.patch |    44 -
 ...ditional-libopenssl-build-dependency.patch |    22 -
 ...ditional-libopenssl-build-dependency.patch |    22 -
 .../openwrt/0022-odhcp6c-minor-fixes.patch    |    77 -
 ...base-files-add-etc-profile.d-support.patch |    40 -
 ...152-based-USB-to-Ethernet-converters.patch |    49 -
 ...tils-tplink-safeloader-clean-up-code.patch |   107 -
 ...t-format-clean-up-vendor-information.patch |   126 -
 ...on-1.1-support-to-CPE210-220-510-520.patch |    38 -
 ...-TL-WR941ND-v6-international-version.patch |   330 -
 ...d-support-for-TP-Link-TL-WR1043ND-v3.patch |    25 -
 ...ath10k-calibration-data-load-changes.patch |   197 -
 ...ix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch |    20 -
 ...L-Added-source-old-to-PKG_SOURCE_URL.patch |    24 -
 ...37-x86-generic-refresh-kernel-config.patch |    48 -
 ...86-generic-enable-pata_atiixp-driver.patch |    22 -
 ...bvious-bugs-causing-compile-warnings.patch |    64 -
 ...s-split-ubdev01-flash-layout-from-XM.patch |    39 -
 ...ix-firmware_max_length-for-XM-layout.patch |    45 -
 ...its-for-macronix-flash-chips-at-init.patch |    22 -
 ...-bugs-after-cleaning-the-kernel-tree.patch |    19 -
 ...el-gpio_keys-load-module-on-pre-init.patch |    21 -
 ...-lzma-loader-fix-O32-ABI-conformance.patch |    36 -
 42 files changed, 5 insertions(+), 35775 deletions(-)
 rename patches/openwrt/{0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch => 0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch} (90%)
 delete mode 100644 patches/openwrt/0006-build-add-support-for-choosing-a-different-url-filename-part-than-the-output-file.patch
 rename patches/openwrt/{0009-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch => 0007-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch} (100%)
 delete mode 100644 patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch
 rename patches/openwrt/{0010-iwinfo-update-NanoStation-Loco-txpower-offsets.patch => 0008-iwinfo-update-NanoStation-Loco-txpower-offsets.patch} (100%)
 rename patches/openwrt/{0016-hostapd-prevent-channel-switch-for-5GHz.patch => 0009-hostapd-prevent-channel-switch-for-5GHz.patch} (100%)
 rename patches/openwrt/{0023-ath9k-add-HSR-tuner-support-for-UniFi-Outdoor-Plus.patch => 0010-ath9k-add-HSR-tuner-support-for-UniFi-Outdoor-Plus.patch} (100%)
 delete mode 100644 patches/openwrt/0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch
 rename patches/openwrt/{0029-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch => 0011-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch} (100%)
 delete mode 100644 patches/openwrt/0012-ar71xx-add-support-for-TL-WR741ND-v5.patch
 rename patches/openwrt/{0035-lua-fix-installation-of-headers-for-host-build.patch => 0012-lua-fix-installation-of-headers-for-host-build.patch} (100%)
 rename patches/openwrt/{0036-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch => 0013-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch} (100%)
 delete mode 100644 patches/openwrt/0013-sunxi-fix-uboot-install-location.patch
 rename patches/openwrt/{0039-fix-UBNT-XM-model-detection.patch => 0014-fix-UBNT-XM-model-detection.patch} (100%)
 delete mode 100644 patches/openwrt/0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch
 delete mode 100644 patches/openwrt/0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch
 delete mode 100644 patches/openwrt/0017-ar71xx-fix-ethernet-initialization-on-QCA953x-based-boards-TP-Link-TL-WR841N-ND-v9-Compex-WPJ531.patch
 delete mode 100644 patches/openwrt/0018-ar71xx-rework-patch-for-qca953x-956x.patch
 delete mode 100644 patches/openwrt/0019-base-files-default_postinst-propagate-the-real-postinst-return-code.patch
 delete mode 100644 patches/openwrt/0020-opkg-work-around-unconditional-libopenssl-build-dependency.patch
 delete mode 100644 patches/openwrt/0021-hostapd-work-around-unconditional-libopenssl-build-dependency.patch
 delete mode 100644 patches/openwrt/0022-odhcp6c-minor-fixes.patch
 delete mode 100644 patches/openwrt/0024-base-files-add-etc-profile.d-support.patch
 delete mode 100644 patches/openwrt/0025-Kernel-Realtek-8150-and-Realtek-8152-based-USB-to-Ethernet-converters.patch
 delete mode 100644 patches/openwrt/0026-tools-firmware-utils-tplink-safeloader-clean-up-code.patch
 delete mode 100644 patches/openwrt/0027-tools-firmware-utils-tplink-safeloader-fix-support-list-format-clean-up-vendor-information.patch
 delete mode 100644 patches/openwrt/0028-tools-firmware-utils-tplink-safeloader-add-version-1.1-support-to-CPE210-220-510-520.patch
 delete mode 100644 patches/openwrt/0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch
 delete mode 100644 patches/openwrt/0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch
 delete mode 100644 patches/openwrt/0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch
 delete mode 100644 patches/openwrt/0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch
 delete mode 100644 patches/openwrt/0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch
 delete mode 100644 patches/openwrt/0037-x86-generic-refresh-kernel-config.patch
 delete mode 100644 patches/openwrt/0038-x86-generic-enable-pata_atiixp-driver.patch
 delete mode 100644 patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch
 delete mode 100644 patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch
 delete mode 100644 patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch
 delete mode 100644 patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch
 delete mode 100644 patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch
 delete mode 100644 patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch
 delete mode 100644 patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch

diff --git a/modules b/modules
index 471ff93d..418420e0 100644
--- a/modules
+++ b/modules
@@ -1,7 +1,7 @@
 GLUON_FEEDS='openwrt gluon routing luci'
 
 OPENWRT_REPO=git://git.openwrt.org/15.05/openwrt.git
-OPENWRT_COMMIT=a03a846c49c067048cd225d476a7adf91ef8ff03
+OPENWRT_COMMIT=8882c524d9b5e4c16ebfea10c0090f38b07c9da5
 
 PACKAGES_OPENWRT_REPO=git://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_COMMIT=9622fe984bba3a4547f48bc507ebaba7637eb2b0
diff --git a/patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch b/patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
similarity index 90%
rename from patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
rename to patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
index 5f6976fe..725d5995 100644
--- a/patches/openwrt/0008-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
+++ b/patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
@@ -3,10 +3,10 @@ Date: Tue, 9 Feb 2016 18:22:29 +0100
 Subject: ath10k-firmware: add Candela Technologies firmware for QCA988X
 
 diff --git a/package/firmware/ath10k-firmware/Makefile b/package/firmware/ath10k-firmware/Makefile
-index 882294c..c6e6f2d 100644
+index b03d644..7d4d449 100644
 --- a/package/firmware/ath10k-firmware/Makefile
 +++ b/package/firmware/ath10k-firmware/Makefile
-@@ -46,6 +46,26 @@ define Download/ath10k-firmware-qca988x
+@@ -44,6 +44,26 @@ define Download/ath10k-firmware-qca988x
  endef
  $(eval $(call Download,ath10k-firmware-qca988x))
  
@@ -33,7 +33,7 @@ index 882294c..c6e6f2d 100644
  define Package/ath10k-firmware-qca99x0
  $(Package/ath10k-firmware-default)
    TITLE:=ath10k firmware for QCA99x0 devices
-@@ -81,6 +101,16 @@ define Package/ath10k-firmware-qca988x/install
+@@ -79,6 +99,16 @@ define Package/ath10k-firmware-qca988x/install
  		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
  endef
  
@@ -50,7 +50,7 @@ index 882294c..c6e6f2d 100644
  define Package/ath10k-firmware-qca6174/install
  	$(INSTALL_DIR) $(1)/lib/firmware/ath10k
  	$(CP) $(PKG_BUILD_DIR)/QCA6174 $(1)/lib/firmware/ath10k/
-@@ -100,5 +130,6 @@ define Package/ath10k-firmware-qca99x0/install
+@@ -98,5 +128,6 @@ define Package/ath10k-firmware-qca99x0/install
  endef
  
  $(eval $(call BuildPackage,ath10k-firmware-qca988x))
diff --git a/patches/openwrt/0006-build-add-support-for-choosing-a-different-url-filename-part-than-the-output-file.patch b/patches/openwrt/0006-build-add-support-for-choosing-a-different-url-filename-part-than-the-output-file.patch
deleted file mode 100644
index 67564c80..00000000
--- a/patches/openwrt/0006-build-add-support-for-choosing-a-different-url-filename-part-than-the-output-file.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Tue, 9 Feb 2016 13:49:01 +0100
-Subject: build: add support for choosing a different url filename part than the output file
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-
-Backport of r47591 and r48427
-
-diff --git a/include/download.mk b/include/download.mk
-index 937b5d3..e518cce 100644
---- a/include/download.mk
-+++ b/include/download.mk
-@@ -44,11 +44,11 @@ define DownloadMethod/unknown
- endef
- 
- define DownloadMethod/default
--	$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MD5SUM)" $(foreach url,$(URL),"$(url)")
-+	$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MD5SUM)" "$(URL_FILE)" $(foreach url,$(URL),"$(url)")
- endef
- 
- define wrap_mirror
--	$(if $(if $(MIRROR),$(filter-out x,$(MIRROR_MD5SUM))),@$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MIRROR_MD5SUM)" || ( $(1) ),$(1))
-+	$(if $(if $(MIRROR),$(filter-out x,$(MIRROR_MD5SUM))),@$(SCRIPT_DIR)/download.pl "$(DL_DIR)" "$(FILE)" "$(MIRROR_MD5SUM)" "" || ( $(1) ),$(1))
- endef
- 
- define DownloadMethod/cvs
-@@ -157,6 +157,7 @@ Validate/darcs=VERSION SUBDIR
- define Download/Defaults
-   URL:=
-   FILE:=
-+  URL_FILE:=
-   PROTO:=
-   MD5SUM:=
-   SUBDIR:=
-diff --git a/scripts/download.pl b/scripts/download.pl
-index cd68a7b..111d03c 100755
---- a/scripts/download.pl
-+++ b/scripts/download.pl
-@@ -11,15 +11,19 @@ use warnings;
- use File::Basename;
- use File::Copy;
- 
--@ARGV > 2 or die "Syntax: $0 <target dir> <filename> <md5sum> [<mirror> ...]\n";
-+@ARGV > 2 or die "Syntax: $0 <target dir> <filename> <md5sum> <url filename> [<mirror> ...]\n";
- 
-+my $url_filename;
- my $target = shift @ARGV;
- my $filename = shift @ARGV;
- my $md5sum = shift @ARGV;
-+$url_filename = shift @ARGV unless $ARGV[0] =~ /:\/\//;
- my $scriptdir = dirname($0);
- my @mirrors;
- my $ok;
- 
-+$url_filename or $url_filename = $filename;
-+
- sub localmirrors {
- 	my @mlist;
- 	open LM, "$scriptdir/localmirrors" and do {
-@@ -106,7 +110,7 @@ sub download
- 			return;
- 		}
- 	} else {
--		open WGET, "wget -t5 --timeout=20 --no-check-certificate $options -O- '$mirror/$filename' |" or die "Cannot launch wget.\n";
-+		open WGET, "wget -t5 --timeout=20 --no-check-certificate $options -O- '$mirror/$url_filename' |" or die "Cannot launch wget.\n";
- 		open MD5SUM, "| $md5cmd > '$target/$filename.md5sum'" or die "Cannot launch md5sum.\n";
- 		open OUTPUT, "> $target/$filename.dl" or die "Cannot create file $target/$filename.dl: $!\n";
- 		my $buffer;
diff --git a/patches/openwrt/0009-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch b/patches/openwrt/0007-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch
similarity index 100%
rename from patches/openwrt/0009-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch
rename to patches/openwrt/0007-mac80211-ath10k-allow-simultaneous-AP-IBSS.patch
diff --git a/patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch b/patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch
deleted file mode 100644
index 39e628b4..00000000
--- a/patches/openwrt/0007-mac80211-backport-from-trunk-r48810.patch
+++ /dev/null
@@ -1,33113 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 28 Feb 2016 03:14:24 +0100
-Subject: mac80211: backport from trunk r48810
-
-Backport mac80211 and dependent drivers/firmwares from OpenWrt trunk.
-
-diff --git a/package/firmware/ath10k-firmware/Makefile b/package/firmware/ath10k-firmware/Makefile
-new file mode 100644
-index 0000000..882294c
---- /dev/null
-+++ b/package/firmware/ath10k-firmware/Makefile
-@@ -0,0 +1,104 @@
-+#
-+# Copyright (C) 2015 OpenWrt.org
-+#
-+# This is free software, licensed under the GNU General Public License v2.
-+# See /LICENSE for more information.
-+#
-+
-+include $(TOPDIR)/rules.mk
-+
-+PKG_NAME:=ath10k-firmware
-+PKG_SOURCE_VERSION:=77f72b5f7dd940386d9e619a17904987759b7186
-+PKG_VERSION:=2014-11-13-$(PKG_SOURCE_VERSION)
-+PKG_RELEASE:=1
-+
-+PKG_SOURCE_PROTO:=git
-+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-+PKG_SOURCE_URL:=https://github.com/kvalo/ath10k-firmware.git
-+
-+PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
-+
-+include $(INCLUDE_DIR)/package.mk
-+
-+WMENU:=Wireless Drivers
-+
-+define Package/ath10k-firmware-default
-+  SECTION:=kernel
-+  CATEGORY:=Kernel modules
-+  SUBMENU:=$(WMENU)
-+  URL:=$(PKG_SOURCE_URL)
-+  DEPENDS:=kmod-ath10k
-+endef
-+
-+define Package/ath10k-firmware-qca988x
-+$(Package/ath10k-firmware-default)
-+  DEFAULT:=PACKAGE_kmod-ath10k
-+  TITLE:=ath10k firmware for QCA988x devices
-+endef
-+
-+QCA988X_FIRMWARE_FILE:=firmware-5.bin_10.2.4.97-1
-+
-+define Download/ath10k-firmware-qca988x
-+  URL:=https://www.codeaurora.org/cgit/quic/qsdk/oss/firmware/ath10k-firmware/plain/10.2.4/
-+  FILE:=$(QCA988X_FIRMWARE_FILE)
-+  MD5SUM:=fcb2fbd42d73a63fbf603505c718cbde
-+endef
-+$(eval $(call Download,ath10k-firmware-qca988x))
-+
-+define Package/ath10k-firmware-qca99x0
-+$(Package/ath10k-firmware-default)
-+  TITLE:=ath10k firmware for QCA99x0 devices
-+endef
-+
-+define Package/ath10k-firmware-qca6174
-+$(Package/ath10k-firmware-default)
-+  TITLE:=ath10k firmware for QCA6174 devices
-+endef
-+
-+QCA99X0_BOARD_REV:=ddcec9efd245da9365c474f513a855a55f3ac7fe
-+QCA99X0_BOARD_FILE:=board-2.bin.$(QCA99X0_BOARD_REV)
-+
-+define Download/qca99x0-board
-+  URL:=https://www.codeaurora.org/cgit/quic/qsdk/oss/firmware/ath10k-firmware/plain/ath10k/QCA99X0/hw2.0
-+  URL_FILE:=board-2.bin?id=ddcec9efd245da9365c474f513a855a55f3ac7fe
-+  FILE:=$(QCA99X0_BOARD_FILE)
-+  MD5SUM:=a2b3c653c2363a5641200051d6333d0a
-+endef
-+$(eval $(call Download,qca99x0-board))
-+
-+define Build/Compile
-+
-+endef
-+
-+define Package/ath10k-firmware-qca988x/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA988X/hw2.0
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/QCA988X/board.bin \
-+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
-+	$(INSTALL_DATA) \
-+		$(DL_DIR)/$(QCA988X_FIRMWARE_FILE) \
-+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
-+endef
-+
-+define Package/ath10k-firmware-qca6174/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k
-+	$(CP) $(PKG_BUILD_DIR)/QCA6174 $(1)/lib/firmware/ath10k/
-+endef
-+
-+define Package/ath10k-firmware-qca99x0/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA99X0/hw2.0
-+	$(INSTALL_DATA) \
-+		$(DL_DIR)/$(QCA99X0_BOARD_FILE) \
-+		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/board-2.bin
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/QCA99X0/hw2.0/boardData_AR900B_CUS239_5G_v2_001.bin \
-+		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/board.bin
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/QCA99X0/hw2.0/firmware-5.bin_10.4.1.00030-1 \
-+		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/firmware-5.bin
-+endef
-+
-+$(eval $(call BuildPackage,ath10k-firmware-qca988x))
-+$(eval $(call BuildPackage,ath10k-firmware-qca99x0))
-+$(eval $(call BuildPackage,ath10k-firmware-qca6174))
-diff --git a/package/firmware/b43legacy-firmware/Makefile b/package/firmware/b43legacy-firmware/Makefile
-new file mode 100644
-index 0000000..ec13c7d
---- /dev/null
-+++ b/package/firmware/b43legacy-firmware/Makefile
-@@ -0,0 +1,72 @@
-+#
-+# Copyright (C) 2016 OpenWrt.org
-+#
-+# This is free software, licensed under the GNU General Public License v2.
-+# See /LICENSE for more information.
-+#
-+
-+include $(TOPDIR)/rules.mk
-+
-+PKG_NAME:=b43legacy-firmware
-+PKG_VERSION:=3.130.20.0
-+PKG_RELEASE:=1
-+
-+PKG_SOURCE:=wl_apsta-$(PKG_VERSION).o
-+PKG_SOURCE_URL:=http://downloads.openwrt.org/sources
-+PKG_MD5SUM:=e08665c5c5b66beb9c3b2dd54aa80cb3
-+
-+include $(INCLUDE_DIR)/package.mk
-+
-+define Package/b43legacy-firmware
-+  SECTION:=firmware
-+  CATEGORY:=Firmware
-+  URL:=$(PKG_SOURCE_URL)
-+  TITLE:=Broadcom bcm43xx b43legacy firmware
-+endef
-+
-+define Package/b43legacy-firmware/config
-+  if PACKAGE_b43legacy-firmware
-+
-+	config B43LEGACY_FW_SQUASH
-+		bool "Remove unnecessary firmware files"
-+		default y
-+		help
-+		  This options allows you to remove unnecessary b43legacy firmware files
-+		  from the final rootfs image. This can reduce the rootfs size by
-+		  up to 50k.
-+
-+		  If unsure, say Y.
-+
-+	config B43LEGACY_FW_SQUASH_COREREVS
-+		string "Core revisions to include"
-+		depends on B43LEGACY_FW_SQUASH
-+		default "1,2,3,4"
-+		help
-+		  This is a comma seperated list of core revision numbers.
-+
-+		  Example (keep files for rev4 only):
-+		    4
-+
-+		  Example (keep files for rev2 and rev4):
-+		    2,4
-+
-+  endif
-+endef
-+
-+define Build/Prepare
-+	mkdir -p $(PKG_BUILD_DIR)
-+endef
-+
-+define Build/Compile
-+
-+endef
-+
-+define Package/b43legacy-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	b43-fwcutter --unsupported -w $(1)/lib/firmware/ $(DL_DIR)/$(PKG_SOURCE)
-+  ifneq ($(CONFIG_B43LEGACY_FW_SQUASH),)
-+	b43-fwsquash.py "G" "$(CONFIG_B43LEGACY_FW_SQUASH_COREREVS)" "$(1)/lib/firmware/b43legacy"
-+  endif
-+endef
-+
-+$(eval $(call BuildPackage,b43legacy-firmware))
-diff --git a/package/firmware/ixp4xx-microcode/Makefile b/package/firmware/ixp4xx-microcode/Makefile
-index 52b44f3..1af1248 100644
---- a/package/firmware/ixp4xx-microcode/Makefile
-+++ b/package/firmware/ixp4xx-microcode/Makefile
-@@ -1,4 +1,4 @@
--# 
-+#
- # Copyright (C) 2007 OpenWrt.org
- #
- # This is free software, licensed under the GNU General Public License v2.
-diff --git a/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-a/Makefile b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-a/Makefile
-new file mode 100644
-index 0000000..e8dd659
---- /dev/null
-+++ b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-a/Makefile
-@@ -0,0 +1,47 @@
-+# Copyright (C) 2015 OpenWrt.org
-+# Copyright (C) 2015 Lantiq Beteiligungs GmbH & Co KG.
-+#
-+# This is free software, licensed under the GNU General Public License v2.
-+# See /LICENSE for more information.
-+
-+include $(TOPDIR)/rules.mk
-+
-+PKG_NAME:=dsl_vr9_firmware_xdsl
-+PKG_VERSION:=05.07.04.03.00.06_05.07.01.08.00.01_osc
-+PKG_RELEASE:=1
-+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-+PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
-+PKG_MD5SUM:=4c8d9ca68dda88d3cfc0ca0fb946a63e
-+
-+include $(INCLUDE_DIR)/package.mk
-+
-+define Package/dsl-vrx200-firmware-xdsl-a
-+  SECTION:=firmware
-+  CATEGORY:=Firmware
-+  TITLE:=VRX200 / VR9 CPE xDSL Annex A firmware
-+  URL:=http://www.lantiq.com/
-+  DEPENDS:=@TARGET_lantiq_xrx200
-+endef
-+
-+define Package/dsl-vrx200-firmware-xdsl-a/description
-+	VRX200 / VR9 CPE VDSL and ADSL Annex A firmware
-+endef
-+
-+define Build/Prepare
-+	rm -rf $(PKG_BUILD_DIR)
-+	mkdir -p $(PKG_BUILD_DIR)
-+	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(PKG_SOURCE)
-+endef
-+
-+define Build/Compile
-+endef
-+
-+define Package/dsl-vrx200-firmware-xdsl-a/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/LICENSE $(1)/lib/firmware/xcpe_574306_571801.LICENSE
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/xcpe_574306_571801.bin $(1)/lib/firmware/
-+	ln -s xcpe_574306_571801.bin $(1)/lib/firmware/vdsl.bin
-+	ln -s xcpe_574306_571801.bin $(1)/lib/firmware/adsl-a.bin
-+endef
-+
-+$(eval $(call BuildPackage,dsl-vrx200-firmware-xdsl-a))
-diff --git a/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-b/Makefile b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-b/Makefile
-new file mode 100644
-index 0000000..c283da2
---- /dev/null
-+++ b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl-b/Makefile
-@@ -0,0 +1,47 @@
-+# Copyright (C) 2015 OpenWrt.org
-+# Copyright (C) 2015 Lantiq Beteiligungs GmbH & Co KG.
-+#
-+# This is free software, licensed under the GNU General Public License v2.
-+# See /LICENSE for more information.
-+
-+include $(TOPDIR)/rules.mk
-+
-+PKG_NAME:=dsl_vr9_firmware_xdsl
-+PKG_VERSION:=05.07.03.03.00.06_05.07.01.0C.00.02_osc
-+PKG_RELEASE:=1
-+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-+PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
-+PKG_MD5SUM:=af5581836cbe574574590c046fe45bab
-+
-+include $(INCLUDE_DIR)/package.mk
-+
-+define Package/dsl-vrx200-firmware-xdsl-b
-+  SECTION:=firmware
-+  CATEGORY:=Firmware
-+  TITLE:=VRX200 / VR9 CPE xDSL Annex B firmware
-+  URL:=http://www.lantiq.com/
-+  DEPENDS:=@TARGET_lantiq_xrx200
-+endef
-+
-+define Package/dsl-vrx200-firmware-xdsl-b/description
-+	VRX200 / VR9 CPE VDSL and ADSL Annex B firmware
-+endef
-+
-+define Build/Prepare
-+	rm -rf $(PKG_BUILD_DIR)
-+	mkdir -p $(PKG_BUILD_DIR)
-+	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(PKG_SOURCE)
-+endef
-+
-+define Build/Compile
-+endef
-+
-+define Package/dsl-vrx200-firmware-xdsl-b/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/LICENSE $(1)/lib/firmware/xcpe_573306_571C02.LICENSE
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/xcpe_573306_571C02.bin $(1)/lib/firmware/
-+	ln -s xcpe_573306_571C02.bin $(1)/lib/firmware/vdsl.bin
-+	ln -s xcpe_573306_571C02.bin $(1)/lib/firmware/adsl-b.bin
-+endef
-+
-+$(eval $(call BuildPackage,dsl-vrx200-firmware-xdsl-b))
-diff --git a/package/firmware/linux-firmware/Makefile b/package/firmware/linux-firmware/Makefile
-index 015aff7..2fcd93b 100644
---- a/package/firmware/linux-firmware/Makefile
-+++ b/package/firmware/linux-firmware/Makefile
-@@ -8,56 +8,33 @@
- include $(TOPDIR)/rules.mk
- 
- PKG_NAME:=linux-firmware
--PKG_SOURCE_VERSION:=f8c22c692bdee57a20b092e647464ff6176df3ed
--PKG_VERSION:=2014-03-16-$(PKG_SOURCE_VERSION)
-+PKG_SOURCE_VERSION:=52442afee9907bc32a058f22bb3295d040677c26
-+PKG_VERSION:=2016-01-25-$(PKG_SOURCE_VERSION)
- PKG_RELEASE:=1
- 
- PKG_SOURCE_PROTO:=git
- PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
--PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_VERSION)
-+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_SUBDIR)
- PKG_SOURCE_URL:=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
- PKG_MIRROR_MD5SUM:=ca4d289ad9380471cae376fc7dd3660a
- 
- PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
- 
--include $(INCLUDE_DIR)/package.mk
--
--define Package/r8169-firmware
--  SECTION:=firmware
--  CATEGORY:=Firmware
--  URL:=http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git
--  TITLE:=RealTek r8169 firmware
--endef
--
--define Build/Compile
-+SCAN_DEPS = *.mk
- 
--endef
--
--define Package/r8169-firmware/install
--	$(INSTALL_DIR) $(1)/lib/firmware/rtl_nic
--	$(CP) \
--		$(PKG_BUILD_DIR)/rtl_nic/* \
--		$(1)/lib/firmware/rtl_nic
--endef
--
--$(eval $(call BuildPackage,r8169-firmware))
-+include $(INCLUDE_DIR)/package.mk
- 
--define Package/r8188eu-firmware
-+define Package/firmware-default
-   SECTION:=firmware
-   CATEGORY:=Firmware
-   URL:=http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git
--  TITLE:=RealTek r8188eu firmware
-+  TITLE:=$(1)
- endef
- 
- define Build/Compile
- 
- endef
- 
--define Package/r8188eu-firmware/install
--	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
--	$(CP) \
--		$(PKG_BUILD_DIR)/rtlwifi/rtl8188eufw.bin \
--		$(1)/lib/firmware/rtlwifi
--endef
--
--$(eval $(call BuildPackage,r8188eu-firmware))
-+include $(wildcard ./*.mk)
-+#$(eval $(call BuildPackage,linux-firmware))
-diff --git a/package/firmware/linux-firmware/broadcom.mk b/package/firmware/linux-firmware/broadcom.mk
-new file mode 100644
-index 0000000..659dc82
---- /dev/null
-+++ b/package/firmware/linux-firmware/broadcom.mk
-@@ -0,0 +1,45 @@
-+Package/brcmfmac-firmware-pcie = $(call Package/firmware-default,Broadcom BCM43xx fullmac PCIe firmware)
-+define Package/brcmfmac-firmware-pcie/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/brcm/brcmfmac43602-pcie.ap.bin \
-+		$(1)/lib/firmware/brcm/brcmfmac43602-pcie.bin
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/brcm/brcmfmac4366b-pcie.bin \
-+		$(1)/lib/firmware/brcm/
-+endef
-+$(eval $(call BuildPackage,brcmfmac-firmware-pcie))
-+
-+Package/brcmfmac-firmware-sdio = $(call Package/firmware-default,Broadcom BCM43xx fullmac SDIO firmware)
-+define Package/brcmfmac-firmware-sdio/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/brcm/brcmfmac4329-sdio.bin \
-+		$(1)/lib/firmware/brcm/brcmfmac4329-sdio.bin
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/brcm/brcmfmac43362-sdio.bin \
-+		$(1)/lib/firmware/brcm/brcmfmac43362-sdio.bin
-+endef
-+$(eval $(call BuildPackage,brcmfmac-firmware-sdio))
-+
-+Package/brcmfmac-firmware-usb = $(call Package/firmware-default,Broadcom BCM43xx fullmac USB firmware)
-+define Package/brcmfmac-firmware-usb/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/brcm/brcmfmac43236b.bin \
-+		$(1)/lib/firmware/brcm/
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/brcm/brcmfmac43143.bin \
-+		$(1)/lib/firmware/brcm/
-+endef
-+$(eval $(call BuildPackage,brcmfmac-firmware-usb))
-+
-+Package/brcmsmac-firmware = $(call Package/firmware-default,Broadcom BCM43xx softmac PCIe firmware)
-+define Package/brcmsmac-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx-0.fw \
-+		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx_hdr-0.fw \
-+		$(1)/lib/firmware/brcm/
-+endef
-+$(eval $(call BuildPackage,brcmsmac-firmware))
-diff --git a/package/firmware/linux-firmware/intel.mk b/package/firmware/linux-firmware/intel.mk
-new file mode 100644
-index 0000000..f5adfaf
---- /dev/null
-+++ b/package/firmware/linux-firmware/intel.mk
-@@ -0,0 +1,192 @@
-+Package/ibt-firmware = $(call Package/firmware-default,Intel bluetooth firmware)
-+define Package/ibt-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/intel
-+	$(CP) \
-+		$(PKG_BUILD_DIR)/intel/*.bseq \
-+		$(1)/lib/firmware/intel
-+endef
-+$(eval $(call BuildPackage,ibt-firmware))
-+
-+Package/iwl3945-firmware = $(call Package/firmware-default,Intel IWL3945 firmware)
-+define Package/iwl3945-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-3945-2.ucode $(1)/lib/firmware
-+endef
-+$(eval $(call BuildPackage,iwl3945-firmware))
-+
-+Package/iwl4965-firmware = $(call Package/firmware-default,Intel IWL4965 firmware)
-+define Package/iwl4965-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-4965-2.ucode $(1)/lib/firmware
-+endef
-+$(eval $(call BuildPackage,iwl4965-firmware))
-+
-+Package/iwlwifi-firmware = $(call Package/firmware-default,Intel wireless firmware)
-+define Package/iwlwifi-firmware/config
-+  if PACKAGE_iwlwifi-firmware
-+	config IWL100_FW
-+		bool "Intel 100 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Wireless-N 100
-+
-+	config IWL1000_FW
-+		bool "Intel 1000 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Wireless-N 1000
-+
-+	config IWL105_FW
-+		bool "Intel 105 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Wireless-N 105
-+
-+	config IWL135_FW
-+		bool "Intel 135 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Wireless-N 135
-+
-+	config IWL2000_FW
-+		bool "Intel 2000 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Wireless-N 2200
-+
-+	config IWL2030_FW
-+		bool "Intel 2030 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Wireless-N 2230
-+
-+	config IWL3160_FW
-+		bool "Intel 3160 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Wireless WiFi 3160
-+
-+	config IWL5000_FW
-+		bool "Intel 5000 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
-+
-+	config IWL5150_FW
-+		bool "Intel 5150 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Wireless WiFi 5150AGN
-+
-+	config IWL6000_FW
-+		bool "Intel 6000 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Ultimate-N 6300 and Advanced-N 6200
-+
-+	config IWL6005_FW
-+		bool "Intel 6005 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Advanced-N 6205
-+
-+	config IWL6030_FW
-+		bool "Intel 6030 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Advanced-N 6230, Wireless-N 1030, Wireless-N 130 and Advanced-N 6235
-+
-+	config IWL6050_FW
-+		bool "Intel 6050 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Centrino Advanced-N + WiMAX 6250 and Wireless-N + WiMAX 6150
-+
-+	config IWL7260_FW
-+		bool "Intel 7260 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Dual Band Wireless-N 7260 and Intel Dual Band Wireless-AC 7260
-+
-+	config IWL7265_FW
-+		bool "Intel 7265 Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Wireless 7265, 7265D, 3165
-+
-+	config IWL8000_FW
-+		bool "Intel 8000 Series Firmware"
-+		default y
-+		help
-+		  Download and install firmware for:
-+		    Intel Wireless Series 8260, 4165
-+  endif
-+endef
-+define Package/iwlwifi-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+ifneq ($(CONFIG_IWL100_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-100-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL1000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-1000-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL105_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-105-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL135_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-135-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL2000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-2000-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL2030_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-2030-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL3160_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-3160-16.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL5000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-5000-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL5150_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-5150-2.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6000-4.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6005_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6000g2a-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6030_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6000g2b-6.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL6050_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-6050-5.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL7260_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-7260-16.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL7265_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-7265-16.ucode $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-7265D-16.ucode $(1)/lib/firmware
-+endif
-+ifneq ($(CONFIG_IWL8000_FW),)
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-8000C-16.ucode $(1)/lib/firmware
-+endif
-+endef
-+$(eval $(call BuildPackage,iwlwifi-firmware))
-diff --git a/package/firmware/linux-firmware/marvell.mk b/package/firmware/linux-firmware/marvell.mk
-new file mode 100644
-index 0000000..752a8e0
---- /dev/null
-+++ b/package/firmware/linux-firmware/marvell.mk
-@@ -0,0 +1,56 @@
-+Package/mwl8k-firmware = $(call Package/firmware-default,Marvell 8366/8687 firmware)
-+define Package/mwl8k-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/mwl8k
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/mwl8k/fmimage_8366_ap-3.fw \
-+		$(PKG_BUILD_DIR)/mwl8k/fmimage_8366.fw \
-+		$(PKG_BUILD_DIR)/mwl8k/helper_8366.fw \
-+		$(PKG_BUILD_DIR)/mwl8k/fmimage_8687.fw \
-+		$(PKG_BUILD_DIR)/mwl8k/helper_8687.fw \
-+		$(1)/lib/firmware/mwl8k/
-+endef
-+$(eval $(call BuildPackage,mwl8k-firmware))
-+
-+Package/mwifiex-pcie-firmware = $(call Package/firmware-default,Marvell 8897 firmware)
-+define Package/mwifiex-pcie-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/mrvl
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/mrvl/pcie8897_uapsta.bin \
-+		$(1)/lib/firmware/mrvl/
-+endef
-+$(eval $(call BuildPackage,mwifiex-pcie-firmware))
-+
-+Package/libertas-usb-firmware = $(call Package/firmware-default,Marvell 8388/8682 USB firmware)
-+define Package/libertas-usb-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/libertas
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/libertas/usb8388_v9.bin \
-+		$(PKG_BUILD_DIR)/libertas/usb8682.bin \
-+		$(1)/lib/firmware/libertas/
-+endef
-+$(eval $(call BuildPackage,libertas-usb-firmware))
-+
-+Package/libertas-sdio-firmware = $(call Package/firmware-default,Marvell 8385/8686/8688 SDIO firmware)
-+define Package/libertas-sdio-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/libertas
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/libertas/sd8385_helper.bin \
-+		$(PKG_BUILD_DIR)/libertas/sd8385.bin \
-+		$(PKG_BUILD_DIR)/libertas/sd8686_v9_helper.bin \
-+		$(PKG_BUILD_DIR)/libertas/sd8686_v9.bin \
-+		$(PKG_BUILD_DIR)/libertas/sd8688_helper.bin \
-+		$(PKG_BUILD_DIR)/libertas/sd8688.bin \
-+		$(1)/lib/firmware/libertas
-+endef
-+$(eval $(call BuildPackage,libertas-sdio-firmware))
-+
-+Package/libertas-spi-firmware = $(call Package/firmware-default,Marvell 8686 SPI firmware)
-+define Package/libertas-spi-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/libertas
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/libertas/gspi8686_v9_helper.bin \
-+		$(PKG_BUILD_DIR)/libertas/gspi8686_v9.bin \
-+		$(1)/lib/firmware/libertas
-+endef
-+$(eval $(call BuildPackage,libertas-spi-firmware))
-+
-diff --git a/package/firmware/linux-firmware/mediatek.mk b/package/firmware/linux-firmware/mediatek.mk
-new file mode 100644
-index 0000000..591ffee
---- /dev/null
-+++ b/package/firmware/linux-firmware/mediatek.mk
-@@ -0,0 +1,43 @@
-+Package/mt7601u-firmware = $(call Package/firmware-default,MediaTek MT7601U firmware)
-+define Package/mt7601u-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/mt7601u.bin \
-+		$(1)/lib/firmware
-+endef
-+$(eval $(call BuildPackage,mt7601u-firmware))
-+
-+Package/rt2800-pci-firmware = $(call Package/firmware-default,Ralink RT28xx/3xxx PCI/SoC firmware)
-+define Package/rt2800-pci-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/rt2860.bin \
-+		$(PKG_BUILD_DIR)/rt3290.bin \
-+		$(1)/lib/firmware
-+endef
-+$(eval $(call BuildPackage,rt2800-pci-firmware))
-+
-+Package/rt2800-usb-firmware = $(call Package/firmware-default,Ralink RT28xx/3xxx USB firmware)
-+define Package/rt2800-usb-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rt2870.bin $(1)/lib/firmware/
-+endef
-+$(eval $(call BuildPackage,rt2800-usb-firmware))
-+
-+Package/rt61-pci-firmware = $(call Package/firmware-default,Ralink RT2561 firmware)
-+define Package/rt61-pci-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/rt2561.bin \
-+		$(PKG_BUILD_DIR)/rt2561s.bin \
-+		$(PKG_BUILD_DIR)/rt2661.bin \
-+		$(1)/lib/firmware/
-+endef
-+$(eval $(call BuildPackage,rt61-pci-firmware))
-+
-+Package/rt73-pci-firmware = $(call Package/firmware-default,Ralink RT2573 firmware)
-+define Package/rt73-usb-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rt73.bin $(1)/lib/firmware/
-+endef
-+$(eval $(call BuildPackage,rt73-pci-firmware))
-diff --git a/package/firmware/linux-firmware/qca.mk b/package/firmware/linux-firmware/qca.mk
-new file mode 100644
-index 0000000..7ad27ef
---- /dev/null
-+++ b/package/firmware/linux-firmware/qca.mk
-@@ -0,0 +1,25 @@
-+Package/ar3k-firmware = $(call Package/firmware-default,ath3k firmware)
-+define Package/ar3k-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ar3k
-+	$(CP) \
-+		$(PKG_BUILD_DIR)/ar3k/*.dfu \
-+		$(1)/lib/firmware/ar3k
-+endef
-+$(eval $(call BuildPackage,ar3k-firmware))
-+
-+Package/ath9k-htc-firmware = $(call Package/firmware-default,AR9271/AR7010 firmware)
-+define Package/ath9k-htc-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ath9k_htc
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/ath9k_htc/htc_9271-1.4.0.fw \
-+		$(PKG_BUILD_DIR)/ath9k_htc/htc_7010-1.4.0.fw \
-+		$(1)/lib/firmware/ath9k_htc
-+endef
-+$(eval $(call BuildPackage,ath9k-htc-firmware))
-+
-+Package/carl9170-firmware = $(call Package/firmware-default,AR9170 firmware)
-+define Package/carl9170-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/carl9170-1.fw $(1)/lib/firmware
-+endef
-+$(eval $(call BuildPackage,carl9170-firmware))
-diff --git a/package/firmware/linux-firmware/realtek.mk b/package/firmware/linux-firmware/realtek.mk
-new file mode 100644
-index 0000000..0f8b1ce
---- /dev/null
-+++ b/package/firmware/linux-firmware/realtek.mk
-@@ -0,0 +1,50 @@
-+Package/r8169-firmware = $(call Package/firmware-default,RealTek RTL8169 firmware)
-+define Package/r8169-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtl_nic
-+	$(CP) \
-+		$(PKG_BUILD_DIR)/rtl_nic/* \
-+		$(1)/lib/firmware/rtl_nic
-+endef
-+$(eval $(call BuildPackage,r8169-firmware))
-+
-+Package/r8188eu-firmware = $(call Package/firmware-default,RealTek RTL8188EU firmware)
-+define Package/r8188eu-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(CP) \
-+		$(PKG_BUILD_DIR)/rtlwifi/rtl8188eufw.bin \
-+		$(1)/lib/firmware/rtlwifi
-+endef
-+$(eval $(call BuildPackage,r8188eu-firmware))
-+
-+Package/rtl8192ce-firmware = $(call Package/firmware-default,RealTek RTL8192CE firmware)
-+define Package/rtl8192ce-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cfw.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cfwU.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cfwU_B.bin $(1)/lib/firmware/rtlwifi
-+endef
-+$(eval $(call BuildPackage,rtl8192ce-firmware))
-+
-+Package/rtl8192cu-firmware = $(call Package/firmware-default,RealTek RTL8192CU firmware)
-+define Package/rtl8192cu-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw_A.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw_B.bin $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192cufw_TMSC.bin $(1)/lib/firmware/rtlwifi
-+endef
-+$(eval $(call BuildPackage,rtl8192cu-firmware))
-+
-+Package/rtl8192de-firmware = $(call Package/firmware-default,RealTek RTL8192DE firmware)
-+define Package/rtl8192de-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192defw.bin $(1)/lib/firmware/rtlwifi
-+endef
-+$(eval $(call BuildPackage,rtl8192de-firmware))
-+
-+Package/rtl8192se-firmware = $(call Package/firmware-default,RealTek RTL8192SE firmware)
-+define KernelPackage/rtl8192se/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtlwifi/rtl8192sefw.bin $(1)/lib/firmware/rtlwifi
-+endef
-+$(eval $(call BuildPackage,rtl8192se-firmware))
-diff --git a/package/firmware/linux-firmware/ti.mk b/package/firmware/linux-firmware/ti.mk
-new file mode 100644
-index 0000000..a1e12fc
---- /dev/null
-+++ b/package/firmware/linux-firmware/ti.mk
-@@ -0,0 +1,25 @@
-+Package/wl12xx-firmware = $(call Package/firmware-default,TI WL12xx firmware)
-+define Package/wl12xx-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl127x-fw-5-mr.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl127x-fw-5-plt.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl127x-fw-5-sr.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl1271-nvs.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-fw-5-mr.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-fw-5-plt.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-fw-5-sr.bin \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl128x-nvs.bin \
-+		$(1)/lib/firmware/ti-connectivity
-+endef
-+$(eval $(call BuildPackage,wl12xx-firmware))
-+
-+Package/wl18xx-firmware = $(call Package/firmware-default,TI WL18xx firmware)
-+define Package/wl18xx-firmware/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
-+	$(INSTALL_DATA) \
-+		$(PKG_BUILD_DIR)/ti-connectivity/wl18xx-fw-4.bin \
-+		$(1)/lib/firmware/ti-connectivity
-+endef
-+$(eval $(call BuildPackage,wl18xx-firmware))
-+
-diff --git a/package/kernel/acx-mac80211/Makefile b/package/kernel/acx-mac80211/Makefile
-index 1820e7a..c5c020d 100644
---- a/package/kernel/acx-mac80211/Makefile
-+++ b/package/kernel/acx-mac80211/Makefile
-@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
- include $(INCLUDE_DIR)/kernel.mk
- 
- PKG_NAME:=acx-mac80211
--PKG_REV:=v20130127
--PKG_VERSION:=20130909
-+PKG_REV:=b6fc31491020cb01d2cd1acc170cfa03ced7e726
-+PKG_VERSION:=20140216
- PKG_RELEASE:=1
- 
- PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
--PKG_SOURCE_URL:=git://acx100.git.sourceforge.net/gitroot/acx100/acx-mac80211
-+PKG_SOURCE_URL:=git://git.code.sf.net/p/acx100/acx-mac80211
- PKG_SOURCE_PROTO:=git
- PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
- PKG_SOURCE_VERSION:=$(PKG_REV)
-@@ -190,7 +190,7 @@ define Build/Compile
- 		CROSS_COMPILE="$(TARGET_CROSS)" \
- 		SUBDIRS="$(PKG_BUILD_DIR)" \
- 		$(PKG_EXTRA_KCONFIG) \
--		EXTRA_CFLAGS="$(PKG_EXTRA_CFLAGS) -DCONFIG_ACX_MAC80211_VERSION=\"KERNEL_VERSION(3,14,0)\"" \
-+		EXTRA_CFLAGS="$(PKG_EXTRA_CFLAGS) -DCONFIG_ACX_MAC80211_VERSION=\"KERNEL_VERSION(4,2,0)\"" \
- 		LINUXINCLUDE="-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi -I$(STAGING_DIR)/usr/include/mac80211-backport \
- 			-I$(STAGING_DIR)/usr/include/mac80211/uapi -I$(STAGING_DIR)/usr/include/mac80211 \
- 			-I$(LINUX_DIR)/include -I$(LINUX_DIR)/include/$(LINUX_UAPI_DIR) \
-diff --git a/package/kernel/acx-mac80211/patches/001-pci-mem-Fix-3.8-build.patch b/package/kernel/acx-mac80211/patches/001-pci-mem-Fix-3.8-build.patch
-deleted file mode 100644
-index fa4a6be..0000000
---- a/package/kernel/acx-mac80211/patches/001-pci-mem-Fix-3.8-build.patch
-+++ /dev/null
-@@ -1,129 +0,0 @@
--From 8a0f5890019bf43f4bc95ef0754b062ddfcfa9cd Mon Sep 17 00:00:00 2001
--From: Oliver Winker <oliver@oli1170.net>
--Date: Sun, 10 Mar 2013 21:04:23 +0100
--Subject: [PATCH 1/3] pci, mem: Fix 3.8 build
--
--__devexit and __devinit not used anymore in 3.8
--
--Signed-off-by: Reinhard Karcher <reinhard.karcher@gmx.net>
--Signed-off-by: Oliver Winker <oliver@oli1170.net>
-----
-- mem.c | 13 ++++++++++++-
-- pci.c | 26 +++++++++++++++++++++++++-
-- 2 files changed, 37 insertions(+), 2 deletions(-)
--
----- a/mem.c
--+++ b/mem.c
--@@ -2216,7 +2216,11 @@ int acx100mem_ioctl_set_phy_amp_bias(str
--  * ==================================================
--  */
-- 
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- static int __devinit acxmem_probe(struct platform_device *pdev)
--+#else
--+static int acxmem_probe(struct platform_device *pdev)
--+#endif
-- {
-- 	acx_device_t *adev = NULL;
-- 	const char *chip_name;
--@@ -2392,7 +2396,11 @@ static int __devinit acxmem_probe(struct
--  * pdev - ptr to PCI device structure containing info about pci
--  * configuration
--  */
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- static int __devexit acxmem_remove(struct platform_device *pdev)
--+#else
--+static int acxmem_remove(struct platform_device *pdev)
--+#endif
-- {
-- 	struct ieee80211_hw *hw = (struct ieee80211_hw *)
-- 		platform_get_drvdata(pdev);
--@@ -2594,8 +2602,11 @@ static struct platform_driver acxmem_dri
-- 		.name = "acx-mem",
-- 	},
-- 	.probe = acxmem_probe,
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- 	.remove = __devexit_p(acxmem_remove),
---
--+#else
--+	.remove = acxmem_remove,
--+#endif
-- #ifdef CONFIG_PM
-- 	.suspend = acxmem_e_suspend,
-- 	.resume = acxmem_e_resume
----- a/pci.c
--+++ b/pci.c
--@@ -1039,7 +1039,11 @@ int acx100pci_ioctl_set_phy_amp_bias(str
--  * id	- ptr to the device id entry that matched this device
--  */
-- #ifdef CONFIG_PCI
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- static int __devinit acxpci_probe(struct pci_dev *pdev,
--+#else
--+static int acxpci_probe(struct pci_dev *pdev,
--+#endif
-- 				const struct pci_device_id *id)
-- {
-- 	unsigned long mem_region1 = 0;
--@@ -1292,7 +1296,11 @@ static int __devinit acxpci_probe(struct
--  *
--  * pdev - ptr to PCI device structure containing info about pci configuration
--  */
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- static void __devexit acxpci_remove(struct pci_dev *pdev)
--+#else
--+static void acxpci_remove(struct pci_dev *pdev)
--+#endif
-- {
-- 	struct ieee80211_hw *hw
-- 		= (struct ieee80211_hw *) pci_get_drvdata(pdev);
--@@ -1505,7 +1513,11 @@ static struct pci_driver acxpci_driver =
-- 	.name		= "acx_pci",
-- 	.id_table	= acxpci_id_tbl,
-- 	.probe		= acxpci_probe,
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- 	.remove		= __devexit_p(acxpci_remove),
--+#else
--+	.remove		= acxpci_remove,
--+#endif
-- #ifdef CONFIG_PM
-- 	.suspend	= acxpci_e_suspend,
-- 	.resume		= acxpci_e_resume
--@@ -1603,8 +1615,12 @@ static struct vlynq_device_id acx_vlynq_
-- };
-- 
-- 
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- static __devinit int vlynq_probe(struct vlynq_device *vdev,
---				 struct vlynq_device_id *id)
--+#else
--+static int vlynq_probe(struct vlynq_device *vdev,
--+#endif
--+				  struct vlynq_device_id *id)
-- {
-- 	int result = -EIO, i;
-- 	u32 addr;
--@@ -1785,7 +1801,11 @@ static __devinit int vlynq_probe(struct
-- 	return result;
-- }
-- 
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- static __devexit void vlynq_remove(struct vlynq_device *vdev)
--+#else
--+static void vlynq_remove(struct vlynq_device *vdev)
--+#endif
-- {
-- 	struct ieee80211_hw *hw = vlynq_get_drvdata(vdev);
-- 	acx_device_t *adev = hw2adev(hw);
--@@ -1851,7 +1871,11 @@ static struct vlynq_driver acxvlynq_driv
-- 	.name = "acx_vlynq",
-- 	.id_table = acx_vlynq_id,
-- 	.probe = vlynq_probe,
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-- 	.remove = __devexit_p(vlynq_remove),
--+#else
--+	.remove = vlynq_remove,
--+#endif
-- };
-- #endif /* CONFIG_VLYNQ */
-- 
-diff --git a/package/kernel/acx-mac80211/patches/003-Fix-3.10-build.patch b/package/kernel/acx-mac80211/patches/003-Fix-3.10-build.patch
-deleted file mode 100644
-index c737844..0000000
---- a/package/kernel/acx-mac80211/patches/003-Fix-3.10-build.patch
-+++ /dev/null
-@@ -1,31 +0,0 @@
--From 1daf4bfdb072b08f3b4e412bbfa9645f88dc0a01 Mon Sep 17 00:00:00 2001
--From: Oliver Winker <oliver@oli1170.net>
--Date: Tue, 3 Sep 2013 20:36:36 +0200
--Subject: [PATCH 3/3] Fix 3.10 build
--
--Signed-off-by: Reinhard Karcher <reinhard.karcher@gmx.net>
--Signed-off-by: Oliver Winker <oliver@oli1170.net>
-----
-- main.c | 7 +++++++
-- 1 file changed, 7 insertions(+)
--
----- a/main.c
--+++ b/main.c
--@@ -682,10 +682,17 @@ int acx_op_config(struct ieee80211_hw *h
-- 
-- 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-- 		logf1(L_DEBUG, "IEEE80211_CONF_CHANGE_CHANNEL,"
--+#if CONFIG_ACX_MAC80211_VERSION >= KERNEL_VERSION(3, 10, 0)
--+			"channel->hw_value=%i\n", conf->chandef.chan->hw_value);
--+
--+		acx_set_channel(adev, conf->chandef.chan->hw_value,
--+				conf->chandef.chan->center_freq);
--+#else
-- 			"channel->hw_value=%i\n", conf->channel->hw_value);
-- 
-- 		acx_set_channel(adev, conf->channel->hw_value,
-- 				conf->channel->center_freq);
--+#endif
-- 
-- 		changed_not_done &= ~IEEE80211_CONF_CHANGE_CHANNEL;
-- 	}
-diff --git a/package/kernel/acx-mac80211/patches/004-Fix-3.14-build.patch b/package/kernel/acx-mac80211/patches/004-Fix-3.14-build.patch
-deleted file mode 100644
-index 847b573..0000000
---- a/package/kernel/acx-mac80211/patches/004-Fix-3.14-build.patch
-+++ /dev/null
-@@ -1,22 +0,0 @@
--From d17fcac710e629463591f6bd09d76b66ec591583 Mon Sep 17 00:00:00 2001
--From: Hauke Mehrtens <hauke@hauke-m.de>
--Date: Wed, 5 Feb 2014 20:57:07 +0100
--Subject: [PATCH] Fix 3.14 build
--
--Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
-----
-- main.c |    2 ++
-- 1 file changed, 2 insertions(+)
--
----- a/main.c
--+++ b/main.c
--@@ -500,7 +500,9 @@ int acx_init_ieee80211(acx_device_t *ade
-- 	hw->flags &= ~IEEE80211_HW_RX_INCLUDES_FCS;
-- 	hw->queues = 1;
-- 	hw->wiphy->max_scan_ssids = 1;
--+#if CONFIG_ACX_MAC80211_VERSION < KERNEL_VERSION(3, 14, 0)
-- 	hw->channel_change_time = 10000;
--+#endif
-- 
-- 	/* OW TODO Check if RTS/CTS threshold can be included here */
-- 
-diff --git a/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch b/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch
-new file mode 100644
-index 0000000..ee92b94
---- /dev/null
-+++ b/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch
-@@ -0,0 +1,67 @@
-+diff --git a/main.c b/main.c
-+index bfec856..3c482d9 100644
-+--- a/main.c
-++++ b/main.c
-+@@ -497,7 +497,7 @@ int acx_free_mechanics(acx_device_t *adev)
-+ 
-+ int acx_init_ieee80211(acx_device_t *adev, struct ieee80211_hw *hw)
-+ {
-+-	hw->flags &= ~IEEE80211_HW_RX_INCLUDES_FCS;
-++	__clear_bit(IEEE80211_HW_RX_INCLUDES_FCS, hw->flags);
-+ 	hw->queues = 1;
-+ 	hw->wiphy->max_scan_ssids = 1;
-+ 
-+@@ -525,7 +525,7 @@ int acx_init_ieee80211(acx_device_t *adev, struct ieee80211_hw *hw)
-+ 	/* We base signal quality on winlevel approach of previous driver
-+ 	 * TODO OW 20100615 This should into a common init code
-+ 	 */
-+-	hw->flags |= IEEE80211_HW_SIGNAL_UNSPEC;
-++	__set_bit(IEEE80211_HW_SIGNAL_UNSPEC, hw->flags);
-+ 	hw->max_signal = 100;
-+ 
-+ 	if (IS_ACX100(adev)) {
-+@@ -945,8 +945,8 @@ void acx_op_configure_filter(struct ieee80211_hw *hw,
-+ 		changed_flags, *total_flags);
-+ 
-+ 	/* OWI TODO: Set also FIF_PROBE_REQ ? */
-+-	*total_flags &= (FIF_PROMISC_IN_BSS | FIF_ALLMULTI | FIF_FCSFAIL
-+-			| FIF_CONTROL | FIF_OTHER_BSS);
-++	*total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_CONTROL
-++			| FIF_OTHER_BSS);
-+ 
-+ 	logf1(L_DEBUG, "2: *total_flags=0x%08x\n", *total_flags);
-+ 
-+@@ -1045,9 +1045,10 @@ void acx_op_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
-+ }
-+ 
-+ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+-                   struct cfg80211_scan_request *req)
-++                   struct ieee80211_scan_request *hw_req)
-+ {
-+ 	acx_device_t *adev = hw2adev(hw);
-++	struct cfg80211_scan_request *req = &hw_req->req;
-+ 	struct sk_buff *skb;
-+ 	size_t ssid_len = 0;
-+ 	u8 *ssid = NULL;
-+@@ -1082,7 +1083,7 @@ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+ 		goto out;
-+ 	}
-+ #else
-+-	skb = ieee80211_probereq_get(adev->hw, adev->vif, ssid, ssid_len,
-++	skb = ieee80211_probereq_get(adev->hw, vif->addr, ssid, ssid_len,
-+ 		req->ie_len);
-+ 	if (!skb) {
-+ 		ret = -ENOMEM;
-+diff --git a/main.h b/main.h
-+index 293f5c8..84ecb9a 100644
-+--- a/main.h
-++++ b/main.h
-+@@ -62,7 +62,7 @@ void acx_op_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
-+ #endif
-+ 
-+ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+-                   struct cfg80211_scan_request *req);
-++                   struct ieee80211_scan_request *req);
-+ 
-+ int acx_recover_hw(acx_device_t *adev);
-+ 
-diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
-index a1eedce..525537c 100644
---- a/package/kernel/mac80211/Makefile
-+++ b/package/kernel/mac80211/Makefile
-@@ -10,11 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
- 
- PKG_NAME:=mac80211
- 
--PKG_VERSION:=2015-03-09
--PKG_RELEASE:=3
-+PKG_VERSION:=2016-01-10
-+PKG_RELEASE:=1
- PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
- PKG_BACKPORT_VERSION:=
--PKG_MD5SUM:=6d4b04e4ce8a1f54dabfb04f4709453c
-+PKG_MD5SUM:=be5fae2e8d6f7490f9b073374fb895ba
- 
- PKG_SOURCE:=compat-wireless-$(PKG_VERSION)$(PKG_BACKPORT_VERSION).tar.bz2
- PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
-@@ -23,15 +23,29 @@ PKG_BUILD_PARALLEL:=1
- PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
- 
- PKG_DRIVERS = \
--	adm8211 ath5k libertas-usb libertas-sdio p54-common p54-pci p54-usb p54-spi \
--	rt2x00-lib rt2x00-pci rt2x00-usb rt2800-lib rt2400-pci rt2500-pci \
--	rt2500-usb rt61-pci rt73-usb rt2800-mmio rt2800-pci rt2800-usb rt2800-soc \
--	rtl8180 rtl8187 zd1211rw mac80211-hwsim carl9170 b43 b43legacy \
--	ath9k-common ath9k ath9k-htc ath10k ath net-libipw net-ipw2100 net-ipw2200 \
--	mwl8k mwifiex-pcie net-hermes net-hermes-pci net-hermes-plx net-hermes-pcmcia \
--	iwl-legacy iwl3945 iwl4965 iwlagn wlcore wl12xx wl18xx lib80211 \
-+	adm8211 \
-+	ath ath5k ath9k ath9k-common ath9k-htc ath10k \
-+	b43 b43legacy \
-+	carl9170 \
-+	hermes hermes-pci hermes-pcmcia hermes-plx\
-+	iwl-legacy iwl3945 iwl4965 iwlwifi \
-+	lib80211 \
-+	libipw ipw2100 ipw2200 \
-+	libertas-sdio libertas-usb libertas-spi \
-+	mac80211-hwsim \
-+	mt7601u \
-+	mwl8k mwifiex-pcie \
-+	p54-common p54-pci p54-spi p54-usb \
-+	rt2x00-lib rt2x00-pci rt2x00-usb \
-+	rt2400-pci rt2500-pci rt2500-usb \
-+	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
-+	rt61-pci rt73-usb \
-+	rtl8180 rtl8187 \
- 	rtlwifi rtlwifi-pci rtlwifi-usb rtl8192c-common rtl8192ce rtl8192se \
--	rtl8192de rtl8192cu
-+	rtl8192de rtl8192cu \
-+	rtl8xxxu \
-+	wlcore wl12xx wl18xx \
-+	zd1211rw
- 
- PKG_CONFIG_DEPENDS:= \
- 	CONFIG_PACKAGE_kmod-mac80211 \
-@@ -60,7 +74,6 @@ define KernelPackage/mac80211/Default
-   SUBMENU:=$(WMENU)
-   URL:=https://wireless.wiki.kernel.org/
-   MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
--  DEPENDS:=@!TARGET_uml
- endef
- 
- define KernelPackage/cfg80211
-@@ -97,6 +110,15 @@ define KernelPackage/mac80211/config
- 		  Select this to see extensive information about
- 		  the internal state of mac80211 in debugfs.
- 
-+	config PACKAGE_MAC80211_TRACING
-+		bool "Enable tracing (mac80211 and supported drivers)"
-+		select KERNEL_FTRACE
-+		select KERNEL_ENABLE_DEFAULT_TRACERS
-+		default n
-+		help
-+		  Select this to enable tracing of mac80211 and
-+		  related wifi drivers (using trace-cmd).
-+
- 	config PACKAGE_MAC80211_MESH
- 		bool "Enable 802.11s mesh support"
- 		default y
-@@ -108,833 +130,703 @@ define KernelPackage/mac80211/description
- Generic IEEE 802.11 Networking Stack (mac80211)
- endef
- 
--PKG_LINUX_FIRMWARE_NAME:=linux-firmware
--PKG_LINUX_FIRMWARE_VERSION:=f404336ba808cbd57547196e13367079a23b822c
--PKG_LINUX_FIRMWARE_SOURCE:=$(PKG_LINUX_FIRMWARE_NAME)-2015-03-20-$(PKG_LINUX_FIRMWARE_VERSION).tar.bz2
--PKG_LINUX_FIRMWARE_PROTO:=git
--PKG_LINUX_FIRMWARE_SOURCE_URL:=https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
--PKG_LINUX_FIRMWARE_SUBDIR:=$(PKG_LINUX_FIRMWARE_NAME)-$(PKG_LINUX_FIRMWARE_VERSION)
--#PKG_LINUX_FIRMWARE_MIRROR_MD5SUM:=e219333f01835c6e556875a9e0deb3f9
--
--define Download/linux-firmware
--  FILE:=$(PKG_LINUX_FIRMWARE_SOURCE)
--  URL:=$(PKG_LINUX_FIRMWARE_SOURCE_URL)
--  MD5SUM:=$(PKG_LINUX_FIRMWARE_MD5SUM)
--  PROTO:=$(PKG_LINUX_FIRMWARE_PROTO)
--  VERSION:=$(PKG_LINUX_FIRMWARE_VERSION)
--  SUBDIR:=$(PKG_LINUX_FIRMWARE_SUBDIR)
--  MIRROR_MD5SUM:=$(PKG_LINUX_FIRMWARE_MIRROR_MD5SUM)
--endef
--$(eval $(call Download,linux-firmware))
--
--PKG_ATH10K_LINUX_FIRMWARE_NAME:=ath10k-firmware
--PKG_ATH10K_LINUX_FIRMWARE_VERSION:=da0f85d924226ee30c46e037120621c9e192b39e
--PKG_ATH10K_LINUX_FIRMWARE_SOURCE:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION).tar.bz2
--PKG_ATH10K_LINUX_FIRMWARE_PROTO:=git
--PKG_ATH10K_LINUX_FIRMWARE_SOURCE_URL:=https://github.com/kvalo/ath10k-firmware.git
--PKG_ATH10K_LINUX_FIRMWARE_SUBDIR:=$(PKG_ATH10K_LINUX_FIRMWARE_NAME)-$(PKG_ATH10K_LINUX_FIRMWARE_VERSION)
--#PKG_ATH10K_LINUX_FIRMWARE_MIRROR_MD5SUM:=?
--
--define Download/ath10k-firmware
--  FILE:=$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE)
--  URL:=$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE_URL)
--  PROTO:=$(PKG_ATH10K_LINUX_FIRMWARE_PROTO)
--  VERSION:=$(PKG_ATH10K_LINUX_FIRMWARE_VERSION)
--  SUBDIR:=$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)
--  #MIRROR_MD5SUM:=$(PKG_ATH10K_LINUX_FIRMWARE_MIRROR_MD5SUM)
--endef
--$(eval $(call Download,ath10k-firmware))
--
--# Prism54 drivers
--P54PCIFW:=2.13.12.0.arm
--P54USBFW:=2.13.24.0.lm87.arm
--P54SPIFW:=2.13.0.0.a.13.14.arm
--
--define Download/p54usb
--  FILE:=$(P54USBFW)
--  URL:=http://daemonizer.de/prism54/prism54-fw/fw-usb
--  MD5SUM:=8e8ab005a4f8f0123bcdc51bc25b47f6
--endef
--$(eval $(call Download,p54usb))
--
--define Download/p54pci
--  FILE:=$(P54PCIFW)
--  URL:=http://daemonizer.de/prism54/prism54-fw/fw-softmac
--  MD5SUM:=ff7536af2092b1c4b21315bd103ef4c4
--endef
--$(eval $(call Download,p54pci))
--
--define Download/p54spi
--  FILE:=$(P54SPIFW)
--  URL:=http://daemonizer.de/prism54/prism54-fw/stlc4560
--  MD5SUM:=42661f8ecbadd88012807493f596081d
--endef
--$(eval $(call Download,p54spi))
--
--define KernelPackage/p54/Default
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Prism54 Drivers
--endef
--
--define KernelPackage/p54/description
--  Kernel module for Prism54 chipsets (mac80211)
--endef
--
--define KernelPackage/p54-common
--  $(call KernelPackage/p54/Default)
--  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt
--  TITLE+= (COMMON)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54common.ko
--endef
--
--define KernelPackage/p54-pci
--  $(call KernelPackage/p54/Default)
--  TITLE+= (PCI)
--  DEPENDS+= @PCI_SUPPORT +kmod-p54-common
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54pci.ko
--  AUTOLOAD:=$(call AutoProbe,p54pci)
--endef
--
--define KernelPackage/p54-usb
--  $(call KernelPackage/p54/Default)
--  TITLE+= (USB)
--  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54usb.ko
--  AUTOLOAD:=$(call AutoProbe,p54usb)
--endef
--
--define KernelPackage/p54-spi
--  $(call KernelPackage/p54/Default)
--  TITLE+= (SPI)
--  DEPENDS+= @TARGET_omap24xx +kmod-p54-common
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54spi.ko
--  AUTOLOAD:=$(call AutoProbe,p54spi)
--endef
--
--define KernelPackage/rt2x00/Default
-+define KernelPackage/adm8211
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Ralink Drivers for RT2x00 cards
-+  TITLE:=ADMTek 8211 support
-+  DEPENDS+=@PCI_SUPPORT +kmod-mac80211 +kmod-eeprom-93cx6
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/admtek/adm8211.ko
-+  AUTOLOAD:=$(call AutoProbe,adm8211)
- endef
- 
--define KernelPackage/rt2x00-lib
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-lib-crc-itu-t
--  TITLE+= (LIB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00lib.ko
--  MENU:=1
--endef
-+define KernelPackage/ath/config
-+  if PACKAGE_kmod-ath
-+	config ATH_USER_REGD
-+		bool "Force Atheros drivers to respect the user's regdomain settings"
-+		help
-+		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
-+		  the regulatory limits and the user is only allowed to restrict the settings
-+		  even further, even if the country allows frequencies or power levels that
-+		  are forbidden by the EEPROM settings.
- 
--define KernelPackage/rt2x00-lib/config
--  if PACKAGE_kmod-rt2x00-lib
-+		  Select this option if you want the driver to respect the user's decision about
-+		  regulatory settings.
- 
--	config PACKAGE_RT2X00_LIB_DEBUGFS
--		bool "Enable rt2x00 debugfs support"
--		depends on PACKAGE_MAC80211_DEBUGFS
-+	config PACKAGE_ATH_DEBUG
-+		bool "Atheros wireless debugging"
- 		help
--		  Enable creation of debugfs files for the rt2x00 drivers.
--		  These debugfs files support both reading and writing of the
--		  most important register types of the rt2x00 hardware.
-+		  Say Y, if you want to debug atheros wireless drivers.
-+		  Only ath9k & ath10k make use of this.
- 
--	config PACKAGE_RT2X00_DEBUG
--		bool "Enable rt2x00 debug output"
-+	config PACKAGE_ATH_DFS
-+		bool "Enable DFS support"
-+		default y
- 		help
--		  Enable debugging output for all rt2x00 modules
-+		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
-+		  channels in Europe, US, and Japan.
- 
--  endif
--endef
-+		  Select this option if you want to use such channels.
- 
--define KernelPackage/rt2x00-mmio
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
--  HIDDEN:=1
--  TITLE+= (MMIO)
--  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00mmio.ko
-+  endif
- endef
- 
--define KernelPackage/rt2x00-pci
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
--  HIDDEN:=1
--  TITLE+= (PCI)
--  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.ko
--  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
-+define KernelPackage/ath
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros common driver part
-+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath25 +kmod-mac80211
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
-+  MENU:=1
- endef
- 
--define KernelPackage/rt2x00-usb
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
--  HIDDEN:=1
--  TITLE+= (USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00usb.ko
--  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
-+define KernelPackage/ath/description
-+ This module contains some common parts needed by Atheros Wireless drivers.
- endef
- 
--define KernelPackage/rt2800-lib
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
--  HIDDEN:=1
--  TITLE+= (rt2800 LIB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800lib.ko
-+define KernelPackage/ath5k
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 5xxx wireless cards support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
-+  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
-+  AUTOLOAD:=$(call AutoProbe,ath5k)
- endef
- 
--define KernelPackage/rt2400-pci
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
--  TITLE+= (RT2400 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2400pci.ko
--  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-+define KernelPackage/ath5k/description
-+ This module adds support for wireless adapters based on
-+ Atheros 5xxx chipset.
- endef
- 
--define KernelPackage/rt2500-pci
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
--  TITLE+= (RT2500 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500pci.ko
--  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-+define KernelPackage/ath9k-common
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
- endef
- 
--define KernelPackage/rt2500-usb
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
--  TITLE+= (RT2500 USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500usb.ko
--  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-+define KernelPackage/ath9k
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 802.11n PCI wireless cards support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-+  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx +kmod-ath9k-common
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
-+  AUTOLOAD:=$(call AutoProbe,ath9k)
- endef
- 
--define KernelPackage/rt61-pci
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
--  TITLE+= (RT2x61 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt61pci.ko
--  AUTOLOAD:=$(call AutoProbe,rt61pci)
-+define KernelPackage/ath9k/description
-+This module adds support for wireless adapters based on
-+Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
- endef
- 
--define KernelPackage/rt73-usb
--  $(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
--  TITLE+= (RT73 USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt73usb.ko
--  AUTOLOAD:=$(call AutoProbe,rt73usb)
--endef
-+define KernelPackage/ath9k/config
- 
--define KernelPackage/rt2800-mmio
--$(call KernelPackage/rt2x00/Default)
--  TITLE += (RT28xx/RT3xxx MMIO)
--  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
--  HIDDEN:=1
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800mmio.ko
--endef
-+	config ATH9K_SUPPORT_PCOEM
-+		bool "Support chips used in PC OEM cards"
-+		depends on PACKAGE_kmod-ath9k
- 
--define KernelPackage/rt2800-soc
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
--  TITLE += (RT28xx/RT3xxx SoC)
--  FILES := \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00soc.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800soc.ko
--  AUTOLOAD:=$(call AutoProbe,rt2800soc)
- endef
- 
--define KernelPackage/rt2800-pci
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio
--  TITLE+= (RT2860 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800pci.ko
--  AUTOLOAD:=$(call AutoProbe,rt2800pci)
-+define KernelPackage/ath9k-htc
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Atheros 802.11n USB device support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-+  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core +ath9k-htc-firmware
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
-+  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
- endef
- 
--define KernelPackage/rt2800-usb
--$(call KernelPackage/rt2x00/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt
--  TITLE+= (RT2870 USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800usb.ko
--  AUTOLOAD:=$(call AutoProbe,rt2800usb)
-+define KernelPackage/ath9k-htc/description
-+This module adds support for wireless adapters based on
-+Atheros USB AR9271 and AR7010 family of chipsets.
- endef
- 
--define KernelPackage/rtl818x/Default
-+define KernelPackage/ath10k
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek Drivers for RTL818x devices
--  URL:=http://wireless.kernel.org/en/users/Drivers/rtl8187
--  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
-+  TITLE:=Atheros 802.11ac wireless cards support
-+  URL:=https://wireless.wiki.kernel.org/en/users/Drivers/ath10k
-+  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
-+  AUTOLOAD:=$(call AutoLoad,55,ath10k_core ath10k_pci)
- endef
- 
--define KernelPackage/rtl8180
--  $(call KernelPackage/rtl818x/Default)
--  DEPENDS+= @PCI_SUPPORT
--  TITLE+= (RTL8180 PCI)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8180/rtl818x_pci.ko
--  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
-+define KernelPackage/ath10k/description
-+This module adds support for wireless adapters based on
-+Atheros IEEE 802.11ac family of chipsets. For now only
-+PCI is supported.
- endef
- 
--define KernelPackage/rtl8187
--$(call KernelPackage/rtl818x/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-usb-core
--  TITLE+= (RTL8187 USB)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8187/rtl8187.ko
--  AUTOLOAD:=$(call AutoProbe,rtl8187)
--endef
-+#Broadcom firmware
-+ifneq ($(CONFIG_B43_FW_6_30),)
-+  PKG_B43_FWV4_NAME:=broadcom-wl
-+  PKG_B43_FWV4_VERSION:=6.30.163.46
-+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).wl_apsta.o
-+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-+  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-+  PKG_B43_FWV4_MD5SUM:=6fe97e9368d25342a1ab943d3cf3496d
-+else
-+ifneq ($(CONFIG_B43_FW_5_10),)
-+  PKG_B43_FWV4_NAME:=broadcom-wl
-+  PKG_B43_FWV4_VERSION:=5.10.56.27.3
-+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta/wl_prebuilt.o
-+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)_mipsel.tar.bz2
-+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-+  PKG_B43_FWV4_MD5SUM:=3363e3a6b3d9d73c49dea870c7834eac
-+else
-+ifneq ($(CONFIG_B43_FW_4_178),)
-+  PKG_B43_FWV4_NAME:=broadcom-wl
-+  PKG_B43_FWV4_VERSION:=4.178.10.4
-+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
-+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-+  PKG_B43_FWV4_MD5SUM:=14477e8cbbb91b11896affac9b219fdb
-+else
-+ifneq ($(CONFIG_B43_FW_5_100_138),)
-+  PKG_B43_FWV4_NAME:=broadcom-wl
-+  PKG_B43_FWV4_VERSION:=5.100.138
-+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
-+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-+  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-+  PKG_B43_FWV4_MD5SUM:=f4e357b09eaf5d8b1f1920cf3493a555
-+else
-+  PKG_B43_FWV4_NAME:=broadcom-wl
-+  PKG_B43_FWV4_VERSION:=4.150.10.5
-+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta_mimo.o
-+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-+  PKG_B43_FWV4_MD5SUM:=0c6ba9687114c6b598e8019e262d9a60
-+endif
-+endif
-+endif
-+endif
-+ifneq ($(CONFIG_B43_OPENFIRMWARE),)
-+  PKG_B43_FWV4_NAME:=broadcom-wl
-+  PKG_B43_FWV4_VERSION:=5.2
-+  PKG_B43_FWV4_OBJECT:=openfwwf-$(PKG_B43_FWV4_VERSION)
-+  PKG_B43_FWV4_SOURCE:=openfwwf-$(PKG_B43_FWV4_VERSION).tar.gz
-+  PKG_B43_FWV4_SOURCE_URL:=http://www.ing.unibs.it/openfwwf/firmware/
-+  PKG_B43_FWV4_MD5SUM:=e045a135453274e439ae183f8498b0fa
-+endif
- 
--define KernelPackage/rtlwifi/config
--	config PACKAGE_RTLWIFI_DEBUG
--		bool "Realtek wireless debugging"
--		depends on PACKAGE_kmod-rtlwifi
--		help
--		  Say Y, if you want to debug realtek wireless drivers.
- 
-+define Download/b43
-+  FILE:=$(PKG_B43_FWV4_SOURCE)
-+  URL:=$(PKG_B43_FWV4_SOURCE_URL)
-+  MD5SUM:=$(PKG_B43_FWV4_MD5SUM)
- endef
-+$(eval $(call Download,b43))
- 
--define KernelPackage/rtlwifi
-+define KernelPackage/b43
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek common driver part
--  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtlwifi.ko
--  HIDDEN:=1
-+  TITLE:=Broadcom 43xx wireless support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-+  KCONFIG:= \
-+  	CONFIG_HW_RANDOM=y
-+  # Depend on PCI_SUPPORT to make sure we can select kmod-bcma or kmod-ssb
-+  DEPENDS += \
-+	@PCI_SUPPORT +kmod-mac80211 \
-+	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
-+	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43/b43.ko
-+  AUTOLOAD:=$(call AutoProbe,b43)
-+  MENU:=1
- endef
- 
--define KernelPackage/rtlwifi-pci
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek common driver part (PCI support)
--  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl_pci.ko
--  AUTOLOAD:=$(call AutoProbe,rtl_pci)
--  HIDDEN:=1
--endef
-+define KernelPackage/b43/config
- 
--define KernelPackage/rtlwifi-usb
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek common driver part (USB support)
--  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl_usb.ko
--  AUTOLOAD:=$(call AutoProbe,rtl_usb)
--  HIDDEN:=1
--endef
-+config PACKAGE_B43_USE_SSB
-+	select PACKAGE_kmod-ssb
-+	tristate
-+	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
- 
--define KernelPackage/rtl8192c-common
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
--  DEPENDS+= +kmod-rtlwifi
--  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192c/rtl8192c-common.ko
--  HIDDEN:=1
--endef
-+config PACKAGE_B43_USE_BCMA
-+	select PACKAGE_kmod-bcma
-+	tristate
-+	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
- 
--define KernelPackage/rtl8192ce
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek RTL8192CE/RTL8188CE support
--  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common
--  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192ce.ko
--  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
--endef
-+  if PACKAGE_kmod-b43
- 
--define KernelPackage/rtl8192ce/install
--	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfw.bin $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfwU.bin $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cfwU_B.bin $(1)/lib/firmware/rtlwifi
--endef
-+	choice
-+		prompt "b43 firmware version"
-+		default B43_FW_5_100_138
-+		help
-+		  This option allows you to select the version of the b43 firmware.
- 
--define KernelPackage/rtl8192se
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek RTL8192SE/RTL8191SE support
--  DEPENDS+= +kmod-rtlwifi-pci
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192se/rtl8192se.ko
--  AUTOLOAD:=$(call AutoProbe,rtl8192se)
--endef
-+	config B43_FW_4_150
-+		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
-+		help
-+		  Old stable firmware for BCM43xx devices.
- 
--define KernelPackage/rtl8192se/install
--	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192sefw.bin $(1)/lib/firmware/rtlwifi
--endef
-+		  If unsure, select this.
- 
--define KernelPackage/rtl8192de
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek RTL8192DE/RTL8188DE support
--  DEPENDS+= +kmod-rtlwifi-pci
--  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192de/rtl8192de.ko
--  AUTOLOAD:=$(call AutoProbe,rtl8192de)
--endef
-+	config B43_FW_4_178
-+		bool "Firmware 478.104 from driver 4.178.10.4"
-+		help
-+		  Older firmware for BCM43xx devices.
- 
--define KernelPackage/rtl8192de/install
--	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192defw.bin $(1)/lib/firmware/rtlwifi
--endef
-+		  If unsure, select the "stable" firmware.
- 
--define KernelPackage/rtl8192cu
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Realtek RTL8192CU/RTL8188CU support
--  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common
--  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/rtlwifi/rtl8192cu/rtl8192cu.ko
--  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
--endef
-+	config B43_FW_5_10
-+		bool "Firmware 508.1084 from driver 5.10.56.27"
-+		help
-+		  Older firmware for BCM43xx devices.
- 
--define KernelPackage/rtl8192cu/install
--	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw.bin $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_A.bin $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_B.bin $(1)/lib/firmware/rtlwifi
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rtlwifi/rtl8192cufw_TMSC.bin $(1)/lib/firmware/rtlwifi
--endef
-+		  If unsure, select the "stable" firmware.
- 
--ZD1211FW_NAME:=zd1211-firmware
--ZD1211FW_VERSION:=1.4
--define Download/zd1211rw
--  FILE:=$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
--  URL:=@SF/zd1211/
--  MD5SUM:=19f28781d76569af8551c9d11294c870
--endef
--$(eval $(call Download,zd1211rw))
-+	config B43_FW_5_100_138
-+		bool "Firmware 666.2 from driver 5.100.138 (stable)"
-+		help
-+		  The currently default firmware for BCM43xx devices.
- 
--define KernelPackage/zd1211rw
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Zydas ZD1211 support
--  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zd1211rw/zd1211rw.ko
--  AUTOLOAD:=$(call AutoProbe,zd1211rw)
--endef
-+		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
- 
--define KernelPackage/adm8211
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=ADMTek 8211 support
--  DEPENDS+=@PCI_SUPPORT +kmod-mac80211 +kmod-eeprom-93cx6
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/adm8211.ko
--  AUTOLOAD:=$(call AutoProbe,adm8211)
--endef
-+		  If unsure, select the this firmware.
- 
--define KernelPackage/ath/config
--  if PACKAGE_kmod-ath
--	config ATH_USER_REGD
--		bool "Force Atheros drivers to respect the user's regdomain settings"
-+	config B43_FW_6_30
-+		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
- 		help
--		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
--		  the regulatory limits and the user is only allowed to restrict the settings
--		  even further, even if the country allows frequencies or power levels that
--		  are forbidden by the EEPROM settings.
-+		  Newer experimental firmware for BCM43xx devices.
-+
-+		  This firmware is mostly untested.
-+
-+		  If unsure, select the "stable" firmware.
-+
-+	config B43_OPENFIRMWARE
-+		bool "Open FirmWare for WiFi networks"
-+		help
-+		  Opensource firmware for BCM43xx devices.
-+
-+		  Do _not_ select this, unless you know what you are doing.
-+		  The Opensource firmware is not suitable for embedded devices, yet.
-+		  It does not support QoS, which is bad for AccessPoints.
-+		  It does not support hardware crypto acceleration, which is a showstopper
-+		  for embedded devices with low CPU resources.
-+
-+		  If unsure, select the "stable" firmware.
-+
-+	endchoice
-+
-+	config B43_FW_SQUASH
-+		bool "Remove unnecessary firmware files"
-+		depends on !B43_OPENFIRMWARE
-+		default y
-+		help
-+		  This options allows you to remove unnecessary b43 firmware files
-+		  from the final rootfs image. This can reduce the rootfs size by
-+		  up to 200k.
-+
-+		  If unsure, say Y.
-+
-+	config B43_FW_SQUASH_COREREVS
-+		string "Core revisions to include"
-+		depends on B43_FW_SQUASH
-+		default "5,6,7,8,9,10,11,13,15" if TARGET_brcm47xx_legacy
-+		default "16,28,29,30" if TARGET_brcm47xx_mips74k
-+		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
-+		help
-+		  This is a comma seperated list of core revision numbers.
-+
-+		  Example (keep files for rev5 only):
-+		    5
-+
-+		  Example (keep files for rev5 and rev11):
-+		    5,11
-+
-+	config B43_FW_SQUASH_PHYTYPES
-+		string "PHY types to include"
-+		depends on B43_FW_SQUASH
-+		default "G,N,LP" if TARGET_brcm47xx_legacy
-+		default "N,HT" if TARGET_brcm47xx_mips74k
-+		default "G,N,LP,HT"
-+		help
-+		  This is a comma seperated list of PHY types:
-+		    A  => A-PHY
-+		    AG => Dual A-PHY G-PHY
-+		    G  => G-PHY
-+		    LP => LP-PHY
-+		    N  => N-PHY
-+		    HT  => HT-PHY
-+		    LCN  => LCN-PHY
-+		    LCN40  => LCN40-PHY
-+		    AC  => AC-PHY
-+
-+		  Example (keep files for G-PHY only):
-+		    G
-+
-+		  Example (keep files for G-PHY and N-PHY):
-+		    G,N
-+
-+	choice
-+		prompt "Supported buses"
-+		default PACKAGE_B43_BUSES_BCMA_AND_SSB
-+		help
-+		  This allows choosing buses that b43 should support.
-+
-+	config PACKAGE_B43_BUSES_BCMA_AND_SSB
-+		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
-+		bool "BCMA and SSB"
-+
-+	config PACKAGE_B43_BUSES_BCMA
-+		depends on !TARGET_brcm47xx_legacy
-+		bool "BCMA only"
-+
-+	config PACKAGE_B43_BUSES_SSB
-+		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
-+		bool "SSB only"
-+
-+	endchoice
-+
-+	config PACKAGE_B43_DEBUG
-+		bool "Enable debug output and debugfs for b43"
-+		default n
-+		help
-+		  Enable additional debug output and runtime sanity checks for b43
-+		  and enables the debugfs interface.
-+
-+		  If unsure, say N.
-+
-+	config PACKAGE_B43_PIO
-+		bool "Enable support for PIO transfer mode"
-+		default n
-+		help
-+		  Enable support for using PIO instead of DMA. Unless you have DMA
-+		  transfer problems you don't need this.
- 
--		  Select this option if you want the driver to respect the user's decision about
--		  regulatory settings.
-+		  If unsure, say N.
- 
--	config PACKAGE_ATH_DEBUG
--		bool "Atheros wireless debugging"
-+	config PACKAGE_B43_PHY_G
-+		bool "Enable support for G-PHYs"
-+		default n if TARGET_brcm47xx_mips74k
-+		default y
- 		help
--		  Say Y, if you want to debug atheros wireless drivers.
--		  Right now only ath9k makes use of this.
-+		  Enable support for G-PHY. This includes support for the following devices:
-+		  PCI: BCM4306, BCM4311, BCM4318
-+		  SoC: BCM5352E, BCM4712
- 
--	config PACKAGE_ATH_DFS
--		bool "Enable DFS support"
-+		  If unsure, say Y.
-+
-+	config PACKAGE_B43_PHY_N
-+		bool "Enable support for N-PHYs"
- 		default y
- 		help
--		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
--		  channels in Europe, US, and Japan.
-+		  Enable support for N-PHY. This includes support for the following devices:
-+		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
-+		  SoC: BCM4716, BCM4717, BCM4718
- 
--		  Select this option if you want to use such channels.
-+		  Currently only 11g speed is available.
- 
--  endif
--endef
-+		  If unsure, say Y.
- 
--define KernelPackage/ath
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Atheros common driver part
--  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath25 +kmod-mac80211
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
--  MENU:=1
--endef
-+	config PACKAGE_B43_PHY_LP
-+		bool "Enable support for LP-PHYs"
-+		default n if TARGET_brcm47xx_mips74k
-+		default y
-+		help
-+		  Enable support for LP-PHY. This includes support for the following devices:
-+		  PCI: BCM4312
-+		  SoC: BCM5354
- 
--define KernelPackage/ath/description
-- This module contains some common parts needed by Atheros Wireless drivers.
--endef
-+		  If unsure, say Y.
- 
--define KernelPackage/ath5k
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Atheros 5xxx wireless cards support
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
--  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
--  AUTOLOAD:=$(call AutoProbe,ath5k)
--endef
-+	config PACKAGE_B43_PHY_HT
-+		bool "Enable support for HT-PHYs"
-+		default n if TARGET_brcm47xx_legacy
-+		default y
-+		help
-+		  Enable support for HT-PHY. This includes support for the following devices:
-+		  PCI: BCM4331
- 
--define KernelPackage/ath5k/description
-- This module adds support for wireless adapters based on
-- Atheros 5xxx chipset.
--endef
-+		  Currently only 11g speed is available.
- 
--define KernelPackage/ath9k-common
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
--  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@KERNEL_RELAY
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
--endef
-+		  If unsure, say Y.
- 
--define KernelPackage/ath9k
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Atheros 802.11n PCI wireless cards support
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
--  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx +kmod-ath9k-common
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
--  AUTOLOAD:=$(call AutoProbe,ath9k)
--endef
-+	config PACKAGE_B43_PHY_LCN
-+		bool "Enable support for LCN-PHYs"
-+		depends on BROKEN
-+		default n
-+		help
-+		  Currently broken.
- 
--define KernelPackage/ath9k/description
--This module adds support for wireless adapters based on
--Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
--endef
-+		  If unsure, say N.
- 
--define KernelPackage/ath9k/config
-+  endif
-+endef
- 
--	config ATH9K_SUPPORT_PCOEM
--		bool "Support chips used in PC OEM cards"
--		depends on PACKAGE_kmod-ath9k
--	
-+define KernelPackage/b43/description
-+Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
- endef
- 
--define KernelPackage/ath9k-htc
-+define KernelPackage/b43legacy
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Atheros 802.11n USB device support
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
--  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
--  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
-+  TITLE:=Broadcom 43xx-legacy wireless support
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-+  KCONFIG:= \
-+  	CONFIG_HW_RANDOM=y
-+  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb +b43legacy-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
-+  AUTOLOAD:=$(call AutoProbe,b43legacy)
-+  MENU:=1
- endef
- 
--define KernelPackage/ath9k-htc/description
--This module adds support for wireless adapters based on
--Atheros USB AR9271 and AR7010 family of chipsets.
-+define KernelPackage/b43legacy/description
-+Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
- endef
- 
--define KernelPackage/ath10k
-+
-+define KernelPackage/brcmutil
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Atheros 802.11ac wireless cards support
--  URL:=https://wireless.wiki.kernel.org/en/users/Drivers/ath10k
--  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
--  AUTOLOAD:=$(call AutoLoad,55,ath10k_core ath10k_pci)
-+  TITLE:=Broadcom IEEE802.11n common driver parts
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-+  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmutil/brcmutil.ko
-+  AUTOLOAD:=$(call AutoProbe,brcmutil)
-+  MENU:=1
- endef
- 
--define KernelPackage/ath10k/description
--This module adds support for wireless adapters based on
--Atheros IEEE 802.11ac family of chipsets. For now only
--PCI is supported.
-+define KernelPackage/brcmutil/description
-+ This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
- endef
- 
--define KernelPackage/ath10k/config
--  if PACKAGE_kmod-ath10k
--
--	config ATH10K_STA_FW
--		bool "Firmware optimized for STA operation"
--		default n
--		help
--		  Use the ath10k firmware optimized for wireless client instead
--		  of access point operation.
-+define KernelPackage/brcmutil/config
-+  if PACKAGE_kmod-brcmutil
- 
--	config ATH10K_API2_FW
--		bool "Firmware optimized for AP operation (v10.1 / API v2)"
--		default n
--		depends on !ATH10K_STA_FW
-+	config PACKAGE_BRCM80211_DEBUG
-+		bool "Broadcom wireless driver debugging"
- 		help
--		  Use the ath10k firmware from the 10.1 SDK using API v2 optimized
--		  for access point operation if the default firmware keeps crashing.
-+		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
- 
-   endif
- endef
- 
--define KernelPackage/carl9170
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Driver for Atheros AR9170 USB sticks
--  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
--  AUTOLOAD:=$(call AutoProbe,carl9170)
-+PKG_BRCMSMAC_FW_NAME:=broadcom-wl
-+PKG_BRCMSMAC_FW_VERSION:=5.100.138
-+PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
-+PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
-+PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-+PKG_BRCMSMAC_FW_MD5SUM:=f4e357b09eaf5d8b1f1920cf3493a555
-+
-+define Download/brcmsmac
-+  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
-+  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
-+  MD5SUM:=$(PKG_BRCMSMAC_FW_MD5SUM)
- endef
-+$(eval $(call Download,brcmsmac))
- 
--define KernelPackage/lib80211
-+define KernelPackage/brcmsmac
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=802.11 Networking stack
--  DEPENDS:=+kmod-cfg80211
--  FILES:= \
--	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
--	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
--	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_ccmp.ko \
--	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_tkip.ko
--  AUTOLOAD:=$(call AutoProbe, \
--	lib80211 \
--	lib80211_crypt_wep \
--	lib80211_crypt_ccmp \
--	lib80211_crypt_tkip \
--  )
-+  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
-+  AUTOLOAD:=$(call AutoProbe,brcmsmac)
-+  MENU:=1
- endef
- 
--define KernelPackage/lib80211/description
-- Kernel modules for 802.11 Networking stack
-- Includes:
-- - lib80211
-- - lib80211_crypt_wep
-- - lib80211_crypt_tkip
-- - lib80211_crytp_ccmp
-+define KernelPackage/brcmsmac/description
-+ Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
- endef
- 
--define KernelPackage/libertas-usb
--  $(call KernelPackage/mac80211/Default)
--  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT
--  TITLE:=Marvell 88W8015 Wireless Driver
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/usb8xxx.ko
--  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
--endef
-+define KernelPackage/brcmsmac/config
-+  if PACKAGE_kmod-brcmsmac
- 
--define KernelPackage/libertas-sdio
--  $(call KernelPackage/mac80211/Default)
--  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml
--  TITLE:=Marvell 88W8686 Wireless Driver
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas_sdio.ko
--  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
--endef
-+	config BRCMSMAC_USE_FW_FROM_WL
-+		bool "Use firmware extracted from broadcom proprietary driver"
-+		default y
-+		help
-+		  Instead of using the official brcmsmac firmware a firmware
-+		  version 666.2 extracted from the proprietary Broadcom driver
-+		  is used. This is needed to get core rev 17 used in bcm4716
-+		  to work.
- 
--define KernelPackage/mac80211-hwsim
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=mac80211 HW simulation device
--  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
--  AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
-+		  If unsure, say Y.
-+
-+  endif
- endef
- 
--define KernelPackage/net-libipw
-+
-+define KernelPackage/brcmfmac
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=libipw for ipw2100 and ipw2200
--  DEPENDS:=@PCI_SUPPORT +kmod-crypto-core +kmod-crypto-arc4 +kmod-crypto-aes +kmod-crypto-michael-mic +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/libipw.ko
--  AUTOLOAD:=$(call AutoProbe,libipw)
-+  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
-+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +kmod-brcmutil \
-+	+BRCMFMAC_PCIE:brcmfmac-firmware-pcie \
-+	+BRCMFMAC_SDIO:kmod-mmc +BRCMFMAC_SDIO:brcmfmac-firmware-sdio \
-+	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
-+  AUTOLOAD:=$(call AutoProbe,brcmfmac)
- endef
- 
--define KernelPackage/net-libipw/description
-- Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-+define KernelPackage/brcmfmac/description
-+ Kernel module for Broadcom IEEE802.11n USB Wireless cards
- endef
- 
--IPW2100_NAME:=ipw2100-fw
--IPW2100_VERSION:=1.3
--
--define Download/net-ipw2100
--  URL:=http://bughost.org/firmware/
--  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
--  MD5SUM=46aa75bcda1a00efa841f9707bbbd113
--endef
--$(eval $(call Download,net-ipw2100))
-+define KernelPackage/brcmfmac/config
-+  if PACKAGE_kmod-brcmfmac
- 
--define KernelPackage/net-ipw2100
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Intel IPW2100 driver
--  DEPENDS:=@PCI_SUPPORT +kmod-net-libipw
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2100.ko
--  AUTOLOAD:=$(call AutoProbe,ipw2100)
--endef
-+	config BRCMFMAC_SDIO
-+		bool "Enable SDIO bus interface support"
-+		default n
-+		help
-+		  Enable support for cards attached to an SDIO bus.
-+		  Select this option only if you are sure that your
-+		  board has a Broadcom wireless chip atacched to
-+		  that bus.
- 
--define KernelPackage/net-ipw2100/description
-- Kernel support for Intel IPW2100
-- Includes:
-- - ipw2100
--endef
-+	config BRCMFMAC_USB
-+		bool "Enable USB bus interface support"
-+		depends on USB_SUPPORT
-+		default y
-+		help
-+		  Supported USB connected chipsets:
-+		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
-+		  BCM43143, BCM43242, BCM43566, BCM43569
- 
--IPW2200_NAME:=ipw2200-fw
--IPW2200_VERSION:=3.1
-+	config BRCMFMAC_PCIE
-+		bool "Enable PCIE bus interface support"
-+		depends on PCI_SUPPORT
-+		default y
-+		help
-+		  Supported PCIe connected chipsets:
-+		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
- 
--define Download/net-ipw2200
--  URL:=http://bughost.org/firmware/
--  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
--  MD5SUM=eaba788643c7cc7483dd67ace70f6e99
-+  endif
- endef
--$(eval $(call Download,net-ipw2200))
- 
--define KernelPackage/net-ipw2200
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Intel IPW2200 driver
--  DEPENDS:=@PCI_SUPPORT +kmod-net-libipw
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2200.ko
--  AUTOLOAD:=$(call AutoProbe,ipw2200)
--endef
- 
--define KernelPackage/net-ipw2200/description
-- Kernel support for Intel IPW2200
-- Includes:
-- - ipw2200
-+define KernelPackage/carl9170
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for Atheros AR9170 USB sticks
-+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
-+  AUTOLOAD:=$(call AutoProbe,carl9170)
- endef
- 
- 
--define KernelPackage/net-hermes
-+define KernelPackage/hermes
-   $(call KernelPackage/mac80211/Default)
-   TITLE:=Hermes 802.11b chipset support
--  DEPENDS:=@PCI_SUPPORT||PCMCIA_SUPPORT +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco.ko
-+  DEPENDS:=@PCI_SUPPORT||PCMCIA_SUPPORT +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT +kmod-crypto-michael-mic
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco.ko
-   AUTOLOAD:=$(call AutoProbe,orinoco)
- endef
- 
--define KernelPackage/net-hermes/description
-+define KernelPackage/hermes/description
-  Kernel support for Hermes 802.11b chipsets
- endef
- 
--define KernelPackage/net-hermes-pci
-+define KernelPackage/hermes-pci
-   $(call KernelPackage/mac80211/Default)
-   TITLE:=Intersil Prism 2.5 PCI support
--  DEPENDS:=@PCI_SUPPORT +kmod-net-hermes
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_pci.ko
-+  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_pci.ko
-   AUTOLOAD:=$(call AutoProbe,orinoco_pci)
- endef
- 
--define KernelPackage/net-hermes-pci/description
-+define KernelPackage/hermes-pci/description
-  Kernel modules for Intersil Prism 2.5 PCI support
- endef
- 
--define KernelPackage/net-hermes-plx
-+define KernelPackage/hermes-plx
-   $(call KernelPackage/mac80211/Default)
-   TITLE:=PLX9052 based PCI adaptor
--  DEPENDS:=@PCI_SUPPORT +kmod-net-hermes
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_plx.ko
-+  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_plx.ko
-   AUTOLOAD:=$(call AutoProbe,orinoco_plx)
- endef
- 
--define KernelPackage/net-hermes-plx/description
-+define KernelPackage/hermes-plx/description
-  Kernel modules for Hermes in PLX9052 based PCI adaptors
- endef
- 
--define KernelPackage/net-hermes-pcmcia
-+define KernelPackage/hermes-pcmcia
-   $(call KernelPackage/mac80211/Default)
-   TITLE:=Hermes based PCMCIA adaptors
--  DEPENDS:=@PCMCIA_SUPPORT +kmod-net-hermes @BROKEN
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/orinoco/orinoco_cs.ko
-+  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes @BROKEN
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
-   AUTOLOAD:=$(call AutoProbe,orinoco_cs)
- endef
- 
--define KernelPackage/net-hermes-pcmcia/description
-+define KernelPackage/hermes-pcmcia/description
-  Kernel modules for Hermes based PCMCIA adaptors
- endef
- 
--define KernelPackage/iwlagn
-+
-+define KernelPackage/iwlwifi
-   $(call KernelPackage/mac80211/Default)
--  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT
-+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +iwlwifi-firmware
-   TITLE:=Intel AGN Wireless support
-   FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/iwlwifi.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/iwlwifi/dvm/iwldvm.ko
--  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm)
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/dvm/iwldvm.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/mvm/iwlmvm.ko
-+  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm iwlmvm)
-   MENU:=1
- endef
- 
--define KernelPackage/iwlagn/description
-- iwlagn kernel module for Intel 5000/5150/1000/6000/6050/6005/6030/100 support
--endef
--
--define KernelPackage/iwlagn/config
--  if PACKAGE_kmod-iwlagn
--
--	config IWL5000_FW
--		bool "Intel 5000 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
--
--	config IWL5150_FW
--		bool "Intel 5150 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Wireless WiFi 5150AGN
--
--	config IWL1000_FW
--		bool "Intel 1000 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Wireless-N 1000
--
--	config IWL6000_FW
--		bool "Intel 6000 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Ultimate-N 6300 and Advanced-N 6200
--
--	config IWL6050_FW
--		bool "Intel 6050 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Advanced-N + WiMAX 6250 and Wireless-N + WiMAX 6150
--
--	config IWL6005_FW
--		bool "Intel 6005 Firmware"
--		default y
-+define KernelPackage/iwlwifi/description
-+ iwlwifi kernel module for
-+ Intel Wireless WiFi Link 6250AGN Adapter
-+ Intel 6000 Series Wi-Fi Adapters (6200AGN and 6300AGN)
-+ Intel WiFi Link 1000BGN
-+ Intel Wireless WiFi 5150AGN
-+ Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
-+ Intel 6005 Series Wi-Fi Adapters
-+ Intel 6030 Series Wi-Fi Adapters
-+ Intel Wireless WiFi Link 6150BGN 2 Adapter
-+ Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
-+ Intel 2000 Series Wi-Fi Adapters
-+ Intel 7260 Wi-Fi Adapter
-+ Intel 3160 Wi-Fi Adapter
-+ Intel 7265 Wi-Fi Adapter
-+ Intel 8260 Wi-Fi Adapter
-+ Intel 3165 Wi-Fi Adapter
-+endef
-+
-+define KernelPackage/iwlwifi/config
-+  if PACKAGE_kmod-iwlwifi
-+
-+	config PACKAGE_IWLWIFI_DEBUG
-+		bool "Enable full debugging output in the iwlwifi driver"
-+		default n
- 		help
--		  Download and install firmware for:
--		    Intel Centrino Advanced-N 6205
-+		  This option will enable debug tracing output for the iwlwifi drivers
- 
--	config IWL6030_FW
--		bool "Intel 6030 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Advanced-N 6230, Wireless-N 1030, Wireless-N 130 and Advanced-N 6235
-+		  This will result in the kernel module being ~100k larger.  You can
-+		  control which debug output is sent to the kernel log by setting the
-+		  value in
- 
--	config IWL7260_FW
--		bool "Intel 7260 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Dual Band Wireless-N 7260 and Intel Dual Band Wireless-AC 7260
-+			/sys/module/iwlwifi/parameters/debug
- 
--	config IWL7265_FW
--		bool "Intel 7265 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Wireless 7265
-+		  This entry will only exist if this option is enabled.
- 
--	config IWL100_FW
--		bool "Intel 100 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Wireless-N 100
-+		  To set a value, simply echo an 8-byte hex value to the same file:
- 
--	config IWL2000_FW
--		bool "Intel 2000 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Wireless-N 2200
-+			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
- 
--	config IWL2030_FW
--		bool "Intel 2030 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Wireless-N 2230
-+		  You can find the list of debug mask values in:
-+			  drivers/net/wireless/intel/iwlwifi/iwl-debug.h
- 
--	config IWL105_FW
--		bool "Intel 105 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Centrino Wireless-N 105
-+		  If this is your first time using this driver, you should say Y here
-+		  as the debug information can assist others in helping you resolve
-+		  any problems you may encounter.
- 
--	config IWL135_FW
--		bool "Intel 135 Firmware"
--		default y
-+	config PACKAGE_IWLWIFI_DEBUGFS
-+	        bool "iwlwifi debugfs support"
-+		depends on PACKAGE_MAC80211_DEBUGFS
-+		default n
- 		help
--		  Download and install firmware for:
--		    Intel Centrino Wireless-N 135
-+		  Enable creation of debugfs files for the iwlwifi drivers. This
-+		  is a low-impact option that allows getting insight into the
-+		  driver's state at runtime.
- 
--	config IWL3160_FW
--		bool "Intel 3160 Firmware"
--		default y
--		help
--		  Download and install firmware for:
--		    Intel Wireless 3160
-   endif
- endef
- 
-@@ -942,7 +834,7 @@ define KernelPackage/iwl-legacy
-   $(call KernelPackage/mac80211/Default)
-   DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
-   TITLE:=Intel legacy Wireless support
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwlegacy.ko
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
-   AUTOLOAD:=$(call AutoProbe,iwlegacy)
- endef
- 
-@@ -952,9 +844,9 @@ endef
- 
- define KernelPackage/iwl3945
-   $(call KernelPackage/mac80211/Default)
--  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy
-+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
-   TITLE:=Intel iwl3945 Wireless support
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwl3945.ko
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
-   AUTOLOAD:=$(call AutoProbe,iwl3945)
- endef
- 
-@@ -964,9 +856,9 @@ endef
- 
- define KernelPackage/iwl4965
-   $(call KernelPackage/mac80211/Default)
--  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT
-+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
-   TITLE:=Intel iwl4965 Wireless support
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/iwlegacy/iwl4965.ko
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
-   AUTOLOAD:=$(call AutoProbe,iwl4965)
- endef
- 
-@@ -975,557 +867,576 @@ define KernelPackage/iwl4965/description
- endef
- 
- 
--define KernelPackage/mwl8k
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
--  URL:=http://wireless.kernel.org/en/users/Drivers/mwl8k
--  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mwl8k.ko
--  AUTOLOAD:=$(call AutoProbe,mwl8k)
--endef
--
--define KernelPackage/mwl8k/description
-- Kernel modules for Marvell TOPDOG 802.11 Wireless cards
--endef
--
--
--define KernelPackage/mwifiex-pcie
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
--  URL:=http://wireless.kernel.org/en/users/Drivers/mwifiex
--  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT
--  FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/mwifiex/mwifiex.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/mwifiex/mwifiex_pcie.ko
--  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
--endef
--
--define KernelPackage/mwifiex-pcie/description
-- Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
--endef
--
--
--define KernelPackage/wlcore
-+define KernelPackage/lib80211
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=TI common driver part
--  DEPENDS+= @TARGET_omap +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  TITLE:=802.11 Networking stack
-+  DEPENDS:=+kmod-cfg80211
-   FILES:= \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
--	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
--  AUTOLOAD:=$(call AutoProbe,wlcore wlcore_sdio)
--endef
--
--define KernelPackage/wlcore/description
-- This module contains some common parts needed by TI Wireless drivers.
--endef
--
--define KernelPackage/wl12xx
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Driver for TI WL12xx
--  URL:=http://wireless.kernel.org/en/users/Drivers/wl12xx
--  DEPENDS+= +kmod-wlcore
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl12xx/wl12xx.ko
--  AUTOLOAD:=$(call AutoProbe,wl12xx)
--endef
--
--define KernelPackage/wl12xx/description
-- Kernel modules for TI WL12xx
--endef
--
--define KernelPackage/wl18xx
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Driver for TI WL18xx
--  URL:=http://wireless.kernel.org/en/users/Drivers/wl18xx
--  DEPENDS+= +kmod-wlcore
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl18xx/wl18xx.ko
--  AUTOLOAD:=$(call AutoProbe,wl18xx)
--endef
--
--define KernelPackage/wl18xx/description
-- Kernel modules for TI WL18xx
--endef
--
--
--#Broadcom firmware
--ifneq ($(CONFIG_B43_FW_6_30),)
--  PKG_B43_FWV4_NAME:=broadcom-wl
--  PKG_B43_FWV4_VERSION:=6.30.163.46
--  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).wl_apsta.o
--  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
--  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
--  PKG_B43_FWV4_MD5SUM:=6fe97e9368d25342a1ab943d3cf3496d
--else
--ifneq ($(CONFIG_B43_FW_5_10),)
--  PKG_B43_FWV4_NAME:=broadcom-wl
--  PKG_B43_FWV4_VERSION:=5.10.56.27.3
--  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta/wl_prebuilt.o
--  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)_mipsel.tar.bz2
--  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
--  PKG_B43_FWV4_MD5SUM:=3363e3a6b3d9d73c49dea870c7834eac
--else
--ifneq ($(CONFIG_B43_FW_4_178),)
--  PKG_B43_FWV4_NAME:=broadcom-wl
--  PKG_B43_FWV4_VERSION:=4.178.10.4
--  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
--  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
--  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
--  PKG_B43_FWV4_MD5SUM:=14477e8cbbb91b11896affac9b219fdb
--else
--ifneq ($(CONFIG_B43_FW_5_100_138),)
--  PKG_B43_FWV4_NAME:=broadcom-wl
--  PKG_B43_FWV4_VERSION:=5.100.138
--  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
--  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
--  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
--  PKG_B43_FWV4_MD5SUM:=f4e357b09eaf5d8b1f1920cf3493a555
--else
--  PKG_B43_FWV4_NAME:=broadcom-wl
--  PKG_B43_FWV4_VERSION:=4.150.10.5
--  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta_mimo.o
--  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
--  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
--  PKG_B43_FWV4_MD5SUM:=0c6ba9687114c6b598e8019e262d9a60
--endif
--endif
--endif
--endif
--ifneq ($(CONFIG_B43_OPENFIRMWARE),)
--  PKG_B43_FWV4_NAME:=broadcom-wl
--  PKG_B43_FWV4_VERSION:=5.2
--  PKG_B43_FWV4_OBJECT:=openfwwf-$(PKG_B43_FWV4_VERSION)
--  PKG_B43_FWV4_SOURCE:=openfwwf-$(PKG_B43_FWV4_VERSION).tar.gz
--  PKG_B43_FWV4_SOURCE_URL:=http://www.ing.unibs.it/openfwwf/firmware/
--  PKG_B43_FWV4_MD5SUM:=e045a135453274e439ae183f8498b0fa
--endif
--
--
--PKG_B43_FWV3_NAME:=wl_apsta
--PKG_B43_FWV3_VERSION:=3.130.20.0
--PKG_B43_FWV3_SOURCE:=$(PKG_B43_FWV3_NAME)-$(PKG_B43_FWV3_VERSION).o
--PKG_B43_FWV3_SOURCE_URL:=http://downloads.openwrt.org/sources/
--PKG_B43_FWV3_MD5SUM:=e08665c5c5b66beb9c3b2dd54aa80cb3
--
--define Download/b43
--  FILE:=$(PKG_B43_FWV4_SOURCE)
--  URL:=$(PKG_B43_FWV4_SOURCE_URL)
--  MD5SUM:=$(PKG_B43_FWV4_MD5SUM)
-+	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
-+	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
-+	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_ccmp.ko \
-+	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_tkip.ko
-+  AUTOLOAD:=$(call AutoProbe, \
-+	lib80211 \
-+	lib80211_crypt_wep \
-+	lib80211_crypt_ccmp \
-+	lib80211_crypt_tkip \
-+  )
- endef
--$(eval $(call Download,b43))
- 
--define Download/b43legacy
--  FILE:=$(PKG_B43_FWV3_SOURCE)
--  URL:=$(PKG_B43_FWV3_SOURCE_URL)
--  MD5SUM:=$(PKG_B43_FWV3_MD5SUM)
-+define KernelPackage/lib80211/description
-+ Kernel modules for 802.11 Networking stack
-+ Includes:
-+ - lib80211
-+ - lib80211_crypt_wep
-+ - lib80211_crypt_tkip
-+ - lib80211_crytp_ccmp
- endef
--$(eval $(call Download,b43legacy))
- 
- 
--define KernelPackage/b43
-+define KernelPackage/libipw
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom 43xx wireless support
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
--  KCONFIG:= \
--  	CONFIG_HW_RANDOM=y
--  # Depend on PCI_SUPPORT to make sure we can select kmod-bcma or kmod-ssb
--  DEPENDS += \
--	@PCI_SUPPORT +kmod-mac80211 \
--	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
--	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43/b43.ko
--  AUTOLOAD:=$(call AutoProbe,b43)
--  MENU:=1
--endef
--
--define KernelPackage/b43/config
--
--config PACKAGE_B43_USE_SSB
--	select PACKAGE_kmod-ssb
--	tristate
--	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
--	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
--	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
--
--config PACKAGE_B43_USE_BCMA
--	select PACKAGE_kmod-bcma
--	tristate
--	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
--	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
--	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
--
--  if PACKAGE_kmod-b43
-+  TITLE:=libipw for ipw2100 and ipw2200
-+  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
-+  AUTOLOAD:=$(call AutoProbe,libipw)
-+endef
- 
--	choice
--		prompt "b43 firmware version"
--		default B43_FW_5_100_138
--		help
--		  This option allows you to select the version of the b43 firmware.
-+define KernelPackage/libipw/description
-+ Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-+endef
- 
--	config B43_FW_4_150
--		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
--		help
--		  Old stable firmware for BCM43xx devices.
-+IPW2100_NAME:=ipw2100-fw
-+IPW2100_VERSION:=1.3
- 
--		  If unsure, select this.
-+define Download/ipw2100
-+  URL:=http://bughost.org/firmware/
-+  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-+  MD5SUM=46aa75bcda1a00efa841f9707bbbd113
-+endef
-+$(eval $(call Download,ipw2100))
- 
--	config B43_FW_4_178
--		bool "Firmware 478.104 from driver 4.178.10.4"
--		help
--		  Older firmware for BCM43xx devices.
-+define KernelPackage/ipw2100
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Intel IPW2100 driver
-+  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
-+  AUTOLOAD:=$(call AutoProbe,ipw2100)
-+endef
- 
--		  If unsure, select the "stable" firmware.
-+define KernelPackage/ipw2100/description
-+ Kernel support for Intel IPW2100
-+ Includes:
-+ - ipw2100
-+endef
- 
--	config B43_FW_5_10
--		bool "Firmware 508.1084 from driver 5.10.56.27"
--		help
--		  Older firmware for BCM43xx devices.
-+IPW2200_NAME:=ipw2200-fw
-+IPW2200_VERSION:=3.1
- 
--		  If unsure, select the "stable" firmware.
-+define Download/ipw2200
-+  URL:=http://bughost.org/firmware/
-+  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-+  MD5SUM=eaba788643c7cc7483dd67ace70f6e99
-+endef
-+$(eval $(call Download,ipw2200))
- 
--	config B43_FW_5_100_138
--		bool "Firmware 666.2 from driver 5.100.138 (stable)"
--		help
--		  The currently default firmware for BCM43xx devices.
-+define KernelPackage/ipw2200
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Intel IPW2200 driver
-+  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
-+  AUTOLOAD:=$(call AutoProbe,ipw2200)
-+endef
- 
--		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
-+define KernelPackage/ipw2200/description
-+ Kernel support for Intel IPW2200
-+ Includes:
-+ - ipw2200
-+endef
- 
--		  If unsure, select the this firmware.
- 
--	config B43_FW_6_30
--		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
--		help
--		  Newer experimental firmware for BCM43xx devices.
-+define KernelPackage/libertas-usb
-+  $(call KernelPackage/mac80211/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware
-+  TITLE:=Marvell 88W8015 Wireless Driver
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
-+  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
-+endef
- 
--		  This firmware is mostly untested.
-+define KernelPackage/libertas-sdio
-+  $(call KernelPackage/mac80211/Default)
-+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware
-+  TITLE:=Marvell 88W8686 Wireless Driver
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
-+  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
-+endef
- 
--		  If unsure, select the "stable" firmware.
-+define KernelPackage/libertas-spi
-+  $(call KernelPackage/mac80211/Default)
-+  SUBMENU:=Wireless Drivers
-+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-spi-firmware
-+  KCONFIG := \
-+	CONFIG_SPI=y \
-+	CONFIG_SPI_MASTER=y
-+  TITLE:=Marvell 88W8686 SPI Wireless Driver
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
-+  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
-+endef
- 
--	config B43_OPENFIRMWARE
--		bool "Open FirmWare for WiFi networks"
--		help
--		  Opensource firmware for BCM43xx devices.
-+define KernelPackage/mac80211-hwsim
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=mac80211 HW simulation device
-+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
-+  AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
-+endef
- 
--		  Do _not_ select this, unless you know what you are doing.
--		  The Opensource firmware is not suitable for embedded devices, yet.
--		  It does not support QoS, which is bad for AccessPoints.
--		  It does not support hardware crypto acceleration, which is a showstopper
--		  for embedded devices with low CPU resources.
- 
--		  If unsure, select the "stable" firmware.
-+define KernelPackage/mt7601u
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=MT7601U-based USB dongles Wireless Driver
-+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
-+  AUTOLOAD:=$(call AutoProbe,mt7601u)
-+endef
- 
--	endchoice
- 
--	config B43_FW_SQUASH
--		bool "Remove unnecessary firmware files"
--		depends on !B43_OPENFIRMWARE
--		default y
--		help
--		  This options allows you to remove unnecessary b43 firmware files
--		  from the final rootfs image. This can reduce the rootfs size by
--		  up to 200k.
-+define KernelPackage/mwl8k
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
-+  URL:=http://wireless.kernel.org/en/users/Drivers/mwl8k
-+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
-+  AUTOLOAD:=$(call AutoProbe,mwl8k)
-+endef
- 
--		  If unsure, say Y.
-+define KernelPackage/mwl8k/description
-+ Kernel modules for Marvell TOPDOG 802.11 Wireless cards
-+endef
- 
--	config B43_FW_SQUASH_COREREVS
--		string "Core revisions to include"
--		depends on B43_FW_SQUASH
--		default "5,6,7,8,9,10,11,13,15" if TARGET_brcm47xx_legacy
--		default "16,28,29,30" if TARGET_brcm47xx_mips74k
--		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
--		help
--		  This is a comma seperated list of core revision numbers.
- 
--		  Example (keep files for rev5 only):
--		    5
-+define KernelPackage/mwifiex-pcie
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
-+  URL:=http://wireless.kernel.org/en/users/Drivers/mwifiex
-+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwifiex-pcie-firmware
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
-+  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
-+endef
- 
--		  Example (keep files for rev5 and rev11):
--		    5,11
-+define KernelPackage/mwifiex-pcie/description
-+ Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
-+endef
- 
--	config B43_FW_SQUASH_PHYTYPES
--		string "PHY types to include"
--		depends on B43_FW_SQUASH
--		default "G,N,LP" if TARGET_brcm47xx_legacy
--		default "N,HT" if TARGET_brcm47xx_mips74k
--		default "G,N,LP,HT"
--		help
--		  This is a comma seperated list of PHY types:
--		    A  => A-PHY
--		    AG => Dual A-PHY G-PHY
--		    G  => G-PHY
--		    LP => LP-PHY
--		    N  => N-PHY
--		    HT  => HT-PHY
--		    LCN  => LCN-PHY
--		    LCN40  => LCN40-PHY
--		    AC  => AC-PHY
- 
--		  Example (keep files for G-PHY only):
--		    G
-+# Prism54 drivers
-+P54PCIFW:=2.13.12.0.arm
-+P54USBFW:=2.13.24.0.lm87.arm
-+P54SPIFW:=2.13.0.0.a.13.14.arm
- 
--		  Example (keep files for G-PHY and N-PHY):
--		    G,N
-+define Download/p54usb
-+  FILE:=$(P54USBFW)
-+  URL:=http://daemonizer.de/prism54/prism54-fw/fw-usb
-+  MD5SUM:=8e8ab005a4f8f0123bcdc51bc25b47f6
-+endef
-+$(eval $(call Download,p54usb))
- 
--	choice
--		prompt "Supported buses"
--		default PACKAGE_B43_BUSES_BCMA_AND_SSB
--		help
--		  This allows choosing buses that b43 should support.
-+define Download/p54pci
-+  FILE:=$(P54PCIFW)
-+  URL:=http://daemonizer.de/prism54/prism54-fw/fw-softmac
-+  MD5SUM:=ff7536af2092b1c4b21315bd103ef4c4
-+endef
-+$(eval $(call Download,p54pci))
- 
--	config PACKAGE_B43_BUSES_BCMA_AND_SSB
--		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
--		bool "BCMA and SSB"
-+define Download/p54spi
-+  FILE:=$(P54SPIFW)
-+  URL:=http://daemonizer.de/prism54/prism54-fw/stlc4560
-+  MD5SUM:=42661f8ecbadd88012807493f596081d
-+endef
-+$(eval $(call Download,p54spi))
- 
--	config PACKAGE_B43_BUSES_BCMA
--		depends on !TARGET_brcm47xx_legacy
--		bool "BCMA only"
-+define KernelPackage/p54/Default
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Prism54 Drivers
-+endef
- 
--	config PACKAGE_B43_BUSES_SSB
--		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
--		bool "SSB only"
-+define KernelPackage/p54/description
-+  Kernel module for Prism54 chipsets (mac80211)
-+endef
- 
--	endchoice
-+define KernelPackage/p54-common
-+  $(call KernelPackage/p54/Default)
-+  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt
-+  TITLE+= (COMMON)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54common.ko
-+endef
- 
--	config PACKAGE_B43_DEBUG
--		bool "Enable debug output and debugfs for b43"
--		default n
--		help
--		  Enable additional debug output and runtime sanity checks for b43
--		  and enables the debugfs interface.
-+define KernelPackage/p54-pci
-+  $(call KernelPackage/p54/Default)
-+  TITLE+= (PCI)
-+  DEPENDS+= @PCI_SUPPORT +kmod-p54-common
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54pci.ko
-+  AUTOLOAD:=$(call AutoProbe,p54pci)
-+endef
- 
--		  If unsure, say N.
-+define KernelPackage/p54-usb
-+  $(call KernelPackage/p54/Default)
-+  TITLE+= (USB)
-+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54usb.ko
-+  AUTOLOAD:=$(call AutoProbe,p54usb)
-+endef
- 
--	config PACKAGE_B43_PIO
--		bool "Enable support for PIO transfer mode"
--		default n
--		help
--		  Enable support for using PIO instead of DMA. Unless you have DMA
--		  transfer problems you don't need this.
-+define KernelPackage/p54-spi
-+  $(call KernelPackage/p54/Default)
-+  TITLE+= (SPI)
-+  DEPENDS+= @TARGET_omap24xx +kmod-p54-common
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54spi.ko
-+  AUTOLOAD:=$(call AutoProbe,p54spi)
-+endef
- 
--		  If unsure, say N.
-+define KernelPackage/rt2x00/Default
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Ralink Drivers for RT2x00 cards
-+endef
- 
--	config PACKAGE_B43_PHY_G
--		bool "Enable support for G-PHYs"
--		default n if TARGET_brcm47xx_mips74k
--		default y
--		help
--		  Enable support for G-PHY. This includes support for the following devices:
--		  PCI: BCM4306, BCM4311, BCM4318
--		  SoC: BCM5352E, BCM4712
-+define KernelPackage/rt2x00-lib
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-lib-crc-itu-t
-+  TITLE+= (LIB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00lib.ko
-+  MENU:=1
-+endef
- 
--		  If unsure, say Y.
-+define KernelPackage/rt2x00-lib/config
-+  if PACKAGE_kmod-rt2x00-lib
- 
--	config PACKAGE_B43_PHY_N
--		bool "Enable support for N-PHYs"
--		default y
-+	config PACKAGE_RT2X00_LIB_DEBUGFS
-+		bool "Enable rt2x00 debugfs support"
-+		depends on PACKAGE_MAC80211_DEBUGFS
- 		help
--		  Enable support for N-PHY. This includes support for the following devices:
--		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
--		  SoC: BCM4716, BCM4717, BCM4718
-+		  Enable creation of debugfs files for the rt2x00 drivers.
-+		  These debugfs files support both reading and writing of the
-+		  most important register types of the rt2x00 hardware.
- 
--		  Currently only 11g speed is available.
-+	config PACKAGE_RT2X00_DEBUG
-+		bool "Enable rt2x00 debug output"
-+		help
-+		  Enable debugging output for all rt2x00 modules
- 
--		  If unsure, say Y.
-+  endif
-+endef
- 
--	config PACKAGE_B43_PHY_LP
--		bool "Enable support for LP-PHYs"
--		default n if TARGET_brcm47xx_mips74k
--		default y
--		help
--		  Enable support for LP-PHY. This includes support for the following devices:
--		  PCI: BCM4312
--		  SoC: BCM5354
-+define KernelPackage/rt2x00-mmio
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
-+  HIDDEN:=1
-+  TITLE+= (MMIO)
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko
-+endef
- 
--		  If unsure, say Y.
-+define KernelPackage/rt2x00-pci
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
-+  HIDDEN:=1
-+  TITLE+= (PCI)
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
-+endef
- 
--	config PACKAGE_B43_PHY_HT
--		bool "Enable support for HT-PHYs"
--		default n if TARGET_brcm47xx_legacy
--		default y
--		help
--		  Enable support for HT-PHY. This includes support for the following devices:
--		  PCI: BCM4331
-+define KernelPackage/rt2x00-usb
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
-+  HIDDEN:=1
-+  TITLE+= (USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00usb.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
-+endef
- 
--		  Currently only 11g speed is available.
-+define KernelPackage/rt2800-lib
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
-+  HIDDEN:=1
-+  TITLE+= (rt2800 LIB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
-+endef
- 
--		  If unsure, say Y.
-+define KernelPackage/rt2400-pci
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
-+  TITLE+= (RT2400 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-+endef
- 
--	config PACKAGE_B43_PHY_LCN
--		bool "Enable support for LCN-PHYs"
--		depends on BROKEN
--		default n
--		help
--		  Currently broken.
-+define KernelPackage/rt2500-pci
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
-+  TITLE+= (RT2500 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-+endef
- 
--		  If unsure, say N.
-+define KernelPackage/rt2500-usb
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
-+  TITLE+= (RT2500 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-+endef
- 
--  endif
-+define KernelPackage/rt2800-mmio
-+$(call KernelPackage/rt2x00/Default)
-+  TITLE += (RT28xx/RT3xxx MMIO)
-+  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
-+  HIDDEN:=1
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800mmio.ko
- endef
- 
--define KernelPackage/b43/description
--Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
-+define KernelPackage/rt2800-soc
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
-+  TITLE += (RT28xx/RT3xxx SoC)
-+  FILES := \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00soc.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800soc.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2800soc)
- endef
- 
--define KernelPackage/b43legacy
--  $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom 43xx-legacy wireless support
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
--  KCONFIG:= \
--  	CONFIG_HW_RANDOM=y
--  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43legacy/b43legacy.ko
--  AUTOLOAD:=$(call AutoProbe,b43legacy)
--  MENU:=1
-+define KernelPackage/rt2800-pci
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio +rt2800-pci-firmware
-+  TITLE+= (RT2860 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2800pci)
- endef
- 
--define KernelPackage/b43legacy/config
--  if PACKAGE_kmod-b43legacy
-+define KernelPackage/rt2800-usb
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt +rt2800-usb-firmware
-+  TITLE+= (RT2870 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800usb.ko
-+  AUTOLOAD:=$(call AutoProbe,rt2800usb)
-+endef
- 
--	config B43LEGACY_FW_SQUASH
--		bool "Remove unnecessary firmware files"
--		default y
--		help
--		  This options allows you to remove unnecessary b43legacy firmware files
--		  from the final rootfs image. This can reduce the rootfs size by
--		  up to 50k.
- 
--		  If unsure, say Y.
-+define KernelPackage/rt61-pci
-+$(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +rt61-pci-firmware
-+  TITLE+= (RT2x61 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rt61pci)
-+endef
- 
--	config B43LEGACY_FW_SQUASH_COREREVS
--		string "Core revisions to include"
--		depends on B43LEGACY_FW_SQUASH
--		default "1,2,3,4"
--		help
--		  This is a comma seperated list of core revision numbers.
-+define KernelPackage/rt73-usb
-+  $(call KernelPackage/rt2x00/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +rt73-usb-firmware
-+  TITLE+= (RT73 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
-+  AUTOLOAD:=$(call AutoProbe,rt73usb)
-+endef
- 
--		  Example (keep files for rev4 only):
--		    4
- 
--		  Example (keep files for rev2 and rev4):
--		    2,4
-+define KernelPackage/rtl818x/Default
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek Drivers for RTL818x devices
-+  URL:=http://wireless.kernel.org/en/users/Drivers/rtl8187
-+  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
-+endef
- 
--  endif
-+define KernelPackage/rtl8180
-+  $(call KernelPackage/rtl818x/Default)
-+  DEPENDS+= @PCI_SUPPORT
-+  TITLE+= (RTL8180 PCI)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
- endef
- 
--define KernelPackage/b43legacy/description
--Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
-+define KernelPackage/rtl8187
-+$(call KernelPackage/rtl818x/Default)
-+  DEPENDS+= @USB_SUPPORT +kmod-usb-core
-+  TITLE+= (RTL8187 USB)
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8187)
- endef
- 
-+define KernelPackage/rtlwifi/config
-+	config PACKAGE_RTLWIFI_DEBUG
-+		bool "Realtek wireless debugging"
-+		depends on PACKAGE_kmod-rtlwifi
-+		help
-+		  Say Y, if you want to debug realtek wireless drivers.
-+
-+endef
- 
--define KernelPackage/brcmutil
-+define KernelPackage/rtlwifi
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom IEEE802.11n common driver parts
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
--  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmutil/brcmutil.ko
--  AUTOLOAD:=$(call AutoProbe,brcmutil)
--  MENU:=1
-+  TITLE:=Realtek common driver part
-+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
-+  HIDDEN:=1
- endef
- 
--define KernelPackage/brcmutil/description
-- This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
-+define KernelPackage/rtlwifi-pci
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek common driver part (PCI support)
-+  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl_pci)
-+  HIDDEN:=1
- endef
- 
--define KernelPackage/brcmutil/config
--  if PACKAGE_kmod-brcmutil
-+define KernelPackage/rtlwifi-usb
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek common driver part (USB support)
-+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl_usb)
-+  HIDDEN:=1
-+endef
- 
--	config PACKAGE_BRCM80211_DEBUG
--		bool "Broadcom wireless driver debugging"
--		help
--		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
-+define KernelPackage/rtl8192c-common
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
-+  DEPENDS+= +kmod-rtlwifi
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
-+  HIDDEN:=1
-+endef
- 
--  endif
-+define KernelPackage/rtl8192ce
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192CE/RTL8188CE support
-+  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common +rtl8192ce-firmware
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
- endef
- 
--PKG_BRCMSMAC_FW_NAME:=broadcom-wl
--PKG_BRCMSMAC_FW_VERSION:=5.100.138
--PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
--PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
--PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
--PKG_BRCMSMAC_FW_MD5SUM:=f4e357b09eaf5d8b1f1920cf3493a555
-+define KernelPackage/rtl8192se
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192SE/RTL8191SE support
-+  DEPENDS+= +kmod-rtlwifi-pci +rtl8192se-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192se)
-+endef
- 
--define Download/brcmsmac
--  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
--  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
--  MD5SUM:=$(PKG_BRCMSMAC_FW_MD5SUM)
-+define KernelPackage/rtl8192de
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Realtek RTL8192DE/RTL8188DE support
-+  DEPENDS+= +kmod-rtlwifi-pci +rtl8192de-firmware
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192de)
- endef
--$(eval $(call Download,brcmsmac))
- 
--define KernelPackage/brcmsmac
-+define KernelPackage/rtl8192cu
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
--  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmsmac/brcmsmac.ko
--  AUTOLOAD:=$(call AutoProbe,brcmsmac)
--  MENU:=1
-+  TITLE:=Realtek RTL8192CU/RTL8188CU support
-+  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common +rtl8192cu-firmware
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
- endef
- 
--define KernelPackage/brcmsmac/description
-- Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
-+
-+define KernelPackage/rtl8xxxu
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=alternative Realtek RTL8XXXU support
-+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8xxxu)
- endef
- 
--define KernelPackage/brcmsmac/config
--  if PACKAGE_kmod-brcmsmac
-+define KernelPackage/rtl8xxxu/description
-+  This is an alternative driver for various Realtek RTL8XXX
-+  parts written to utilize the Linux mac80211 stack.
-+  The driver is known to work with a number of RTL8723AU,
-+  RL8188CU, RTL8188RU, RTL8191CU, and RTL8192CU devices
- 
--	config BRCMSMAC_USE_FW_FROM_WL
--		bool "Use firmware extracted from broadcom proprietary driver"
--		default y
--		help
--		  Instead of using the official brcmsmac firmware a firmware
--		  version 666.2 extracted from the proprietary Broadcom driver
--		  is used. This is needed to get core rev 17 used in bcm4716
--		  to work.
-+  This driver is under development and has a limited feature
-+  set. In particular it does not yet support 40MHz channels
-+  and power management. However it should have a smaller
-+  memory footprint than the vendor drivers and benetifs
-+  from the in kernel mac80211 stack.
-+
-+  It can coexist with drivers from drivers/staging/rtl8723au,
-+  drivers/staging/rtl8192u, and drivers/net/wireless/rtlwifi,
-+  but you will need to control which module you wish to load.
- 
--		  If unsure, say Y.
-+  RTL8XXXU_UNTESTED is enabled
-+  This option enables detection of Realtek 8723/8188/8191/8192 WiFi
-+  USB devices which have not been tested directly by the driver
-+  author or reported to be working by third parties.
- 
--  endif
-+  Please report your results!
- endef
- 
- 
--define KernelPackage/brcmfmac
-+define KernelPackage/wlcore
-   $(call KernelPackage/mac80211/Default)
--  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
--  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
--  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc +BRCMFMAC_USB:kmod-usb-core
--  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/brcm80211/brcmfmac/brcmfmac.ko
--  AUTOLOAD:=$(call AutoProbe,brcmfmac)
-+  TITLE:=TI common driver part
-+  DEPENDS+= @TARGET_omap +kmod-mac80211 +@DRIVER_11N_SUPPORT
-+  FILES:= \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
-+	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
-+  AUTOLOAD:=$(call AutoProbe,wlcore wlcore_sdio)
- endef
- 
--define KernelPackage/brcmfmac/description
-- Kernel module for Broadcom IEEE802.11n USB Wireless cards
-+define KernelPackage/wlcore/description
-+ This module contains some common parts needed by TI Wireless drivers.
- endef
- 
--define KernelPackage/brcmfmac/config
--  if PACKAGE_kmod-brcmfmac
-+define KernelPackage/wl12xx
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for TI WL12xx
-+  URL:=http://wireless.kernel.org/en/users/Drivers/wl12xx
-+  DEPENDS+= +kmod-wlcore +wl12xx-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl12xx/wl12xx.ko
-+  AUTOLOAD:=$(call AutoProbe,wl12xx)
-+endef
- 
--	config BRCMFMAC_SDIO
--		bool "Enable SDIO bus interface support"
--		default n
--		help
--		  Enable support for cards attached to an SDIO bus.
--		  Select this option only if you are sure that your
--		  board has a Broadcom wireless chip atacched to
--		  that bus.
-+define KernelPackage/wl12xx/description
-+ Kernel modules for TI WL12xx
-+endef
- 
--	config BRCMFMAC_USB
--		bool "Enable USB bus interface support"
--		depends on USB_SUPPORT
--		default y
--		help
--		  Supported USB connected chipsets:
--		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
--		  BCM43143, BCM43242, BCM43566, BCM43569
-+define KernelPackage/wl18xx
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Driver for TI WL18xx
-+  URL:=http://wireless.kernel.org/en/users/Drivers/wl18xx
-+  DEPENDS+= +kmod-wlcore +wl18xx-firmware
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wl18xx/wl18xx.ko
-+  AUTOLOAD:=$(call AutoProbe,wl18xx)
-+endef
- 
--	config BRCMFMAC_PCIE
--		bool "Enable PCIE bus interface support"
--		depends on PCI_SUPPORT
--		default y
--		help
--		  Supported PCIe connected chipsets:
--		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
-+define KernelPackage/wl18xx/description
-+ Kernel modules for TI WL18xx
-+endef
- 
--  endif
-+
-+ZD1211FW_NAME:=zd1211-firmware
-+ZD1211FW_VERSION:=1.4
-+define Download/zd1211rw
-+  FILE:=$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
-+  URL:=@SF/zd1211/
-+  MD5SUM:=19f28781d76569af8551c9d11294c870
-+endef
-+$(eval $(call Download,zd1211rw))
-+
-+define KernelPackage/zd1211rw
-+  $(call KernelPackage/mac80211/Default)
-+  TITLE:=Zydas ZD1211 support
-+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zydas/zd1211rw/zd1211rw.ko
-+  AUTOLOAD:=$(call AutoProbe,zd1211rw)
- endef
- 
-+
-+
- config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
- 
- config-y:= \
-@@ -1538,6 +1449,20 @@ config-y:= \
- 	MAC80211_RC_MINSTREL_HT \
- 	MAC80211_RC_MINSTREL_VHT \
- 	MAC80211_RC_DEFAULT_MINSTREL \
-+	WLAN_VENDOR_ADMTEK \
-+	WLAN_VENDOR_ATH \
-+	WLAN_VENDOR_ATMEL \
-+	WLAN_VENDOR_BROADCOM \
-+	WLAN_VENDOR_INTEL \
-+	WLAN_VENDOR_INTERSIL \
-+	WLAN_VENDOR_MARVELL \
-+	WLAN_VENDOR_MEDIATEK \
-+	WLAN_VENDOR_RALINK \
-+	WLAN_VENDOR_REALTEK \
-+	WLAN_VENDOR_RSI \
-+	WLAN_VENDOR_ST \
-+	WLAN_VENDOR_TI \
-+	WLAN_VENDOR_ZYDAS \
- 
- config-$(call config_package,cfg80211) += CFG80211
- 
-@@ -1554,6 +1479,16 @@ ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
- 	ATH5K_DEBUG
- endif
- 
-+ifdef CONFIG_PACKAGE_MAC80211_TRACING
-+  config-y += \
-+	ATH10K_TRACING \
-+	ATH6KL_TRACING \
-+	ATH_TRACEPOINTS \
-+	WIL6210_TRACING \
-+	ATH5K_TRACER \
-+	IWLWIFI_DEVICE_TRACING
-+endif
-+
- config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_CRYPT_CCMP LIB80211_CRYPT_TKIP
- 
- config-$(call config_package,ath) += ATH_CARDS ATH_COMMON
-@@ -1602,6 +1537,8 @@ config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
- config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
- 
- config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
-+config-$(call config_package,mt7601u) += MT7601U
-+config-y += WL_MEDIATEK
- 
- config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
- config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
-@@ -1623,31 +1560,34 @@ config-$(call config_package,rt2800-pci) += RT2800PCI
- config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
- 
- config-$(call config_package,rt2800-usb) += RT2800USB
--config-y += RT2800USB_RT33XX RT2800USB_RT35XX RT2800USB_RT3573 RT2800USB_RT53XX RT2800USB_RT55XX
-+config-y += RT2800USB_RT33XX RT2800USB_RT35XX RT2800USB_RT3573 RT2800USB_RT53XX RT2800USB_RT55XX RT2800USB_UNKNOWN
- 
- config-$(call config_package,iwl-legacy) += IWLEGACY
- config-$(call config_package,iwl3945) += IWL3945
- config-$(call config_package,iwl4965) += IWL4965
--config-$(call config_package,iwlagn) += IWLWIFI IWLDVM
-+config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
-+config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
-+config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
- 
--config-$(call config_package,net-libipw) += LIBIPW
--config-$(call config_package,net-ipw2100) += IPW2100
--config-$(call config_package,net-ipw2200) += IPW2200
-+config-$(call config_package,libipw) += LIBIPW
-+config-$(call config_package,ipw2100) += IPW2100
-+config-$(call config_package,ipw2200) += IPW2200
- 
- config-$(call config_package,p54-common) += P54_COMMON
- config-$(call config_package,p54-pci) += P54_PCI
- config-$(call config_package,p54-usb) += P54_USB
- config-$(call config_package,p54-spi) += P54_SPI
- 
--config-$(call config_package,net-hermes) += HERMES
--config-$(call config_package,net-hermes-pci) += PCI_HERMES
--config-$(call config_package,net-hermes-plx) += PLX_HERMES
--config-$(call config_package,net-hermes-pcmcia) += PCMCIA_HERMES
-+config-$(call config_package,hermes) += HERMES
-+config-$(call config_package,hermes-pci) += PCI_HERMES
-+config-$(call config_package,hermes-plx) += PLX_HERMES
-+config-$(call config_package,hermes-pcmcia) += PCMCIA_HERMES
- config-y += HERMES_PRISM
- 
- config-$(call config_package,adm8211) += ADM8211
- config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
- config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
-+config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
- config-$(call config_package,mwl8k) += MWL8K
- config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
- config-$(call config_package,rtl8180) += RTL8180
-@@ -1668,12 +1608,15 @@ config-$(call config_package,rtl8192de) += RTL8192DE
- config-$(call config_package,rtl8192cu) += RTL8192CU
- config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
- 
-+config-$(call config_package,rtl8xxxu) += RTL8XXXU
-+config-y += RTL8XXXU_UNTESTED
-+
- config-$(CONFIG_LEDS_TRIGGERS) += MAC80211_LEDS B43_LEDS B43LEGACY_LEDS
- 
- MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
- 	CROSS_COMPILE="$(KERNEL_CROSS)" \
- 	ARCH="$(LINUX_KARCH)" \
--	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include" \
-+	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include $(IREMAP_CFLAGS)" \
- 	KLIB_BUILD="$(LINUX_DIR)" \
- 	MODPROBE=true \
- 	KLIB=$(TARGET_MODULES_DIR) \
-@@ -1702,8 +1645,6 @@ define Build/Prepare
- 	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
- 	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
- 	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
--	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_LINUX_FIRMWARE_SOURCE)
--	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SOURCE)
- 	rm -rf \
- 		$(PKG_BUILD_DIR)/include/linux/ssb \
- 		$(PKG_BUILD_DIR)/include/linux/bcma \
-@@ -1715,7 +1656,8 @@ define Build/Prepare
- 		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
- 		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
- 		$(PKG_BUILD_DIR)/include/linux/spi/libertas_spi.h \
--		$(PKG_BUILD_DIR)/include/net/ieee80211.h
-+		$(PKG_BUILD_DIR)/include/net/ieee80211.h \
-+		$(PKG_BUILD_DIR)/backport-include/linux/bcm47xx_nvram.h
- 
- 	echo 'compat-wireless-$(PKG_VERSION)-$(PKG_RELEASE)-$(REVISION)' > $(PKG_BUILD_DIR)/compat_version
- 	$(CP) ./files/regdb.txt $(PKG_BUILD_DIR)/net/wireless/db.txt
-@@ -1753,220 +1695,6 @@ define Build/InstallDev
- 	rm -f $(1)/usr/include/mac80211-backport/linux/module.h
- endef
- 
--define KernelPackage/libertas-usb/install
--	$(INSTALL_DIR) $(1)/lib/firmware/libertas
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/usb8388_v9.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/usb8682.bin \
--		$(1)/lib/firmware/libertas/
--endef
--
--define KernelPackage/libertas-sdio/install
--	$(INSTALL_DIR) $(1)/lib/firmware/libertas
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8385_helper.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8385.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8686_v9_helper.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8686_v9.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8688_helper.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/libertas/sd8688.bin \
--		$(1)/lib/firmware/libertas
--endef
--
--define KernelPackage/cfg80211/install
--	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
--	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
--	$(INSTALL_BIN) ./files/lib/netifd/wireless/mac80211.sh $(1)/lib/netifd/wireless
--endef
--
--define KernelPackage/p54-pci/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(DL_DIR)/$(P54PCIFW) $(1)/lib/firmware/isl3886pci
--endef
--
--define KernelPackage/p54-usb/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(DL_DIR)/$(P54USBFW) $(1)/lib/firmware/isl3887usb
--endef
--
--define KernelPackage/p54-spi/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(DL_DIR)/$(P54SPIFW) $(1)/lib/firmware/3826.arm
--endef
--
--define KernelPackage/rt61-pci/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2561.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2561s.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2661.bin \
--		$(1)/lib/firmware/
--endef
--
--define KernelPackage/rt73-usb/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt73.bin $(1)/lib/firmware/
--endef
--
--define KernelPackage/rt2800-pci/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2860.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt3290.bin \
--		$(1)/lib/firmware
--endef
--
--define KernelPackage/rt2800-usb/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/rt2870.bin $(1)/lib/firmware/
--endef
--
--define KernelPackage/wl12xx/install
--	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl127x-fw-5-mr.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl127x-fw-5-plt.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl127x-fw-5-sr.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl1271-nvs.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-fw-5-mr.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-fw-5-plt.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-fw-5-sr.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl128x-nvs.bin \
--		$(1)/lib/firmware/ti-connectivity
--endef
--
--define KernelPackage/wl18xx/install
--	$(INSTALL_DIR) $(1)/lib/firmware/ti-connectivity
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl18xx-conf.bin \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/ti-connectivity/wl18xx-fw-3.bin \
--		$(1)/lib/firmware/ti-connectivity
--endef
--
--define KernelPackage/zd1211rw/install
--	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
--endef
--
--define KernelPackage/carl9170/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/carl9170-1.fw $(1)/lib/firmware
--endef
--
--define KernelPackage/ath9k-htc/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/htc_9271.fw \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/htc_7010.fw \
--		$(1)/lib/firmware/
--endef
--
--define KernelPackage/ath10k/install
--	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA988X/hw2.0
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/ath10k/QCA988X/hw2.0/board.bin \
--		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
--ifeq ($(CONFIG_ATH10K_STA_FW),y)
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/main/firmware-2.bin_999.999.0.636 \
--		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-2.bin
--else ifeq ($(CONFIG_ATH10K_API2_FW),y)
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/10.1/firmware-2.bin_10.1.467.2-1 \
--		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-2.bin
--else
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_ATH10K_LINUX_FIRMWARE_SUBDIR)/10.2.4/firmware-4.bin_10.2.4.45 \
--		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-4.bin
--endif
--endef
--
--define KernelPackage/mwl8k/install
--	$(INSTALL_DIR) $(1)/lib/firmware/mwl8k
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/fmimage_8366_ap-3.fw \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/fmimage_8366.fw \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/helper_8366.fw \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/fmimage_8687.fw \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mwl8k/helper_8687.fw \
--		$(1)/lib/firmware/mwl8k/
--endef
--
--define KernelPackage/mwifiex-pcie/install
--	$(INSTALL_DIR) $(1)/lib/firmware/mrvl
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/mrvl/pcie8897_uapsta.bin \
--		$(1)/lib/firmware/mrvl/
--endef
--
--define KernelPackage/net-ipw2100/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
--endef
--
--define KernelPackage/net-ipw2200/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
--endef
--
--define KernelPackage/iwlagn/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--ifneq ($(CONFIG_IWL5000_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-5000-5.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL5150_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-5150-2.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL1000_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-1000-5.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL6000_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6000-4.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL6050_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6050-5.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL6005_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6000g2a-6.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL6030_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-6000g2b-6.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL7260_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-7260-9.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL7265_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-7265-9.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL100_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-100-5.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL2000_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-2000-6.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL2030_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-2030-6.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL105_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-105-6.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL135_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-135-6.ucode $(1)/lib/firmware
--endif
--ifneq ($(CONFIG_IWL3160_FW),)
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-3160-9.ucode $(1)/lib/firmware
--endif
--endef
--
--define KernelPackage/iwl3945/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-3945-2.ucode $(1)/lib/firmware
--endef
--
--define KernelPackage/iwl4965/install
--	$(INSTALL_DIR) $(1)/lib/firmware
--	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/iwlwifi-4965-2.ucode $(1)/lib/firmware
--endef
- 
- define KernelPackage/b43/install
- 	rm -rf $(1)/lib/firmware/
-@@ -1990,51 +1718,85 @@ ifneq ($(CONFIG_B43_FW_SQUASH),)
- endif
- endef
- 
--define KernelPackage/b43legacy/install
--	$(INSTALL_DIR) $(1)/lib/firmware/
--	b43-fwcutter --unsupported -w $(1)/lib/firmware/ $(DL_DIR)/$(PKG_B43_FWV3_SOURCE)
--ifneq ($(CONFIG_B43LEGACY_FW_SQUASH),)
--	b43-fwsquash.py "G" "$(CONFIG_B43LEGACY_FW_SQUASH_COREREVS)" "$(1)/lib/firmware/b43legacy"
--endif
--endef
--
- define KernelPackage/brcmsmac/install
- 	$(INSTALL_DIR) $(1)/lib/firmware/brcm
- ifeq ($(CONFIG_BRCMSMAC_USE_FW_FROM_WL),y)
- 	tar xjf "$(DL_DIR)/$(PKG_BRCMSMAC_FW_SOURCE)" -C "$(PKG_BUILD_DIR)"
- 	b43-fwcutter --brcmsmac -w $(1)/lib/firmware/ $(PKG_BUILD_DIR)/$(PKG_BRCMSMAC_FW_OBJECT)
--else
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx-0.fw \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/bcm43xx_hdr-0.fw \
--		$(1)/lib/firmware/brcm/
- endif
- endef
- 
--define KernelPackage/brcmfmac/install
--	$(INSTALL_DIR) $(1)/lib/firmware/brcm
--ifneq ($(CONFIG_BRCMFMAC_USB),)
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/brcmfmac43236b.bin \
--		$(1)/lib/firmware/brcm/
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/brcmfmac43143.bin \
--		$(1)/lib/firmware/brcm/
--endif
--ifneq ($(CONFIG_BRCMFMAC_PCIE),)
--	$(INSTALL_DATA) \
--		$(PKG_BUILD_DIR)/$(PKG_LINUX_FIRMWARE_SUBDIR)/brcm/brcmfmac43602-pcie.ap.bin \
--		$(1)/lib/firmware/brcm/brcmfmac43602-pcie.bin
--endif
-+define KernelPackage/cfg80211/install
-+	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
-+	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
-+	$(INSTALL_BIN) ./files/lib/netifd/wireless/mac80211.sh $(1)/lib/netifd/wireless
-+endef
-+
-+define KernelPackage/ipw2100/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
-+endef
-+
-+define KernelPackage/ipw2200/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
-+endef
-+
-+define KernelPackage/p54-pci/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(DL_DIR)/$(P54PCIFW) $(1)/lib/firmware/isl3886pci
-+endef
-+
-+define KernelPackage/p54-usb/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(DL_DIR)/$(P54USBFW) $(1)/lib/firmware/isl3887usb
-+endef
-+
-+define KernelPackage/p54-spi/install
-+	$(INSTALL_DIR) $(1)/lib/firmware
-+	$(INSTALL_DATA) $(DL_DIR)/$(P54SPIFW) $(1)/lib/firmware/3826.arm
- endef
- 
-+define KernelPackage/zd1211rw/install
-+	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
-+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
-+endef
-+
-+
- $(eval $(call KernelPackage,adm8211))
-+$(eval $(call KernelPackage,ath))
-+$(eval $(call KernelPackage,ath10k))
- $(eval $(call KernelPackage,ath5k))
-+$(eval $(call KernelPackage,ath9k))
-+$(eval $(call KernelPackage,ath9k-common))
-+$(eval $(call KernelPackage,ath9k-htc))
-+$(eval $(call KernelPackage,b43))
-+$(eval $(call KernelPackage,b43legacy))
-+$(eval $(call KernelPackage,brcmsmac))
-+$(eval $(call KernelPackage,brcmfmac))
-+$(eval $(call KernelPackage,brcmutil))
-+$(eval $(call KernelPackage,carl9170))
-+$(eval $(call KernelPackage,cfg80211))
-+$(eval $(call KernelPackage,hermes))
-+$(eval $(call KernelPackage,hermes-pci))
-+$(eval $(call KernelPackage,hermes-plx))
-+$(eval $(call KernelPackage,hermes-pcmcia))
-+$(eval $(call KernelPackage,iwlwifi))
-+$(eval $(call KernelPackage,iwl-legacy))
-+$(eval $(call KernelPackage,iwl4965))
-+$(eval $(call KernelPackage,iwl3945))
- $(eval $(call KernelPackage,lib80211))
- $(eval $(call KernelPackage,libertas-usb))
- $(eval $(call KernelPackage,libertas-sdio))
--$(eval $(call KernelPackage,cfg80211))
-+$(eval $(call KernelPackage,libertas-spi))
-+$(eval $(call KernelPackage,libipw))
-+$(eval $(call KernelPackage,ipw2100))
-+$(eval $(call KernelPackage,ipw2200))
- $(eval $(call KernelPackage,mac80211))
-+$(eval $(call KernelPackage,mac80211-hwsim))
-+$(eval $(call KernelPackage,mt7601u))
-+$(eval $(call KernelPackage,mwl8k))
-+$(eval $(call KernelPackage,mwifiex-pcie))
- $(eval $(call KernelPackage,p54-common))
- $(eval $(call KernelPackage,p54-pci))
- $(eval $(call KernelPackage,p54-usb))
-@@ -2047,12 +1809,12 @@ $(eval $(call KernelPackage,rt2800-lib))
- $(eval $(call KernelPackage,rt2400-pci))
- $(eval $(call KernelPackage,rt2500-pci))
- $(eval $(call KernelPackage,rt2500-usb))
--$(eval $(call KernelPackage,rt61-pci))
--$(eval $(call KernelPackage,rt73-usb))
- $(eval $(call KernelPackage,rt2800-mmio))
- $(eval $(call KernelPackage,rt2800-soc))
- $(eval $(call KernelPackage,rt2800-pci))
- $(eval $(call KernelPackage,rt2800-usb))
-+$(eval $(call KernelPackage,rt61-pci))
-+$(eval $(call KernelPackage,rt73-usb))
- $(eval $(call KernelPackage,rtl8180))
- $(eval $(call KernelPackage,rtl8187))
- $(eval $(call KernelPackage,rtlwifi))
-@@ -2063,32 +1825,8 @@ $(eval $(call KernelPackage,rtl8192ce))
- $(eval $(call KernelPackage,rtl8192se))
- $(eval $(call KernelPackage,rtl8192de))
- $(eval $(call KernelPackage,rtl8192cu))
--$(eval $(call KernelPackage,zd1211rw))
--$(eval $(call KernelPackage,mac80211-hwsim))
--$(eval $(call KernelPackage,ath9k-common))
--$(eval $(call KernelPackage,ath9k))
--$(eval $(call KernelPackage,ath9k-htc))
--$(eval $(call KernelPackage,ath10k))
--$(eval $(call KernelPackage,ath))
--$(eval $(call KernelPackage,carl9170))
--$(eval $(call KernelPackage,b43))
--$(eval $(call KernelPackage,b43legacy))
--$(eval $(call KernelPackage,brcmutil))
--$(eval $(call KernelPackage,brcmsmac))
--$(eval $(call KernelPackage,brcmfmac))
--$(eval $(call KernelPackage,net-libipw))
--$(eval $(call KernelPackage,net-ipw2100))
--$(eval $(call KernelPackage,net-ipw2200))
--$(eval $(call KernelPackage,iwlagn))
--$(eval $(call KernelPackage,iwl-legacy))
--$(eval $(call KernelPackage,iwl4965))
--$(eval $(call KernelPackage,iwl3945))
--$(eval $(call KernelPackage,mwl8k))
--$(eval $(call KernelPackage,mwifiex-pcie))
--$(eval $(call KernelPackage,net-hermes))
--$(eval $(call KernelPackage,net-hermes-pci))
--$(eval $(call KernelPackage,net-hermes-plx))
--$(eval $(call KernelPackage,net-hermes-pcmcia))
-+$(eval $(call KernelPackage,rtl8xxxu))
- $(eval $(call KernelPackage,wlcore))
- $(eval $(call KernelPackage,wl12xx))
- $(eval $(call KernelPackage,wl18xx))
-+$(eval $(call KernelPackage,zd1211rw))
-diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-index 2852f3e..02c195e 100644
---- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-@@ -23,6 +23,7 @@ drv_mac80211_init_device_config() {
- 	config_add_int rxantenna txantenna antenna_gain txpower distance
- 	config_add_boolean noscan ht_coex
- 	config_add_array ht_capab
-+	config_add_array channels
- 	config_add_boolean \
- 		rxldpc \
- 		short_gi_80 \
-@@ -89,6 +90,7 @@ mac80211_hostapd_setup_base() {
- 	json_select config
- 
- 	[ "$auto_channel" -gt 0 ] && channel=acs_survey
-+	[ "$auto_channel" -gt 0 ] && json_get_values channel_list channels
- 
- 	json_get_vars noscan ht_coex
- 	json_get_values ht_capab_list ht_capab
-@@ -301,6 +303,7 @@ mac80211_hostapd_setup_base() {
- 	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
- 	cat >> "$hostapd_conf_file" <<EOF
- ${channel:+channel=$channel}
-+${channel_list:+chanlist=$channel_list}
- ${noscan:+noscan=$noscan}
- $base_cfg
- 
-@@ -391,11 +394,10 @@ mac80211_generate_mac() {
- find_phy() {
- 	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
- 	[ -n "$path" ] && {
--		for phy in /sys/devices/$path/ieee80211/phy*; do
--			[ -e "$phy" ] && {
--				phy="${phy##*/}"
--				return 0
--			}
-+		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
-+			case "$(readlink -f /sys/class/ieee80211/$phy/device)" in
-+				*$path) return 0;;
-+			esac
- 		done
- 	}
- 	[ -n "$macaddr" ] && {
-@@ -455,12 +457,7 @@ mac80211_prepare_vif() {
- 			}
- 		;;
- 		mesh)
--			json_get_vars key mesh_id
--			if [ -n "$key" ]; then
--				iw phy "$phy" interface add "$ifname" type mp
--			else
--				iw phy "$phy" interface add "$ifname" type mp mesh_id "$mesh_id"
--			fi
-+			iw phy "$phy" interface add "$ifname" type mp
- 		;;
- 		monitor)
- 			iw phy "$phy" interface add "$ifname" type monitor
-@@ -486,7 +483,7 @@ mac80211_prepare_vif() {
- 		# All interfaces must have unique mac addresses
- 		# which can either be explicitly set in the device
- 		# section, or automatically generated
--		ifconfig "$ifname" hw ether "$macaddr"
-+		ip link set dev "$ifname" address "$macaddr"
- 	fi
- 
- 	json_select ..
-@@ -501,7 +498,7 @@ mac80211_setup_supplicant() {
- mac80211_setup_adhoc_htmode() {
- 	case "$htmode" in
- 		VHT20|HT20) ibss_htmode=HT20;;
--		HT40*|VHT40|VHT80|VHT160)
-+		HT40*|VHT40|VHT160)
- 			case "$hwmode" in
- 				a)
- 					case "$(( ($channel / 4) % 2 ))" in
-@@ -525,6 +522,9 @@ mac80211_setup_adhoc_htmode() {
- 			esac
- 			[ "$auto_channel" -gt 0 ] && ibss_htmode="HT40+"
- 		;;
-+		VHT80)
-+			ibss_htmode="80MHZ"
-+		;;
- 		NONE|NOHT)
- 			ibss_htmode="NOHT"
- 		;;
-@@ -585,7 +585,7 @@ mac80211_setup_vif() {
- 	json_get_vars mode
- 	json_get_var vif_txpower txpower
- 
--	ifconfig "$ifname" up || {
-+	ip link set dev "$ifname" up || {
- 		wireless_setup_vif_failed IFUP_ERROR
- 		json_select ..
- 		return
-@@ -606,6 +606,13 @@ mac80211_setup_vif() {
- 					wireless_vif_parse_encryption
- 					mac80211_setup_supplicant || failed=1
- 				fi
-+			else
-+				json_get_vars mesh_id mcast_rate
-+
-+				mcval=
-+				[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
-+
-+				iw dev "$ifname" mesh join "$mesh_id" ${mcval:+mcast-rate $mcval}
- 			fi
- 
- 			for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
-@@ -641,7 +648,7 @@ mac80211_interface_cleanup() {
- 	local phy="$1"
- 
- 	for wdev in $(list_phy_interfaces "$phy"); do
--		ifconfig "$wdev" down 2>/dev/null
-+		ip link set dev "$wdev" down 2>/dev/null
- 		iw dev "$wdev" del
- 	done
- }
-diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
-index ea229d6..06f3b8b 100644
---- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
-+++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
-@@ -9,11 +9,10 @@ lookup_phy() {
- 	local devpath
- 	config_get devpath "$device" path
- 	[ -n "$devpath" ] && {
--		for _phy in /sys/devices/$devpath/ieee80211/phy*; do
--			[ -e "$_phy" ] && {
--				phy="${_phy##*/}"
--				return
--			}
-+		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
-+			case "$(readlink -f /sys/class/ieee80211/$phy/device)" in
-+				*$devpath) return;;
-+			esac
- 		done
- 	}
- 
-@@ -102,6 +101,9 @@ detect_mac80211() {
- 		fi
- 		if [ -n "$path" ]; then
- 			path="${path##/sys/devices/}"
-+			case "$path" in
-+				platform*/pci*) path="${path##platform/}";;
-+			esac
- 			dev_id="	option path	'$path'"
- 		else
- 			dev_id="	option macaddr	$(cat /sys/class/ieee80211/${dev}/macaddress)"
-diff --git a/package/kernel/mac80211/patches/001-fix_build.patch b/package/kernel/mac80211/patches/001-fix_build.patch
-index 818983e..402649d 100644
---- a/package/kernel/mac80211/patches/001-fix_build.patch
-+++ b/package/kernel/mac80211/patches/001-fix_build.patch
-@@ -27,7 +27,7 @@
-  	@set -e ; test -f .local-symbols || (						\
-  	echo "/--------------"								;\
-  	echo "| You shouldn't run make in the backports tree, but only in"		;\
--@@ -60,56 +62,60 @@ mrproper:
-+@@ -60,57 +62,61 @@ mrproper:
-  	echo "| (that isn't currently running.)"					;\
-  	echo "\\--"									;\
-  	false)
-@@ -56,11 +56,12 @@
- -			done								\
- -		) > Kconfig.kernel							;\
- -		kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
---			sed 's/^\(\(3\|2\.6\)\.[0-9]\+\).*/\1/;t;d')			;\
-+-			sed 's/^\(\([3-4]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
- -		test "$$kver" != "" || echo "Kernel version parse failed!"		;\
- -		test "$$kver" != ""							;\
- -		kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
---		kvers="$$kvers $$(seq 0 99 | sed 's/^/3./')"				;\
-+-		kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')"				;\
-+-		kvers="$$kvers $$(seq 0 99 | sed 's/^/4./')"				;\
- -		print=0									;\
- -		for v in $$kvers ; do							\
- -			if [ "$$print" = "1" ] ; then					\
-@@ -111,11 +112,12 @@
- +
- +Kconfig.versions: Kconfig.kernel
- +	@kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
--+		sed 's/^\(\(3\|2\.6\)\.[0-9]\+\).*/\1/;t;d')			;\
-++		sed 's/^\(\([3-4]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
- +	test "$$kver" != "" || echo "Kernel version parse failed!"		;\
- +	test "$$kver" != ""							;\
- +	kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
--+	kvers="$$kvers $$(seq 0 99 | sed 's/^/3./')"				;\
-++	kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')"				;\
-++	kvers="$$kvers $$(seq 0 99 | sed 's/^/4./')"				;\
- +	print=0									;\
- +	for v in $$kvers ; do							\
- +		if [ "$$print" = "1" ] ; then					\
-diff --git a/package/kernel/mac80211/patches/002-change_allconfig.patch b/package/kernel/mac80211/patches/002-change_allconfig.patch
-index 91ad20f..bd5bebf 100644
---- a/package/kernel/mac80211/patches/002-change_allconfig.patch
-+++ b/package/kernel/mac80211/patches/002-change_allconfig.patch
-@@ -1,6 +1,6 @@
- --- a/kconf/conf.c
- +++ b/kconf/conf.c
--@@ -578,40 +578,12 @@ int main(int ac, char **av)
-+@@ -593,40 +593,12 @@ int main(int ac, char **av)
-  	case oldconfig:
-  	case listnewconfig:
-  	case olddefconfig:
-@@ -42,3 +42,23 @@
-  		break;
-  	default:
-  		break;
-+--- a/kconf/confdata.c
-++++ b/kconf/confdata.c
-+@@ -1169,6 +1169,8 @@ bool conf_set_all_new_symbols(enum conf_
-+ 	}
-+ 	bool has_changed = false;
-+ 
-++	sym_clear_all_valid();
-++
-+ 	for_all_symbols(i, sym) {
-+ 		if (sym_has_value(sym) || (sym->flags & SYMBOL_VALID))
-+ 			continue;
-+@@ -1212,8 +1214,6 @@ bool conf_set_all_new_symbols(enum conf_
-+ 
-+ 	}
-+ 
-+-	sym_clear_all_valid();
-+-
-+ 	/*
-+ 	 * We have different type of choice blocks.
-+ 	 * If curr.tri equals to mod then we can select several
-diff --git a/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch b/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch
-new file mode 100644
-index 0000000..9adfd8f
---- /dev/null
-+++ b/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch
-@@ -0,0 +1,21 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 28 Jan 2016 15:16:35 +0100
-+Subject: [PATCH] backports: add skb_free_frag()
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/backport-include/linux/skbuff.h
-++++ b/backport-include/linux/skbuff.h
-+@@ -300,4 +300,11 @@ int skb_ensure_writable(struct sk_buff *
-+ 
-+ #endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0) */
-+ 
-++#if LINUX_VERSION_CODE < KERNEL_VERSION(4,2,0)
-++static inline void skb_free_frag(void *data)
-++{
-++	put_page(virt_to_head_page(data));
-++}
-++#endif
-++
-+ #endif /* __BACKPORT_SKBUFF_H */
-diff --git a/package/kernel/mac80211/patches/004-backports_debugfs_fix.patch b/package/kernel/mac80211/patches/004-backports_debugfs_fix.patch
-deleted file mode 100644
-index d48a723..0000000
---- a/package/kernel/mac80211/patches/004-backports_debugfs_fix.patch
-+++ /dev/null
-@@ -1,10 +0,0 @@
----- a/backport-include/linux/debugfs.h
--+++ b/backport-include/linux/debugfs.h
--@@ -3,6 +3,7 @@
-- #include_next <linux/debugfs.h>
-- #include <linux/version.h>
-- #include <generated/utsrelease.h>
--+#include <linux/device.h>
-- 
-- #if defined(CONFIG_DEBUG_FS)
-- struct dentry *debugfs_create_devm_seqfile(struct device *dev, const char *name,
-diff --git a/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch b/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch
-new file mode 100644
-index 0000000..9b672a8
---- /dev/null
-+++ b/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch
-@@ -0,0 +1,20 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 28 Jan 2016 15:19:22 +0100
-+Subject: [PATCH] backports: add napi_alloc_frag
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/backport-include/linux/netdevice.h
-++++ b/backport-include/linux/netdevice.h
-+@@ -232,6 +232,10 @@ static inline void backport_unregister_n
-+ #define unregister_netdevice_many LINUX_BACKPORT(unregister_netdevice_many)
-+ #endif
-+ 
-++#if LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0)
-++#define napi_alloc_frag netdev_alloc_frag
-++#endif
-++
-+ /*
-+  * Complicated way of saying: We only backport netdev_rss_key stuff on kernels
-+  * that either already have net_get_random_once() (>= 3.13) or where we've been
-diff --git a/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch b/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch
-deleted file mode 100644
-index e07f323..0000000
---- a/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch
-+++ /dev/null
-@@ -1,16 +0,0 @@
----- a/net/mac80211/iface.c
--+++ b/net/mac80211/iface.c
--@@ -1858,6 +1858,13 @@ void ieee80211_remove_interfaces(struct
-- 	}
-- 	mutex_unlock(&local->iflist_mtx);
-- 	unregister_netdevice_many(&unreg_list);
--+#if (!(LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,45) && \
--+       LINUX_VERSION_CODE < KERNEL_VERSION(3,11,0)) && \
--+     !(LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,9) && \
--+       LINUX_VERSION_CODE < KERNEL_VERSION(3,15,0)) && \
--+     (LINUX_VERSION_CODE < KERNEL_VERSION(3,16,0)))
--+	list_del(&unreg_list);
--+#endif
-- 
-- 	list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
-- 		list_del(&sdata->list);
-diff --git a/package/kernel/mac80211/patches/020-add_mpls_h.patch b/package/kernel/mac80211/patches/020-add_mpls_h.patch
-deleted file mode 100644
-index e5310bc..0000000
---- a/package/kernel/mac80211/patches/020-add_mpls_h.patch
-+++ /dev/null
-@@ -1,37 +0,0 @@
----- /dev/null
--+++ b/include/uapi/linux/mpls.h
--@@ -0,0 +1,34 @@
--+#ifndef _UAPI_MPLS_H
--+#define _UAPI_MPLS_H
--+
--+#include <linux/types.h>
--+#include <asm/byteorder.h>
--+
--+/* Reference: RFC 5462, RFC 3032
--+ *
--+ *  0                   1                   2                   3
--+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
--+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
--+ * |                Label                  | TC  |S|       TTL     |
--+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
--+ *
--+ *	Label:  Label Value, 20 bits
--+ *	TC:     Traffic Class field, 3 bits
--+ *	S:      Bottom of Stack, 1 bit
--+ *	TTL:    Time to Live, 8 bits
--+ */
--+
--+struct mpls_label {
--+	__be32 entry;
--+};
--+
--+#define MPLS_LS_LABEL_MASK      0xFFFFF000
--+#define MPLS_LS_LABEL_SHIFT     12
--+#define MPLS_LS_TC_MASK         0x00000E00
--+#define MPLS_LS_TC_SHIFT        9
--+#define MPLS_LS_S_MASK          0x00000100
--+#define MPLS_LS_S_SHIFT         8
--+#define MPLS_LS_TTL_MASK        0x000000FF
--+#define MPLS_LS_TTL_SHIFT       0
--+
--+#endif /* _UAPI_MPLS_H */
-diff --git a/package/kernel/mac80211/patches/030-rt2x00_options.patch b/package/kernel/mac80211/patches/030-rt2x00_options.patch
-index 35b5b5d..a4ca884 100644
---- a/package/kernel/mac80211/patches/030-rt2x00_options.patch
-+++ b/package/kernel/mac80211/patches/030-rt2x00_options.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/Kconfig
--+++ b/drivers/net/wireless/rt2x00/Kconfig
-+--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
-++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
- @@ -225,36 +225,37 @@ config RT2800SOC
-  
-  
-@@ -43,5 +43,5 @@
- -	tristate
- +	tristate "RT2x00 support"
-  	depends on m
-- 	select BPAUTO_AVERAGE
-  
-+ config RT2X00_LIB_FIRMWARE
-diff --git a/package/kernel/mac80211/patches/040-brcmutil_option.patch b/package/kernel/mac80211/patches/040-brcmutil_option.patch
-index 8a6cae6..167332d 100644
---- a/package/kernel/mac80211/patches/040-brcmutil_option.patch
-+++ b/package/kernel/mac80211/patches/040-brcmutil_option.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/brcm80211/Kconfig
--+++ b/drivers/net/wireless/brcm80211/Kconfig
-+--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
-++++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
- @@ -1,5 +1,5 @@
-  config BRCMUTIL
- -	tristate
-diff --git a/package/kernel/mac80211/patches/045-bcma-from-4.1.patch b/package/kernel/mac80211/patches/045-bcma-from-4.1.patch
-deleted file mode 100644
-index dce217f..0000000
---- a/package/kernel/mac80211/patches/045-bcma-from-4.1.patch
-+++ /dev/null
-@@ -1,104 +0,0 @@
----- a/drivers/bcma/driver_pci.c
--+++ b/drivers/bcma/driver_pci.c
--@@ -282,39 +282,6 @@ void bcma_core_pci_power_save(struct bcm
-- }
-- EXPORT_SYMBOL_GPL(bcma_core_pci_power_save);
-- 
---int bcma_core_pci_irq_ctl(struct bcma_bus *bus, struct bcma_device *core,
---			  bool enable)
---{
---	struct pci_dev *pdev;
---	u32 coremask, tmp;
---	int err = 0;
---
---	if (bus->hosttype != BCMA_HOSTTYPE_PCI) {
---		/* This bcma device is not on a PCI host-bus. So the IRQs are
---		 * not routed through the PCI core.
---		 * So we must not enable routing through the PCI core. */
---		goto out;
---	}
---
---	pdev = bus->host_pci;
---
---	err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
---	if (err)
---		goto out;
---
---	coremask = BIT(core->core_index) << 8;
---	if (enable)
---		tmp |= coremask;
---	else
---		tmp &= ~coremask;
---
---	err = pci_write_config_dword(pdev, BCMA_PCI_IRQMASK, tmp);
---
---out:
---	return err;
---}
---EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
---
-- static void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend)
-- {
-- 	u32 w;
----- a/drivers/bcma/host_pci.c
--+++ b/drivers/bcma/host_pci.c
--@@ -351,3 +351,37 @@ void bcma_host_pci_down(struct bcma_bus
-- 		bcma_core_pci_down(&bus->drv_pci[0]);
-- }
-- EXPORT_SYMBOL_GPL(bcma_host_pci_down);
--+
--+/* See also si_pci_setup */
--+int bcma_host_pci_irq_ctl(struct bcma_bus *bus, struct bcma_device *core,
--+			  bool enable)
--+{
--+	struct pci_dev *pdev;
--+	u32 coremask, tmp;
--+	int err = 0;
--+
--+	if (bus->hosttype != BCMA_HOSTTYPE_PCI) {
--+		/* This bcma device is not on a PCI host-bus. So the IRQs are
--+		 * not routed through the PCI core.
--+		 * So we must not enable routing through the PCI core. */
--+		goto out;
--+	}
--+
--+	pdev = bus->host_pci;
--+
--+	err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
--+	if (err)
--+		goto out;
--+
--+	coremask = BIT(core->core_index) << 8;
--+	if (enable)
--+		tmp |= coremask;
--+	else
--+		tmp &= ~coremask;
--+
--+	err = pci_write_config_dword(pdev, BCMA_PCI_IRQMASK, tmp);
--+
--+out:
--+	return err;
--+}
--+EXPORT_SYMBOL_GPL(bcma_host_pci_irq_ctl);
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
--@@ -4866,7 +4866,7 @@ static int b43_wireless_core_init(struct
-- 	switch (dev->dev->bus_type) {
-- #ifdef CPTCFG_B43_BCMA
-- 	case B43_BUS_BCMA:
---		bcma_core_pci_irq_ctl(dev->dev->bdev->bus,
--+		bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
-- 				      dev->dev->bdev, true);
-- 		bcma_host_pci_up(dev->dev->bdev->bus);
-- 		break;
----- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
--+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
--@@ -4959,7 +4959,7 @@ static int brcms_b_up_prep(struct brcms_
-- 	 * Configure pci/pcmcia here instead of in brcms_c_attach()
-- 	 * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
-- 	 */
---	bcma_core_pci_irq_ctl(wlc_hw->d11core->bus, wlc_hw->d11core,
--+	bcma_host_pci_irq_ctl(wlc_hw->d11core->bus, wlc_hw->d11core,
-- 			      true);
-- 
-- 	/*
-diff --git a/package/kernel/mac80211/patches/050-lib80211_option.patch b/package/kernel/mac80211/patches/050-lib80211_option.patch
-index 5fe5558..3fc8c05 100644
---- a/package/kernel/mac80211/patches/050-lib80211_option.patch
-+++ b/package/kernel/mac80211/patches/050-lib80211_option.patch
-@@ -1,6 +1,6 @@
- --- a/net/wireless/Kconfig
- +++ b/net/wireless/Kconfig
--@@ -174,7 +174,7 @@ config CFG80211_WEXT_EXPORT
-+@@ -171,7 +171,7 @@ config CFG80211_WEXT_EXPORT
-  	  wext compatibility symbols to be exported.
-  
-  config LIB80211
-@@ -9,7 +9,7 @@
-  	depends on m
-  	default n
-  	help
--@@ -184,15 +184,15 @@ config LIB80211
-+@@ -181,15 +181,15 @@ config LIB80211
-  	  Drivers should select this themselves if needed.
-  
-  config LIB80211_CRYPT_WEP
-diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
-index d307949..fd1e1cf 100644
---- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
-+++ b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
-@@ -1,9 +1,9 @@
- --- a/.local-symbols
- +++ b/.local-symbols
--@@ -344,40 +344,3 @@ USB_CDC_PHONET=
-- USB_IPHETH=
-+@@ -476,44 +476,6 @@ USB_IPHETH=
-  USB_SIERRA_NET=
-  USB_VL600=
-+ USB_NET_CH9200=
- -SSB_POSSIBLE=
- -SSB=
- -SSB_SPROM=
-@@ -15,6 +15,7 @@
- -SSB_PCMCIAHOST=
- -SSB_SDIOHOST_POSSIBLE=
- -SSB_SDIOHOST=
-+-SSB_HOST_SOC=
- -SSB_SILENT=
- -SSB_DEBUG=
- -SSB_SERIAL=
-@@ -32,28 +33,20 @@
- -BCMA_BLOCKIO=
- -BCMA_HOST_PCI_POSSIBLE=
- -BCMA_HOST_PCI=
---BCMA_DRIVER_PCI_HOSTMODE=
- -BCMA_HOST_SOC=
- -BCMA_DRIVER_PCI=
-+-BCMA_DRIVER_PCI_HOSTMODE=
- -BCMA_DRIVER_MIPS=
- -BCMA_SFLASH=
- -BCMA_NFLASH=
- -BCMA_DRIVER_GMAC_CMN=
- -BCMA_DRIVER_GPIO=
- -BCMA_DEBUG=
----- a/Makefile.kernel
--+++ b/Makefile.kernel
--@@ -38,8 +38,6 @@ obj-$(CPTCFG_MAC80211) += net/mac80211/
-- obj-$(CPTCFG_WLAN) += drivers/net/wireless/
-- #obj-$(CPTCFG_BT) += net/bluetooth/
-- #obj-$(CPTCFG_BT) += drivers/bluetooth/
---obj-$(CPTCFG_SSB) += drivers/ssb/
---obj-$(CPTCFG_BCMA) += drivers/bcma/
-- #obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
-- obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
-- #obj-$(CPTCFG_NFC) += net/nfc/
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
-+ NFC=
-+ NFC_DIGITAL=
-+ NFC_NCI=
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
- @@ -2866,7 +2866,7 @@ static struct ssb_device *b43_ssb_gpio_d
-  {
-  	struct ssb_bus *bus = dev->dev->sdev->bus;
-@@ -63,7 +56,7 @@
-  	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
-  #else
-  	return bus->chipco.dev;
--@@ -4907,7 +4907,7 @@ static int b43_wireless_core_init(struct
-+@@ -4903,7 +4903,7 @@ static int b43_wireless_core_init(struct
-  	}
-  	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
-  		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
-@@ -72,8 +65,8 @@
-  	if (dev->dev->bus_type == B43_BUS_SSB &&
-  	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
-  	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
----- a/drivers/net/wireless/b43legacy/main.c
--+++ b/drivers/net/wireless/b43legacy/main.c
-+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
-++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
- @@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
-  	if (dev->dev->id.revision >= 2)
-  		mask  |= 0x0010; /* FIXME: This is redundant. */
-@@ -92,8 +85,8 @@
-  	pcidev = bus->pcicore.dev;
-  #endif
-  	gpiodev = bus->chipco.dev ? : pcidev;
----- a/drivers/net/wireless/brcm80211/brcmsmac/Makefile
--+++ b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
- @@ -43,6 +43,6 @@ brcmsmac-y := \
-  	brcms_trace_events.o \
-  	debug.o
-@@ -102,8 +95,8 @@
- +brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
-  
-  obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
----- a/drivers/net/wireless/brcm80211/brcmsmac/led.h
--+++ b/drivers/net/wireless/brcm80211/brcmsmac/led.h
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
- @@ -22,7 +22,7 @@ struct brcms_led {
-  	bool active_low;
-  };
-@@ -116,12 +109,23 @@
- --- a/Kconfig.sources
- +++ b/Kconfig.sources
- @@ -9,9 +9,6 @@ source "$BACKPORT_DIR/drivers/net/wirele
-- #source "$BACKPORT_DIR/drivers/net/ethernet/Kconfig"
-+ source "$BACKPORT_DIR/drivers/net/ethernet/Kconfig"
-  source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
-  
- -source "$BACKPORT_DIR/drivers/ssb/Kconfig"
- -source "$BACKPORT_DIR/drivers/bcma/Kconfig"
- -
-- #source "$BACKPORT_DIR/net/nfc/Kconfig"
-+ source "$BACKPORT_DIR/net/nfc/Kconfig"
-  
-- #source "$BACKPORT_DIR/drivers/media/Kconfig"
-+ source "$BACKPORT_DIR/drivers/media/Kconfig"
-+--- a/Makefile.kernel
-++++ b/Makefile.kernel
-+@@ -38,8 +38,6 @@ obj-$(CPTCFG_MAC80211) += net/mac80211/
-+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
-+ obj-$(CPTCFG_BT) += net/bluetooth/
-+ obj-$(CPTCFG_BT) += drivers/bluetooth/
-+-obj-$(CPTCFG_SSB) += drivers/ssb/
-+-obj-$(CPTCFG_BCMA) += drivers/bcma/
-+ obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
-+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
-+ obj-$(CPTCFG_NFC) += net/nfc/
-diff --git a/package/kernel/mac80211/patches/070-ath_common_config.patch b/package/kernel/mac80211/patches/070-ath_common_config.patch
-index c6e9cd8..41774fe 100644
---- a/package/kernel/mac80211/patches/070-ath_common_config.patch
-+++ b/package/kernel/mac80211/patches/070-ath_common_config.patch
-@@ -1,10 +1,9 @@
- --- a/drivers/net/wireless/ath/Kconfig
- +++ b/drivers/net/wireless/ath/Kconfig
--@@ -6,6 +6,7 @@ menuconfig ATH_CARDS
-- 	tristate "Atheros Wireless Cards"
-+@@ -1,5 +1,5 @@
-+ config ATH_COMMON
-+-	tristate
-++	tristate "ath.ko"
-  	depends on m
-- 	depends on CFG80211 && (!UML || BROKEN)
--+	select ATH_COMMON
-- 	---help---
-- 	  This will enable the support for the Atheros wireless drivers.
-- 	  ath5k, ath9k, ath9k_htc and ar9170 drivers share some common code, this option
-+ 
-+ config WLAN_VENDOR_ATH
-diff --git a/package/kernel/mac80211/patches/090-linux_3_18_12_compat.patch b/package/kernel/mac80211/patches/090-linux_3_18_12_compat.patch
-deleted file mode 100644
-index 85c5280..0000000
---- a/package/kernel/mac80211/patches/090-linux_3_18_12_compat.patch
-+++ /dev/null
-@@ -1,29 +0,0 @@
----- a/backport-include/linux/wait.h
--+++ b/backport-include/linux/wait.h
--@@ -23,7 +23,7 @@ backport_wait_on_bit_io(void *word, int
-- 
-- #endif
-- 
---#if LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0)
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,18,12)
-- #define WQ_FLAG_WOKEN		0x02
-- 
-- #define wait_woken LINUX_BACKPORT(wait_woken)
----- a/compat/backport-3.19.c
--+++ b/compat/backport-3.19.c
--@@ -15,6 +15,7 @@
-- #include <linux/netdevice.h>
-- #include <linux/debugfs.h>
-- 
--+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,18,12)
-- static inline bool is_kthread_should_stop(void)
-- {
-- 	return (current->flags & PF_KTHREAD) && kthread_should_stop();
--@@ -79,6 +80,7 @@ int woken_wake_function(wait_queue_t *wa
-- 	return default_wake_function(wait, mode, sync, key);
-- }
-- EXPORT_SYMBOL(woken_wake_function);
--+#endif
-- 
-- #ifdef __BACKPORT_NETDEV_RSS_KEY_FILL
-- u8 netdev_rss_key[NETDEV_RSS_KEY_LEN];
-diff --git a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
-new file mode 100644
-index 0000000..02f46c7
---- /dev/null
-+++ b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
-@@ -0,0 +1,376 @@
-+--- a/net/mac80211/Kconfig
-++++ b/net/mac80211/Kconfig
-+@@ -5,8 +5,6 @@ config MAC80211
-+ 	depends on CRYPTO
-+ 	depends on CRYPTO_ARC4
-+ 	depends on CRYPTO_AES
-+-	select BPAUTO_CRYPTO_CCM
-+-	depends on CRYPTO_GCM
-+ 	depends on CRC32
-+ 	---help---
-+ 	  This option enables the hardware independent IEEE 802.11
-+--- a/net/mac80211/Makefile
-++++ b/net/mac80211/Makefile
-+@@ -16,9 +16,7 @@ mac80211-y := \
-+ 	michael.o \
-+ 	tkip.o \
-+ 	aes_ccm.o \
-+-	aes_gcm.o \
-+ 	aes_cmac.o \
-+-	aes_gmac.o \
-+ 	cfg.o \
-+ 	ethtool.o \
-+ 	rx.o \
-+--- a/net/mac80211/aes_ccm.c
-++++ b/net/mac80211/aes_ccm.c
-+@@ -13,89 +13,132 @@
-+ #include <linux/types.h>
-+ #include <linux/err.h>
-+ #include <crypto/aead.h>
-++#include <crypto/aes.h>
-+ 
-+ #include <net/mac80211.h>
-+ #include "key.h"
-+ #include "aes_ccm.h"
-+ 
-+-void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-+-			       u8 *data, size_t data_len, u8 *mic,
-+-			       size_t mic_len)
-++static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad, u8 *s_0,
-++			    u8 *a, u8 *b)
-+ {
-+-	struct scatterlist sg[3];
-++	int i;
-++
-++	crypto_cipher_encrypt_one(tfm, b, b_0);
-++
-++	/* Extra Authenticate-only data (always two AES blocks) */
-++	for (i = 0; i < AES_BLOCK_SIZE; i++)
-++		aad[i] ^= b[i];
-++	crypto_cipher_encrypt_one(tfm, b, aad);
-++
-++	aad += AES_BLOCK_SIZE;
-++
-++	for (i = 0; i < AES_BLOCK_SIZE; i++)
-++		aad[i] ^= b[i];
-++	crypto_cipher_encrypt_one(tfm, a, aad);
-+ 
-+-	char aead_req_data[sizeof(struct aead_request) +
-+-			   crypto_aead_reqsize(tfm)]
-+-		__aligned(__alignof__(struct aead_request));
-+-	struct aead_request *aead_req = (void *) aead_req_data;
-++	/* Mask out bits from auth-only-b_0 */
-++	b_0[0] &= 0x07;
-+ 
-+-	memset(aead_req, 0, sizeof(aead_req_data));
-++	/* S_0 is used to encrypt T (= MIC) */
-++	b_0[14] = 0;
-++	b_0[15] = 0;
-++	crypto_cipher_encrypt_one(tfm, s_0, b_0);
-++}
-+ 
-+-	sg_init_table(sg, 3);
-+-	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
-+-	sg_set_buf(&sg[1], data, data_len);
-+-	sg_set_buf(&sg[2], mic, mic_len);
-+ 
-+-	aead_request_set_tfm(aead_req, tfm);
-+-	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
-+-	aead_request_set_ad(aead_req, sg[0].length);
-++void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-++			       u8 *data, size_t data_len, u8 *mic,
-++			       size_t mic_len)
-++{
-++	int i, j, last_len, num_blocks;
-++	u8 b[AES_BLOCK_SIZE];
-++	u8 s_0[AES_BLOCK_SIZE];
-++	u8 e[AES_BLOCK_SIZE];
-++	u8 *pos, *cpos;
-++
-++	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
-++	last_len = data_len % AES_BLOCK_SIZE;
-++	aes_ccm_prepare(tfm, b_0, aad, s_0, b, b);
-++
-++	/* Process payload blocks */
-++	pos = data;
-++	cpos = data;
-++	for (j = 1; j <= num_blocks; j++) {
-++		int blen = (j == num_blocks && last_len) ?
-++			last_len : AES_BLOCK_SIZE;
-++
-++		/* Authentication followed by encryption */
-++		for (i = 0; i < blen; i++)
-++			b[i] ^= pos[i];
-++		crypto_cipher_encrypt_one(tfm, b, b);
-++
-++		b_0[14] = (j >> 8) & 0xff;
-++		b_0[15] = j & 0xff;
-++		crypto_cipher_encrypt_one(tfm, e, b_0);
-++		for (i = 0; i < blen; i++)
-++			*cpos++ = *pos++ ^ e[i];
-++	}
-+ 
-+-	crypto_aead_encrypt(aead_req);
-++	for (i = 0; i < mic_len; i++)
-++		mic[i] = b[i] ^ s_0[i];
-+ }
-+ 
-+-int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-++int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+ 			      u8 *data, size_t data_len, u8 *mic,
-+ 			      size_t mic_len)
-+ {
-+-	struct scatterlist sg[3];
-+-	char aead_req_data[sizeof(struct aead_request) +
-+-			   crypto_aead_reqsize(tfm)]
-+-		__aligned(__alignof__(struct aead_request));
-+-	struct aead_request *aead_req = (void *) aead_req_data;
-+-
-+-	if (data_len == 0)
-+-		return -EINVAL;
-+-
-+-	memset(aead_req, 0, sizeof(aead_req_data));
-+-
-+-	sg_init_table(sg, 3);
-+-	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
-+-	sg_set_buf(&sg[1], data, data_len);
-+-	sg_set_buf(&sg[2], mic, mic_len);
-+-
-+-	aead_request_set_tfm(aead_req, tfm);
-+-	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
-+-	aead_request_set_ad(aead_req, sg[0].length);
-++	int i, j, last_len, num_blocks;
-++	u8 *pos, *cpos;
-++	u8 a[AES_BLOCK_SIZE];
-++	u8 b[AES_BLOCK_SIZE];
-++	u8 s_0[AES_BLOCK_SIZE];
-++
-++	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
-++	last_len = data_len % AES_BLOCK_SIZE;
-++	aes_ccm_prepare(tfm, b_0, aad, s_0, a, b);
-++
-++	/* Process payload blocks */
-++	cpos = data;
-++	pos = data;
-++	for (j = 1; j <= num_blocks; j++) {
-++		int blen = (j == num_blocks && last_len) ?
-++			last_len : AES_BLOCK_SIZE;
-++
-++		/* Decryption followed by authentication */
-++		b_0[14] = (j >> 8) & 0xff;
-++		b_0[15] = j & 0xff;
-++		crypto_cipher_encrypt_one(tfm, b, b_0);
-++		for (i = 0; i < blen; i++) {
-++			*pos = *cpos++ ^ b[i];
-++			a[i] ^= *pos++;
-++		}
-++		crypto_cipher_encrypt_one(tfm, a, a);
-++	}
-++
-++	for (i = 0; i < mic_len; i++) {
-++		if ((mic[i] ^ s_0[i]) != a[i])
-++			return -1;
-++	}
-+ 
-+-	return crypto_aead_decrypt(aead_req);
-++	return 0;
-+ }
-+ 
-+-struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[],
-+-						    size_t key_len,
-+-						    size_t mic_len)
-++struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
-++						      size_t key_len,
-++						      size_t mic_len)
-+ {
-+-	struct crypto_aead *tfm;
-+-	int err;
-++	struct crypto_cipher *tfm;
-+ 
-+-	tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
-+-	if (IS_ERR(tfm))
-+-		return tfm;
-+-
-+-	err = crypto_aead_setkey(tfm, key, key_len);
-+-	if (err)
-+-		goto free_aead;
-+-	err = crypto_aead_setauthsize(tfm, mic_len);
-+-	if (err)
-+-		goto free_aead;
-++	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-++	if (!IS_ERR(tfm))
-++		crypto_cipher_setkey(tfm, key, key_len);
-+ 
-+ 	return tfm;
-+-
-+-free_aead:
-+-	crypto_free_aead(tfm);
-+-	return ERR_PTR(err);
-+ }
-+ 
-+-void ieee80211_aes_key_free(struct crypto_aead *tfm)
-++
-++void ieee80211_aes_key_free(struct crypto_cipher *tfm)
-+ {
-+-	crypto_free_aead(tfm);
-++	crypto_free_cipher(tfm);
-+ }
-+--- a/net/mac80211/aes_ccm.h
-++++ b/net/mac80211/aes_ccm.h
-+@@ -12,15 +12,15 @@
-+ 
-+ #include <linux/crypto.h>
-+ 
-+-struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[],
-+-						    size_t key_len,
-+-						    size_t mic_len);
-+-void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-++struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
-++						      size_t key_len,
-++						      size_t mic_len);
-++void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+ 			       u8 *data, size_t data_len, u8 *mic,
-+ 			       size_t mic_len);
-+-int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
-++int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+ 			      u8 *data, size_t data_len, u8 *mic,
-+ 			      size_t mic_len);
-+-void ieee80211_aes_key_free(struct crypto_aead *tfm);
-++void ieee80211_aes_key_free(struct crypto_cipher *tfm);
-+ 
-+ #endif /* AES_CCM_H */
-+--- a/net/mac80211/aes_gcm.h
-++++ b/net/mac80211/aes_gcm.h
-+@@ -11,12 +11,28 @@
-+ 
-+ #include <linux/crypto.h>
-+ 
-+-void ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+-			       u8 *data, size_t data_len, u8 *mic);
-+-int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+-			      u8 *data, size_t data_len, u8 *mic);
-+-struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
-+-							size_t key_len);
-+-void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm);
-++static inline void
-++ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-++			  u8 *data, size_t data_len, u8 *mic)
-++{
-++}
-++
-++static inline int
-++ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-++			  u8 *data, size_t data_len, u8 *mic)
-++{
-++    return -EOPNOTSUPP;
-++}
-++
-++static inline struct crypto_aead *
-++ieee80211_aes_gcm_key_setup_encrypt(const u8 key[], size_t key_len)
-++{
-++    return NULL;
-++}
-++
-++static inline void
-++ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
-++{
-++}
-+ 
-+ #endif /* AES_GCM_H */
-+--- a/net/mac80211/aes_gmac.h
-++++ b/net/mac80211/aes_gmac.h
-+@@ -11,10 +11,22 @@
-+ 
-+ #include <linux/crypto.h>
-+ 
-+-struct crypto_aead *ieee80211_aes_gmac_key_setup(const u8 key[],
-+-						 size_t key_len);
-+-int ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
-+-		       const u8 *data, size_t data_len, u8 *mic);
-+-void ieee80211_aes_gmac_key_free(struct crypto_aead *tfm);
-++static inline struct crypto_aead *
-++ieee80211_aes_gmac_key_setup(const u8 key[], size_t key_len)
-++{
-++	return NULL;
-++}
-++
-++static inline int
-++ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
-++		   const u8 *data, size_t data_len, u8 *mic)
-++{
-++	return -EOPNOTSUPP;
-++}
-++
-++static inline void
-++ieee80211_aes_gmac_key_free(struct crypto_aead *tfm)
-++{
-++}
-+ 
-+ #endif /* AES_GMAC_H */
-+--- a/net/mac80211/key.h
-++++ b/net/mac80211/key.h
-+@@ -84,7 +84,7 @@ struct ieee80211_key {
-+ 			 * Management frames.
-+ 			 */
-+ 			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
-+-			struct crypto_aead *tfm;
-++			struct crypto_cipher *tfm;
-+ 			u32 replays; /* dot11RSNAStatsCCMPReplays */
-+ 		} ccmp;
-+ 		struct {
-+--- a/net/mac80211/wpa.c
-++++ b/net/mac80211/wpa.c
-+@@ -307,7 +307,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
-+ }
-+ 
-+ 
-+-static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
-++static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
-++				u16 data_len)
-+ {
-+ 	__le16 mask_fc;
-+ 	int a4_included, mgmt;
-+@@ -337,14 +338,8 @@ static void ccmp_special_blocks(struct s
-+ 	else
-+ 		qos_tid = 0;
-+ 
-+-	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
-+-	 * mode authentication are not allowed to collide, yet both are derived
-+-	 * from this vector b_0. We only set L := 1 here to indicate that the
-+-	 * data size can be represented in (L+1) bytes. The CCM layer will take
-+-	 * care of storing the data length in the top (L+1) bytes and setting
-+-	 * and clearing the other bits as is required to derive the two IVs.
-+-	 */
-+-	b_0[0] = 0x1;
-++	/* First block, b_0 */
-++	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
-+ 
-+ 	/* Nonce: Nonce Flags | A2 | PN
-+ 	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-+@@ -352,6 +347,8 @@ static void ccmp_special_blocks(struct s
-+ 	b_0[1] = qos_tid | (mgmt << 4);
-+ 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
-+ 	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
-++	/* l(m) */
-++	put_unaligned_be16(data_len, &b_0[14]);
-+ 
-+ 	/* AAD (extra authenticate-only data) / masked 802.11 header
-+ 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-+@@ -463,7 +460,7 @@ static int ccmp_encrypt_skb(struct ieee8
-+ 		return 0;
-+ 
-+ 	pos += IEEE80211_CCMP_HDR_LEN;
-+-	ccmp_special_blocks(skb, pn, b_0, aad);
-++	ccmp_special_blocks(skb, pn, b_0, aad, len);
-+ 	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
-+ 				  skb_put(skb, mic_len), mic_len);
-+ 
-+@@ -534,7 +531,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
-+ 			u8 aad[2 * AES_BLOCK_SIZE];
-+ 			u8 b_0[AES_BLOCK_SIZE];
-+ 			/* hardware didn't decrypt/verify MIC */
-+-			ccmp_special_blocks(skb, pn, b_0, aad);
-++			ccmp_special_blocks(skb, pn, b_0, aad, data_len);
-+ 
-+ 			if (ieee80211_aes_ccm_decrypt(
-+ 				    key->u.ccmp.tfm, b_0, aad,
-diff --git a/package/kernel/mac80211/patches/100-revert-cryptoapi-ports.patch b/package/kernel/mac80211/patches/100-revert-cryptoapi-ports.patch
-deleted file mode 100644
-index ceca952..0000000
---- a/package/kernel/mac80211/patches/100-revert-cryptoapi-ports.patch
-+++ /dev/null
-@@ -1,2055 +0,0 @@
--This patch reverts the following commits from wireless-testing:
--
--8ade538bf39b1ee53418528fdacd36b8e65621b9
--56c52da2d554f081e8fce58ecbcf6a40c605b95b
--2b2ba0db1c820d04d5143452d70012cd44d7b578
--00b9cfa3ff38401bd70c34b250ca13e5ea347b4a
--4f031fa9f188b2b0641ac20087d9e16bcfb4e49d
--6e1ee5d2e9e411892b5d84e3ea93e3fc88ac786c
--30ef7ef9672d92ab2cac37f60a31955c118321e7
--f359d3fe832e49eeec2232b2af5a9e3aee6b4862 (only the changes in aes_cmac.{c,h})
--7ec7c4a9a686c608315739ab6a2b0527a240883c
-----
--
----- a/include/linux/ieee80211.h
--+++ b/include/linux/ieee80211.h
--@@ -1017,15 +1017,6 @@ struct ieee80211_mmie {
-- 	u8 mic[8];
-- } __packed;
-- 
---/* Management MIC information element (IEEE 802.11w) for GMAC and CMAC-256 */
---struct ieee80211_mmie_16 {
---	u8 element_id;
---	u8 length;
---	__le16 key_id;
---	u8 sequence_number[6];
---	u8 mic[16];
---} __packed;
---
-- struct ieee80211_vendor_ie {
-- 	u8 element_id;
-- 	u8 len;
----- a/include/net/mac80211.h
--+++ b/include/net/mac80211.h
--@@ -1306,8 +1306,8 @@ struct ieee80211_vif *wdev_to_ieee80211_
--  * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
--  *	that the key is pairwise rather then a shared key.
--  * @IEEE80211_KEY_FLAG_SW_MGMT_TX: This flag should be set by the driver for a
--- *	CCMP/GCMP key if it requires CCMP/GCMP encryption of management frames
--- *	(MFP) to be done in software.
--+ *	CCMP key if it requires CCMP encryption of management frames (MFP) to
--+ *	be done in software.
--  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
--  *	if space should be prepared for the IV, but the IV
--  *	itself should not be generated. Do not set together with
--@@ -1322,7 +1322,7 @@ struct ieee80211_vif *wdev_to_ieee80211_
--  *	RX, if your crypto engine can't deal with TX you can also set the
--  *	%IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
--  * @IEEE80211_KEY_FLAG_GENERATE_IV_MGMT: This flag should be set by the
--- *	driver for a CCMP/GCMP key to indicate that is requires IV generation
--+ *	driver for a CCMP key to indicate that is requires IV generation
--  *	only for managment frames (MFP).
--  * @IEEE80211_KEY_FLAG_RESERVE_TAILROOM: This flag should be set by the
--  *	driver for a key to indicate that sufficient tailroom must always
--@@ -4112,10 +4112,6 @@ void ieee80211_aes_cmac_calculate_k1_k2(
--  *	reverse order than in packet)
--  * @aes_cmac: PN data, most significant byte first (big endian,
--  *	reverse order than in packet)
--- * @aes_gmac: PN data, most significant byte first (big endian,
--- *	reverse order than in packet)
--- * @gcmp: PN data, most significant byte first (big endian,
--- *	reverse order than in packet)
--  */
-- struct ieee80211_key_seq {
-- 	union {
--@@ -4129,12 +4125,6 @@ struct ieee80211_key_seq {
-- 		struct {
-- 			u8 pn[6];
-- 		} aes_cmac;
---		struct {
---			u8 pn[6];
---		} aes_gmac;
---		struct {
---			u8 pn[6];
---		} gcmp;
-- 	};
-- };
-- 
--@@ -4159,7 +4149,7 @@ void ieee80211_get_key_tx_seq(struct iee
--  * ieee80211_get_key_rx_seq - get key RX sequence counter
--  *
--  * @keyconf: the parameter passed with the set key
--- * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
--+ * @tid: The TID, or -1 for the management frame value (CCMP only);
--  *	the value on TID 0 is also used for non-QoS frames. For
--  *	CMAC, only TID 0 is valid.
--  * @seq: buffer to receive the sequence data
--@@ -4195,7 +4185,7 @@ void ieee80211_set_key_tx_seq(struct iee
--  * ieee80211_set_key_rx_seq - set key RX sequence counter
--  *
--  * @keyconf: the parameter passed with the set key
--- * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
--+ * @tid: The TID, or -1 for the management frame value (CCMP only);
--  *	the value on TID 0 is also used for non-QoS frames. For
--  *	CMAC, only TID 0 is valid.
--  * @seq: new sequence data
----- a/net/mac80211/Kconfig
--+++ b/net/mac80211/Kconfig
--@@ -5,8 +5,6 @@ config MAC80211
-- 	depends on CRYPTO
-- 	depends on CRYPTO_ARC4
-- 	depends on CRYPTO_AES
---	select BPAUTO_CRYPTO_CCM
---	depends on CRYPTO_GCM
-- 	depends on CRC32
-- 	select BPAUTO_AVERAGE
-- 	---help---
----- a/net/mac80211/Makefile
--+++ b/net/mac80211/Makefile
--@@ -15,9 +15,7 @@ mac80211-y := \
-- 	michael.o \
-- 	tkip.o \
-- 	aes_ccm.o \
---	aes_gcm.o \
-- 	aes_cmac.o \
---	aes_gmac.o \
-- 	cfg.o \
-- 	ethtool.o \
-- 	rx.o \
----- a/net/mac80211/aes_ccm.c
--+++ b/net/mac80211/aes_ccm.c
--@@ -2,8 +2,6 @@
--  * Copyright 2003-2004, Instant802 Networks, Inc.
--  * Copyright 2005-2006, Devicescape Software, Inc.
--  *
--- * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
--- *
--  * This program is free software; you can redistribute it and/or modify
--  * it under the terms of the GNU General Public License version 2 as
--  * published by the Free Software Foundation.
--@@ -19,82 +17,134 @@
-- #include "key.h"
-- #include "aes_ccm.h"
-- 
---void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
---			       u8 *data, size_t data_len, u8 *mic,
---			       size_t mic_len)
--+static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *scratch, u8 *a)
--+{
--+	int i;
--+	u8 *b_0, *aad, *b, *s_0;
--+
--+	b_0 = scratch + 3 * AES_BLOCK_SIZE;
--+	aad = scratch + 4 * AES_BLOCK_SIZE;
--+	b = scratch;
--+	s_0 = scratch + AES_BLOCK_SIZE;
--+
--+	crypto_cipher_encrypt_one(tfm, b, b_0);
--+
--+	/* Extra Authenticate-only data (always two AES blocks) */
--+	for (i = 0; i < AES_BLOCK_SIZE; i++)
--+		aad[i] ^= b[i];
--+	crypto_cipher_encrypt_one(tfm, b, aad);
--+
--+	aad += AES_BLOCK_SIZE;
--+
--+	for (i = 0; i < AES_BLOCK_SIZE; i++)
--+		aad[i] ^= b[i];
--+	crypto_cipher_encrypt_one(tfm, a, aad);
--+
--+	/* Mask out bits from auth-only-b_0 */
--+	b_0[0] &= 0x07;
--+
--+	/* S_0 is used to encrypt T (= MIC) */
--+	b_0[14] = 0;
--+	b_0[15] = 0;
--+	crypto_cipher_encrypt_one(tfm, s_0, b_0);
--+}
--+
--+
--+void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
--+			       u8 *data, size_t data_len,
--+			       u8 *cdata, u8 *mic)
-- {
---	struct scatterlist assoc, pt, ct[2];
--+	int i, j, last_len, num_blocks;
--+	u8 *pos, *cpos, *b, *s_0, *e, *b_0;
-- 
---	char aead_req_data[sizeof(struct aead_request) +
---			   crypto_aead_reqsize(tfm)]
---		__aligned(__alignof__(struct aead_request));
---	struct aead_request *aead_req = (void *) aead_req_data;
---
---	memset(aead_req, 0, sizeof(aead_req_data));
---
---	sg_init_one(&pt, data, data_len);
---	sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
---	sg_init_table(ct, 2);
---	sg_set_buf(&ct[0], data, data_len);
---	sg_set_buf(&ct[1], mic, mic_len);
---
---	aead_request_set_tfm(aead_req, tfm);
---	aead_request_set_assoc(aead_req, &assoc, assoc.length);
---	aead_request_set_crypt(aead_req, &pt, ct, data_len, b_0);
--+	b = scratch;
--+	s_0 = scratch + AES_BLOCK_SIZE;
--+	e = scratch + 2 * AES_BLOCK_SIZE;
--+	b_0 = scratch + 3 * AES_BLOCK_SIZE;
--+
--+	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
--+	last_len = data_len % AES_BLOCK_SIZE;
--+	aes_ccm_prepare(tfm, scratch, b);
--+
--+	/* Process payload blocks */
--+	pos = data;
--+	cpos = cdata;
--+	for (j = 1; j <= num_blocks; j++) {
--+		int blen = (j == num_blocks && last_len) ?
--+			last_len : AES_BLOCK_SIZE;
--+
--+		/* Authentication followed by encryption */
--+		for (i = 0; i < blen; i++)
--+			b[i] ^= pos[i];
--+		crypto_cipher_encrypt_one(tfm, b, b);
--+
--+		b_0[14] = (j >> 8) & 0xff;
--+		b_0[15] = j & 0xff;
--+		crypto_cipher_encrypt_one(tfm, e, b_0);
--+		for (i = 0; i < blen; i++)
--+			*cpos++ = *pos++ ^ e[i];
--+	}
-- 
---	crypto_aead_encrypt(aead_req);
--+	for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++)
--+		mic[i] = b[i] ^ s_0[i];
-- }
-- 
---int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
---			      u8 *data, size_t data_len, u8 *mic,
---			      size_t mic_len)
--+
--+int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
--+			      u8 *cdata, size_t data_len, u8 *mic, u8 *data)
-- {
---	struct scatterlist assoc, pt, ct[2];
---	char aead_req_data[sizeof(struct aead_request) +
---			   crypto_aead_reqsize(tfm)]
---		__aligned(__alignof__(struct aead_request));
---	struct aead_request *aead_req = (void *) aead_req_data;
---
---	if (data_len == 0)
---		return -EINVAL;
---
---	memset(aead_req, 0, sizeof(aead_req_data));
---
---	sg_init_one(&pt, data, data_len);
---	sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
---	sg_init_table(ct, 2);
---	sg_set_buf(&ct[0], data, data_len);
---	sg_set_buf(&ct[1], mic, mic_len);
---
---	aead_request_set_tfm(aead_req, tfm);
---	aead_request_set_assoc(aead_req, &assoc, assoc.length);
---	aead_request_set_crypt(aead_req, ct, &pt, data_len + mic_len, b_0);
--+	int i, j, last_len, num_blocks;
--+	u8 *pos, *cpos, *b, *s_0, *a, *b_0;
--+
--+	b = scratch;
--+	s_0 = scratch + AES_BLOCK_SIZE;
--+	a = scratch + 2 * AES_BLOCK_SIZE;
--+	b_0 = scratch + 3 * AES_BLOCK_SIZE;
--+
--+	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
--+	last_len = data_len % AES_BLOCK_SIZE;
--+	aes_ccm_prepare(tfm, scratch, a);
--+
--+	/* Process payload blocks */
--+	cpos = cdata;
--+	pos = data;
--+	for (j = 1; j <= num_blocks; j++) {
--+		int blen = (j == num_blocks && last_len) ?
--+			last_len : AES_BLOCK_SIZE;
--+
--+		/* Decryption followed by authentication */
--+		b_0[14] = (j >> 8) & 0xff;
--+		b_0[15] = j & 0xff;
--+		crypto_cipher_encrypt_one(tfm, b, b_0);
--+		for (i = 0; i < blen; i++) {
--+			*pos = *cpos++ ^ b[i];
--+			a[i] ^= *pos++;
--+		}
--+		crypto_cipher_encrypt_one(tfm, a, a);
--+	}
--+
--+	for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++) {
--+		if ((mic[i] ^ s_0[i]) != a[i])
--+			return -1;
--+	}
-- 
---	return crypto_aead_decrypt(aead_req);
--+	return 0;
-- }
-- 
---struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[],
---						    size_t key_len,
---						    size_t mic_len)
--+
--+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
-- {
---	struct crypto_aead *tfm;
---	int err;
--+	struct crypto_cipher *tfm;
-- 
---	tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
---	if (IS_ERR(tfm))
---		return tfm;
---
---	err = crypto_aead_setkey(tfm, key, key_len);
---	if (!err)
---		err = crypto_aead_setauthsize(tfm, mic_len);
---	if (!err)
---		return tfm;
--+	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
--+	if (!IS_ERR(tfm))
--+		crypto_cipher_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
-- 
---	crypto_free_aead(tfm);
---	return ERR_PTR(err);
--+	return tfm;
-- }
-- 
---void ieee80211_aes_key_free(struct crypto_aead *tfm)
--+
--+void ieee80211_aes_key_free(struct crypto_cipher *tfm)
-- {
---	crypto_free_aead(tfm);
--+	crypto_free_cipher(tfm);
-- }
----- a/net/mac80211/aes_ccm.h
--+++ b/net/mac80211/aes_ccm.h
--@@ -12,15 +12,13 @@
-- 
-- #include <linux/crypto.h>
-- 
---struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[],
---						    size_t key_len,
---						    size_t mic_len);
---void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
---			       u8 *data, size_t data_len, u8 *mic,
---			       size_t mic_len);
---int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
---			      u8 *data, size_t data_len, u8 *mic,
---			      size_t mic_len);
---void ieee80211_aes_key_free(struct crypto_aead *tfm);
--+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[]);
--+void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
--+			       u8 *data, size_t data_len,
--+			       u8 *cdata, u8 *mic);
--+int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
--+			      u8 *cdata, size_t data_len,
--+			      u8 *mic, u8 *data);
--+void ieee80211_aes_key_free(struct crypto_cipher *tfm);
-- 
-- #endif /* AES_CCM_H */
----- a/net/mac80211/aes_cmac.c
--+++ b/net/mac80211/aes_cmac.c
--@@ -18,8 +18,8 @@
-- #include "key.h"
-- #include "aes_cmac.h"
-- 
--+#define AES_CMAC_KEY_LEN 16
-- #define CMAC_TLEN 8 /* CMAC TLen = 64 bits (8 octets) */
---#define CMAC_TLEN_256 16 /* CMAC TLen = 128 bits (16 octets) */
-- #define AAD_LEN 20
-- 
-- 
--@@ -35,9 +35,9 @@ static void gf_mulx(u8 *pad)
-- 		pad[AES_BLOCK_SIZE - 1] ^= 0x87;
-- }
-- 
---static void aes_cmac_vector(struct crypto_cipher *tfm, size_t num_elem,
---			    const u8 *addr[], const size_t *len, u8 *mac,
---			    size_t mac_len)
--+
--+static void aes_128_cmac_vector(struct crypto_cipher *tfm, size_t num_elem,
--+				const u8 *addr[], const size_t *len, u8 *mac)
-- {
-- 	u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
-- 	const u8 *pos, *end;
--@@ -88,7 +88,7 @@ static void aes_cmac_vector(struct crypt
-- 	for (i = 0; i < AES_BLOCK_SIZE; i++)
-- 		pad[i] ^= cbc[i];
-- 	crypto_cipher_encrypt_one(tfm, pad, pad);
---	memcpy(mac, pad, mac_len);
--+	memcpy(mac, pad, CMAC_TLEN);
-- }
-- 
-- 
--@@ -107,35 +107,17 @@ void ieee80211_aes_cmac(struct crypto_ci
-- 	addr[2] = zero;
-- 	len[2] = CMAC_TLEN;
-- 
---	aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN);
--+	aes_128_cmac_vector(tfm, 3, addr, len, mic);
-- }
-- 
---void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
---			    const u8 *data, size_t data_len, u8 *mic)
---{
---	const u8 *addr[3];
---	size_t len[3];
---	u8 zero[CMAC_TLEN_256];
---
---	memset(zero, 0, CMAC_TLEN_256);
---	addr[0] = aad;
---	len[0] = AAD_LEN;
---	addr[1] = data;
---	len[1] = data_len - CMAC_TLEN_256;
---	addr[2] = zero;
---	len[2] = CMAC_TLEN_256;
---
---	aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN_256);
---}
-- 
---struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
---						   size_t key_len)
--+struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[])
-- {
-- 	struct crypto_cipher *tfm;
-- 
-- 	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-- 	if (!IS_ERR(tfm))
---		crypto_cipher_setkey(tfm, key, key_len);
--+		crypto_cipher_setkey(tfm, key, AES_CMAC_KEY_LEN);
-- 
-- 	return tfm;
-- }
----- a/net/mac80211/aes_cmac.h
--+++ b/net/mac80211/aes_cmac.h
--@@ -11,12 +11,9 @@
-- 
-- #include <linux/crypto.h>
-- 
---struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
---						   size_t key_len);
--+struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[]);
-- void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
-- 			const u8 *data, size_t data_len, u8 *mic);
---void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
---			    const u8 *data, size_t data_len, u8 *mic);
-- void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm);
-- 
-- #endif /* AES_CMAC_H */
----- a/net/mac80211/aes_gcm.c
--+++ /dev/null
--@@ -1,95 +0,0 @@
---/*
--- * Copyright 2014-2015, Qualcomm Atheros, Inc.
--- *
--- * This program is free software; you can redistribute it and/or modify
--- * it under the terms of the GNU General Public License version 2 as
--- * published by the Free Software Foundation.
--- */
---
---#include <linux/kernel.h>
---#include <linux/types.h>
---#include <linux/crypto.h>
---#include <linux/err.h>
---#include <crypto/aes.h>
---
---#include <net/mac80211.h>
---#include "key.h"
---#include "aes_gcm.h"
---
---void ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
---			       u8 *data, size_t data_len, u8 *mic)
---{
---	struct scatterlist assoc, pt, ct[2];
---
---	char aead_req_data[sizeof(struct aead_request) +
---			   crypto_aead_reqsize(tfm)]
---		__aligned(__alignof__(struct aead_request));
---	struct aead_request *aead_req = (void *)aead_req_data;
---
---	memset(aead_req, 0, sizeof(aead_req_data));
---
---	sg_init_one(&pt, data, data_len);
---	sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
---	sg_init_table(ct, 2);
---	sg_set_buf(&ct[0], data, data_len);
---	sg_set_buf(&ct[1], mic, IEEE80211_GCMP_MIC_LEN);
---
---	aead_request_set_tfm(aead_req, tfm);
---	aead_request_set_assoc(aead_req, &assoc, assoc.length);
---	aead_request_set_crypt(aead_req, &pt, ct, data_len, j_0);
---
---	crypto_aead_encrypt(aead_req);
---}
---
---int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
---			      u8 *data, size_t data_len, u8 *mic)
---{
---	struct scatterlist assoc, pt, ct[2];
---	char aead_req_data[sizeof(struct aead_request) +
---			   crypto_aead_reqsize(tfm)]
---		__aligned(__alignof__(struct aead_request));
---	struct aead_request *aead_req = (void *)aead_req_data;
---
---	if (data_len == 0)
---		return -EINVAL;
---
---	memset(aead_req, 0, sizeof(aead_req_data));
---
---	sg_init_one(&pt, data, data_len);
---	sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
---	sg_init_table(ct, 2);
---	sg_set_buf(&ct[0], data, data_len);
---	sg_set_buf(&ct[1], mic, IEEE80211_GCMP_MIC_LEN);
---
---	aead_request_set_tfm(aead_req, tfm);
---	aead_request_set_assoc(aead_req, &assoc, assoc.length);
---	aead_request_set_crypt(aead_req, ct, &pt,
---			       data_len + IEEE80211_GCMP_MIC_LEN, j_0);
---
---	return crypto_aead_decrypt(aead_req);
---}
---
---struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
---							size_t key_len)
---{
---	struct crypto_aead *tfm;
---	int err;
---
---	tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
---	if (IS_ERR(tfm))
---		return tfm;
---
---	err = crypto_aead_setkey(tfm, key, key_len);
---	if (!err)
---		err = crypto_aead_setauthsize(tfm, IEEE80211_GCMP_MIC_LEN);
---	if (!err)
---		return tfm;
---
---	crypto_free_aead(tfm);
---	return ERR_PTR(err);
---}
---
---void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
---{
---	crypto_free_aead(tfm);
---}
----- a/net/mac80211/aes_gcm.h
--+++ /dev/null
--@@ -1,22 +0,0 @@
---/*
--- * Copyright 2014-2015, Qualcomm Atheros, Inc.
--- *
--- * This program is free software; you can redistribute it and/or modify
--- * it under the terms of the GNU General Public License version 2 as
--- * published by the Free Software Foundation.
--- */
---
---#ifndef AES_GCM_H
---#define AES_GCM_H
---
---#include <linux/crypto.h>
---
---void ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
---			       u8 *data, size_t data_len, u8 *mic);
---int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
---			      u8 *data, size_t data_len, u8 *mic);
---struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
---							size_t key_len);
---void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm);
---
---#endif /* AES_GCM_H */
----- a/net/mac80211/aes_gmac.c
--+++ /dev/null
--@@ -1,84 +0,0 @@
---/*
--- * AES-GMAC for IEEE 802.11 BIP-GMAC-128 and BIP-GMAC-256
--- * Copyright 2015, Qualcomm Atheros, Inc.
--- *
--- * This program is free software; you can redistribute it and/or modify
--- * it under the terms of the GNU General Public License version 2 as
--- * published by the Free Software Foundation.
--- */
---
---#include <linux/kernel.h>
---#include <linux/types.h>
---#include <linux/crypto.h>
---#include <linux/err.h>
---#include <crypto/aes.h>
---
---#include <net/mac80211.h>
---#include "key.h"
---#include "aes_gmac.h"
---
---#define GMAC_MIC_LEN 16
---#define GMAC_NONCE_LEN 12
---#define AAD_LEN 20
---
---int ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
---		       const u8 *data, size_t data_len, u8 *mic)
---{
---	struct scatterlist sg[3], ct[1];
---	char aead_req_data[sizeof(struct aead_request) +
---			   crypto_aead_reqsize(tfm)]
---		__aligned(__alignof__(struct aead_request));
---	struct aead_request *aead_req = (void *)aead_req_data;
---	u8 zero[GMAC_MIC_LEN], iv[AES_BLOCK_SIZE];
---
---	if (data_len < GMAC_MIC_LEN)
---		return -EINVAL;
---
---	memset(aead_req, 0, sizeof(aead_req_data));
---
---	memset(zero, 0, GMAC_MIC_LEN);
---	sg_init_table(sg, 3);
---	sg_set_buf(&sg[0], aad, AAD_LEN);
---	sg_set_buf(&sg[1], data, data_len - GMAC_MIC_LEN);
---	sg_set_buf(&sg[2], zero, GMAC_MIC_LEN);
---
---	memcpy(iv, nonce, GMAC_NONCE_LEN);
---	memset(iv + GMAC_NONCE_LEN, 0, sizeof(iv) - GMAC_NONCE_LEN);
---	iv[AES_BLOCK_SIZE - 1] = 0x01;
---
---	sg_init_table(ct, 1);
---	sg_set_buf(&ct[0], mic, GMAC_MIC_LEN);
---
---	aead_request_set_tfm(aead_req, tfm);
---	aead_request_set_assoc(aead_req, sg, AAD_LEN + data_len);
---	aead_request_set_crypt(aead_req, NULL, ct, 0, iv);
---
---	crypto_aead_encrypt(aead_req);
---
---	return 0;
---}
---
---struct crypto_aead *ieee80211_aes_gmac_key_setup(const u8 key[],
---						 size_t key_len)
---{
---	struct crypto_aead *tfm;
---	int err;
---
---	tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
---	if (IS_ERR(tfm))
---		return tfm;
---
---	err = crypto_aead_setkey(tfm, key, key_len);
---	if (!err)
---		return tfm;
---	if (!err)
---		err = crypto_aead_setauthsize(tfm, GMAC_MIC_LEN);
---
---	crypto_free_aead(tfm);
---	return ERR_PTR(err);
---}
---
---void ieee80211_aes_gmac_key_free(struct crypto_aead *tfm)
---{
---	crypto_free_aead(tfm);
---}
----- a/net/mac80211/aes_gmac.h
--+++ /dev/null
--@@ -1,20 +0,0 @@
---/*
--- * Copyright 2015, Qualcomm Atheros, Inc.
--- *
--- * This program is free software; you can redistribute it and/or modify
--- * it under the terms of the GNU General Public License version 2 as
--- * published by the Free Software Foundation.
--- */
---
---#ifndef AES_GMAC_H
---#define AES_GMAC_H
---
---#include <linux/crypto.h>
---
---struct crypto_aead *ieee80211_aes_gmac_key_setup(const u8 key[],
---						 size_t key_len);
---int ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
---		       const u8 *data, size_t data_len, u8 *mic);
---void ieee80211_aes_gmac_key_free(struct crypto_aead *tfm);
---
---#endif /* AES_GMAC_H */
----- a/net/mac80211/cfg.c
--+++ b/net/mac80211/cfg.c
--@@ -162,13 +162,8 @@ static int ieee80211_add_key(struct wiph
-- 			return -EINVAL;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
-- 	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
-- 		break;
-- 	default:
-- 		cs = ieee80211_cs_get(local, params->cipher, sdata->vif.type);
--@@ -353,7 +348,6 @@ static int ieee80211_get_key(struct wiph
-- 		params.seq_len = 6;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		pn64 = atomic64_read(&key->u.ccmp.tx_pn);
-- 		seq[0] = pn64;
-- 		seq[1] = pn64 >> 8;
--@@ -365,35 +359,10 @@ static int ieee80211_get_key(struct wiph
-- 		params.seq_len = 6;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		pn64 = atomic64_read(&key->u.aes_cmac.tx_pn);
-- 		seq[0] = pn64;
-- 		seq[1] = pn64 >> 8;
-- 		seq[2] = pn64 >> 16;
---		seq[3] = pn64 >> 24;
---		seq[4] = pn64 >> 32;
---		seq[5] = pn64 >> 40;
---		params.seq = seq;
---		params.seq_len = 6;
---		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		pn64 = atomic64_read(&key->u.aes_gmac.tx_pn);
---		seq[0] = pn64;
---		seq[1] = pn64 >> 8;
---		seq[2] = pn64 >> 16;
---		seq[3] = pn64 >> 24;
---		seq[4] = pn64 >> 32;
---		seq[5] = pn64 >> 40;
---		params.seq = seq;
---		params.seq_len = 6;
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		pn64 = atomic64_read(&key->u.gcmp.tx_pn);
---		seq[0] = pn64;
---		seq[1] = pn64 >> 8;
---		seq[2] = pn64 >> 16;
-- 		seq[3] = pn64 >> 24;
-- 		seq[4] = pn64 >> 32;
-- 		seq[5] = pn64 >> 40;
----- a/net/mac80211/debugfs_key.c
--+++ b/net/mac80211/debugfs_key.c
--@@ -94,33 +94,17 @@ static ssize_t key_tx_spec_read(struct f
-- 				key->u.tkip.tx.iv16);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		pn = atomic64_read(&key->u.ccmp.tx_pn);
-- 		len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
-- 				(u8)(pn >> 40), (u8)(pn >> 32), (u8)(pn >> 24),
-- 				(u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		pn = atomic64_read(&key->u.aes_cmac.tx_pn);
-- 		len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
-- 				(u8)(pn >> 40), (u8)(pn >> 32), (u8)(pn >> 24),
-- 				(u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		pn = atomic64_read(&key->u.aes_gmac.tx_pn);
---		len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
---				(u8)(pn >> 40), (u8)(pn >> 32), (u8)(pn >> 24),
---				(u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		pn = atomic64_read(&key->u.gcmp.tx_pn);
---		len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
---				(u8)(pn >> 40), (u8)(pn >> 32), (u8)(pn >> 24),
---				(u8)(pn >> 16), (u8)(pn >> 8), (u8)pn);
---		break;
-- 	default:
-- 		return 0;
-- 	}
--@@ -150,7 +134,6 @@ static ssize_t key_rx_spec_read(struct f
-- 		len = p - buf;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++) {
-- 			rpn = key->u.ccmp.rx_pn[i];
-- 			p += scnprintf(p, sizeof(buf)+buf-p,
--@@ -161,7 +144,6 @@ static ssize_t key_rx_spec_read(struct f
-- 		len = p - buf;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		rpn = key->u.aes_cmac.rx_pn;
-- 		p += scnprintf(p, sizeof(buf)+buf-p,
-- 			       "%02x%02x%02x%02x%02x%02x\n",
--@@ -169,26 +151,6 @@ static ssize_t key_rx_spec_read(struct f
-- 			       rpn[3], rpn[4], rpn[5]);
-- 		len = p - buf;
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		rpn = key->u.aes_gmac.rx_pn;
---		p += scnprintf(p, sizeof(buf)+buf-p,
---			       "%02x%02x%02x%02x%02x%02x\n",
---			       rpn[0], rpn[1], rpn[2],
---			       rpn[3], rpn[4], rpn[5]);
---		len = p - buf;
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++) {
---			rpn = key->u.gcmp.rx_pn[i];
---			p += scnprintf(p, sizeof(buf)+buf-p,
---				       "%02x%02x%02x%02x%02x%02x\n",
---				       rpn[0], rpn[1], rpn[2],
---				       rpn[3], rpn[4], rpn[5]);
---		}
---		len = p - buf;
---		break;
-- 	default:
-- 		return 0;
-- 	}
--@@ -205,23 +167,12 @@ static ssize_t key_replays_read(struct f
-- 
-- 	switch (key->conf.cipher) {
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		len = scnprintf(buf, sizeof(buf), "%u\n",
-- 				key->u.aes_cmac.replays);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		len = scnprintf(buf, sizeof(buf), "%u\n",
---				key->u.aes_gmac.replays);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		len = scnprintf(buf, sizeof(buf), "%u\n", key->u.gcmp.replays);
---		break;
-- 	default:
-- 		return 0;
-- 	}
--@@ -238,15 +189,9 @@ static ssize_t key_icverrors_read(struct
-- 
-- 	switch (key->conf.cipher) {
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		len = scnprintf(buf, sizeof(buf), "%u\n",
-- 				key->u.aes_cmac.icverrors);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		len = scnprintf(buf, sizeof(buf), "%u\n",
---				key->u.aes_gmac.icverrors);
---		break;
-- 	default:
-- 		return 0;
-- 	}
----- a/net/mac80211/key.c
--+++ b/net/mac80211/key.c
--@@ -24,8 +24,6 @@
-- #include "debugfs_key.h"
-- #include "aes_ccm.h"
-- #include "aes_cmac.h"
---#include "aes_gmac.h"
---#include "aes_gcm.h"
-- 
-- 
-- /**
--@@ -164,13 +162,7 @@ static int ieee80211_key_enable_hw_accel
-- 	case WLAN_CIPHER_SUITE_WEP104:
-- 	case WLAN_CIPHER_SUITE_TKIP:
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
-- 		/* all of these we can do in software - if driver can */
-- 		if (ret == 1)
-- 			return 0;
--@@ -394,26 +386,7 @@ ieee80211_key_alloc(u32 cipher, int idx,
-- 		 * Initialize AES key state here as an optimization so that
-- 		 * it does not need to be initialized for every packet.
-- 		 */
---		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(
---			key_data, key_len, IEEE80211_CCMP_MIC_LEN);
---		if (IS_ERR(key->u.ccmp.tfm)) {
---			err = PTR_ERR(key->u.ccmp.tfm);
---			kfree(key);
---			return ERR_PTR(err);
---		}
---		break;
---	case WLAN_CIPHER_SUITE_CCMP_256:
---		key->conf.iv_len = IEEE80211_CCMP_256_HDR_LEN;
---		key->conf.icv_len = IEEE80211_CCMP_256_MIC_LEN;
---		for (i = 0; seq && i < IEEE80211_NUM_TIDS + 1; i++)
---			for (j = 0; j < IEEE80211_CCMP_256_PN_LEN; j++)
---				key->u.ccmp.rx_pn[i][j] =
---					seq[IEEE80211_CCMP_256_PN_LEN - j - 1];
---		/* Initialize AES key state here as an optimization so that
---		 * it does not need to be initialized for every packet.
---		 */
---		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(
---			key_data, key_len, IEEE80211_CCMP_256_MIC_LEN);
--+		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
-- 		if (IS_ERR(key->u.ccmp.tfm)) {
-- 			err = PTR_ERR(key->u.ccmp.tfm);
-- 			kfree(key);
--@@ -421,12 +394,8 @@ ieee80211_key_alloc(u32 cipher, int idx,
-- 		}
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		key->conf.iv_len = 0;
---		if (cipher == WLAN_CIPHER_SUITE_AES_CMAC)
---			key->conf.icv_len = sizeof(struct ieee80211_mmie);
---		else
---			key->conf.icv_len = sizeof(struct ieee80211_mmie_16);
--+		key->conf.icv_len = sizeof(struct ieee80211_mmie);
-- 		if (seq)
-- 			for (j = 0; j < IEEE80211_CMAC_PN_LEN; j++)
-- 				key->u.aes_cmac.rx_pn[j] =
--@@ -436,51 +405,13 @@ ieee80211_key_alloc(u32 cipher, int idx,
-- 		 * it does not need to be initialized for every packet.
-- 		 */
-- 		key->u.aes_cmac.tfm =
---			ieee80211_aes_cmac_key_setup(key_data, key_len);
--+			ieee80211_aes_cmac_key_setup(key_data);
-- 		if (IS_ERR(key->u.aes_cmac.tfm)) {
-- 			err = PTR_ERR(key->u.aes_cmac.tfm);
-- 			kfree(key);
-- 			return ERR_PTR(err);
-- 		}
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		key->conf.iv_len = 0;
---		key->conf.icv_len = sizeof(struct ieee80211_mmie_16);
---		if (seq)
---			for (j = 0; j < IEEE80211_GMAC_PN_LEN; j++)
---				key->u.aes_gmac.rx_pn[j] =
---					seq[IEEE80211_GMAC_PN_LEN - j - 1];
---		/* Initialize AES key state here as an optimization so that
---		 * it does not need to be initialized for every packet.
---		 */
---		key->u.aes_gmac.tfm =
---			ieee80211_aes_gmac_key_setup(key_data, key_len);
---		if (IS_ERR(key->u.aes_gmac.tfm)) {
---			err = PTR_ERR(key->u.aes_gmac.tfm);
---			kfree(key);
---			return ERR_PTR(err);
---		}
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		key->conf.iv_len = IEEE80211_GCMP_HDR_LEN;
---		key->conf.icv_len = IEEE80211_GCMP_MIC_LEN;
---		for (i = 0; seq && i < IEEE80211_NUM_TIDS + 1; i++)
---			for (j = 0; j < IEEE80211_GCMP_PN_LEN; j++)
---				key->u.gcmp.rx_pn[i][j] =
---					seq[IEEE80211_GCMP_PN_LEN - j - 1];
---		/* Initialize AES key state here as an optimization so that
---		 * it does not need to be initialized for every packet.
---		 */
---		key->u.gcmp.tfm = ieee80211_aes_gcm_key_setup_encrypt(key_data,
---								      key_len);
---		if (IS_ERR(key->u.gcmp.tfm)) {
---			err = PTR_ERR(key->u.gcmp.tfm);
---			kfree(key);
---			return ERR_PTR(err);
---		}
---		break;
-- 	default:
-- 		if (cs) {
-- 			size_t len = (seq_len > MAX_PN_LEN) ?
--@@ -502,24 +433,10 @@ ieee80211_key_alloc(u32 cipher, int idx,
-- 
-- static void ieee80211_key_free_common(struct ieee80211_key *key)
-- {
---	switch (key->conf.cipher) {
---	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
--+	if (key->conf.cipher == WLAN_CIPHER_SUITE_CCMP)
-- 		ieee80211_aes_key_free(key->u.ccmp.tfm);
---		break;
---	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
--+	if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
-- 		ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
---		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		ieee80211_aes_gmac_key_free(key->u.aes_gmac.tfm);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		ieee80211_aes_gcm_key_free(key->u.gcmp.tfm);
---		break;
---	}
-- 	kzfree(key);
-- }
-- 
--@@ -826,7 +743,6 @@ void ieee80211_get_key_tx_seq(struct iee
-- 		seq->tkip.iv16 = key->u.tkip.tx.iv16;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		pn64 = atomic64_read(&key->u.ccmp.tx_pn);
-- 		seq->ccmp.pn[5] = pn64;
-- 		seq->ccmp.pn[4] = pn64 >> 8;
--@@ -836,7 +752,6 @@ void ieee80211_get_key_tx_seq(struct iee
-- 		seq->ccmp.pn[0] = pn64 >> 40;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		pn64 = atomic64_read(&key->u.aes_cmac.tx_pn);
-- 		seq->ccmp.pn[5] = pn64;
-- 		seq->ccmp.pn[4] = pn64 >> 8;
--@@ -845,26 +760,6 @@ void ieee80211_get_key_tx_seq(struct iee
-- 		seq->ccmp.pn[1] = pn64 >> 32;
-- 		seq->ccmp.pn[0] = pn64 >> 40;
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		pn64 = atomic64_read(&key->u.aes_gmac.tx_pn);
---		seq->ccmp.pn[5] = pn64;
---		seq->ccmp.pn[4] = pn64 >> 8;
---		seq->ccmp.pn[3] = pn64 >> 16;
---		seq->ccmp.pn[2] = pn64 >> 24;
---		seq->ccmp.pn[1] = pn64 >> 32;
---		seq->ccmp.pn[0] = pn64 >> 40;
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		pn64 = atomic64_read(&key->u.gcmp.tx_pn);
---		seq->gcmp.pn[5] = pn64;
---		seq->gcmp.pn[4] = pn64 >> 8;
---		seq->gcmp.pn[3] = pn64 >> 16;
---		seq->gcmp.pn[2] = pn64 >> 24;
---		seq->gcmp.pn[1] = pn64 >> 32;
---		seq->gcmp.pn[0] = pn64 >> 40;
---		break;
-- 	default:
-- 		WARN_ON(1);
-- 	}
--@@ -887,7 +782,6 @@ void ieee80211_get_key_rx_seq(struct iee
-- 		seq->tkip.iv16 = key->u.tkip.rx[tid].iv16;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
-- 			return;
-- 		if (tid < 0)
--@@ -897,29 +791,11 @@ void ieee80211_get_key_rx_seq(struct iee
-- 		memcpy(seq->ccmp.pn, pn, IEEE80211_CCMP_PN_LEN);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		if (WARN_ON(tid != 0))
-- 			return;
-- 		pn = key->u.aes_cmac.rx_pn;
-- 		memcpy(seq->aes_cmac.pn, pn, IEEE80211_CMAC_PN_LEN);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		if (WARN_ON(tid != 0))
---			return;
---		pn = key->u.aes_gmac.rx_pn;
---		memcpy(seq->aes_gmac.pn, pn, IEEE80211_GMAC_PN_LEN);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
---			return;
---		if (tid < 0)
---			pn = key->u.gcmp.rx_pn[IEEE80211_NUM_TIDS];
---		else
---			pn = key->u.gcmp.rx_pn[tid];
---		memcpy(seq->gcmp.pn, pn, IEEE80211_GCMP_PN_LEN);
---		break;
-- 	}
-- }
-- EXPORT_SYMBOL(ieee80211_get_key_rx_seq);
--@@ -938,7 +814,6 @@ void ieee80211_set_key_tx_seq(struct iee
-- 		key->u.tkip.tx.iv16 = seq->tkip.iv16;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		pn64 = (u64)seq->ccmp.pn[5] |
-- 		       ((u64)seq->ccmp.pn[4] << 8) |
-- 		       ((u64)seq->ccmp.pn[3] << 16) |
--@@ -948,7 +823,6 @@ void ieee80211_set_key_tx_seq(struct iee
-- 		atomic64_set(&key->u.ccmp.tx_pn, pn64);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		pn64 = (u64)seq->aes_cmac.pn[5] |
-- 		       ((u64)seq->aes_cmac.pn[4] << 8) |
-- 		       ((u64)seq->aes_cmac.pn[3] << 16) |
--@@ -957,26 +831,6 @@ void ieee80211_set_key_tx_seq(struct iee
-- 		       ((u64)seq->aes_cmac.pn[0] << 40);
-- 		atomic64_set(&key->u.aes_cmac.tx_pn, pn64);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		pn64 = (u64)seq->aes_gmac.pn[5] |
---		       ((u64)seq->aes_gmac.pn[4] << 8) |
---		       ((u64)seq->aes_gmac.pn[3] << 16) |
---		       ((u64)seq->aes_gmac.pn[2] << 24) |
---		       ((u64)seq->aes_gmac.pn[1] << 32) |
---		       ((u64)seq->aes_gmac.pn[0] << 40);
---		atomic64_set(&key->u.aes_gmac.tx_pn, pn64);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		pn64 = (u64)seq->gcmp.pn[5] |
---		       ((u64)seq->gcmp.pn[4] << 8) |
---		       ((u64)seq->gcmp.pn[3] << 16) |
---		       ((u64)seq->gcmp.pn[2] << 24) |
---		       ((u64)seq->gcmp.pn[1] << 32) |
---		       ((u64)seq->gcmp.pn[0] << 40);
---		atomic64_set(&key->u.gcmp.tx_pn, pn64);
---		break;
-- 	default:
-- 		WARN_ON(1);
-- 		break;
--@@ -1000,7 +854,6 @@ void ieee80211_set_key_rx_seq(struct iee
-- 		key->u.tkip.rx[tid].iv16 = seq->tkip.iv16;
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---	case WLAN_CIPHER_SUITE_CCMP_256:
-- 		if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
-- 			return;
-- 		if (tid < 0)
--@@ -1010,29 +863,11 @@ void ieee80211_set_key_rx_seq(struct iee
-- 		memcpy(pn, seq->ccmp.pn, IEEE80211_CCMP_PN_LEN);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-- 		if (WARN_ON(tid != 0))
-- 			return;
-- 		pn = key->u.aes_cmac.rx_pn;
-- 		memcpy(pn, seq->aes_cmac.pn, IEEE80211_CMAC_PN_LEN);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		if (WARN_ON(tid != 0))
---			return;
---		pn = key->u.aes_gmac.rx_pn;
---		memcpy(pn, seq->aes_gmac.pn, IEEE80211_GMAC_PN_LEN);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
---			return;
---		if (tid < 0)
---			pn = key->u.gcmp.rx_pn[IEEE80211_NUM_TIDS];
---		else
---			pn = key->u.gcmp.rx_pn[tid];
---		memcpy(pn, seq->gcmp.pn, IEEE80211_GCMP_PN_LEN);
---		break;
-- 	default:
-- 		WARN_ON(1);
-- 		break;
----- a/net/mac80211/key.h
--+++ b/net/mac80211/key.h
--@@ -84,7 +84,7 @@ struct ieee80211_key {
-- 			 * Management frames.
-- 			 */
-- 			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
---			struct crypto_aead *tfm;
--+			struct crypto_cipher *tfm;
-- 			u32 replays; /* dot11RSNAStatsCCMPReplays */
-- 		} ccmp;
-- 		struct {
--@@ -95,24 +95,6 @@ struct ieee80211_key {
-- 			u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
-- 		} aes_cmac;
-- 		struct {
---			atomic64_t tx_pn;
---			u8 rx_pn[IEEE80211_GMAC_PN_LEN];
---			struct crypto_aead *tfm;
---			u32 replays; /* dot11RSNAStatsCMACReplays */
---			u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
---		} aes_gmac;
---		struct {
---			atomic64_t tx_pn;
---			/* Last received packet number. The first
---			 * IEEE80211_NUM_TIDS counters are used with Data
---			 * frames and the last counter is used with Robust
---			 * Management frames.
---			 */
---			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_GCMP_PN_LEN];
---			struct crypto_aead *tfm;
---			u32 replays; /* dot11RSNAStatsGCMPReplays */
---		} gcmp;
---		struct {
-- 			/* generic cipher scheme */
-- 			u8 rx_pn[IEEE80211_NUM_TIDS + 1][MAX_PN_LEN];
-- 		} gen;
----- a/net/mac80211/main.c
--+++ b/net/mac80211/main.c
--@@ -666,15 +666,9 @@ static int ieee80211_init_cipher_suites(
-- 		WLAN_CIPHER_SUITE_WEP104,
-- 		WLAN_CIPHER_SUITE_TKIP,
-- 		WLAN_CIPHER_SUITE_CCMP,
---		WLAN_CIPHER_SUITE_CCMP_256,
---		WLAN_CIPHER_SUITE_GCMP,
---		WLAN_CIPHER_SUITE_GCMP_256,
-- 
-- 		/* keep last -- depends on hw flags! */
---		WLAN_CIPHER_SUITE_AES_CMAC,
---		WLAN_CIPHER_SUITE_BIP_CMAC_256,
---		WLAN_CIPHER_SUITE_BIP_GMAC_128,
---		WLAN_CIPHER_SUITE_BIP_GMAC_256,
--+		WLAN_CIPHER_SUITE_AES_CMAC
-- 	};
-- 
-- 	if (local->hw.flags & IEEE80211_HW_SW_CRYPTO_CONTROL ||
--@@ -713,7 +707,7 @@ static int ieee80211_init_cipher_suites(
-- 		local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
-- 
-- 		if (!have_mfp)
---			local->hw.wiphy->n_cipher_suites -= 4;
--+			local->hw.wiphy->n_cipher_suites--;
-- 
-- 		if (!have_wep) {
-- 			local->hw.wiphy->cipher_suites += 2;
--@@ -730,42 +724,32 @@ static int ieee80211_init_cipher_suites(
-- 		/* Driver specifies cipher schemes only (but not cipher suites
-- 		 * including the schemes)
-- 		 *
---		 * We start counting ciphers defined by schemes, TKIP, CCMP,
---		 * CCMP-256, GCMP, and GCMP-256
--+		 * We start counting ciphers defined by schemes, TKIP and CCMP
-- 		 */
---		n_suites = local->hw.n_cipher_schemes + 5;
--+		n_suites = local->hw.n_cipher_schemes + 2;
-- 
-- 		/* check if we have WEP40 and WEP104 */
-- 		if (have_wep)
-- 			n_suites += 2;
-- 
---		/* check if we have AES_CMAC, BIP-CMAC-256, BIP-GMAC-128,
---		 * BIP-GMAC-256
---		 */
--+		/* check if we have AES_CMAC */
-- 		if (have_mfp)
---			n_suites += 4;
--+			n_suites++;
-- 
-- 		suites = kmalloc(sizeof(u32) * n_suites, GFP_KERNEL);
-- 		if (!suites)
-- 			return -ENOMEM;
-- 
-- 		suites[w++] = WLAN_CIPHER_SUITE_CCMP;
---		suites[w++] = WLAN_CIPHER_SUITE_CCMP_256;
-- 		suites[w++] = WLAN_CIPHER_SUITE_TKIP;
---		suites[w++] = WLAN_CIPHER_SUITE_GCMP;
---		suites[w++] = WLAN_CIPHER_SUITE_GCMP_256;
-- 
-- 		if (have_wep) {
-- 			suites[w++] = WLAN_CIPHER_SUITE_WEP40;
-- 			suites[w++] = WLAN_CIPHER_SUITE_WEP104;
-- 		}
-- 
---		if (have_mfp) {
--+		if (have_mfp)
-- 			suites[w++] = WLAN_CIPHER_SUITE_AES_CMAC;
---			suites[w++] = WLAN_CIPHER_SUITE_BIP_CMAC_256;
---			suites[w++] = WLAN_CIPHER_SUITE_BIP_GMAC_128;
---			suites[w++] = WLAN_CIPHER_SUITE_BIP_GMAC_256;
---		}
-- 
-- 		for (r = 0; r < local->hw.n_cipher_schemes; r++)
-- 			suites[w++] = cs[r].cipher;
----- a/net/mac80211/rx.c
--+++ b/net/mac80211/rx.c
--@@ -647,7 +647,6 @@ static int ieee80211_get_mmie_keyidx(str
-- {
-- 	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
-- 	struct ieee80211_mmie *mmie;
---	struct ieee80211_mmie_16 *mmie16;
-- 
-- 	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
-- 		return -1;
--@@ -657,18 +656,11 @@ static int ieee80211_get_mmie_keyidx(str
-- 
-- 	mmie = (struct ieee80211_mmie *)
-- 		(skb->data + skb->len - sizeof(*mmie));
---	if (mmie->element_id == WLAN_EID_MMIE &&
---	    mmie->length == sizeof(*mmie) - 2)
---		return le16_to_cpu(mmie->key_id);
---
---	mmie16 = (struct ieee80211_mmie_16 *)
---		(skb->data + skb->len - sizeof(*mmie16));
---	if (skb->len >= 24 + sizeof(*mmie16) &&
---	    mmie16->element_id == WLAN_EID_MMIE &&
---	    mmie16->length == sizeof(*mmie16) - 2)
---		return le16_to_cpu(mmie16->key_id);
--+	if (mmie->element_id != WLAN_EID_MMIE ||
--+	    mmie->length != sizeof(*mmie) - 2)
--+		return -1;
-- 
---	return -1;
--+	return le16_to_cpu(mmie->key_id);
-- }
-- 
-- static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
--@@ -1658,27 +1650,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_
-- 		result = ieee80211_crypto_tkip_decrypt(rx);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_CCMP:
---		result = ieee80211_crypto_ccmp_decrypt(
---			rx, IEEE80211_CCMP_MIC_LEN);
---		break;
---	case WLAN_CIPHER_SUITE_CCMP_256:
---		result = ieee80211_crypto_ccmp_decrypt(
---			rx, IEEE80211_CCMP_256_MIC_LEN);
--+		result = ieee80211_crypto_ccmp_decrypt(rx);
-- 		break;
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
-- 		result = ieee80211_crypto_aes_cmac_decrypt(rx);
-- 		break;
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
---		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
---		break;
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		result = ieee80211_crypto_aes_gmac_decrypt(rx);
---		break;
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		result = ieee80211_crypto_gcmp_decrypt(rx);
---		break;
-- 	default:
-- 		result = ieee80211_crypto_hw_decrypt(rx);
-- 	}
--@@ -1805,9 +1781,7 @@ ieee80211_rx_h_defragment(struct ieee802
-- 		/* This is the first fragment of a new frame. */
-- 		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
-- 						 rx->seqno_idx, &(rx->skb));
---		if (rx->key &&
---		    (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
---		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256) &&
--+		if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
-- 		    ieee80211_has_protected(fc)) {
-- 			int queue = rx->security_idx;
-- 			/* Store CCMP PN so that we can verify that the next
--@@ -1836,9 +1810,7 @@ ieee80211_rx_h_defragment(struct ieee802
-- 		int i;
-- 		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
-- 		int queue;
---		if (!rx->key ||
---		    (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
---		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256))
--+		if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
-- 			return RX_DROP_UNUSABLE;
-- 		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
-- 		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -626,9 +626,6 @@ ieee80211_tx_h_select_key(struct ieee802
-- 				tx->key = NULL;
-- 			break;
-- 		case WLAN_CIPHER_SUITE_CCMP:
---		case WLAN_CIPHER_SUITE_CCMP_256:
---		case WLAN_CIPHER_SUITE_GCMP:
---		case WLAN_CIPHER_SUITE_GCMP_256:
-- 			if (!ieee80211_is_data_present(hdr->frame_control) &&
-- 			    !ieee80211_use_mfp(hdr->frame_control, tx->sta,
-- 					       tx->skb))
--@@ -639,9 +636,6 @@ ieee80211_tx_h_select_key(struct ieee802
-- 					ieee80211_is_mgmt(hdr->frame_control);
-- 			break;
-- 		case WLAN_CIPHER_SUITE_AES_CMAC:
---		case WLAN_CIPHER_SUITE_BIP_CMAC_256:
---		case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---		case WLAN_CIPHER_SUITE_BIP_GMAC_256:
-- 			if (!ieee80211_is_mgmt(hdr->frame_control))
-- 				tx->key = NULL;
-- 			break;
--@@ -1017,21 +1011,9 @@ ieee80211_tx_h_encrypt(struct ieee80211_
-- 	case WLAN_CIPHER_SUITE_TKIP:
-- 		return ieee80211_crypto_tkip_encrypt(tx);
-- 	case WLAN_CIPHER_SUITE_CCMP:
---		return ieee80211_crypto_ccmp_encrypt(
---			tx, IEEE80211_CCMP_MIC_LEN);
---	case WLAN_CIPHER_SUITE_CCMP_256:
---		return ieee80211_crypto_ccmp_encrypt(
---			tx, IEEE80211_CCMP_256_MIC_LEN);
--+		return ieee80211_crypto_ccmp_encrypt(tx);
-- 	case WLAN_CIPHER_SUITE_AES_CMAC:
-- 		return ieee80211_crypto_aes_cmac_encrypt(tx);
---	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
---		return ieee80211_crypto_aes_cmac_256_encrypt(tx);
---	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
---	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
---		return ieee80211_crypto_aes_gmac_encrypt(tx);
---	case WLAN_CIPHER_SUITE_GCMP:
---	case WLAN_CIPHER_SUITE_GCMP_256:
---		return ieee80211_crypto_gcmp_encrypt(tx);
-- 	default:
-- 		return ieee80211_crypto_hw_encrypt(tx);
-- 	}
----- a/net/mac80211/wpa.c
--+++ b/net/mac80211/wpa.c
--@@ -22,8 +22,6 @@
-- #include "tkip.h"
-- #include "aes_ccm.h"
-- #include "aes_cmac.h"
---#include "aes_gmac.h"
---#include "aes_gcm.h"
-- #include "wpa.h"
-- 
-- ieee80211_tx_result
--@@ -304,15 +302,22 @@ ieee80211_crypto_tkip_decrypt(struct iee
-- }
-- 
-- 
---static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
--+static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
--+				int encrypted)
-- {
-- 	__le16 mask_fc;
-- 	int a4_included, mgmt;
-- 	u8 qos_tid;
---	u16 len_a;
--+	u8 *b_0, *aad;
--+	u16 data_len, len_a;
-- 	unsigned int hdrlen;
-- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-- 
--+	memset(scratch, 0, 6 * AES_BLOCK_SIZE);
--+
--+	b_0 = scratch + 3 * AES_BLOCK_SIZE;
--+	aad = scratch + 4 * AES_BLOCK_SIZE;
--+
-- 	/*
-- 	 * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
-- 	 * Retry, PwrMgt, MoreData; set Protected
--@@ -334,21 +339,20 @@ static void ccmp_special_blocks(struct s
-- 	else
-- 		qos_tid = 0;
-- 
---	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
---	 * mode authentication are not allowed to collide, yet both are derived
---	 * from this vector b_0. We only set L := 1 here to indicate that the
---	 * data size can be represented in (L+1) bytes. The CCM layer will take
---	 * care of storing the data length in the top (L+1) bytes and setting
---	 * and clearing the other bits as is required to derive the two IVs.
---	 */
---	b_0[0] = 0x1;
--+	data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN;
--+	if (encrypted)
--+		data_len -= IEEE80211_CCMP_MIC_LEN;
-- 
--+	/* First block, b_0 */
--+	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
-- 	/* Nonce: Nonce Flags | A2 | PN
-- 	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-- 	 */
-- 	b_0[1] = qos_tid | (mgmt << 4);
-- 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
-- 	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
--+	/* l(m) */
--+	put_unaligned_be16(data_len, &b_0[14]);
-- 
-- 	/* AAD (extra authenticate-only data) / masked 802.11 header
-- 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
--@@ -395,8 +399,7 @@ static inline void ccmp_hdr2pn(u8 *pn, u
-- }
-- 
-- 
---static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
---			    unsigned int mic_len)
--+static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
-- {
-- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-- 	struct ieee80211_key *key = tx->key;
--@@ -405,8 +408,7 @@ static int ccmp_encrypt_skb(struct ieee8
-- 	u8 *pos;
-- 	u8 pn[6];
-- 	u64 pn64;
---	u8 aad[2 * AES_BLOCK_SIZE];
---	u8 b_0[AES_BLOCK_SIZE];
--+	u8 scratch[6 * AES_BLOCK_SIZE];
-- 
-- 	if (info->control.hw_key &&
-- 	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
--@@ -427,7 +429,7 @@ static int ccmp_encrypt_skb(struct ieee8
-- 	if (info->control.hw_key)
-- 		tail = 0;
-- 	else
---		tail = mic_len;
--+		tail = IEEE80211_CCMP_MIC_LEN;
-- 
-- 	if (WARN_ON(skb_tailroom(skb) < tail ||
-- 		    skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
--@@ -460,24 +462,23 @@ static int ccmp_encrypt_skb(struct ieee8
-- 		return 0;
-- 
-- 	pos += IEEE80211_CCMP_HDR_LEN;
---	ccmp_special_blocks(skb, pn, b_0, aad);
---	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
---				  skb_put(skb, mic_len), mic_len);
--+	ccmp_special_blocks(skb, pn, scratch, 0);
--+	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, pos, len,
--+				  pos, skb_put(skb, IEEE80211_CCMP_MIC_LEN));
-- 
-- 	return 0;
-- }
-- 
-- 
-- ieee80211_tx_result
---ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
---			      unsigned int mic_len)
--+ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
-- {
-- 	struct sk_buff *skb;
-- 
-- 	ieee80211_tx_set_protected(tx);
-- 
-- 	skb_queue_walk(&tx->skbs, skb) {
---		if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
--+		if (ccmp_encrypt_skb(tx, skb) < 0)
-- 			return TX_DROP;
-- 	}
-- 
--@@ -486,8 +487,7 @@ ieee80211_crypto_ccmp_encrypt(struct iee
-- 
-- 
-- ieee80211_rx_result
---ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
---			      unsigned int mic_len)
--+ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
-- {
-- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
-- 	int hdrlen;
--@@ -504,7 +504,8 @@ ieee80211_crypto_ccmp_decrypt(struct iee
-- 	    !ieee80211_is_robust_mgmt_frame(skb))
-- 		return RX_CONTINUE;
-- 
---	data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
--+	data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN -
--+		   IEEE80211_CCMP_MIC_LEN;
-- 	if (!rx->sta || data_len < 0)
-- 		return RX_DROP_UNUSABLE;
-- 
--@@ -526,23 +527,23 @@ ieee80211_crypto_ccmp_decrypt(struct iee
-- 	}
-- 
-- 	if (!(status->flag & RX_FLAG_DECRYPTED)) {
---		u8 aad[2 * AES_BLOCK_SIZE];
---		u8 b_0[AES_BLOCK_SIZE];
--+		u8 scratch[6 * AES_BLOCK_SIZE];
-- 		/* hardware didn't decrypt/verify MIC */
---		ccmp_special_blocks(skb, pn, b_0, aad);
--+		ccmp_special_blocks(skb, pn, scratch, 1);
-- 
-- 		if (ieee80211_aes_ccm_decrypt(
---			    key->u.ccmp.tfm, b_0, aad,
--+			    key->u.ccmp.tfm, scratch,
-- 			    skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
-- 			    data_len,
---			    skb->data + skb->len - mic_len, mic_len))
--+			    skb->data + skb->len - IEEE80211_CCMP_MIC_LEN,
--+			    skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN))
-- 			return RX_DROP_UNUSABLE;
-- 	}
-- 
-- 	memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
-- 
-- 	/* Remove CCMP header and MIC */
---	if (pskb_trim(skb, skb->len - mic_len))
--+	if (pskb_trim(skb, skb->len - IEEE80211_CCMP_MIC_LEN))
-- 		return RX_DROP_UNUSABLE;
-- 	memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
-- 	skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
--@@ -550,229 +551,6 @@ ieee80211_crypto_ccmp_decrypt(struct iee
-- 	return RX_CONTINUE;
-- }
-- 
---static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad)
---{
---	__le16 mask_fc;
---	u8 qos_tid;
---	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
---
---	memcpy(j_0, hdr->addr2, ETH_ALEN);
---	memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
---	j_0[13] = 0;
---	j_0[14] = 0;
---	j_0[AES_BLOCK_SIZE - 1] = 0x01;
---
---	/* AAD (extra authenticate-only data) / masked 802.11 header
---	 * FC | A1 | A2 | A3 | SC | [A4] | [QC]
---	 */
---	put_unaligned_be16(ieee80211_hdrlen(hdr->frame_control) - 2, &aad[0]);
---	/* Mask FC: zero subtype b4 b5 b6 (if not mgmt)
---	 * Retry, PwrMgt, MoreData; set Protected
---	 */
---	mask_fc = hdr->frame_control;
---	mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
---				IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
---	if (!ieee80211_is_mgmt(hdr->frame_control))
---		mask_fc &= ~cpu_to_le16(0x0070);
---	mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
---
---	put_unaligned(mask_fc, (__le16 *)&aad[2]);
---	memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
---
---	/* Mask Seq#, leave Frag# */
---	aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x0f;
---	aad[23] = 0;
---
---	if (ieee80211_is_data_qos(hdr->frame_control))
---		qos_tid = *ieee80211_get_qos_ctl(hdr) &
---			IEEE80211_QOS_CTL_TID_MASK;
---	else
---		qos_tid = 0;
---
---	if (ieee80211_has_a4(hdr->frame_control)) {
---		memcpy(&aad[24], hdr->addr4, ETH_ALEN);
---		aad[30] = qos_tid;
---		aad[31] = 0;
---	} else {
---		memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
---		aad[24] = qos_tid;
---	}
---}
---
---static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
---{
---	hdr[0] = pn[5];
---	hdr[1] = pn[4];
---	hdr[2] = 0;
---	hdr[3] = 0x20 | (key_id << 6);
---	hdr[4] = pn[3];
---	hdr[5] = pn[2];
---	hdr[6] = pn[1];
---	hdr[7] = pn[0];
---}
---
---static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
---{
---	pn[0] = hdr[7];
---	pn[1] = hdr[6];
---	pn[2] = hdr[5];
---	pn[3] = hdr[4];
---	pn[4] = hdr[1];
---	pn[5] = hdr[0];
---}
---
---static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
---{
---	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
---	struct ieee80211_key *key = tx->key;
---	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
---	int hdrlen, len, tail;
---	u8 *pos;
---	u8 pn[6];
---	u64 pn64;
---	u8 aad[2 * AES_BLOCK_SIZE];
---	u8 j_0[AES_BLOCK_SIZE];
---
---	if (info->control.hw_key &&
---	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
---	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
---	    !((info->control.hw_key->flags &
---	       IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
---	      ieee80211_is_mgmt(hdr->frame_control))) {
---		/* hwaccel has no need for preallocated room for GCMP
---		 * header or MIC fields
---		 */
---		return 0;
---	}
---
---	hdrlen = ieee80211_hdrlen(hdr->frame_control);
---	len = skb->len - hdrlen;
---
---	if (info->control.hw_key)
---		tail = 0;
---	else
---		tail = IEEE80211_GCMP_MIC_LEN;
---
---	if (WARN_ON(skb_tailroom(skb) < tail ||
---		    skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
---		return -1;
---
---	pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
---	memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
---	skb_set_network_header(skb, skb_network_offset(skb) +
---				    IEEE80211_GCMP_HDR_LEN);
---
---	/* the HW only needs room for the IV, but not the actual IV */
---	if (info->control.hw_key &&
---	    (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
---		return 0;
---
---	hdr = (struct ieee80211_hdr *)pos;
---	pos += hdrlen;
---
---	pn64 = atomic64_inc_return(&key->u.gcmp.tx_pn);
---
---	pn[5] = pn64;
---	pn[4] = pn64 >> 8;
---	pn[3] = pn64 >> 16;
---	pn[2] = pn64 >> 24;
---	pn[1] = pn64 >> 32;
---	pn[0] = pn64 >> 40;
---
---	gcmp_pn2hdr(pos, pn, key->conf.keyidx);
---
---	/* hwaccel - with software GCMP header */
---	if (info->control.hw_key)
---		return 0;
---
---	pos += IEEE80211_GCMP_HDR_LEN;
---	gcmp_special_blocks(skb, pn, j_0, aad);
---	ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
---				  skb_put(skb, IEEE80211_GCMP_MIC_LEN));
---
---	return 0;
---}
---
---ieee80211_tx_result
---ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
---{
---	struct sk_buff *skb;
---
---	ieee80211_tx_set_protected(tx);
---
---	skb_queue_walk(&tx->skbs, skb) {
---		if (gcmp_encrypt_skb(tx, skb) < 0)
---			return TX_DROP;
---	}
---
---	return TX_CONTINUE;
---}
---
---ieee80211_rx_result
---ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
---{
---	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
---	int hdrlen;
---	struct ieee80211_key *key = rx->key;
---	struct sk_buff *skb = rx->skb;
---	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
---	u8 pn[IEEE80211_GCMP_PN_LEN];
---	int data_len;
---	int queue;
---
---	hdrlen = ieee80211_hdrlen(hdr->frame_control);
---
---	if (!ieee80211_is_data(hdr->frame_control) &&
---	    !ieee80211_is_robust_mgmt_frame(skb))
---		return RX_CONTINUE;
---
---	data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN -
---		   IEEE80211_GCMP_MIC_LEN;
---	if (!rx->sta || data_len < 0)
---		return RX_DROP_UNUSABLE;
---
---	if (status->flag & RX_FLAG_DECRYPTED) {
---		if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
---			return RX_DROP_UNUSABLE;
---	} else {
---		if (skb_linearize(rx->skb))
---			return RX_DROP_UNUSABLE;
---	}
---
---	gcmp_hdr2pn(pn, skb->data + hdrlen);
---
---	queue = rx->security_idx;
---
---	if (memcmp(pn, key->u.gcmp.rx_pn[queue], IEEE80211_GCMP_PN_LEN) <= 0) {
---		key->u.gcmp.replays++;
---		return RX_DROP_UNUSABLE;
---	}
---
---	if (!(status->flag & RX_FLAG_DECRYPTED)) {
---		u8 aad[2 * AES_BLOCK_SIZE];
---		u8 j_0[AES_BLOCK_SIZE];
---		/* hardware didn't decrypt/verify MIC */
---		gcmp_special_blocks(skb, pn, j_0, aad);
---
---		if (ieee80211_aes_gcm_decrypt(
---			    key->u.gcmp.tfm, j_0, aad,
---			    skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
---			    data_len,
---			    skb->data + skb->len - IEEE80211_GCMP_MIC_LEN))
---			return RX_DROP_UNUSABLE;
---	}
---
---	memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
---
---	/* Remove GCMP header and MIC */
---	if (pskb_trim(skb, skb->len - IEEE80211_GCMP_MIC_LEN))
---		return RX_DROP_UNUSABLE;
---	memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
---	skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
---
---	return RX_CONTINUE;
---}
---
-- static ieee80211_tx_result
-- ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
-- 			    struct sk_buff *skb)
--@@ -956,48 +734,6 @@ ieee80211_crypto_aes_cmac_encrypt(struct
-- 	return TX_CONTINUE;
-- }
-- 
---ieee80211_tx_result
---ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
---{
---	struct sk_buff *skb;
---	struct ieee80211_tx_info *info;
---	struct ieee80211_key *key = tx->key;
---	struct ieee80211_mmie_16 *mmie;
---	u8 aad[20];
---	u64 pn64;
---
---	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
---		return TX_DROP;
---
---	skb = skb_peek(&tx->skbs);
---
---	info = IEEE80211_SKB_CB(skb);
---
---	if (info->control.hw_key)
---		return TX_CONTINUE;
---
---	if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
---		return TX_DROP;
---
---	mmie = (struct ieee80211_mmie_16 *)skb_put(skb, sizeof(*mmie));
---	mmie->element_id = WLAN_EID_MMIE;
---	mmie->length = sizeof(*mmie) - 2;
---	mmie->key_id = cpu_to_le16(key->conf.keyidx);
---
---	/* PN = PN + 1 */
---	pn64 = atomic64_inc_return(&key->u.aes_cmac.tx_pn);
---
---	bip_ipn_set64(mmie->sequence_number, pn64);
---
---	bip_aad(skb, aad);
---
---	/* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
---	 */
---	ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
---			       skb->data + 24, skb->len - 24, mmie->mic);
---
---	return TX_CONTINUE;
---}
-- 
-- ieee80211_rx_result
-- ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
--@@ -1045,160 +781,6 @@ ieee80211_crypto_aes_cmac_decrypt(struct
-- 
-- 	/* Remove MMIE */
-- 	skb_trim(skb, skb->len - sizeof(*mmie));
---
---	return RX_CONTINUE;
---}
---
---ieee80211_rx_result
---ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
---{
---	struct sk_buff *skb = rx->skb;
---	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
---	struct ieee80211_key *key = rx->key;
---	struct ieee80211_mmie_16 *mmie;
---	u8 aad[20], mic[16], ipn[6];
---	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
---
---	if (!ieee80211_is_mgmt(hdr->frame_control))
---		return RX_CONTINUE;
---
---	/* management frames are already linear */
---
---	if (skb->len < 24 + sizeof(*mmie))
---		return RX_DROP_UNUSABLE;
---
---	mmie = (struct ieee80211_mmie_16 *)
---		(skb->data + skb->len - sizeof(*mmie));
---	if (mmie->element_id != WLAN_EID_MMIE ||
---	    mmie->length != sizeof(*mmie) - 2)
---		return RX_DROP_UNUSABLE; /* Invalid MMIE */
---
---	bip_ipn_swap(ipn, mmie->sequence_number);
---
---	if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
---		key->u.aes_cmac.replays++;
---		return RX_DROP_UNUSABLE;
---	}
---
---	if (!(status->flag & RX_FLAG_DECRYPTED)) {
---		/* hardware didn't decrypt/verify MIC */
---		bip_aad(skb, aad);
---		ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
---				       skb->data + 24, skb->len - 24, mic);
---		if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
---			key->u.aes_cmac.icverrors++;
---			return RX_DROP_UNUSABLE;
---		}
---	}
---
---	memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
---
---	/* Remove MMIE */
---	skb_trim(skb, skb->len - sizeof(*mmie));
---
---	return RX_CONTINUE;
---}
---
---ieee80211_tx_result
---ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
---{
---	struct sk_buff *skb;
---	struct ieee80211_tx_info *info;
---	struct ieee80211_key *key = tx->key;
---	struct ieee80211_mmie_16 *mmie;
---	struct ieee80211_hdr *hdr;
---	u8 aad[20];
---	u64 pn64;
---	u8 nonce[12];
---
---	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
---		return TX_DROP;
---
---	skb = skb_peek(&tx->skbs);
---
---	info = IEEE80211_SKB_CB(skb);
---
---	if (info->control.hw_key)
---		return TX_CONTINUE;
---
---	if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
---		return TX_DROP;
---
---	mmie = (struct ieee80211_mmie_16 *)skb_put(skb, sizeof(*mmie));
---	mmie->element_id = WLAN_EID_MMIE;
---	mmie->length = sizeof(*mmie) - 2;
---	mmie->key_id = cpu_to_le16(key->conf.keyidx);
---
---	/* PN = PN + 1 */
---	pn64 = atomic64_inc_return(&key->u.aes_gmac.tx_pn);
---
---	bip_ipn_set64(mmie->sequence_number, pn64);
---
---	bip_aad(skb, aad);
---
---	hdr = (struct ieee80211_hdr *)skb->data;
---	memcpy(nonce, hdr->addr2, ETH_ALEN);
---	bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
---
---	/* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
---	if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
---			       skb->data + 24, skb->len - 24, mmie->mic) < 0)
---		return TX_DROP;
---
---	return TX_CONTINUE;
---}
---
---ieee80211_rx_result
---ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
---{
---	struct sk_buff *skb = rx->skb;
---	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
---	struct ieee80211_key *key = rx->key;
---	struct ieee80211_mmie_16 *mmie;
---	u8 aad[20], mic[16], ipn[6], nonce[12];
---	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
---
---	if (!ieee80211_is_mgmt(hdr->frame_control))
---		return RX_CONTINUE;
---
---	/* management frames are already linear */
---
---	if (skb->len < 24 + sizeof(*mmie))
---		return RX_DROP_UNUSABLE;
---
---	mmie = (struct ieee80211_mmie_16 *)
---		(skb->data + skb->len - sizeof(*mmie));
---	if (mmie->element_id != WLAN_EID_MMIE ||
---	    mmie->length != sizeof(*mmie) - 2)
---		return RX_DROP_UNUSABLE; /* Invalid MMIE */
---
---	bip_ipn_swap(ipn, mmie->sequence_number);
---
---	if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
---		key->u.aes_gmac.replays++;
---		return RX_DROP_UNUSABLE;
---	}
---
---	if (!(status->flag & RX_FLAG_DECRYPTED)) {
---		/* hardware didn't decrypt/verify MIC */
---		bip_aad(skb, aad);
---
---		memcpy(nonce, hdr->addr2, ETH_ALEN);
---		memcpy(nonce + ETH_ALEN, ipn, 6);
---
---		if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
---				       skb->data + 24, skb->len - 24,
---				       mic) < 0 ||
---		    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
---			key->u.aes_gmac.icverrors++;
---			return RX_DROP_UNUSABLE;
---		}
---	}
---
---	memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
---
---	/* Remove MMIE */
---	skb_trim(skb, skb->len - sizeof(*mmie));
-- 
-- 	return RX_CONTINUE;
-- }
----- a/net/mac80211/wpa.h
--+++ b/net/mac80211/wpa.h
--@@ -24,32 +24,17 @@ ieee80211_rx_result
-- ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx);
-- 
-- ieee80211_tx_result
---ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
---			      unsigned int mic_len);
--+ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx);
-- ieee80211_rx_result
---ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
---			      unsigned int mic_len);
--+ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx);
-- 
-- ieee80211_tx_result
-- ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
---ieee80211_tx_result
---ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx);
-- ieee80211_rx_result
-- ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
---ieee80211_rx_result
---ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx);
---ieee80211_tx_result
---ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx);
---ieee80211_rx_result
---ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx);
-- ieee80211_tx_result
-- ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx);
-- ieee80211_rx_result
-- ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx);
-- 
---ieee80211_tx_result
---ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx);
---ieee80211_rx_result
---ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx);
---
-- #endif /* WPA_H */
-diff --git a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
-index 41a3c4f..d1d9fbd 100644
---- a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
-+++ b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
-@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
- 
- --- a/net/mac80211/cfg.c
- +++ b/net/mac80211/cfg.c
--@@ -856,7 +856,6 @@ static int ieee80211_stop_ap(struct wiph
-+@@ -846,7 +846,6 @@ static int ieee80211_stop_ap(struct wiph
-  	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
-  
-  	__sta_info_flush(sdata, true);
-diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
-index de79bd2..2855a88 100644
---- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
-+++ b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
-@@ -1,6 +1,6 @@
- --- a/net/mac80211/main.c
- +++ b/net/mac80211/main.c
--@@ -287,7 +287,7 @@ void ieee80211_restart_hw(struct ieee802
-+@@ -291,7 +291,7 @@ void ieee80211_restart_hw(struct ieee802
-  }
-  EXPORT_SYMBOL(ieee80211_restart_hw);
-  
-@@ -9,7 +9,7 @@
-  static int ieee80211_ifa_changed(struct notifier_block *nb,
-  				 unsigned long data, void *arg)
-  {
--@@ -346,7 +346,7 @@ static int ieee80211_ifa_changed(struct
-+@@ -350,7 +350,7 @@ static int ieee80211_ifa_changed(struct
-  }
-  #endif
-  
-@@ -18,9 +18,9 @@
-  static int ieee80211_ifa6_changed(struct notifier_block *nb,
-  				  unsigned long data, void *arg)
-  {
--@@ -1057,14 +1057,14 @@ int ieee80211_register_hw(struct ieee802
-- 	if (result)
-- 		goto fail_pm_qos;
-+@@ -1087,14 +1087,14 @@ int ieee80211_register_hw(struct ieee802
-+ 
-+ 	rtnl_unlock();
-  
- -#ifdef CONFIG_INET
- +#ifdef __disabled__CONFIG_INET
-@@ -35,7 +35,7 @@
-  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
-  	result = register_inet6addr_notifier(&local->ifa6_notifier);
-  	if (result)
--@@ -1073,13 +1073,13 @@ int ieee80211_register_hw(struct ieee802
-+@@ -1103,13 +1103,13 @@ int ieee80211_register_hw(struct ieee802
-  
-  	return 0;
-  
-@@ -50,12 +50,12 @@
- -#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
- +#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
-   fail_ifa:
-- 	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
-- 			       &local->network_latency_notifier);
--@@ -1124,10 +1124,10 @@ void ieee80211_unregister_hw(struct ieee
-+ #endif
-+ 	rtnl_lock();
-+@@ -1137,10 +1137,10 @@ void ieee80211_unregister_hw(struct ieee
-+ 	tasklet_kill(&local->tx_pending_tasklet);
-+ 	tasklet_kill(&local->tasklet);
-  
-- 	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
-- 			       &local->network_latency_notifier);
- -#ifdef CONFIG_INET
- +#ifdef __disabled__CONFIG_INET
-  	unregister_inetaddr_notifier(&local->ifa_notifier);
-diff --git a/package/kernel/mac80211/patches/210-ap_scan.patch b/package/kernel/mac80211/patches/210-ap_scan.patch
-index 47dcec3..a99cbd2 100644
---- a/package/kernel/mac80211/patches/210-ap_scan.patch
-+++ b/package/kernel/mac80211/patches/210-ap_scan.patch
-@@ -1,6 +1,6 @@
- --- a/net/mac80211/cfg.c
- +++ b/net/mac80211/cfg.c
--@@ -1963,7 +1963,7 @@ static int ieee80211_scan(struct wiphy *
-+@@ -1999,7 +1999,7 @@ static int ieee80211_scan(struct wiphy *
-  		 * the  frames sent while scanning on other channel will be
-  		 * lost)
-  		 */
-diff --git a/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch
-new file mode 100644
-index 0000000..bddb15a
---- /dev/null
-+++ b/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch
-@@ -0,0 +1,31 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Sun, 7 Jun 2015 13:53:35 +0200
-+Subject: [PATCH] ath9k: force rx_clear when disabling rx
-+
-+This makes stopping Rx more reliable and should reduce the frequency of
-+Rx related DMA stop warnings
-+
-+Cc: stable@vger.kernel.org
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/mac.c
-++++ b/drivers/net/wireless/ath/ath9k/mac.c
-+@@ -677,13 +677,15 @@ void ath9k_hw_startpcureceive(struct ath
-+ 
-+ 	ath9k_ani_reset(ah, is_scanning);
-+ 
-+-	REG_CLR_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
-++	REG_CLR_BIT(ah, AR_DIAG_SW,
-++		    AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT | AR_DIAG_FORCE_RX_CLEAR);
-+ }
-+ EXPORT_SYMBOL(ath9k_hw_startpcureceive);
-+ 
-+ void ath9k_hw_abortpcurecv(struct ath_hw *ah)
-+ {
-+-	REG_SET_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_ABORT | AR_DIAG_RX_DIS);
-++	REG_SET_BIT(ah, AR_DIAG_SW,
-++		    AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT | AR_DIAG_FORCE_RX_CLEAR);
-+ 
-+ 	ath9k_hw_disable_mib_counters(ah);
-+ }
-diff --git a/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch b/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
-deleted file mode 100644
-index 237121b..0000000
---- a/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
-+++ /dev/null
-@@ -1,882 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Tue, 18 Nov 2014 23:58:51 +0100
--Subject: [PATCH] mac80211: add an intermediate software queue implementation
--
--This allows drivers to request per-vif and per-sta-tid queues from which
--they can pull frames. This makes it easier to keep the hardware queues
--short, and to improve fairness between clients and vifs.
--
--The task of scheduling packet transmission is left up to the driver -
--queueing is controlled by mac80211. Drivers can only dequeue packets by
--calling ieee80211_tx_dequeue. This makes it possible to add active queue
--management later without changing drivers using this code.
--
--This can also be used as a starting point to implement A-MSDU
--aggregation in a way that does not add artificially induced latency.
--
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/include/net/mac80211.h
--+++ b/include/net/mac80211.h
--@@ -84,6 +84,39 @@
--  *
--  */
-- 
--+/**
--+ * DOC: mac80211 software tx queueing
--+ *
--+ * mac80211 provides an optional intermediate queueing implementation designed
--+ * to allow the driver to keep hardware queues short and provide some fairness
--+ * between different stations/interfaces.
--+ * In this model, the driver pulls data frames from the mac80211 queue instead
--+ * of letting mac80211 push them via drv_tx().
--+ * Other frames (e.g. control or management) are still pushed using drv_tx().
--+ *
--+ * Drivers indicate that they use this model by implementing the .wake_tx_queue
--+ * driver operation.
--+ *
--+ * Intermediate queues (struct ieee80211_txq) are kept per-sta per-tid, with a
--+ * single per-vif queue for multicast data frames.
--+ *
--+ * The driver is expected to initialize its private per-queue data for stations
--+ * and interfaces in the .add_interface and .sta_add ops.
--+ *
--+ * The driver can't access the queue directly. To dequeue a frame, it calls
--+ * ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a queue, it
--+ * calls the .wake_tx_queue driver op.
--+ *
--+ * For AP powersave TIM handling, the driver only needs to indicate if it has
--+ * buffered packets in the driver specific data structures by calling
--+ * ieee80211_sta_set_buffered(). For frames buffered in the ieee80211_txq
--+ * struct, mac80211 sets the appropriate TIM PVB bits and calls
--+ * .release_buffered_frames().
--+ * In that callback the driver is therefore expected to release its own
--+ * buffered frames and afterwards also frames from the ieee80211_txq (obtained
--+ * via the usual ieee80211_tx_dequeue).
--+ */
--+
-- struct device;
-- 
-- /**
--@@ -1246,6 +1279,7 @@ enum ieee80211_vif_flags {
--  *	monitor interface (if that is requested.)
--  * @drv_priv: data area for driver use, will always be aligned to
--  *	sizeof(void *).
--+ * @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
--  */
-- struct ieee80211_vif {
-- 	enum nl80211_iftype type;
--@@ -1257,6 +1291,8 @@ struct ieee80211_vif {
-- 	u8 cab_queue;
-- 	u8 hw_queue[IEEE80211_NUM_ACS];
-- 
--+	struct ieee80211_txq *txq;
--+
-- 	struct ieee80211_chanctx_conf __rcu *chanctx_conf;
-- 
-- 	u32 driver_flags;
--@@ -1501,6 +1537,7 @@ struct ieee80211_sta_rates {
--  * @tdls_initiator: indicates the STA is an initiator of the TDLS link. Only
--  *	valid if the STA is a TDLS peer in the first place.
--  * @mfp: indicates whether the STA uses management frame protection or not.
--+ * @txq: per-TID data TX queues (if driver uses the TXQ abstraction)
--  */
-- struct ieee80211_sta {
-- 	u32 supp_rates[IEEE80211_NUM_BANDS];
--@@ -1519,6 +1556,8 @@ struct ieee80211_sta {
-- 	bool tdls_initiator;
-- 	bool mfp;
-- 
--+	struct ieee80211_txq *txq[IEEE80211_NUM_TIDS];
--+
-- 	/* must be last */
-- 	u8 drv_priv[0] __aligned(sizeof(void *));
-- };
--@@ -1547,6 +1586,27 @@ struct ieee80211_tx_control {
-- };
-- 
-- /**
--+ * struct ieee80211_txq - Software intermediate tx queue
--+ *
--+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
--+ * @sta: station table entry, %NULL for per-vif queue
--+ * @tid: the TID for this queue (unused for per-vif queue)
--+ * @ac: the AC for this queue
--+ *
--+ * The driver can obtain packets from this queue by calling
--+ * ieee80211_tx_dequeue().
--+ */
--+struct ieee80211_txq {
--+	struct ieee80211_vif *vif;
--+	struct ieee80211_sta *sta;
--+	u8 tid;
--+	u8 ac;
--+
--+	/* must be last */
--+	u8 drv_priv[0] __aligned(sizeof(void *));
--+};
--+
--+/**
--  * enum ieee80211_hw_flags - hardware flags
--  *
--  * These flags are used to indicate hardware capabilities to
--@@ -1770,6 +1830,8 @@ enum ieee80211_hw_flags {
--  *	within &struct ieee80211_sta.
--  * @chanctx_data_size: size (in bytes) of the drv_priv data area
--  *	within &struct ieee80211_chanctx_conf.
--+ * @txq_data_size: size (in bytes) of the drv_priv data area
--+ *	within @struct ieee80211_txq.
--  *
--  * @max_rates: maximum number of alternate rate retry stages the hw
--  *	can handle.
--@@ -1818,6 +1880,9 @@ enum ieee80211_hw_flags {
--  * @n_cipher_schemes: a size of an array of cipher schemes definitions.
--  * @cipher_schemes: a pointer to an array of cipher scheme definitions
--  *	supported by HW.
--+ *
--+ * @txq_ac_max_pending: maximum number of frames per AC pending in all txq
--+ *	entries for a vif.
--  */
-- struct ieee80211_hw {
-- 	struct ieee80211_conf conf;
--@@ -1830,6 +1895,7 @@ struct ieee80211_hw {
-- 	int vif_data_size;
-- 	int sta_data_size;
-- 	int chanctx_data_size;
--+	int txq_data_size;
-- 	u16 queues;
-- 	u16 max_listen_interval;
-- 	s8 max_signal;
--@@ -1846,6 +1912,7 @@ struct ieee80211_hw {
-- 	u8 uapsd_max_sp_len;
-- 	u8 n_cipher_schemes;
-- 	const struct ieee80211_cipher_scheme *cipher_schemes;
--+	int txq_ac_max_pending;
-- };
-- 
-- /**
--@@ -3007,6 +3074,8 @@ enum ieee80211_reconfig_type {
--  *	response template is provided, together with the location of the
--  *	switch-timing IE within the template. The skb can only be used within
--  *	the function call.
--+ *
--+ * @wake_tx_queue: Called when new packets have been added to the queue.
--  */
-- struct ieee80211_ops {
-- 	void (*tx)(struct ieee80211_hw *hw,
--@@ -3238,6 +3307,9 @@ struct ieee80211_ops {
-- 	void (*tdls_recv_channel_switch)(struct ieee80211_hw *hw,
-- 					 struct ieee80211_vif *vif,
-- 					 struct ieee80211_tdls_ch_sw_params *params);
--+
--+	void (*wake_tx_queue)(struct ieee80211_hw *hw,
--+			      struct ieee80211_txq *txq);
-- };
-- 
-- /**
--@@ -5249,4 +5321,15 @@ void ieee80211_unreserve_tid(struct ieee
--  */
-- size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
-- 			  const u8 *ids, int n_ids, size_t offset);
--+
--+/**
--+ * ieee80211_tx_dequeue - dequeue a packet from a software tx queue
--+ *
--+ * @hw: pointer as obtained from ieee80211_alloc_hw()
--+ * @txq: pointer obtained from station or virtual interface
--+ *
--+ * Returns the skb if successful, %NULL if no frame was available.
--+ */
--+struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
--+				     struct ieee80211_txq *txq);
-- #endif /* MAC80211_H */
----- a/net/mac80211/driver-ops.h
--+++ b/net/mac80211/driver-ops.h
--@@ -1367,4 +1367,16 @@ drv_tdls_recv_channel_switch(struct ieee
-- 	trace_drv_return_void(local);
-- }
-- 
--+static inline void drv_wake_tx_queue(struct ieee80211_local *local,
--+				     struct txq_info *txq)
--+{
--+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
--+
--+	if (!check_sdata_in_driver(sdata))
--+		return;
--+
--+	trace_drv_wake_tx_queue(local, sdata, txq);
--+	local->ops->wake_tx_queue(&local->hw, &txq->txq);
--+}
--+
-- #endif /* __MAC80211_DRIVER_OPS */
----- a/net/mac80211/ieee80211_i.h
--+++ b/net/mac80211/ieee80211_i.h
--@@ -809,6 +809,19 @@ struct mac80211_qos_map {
-- 	struct rcu_head rcu_head;
-- };
-- 
--+enum txq_info_flags {
--+	IEEE80211_TXQ_STOP,
--+	IEEE80211_TXQ_AMPDU,
--+};
--+
--+struct txq_info {
--+	struct sk_buff_head queue;
--+	unsigned long flags;
--+
--+	/* keep last! */
--+	struct ieee80211_txq txq;
--+};
--+
-- struct ieee80211_sub_if_data {
-- 	struct list_head list;
-- 
--@@ -853,6 +866,7 @@ struct ieee80211_sub_if_data {
-- 	bool control_port_no_encrypt;
-- 	int encrypt_headroom;
-- 
--+	atomic_t txqs_len[IEEE80211_NUM_ACS];
-- 	struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
-- 	struct mac80211_qos_map __rcu *qos_map;
-- 
--@@ -1453,6 +1467,10 @@ static inline struct ieee80211_local *hw
-- 	return container_of(hw, struct ieee80211_local, hw);
-- }
-- 
--+static inline struct txq_info *to_txq_info(struct ieee80211_txq *txq)
--+{
--+	return container_of(txq, struct txq_info, txq);
--+}
-- 
-- static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
-- {
--@@ -1905,6 +1923,9 @@ static inline bool ieee80211_can_run_wor
-- 	return true;
-- }
-- 
--+void ieee80211_init_tx_queue(struct ieee80211_sub_if_data *sdata,
--+			     struct sta_info *sta,
--+			     struct txq_info *txq, int tid);
-- void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
-- 			 u16 transaction, u16 auth_alg, u16 status,
-- 			 const u8 *extra, size_t extra_len, const u8 *bssid,
----- a/net/mac80211/iface.c
--+++ b/net/mac80211/iface.c
--@@ -969,6 +969,13 @@ static void ieee80211_do_stop(struct iee
-- 	}
-- 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-- 
--+	if (sdata->vif.txq) {
--+		struct txq_info *txqi = to_txq_info(sdata->vif.txq);
--+
--+		ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
--+		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
--+	}
--+
-- 	if (local->open_count == 0)
-- 		ieee80211_clear_tx_pending(local);
-- 
--@@ -1674,6 +1681,7 @@ int ieee80211_if_add(struct ieee80211_lo
-- {
-- 	struct net_device *ndev = NULL;
-- 	struct ieee80211_sub_if_data *sdata = NULL;
--+	struct txq_info *txqi;
-- 	int ret, i;
-- 	int txqs = 1;
-- 
--@@ -1693,10 +1701,18 @@ int ieee80211_if_add(struct ieee80211_lo
-- 		ieee80211_assign_perm_addr(local, wdev->address, type);
-- 		memcpy(sdata->vif.addr, wdev->address, ETH_ALEN);
-- 	} else {
--+		int size = ALIGN(sizeof(*sdata) + local->hw.vif_data_size,
--+				 sizeof(void *));
--+		int txq_size = 0;
--+
--+		if (local->ops->wake_tx_queue)
--+			txq_size += sizeof(struct txq_info) +
--+				    local->hw.txq_data_size;
--+
-- 		if (local->hw.queues >= IEEE80211_NUM_ACS)
-- 			txqs = IEEE80211_NUM_ACS;
-- 
---		ndev = alloc_netdev_mqs(sizeof(*sdata) + local->hw.vif_data_size,
--+		ndev = alloc_netdev_mqs(size + txq_size,
-- 					name, NET_NAME_UNKNOWN,
-- 					ieee80211_if_setup, txqs, 1);
-- 		if (!ndev)
--@@ -1731,6 +1747,11 @@ int ieee80211_if_add(struct ieee80211_lo
-- 		memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
-- 		memcpy(sdata->name, ndev->name, IFNAMSIZ);
-- 
--+		if (txq_size) {
--+			txqi = netdev_priv(ndev) + size;
--+			ieee80211_init_tx_queue(sdata, NULL, txqi, 0);
--+		}
--+
-- 		sdata->dev = ndev;
-- 	}
-- 
----- a/net/mac80211/main.c
--+++ b/net/mac80211/main.c
--@@ -1019,6 +1019,9 @@ int ieee80211_register_hw(struct ieee802
-- 
-- 	local->dynamic_ps_forced_timeout = -1;
-- 
--+	if (!local->hw.txq_ac_max_pending)
--+		local->hw.txq_ac_max_pending = 64;
--+
-- 	result = ieee80211_wep_init(local);
-- 	if (result < 0)
-- 		wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
----- a/net/mac80211/sta_info.c
--+++ b/net/mac80211/sta_info.c
--@@ -118,6 +118,16 @@ static void __cleanup_single_sta(struct
-- 		atomic_dec(&ps->num_sta_ps);
-- 	}
-- 
--+	if (sta->sta.txq[0]) {
--+		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
--+			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
--+			int n = skb_queue_len(&txqi->queue);
--+
--+			ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
--+			atomic_sub(n, &sdata->txqs_len[txqi->txq.ac]);
--+		}
--+	}
--+
-- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-- 		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
-- 		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
--@@ -234,6 +244,8 @@ void sta_info_free(struct ieee80211_loca
-- 
-- 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
-- 
--+	if (sta->sta.txq[0])
--+		kfree(to_txq_info(sta->sta.txq[0]));
-- 	kfree(rcu_dereference_raw(sta->sta.rates));
-- 	kfree(sta);
-- }
--@@ -285,11 +297,12 @@ struct sta_info *sta_info_alloc(struct i
-- 				const u8 *addr, gfp_t gfp)
-- {
-- 	struct ieee80211_local *local = sdata->local;
--+	struct ieee80211_hw *hw = &local->hw;
-- 	struct sta_info *sta;
-- 	struct timespec uptime;
-- 	int i;
-- 
---	sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
--+	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
-- 	if (!sta)
-- 		return NULL;
-- 
--@@ -321,11 +334,25 @@ struct sta_info *sta_info_alloc(struct i
-- 	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
-- 		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
-- 
---	if (sta_prepare_rate_control(local, sta, gfp)) {
---		kfree(sta);
---		return NULL;
--+	if (local->ops->wake_tx_queue) {
--+		void *txq_data;
--+		int size = sizeof(struct txq_info) +
--+			   ALIGN(hw->txq_data_size, sizeof(void *));
--+
--+		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
--+		if (!txq_data)
--+			goto free;
--+
--+		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
--+			struct txq_info *txq = txq_data + i * size;
--+
--+			ieee80211_init_tx_queue(sdata, sta, txq, i);
--+		}
-- 	}
-- 
--+	if (sta_prepare_rate_control(local, sta, gfp))
--+		goto free_txq;
--+
-- 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
-- 		/*
-- 		 * timer_to_tid must be initialized with identity mapping
--@@ -346,7 +373,7 @@ struct sta_info *sta_info_alloc(struct i
-- 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
-- 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
-- 		struct ieee80211_supported_band *sband =
---			local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
--+			hw->wiphy->bands[ieee80211_get_sdata_band(sdata)];
-- 		u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
-- 				IEEE80211_HT_CAP_SM_PS_SHIFT;
-- 		/*
--@@ -371,6 +398,13 @@ struct sta_info *sta_info_alloc(struct i
-- 	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
-- 
-- 	return sta;
--+
--+free_txq:
--+	if (sta->sta.txq[0])
--+		kfree(to_txq_info(sta->sta.txq[0]));
--+free:
--+	kfree(sta);
--+	return NULL;
-- }
-- 
-- static int sta_info_insert_check(struct sta_info *sta)
--@@ -640,6 +674,8 @@ static void __sta_info_recalc_tim(struct
-- 
-- 		indicate_tim |=
-- 			sta->driver_buffered_tids & tids;
--+		indicate_tim |=
--+			sta->txq_buffered_tids & tids;
-- 	}
-- 
--  done:
--@@ -1071,7 +1107,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
-- 	struct ieee80211_sub_if_data *sdata = sta->sdata;
-- 	struct ieee80211_local *local = sdata->local;
-- 	struct sk_buff_head pending;
---	int filtered = 0, buffered = 0, ac;
--+	int filtered = 0, buffered = 0, ac, i;
-- 	unsigned long flags;
-- 	struct ps_data *ps;
-- 
--@@ -1090,10 +1126,22 @@ void ieee80211_sta_ps_deliver_wakeup(str
-- 
-- 	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
-- 	sta->driver_buffered_tids = 0;
--+	sta->txq_buffered_tids = 0;
-- 
-- 	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
-- 		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
-- 
--+	if (sta->sta.txq[0]) {
--+		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
--+			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
--+
--+			if (!skb_queue_len(&txqi->queue))
--+				continue;
--+
--+			drv_wake_tx_queue(local, txqi);
--+		}
--+	}
--+
-- 	skb_queue_head_init(&pending);
-- 
-- 	/* sync with ieee80211_tx_h_unicast_ps_buf */
--@@ -1275,8 +1323,10 @@ ieee80211_sta_ps_deliver_response(struct
-- 		/* if we already have frames from software, then we can't also
-- 		 * release from hardware queues
-- 		 */
---		if (skb_queue_empty(&frames))
--+		if (skb_queue_empty(&frames)) {
-- 			driver_release_tids |= sta->driver_buffered_tids & tids;
--+			driver_release_tids |= sta->txq_buffered_tids & tids;
--+		}
-- 
-- 		if (driver_release_tids) {
-- 			/* If the driver has data on more than one TID then
--@@ -1447,6 +1497,9 @@ ieee80211_sta_ps_deliver_response(struct
-- 
-- 		sta_info_recalc_tim(sta);
-- 	} else {
--+		unsigned long tids = sta->txq_buffered_tids & driver_release_tids;
--+		int tid;
--+
-- 		/*
-- 		 * We need to release a frame that is buffered somewhere in the
-- 		 * driver ... it'll have to handle that.
--@@ -1466,8 +1519,22 @@ ieee80211_sta_ps_deliver_response(struct
-- 		 * that the TID(s) became empty before returning here from the
-- 		 * release function.
-- 		 * Either way, however, when the driver tells us that the TID(s)
---		 * became empty we'll do the TIM recalculation.
--+		 * became empty or we find that a txq became empty, we'll do the
--+		 * TIM recalculation.
-- 		 */
--+
--+		if (!sta->sta.txq[0])
--+			return;
--+
--+		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
--+			struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
--+
--+			if (!(tids & BIT(tid)) || skb_queue_len(&txqi->queue))
--+				continue;
--+
--+			sta_info_recalc_tim(sta);
--+			break;
--+		}
-- 	}
-- }
-- 
----- a/net/mac80211/sta_info.h
--+++ b/net/mac80211/sta_info.h
--@@ -274,6 +274,7 @@ struct sta_ampdu_mlme {
--  *	entered power saving state, these are also delivered to
--  *	the station when it leaves powersave or polls for frames
--  * @driver_buffered_tids: bitmap of TIDs the driver has data buffered on
--+ * @txq_buffered_tids: bitmap of TIDs that mac80211 has txq data buffered on
--  * @rx_packets: Number of MSDUs received from this STA
--  * @rx_bytes: Number of bytes received from this STA
--  * @last_rx: time (in jiffies) when last frame was received from this STA
--@@ -368,6 +369,7 @@ struct sta_info {
-- 	struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
-- 	struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
-- 	unsigned long driver_buffered_tids;
--+	unsigned long txq_buffered_tids;
-- 
-- 	/* Updated from RX path only, no locking requirements */
-- 	unsigned long rx_packets;
----- a/net/mac80211/trace.h
--+++ b/net/mac80211/trace.h
--@@ -2312,6 +2312,37 @@ TRACE_EVENT(drv_tdls_recv_channel_switch
-- 	)
-- );
-- 
--+TRACE_EVENT(drv_wake_tx_queue,
--+	TP_PROTO(struct ieee80211_local *local,
--+		 struct ieee80211_sub_if_data *sdata,
--+		 struct txq_info *txq),
--+
--+	TP_ARGS(local, sdata, txq),
--+
--+	TP_STRUCT__entry(
--+		LOCAL_ENTRY
--+		VIF_ENTRY
--+		STA_ENTRY
--+		__field(u8, ac)
--+		__field(u8, tid)
--+	),
--+
--+	TP_fast_assign(
--+		struct ieee80211_sta *sta = txq->txq.sta;
--+
--+		LOCAL_ASSIGN;
--+		VIF_ASSIGN;
--+		STA_ASSIGN;
--+		__entry->ac = txq->txq.ac;
--+		__entry->tid = txq->txq.tid;
--+	),
--+
--+	TP_printk(
--+		LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ac:%d tid:%d",
--+		LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ac, __entry->tid
--+	)
--+);
--+
-- #ifdef CPTCFG_MAC80211_MESSAGE_TRACING
-- #undef TRACE_SYSTEM
-- #define TRACE_SYSTEM mac80211_msg
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -776,12 +776,22 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
-- 	return TX_CONTINUE;
-- }
-- 
--+static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
--+{
--+	u16 *seq = &sta->tid_seq[tid];
--+	__le16 ret = cpu_to_le16(*seq);
--+
--+	/* Increase the sequence number. */
--+	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
--+
--+	return ret;
--+}
--+
-- static ieee80211_tx_result debug_noinline
-- ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
-- {
-- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
---	u16 *seq;
-- 	u8 *qc;
-- 	int tid;
-- 
--@@ -832,13 +842,10 @@ ieee80211_tx_h_sequence(struct ieee80211
-- 
-- 	qc = ieee80211_get_qos_ctl(hdr);
-- 	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
---	seq = &tx->sta->tid_seq[tid];
-- 	tx->sta->tx_msdu[tid]++;
-- 
---	hdr->seq_ctrl = cpu_to_le16(*seq);
---
---	/* Increase the sequence number. */
---	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
--+	if (!tx->sta->sta.txq[0])
--+		hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
-- 
-- 	return TX_CONTINUE;
-- }
--@@ -1067,7 +1074,7 @@ static bool ieee80211_tx_prep_agg(struct
-- 		 * nothing -- this aggregation session is being started
-- 		 * but that might still fail with the driver
-- 		 */
---	} else {
--+	} else if (!tx->sta->sta.txq[tid]) {
-- 		spin_lock(&tx->sta->lock);
-- 		/*
-- 		 * Need to re-check now, because we may get here
--@@ -1201,13 +1208,102 @@ ieee80211_tx_prepare(struct ieee80211_su
-- 	return TX_CONTINUE;
-- }
-- 
--+static void ieee80211_drv_tx(struct ieee80211_local *local,
--+			     struct ieee80211_vif *vif,
--+			     struct ieee80211_sta *pubsta,
--+			     struct sk_buff *skb)
--+{
--+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
--+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
--+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--+	struct ieee80211_tx_control control = {
--+		.sta = pubsta,
--+	};
--+	struct ieee80211_txq *txq = NULL;
--+	struct txq_info *txqi;
--+	u8 ac;
--+
--+	if (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE)
--+		goto tx_normal;
--+
--+	if (!ieee80211_is_data(hdr->frame_control))
--+		goto tx_normal;
--+
--+	if (pubsta) {
--+		u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
--+
--+		txq = pubsta->txq[tid];
--+	} else if (vif) {
--+		txq = vif->txq;
--+	}
--+
--+	if (!txq)
--+		goto tx_normal;
--+
--+	ac = txq->ac;
--+	txqi = to_txq_info(txq);
--+	atomic_inc(&sdata->txqs_len[ac]);
--+	if (atomic_read(&sdata->txqs_len[ac]) >= local->hw.txq_ac_max_pending)
--+		netif_stop_subqueue(sdata->dev, ac);
--+
--+	skb_queue_tail(&txqi->queue, skb);
--+	drv_wake_tx_queue(local, txqi);
--+
--+	return;
--+
--+tx_normal:
--+	drv_tx(local, &control, skb);
--+}
--+
--+struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
--+				     struct ieee80211_txq *txq)
--+{
--+	struct ieee80211_local *local = hw_to_local(hw);
--+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
--+	struct txq_info *txqi = container_of(txq, struct txq_info, txq);
--+	struct ieee80211_hdr *hdr;
--+	struct sk_buff *skb = NULL;
--+	u8 ac = txq->ac;
--+
--+	spin_lock_bh(&txqi->queue.lock);
--+
--+	if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
--+		goto out;
--+
--+	skb = __skb_dequeue(&txqi->queue);
--+	if (!skb)
--+		goto out;
--+
--+	atomic_dec(&sdata->txqs_len[ac]);
--+	if (__netif_subqueue_stopped(sdata->dev, ac))
--+		ieee80211_propagate_queue_wake(local, sdata->vif.hw_queue[ac]);
--+
--+	hdr = (struct ieee80211_hdr *)skb->data;
--+	if (txq->sta && ieee80211_is_data_qos(hdr->frame_control)) {
--+		struct sta_info *sta = container_of(txq->sta, struct sta_info,
--+						    sta);
--+		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--+
--+		hdr->seq_ctrl = ieee80211_tx_next_seq(sta, txq->tid);
--+		if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
--+			info->flags |= IEEE80211_TX_CTL_AMPDU;
--+		else
--+			info->flags &= ~IEEE80211_TX_CTL_AMPDU;
--+	}
--+
--+out:
--+	spin_unlock_bh(&txqi->queue.lock);
--+
--+	return skb;
--+}
--+EXPORT_SYMBOL(ieee80211_tx_dequeue);
--+
-- static bool ieee80211_tx_frags(struct ieee80211_local *local,
-- 			       struct ieee80211_vif *vif,
-- 			       struct ieee80211_sta *sta,
-- 			       struct sk_buff_head *skbs,
-- 			       bool txpending)
-- {
---	struct ieee80211_tx_control control;
-- 	struct sk_buff *skb, *tmp;
-- 	unsigned long flags;
-- 
--@@ -1265,10 +1361,9 @@ static bool ieee80211_tx_frags(struct ie
-- 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-- 
-- 		info->control.vif = vif;
---		control.sta = sta;
-- 
-- 		__skb_unlink(skb, skbs);
---		drv_tx(local, &control, skb);
--+		ieee80211_drv_tx(local, vif, sta, skb);
-- 	}
-- 
-- 	return true;
----- a/net/mac80211/util.c
--+++ b/net/mac80211/util.c
--@@ -308,6 +308,11 @@ void ieee80211_propagate_queue_wake(stru
-- 		for (ac = 0; ac < n_acs; ac++) {
-- 			int ac_queue = sdata->vif.hw_queue[ac];
-- 
--+			if (local->ops->wake_tx_queue &&
--+			    (atomic_read(&sdata->txqs_len[ac]) >
--+			     local->hw.txq_ac_max_pending))
--+				continue;
--+
-- 			if (ac_queue == queue ||
-- 			    (sdata->vif.cab_queue == queue &&
-- 			     local->queue_stop_reasons[ac_queue] == 0 &&
--@@ -3307,3 +3312,20 @@ u8 *ieee80211_add_wmm_info_ie(u8 *buf, u
-- 
-- 	return buf;
-- }
--+
--+void ieee80211_init_tx_queue(struct ieee80211_sub_if_data *sdata,
--+			     struct sta_info *sta,
--+			     struct txq_info *txqi, int tid)
--+{
--+	skb_queue_head_init(&txqi->queue);
--+	txqi->txq.vif = &sdata->vif;
--+
--+	if (sta) {
--+		txqi->txq.sta = &sta->sta;
--+		sta->sta.txq[tid] = &txqi->txq;
--+		txqi->txq.ac = ieee802_1d_to_ac[tid & 7];
--+	} else {
--+		sdata->vif.txq = &txqi->txq;
--+		txqi->txq.ac = IEEE80211_AC_BE;
--+	}
--+}
----- a/net/mac80211/rx.c
--+++ b/net/mac80211/rx.c
--@@ -1176,6 +1176,7 @@ static void sta_ps_start(struct sta_info
-- 	struct ieee80211_sub_if_data *sdata = sta->sdata;
-- 	struct ieee80211_local *local = sdata->local;
-- 	struct ps_data *ps;
--+	int tid;
-- 
-- 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
-- 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
--@@ -1189,6 +1190,18 @@ static void sta_ps_start(struct sta_info
-- 		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
-- 	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
-- 	       sta->sta.addr, sta->sta.aid);
--+
--+	if (!sta->sta.txq[0])
--+		return;
--+
--+	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
--+		struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
--+
--+		if (!skb_queue_len(&txqi->queue))
--+			set_bit(tid, &sta->txq_buffered_tids);
--+		else
--+			clear_bit(tid, &sta->txq_buffered_tids);
--+	}
-- }
-- 
-- static void sta_ps_end(struct sta_info *sta)
----- a/net/mac80211/agg-tx.c
--+++ b/net/mac80211/agg-tx.c
--@@ -188,6 +188,43 @@ ieee80211_wake_queue_agg(struct ieee8021
-- 	__release(agg_queue);
-- }
-- 
--+static void
--+ieee80211_agg_stop_txq(struct sta_info *sta, int tid)
--+{
--+	struct ieee80211_txq *txq = sta->sta.txq[tid];
--+	struct txq_info *txqi;
--+
--+	if (!txq)
--+		return;
--+
--+	txqi = to_txq_info(txq);
--+
--+	/* Lock here to protect against further seqno updates on dequeue */
--+	spin_lock_bh(&txqi->queue.lock);
--+	set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
--+	spin_unlock_bh(&txqi->queue.lock);
--+}
--+
--+static void
--+ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable)
--+{
--+	struct ieee80211_txq *txq = sta->sta.txq[tid];
--+	struct txq_info *txqi;
--+
--+	if (!txq)
--+		return;
--+
--+	txqi = to_txq_info(txq);
--+
--+	if (enable)
--+		set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
--+	else
--+		clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
--+
--+	clear_bit(IEEE80211_TXQ_STOP, &txqi->flags);
--+	drv_wake_tx_queue(sta->sdata->local, txqi);
--+}
--+
-- /*
--  * splice packets from the STA's pending to the local pending,
--  * requires a call to ieee80211_agg_splice_finish later
--@@ -247,6 +284,7 @@ static void ieee80211_remove_tid_tx(stru
-- 	ieee80211_assign_tid_tx(sta, tid, NULL);
-- 
-- 	ieee80211_agg_splice_finish(sta->sdata, tid);
--+	ieee80211_agg_start_txq(sta, tid, false);
-- 
-- 	kfree_rcu(tid_tx, rcu_head);
-- }
--@@ -418,6 +456,8 @@ void ieee80211_tx_ba_session_handle_star
-- 	 */
-- 	clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
-- 
--+	ieee80211_agg_stop_txq(sta, tid);
--+
-- 	/*
-- 	 * Make sure no packets are being processed. This ensures that
-- 	 * we have a valid starting sequence number and that in-flight
--@@ -440,6 +480,8 @@ void ieee80211_tx_ba_session_handle_star
-- 		ieee80211_agg_splice_finish(sdata, tid);
-- 		spin_unlock_bh(&sta->lock);
-- 
--+		ieee80211_agg_start_txq(sta, tid, false);
--+
-- 		kfree_rcu(tid_tx, rcu_head);
-- 		return;
-- 	}
--@@ -666,6 +708,8 @@ static void ieee80211_agg_tx_operational
-- 	ieee80211_agg_splice_finish(sta->sdata, tid);
-- 
-- 	spin_unlock_bh(&sta->lock);
--+
--+	ieee80211_agg_start_txq(sta, tid, true);
-- }
-- 
-- void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
-diff --git a/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch b/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch
-new file mode 100644
-index 0000000..a160dc4
---- /dev/null
-+++ b/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch
-@@ -0,0 +1,121 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 2 Jul 2015 15:20:56 +0200
-+Subject: [PATCH] ath9k: limit retries for powersave response frames
-+
-+In some cases, the channel might be busy enough that an ath9k AP's
-+response to PS-Poll frames might be too slow and the station has already
-+gone to sleep. To avoid wasting too much airtime on this, limit the
-+number of retries on such frames and ensure that no sample rate gets
-+used.
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/xmit.c
-++++ b/drivers/net/wireless/ath/ath9k/xmit.c
-+@@ -136,10 +136,25 @@ static void ath_send_bar(struct ath_atx_
-+ }
-+ 
-+ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
-+-			  struct ath_buf *bf)
-++			  struct ath_buf *bf, bool ps)
-+ {
-++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(bf->bf_mpdu);
-++
-++	if (ps) {
-++		/* Clear the first rate to avoid using a sample rate for PS frames */
-++		info->control.rates[0].idx = -1;
-++		info->control.rates[0].count = 0;
-++	}
-++
-+ 	ieee80211_get_tx_rates(vif, sta, bf->bf_mpdu, bf->rates,
-+ 			       ARRAY_SIZE(bf->rates));
-++	if (!ps)
-++		return;
-++
-++	if (bf->rates[0].count > 2)
-++		bf->rates[0].count = 2;
-++
-++	bf->rates[1].idx = -1;
-+ }
-+ 
-+ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
-+@@ -1419,7 +1434,7 @@ ath_tx_form_burst(struct ath_softc *sc,
-+ 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
-+ 			break;
-+ 
-+-		ath_set_rates(tid->an->vif, tid->an->sta, bf);
-++		ath_set_rates(tid->an->vif, tid->an->sta, bf, false);
-+ 	} while (1);
-+ }
-+ 
-+@@ -1450,7 +1465,7 @@ static bool ath_tx_sched_aggr(struct ath
-+ 		return false;
-+ 	}
-+ 
-+-	ath_set_rates(tid->an->vif, tid->an->sta, bf);
-++	ath_set_rates(tid->an->vif, tid->an->sta, bf, false);
-+ 	if (aggr)
-+ 		last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
-+ 					tid_q, &aggr_len);
-+@@ -1647,7 +1662,7 @@ void ath9k_release_buffered_frames(struc
-+ 
-+ 			__skb_unlink(bf->bf_mpdu, tid_q);
-+ 			list_add_tail(&bf->list, &bf_q);
-+-			ath_set_rates(tid->an->vif, tid->an->sta, bf);
-++			ath_set_rates(tid->an->vif, tid->an->sta, bf, true);
-+ 			if (bf_isampdu(bf)) {
-+ 				ath_tx_addto_baw(sc, tid, bf);
-+ 				bf->bf_state.bf_type &= ~BUF_AGGR;
-+@@ -2293,7 +2308,7 @@ int ath_tx_start(struct ieee80211_hw *hw
-+ 	struct ath_txq *txq = txctl->txq;
-+ 	struct ath_atx_tid *tid = NULL;
-+ 	struct ath_buf *bf;
-+-	bool queue, skip_uapsd = false, ps_resp;
-++	bool queue, ps_resp;
-+ 	int q, ret;
-+ 
-+ 	if (vif)
-+@@ -2346,13 +2361,13 @@ int ath_tx_start(struct ieee80211_hw *hw
-+ 		if (!txctl->an)
-+ 			txctl->an = &avp->mcast_node;
-+ 		queue = true;
-+-		skip_uapsd = true;
-++		ps_resp = false;
-+ 	}
-+ 
-+ 	if (txctl->an && queue)
-+ 		tid = ath_get_skb_tid(sc, txctl->an, skb);
-+ 
-+-	if (!skip_uapsd && ps_resp) {
-++	if (ps_resp) {
-+ 		ath_txq_unlock(sc, txq);
-+ 		txq = sc->tx.uapsdq;
-+ 		ath_txq_lock(sc, txq);
-+@@ -2390,7 +2405,7 @@ int ath_tx_start(struct ieee80211_hw *hw
-+ 	if (txctl->paprd)
-+ 		bf->bf_state.bfs_paprd_timestamp = jiffies;
-+ 
-+-	ath_set_rates(vif, sta, bf);
-++	ath_set_rates(vif, sta, bf, ps_resp);
-+ 	ath_tx_send_normal(sc, txq, tid, skb);
-+ 
-+ out:
-+@@ -2429,7 +2444,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw
-+ 			break;
-+ 
-+ 		bf->bf_lastbf = bf;
-+-		ath_set_rates(vif, NULL, bf);
-++		ath_set_rates(vif, NULL, bf, false);
-+ 		ath_buf_set_rate(sc, bf, &info, fi->framelen, false);
-+ 		duration += info.rates[0].PktDuration;
-+ 		if (bf_tail)
-+@@ -2932,7 +2947,7 @@ int ath9k_tx99_send(struct ath_softc *sc
-+ 		return -EINVAL;
-+ 	}
-+ 
-+-	ath_set_rates(sc->tx99_vif, NULL, bf);
-++	ath_set_rates(sc->tx99_vif, NULL, bf, false);
-+ 
-+ 	ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
-+ 	ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
-diff --git a/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch b/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
-deleted file mode 100644
-index 465d943..0000000
---- a/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
-+++ /dev/null
-@@ -1,125 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Wed, 11 Mar 2015 09:14:15 +0100
--Subject: [PATCH] mac80211: lock rate control
--
--Both minstrel (reported by Sven Eckelmann) and the iwlwifi rate
--control aren't properly taking concurrency into account. It's
--likely that the same is true for other rate control algorithms.
--
--In the case of minstrel this manifests itself in crashes when an
--update and other data access are run concurrently, for example
--when the stations change bandwidth or similar. In iwlwifi, this
--can cause firmware crashes.
--
--Since fixing all rate control algorithms will be very difficult,
--just provide locking for invocations. This protects the internal
--data structures the algorithms maintain.
--
--I've manipulated hostapd to test this, by having it change its
--advertised bandwidth roughly ever 150ms. At the same time, I'm
--running a flood ping between the client and the AP, which causes
--this race of update vs. get_rate/status to easily happen on the
--client. With this change, the system survives this test.
--
--Reported-by: Sven Eckelmann <sven@open-mesh.com>
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/rate.c
--+++ b/net/mac80211/rate.c
--@@ -683,7 +683,13 @@ void rate_control_get_rate(struct ieee80
-- 	if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
-- 		return;
-- 
---	ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
--+	if (ista) {
--+		spin_lock_bh(&sta->rate_ctrl_lock);
--+		ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
--+		spin_unlock_bh(&sta->rate_ctrl_lock);
--+	} else {
--+		ref->ops->get_rate(ref->priv, NULL, NULL, txrc);
--+	}
-- 
-- 	if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
-- 		return;
----- a/net/mac80211/rate.h
--+++ b/net/mac80211/rate.h
--@@ -42,10 +42,12 @@ static inline void rate_control_tx_statu
-- 	if (!ref || !test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
-- 		return;
-- 
--+	spin_lock_bh(&sta->rate_ctrl_lock);
-- 	if (ref->ops->tx_status)
-- 		ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
-- 	else
-- 		ref->ops->tx_status_noskb(ref->priv, sband, ista, priv_sta, info);
--+	spin_unlock_bh(&sta->rate_ctrl_lock);
-- }
-- 
-- static inline void
--@@ -64,7 +66,9 @@ rate_control_tx_status_noskb(struct ieee
-- 	if (WARN_ON_ONCE(!ref->ops->tx_status_noskb))
-- 		return;
-- 
--+	spin_lock_bh(&sta->rate_ctrl_lock);
-- 	ref->ops->tx_status_noskb(ref->priv, sband, ista, priv_sta, info);
--+	spin_unlock_bh(&sta->rate_ctrl_lock);
-- }
-- 
-- static inline void rate_control_rate_init(struct sta_info *sta)
--@@ -91,8 +95,10 @@ static inline void rate_control_rate_ini
-- 
-- 	sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
-- 
--+	spin_lock_bh(&sta->rate_ctrl_lock);
-- 	ref->ops->rate_init(ref->priv, sband, &chanctx_conf->def, ista,
-- 			    priv_sta);
--+	spin_unlock_bh(&sta->rate_ctrl_lock);
-- 	rcu_read_unlock();
-- 	set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
-- }
--@@ -115,18 +121,20 @@ static inline void rate_control_rate_upd
-- 			return;
-- 		}
-- 
--+		spin_lock_bh(&sta->rate_ctrl_lock);
-- 		ref->ops->rate_update(ref->priv, sband, &chanctx_conf->def,
-- 				      ista, priv_sta, changed);
--+		spin_unlock_bh(&sta->rate_ctrl_lock);
-- 		rcu_read_unlock();
-- 	}
-- 	drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
-- }
-- 
-- static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
---					   struct ieee80211_sta *sta,
---					   gfp_t gfp)
--+					   struct sta_info *sta, gfp_t gfp)
-- {
---	return ref->ops->alloc_sta(ref->priv, sta, gfp);
--+	spin_lock_init(&sta->rate_ctrl_lock);
--+	return ref->ops->alloc_sta(ref->priv, &sta->sta, gfp);
-- }
-- 
-- static inline void rate_control_free_sta(struct sta_info *sta)
----- a/net/mac80211/sta_info.c
--+++ b/net/mac80211/sta_info.c
--@@ -286,7 +286,7 @@ static int sta_prepare_rate_control(stru
-- 
-- 	sta->rate_ctrl = local->rate_ctrl;
-- 	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
---						     &sta->sta, gfp);
--+						     sta, gfp);
-- 	if (!sta->rate_ctrl_priv)
-- 		return -ENOMEM;
-- 
----- a/net/mac80211/sta_info.h
--+++ b/net/mac80211/sta_info.h
--@@ -349,6 +349,7 @@ struct sta_info {
-- 	u8 ptk_idx;
-- 	struct rate_control_ref *rate_ctrl;
-- 	void *rate_ctrl_priv;
--+	spinlock_t rate_ctrl_lock;
-- 	spinlock_t lock;
-- 
-- 	struct work_struct drv_deliver_wk;
-diff --git a/package/kernel/mac80211/patches/302-ath9k-restart-only-triggering-DFS-detector-line.patch b/package/kernel/mac80211/patches/302-ath9k-restart-only-triggering-DFS-detector-line.patch
-deleted file mode 100644
-index e54e16e..0000000
---- a/package/kernel/mac80211/patches/302-ath9k-restart-only-triggering-DFS-detector-line.patch
-+++ /dev/null
-@@ -1,21 +0,0 @@
--From: Zefir Kurtisi <zefir.kurtisi@neratec.com>
--Date: Tue, 10 Mar 2015 17:49:29 +0100
--Subject: [PATCH] ath9k: restart only triggering DFS detector line
--
--To support HT40 DFS mode, a triggering detector must
--reset only itself but not other detector lines.
--
--Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
-----
--
----- a/drivers/net/wireless/ath/dfs_pattern_detector.c
--+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
--@@ -289,7 +289,7 @@ dpd_add_pulse(struct dfs_pattern_detecto
-- 				"count=%d, count_false=%d\n",
-- 				event->freq, pd->rs->type_id,
-- 				ps->pri, ps->count, ps->count_falses);
---			channel_detector_reset(dpd, cd);
--+			pd->reset(pd, dpd->last_pulse_ts);
-- 			return true;
-- 		}
-- 	}
-diff --git a/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch b/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch
-new file mode 100644
-index 0000000..22b987a
---- /dev/null
-+++ b/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch
-@@ -0,0 +1,95 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 14 Jan 2016 03:14:03 +0100
-+Subject: [PATCH] ath9k_hw: add low power tx gain table for AR953x
-+
-+Used in some newer TP-Link AR9533 devices.
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
-++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
-+@@ -698,6 +698,9 @@ static void ar9003_tx_gain_table_mode2(s
-+ 	else if (AR_SREV_9340(ah))
-+ 		INIT_INI_ARRAY(&ah->iniModesTxGain,
-+ 			ar9340Modes_low_ob_db_tx_gain_table_1p0);
-++	else if (AR_SREV_9531_11(ah))
-++		INIT_INI_ARRAY(&ah->iniModesTxGain,
-++			       qca953x_1p1_modes_no_xpa_low_power_tx_gain_table);
-+ 	else if (AR_SREV_9485_11_OR_LATER(ah))
-+ 		INIT_INI_ARRAY(&ah->iniModesTxGain,
-+ 			ar9485Modes_low_ob_db_tx_gain_1_1);
-+--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
-++++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
-+@@ -757,6 +757,71 @@ static const u32 qca953x_1p1_modes_xpa_t
-+ 	{0x00016448, 0x6c927a70},
-+ };
-+ 
-++static const u32 qca953x_1p1_modes_no_xpa_low_power_tx_gain_table[][2] = {
-++	/* Addr      allmodes  */
-++	{0x0000a2dc, 0xfff55592},
-++	{0x0000a2e0, 0xfff99924},
-++	{0x0000a2e4, 0xfffe1e00},
-++	{0x0000a2e8, 0xffffe000},
-++	{0x0000a410, 0x000050d6},
-++	{0x0000a500, 0x00000069},
-++	{0x0000a504, 0x0400006b},
-++	{0x0000a508, 0x0800006d},
-++	{0x0000a50c, 0x0c000269},
-++	{0x0000a510, 0x1000026b},
-++	{0x0000a514, 0x1400026d},
-++	{0x0000a518, 0x18000669},
-++	{0x0000a51c, 0x1c00066b},
-++	{0x0000a520, 0x1d000a68},
-++	{0x0000a524, 0x21000a6a},
-++	{0x0000a528, 0x25000a6c},
-++	{0x0000a52c, 0x29000a6e},
-++	{0x0000a530, 0x2d0012a9},
-++	{0x0000a534, 0x310012ab},
-++	{0x0000a538, 0x350012ad},
-++	{0x0000a53c, 0x39001b0a},
-++	{0x0000a540, 0x3d001b0c},
-++	{0x0000a544, 0x41001b0e},
-++	{0x0000a548, 0x43001bae},
-++	{0x0000a54c, 0x45001914},
-++	{0x0000a550, 0x47001916},
-++	{0x0000a554, 0x49001b96},
-++	{0x0000a558, 0x49001b96},
-++	{0x0000a55c, 0x49001b96},
-++	{0x0000a560, 0x49001b96},
-++	{0x0000a564, 0x49001b96},
-++	{0x0000a568, 0x49001b96},
-++	{0x0000a56c, 0x49001b96},
-++	{0x0000a570, 0x49001b96},
-++	{0x0000a574, 0x49001b96},
-++	{0x0000a578, 0x49001b96},
-++	{0x0000a57c, 0x49001b96},
-++	{0x0000a600, 0x00000000},
-++	{0x0000a604, 0x00000000},
-++	{0x0000a608, 0x00000000},
-++	{0x0000a60c, 0x00000000},
-++	{0x0000a610, 0x00000000},
-++	{0x0000a614, 0x00000000},
-++	{0x0000a618, 0x00804201},
-++	{0x0000a61c, 0x01408201},
-++	{0x0000a620, 0x01408502},
-++	{0x0000a624, 0x01408502},
-++	{0x0000a628, 0x01408502},
-++	{0x0000a62c, 0x01408502},
-++	{0x0000a630, 0x01408502},
-++	{0x0000a634, 0x01408502},
-++	{0x0000a638, 0x01408502},
-++	{0x0000a63c, 0x01408502},
-++	{0x0000b2dc, 0xfff55592},
-++	{0x0000b2e0, 0xfff99924},
-++	{0x0000b2e4, 0xfffe1e00},
-++	{0x0000b2e8, 0xffffe000},
-++	{0x00016044, 0x044922db},
-++	{0x00016048, 0x6c927a70},
-++	{0x00016444, 0x044922db},
-++	{0x00016448, 0x6c927a70},
-++};
-++
-+ static const u32 qca953x_2p0_baseband_core[][2] = {
-+ 	/* Addr      allmodes  */
-+ 	{0x00009800, 0xafe68e30},
-diff --git a/package/kernel/mac80211/patches/303-ath9k-add-DFS-support-for-extension-channel.patch b/package/kernel/mac80211/patches/303-ath9k-add-DFS-support-for-extension-channel.patch
-deleted file mode 100644
-index ed268ea..0000000
---- a/package/kernel/mac80211/patches/303-ath9k-add-DFS-support-for-extension-channel.patch
-+++ /dev/null
-@@ -1,76 +0,0 @@
--From: Zefir Kurtisi <zefir.kurtisi@neratec.com>
--Date: Tue, 10 Mar 2015 17:49:30 +0100
--Subject: [PATCH] ath9k: add DFS support for extension channel
--
--In HT40 modes, pulse events on primary and extension
--channel are processed individually. If valid, a pulse
--event will be fed into the detector
--* for primary frequency, or
--* for extension frequency (+/-20MHz based on HT40-mode)
--* or both
--
--With that, a 40MHz radar will result in two individual
--radar events.
--
--Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
-----
--
----- a/drivers/net/wireless/ath/ath9k/dfs.c
--+++ b/drivers/net/wireless/ath/ath9k/dfs.c
--@@ -126,8 +126,19 @@ ath9k_postprocess_radar_event(struct ath
-- 	DFS_STAT_INC(sc, pulses_detected);
-- 	return true;
-- }
---#undef PRI_CH_RADAR_FOUND
---#undef EXT_CH_RADAR_FOUND
--+
--+static void
--+ath9k_dfs_process_radar_pulse(struct ath_softc *sc, struct pulse_event *pe)
--+{
--+	struct dfs_pattern_detector *pd = sc->dfs_detector;
--+	DFS_STAT_INC(sc, pulses_processed);
--+	if (pd == NULL)
--+		return;
--+	if (!pd->add_pulse(pd, pe))
--+		return;
--+	DFS_STAT_INC(sc, radar_detected);
--+	ieee80211_radar_detected(sc->hw);
--+}
-- 
-- /*
--  * DFS: check PHY-error for radar pulse and feed the detector
--@@ -176,18 +187,21 @@ void ath9k_dfs_process_phyerr(struct ath
-- 	ard.pulse_length_pri = vdata_end[-3];
-- 	pe.freq = ah->curchan->channel;
-- 	pe.ts = mactime;
---	if (ath9k_postprocess_radar_event(sc, &ard, &pe)) {
---		struct dfs_pattern_detector *pd = sc->dfs_detector;
---		ath_dbg(common, DFS,
---			"ath9k_dfs_process_phyerr: channel=%d, ts=%llu, "
---			"width=%d, rssi=%d, delta_ts=%llu\n",
---			pe.freq, pe.ts, pe.width, pe.rssi,
---			pe.ts - sc->dfs_prev_pulse_ts);
---		sc->dfs_prev_pulse_ts = pe.ts;
---		DFS_STAT_INC(sc, pulses_processed);
---		if (pd != NULL && pd->add_pulse(pd, &pe)) {
---			DFS_STAT_INC(sc, radar_detected);
---			ieee80211_radar_detected(sc->hw);
---		}
--+	if (!ath9k_postprocess_radar_event(sc, &ard, &pe))
--+		return;
--+
--+	ath_dbg(common, DFS,
--+		"ath9k_dfs_process_phyerr: type=%d, freq=%d, ts=%llu, "
--+		"width=%d, rssi=%d, delta_ts=%llu\n",
--+		ard.pulse_bw_info, pe.freq, pe.ts, pe.width, pe.rssi,
--+		pe.ts - sc->dfs_prev_pulse_ts);
--+	sc->dfs_prev_pulse_ts = pe.ts;
--+	if (ard.pulse_bw_info & PRI_CH_RADAR_FOUND)
--+		ath9k_dfs_process_radar_pulse(sc, &pe);
--+	if (ard.pulse_bw_info & EXT_CH_RADAR_FOUND) {
--+		pe.freq += IS_CHAN_HT40PLUS(ah->curchan) ? 20 : -20;
--+		ath9k_dfs_process_radar_pulse(sc, &pe);
-- 	}
-- }
--+#undef PRI_CH_RADAR_FOUND
--+#undef EXT_CH_RADAR_FOUND
-diff --git a/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch b/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch
-new file mode 100644
-index 0000000..7bb7435
---- /dev/null
-+++ b/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch
-@@ -0,0 +1,156 @@
-+From: Eli Cooper <elicooper@gmx.com>
-+Date: Thu, 14 Jan 2016 00:07:12 +0800
-+Subject: [PATCH] rt2x00: fix monitor mode regression
-+
-+Since commit df1404650ccbfeb76a84f301f22316be0d00a864 monitor mode for rt2x00
-+has been made effectively useless because the hardware filter is configured to
-+drop packets whose intended recipient is not the device, regardless of the
-+presence of monitor mode interfaces.
-+
-+This patch fixes this regression by adding explicit monitor mode support, and
-+configuring the hardware filter accordingly.
-+
-+Signed-off-by: Eli Cooper <elicooper@gmx.com>
-+---
-+
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
-+@@ -273,8 +273,10 @@ static void rt2400pci_config_filter(stru
-+ 			   !(filter_flags & FIF_PLCPFAIL));
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_CONTROL,
-+ 			   !(filter_flags & FIF_CONTROL));
-+-	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME, 1);
-++	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME,
-++			   !rt2x00dev->is_monitoring);
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_TODS,
-++			   !rt2x00dev->is_monitoring &&
-+ 			   !rt2x00dev->intf_ap_count);
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
-+ 	rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
-+@@ -274,8 +274,10 @@ static void rt2500pci_config_filter(stru
-+ 			   !(filter_flags & FIF_PLCPFAIL));
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_CONTROL,
-+ 			   !(filter_flags & FIF_CONTROL));
-+-	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME, 1);
-++	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME,
-++			   !rt2x00dev->is_monitoring);
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_TODS,
-++			   !rt2x00dev->is_monitoring &&
-+ 			   !rt2x00dev->intf_ap_count);
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
-+ 	rt2x00_set_field32(&reg, RXCSR0_DROP_MCAST,
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
-+@@ -437,8 +437,10 @@ static void rt2500usb_config_filter(stru
-+ 			   !(filter_flags & FIF_PLCPFAIL));
-+ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CONTROL,
-+ 			   !(filter_flags & FIF_CONTROL));
-+-	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME, 1);
-++	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME,
-++			   !rt2x00dev->is_monitoring);
-+ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_TODS,
-++			   !rt2x00dev->is_monitoring &&
-+ 			   !rt2x00dev->intf_ap_count);
-+ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_VERSION_ERROR, 1);
-+ 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_MULTICAST,
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -1490,7 +1490,8 @@ void rt2800_config_filter(struct rt2x00_
-+ 			   !(filter_flags & FIF_FCSFAIL));
-+ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
-+ 			   !(filter_flags & FIF_PLCPFAIL));
-+-	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME, 1);
-++	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
-++			   !rt2x00dev->is_monitoring);
-+ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
-+ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
-+ 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -844,11 +844,13 @@ struct rt2x00_dev {
-+ 	 *  - Open sta interface count.
-+ 	 *  - Association count.
-+ 	 *  - Beaconing enabled count.
-++	 *  - Whether the device is monitoring.
-+ 	 */
-+ 	unsigned int intf_ap_count;
-+ 	unsigned int intf_sta_count;
-+ 	unsigned int intf_associated;
-+ 	unsigned int intf_beaconing;
-++	bool is_monitoring;
-+ 
-+ 	/*
-+ 	 * Interface combinations
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00config.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00config.c
-+@@ -244,6 +244,16 @@ void rt2x00lib_config(struct rt2x00_dev
-+ 	    (ieee80211_flags & IEEE80211_CONF_CHANGE_PS))
-+ 		cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
-+ 
-++	if (ieee80211_flags & IEEE80211_CONF_CHANGE_MONITOR) {
-++		if (conf->flags & IEEE80211_CONF_MONITOR) {
-++			rt2x00_dbg(rt2x00dev, "Monitor mode is enabled\n");
-++			rt2x00dev->is_monitoring = true;
-++		} else {
-++			rt2x00_dbg(rt2x00dev, "Monitor mode is disabled\n");
-++			rt2x00dev->is_monitoring = false;
-++		}
-++	}
-++
-+ 	/*
-+ 	 * Start configuration.
-+ 	 */
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+@@ -1204,6 +1204,7 @@ int rt2x00lib_start(struct rt2x00_dev *r
-+ 	rt2x00dev->intf_ap_count = 0;
-+ 	rt2x00dev->intf_sta_count = 0;
-+ 	rt2x00dev->intf_associated = 0;
-++	rt2x00dev->is_monitoring = false;
-+ 
-+ 	/* Enable the radio */
-+ 	retval = rt2x00lib_enable_radio(rt2x00dev);
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-+@@ -385,11 +385,6 @@ void rt2x00mac_configure_filter(struct i
-+ 			*total_flags |= FIF_PSPOLL;
-+ 	}
-+ 
-+-	/*
-+-	 * Check if there is any work left for us.
-+-	 */
-+-	if (rt2x00dev->packet_filter == *total_flags)
-+-		return;
-+ 	rt2x00dev->packet_filter = *total_flags;
-+ 
-+ 	rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
-+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
-+@@ -530,8 +530,10 @@ static void rt61pci_config_filter(struct
-+ 			   !(filter_flags & FIF_PLCPFAIL));
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
-+ 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
-+-	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME, 1);
-++	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
-++			   !rt2x00dev->is_monitoring);
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
-++			   !rt2x00dev->is_monitoring &&
-+ 			   !rt2x00dev->intf_ap_count);
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
-+--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c
-+@@ -480,8 +480,10 @@ static void rt73usb_config_filter(struct
-+ 			   !(filter_flags & FIF_PLCPFAIL));
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
-+ 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
-+-	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME, 1);
-++	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
-++			   !rt2x00dev->is_monitoring);
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
-++			   !rt2x00dev->is_monitoring &&
-+ 			   !rt2x00dev->intf_ap_count);
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
-+ 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
-diff --git a/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch b/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch
-deleted file mode 100644
-index e1eab64..0000000
---- a/package/kernel/mac80211/patches/304-ath9k-allow-40MHz-radar-detection-width.patch
-+++ /dev/null
-@@ -1,19 +0,0 @@
--From: Zefir Kurtisi <zefir.kurtisi@neratec.com>
--Date: Tue, 10 Mar 2015 17:49:31 +0100
--Subject: [PATCH] ath9k: allow 40MHz radar detection width
--
--Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
-----
--
----- a/drivers/net/wireless/ath/ath9k/init.c
--+++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -763,7 +763,8 @@ static const struct ieee80211_iface_comb
-- 		.num_different_channels = 1,
-- 		.beacon_int_infra_match = true,
-- 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
---					BIT(NL80211_CHAN_WIDTH_20),
--+					BIT(NL80211_CHAN_WIDTH_20) |
--+					BIT(NL80211_CHAN_WIDTH_40),
-- 	}
-- #endif
-- };
-diff --git a/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch b/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch
-new file mode 100644
-index 0000000..049059a
---- /dev/null
-+++ b/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch
-@@ -0,0 +1,32 @@
-+From: Miaoqing Pan <miaoqing@codeaurora.org>
-+Date: Fri, 15 Jan 2016 18:17:17 +0800
-+Subject: [PATCH] ath9k: avoid ANI restart if no trigger
-+
-+Fixes commit 54da20d83f0e ("ath9k_hw: improve ANI processing and rx desensitizing parameters")
-+
-+Call ath9k_ani_restart() only when the phy error rate reach the
-+ANI immunity threshold. Sync the logic with internal code base.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/ani.c
-++++ b/drivers/net/wireless/ath/ath9k/ani.c
-+@@ -444,14 +444,16 @@ void ath9k_hw_ani_monitor(struct ath_hw
-+ 		    ofdmPhyErrRate < ah->config.ofdm_trig_low) {
-+ 			ath9k_hw_ani_lower_immunity(ah);
-+ 			aniState->ofdmsTurn = !aniState->ofdmsTurn;
-++			ath9k_ani_restart(ah);
-+ 		} else if (ofdmPhyErrRate > ah->config.ofdm_trig_high) {
-+ 			ath9k_hw_ani_ofdm_err_trigger(ah);
-+ 			aniState->ofdmsTurn = false;
-++			ath9k_ani_restart(ah);
-+ 		} else if (cckPhyErrRate > ah->config.cck_trig_high) {
-+ 			ath9k_hw_ani_cck_err_trigger(ah);
-+ 			aniState->ofdmsTurn = true;
-++			ath9k_ani_restart(ah);
-+ 		}
-+-		ath9k_ani_restart(ah);
-+ 	}
-+ }
-+ EXPORT_SYMBOL(ath9k_hw_ani_monitor);
-diff --git a/package/kernel/mac80211/patches/305-ath5k-channel-change-fix.patch b/package/kernel/mac80211/patches/305-ath5k-channel-change-fix.patch
-deleted file mode 100644
-index 4cfa53f..0000000
---- a/package/kernel/mac80211/patches/305-ath5k-channel-change-fix.patch
-+++ /dev/null
-@@ -1,137 +0,0 @@
--From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
--Date: Wed, 4 Mar 2015 05:12:10 +0300
--Subject: [PATCH] ath5k: channel change fix
--
--ath5k updates the channel pointer and after that it stops the Rx logic
--and apply channel to HW. In case of channel switch, such sequence
--creates a small window when a frame, which is received on the old
--channel is considered as a frame received on the new one.
--
--The most notable consequence of this situation occurs during the switch
--from 2 GHz band (CCK+OFDM) to the 5GHz band (OFDM-only). Frame received
--with CCK rate, e.g. beacon received at the 1mbps, causes the following
--warning:
--
--  WARNING: at ath5k/base.c:589 ath5k_tasklet_rx+0x318/0x6ec [ath5k]()
--  invalid hw_rix: 1a
--  [..]
--  Call Trace:
--  [<802656a8>] show_stack+0x48/0x70
--  [<802dd92c>] warn_slowpath_common+0x88/0xbc
--  [<802dd98c>] warn_slowpath_fmt+0x2c/0x38
--  [<81b51be8>] ath5k_tasklet_rx+0x318/0x6ec [ath5k]
--  [<8028ac64>] tasklet_action+0x8c/0xf0
--  [<80075804>] __do_softirq+0x180/0x32c
--  [<80196ce8>] irq_exit+0x54/0x70
--  [<80041848>] ret_from_irq+0x0/0x4
--  [<80182fdc>] ioread32+0x4/0xc
--  [<81b4c42c>] ath5k_hw_set_sleep_clock+0x2ec/0x474 [ath5k]
--  [<81b4cf28>] ath5k_hw_reset+0x50/0xeb8 [ath5k]
--  [<81b50900>] ath5k_reset+0xd4/0x310 [ath5k]
--  [<81b557e8>] ath5k_config+0x4c/0x104 [ath5k]
--  [<80d01770>] ieee80211_hw_config+0x2f4/0x35c [mac80211]
--  [<80d09aa8>] ieee80211_scan_work+0x2e4/0x414 [mac80211]
--  [<8022c3f4>] process_one_work+0x28c/0x400
--  [<802df8f8>] worker_thread+0x258/0x3c0
--  [<801b5710>] kthread+0xe0/0xec
--  [<800418a8>] ret_from_kernel_thread+0x14/0x1c
--
--The easiest way to reproduce this warning is to run scan with dualband
--NIC in noisy environments, when the channel 11 runs multiple APs. In my
--tests if the APs num >= 12, the warning appears in the first few
--seconds of scanning.
--
--In order to fix this, the Rx disable code moved to a higher level and
--placed before the channel pointer update. This is also makes the code a
--bit more symmetrical, since we disable and enable the Rx in the same
--function.
--
--In fact, at the pointer update time new frames should not appear,
--because interrupt generation at this point should already be disabled.
--The next patch should address this issue.
--
--CC: Jiri Slaby <jirislaby@gmail.com>
--CC: Nick Kossifidis <mickflemm@gmail.com>
--CC: Luis R. Rodriguez <mcgrof@do-not-panic.com>
--Reported-by: Christophe Prevotaux <cprevotaux@nltinc.com>
--Tested-by: Christophe Prevotaux <cprevotaux@nltinc.com>
--Tested-by: Eric Bree <ebree@nltinc.com>
--Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
-----
--
----- a/drivers/net/wireless/ath/ath5k/base.c
--+++ b/drivers/net/wireless/ath/ath5k/base.c
--@@ -2858,7 +2858,7 @@ ath5k_reset(struct ath5k_hw *ah, struct
-- {
-- 	struct ath_common *common = ath5k_hw_common(ah);
-- 	int ret, ani_mode;
---	bool fast;
--+	bool fast = chan && modparam_fastchanswitch ? 1 : 0;
-- 
-- 	ATH5K_DBG(ah, ATH5K_DEBUG_RESET, "resetting\n");
-- 
--@@ -2876,11 +2876,29 @@ ath5k_reset(struct ath5k_hw *ah, struct
-- 	 * so we should also free any remaining
-- 	 * tx buffers */
-- 	ath5k_drain_tx_buffs(ah);
--+
--+	/* Stop PCU */
--+	ath5k_hw_stop_rx_pcu(ah);
--+
--+	/* Stop DMA
--+	 *
--+	 * Note: If DMA didn't stop continue
--+	 * since only a reset will fix it.
--+	 */
--+	ret = ath5k_hw_dma_stop(ah);
--+
--+	/* RF Bus grant won't work if we have pending
--+	 * frames
--+	 */
--+	if (ret && fast) {
--+		ATH5K_DBG(ah, ATH5K_DEBUG_RESET,
--+			  "DMA didn't stop, falling back to normal reset\n");
--+		fast = false;
--+	}
--+
-- 	if (chan)
-- 		ah->curchan = chan;
-- 
---	fast = ((chan != NULL) && modparam_fastchanswitch) ? 1 : 0;
---
-- 	ret = ath5k_hw_reset(ah, ah->opmode, ah->curchan, fast, skip_pcu);
-- 	if (ret) {
-- 		ATH5K_ERR(ah, "can't reset hardware (%d)\n", ret);
----- a/drivers/net/wireless/ath/ath5k/reset.c
--+++ b/drivers/net/wireless/ath/ath5k/reset.c
--@@ -1169,30 +1169,6 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
-- 	if (ah->ah_version == AR5K_AR5212)
-- 		ath5k_hw_set_sleep_clock(ah, false);
-- 
---	/*
---	 * Stop PCU
---	 */
---	ath5k_hw_stop_rx_pcu(ah);
---
---	/*
---	 * Stop DMA
---	 *
---	 * Note: If DMA didn't stop continue
---	 * since only a reset will fix it.
---	 */
---	ret = ath5k_hw_dma_stop(ah);
---
---	/* RF Bus grant won't work if we have pending
---	 * frames */
---	if (ret && fast) {
---		ATH5K_DBG(ah, ATH5K_DEBUG_RESET,
---			"DMA didn't stop, falling back to normal reset\n");
---		fast = false;
---		/* Non fatal, just continue with
---		 * normal reset */
---		ret = 0;
---	}
---
-- 	mode = channel->hw_value;
-- 	switch (mode) {
-- 	case AR5K_MODE_11A:
-diff --git a/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch b/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch
-new file mode 100644
-index 0000000..a1ac67c
---- /dev/null
-+++ b/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch
-@@ -0,0 +1,91 @@
-+From: Miaoqing Pan <miaoqing@codeaurora.org>
-+Date: Fri, 15 Jan 2016 18:17:18 +0800
-+Subject: [PATCH] ath9k: clean up ANI per-channel pointer checking
-+
-+commit c24bd3620c50 ("ath9k: Do not maintain ANI state per-channel")
-+removed per-channel handling, the code to check 'curchan' also
-+should be removed as never used.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/ani.c
-++++ b/drivers/net/wireless/ath/ath9k/ani.c
-+@@ -126,12 +126,8 @@ static void ath9k_hw_update_mibstats(str
-+ 
-+ static void ath9k_ani_restart(struct ath_hw *ah)
-+ {
-+-	struct ar5416AniState *aniState;
-+-
-+-	if (!ah->curchan)
-+-		return;
-++	struct ar5416AniState *aniState = &ah->ani;
-+ 
-+-	aniState = &ah->ani;
-+ 	aniState->listenTime = 0;
-+ 
-+ 	ENABLE_REGWRITE_BUFFER(ah);
-+@@ -221,12 +217,7 @@ static void ath9k_hw_set_ofdm_nil(struct
-+ 
-+ static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
-+ {
-+-	struct ar5416AniState *aniState;
-+-
-+-	if (!ah->curchan)
-+-		return;
-+-
-+-	aniState = &ah->ani;
-++	struct ar5416AniState *aniState = &ah->ani;
-+ 
-+ 	if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
-+ 		ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1, false);
-+@@ -281,12 +272,7 @@ static void ath9k_hw_set_cck_nil(struct
-+ 
-+ static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
-+ {
-+-	struct ar5416AniState *aniState;
-+-
-+-	if (!ah->curchan)
-+-		return;
-+-
-+-	aniState = &ah->ani;
-++	struct ar5416AniState *aniState = &ah->ani;
-+ 
-+ 	if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
-+ 		ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1,
-+@@ -299,9 +285,7 @@ static void ath9k_hw_ani_cck_err_trigger
-+  */
-+ static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
-+ {
-+-	struct ar5416AniState *aniState;
-+-
-+-	aniState = &ah->ani;
-++	struct ar5416AniState *aniState = &ah->ani;
-+ 
-+ 	/* lower OFDM noise immunity */
-+ 	if (aniState->ofdmNoiseImmunityLevel > 0 &&
-+@@ -329,7 +313,7 @@ void ath9k_ani_reset(struct ath_hw *ah,
-+ 	struct ath_common *common = ath9k_hw_common(ah);
-+ 	int ofdm_nil, cck_nil;
-+ 
-+-	if (!ah->curchan)
-++	if (!chan)
-+ 		return;
-+ 
-+ 	BUG_ON(aniState == NULL);
-+@@ -416,14 +400,10 @@ static bool ath9k_hw_ani_read_counters(s
-+ 
-+ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
-+ {
-+-	struct ar5416AniState *aniState;
-++	struct ar5416AniState *aniState = &ah->ani;
-+ 	struct ath_common *common = ath9k_hw_common(ah);
-+ 	u32 ofdmPhyErrRate, cckPhyErrRate;
-+ 
-+-	if (!ah->curchan)
-+-		return;
-+-
-+-	aniState = &ah->ani;
-+ 	if (!ath9k_hw_ani_read_counters(ah))
-+ 		return;
-+ 
-diff --git a/package/kernel/mac80211/patches/306-ath5k-fix-reset-race.patch b/package/kernel/mac80211/patches/306-ath5k-fix-reset-race.patch
-deleted file mode 100644
-index 85a1904..0000000
---- a/package/kernel/mac80211/patches/306-ath5k-fix-reset-race.patch
-+++ /dev/null
-@@ -1,96 +0,0 @@
--From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
--Date: Wed, 4 Mar 2015 05:12:11 +0300
--Subject: [PATCH] ath5k: fix reset race
--
--To prepare for reset ath5k should finish all asynchronous tasks. At
--first, it disables the interrupt generation, then it waits for the
--interrupt handler and tasklets completion, and then proceeds to the HW
--configuration update. But it does not consider that the interrupt
--handler or tasklet re-enables the interrupt generation. And we fall in a
--situation when ath5k assumes that interrupts are disabled, but it is
--not.
--
--This can lead to different consequences, such as reception of the frame,
--when we do not expect it. Under certain circumstances, this can lead to
--the following warning:
--
--  WARNING: at ath5k/base.c:589 ath5k_tasklet_rx+0x318/0x6ec [ath5k]()
--  invalid hw_rix: 1a
--  [..]
--  Call Trace:
--  [<802656a8>] show_stack+0x48/0x70
--  [<802dd92c>] warn_slowpath_common+0x88/0xbc
--  [<802dd98c>] warn_slowpath_fmt+0x2c/0x38
--  [<81b51be8>] ath5k_tasklet_rx+0x318/0x6ec [ath5k]
--  [<8028ac64>] tasklet_action+0x8c/0xf0
--  [<80075804>] __do_softirq+0x180/0x32c
--  [<80196ce8>] irq_exit+0x54/0x70
--  [<80041848>] ret_from_irq+0x0/0x4
--  [<80182fdc>] ioread32+0x4/0xc
--  [<81b4c42c>] ath5k_hw_set_sleep_clock+0x2ec/0x474 [ath5k]
--  [<81b4cf28>] ath5k_hw_reset+0x50/0xeb8 [ath5k]
--  [<81b50900>] ath5k_reset+0xd4/0x310 [ath5k]
--  [<81b557e8>] ath5k_config+0x4c/0x104 [ath5k]
--  [<80d01770>] ieee80211_hw_config+0x2f4/0x35c [mac80211]
--  [<80d09aa8>] ieee80211_scan_work+0x2e4/0x414 [mac80211]
--  [<8022c3f4>] process_one_work+0x28c/0x400
--  [<802df8f8>] worker_thread+0x258/0x3c0
--  [<801b5710>] kthread+0xe0/0xec
--  [<800418a8>] ret_from_kernel_thread+0x14/0x1c
--
--Fix this issue by adding a new status flag, which forbids to re-enable
--the interrupt generation until the HW configuration is completed.
--
--Note: previous patch, which reorders the Rx disable code helps to avoid
--the above warning, but not fixes the root cause of unexpected frame
--receiving.
--
--CC: Jiri Slaby <jirislaby@gmail.com>
--CC: Nick Kossifidis <mickflemm@gmail.com>
--CC: Luis R. Rodriguez <mcgrof@do-not-panic.com>
--Reported-by: Christophe Prevotaux <cprevotaux@nltinc.com>
--Tested-by: Christophe Prevotaux <cprevotaux@nltinc.com>
--Tested-by: Eric Bree <ebree@nltinc.com>
--Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
-----
--
----- a/drivers/net/wireless/ath/ath5k/ath5k.h
--+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
--@@ -1283,6 +1283,7 @@ struct ath5k_hw {
-- #define ATH_STAT_PROMISC	1
-- #define ATH_STAT_LEDSOFT	2		/* enable LED gpio status */
-- #define ATH_STAT_STARTED	3		/* opened & irqs enabled */
--+#define ATH_STAT_RESET		4		/* hw reset */
-- 
-- 	unsigned int		filter_flags;	/* HW flags, AR5K_RX_FILTER_* */
-- 	unsigned int		fif_filter_flags; /* Current FIF_* filter flags */
----- a/drivers/net/wireless/ath/ath5k/base.c
--+++ b/drivers/net/wireless/ath/ath5k/base.c
--@@ -1523,6 +1523,9 @@ ath5k_set_current_imask(struct ath5k_hw
-- 	enum ath5k_int imask;
-- 	unsigned long flags;
-- 
--+	if (test_bit(ATH_STAT_RESET, ah->status))
--+		return;
--+
-- 	spin_lock_irqsave(&ah->irqlock, flags);
-- 	imask = ah->imask;
-- 	if (ah->rx_pending)
--@@ -2862,6 +2865,8 @@ ath5k_reset(struct ath5k_hw *ah, struct
-- 
-- 	ATH5K_DBG(ah, ATH5K_DEBUG_RESET, "resetting\n");
-- 
--+	__set_bit(ATH_STAT_RESET, ah->status);
--+
-- 	ath5k_hw_set_imr(ah, 0);
-- 	synchronize_irq(ah->irq);
-- 	ath5k_stop_tasklets(ah);
--@@ -2952,6 +2957,8 @@ ath5k_reset(struct ath5k_hw *ah, struct
-- 	 */
-- /*	ath5k_chan_change(ah, c); */
-- 
--+	__clear_bit(ATH_STAT_RESET, ah->status);
--+
-- 	ath5k_beacon_config(ah);
-- 	/* intrs are enabled by ath5k_beacon_config */
-- 
-diff --git a/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch b/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch
-new file mode 100644
-index 0000000..cf8194a
---- /dev/null
-+++ b/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch
-@@ -0,0 +1,31 @@
-+From: Miaoqing Pan <miaoqing@codeaurora.org>
-+Date: Fri, 15 Jan 2016 18:17:19 +0800
-+Subject: [PATCH] ath9k: do not reset while BB panic(0x4000409) on ar9561
-+
-+BB panic(0x4000409) observed while AP enabling/disabling
-+bursting.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+@@ -2071,7 +2071,8 @@ void ar9003_hw_attach_phy_ops(struct ath
-+  *             to be disabled.
-+  *
-+  * 0x04000409: Packet stuck on receive.
-+- *             Full chip reset is required for all chips except AR9340.
-++ *             Full chip reset is required for all chips except
-++ *	       AR9340, AR9531 and AR9561.
-+  */
-+ 
-+ /*
-+@@ -2100,7 +2101,7 @@ bool ar9003_hw_bb_watchdog_check(struct
-+ 	case 0x04000b09:
-+ 		return true;
-+ 	case 0x04000409:
-+-		if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
-++		if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah))
-+ 			return false;
-+ 		else
-+ 			return true;
-diff --git a/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch b/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch
-new file mode 100644
-index 0000000..80b781c
---- /dev/null
-+++ b/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch
-@@ -0,0 +1,27 @@
-+From: Miaoqing Pan <miaoqing@codeaurora.org>
-+Date: Fri, 15 Jan 2016 18:17:20 +0800
-+Subject: [PATCH] ath9k: fix inconsistent use of tab and space in
-+ indentation
-+
-+Minor changes for indenting.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+@@ -5485,11 +5485,11 @@ unsigned int ar9003_get_paprd_scale_fact
-+ 			  AR9300_PAPRD_SCALE_1);
-+ 	else {
-+ 		if (chan->channel >= 5700)
-+-		return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
-+-			  AR9300_PAPRD_SCALE_1);
-++			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
-++				  AR9300_PAPRD_SCALE_1);
-+ 		else if (chan->channel >= 5400)
-+ 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
-+-				   AR9300_PAPRD_SCALE_2);
-++				  AR9300_PAPRD_SCALE_2);
-+ 		else
-+ 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
-+ 				  AR9300_PAPRD_SCALE_1);
-diff --git a/package/kernel/mac80211/patches/307-ath9k-fix-tracking-of-enabled-AP-beacons.patch b/package/kernel/mac80211/patches/307-ath9k-fix-tracking-of-enabled-AP-beacons.patch
-deleted file mode 100644
-index ab9771e..0000000
---- a/package/kernel/mac80211/patches/307-ath9k-fix-tracking-of-enabled-AP-beacons.patch
-+++ /dev/null
-@@ -1,76 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Thu, 12 Mar 2015 17:10:50 +0100
--Subject: [PATCH] ath9k: fix tracking of enabled AP beacons
--
--sc->nbcnvifs tracks assigned beacon slots, not enabled beacons.
--Therefore, it cannot be used to decide if cur_conf->enable_beacon (bool)
--should be updated, or if beacons have been enabled already.
--With the current code (depending on the order of calls), beacons often
--do not get enabled in an AP+STA setup.
--To fix tracking of enabled beacons, convert cur_conf->enable_beacon to a
--bitmask of enabled beacon slots.
--
--Cc: stable@vger.kernel.org
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/beacon.c
--+++ b/drivers/net/wireless/ath/ath9k/beacon.c
--@@ -219,12 +219,15 @@ void ath9k_beacon_remove_slot(struct ath
-- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-- 	struct ath_vif *avp = (void *)vif->drv_priv;
-- 	struct ath_buf *bf = avp->av_bcbuf;
--+	struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
-- 
-- 	ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
-- 		avp->av_bslot);
-- 
-- 	tasklet_disable(&sc->bcon_tasklet);
-- 
--+	cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
--+
-- 	if (bf && bf->bf_mpdu) {
-- 		struct sk_buff *skb = bf->bf_mpdu;
-- 		dma_unmap_single(sc->dev, bf->bf_buf_addr,
--@@ -521,8 +524,7 @@ static bool ath9k_allow_beacon_config(st
-- 	}
-- 
-- 	if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
---		if ((vif->type != NL80211_IFTYPE_AP) ||
---		    (sc->nbcnvifs > 1)) {
--+		if (vif->type != NL80211_IFTYPE_AP) {
-- 			ath_dbg(common, CONFIG,
-- 				"An AP interface is already present !\n");
-- 			return false;
--@@ -616,12 +618,14 @@ void ath9k_beacon_config(struct ath_soft
-- 	 * enabling/disabling SWBA.
-- 	 */
-- 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
---		if (!bss_conf->enable_beacon &&
---		    (sc->nbcnvifs <= 1)) {
---			cur_conf->enable_beacon = false;
---		} else if (bss_conf->enable_beacon) {
---			cur_conf->enable_beacon = true;
---			ath9k_cache_beacon_config(sc, ctx, bss_conf);
--+		bool enabled = cur_conf->enable_beacon;
--+
--+		if (!bss_conf->enable_beacon) {
--+			cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
--+		} else {
--+			cur_conf->enable_beacon |= BIT(avp->av_bslot);
--+			if (!enabled)
--+				ath9k_cache_beacon_config(sc, ctx, bss_conf);
-- 		}
-- 	}
-- 
----- a/drivers/net/wireless/ath/ath9k/common.h
--+++ b/drivers/net/wireless/ath/ath9k/common.h
--@@ -54,7 +54,7 @@ struct ath_beacon_config {
-- 	u16 dtim_period;
-- 	u16 bmiss_timeout;
-- 	u8 dtim_count;
---	bool enable_beacon;
--+	u8 enable_beacon;
-- 	bool ibss_creator;
-- 	u32 nexttbtt;
-- 	u32 intval;
-diff --git a/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch b/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch
-new file mode 100644
-index 0000000..d408866
---- /dev/null
-+++ b/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch
-@@ -0,0 +1,65 @@
-+From: Miaoqing Pan <miaoqing@codeaurora.org>
-+Date: Fri, 15 Jan 2016 18:17:21 +0800
-+Subject: [PATCH] ath9k: fix data bus error on ar9300 and ar9580
-+
-+One crash issue be found on ar9300: RTC_RC reg read leads crash, leading
-+the data bus error, due to RTC_RC reg write not happen properly.
-+
-+Warm Reset trigger in continuous beacon stuck for one of the customer for
-+other chip, noticed the MAC was stuck in RTC reset. After analysis noticed
-+DMA did not complete when RTC was put in reset.
-+
-+So, before resetting the MAC need to make sure there are no pending DMA
-+transactions because this reset does not reset all parts of the chip.
-+
-+The 12th and 11th bit of MAC _DMA_CFG register used to do that.
-+	12 cfg_halt_ack 0x0
-+		0 DMA has not yet halted
-+		1 DMA has halted
-+	11 cfg_halt_req 0x0
-+		0 DMA logic operates normally
-+		1 Request DMA logic to stop so software can reset the MAC
-+
-+The Bit [12] of this register indicates when the halt has taken effect or
-+not. the DMA halt IS NOT recoverable; once software sets bit [11] to
-+request a DMA halt, software must wait for bit [12] to be set and reset
-+the MAC.
-+
-+So, the same thing we implemented for ar9580 chip.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/hw.c
-++++ b/drivers/net/wireless/ath/ath9k/hw.c
-+@@ -1368,6 +1368,16 @@ static bool ath9k_hw_set_reset(struct at
-+ 	if (ath9k_hw_mci_is_enabled(ah))
-+ 		ar9003_mci_check_gpm_offset(ah);
-+ 
-++	/* DMA HALT added to resolve ar9300 and ar9580 bus error during
-++	 * RTC_RC reg read
-++	 */
-++	if (AR_SREV_9300(ah) || AR_SREV_9580(ah)) {
-++		REG_SET_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
-++		ath9k_hw_wait(ah, AR_CFG, AR_CFG_HALT_ACK, AR_CFG_HALT_ACK,
-++			      20 * AH_WAIT_TIMEOUT);
-++		REG_CLR_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
-++	}
-++
-+ 	REG_WRITE(ah, AR_RTC_RC, rst_flags);
-+ 
-+ 	REGWRITE_BUFFER_FLUSH(ah);
-+--- a/drivers/net/wireless/ath/ath9k/reg.h
-++++ b/drivers/net/wireless/ath/ath9k/reg.h
-+@@ -34,8 +34,10 @@
-+ #define AR_CFG_SWRG          0x00000010
-+ #define AR_CFG_AP_ADHOC_INDICATION 0x00000020
-+ #define AR_CFG_PHOK          0x00000100
-+-#define AR_CFG_CLK_GATE_DIS  0x00000400
-+ #define AR_CFG_EEBS          0x00000200
-++#define AR_CFG_CLK_GATE_DIS  0x00000400
-++#define AR_CFG_HALT_REQ	     0x00000800
-++#define AR_CFG_HALT_ACK	     0x00001000
-+ #define AR_CFG_PCI_MASTER_REQ_Q_THRESH         0x00060000
-+ #define AR_CFG_PCI_MASTER_REQ_Q_THRESH_S       17
-+ 
-diff --git a/package/kernel/mac80211/patches/308-mac80211-minstrel_ht-fix-rounding-issue-in-MCS-durat.patch b/package/kernel/mac80211/patches/308-mac80211-minstrel_ht-fix-rounding-issue-in-MCS-durat.patch
-deleted file mode 100644
-index d132636..0000000
---- a/package/kernel/mac80211/patches/308-mac80211-minstrel_ht-fix-rounding-issue-in-MCS-durat.patch
-+++ /dev/null
-@@ -1,43 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Fri, 13 Mar 2015 10:49:40 +0100
--Subject: [PATCH] mac80211: minstrel_ht: fix rounding issue in MCS duration
-- calculation
--
--On very high MCS bitrates, the calculated duration of rates that are
--next to each other can be very imprecise, due to the small packet size
--used as reference (1200 bytes).
--This is most visible in VHT80 nss=2 MCS8/9, for which minstrel shows the
--same throughput when the probability is also the same. This leads to a
--bad rate selection for such rates.
--
--Fix this issue by introducing an average A-MPDU size factor into the
--calculation.
--
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/net/mac80211/rc80211_minstrel_ht.c
--+++ b/net/mac80211/rc80211_minstrel_ht.c
--@@ -17,10 +17,11 @@
-- #include "rc80211_minstrel.h"
-- #include "rc80211_minstrel_ht.h"
-- 
--+#define AVG_AMPDU_SIZE	16
-- #define AVG_PKT_SIZE	1200
-- 
-- /* Number of bits for an average sized packet */
---#define MCS_NBITS (AVG_PKT_SIZE << 3)
--+#define MCS_NBITS ((AVG_PKT_SIZE * AVG_AMPDU_SIZE) << 3)
-- 
-- /* Number of symbols for a packet with (bps) bits per symbol */
-- #define MCS_NSYMS(bps) DIV_ROUND_UP(MCS_NBITS, (bps))
--@@ -33,7 +34,8 @@
-- 	)
-- 
-- /* Transmit duration for the raw data part of an average sized packet */
---#define MCS_DURATION(streams, sgi, bps) MCS_SYMBOL_TIME(sgi, MCS_NSYMS((streams) * (bps)))
--+#define MCS_DURATION(streams, sgi, bps) \
--+	(MCS_SYMBOL_TIME(sgi, MCS_NSYMS((streams) * (bps))) / AVG_AMPDU_SIZE)
-- 
-- #define BW_20			0
-- #define BW_40			1
-diff --git a/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
-new file mode 100644
-index 0000000..d9511c8
---- /dev/null
-+++ b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
-@@ -0,0 +1,19 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Fri, 15 Jan 2016 15:59:45 +0100
-+Subject: [PATCH] brcmfmac: add missing include
-+
-+linux/module.h is required for defining module parameters
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+@@ -17,6 +17,7 @@
-+ #include <linux/kernel.h>
-+ #include <linux/string.h>
-+ #include <linux/netdevice.h>
-++#include <linux/module.h>
-+ #include <brcmu_wifi.h>
-+ #include <brcmu_utils.h>
-+ #include "core.h"
-diff --git a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
-new file mode 100644
-index 0000000..711e019
---- /dev/null
-+++ b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
-@@ -0,0 +1,118 @@
-+From: Hante Meuleman <meuleman@broadcom.com>
-+Date: Tue, 19 Jan 2016 12:39:24 +0100
-+Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash
-+
-+With commit 7d34b0560567 ("brcmfmac: Move all module parameters to
-+one place") a bug was introduced causing a null pointer exception.
-+This patch fixes the bug by initializing the sg table till after
-+the settings have been initialized.
-+
-+Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place")
-+Reported-by: Marc Zyngier <marc.zyngier@arm.com>
-+Tested-by: Marc Zyngier <marc.zyngier@arm.com>
-+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
-+ 	return 0;
-+ }
-+ 
-+-static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
-++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
-+ {
-++	struct sdio_func *func;
-++	struct mmc_host *host;
-++	uint max_blocks;
-+ 	uint nents;
-+ 	int err;
-+ 
-++	func = sdiodev->func[2];
-++	host = func->card->host;
-++	sdiodev->sg_support = host->max_segs > 1;
-++	max_blocks = min_t(uint, host->max_blk_count, 511u);
-++	sdiodev->max_request_size = min_t(uint, host->max_req_size,
-++					  max_blocks * func->cur_blksize);
-++	sdiodev->max_segment_count = min_t(uint, host->max_segs,
-++					   SG_MAX_SINGLE_ALLOC);
-++	sdiodev->max_segment_size = host->max_seg_size;
-++
-+ 	if (!sdiodev->sg_support)
-+ 		return;
-+ 
-+@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc
-+ 
-+ static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
-+ {
-+-	struct sdio_func *func;
-+-	struct mmc_host *host;
-+-	uint max_blocks;
-+ 	int ret = 0;
-+ 
-+ 	sdiodev->num_funcs = 2;
-+@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm
-+ 		goto out;
-+ 	}
-+ 
-+-	/*
-+-	 * determine host related variables after brcmf_sdiod_probe()
-+-	 * as func->cur_blksize is properly set and F2 init has been
-+-	 * completed successfully.
-+-	 */
-+-	func = sdiodev->func[2];
-+-	host = func->card->host;
-+-	sdiodev->sg_support = host->max_segs > 1;
-+-	max_blocks = min_t(uint, host->max_blk_count, 511u);
-+-	sdiodev->max_request_size = min_t(uint, host->max_req_size,
-+-					  max_blocks * func->cur_blksize);
-+-	sdiodev->max_segment_count = min_t(uint, host->max_segs,
-+-					   SG_MAX_SINGLE_ALLOC);
-+-	sdiodev->max_segment_size = host->max_seg_size;
-+-
-+-	/* allocate scatter-gather table. sg support
-+-	 * will be disabled upon allocation failure.
-+-	 */
-+-	brcmf_sdiod_sgtable_alloc(sdiodev);
-+-
-+ 	ret = brcmf_sdiod_freezer_attach(sdiodev);
-+ 	if (ret)
-+ 		goto out;
-+@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm
-+ 		ret = -ENODEV;
-+ 		goto out;
-+ 	}
-+-	brcmf_sdiod_host_fixup(host);
-++	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
-+ out:
-+ 	if (ret)
-+ 		brcmf_sdiod_remove(sdiodev);
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
-+ 		goto fail;
-+ 	}
-+ 
-++	/* allocate scatter-gather table. sg support
-++	 * will be disabled upon allocation failure.
-++	 */
-++	brcmf_sdiod_sgtable_alloc(bus->sdiodev);
-++
-+ 	/* Query the F2 block size, set roundup accordingly */
-+ 	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
-+ 	bus->roundup = min(max_roundup, bus->blocksize);
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
-+ 
-+ /* Issue an abort to the specified function */
-+ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
-++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
-+ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
-+ 			      enum brcmf_sdiod_state state);
-+ #ifdef CONFIG_PM_SLEEP
-diff --git a/package/kernel/mac80211/patches/309-ath9k-disable-TPC-support-again-for-now.patch b/package/kernel/mac80211/patches/309-ath9k-disable-TPC-support-again-for-now.patch
-deleted file mode 100644
-index 945fbce..0000000
---- a/package/kernel/mac80211/patches/309-ath9k-disable-TPC-support-again-for-now.patch
-+++ /dev/null
-@@ -1,22 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Sun, 15 Mar 2015 08:02:37 +0100
--Subject: [PATCH] ath9k: disable TPC support again (for now)
--
--TPC support has been observed to cause some tx power fluctuations on
--some devices with at least AR934x and AR938x chips.
--Disable it for now until the bugs have been found and fixed
--
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/hw.c
--+++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -424,7 +424,7 @@ static void ath9k_hw_init_defaults(struc
-- 	ah->power_mode = ATH9K_PM_UNDEFINED;
-- 	ah->htc_reset_init = true;
-- 
---	ah->tpc_enabled = true;
--+	ah->tpc_enabled = false;
-- 
-- 	ah->ani_function = ATH9K_ANI_ALL;
-- 	if (!AR_SREV_9300_20_OR_LATER(ah))
-diff --git a/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch b/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
-new file mode 100644
-index 0000000..287d6e1
---- /dev/null
-+++ b/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
-@@ -0,0 +1,38 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 21 Jan 2016 16:28:44 +0100
-+Subject: [PATCH] ath9k_hw: ignore eeprom magic mismatch on flash based devices
-+
-+Many AR913x based devices (maybe others too) do not have a valid EEPROM
-+magic in their calibration data partition.
-+
-+Fixes: 6fa658fd5ab2 ("ath9k: Simplify and fix eeprom endianness swapping")
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/eeprom.c
-++++ b/drivers/net/wireless/ath/ath9k/eeprom.c
-+@@ -150,18 +150,18 @@ int ath9k_hw_nvram_swap_data(struct ath_
-+ 		return -EIO;
-+ 	}
-+ 
-+-	if (magic == AR5416_EEPROM_MAGIC) {
-+-		*swap_needed = false;
-+-	} else if (swab16(magic) == AR5416_EEPROM_MAGIC) {
-++	*swap_needed = false;
-++	if (swab16(magic) == AR5416_EEPROM_MAGIC) {
-+ 		if (ah->ah_flags & AH_NO_EEP_SWAP) {
-+ 			ath_info(common,
-+ 				 "Ignoring endianness difference in EEPROM magic bytes.\n");
-+-
-+-			*swap_needed = false;
-+ 		} else {
-+ 			*swap_needed = true;
-+ 		}
-+-	} else {
-++	} else if (magic != AR5416_EEPROM_MAGIC) {
-++		if (ath9k_hw_use_flash(ah))
-++			return 0;
-++
-+ 		ath_err(common,
-+ 			"Invalid EEPROM Magic (0x%04x).\n", magic);
-+ 		return -EINVAL;
-diff --git a/package/kernel/mac80211/patches/310-mac80211-don-t-look-up-stations-for-multicast-addres.patch b/package/kernel/mac80211/patches/310-mac80211-don-t-look-up-stations-for-multicast-addres.patch
-deleted file mode 100644
-index bd3050e..0000000
---- a/package/kernel/mac80211/patches/310-mac80211-don-t-look-up-stations-for-multicast-addres.patch
-+++ /dev/null
-@@ -1,21 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Tue, 24 Feb 2015 00:28:18 +0100
--Subject: [PATCH] mac80211: don't look up stations for multicast addresses
--
--Since multicast addresses don't exist as stations, don't attempt
--to look them up in the hashtable on TX.
--
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -1161,7 +1161,7 @@ ieee80211_tx_prepare(struct ieee80211_su
-- 		   tx->sdata->control_port_protocol == tx->skb->protocol) {
-- 		tx->sta = sta_info_get_bss(sdata, hdr->addr1);
-- 	}
---	if (!tx->sta)
--+	if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
-- 		tx->sta = sta_info_get(sdata, hdr->addr1);
-- 
-- 	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
-diff --git a/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch b/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch
-new file mode 100644
-index 0000000..070efa9
---- /dev/null
-+++ b/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch
-@@ -0,0 +1,55 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Fri, 22 Jan 2016 01:05:56 +0100
-+Subject: [PATCH] ath9k: do not limit the number of DFS interfaces to 1
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/init.c
-++++ b/drivers/net/wireless/ath/ath9k/init.c
-+@@ -751,14 +751,6 @@ static const struct ieee80211_iface_comb
-+ 
-+ #endif /* CPTCFG_ATH9K_CHANNEL_CONTEXT */
-+ 
-+-static const struct ieee80211_iface_limit if_dfs_limits[] = {
-+-	{ .max = 1,	.types = BIT(NL80211_IFTYPE_AP) |
-+-#ifdef CPTCFG_MAC80211_MESH
-+-				 BIT(NL80211_IFTYPE_MESH_POINT) |
-+-#endif
-+-				 BIT(NL80211_IFTYPE_ADHOC) },
-+-};
-+-
-+ static const struct ieee80211_iface_combination if_comb[] = {
-+ 	{
-+ 		.limits = if_limits,
-+@@ -766,6 +758,11 @@ static const struct ieee80211_iface_comb
-+ 		.max_interfaces = 2048,
-+ 		.num_different_channels = 1,
-+ 		.beacon_int_infra_match = true,
-++#ifdef CPTCFG_ATH9K_DFS_CERTIFIED
-++		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
-++					BIT(NL80211_CHAN_WIDTH_20) |
-++					BIT(NL80211_CHAN_WIDTH_40),
-++#endif
-+ 	},
-+ 	{
-+ 		.limits = wds_limits,
-+@@ -774,18 +771,6 @@ static const struct ieee80211_iface_comb
-+ 		.num_different_channels = 1,
-+ 		.beacon_int_infra_match = true,
-+ 	},
-+-#ifdef CPTCFG_ATH9K_DFS_CERTIFIED
-+-	{
-+-		.limits = if_dfs_limits,
-+-		.n_limits = ARRAY_SIZE(if_dfs_limits),
-+-		.max_interfaces = 1,
-+-		.num_different_channels = 1,
-+-		.beacon_int_infra_match = true,
-+-		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
-+-					BIT(NL80211_CHAN_WIDTH_20) |
-+-					BIT(NL80211_CHAN_WIDTH_40),
-+-	}
-+-#endif
-+ };
-+ 
-+ #ifdef CPTCFG_ATH9K_CHANNEL_CONTEXT
-diff --git a/package/kernel/mac80211/patches/311-mac80211-remove-drop_unencrypted-code.patch b/package/kernel/mac80211/patches/311-mac80211-remove-drop_unencrypted-code.patch
-deleted file mode 100644
-index b2475b9..0000000
---- a/package/kernel/mac80211/patches/311-mac80211-remove-drop_unencrypted-code.patch
-+++ /dev/null
-@@ -1,130 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Fri, 20 Mar 2015 11:41:58 +0100
--Subject: [PATCH] mac80211: remove drop_unencrypted code
--
--This mechanism was historic, and only ever used by IBSS, which
--also doesn't need to have it as it properly manages station's
--802.1X PAE state (or, with WEP, always has a key.)
--
--Remove the mechanism to clean up the code.
--
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/debugfs.c
--+++ b/net/mac80211/debugfs.c
--@@ -274,8 +274,6 @@ void debugfs_hw_add(struct ieee80211_loc
-- #ifdef CPTCFG_MAC80211_DEBUG_COUNTERS
-- 	DEBUGFS_STATS_ADD(tx_handlers_drop, local->tx_handlers_drop);
-- 	DEBUGFS_STATS_ADD(tx_handlers_queued, local->tx_handlers_queued);
---	DEBUGFS_STATS_ADD(tx_handlers_drop_unencrypted,
---		local->tx_handlers_drop_unencrypted);
-- 	DEBUGFS_STATS_ADD(tx_handlers_drop_fragment,
-- 		local->tx_handlers_drop_fragment);
-- 	DEBUGFS_STATS_ADD(tx_handlers_drop_wep,
----- a/net/mac80211/debugfs_netdev.c
--+++ b/net/mac80211/debugfs_netdev.c
--@@ -177,7 +177,6 @@ static ssize_t ieee80211_if_write_##name
-- 	IEEE80211_IF_FILE_R(name)
-- 
-- /* common attributes */
---IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
-- IEEE80211_IF_FILE(rc_rateidx_mask_2ghz, rc_rateidx_mask[IEEE80211_BAND_2GHZ],
-- 		  HEX);
-- IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
--@@ -562,7 +561,6 @@ IEEE80211_IF_FILE(dot11MeshAwakeWindowDu
-- 
-- static void add_common_files(struct ieee80211_sub_if_data *sdata)
-- {
---	DEBUGFS_ADD(drop_unencrypted);
-- 	DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-- 	DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-- 	DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
----- a/net/mac80211/ibss.c
--+++ b/net/mac80211/ibss.c
--@@ -249,8 +249,6 @@ static void __ieee80211_sta_join_ibss(st
-- 	if (presp)
-- 		kfree_rcu(presp, rcu_head);
-- 
---	sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
---
-- 	/* make a copy of the chandef, it could be modified below. */
-- 	chandef = *req_chandef;
-- 	chan = chandef.chan;
--@@ -1289,8 +1287,6 @@ static void ieee80211_sta_create_ibss(st
-- 
-- 	if (ifibss->privacy)
-- 		capability |= WLAN_CAPABILITY_PRIVACY;
---	else
---		sdata->drop_unencrypted = 0;
-- 
-- 	__ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
-- 				  &ifibss->chandef, ifibss->basic_rates,
----- a/net/mac80211/ieee80211_i.h
--+++ b/net/mac80211/ieee80211_i.h
--@@ -842,8 +842,6 @@ struct ieee80211_sub_if_data {
-- 
-- 	unsigned long state;
-- 
---	int drop_unencrypted;
---
-- 	char name[IFNAMSIZ];
-- 
-- 	/* Fragment table for host-based reassembly */
--@@ -1289,7 +1287,6 @@ struct ieee80211_local {
-- 	/* TX/RX handler statistics */
-- 	unsigned int tx_handlers_drop;
-- 	unsigned int tx_handlers_queued;
---	unsigned int tx_handlers_drop_unencrypted;
-- 	unsigned int tx_handlers_drop_fragment;
-- 	unsigned int tx_handlers_drop_wep;
-- 	unsigned int tx_handlers_drop_not_assoc;
----- a/net/mac80211/iface.c
--+++ b/net/mac80211/iface.c
--@@ -1535,7 +1535,6 @@ int ieee80211_if_change_type(struct ieee
-- 	}
-- 
-- 	/* reset some values that shouldn't be kept across type changes */
---	sdata->drop_unencrypted = 0;
-- 	if (type == NL80211_IFTYPE_STATION)
-- 		sdata->u.mgd.use_4addr = false;
-- 
----- a/net/mac80211/rx.c
--+++ b/net/mac80211/rx.c
--@@ -1897,8 +1897,7 @@ static int ieee80211_drop_unencrypted(st
-- 	/* Drop unencrypted frames if key is set. */
-- 	if (unlikely(!ieee80211_has_protected(fc) &&
-- 		     !ieee80211_is_nullfunc(fc) &&
---		     ieee80211_is_data(fc) &&
---		     (rx->key || rx->sdata->drop_unencrypted)))
--+		     ieee80211_is_data(fc) && rx->key))
-- 		return -EACCES;
-- 
-- 	return 0;
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -594,23 +594,8 @@ ieee80211_tx_h_select_key(struct ieee802
-- 	else if (!is_multicast_ether_addr(hdr->addr1) &&
-- 		 (key = rcu_dereference(tx->sdata->default_unicast_key)))
-- 		tx->key = key;
---	else if (info->flags & IEEE80211_TX_CTL_INJECTED)
--+	else
-- 		tx->key = NULL;
---	else if (!tx->sdata->drop_unencrypted)
---		tx->key = NULL;
---	else if (tx->skb->protocol == tx->sdata->control_port_protocol)
---		tx->key = NULL;
---	else if (ieee80211_is_robust_mgmt_frame(tx->skb) &&
---		 !(ieee80211_is_action(hdr->frame_control) &&
---		   tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
---		tx->key = NULL;
---	else if (ieee80211_is_mgmt(hdr->frame_control) &&
---		 !ieee80211_is_robust_mgmt_frame(tx->skb))
---		tx->key = NULL;
---	else {
---		I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
---		return TX_DROP;
---	}
-- 
-- 	if (tx->key) {
-- 		bool skip_hw = false;
-diff --git a/package/kernel/mac80211/patches/312-mac80211-don-t-look-up-destination-station-twice.patch b/package/kernel/mac80211/patches/312-mac80211-don-t-look-up-destination-station-twice.patch
-deleted file mode 100644
-index 02a7fab..0000000
---- a/package/kernel/mac80211/patches/312-mac80211-don-t-look-up-destination-station-twice.patch
-+++ /dev/null
-@@ -1,71 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Fri, 20 Mar 2015 16:24:21 +0100
--Subject: [PATCH] mac80211: don't look up destination station twice
--
--There's no need to look up the destination station twice while
--building the 802.11 header for a given frame if the frame will
--actually be transmitted to the station we initially looked up.
--
--This happens for 4-addr VLAN interfaces and TDLS connections, which
--both directly send the frame to the station they looked up, though
--in the case of TDLS some station conditions need to be checked.
--
--To avoid that, add a variable indicating that we've looked up the
--station that the frame is going to be transmitted to, and avoid the
--lookup/flag checking if it already has been done.
--
--In the TDLS case, also move the authorized/wme_sta flag assignment
--to the correct place, i.e. only when that station is really used.
--Before this change, the new lookup should always have succeeded so
--that the potentially erroneous data would be overwritten.
--
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -1894,6 +1894,7 @@ static struct sk_buff *ieee80211_build_h
-- 	bool wme_sta = false, authorized = false, tdls_auth = false;
-- 	bool tdls_peer = false, tdls_setup_frame = false;
-- 	bool multicast;
--+	bool have_station = false;
-- 	u16 info_id = 0;
-- 	struct ieee80211_chanctx_conf *chanctx_conf;
-- 	struct ieee80211_sub_if_data *ap_sdata;
--@@ -1918,6 +1919,7 @@ static struct sk_buff *ieee80211_build_h
-- 			hdrlen = 30;
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-- 			wme_sta = sta->sta.wme;
--+			have_station = true;
-- 		}
-- 		ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
-- 					u.ap);
--@@ -2034,9 +2036,6 @@ static struct sk_buff *ieee80211_build_h
-- 		if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
-- 			sta = sta_info_get(sdata, skb->data);
-- 			if (sta) {
---				authorized = test_sta_flag(sta,
---							WLAN_STA_AUTHORIZED);
---				wme_sta = sta->sta.wme;
-- 				tdls_peer = test_sta_flag(sta,
-- 							  WLAN_STA_TDLS_PEER);
-- 				tdls_auth = test_sta_flag(sta,
--@@ -2068,6 +2067,9 @@ static struct sk_buff *ieee80211_build_h
-- 			memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-- 			memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
-- 			hdrlen = 24;
--+			have_station = true;
--+			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
--+			wme_sta = sta->sta.wme;
-- 		}  else if (sdata->u.mgd.use_4addr &&
-- 			    cpu_to_be16(ethertype) != sdata->control_port_protocol) {
-- 			fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
--@@ -2130,7 +2132,7 @@ static struct sk_buff *ieee80211_build_h
-- 	 * in AP mode)
-- 	 */
-- 	multicast = is_multicast_ether_addr(hdr.addr1);
---	if (!multicast) {
--+	if (!multicast && !have_station) {
-- 		sta = sta_info_get(sdata, hdr.addr1);
-- 		if (sta) {
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-diff --git a/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch
-new file mode 100644
-index 0000000..61cafc7
---- /dev/null
-+++ b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch
-@@ -0,0 +1,27 @@
-+From: Michal Kazior <michal.kazior@tieto.com>
-+Date: Thu, 21 Jan 2016 14:23:07 +0100
-+Subject: [PATCH] mac80211: fix txq queue related crashes
-+
-+The driver can access the queue simultanously
-+while mac80211 tears down the interface. Without
-+spinlock protection this could lead to corrupting
-+sk_buff_head and subsequently to an invalid
-+pointer dereference.
-+
-+Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation")
-+Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
-+---
-+
-+--- a/net/mac80211/iface.c
-++++ b/net/mac80211/iface.c
-+@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct iee
-+ 	if (sdata->vif.txq) {
-+ 		struct txq_info *txqi = to_txq_info(sdata->vif.txq);
-+ 
-++		spin_lock_bh(&txqi->queue.lock);
-+ 		ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
-++		spin_unlock_bh(&txqi->queue.lock);
-++
-+ 		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
-+ 	}
-+ 
-diff --git a/package/kernel/mac80211/patches/313-mac80211-drop-4-addr-VLAN-frames-earlier-if-not-conn.patch b/package/kernel/mac80211/patches/313-mac80211-drop-4-addr-VLAN-frames-earlier-if-not-conn.patch
-deleted file mode 100644
-index 4125351..0000000
---- a/package/kernel/mac80211/patches/313-mac80211-drop-4-addr-VLAN-frames-earlier-if-not-conn.patch
-+++ /dev/null
-@@ -1,27 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Fri, 20 Mar 2015 16:24:22 +0100
--Subject: [PATCH] mac80211: drop 4-addr VLAN frames earlier if not
-- connected
--
--If there's no station on the 4-addr VLAN interface, then frames
--cannot be transmitted. Drop such frames earlier, before setting
--up all the information for them.
--
--We should keep the old check though since that code might be used
--for other internally-generated frames.
--
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -1920,6 +1920,9 @@ static struct sk_buff *ieee80211_build_h
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-- 			wme_sta = sta->sta.wme;
-- 			have_station = true;
--+		} else if (sdata->wdev.use_4addr) {
--+			ret = -ENOLINK;
--+			goto free;
-- 		}
-- 		ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
-- 					u.ap);
-diff --git a/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch
-new file mode 100644
-index 0000000..844d43b
---- /dev/null
-+++ b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch
-@@ -0,0 +1,57 @@
-+From: Michal Kazior <michal.kazior@tieto.com>
-+Date: Mon, 25 Jan 2016 14:43:24 +0100
-+Subject: [PATCH] mac80211: fix unnecessary frame drops in mesh fwding
-+
-+The ieee80211_queue_stopped() expects hw queue
-+number but it was given raw WMM AC number instead.
-+
-+This could cause frame drops and problems with
-+traffic in some cases - most notably if driver
-+doesn't map AC numbers to queue numbers 1:1 and
-+uses ieee80211_stop_queues() and
-+ieee80211_wake_queue() only without ever calling
-+ieee80211_wake_queues().
-+
-+On ath10k it was possible to hit this problem in
-+the following case:
-+
-+  1. wlan0 uses queue 0
-+     (ath10k maps queues per vif)
-+  2. offchannel uses queue 15
-+  3. queues 1-14 are unused
-+  4. ieee80211_stop_queues()
-+  5. ieee80211_wake_queue(q=0)
-+  6. ieee80211_wake_queue(q=15)
-+     (other queues are not woken up because both
-+      driver and mac80211 know other queues are
-+      unused)
-+  7. ieee80211_rx_h_mesh_fwding()
-+  8. ieee80211_select_queue_80211() returns 2
-+  9. ieee80211_queue_stopped(q=2) returns true
-+ 10. frame is dropped (oops!)
-+
-+Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
-+Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
-+---
-+
-+--- a/net/mac80211/rx.c
-++++ b/net/mac80211/rx.c
-+@@ -2235,7 +2235,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
-+ 	struct ieee80211_local *local = rx->local;
-+ 	struct ieee80211_sub_if_data *sdata = rx->sdata;
-+ 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-+-	u16 q, hdrlen;
-++	u16 ac, q, hdrlen;
-+ 
-+ 	hdr = (struct ieee80211_hdr *) skb->data;
-+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+@@ -2304,7 +2304,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
-+ 	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
-+ 		return RX_CONTINUE;
-+ 
-+-	q = ieee80211_select_queue_80211(sdata, skb, hdr);
-++	ac = ieee80211_select_queue_80211(sdata, skb, hdr);
-++	q = sdata->vif.hw_queue[ac];
-+ 	if (ieee80211_queue_stopped(&local->hw, q)) {
-+ 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
-+ 		return RX_DROP_MONITOR;
-diff --git a/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch
-new file mode 100644
-index 0000000..5b3efbd
---- /dev/null
-+++ b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch
-@@ -0,0 +1,103 @@
-+From: Sachin Kulkarni <Sachin.Kulkarni@imgtec.com>
-+Date: Tue, 12 Jan 2016 14:30:19 +0530
-+Subject: [PATCH] mac80211: Requeue work after scan complete for all VIF
-+ types.
-+
-+During a sw scan ieee80211_iface_work ignores work items for all vifs.
-+However after the scan complete work is requeued only for STA, ADHOC
-+and MESH iftypes.
-+
-+This occasionally results in event processing getting delayed/not
-+processed for iftype AP when it coexists with a STA. This can result
-+in data halt and eventually disconnection on the AP interface.
-+
-+Signed-off-by: Sachin Kulkarni <Sachin.Kulkarni@imgtec.com>
-+Cc: linux-wireless@vger.kernel.org
-+Cc: johannes@sipsolutions.net
-+---
-+
-+--- a/net/mac80211/ibss.c
-++++ b/net/mac80211/ibss.c
-+@@ -1731,7 +1731,6 @@ void ieee80211_ibss_notify_scan_complete
-+ 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
-+ 			continue;
-+ 		sdata->u.ibss.last_scan_completed = jiffies;
-+-		ieee80211_queue_work(&local->hw, &sdata->work);
-+ 	}
-+ 	mutex_unlock(&local->iflist_mtx);
-+ }
-+--- a/net/mac80211/mesh.c
-++++ b/net/mac80211/mesh.c
-+@@ -1369,17 +1369,6 @@ out:
-+ 	sdata_unlock(sdata);
-+ }
-+ 
-+-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
-+-{
-+-	struct ieee80211_sub_if_data *sdata;
-+-
-+-	rcu_read_lock();
-+-	list_for_each_entry_rcu(sdata, &local->interfaces, list)
-+-		if (ieee80211_vif_is_mesh(&sdata->vif) &&
-+-		    ieee80211_sdata_running(sdata))
-+-			ieee80211_queue_work(&local->hw, &sdata->work);
-+-	rcu_read_unlock();
-+-}
-+ 
-+ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
-+ {
-+--- a/net/mac80211/mesh.h
-++++ b/net/mac80211/mesh.h
-+@@ -362,14 +362,10 @@ static inline bool mesh_path_sel_is_hwmp
-+ 	return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
-+ }
-+ 
-+-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
-+-
-+ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
-+ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
-+ void ieee80211s_stop(void);
-+ #else
-+-static inline void
-+-ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
-+ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
-+ { return false; }
-+ static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
-+--- a/net/mac80211/mlme.c
-++++ b/net/mac80211/mlme.c
-+@@ -3978,8 +3978,6 @@ static void ieee80211_restart_sta_timer(
-+ 		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
-+ 			ieee80211_queue_work(&sdata->local->hw,
-+ 					     &sdata->u.mgd.monitor_work);
-+-		/* and do all the other regular work too */
-+-		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
-+ 	}
-+ }
-+ 
-+--- a/net/mac80211/scan.c
-++++ b/net/mac80211/scan.c
-+@@ -314,6 +314,7 @@ static void __ieee80211_scan_completed(s
-+ 	bool was_scanning = local->scanning;
-+ 	struct cfg80211_scan_request *scan_req;
-+ 	struct ieee80211_sub_if_data *scan_sdata;
-++	struct ieee80211_sub_if_data *sdata;
-+ 
-+ 	lockdep_assert_held(&local->mtx);
-+ 
-+@@ -373,7 +374,15 @@ static void __ieee80211_scan_completed(s
-+ 
-+ 	ieee80211_mlme_notify_scan_completed(local);
-+ 	ieee80211_ibss_notify_scan_completed(local);
-+-	ieee80211_mesh_notify_scan_completed(local);
-++
-++	/* Requeue all the work that might have been ignored while
-++	 * the scan was in progress
-++	 */
-++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-++		if (ieee80211_sdata_running(sdata))
-++			ieee80211_queue_work(&sdata->local->hw, &sdata->work);
-++	}
-++
-+ 	if (was_scanning)
-+ 		ieee80211_start_next_roc(local);
-+ }
-diff --git a/package/kernel/mac80211/patches/314-mac80211-mesh-avoid-pointless-station-lookup.patch b/package/kernel/mac80211/patches/314-mac80211-mesh-avoid-pointless-station-lookup.patch
-deleted file mode 100644
-index 9105a64..0000000
---- a/package/kernel/mac80211/patches/314-mac80211-mesh-avoid-pointless-station-lookup.patch
-+++ /dev/null
-@@ -1,33 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Fri, 20 Mar 2015 16:24:23 +0100
--Subject: [PATCH] mac80211: mesh: avoid pointless station lookup
--
--In ieee80211_build_hdr(), the station is looked up to build the
--header correctly (QoS field) and to check for authorization. For
--mesh, authorization isn't checked here, and QoS capability is
--mandatory, so the station lookup can be avoided.
--
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -2130,12 +2130,14 @@ static struct sk_buff *ieee80211_build_h
-- 	}
-- 
-- 	/*
---	 * There's no need to try to look up the destination
---	 * if it is a multicast address (which can only happen
---	 * in AP mode)
--+	 * There's no need to try to look up the destination station
--+	 * if it is a multicast address. In mesh, there's no need to
--+	 * look up the station at all as it always must be QoS capable
--+	 * and mesh mode checks authorization later.
-- 	 */
-- 	multicast = is_multicast_ether_addr(hdr.addr1);
---	if (!multicast && !have_station) {
--+	if (!multicast && !have_station &&
--+	    !ieee80211_vif_is_mesh(&sdata->vif)) {
-- 		sta = sta_info_get(sdata, hdr.addr1);
-- 		if (sta) {
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-diff --git a/package/kernel/mac80211/patches/315-mac80211-avoid-duplicate-TX-path-station-lookup.patch b/package/kernel/mac80211/patches/315-mac80211-avoid-duplicate-TX-path-station-lookup.patch
-deleted file mode 100644
-index d143025..0000000
---- a/package/kernel/mac80211/patches/315-mac80211-avoid-duplicate-TX-path-station-lookup.patch
-+++ /dev/null
-@@ -1,267 +0,0 @@
--From: Johannes Berg <johannes.berg@intel.com>
--Date: Fri, 20 Mar 2015 14:18:27 +0100
--Subject: [PATCH] mac80211: avoid duplicate TX path station lookup
--
--Instead of looking up the destination station twice in the TX path
--(first to build the header, and then for control processing), save
--it when building the header and use it later in the TX path.
--
--To avoid having to look up the station in the many callers, allow
--those to pass %NULL which keeps the existing lookup.
--
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/cfg.c
--+++ b/net/mac80211/cfg.c
--@@ -3565,7 +3565,7 @@ static int ieee80211_probe_client(struct
-- 		nullfunc->qos_ctrl = cpu_to_le16(7);
-- 
-- 	local_bh_disable();
---	ieee80211_xmit(sdata, skb);
--+	ieee80211_xmit(sdata, sta, skb);
-- 	local_bh_enable();
-- 	rcu_read_unlock();
-- 
----- a/net/mac80211/ieee80211_i.h
--+++ b/net/mac80211/ieee80211_i.h
--@@ -1775,7 +1775,8 @@ void mac80211_ev_michael_mic_failure(str
-- 				     gfp_t gfp);
-- void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
-- 			       bool bss_notify);
---void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
--+void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
--+		    struct sta_info *sta, struct sk_buff *skb);
-- 
-- void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
-- 				 struct sk_buff *skb, int tid,
----- a/net/mac80211/sta_info.c
--+++ b/net/mac80211/sta_info.c
--@@ -1279,7 +1279,7 @@ static void ieee80211_send_null_response
-- 	}
-- 
-- 	info->band = chanctx_conf->def.chan->band;
---	ieee80211_xmit(sdata, skb);
--+	ieee80211_xmit(sdata, sta, skb);
-- 	rcu_read_unlock();
-- }
-- 
----- a/net/mac80211/tx.c
--+++ b/net/mac80211/tx.c
--@@ -1110,11 +1110,13 @@ static bool ieee80211_tx_prep_agg(struct
-- 
-- /*
--  * initialises @tx
--+ * pass %NULL for the station if unknown, a valid pointer if known
--+ * or an ERR_PTR() if the station is known not to exist
--  */
-- static ieee80211_tx_result
-- ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
-- 		     struct ieee80211_tx_data *tx,
---		     struct sk_buff *skb)
--+		     struct sta_info *sta, struct sk_buff *skb)
-- {
-- 	struct ieee80211_local *local = sdata->local;
-- 	struct ieee80211_hdr *hdr;
--@@ -1137,17 +1139,22 @@ ieee80211_tx_prepare(struct ieee80211_su
-- 
-- 	hdr = (struct ieee80211_hdr *) skb->data;
-- 
---	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
---		tx->sta = rcu_dereference(sdata->u.vlan.sta);
---		if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
---			return TX_DROP;
---	} else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
---				  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
---		   tx->sdata->control_port_protocol == tx->skb->protocol) {
---		tx->sta = sta_info_get_bss(sdata, hdr->addr1);
--+	if (likely(sta)) {
--+		if (!IS_ERR(sta))
--+			tx->sta = sta;
--+	} else {
--+		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
--+			tx->sta = rcu_dereference(sdata->u.vlan.sta);
--+			if (!tx->sta && sdata->wdev.use_4addr)
--+				return TX_DROP;
--+		} else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
--+					  IEEE80211_TX_CTL_INJECTED) ||
--+			   tx->sdata->control_port_protocol == tx->skb->protocol) {
--+			tx->sta = sta_info_get_bss(sdata, hdr->addr1);
--+		}
--+		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
--+			tx->sta = sta_info_get(sdata, hdr->addr1);
-- 	}
---	if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
---		tx->sta = sta_info_get(sdata, hdr->addr1);
-- 
-- 	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
-- 	    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
--@@ -1485,7 +1492,7 @@ bool ieee80211_tx_prepare_skb(struct iee
-- 	struct ieee80211_tx_data tx;
-- 	struct sk_buff *skb2;
-- 
---	if (ieee80211_tx_prepare(sdata, &tx, skb) == TX_DROP)
--+	if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
-- 		return false;
-- 
-- 	info->band = band;
--@@ -1518,7 +1525,8 @@ EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
--  * Returns false if the frame couldn't be transmitted but was queued instead.
--  */
-- static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
---			 struct sk_buff *skb, bool txpending)
--+			 struct sta_info *sta, struct sk_buff *skb,
--+			 bool txpending)
-- {
-- 	struct ieee80211_local *local = sdata->local;
-- 	struct ieee80211_tx_data tx;
--@@ -1534,7 +1542,7 @@ static bool ieee80211_tx(struct ieee8021
-- 
-- 	/* initialises tx */
-- 	led_len = skb->len;
---	res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
--+	res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
-- 
-- 	if (unlikely(res_prepare == TX_DROP)) {
-- 		ieee80211_free_txskb(&local->hw, skb);
--@@ -1590,7 +1598,8 @@ static int ieee80211_skb_resize(struct i
-- 	return 0;
-- }
-- 
---void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
--+void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
--+		    struct sta_info *sta, struct sk_buff *skb)
-- {
-- 	struct ieee80211_local *local = sdata->local;
-- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--@@ -1625,7 +1634,7 @@ void ieee80211_xmit(struct ieee80211_sub
-- 	}
-- 
-- 	ieee80211_set_qos_hdr(sdata, skb);
---	ieee80211_tx(sdata, skb, false);
--+	ieee80211_tx(sdata, sta, skb, false);
-- }
-- 
-- static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
--@@ -1846,7 +1855,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
-- 		goto fail_rcu;
-- 
-- 	info->band = chandef->chan->band;
---	ieee80211_xmit(sdata, skb);
--+	ieee80211_xmit(sdata, NULL, skb);
-- 	rcu_read_unlock();
-- 
-- 	return NETDEV_TX_OK;
--@@ -1877,7 +1886,8 @@ fail:
--  * Returns: the (possibly reallocated) skb or an ERR_PTR() code
--  */
-- static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
---					   struct sk_buff *skb, u32 info_flags)
--+					   struct sk_buff *skb, u32 info_flags,
--+					   struct sta_info **sta_out)
-- {
-- 	struct ieee80211_local *local = sdata->local;
-- 	struct ieee80211_tx_info *info;
--@@ -1920,6 +1930,7 @@ static struct sk_buff *ieee80211_build_h
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-- 			wme_sta = sta->sta.wme;
-- 			have_station = true;
--+			*sta_out = sta;
-- 		} else if (sdata->wdev.use_4addr) {
-- 			ret = -ENOLINK;
-- 			goto free;
--@@ -2073,6 +2084,7 @@ static struct sk_buff *ieee80211_build_h
-- 			have_station = true;
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-- 			wme_sta = sta->sta.wme;
--+			*sta_out = sta;
-- 		}  else if (sdata->u.mgd.use_4addr &&
-- 			    cpu_to_be16(ethertype) != sdata->control_port_protocol) {
-- 			fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
--@@ -2136,13 +2148,18 @@ static struct sk_buff *ieee80211_build_h
-- 	 * and mesh mode checks authorization later.
-- 	 */
-- 	multicast = is_multicast_ether_addr(hdr.addr1);
---	if (!multicast && !have_station &&
---	    !ieee80211_vif_is_mesh(&sdata->vif)) {
---		sta = sta_info_get(sdata, hdr.addr1);
--+	if (multicast) {
--+		*sta_out = ERR_PTR(-ENOENT);
--+	} else if (!have_station && !ieee80211_vif_is_mesh(&sdata->vif)) {
--+		if (sdata->control_port_protocol == skb->protocol)
--+			sta = sta_info_get_bss(sdata, hdr.addr1);
--+		else
--+			sta = sta_info_get(sdata, hdr.addr1);
-- 		if (sta) {
-- 			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-- 			wme_sta = sta->sta.wme;
-- 		}
--+		*sta_out = sta ?: ERR_PTR(-ENOENT);
-- 	}
-- 
-- 	/* For mesh, the use of the QoS header is mandatory */
--@@ -2320,6 +2337,7 @@ void __ieee80211_subif_start_xmit(struct
-- 				  u32 info_flags)
-- {
-- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
--+	struct sta_info *sta = NULL;
-- 
-- 	if (unlikely(skb->len < ETH_HLEN)) {
-- 		kfree_skb(skb);
--@@ -2328,7 +2346,7 @@ void __ieee80211_subif_start_xmit(struct
-- 
-- 	rcu_read_lock();
-- 
---	skb = ieee80211_build_hdr(sdata, skb, info_flags);
--+	skb = ieee80211_build_hdr(sdata, skb, info_flags, &sta);
-- 	if (IS_ERR(skb))
-- 		goto out;
-- 
--@@ -2336,7 +2354,7 @@ void __ieee80211_subif_start_xmit(struct
-- 	dev->stats.tx_bytes += skb->len;
-- 	dev->trans_start = jiffies;
-- 
---	ieee80211_xmit(sdata, skb);
--+	ieee80211_xmit(sdata, sta, skb);
--  out:
-- 	rcu_read_unlock();
-- }
--@@ -2364,10 +2382,11 @@ ieee80211_build_data_template(struct iee
-- 		.local = sdata->local,
-- 		.sdata = sdata,
-- 	};
--+	struct sta_info *sta_ignore;
-- 
-- 	rcu_read_lock();
-- 
---	skb = ieee80211_build_hdr(sdata, skb, info_flags);
--+	skb = ieee80211_build_hdr(sdata, skb, info_flags, &sta_ignore);
-- 	if (IS_ERR(skb))
-- 		goto out;
-- 
--@@ -2425,7 +2444,7 @@ static bool ieee80211_tx_pending_skb(str
-- 			return true;
-- 		}
-- 		info->band = chanctx_conf->def.chan->band;
---		result = ieee80211_tx(sdata, skb, true);
--+		result = ieee80211_tx(sdata, NULL, skb, true);
-- 	} else {
-- 		struct sk_buff_head skbs;
-- 
--@@ -3163,7 +3182,7 @@ ieee80211_get_buffered_bc(struct ieee802
-- 
-- 		if (sdata->vif.type == NL80211_IFTYPE_AP)
-- 			sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
---		if (!ieee80211_tx_prepare(sdata, &tx, skb))
--+		if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
-- 			break;
-- 		dev_kfree_skb_any(skb);
-- 	}
--@@ -3295,6 +3314,6 @@ void __ieee80211_tx_skb_tid_band(struct
-- 	 */
-- 	local_bh_disable();
-- 	IEEE80211_SKB_CB(skb)->band = band;
---	ieee80211_xmit(sdata, skb);
--+	ieee80211_xmit(sdata, NULL, skb);
-- 	local_bh_enable();
-- }
-diff --git a/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch
-new file mode 100644
-index 0000000..52fecb9
---- /dev/null
-+++ b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch
-@@ -0,0 +1,57 @@
-+From: Sara Sharon <sara.sharon@intel.com>
-+Date: Mon, 25 Jan 2016 15:46:35 +0200
-+Subject: [PATCH] mac80211: fix ibss scan parameters
-+
-+When joining IBSS a full scan should be initiated in order to search
-+for existing cell, unless the fixed_channel parameter was set.
-+A default channel to create the IBSS on if no cell was found is
-+provided as well.
-+However - a scan is initiated only on the default channel provided
-+regardless of whether ifibss->fixed_channel is set or not, with the
-+obvious result of the cell not joining existing IBSS cell that is
-+on another channel.
-+
-+Fixes: 76bed0f43b27 ("mac80211: IBSS fix scan request")
-+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
-+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-+---
-+
-+--- a/net/mac80211/ibss.c
-++++ b/net/mac80211/ibss.c
-+@@ -7,6 +7,7 @@
-+  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
-+  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
-+  * Copyright 2013-2014  Intel Mobile Communications GmbH
-++ * Copyright(c) 2016 Intel Deutschland GmbH
-+  *
-+  * This program is free software; you can redistribute it and/or modify
-+  * it under the terms of the GNU General Public License version 2 as
-+@@ -1483,14 +1484,21 @@ static void ieee80211_sta_find_ibss(stru
-+ 
-+ 		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
-+ 
-+-		num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
-+-							 &ifibss->chandef,
-+-							 channels,
-+-							 ARRAY_SIZE(channels));
-+ 		scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
-+-		ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-+-					    ifibss->ssid_len, channels, num,
-+-					    scan_width);
-++
-++		if (ifibss->fixed_channel) {
-++			num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
-++								 &ifibss->chandef,
-++								 channels,
-++								 ARRAY_SIZE(channels));
-++			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-++						    ifibss->ssid_len, channels,
-++						    num, scan_width);
-++		} else {
-++			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-++						    ifibss->ssid_len, NULL,
-++						    0, scan_width);
-++		}
-+ 	} else {
-+ 		int interval = IEEE80211_SCAN_INTERVAL;
-+ 
-diff --git a/package/kernel/mac80211/patches/316-mac80211-reduce-log-spam-from-ieee80211_handle_pwr_c.patch b/package/kernel/mac80211/patches/316-mac80211-reduce-log-spam-from-ieee80211_handle_pwr_c.patch
-deleted file mode 100644
-index 77a82c2..0000000
---- a/package/kernel/mac80211/patches/316-mac80211-reduce-log-spam-from-ieee80211_handle_pwr_c.patch
-+++ /dev/null
-@@ -1,38 +0,0 @@
--From: John Linville <linville@tuxdriver.com>
--Date: Tue, 31 Mar 2015 10:49:14 -0400
--Subject: [PATCH] mac80211: reduce log spam from ieee80211_handle_pwr_constr
--
--This changes a couple of messages from sdata_info to sdata_dbg.
--This should reduce some log spam, as reported here:
--
--	https://bugzilla.redhat.com/show_bug.cgi?id=1206468
--
--Signed-off-by: John W. Linville <linville@tuxdriver.com>
--Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-----
--
----- a/net/mac80211/mlme.c
--+++ b/net/mac80211/mlme.c
--@@ -1347,15 +1347,15 @@ static u32 ieee80211_handle_pwr_constr(s
-- 	 */
-- 	if (has_80211h_pwr &&
-- 	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
---		sdata_info(sdata,
---			   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
---			   pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
---			   sdata->u.mgd.bssid);
--+		sdata_dbg(sdata,
--+			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
--+			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
--+			  sdata->u.mgd.bssid);
-- 		new_ap_level = pwr_level_80211h;
-- 	} else {  /* has_cisco_pwr is always true here. */
---		sdata_info(sdata,
---			   "Limiting TX power to %d dBm as advertised by %pM\n",
---			   pwr_level_cisco, sdata->u.mgd.bssid);
--+		sdata_dbg(sdata,
--+			  "Limiting TX power to %d dBm as advertised by %pM\n",
--+			  pwr_level_cisco, sdata->u.mgd.bssid);
-- 		new_ap_level = pwr_level_cisco;
-- 	}
-- 
-diff --git a/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch
-new file mode 100644
-index 0000000..e78df36
---- /dev/null
-+++ b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch
-@@ -0,0 +1,50 @@
-+From: Chris Bainbridge <chris.bainbridge@gmail.com>
-+Date: Wed, 27 Jan 2016 15:46:18 +0000
-+Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values
-+
-+Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes:
-+
-+[    7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
-+[    7.976608] load of value 2 is not a valid value for type '_Bool'
-+[    7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
-+[    7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015
-+[    7.976616] Workqueue: phy0 rt2x00usb_work_rxdone
-+[    7.976619]  0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
-+[    7.976622]  ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
-+[    7.976626]  ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
-+[    7.976629] Call Trace:
-+[    7.976633]  [<ffffffff8181d866>] dump_stack+0x45/0x5f
-+[    7.976637]  [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
-+[    7.976642]  [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
-+[    7.976646]  [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
-+[    7.976650]  [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
-+[    7.976654]  [<ffffffff81cb27ce>] ? usb_hcd_map_urb_for_dma+0x65e/0x960
-+[    7.976659]  [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
-+[    7.976663]  [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990
-+[    7.976667]  [<ffffffff81c5fb85>] rt2x00lib_rxdone+0x305/0xbd0
-+[    7.976670]  [<ffffffff811ac23f>] ? dequeue_task_fair+0x64f/0x1de0
-+[    7.976674]  [<ffffffff811a1516>] ? sched_clock_cpu+0xe6/0x150
-+[    7.976678]  [<ffffffff81c6c45c>] rt2x00usb_work_rxdone+0x7c/0x140
-+[    7.976682]  [<ffffffff8117aef6>] process_one_work+0x226/0x860
-+[    7.976686]  [<ffffffff8117b58c>] worker_thread+0x5c/0x680
-+[    7.976690]  [<ffffffff8117b530>] ? process_one_work+0x860/0x860
-+[    7.976693]  [<ffffffff81184f86>] kthread+0xf6/0x150
-+[    7.976697]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
-+[    7.976700]  [<ffffffff822a94df>] ret_from_fork+0x3f/0x70
-+[    7.976703]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
-+
-+Link: https://lkml.org/lkml/2016/1/26/230
-+Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
-+---
-+
-+--- a/net/mac80211/agg-rx.c
-++++ b/net/mac80211/agg-rx.c
-+@@ -327,7 +327,7 @@ void __ieee80211_start_rx_ba_session(str
-+ 	}
-+ 
-+ 	/* prepare A-MPDU MLME for Rx aggregation */
-+-	tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
-++	tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
-+ 	if (!tid_agg_rx)
-+ 		goto end;
-+ 
-diff --git a/package/kernel/mac80211/patches/317-brcmfmac-Fix-race-condition-in-msgbuf-ioctl-processi.patch b/package/kernel/mac80211/patches/317-brcmfmac-Fix-race-condition-in-msgbuf-ioctl-processi.patch
-deleted file mode 100644
-index e005fe7..0000000
---- a/package/kernel/mac80211/patches/317-brcmfmac-Fix-race-condition-in-msgbuf-ioctl-processi.patch
-+++ /dev/null
-@@ -1,35 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 6 Mar 2015 18:40:41 +0100
--Subject: [PATCH] brcmfmac: Fix race condition in msgbuf ioctl processing.
--
--Msgbuf is using a wait_event_timeout to wait for the response on
--an ioctl. The wakeup routine uses waitqueue_active to see if
--wait_event_timeout has been called. There is a chance that the
--response arrives before wait_event_timeout is called, this
--will result in situation that wait_event_timeout never gets
--woken again and assumed result will be a timeout. This patch
--removes that errornous situation by always setting the
--ctl_completed var before checking for queue active.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -481,10 +481,9 @@ static int brcmf_msgbuf_ioctl_resp_wait(
-- 
-- static void brcmf_msgbuf_ioctl_resp_wake(struct brcmf_msgbuf *msgbuf)
-- {
---	if (waitqueue_active(&msgbuf->ioctl_resp_wait)) {
---		msgbuf->ctl_completed = true;
--+	msgbuf->ctl_completed = true;
--+	if (waitqueue_active(&msgbuf->ioctl_resp_wait))
-- 		wake_up(&msgbuf->ioctl_resp_wait);
---	}
-- }
-- 
-- 
-diff --git a/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch b/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch
-new file mode 100644
-index 0000000..5bf53b9
---- /dev/null
-+++ b/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch
-@@ -0,0 +1,45 @@
-+From: Konstantin Khlebnikov <koct9i@gmail.com>
-+Date: Fri, 29 Jan 2016 11:35:12 +0300
-+Subject: [PATCH] mac80211: minstrel_ht: fix out-of-bound in
-+ minstrel_ht_set_best_prob_rate
-+
-+Patch fixes this splat
-+
-+BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
-+[mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
-+
-+Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
-+Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com
-+---
-+
-+--- a/net/mac80211/rc80211_minstrel_ht.c
-++++ b/net/mac80211/rc80211_minstrel_ht.c
-+@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct mi
-+ 	    (max_tp_group != MINSTREL_CCK_GROUP))
-+ 		return;
-+ 
-++	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
-++	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-++	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
-++
-+ 	if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
-+ 		cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
-+ 						    mrs->prob_ewma);
-+ 		if (cur_tp_avg > tmp_tp_avg)
-+ 			mi->max_prob_rate = index;
-+ 
-+-		max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
-+-		max_gpr_idx = mg->max_group_prob_rate %	MCS_GROUP_RATES;
-+-		max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
-+ 		max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
-+ 							max_gpr_idx,
-+ 							max_gpr_prob);
-+@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct mi
-+ 	} else {
-+ 		if (mrs->prob_ewma > tmp_prob)
-+ 			mi->max_prob_rate = index;
-+-		if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
-++		if (mrs->prob_ewma > max_gpr_prob)
-+ 			mg->max_group_prob_rate = index;
-+ 	}
-+ }
-diff --git a/package/kernel/mac80211/patches/318-brcmfmac-Update-msgbuf-commonring-size-for-improved-.patch b/package/kernel/mac80211/patches/318-brcmfmac-Update-msgbuf-commonring-size-for-improved-.patch
-deleted file mode 100644
-index c2cd1c5..0000000
---- a/package/kernel/mac80211/patches/318-brcmfmac-Update-msgbuf-commonring-size-for-improved-.patch
-+++ /dev/null
-@@ -1,30 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:23 +0100
--Subject: [PATCH] brcmfmac: Update msgbuf commonring size for improved
-- throughput.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
--@@ -17,11 +17,11 @@
-- 
-- #ifdef CPTCFG_BRCMFMAC_PROTO_MSGBUF
-- 
---#define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_MAX_ITEM	20
---#define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_MAX_ITEM	256
---#define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_MAX_ITEM	20
--+#define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_MAX_ITEM	64
--+#define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_MAX_ITEM	512
--+#define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_MAX_ITEM	64
-- #define BRCMF_D2H_MSGRING_TX_COMPLETE_MAX_ITEM		1024
---#define BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM		256
--+#define BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM		512
-- #define BRCMF_H2D_TXFLOWRING_MAX_ITEM			512
-- 
-- #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE	40
-diff --git a/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch b/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch
-new file mode 100644
-index 0000000..655dc4b
---- /dev/null
-+++ b/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch
-@@ -0,0 +1,35 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Tue, 2 Feb 2016 14:39:08 +0100
-+Subject: [PATCH] mac80211: move A-MSDU skb_linearize call to
-+ ieee80211_amsdu_to_8023s
-+
-+Prepararation for zero-copy A-MSDU support with page fragment SKBs
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/mac80211/rx.c
-++++ b/net/mac80211/rx.c
-+@@ -2203,9 +2203,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
-+ 	skb->dev = dev;
-+ 	__skb_queue_head_init(&frame_list);
-+ 
-+-	if (skb_linearize(skb))
-+-		return RX_DROP_UNUSABLE;
-+-
-+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
-+ 				 rx->sdata->vif.type,
-+ 				 rx->local->hw.extra_tx_headroom, true);
-+--- a/net/wireless/util.c
-++++ b/net/wireless/util.c
-+@@ -657,6 +657,9 @@ void ieee80211_amsdu_to_8023s(struct sk_
-+ 	int remaining, err;
-+ 	u8 dst[ETH_ALEN], src[ETH_ALEN];
-+ 
-++	if (skb_linearize(skb))
-++		goto out;
-++
-+ 	if (has_80211_header) {
-+ 		err = ieee80211_data_to_8023(skb, addr, iftype);
-+ 		if (err)
-diff --git a/package/kernel/mac80211/patches/319-ath9k_htc-add-new-WMI_REG_RMW_CMDID-command.patch b/package/kernel/mac80211/patches/319-ath9k_htc-add-new-WMI_REG_RMW_CMDID-command.patch
-deleted file mode 100644
-index 6af69eb..0000000
---- a/package/kernel/mac80211/patches/319-ath9k_htc-add-new-WMI_REG_RMW_CMDID-command.patch
-+++ /dev/null
-@@ -1,307 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:46 +0100
--Subject: [PATCH] ath9k_htc: add new WMI_REG_RMW_CMDID command
--
--Since usb bus add extra delay on each request, a command
--with read + write requests is too expensive. We can dramtically
--reduce usb load by moving this command to firmware.
--
--In my tests, this patch will reduce channel scan time
--for about 5-10 seconds.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath.h
--+++ b/drivers/net/wireless/ath/ath.h
--@@ -131,6 +131,9 @@ struct ath_ops {
-- 	void (*enable_write_buffer)(void *);
-- 	void (*write_flush) (void *);
-- 	u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
--+	void (*enable_rmw_buffer)(void *);
--+	void (*rmw_flush) (void *);
--+
-- };
-- 
-- struct ath_common;
----- a/drivers/net/wireless/ath/ath9k/htc.h
--+++ b/drivers/net/wireless/ath/ath9k/htc.h
--@@ -444,6 +444,10 @@ static inline void ath9k_htc_stop_btcoex
-- #define OP_BT_SCAN                 BIT(4)
-- #define OP_TSF_RESET               BIT(6)
-- 
--+enum htc_op_flags {
--+	HTC_FWFLAG_NO_RMW,
--+};
--+
-- struct ath9k_htc_priv {
-- 	struct device *dev;
-- 	struct ieee80211_hw *hw;
--@@ -482,6 +486,7 @@ struct ath9k_htc_priv {
-- 	bool reconfig_beacon;
-- 	unsigned int rxfilter;
-- 	unsigned long op_flags;
--+	unsigned long fw_flags;
-- 
-- 	struct ath9k_hw_cal_data caldata;
-- 	struct ath_spec_scan_priv spec_priv;
----- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
--+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
--@@ -376,17 +376,139 @@ static void ath9k_regwrite_flush(void *h
-- 	mutex_unlock(&priv->wmi->multi_write_mutex);
-- }
-- 
---static u32 ath9k_reg_rmw(void *hw_priv, u32 reg_offset, u32 set, u32 clr)
--+static void ath9k_reg_rmw_buffer(void *hw_priv,
--+				 u32 reg_offset, u32 set, u32 clr)
--+{
--+	struct ath_hw *ah = (struct ath_hw *) hw_priv;
--+	struct ath_common *common = ath9k_hw_common(ah);
--+	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
--+	u32 rsp_status;
--+	int r;
--+
--+	mutex_lock(&priv->wmi->multi_rmw_mutex);
--+
--+	/* Store the register/value */
--+	priv->wmi->multi_rmw[priv->wmi->multi_rmw_idx].reg =
--+		cpu_to_be32(reg_offset);
--+	priv->wmi->multi_rmw[priv->wmi->multi_rmw_idx].set =
--+		cpu_to_be32(set);
--+	priv->wmi->multi_rmw[priv->wmi->multi_rmw_idx].clr =
--+		cpu_to_be32(clr);
--+
--+	priv->wmi->multi_rmw_idx++;
--+
--+	/* If the buffer is full, send it out. */
--+	if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) {
--+		r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
--+			  (u8 *) &priv->wmi->multi_rmw,
--+			  sizeof(struct register_write) * priv->wmi->multi_rmw_idx,
--+			  (u8 *) &rsp_status, sizeof(rsp_status),
--+			  100);
--+		if (unlikely(r)) {
--+			ath_dbg(common, WMI,
--+				"REGISTER RMW FAILED, multi len: %d\n",
--+				priv->wmi->multi_rmw_idx);
--+		}
--+		priv->wmi->multi_rmw_idx = 0;
--+	}
--+
--+	mutex_unlock(&priv->wmi->multi_rmw_mutex);
--+}
--+
--+static void ath9k_reg_rmw_flush(void *hw_priv)
-- {
---	u32 val;
--+	struct ath_hw *ah = (struct ath_hw *) hw_priv;
--+	struct ath_common *common = ath9k_hw_common(ah);
--+	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
--+	u32 rsp_status;
--+	int r;
--+
--+	if (test_bit(HTC_FWFLAG_NO_RMW, &priv->fw_flags))
--+		return;
--+
--+	atomic_dec(&priv->wmi->m_rmw_cnt);
--+
--+	mutex_lock(&priv->wmi->multi_rmw_mutex);
--+
--+	if (priv->wmi->multi_rmw_idx) {
--+		r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
--+			  (u8 *) &priv->wmi->multi_rmw,
--+			  sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx,
--+			  (u8 *) &rsp_status, sizeof(rsp_status),
--+			  100);
--+		if (unlikely(r)) {
--+			ath_dbg(common, WMI,
--+				"REGISTER RMW FAILED, multi len: %d\n",
--+				priv->wmi->multi_rmw_idx);
--+		}
--+		priv->wmi->multi_rmw_idx = 0;
--+	}
-- 
---	val = ath9k_regread(hw_priv, reg_offset);
---	val &= ~clr;
---	val |= set;
---	ath9k_regwrite(hw_priv, val, reg_offset);
--+	mutex_unlock(&priv->wmi->multi_rmw_mutex);
--+}
--+
--+static void ath9k_enable_rmw_buffer(void *hw_priv)
--+{
--+	struct ath_hw *ah = (struct ath_hw *) hw_priv;
--+	struct ath_common *common = ath9k_hw_common(ah);
--+	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
--+
--+	if (test_bit(HTC_FWFLAG_NO_RMW, &priv->fw_flags))
--+		return;
--+
--+	atomic_inc(&priv->wmi->m_rmw_cnt);
--+}
--+
--+static u32 ath9k_reg_rmw_single(void *hw_priv,
--+				 u32 reg_offset, u32 set, u32 clr)
--+{
--+	struct ath_hw *ah = (struct ath_hw *) hw_priv;
--+	struct ath_common *common = ath9k_hw_common(ah);
--+	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
--+	struct register_rmw buf, buf_ret;
--+	int ret;
--+	u32 val = 0;
--+
--+	buf.reg = cpu_to_be32(reg_offset);
--+	buf.set = cpu_to_be32(set);
--+	buf.clr = cpu_to_be32(clr);
--+
--+	ret = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
--+			  (u8 *) &buf, sizeof(buf),
--+			  (u8 *) &buf_ret, sizeof(buf_ret),
--+			  100);
--+	if (unlikely(ret)) {
--+		ath_dbg(common, WMI, "REGISTER RMW FAILED:(0x%04x, %d)\n",
--+			reg_offset, ret);
--+	}
-- 	return val;
-- }
-- 
--+static u32 ath9k_reg_rmw(void *hw_priv, u32 reg_offset, u32 set, u32 clr)
--+{
--+	struct ath_hw *ah = (struct ath_hw *) hw_priv;
--+	struct ath_common *common = ath9k_hw_common(ah);
--+	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
--+
--+	if (test_bit(HTC_FWFLAG_NO_RMW, &priv->fw_flags)) {
--+		u32 val;
--+
--+		val = REG_READ(ah, reg_offset);
--+		val &= ~clr;
--+		val |= set;
--+		REG_WRITE(ah, reg_offset, val);
--+
--+		return 0;
--+	}
--+
--+	if (atomic_read(&priv->wmi->m_rmw_cnt))
--+		ath9k_reg_rmw_buffer(hw_priv, reg_offset, set, clr);
--+	else
--+		ath9k_reg_rmw_single(hw_priv, reg_offset, set, clr);
--+
--+	return 0;
--+}
--+
-- static void ath_usb_read_cachesize(struct ath_common *common, int *csz)
-- {
-- 	*csz = L1_CACHE_BYTES >> 2;
--@@ -501,6 +623,8 @@ static int ath9k_init_priv(struct ath9k_
-- 	ah->reg_ops.write = ath9k_regwrite;
-- 	ah->reg_ops.enable_write_buffer = ath9k_enable_regwrite_buffer;
-- 	ah->reg_ops.write_flush = ath9k_regwrite_flush;
--+	ah->reg_ops.enable_rmw_buffer = ath9k_enable_rmw_buffer;
--+	ah->reg_ops.rmw_flush = ath9k_reg_rmw_flush;
-- 	ah->reg_ops.rmw = ath9k_reg_rmw;
-- 	priv->ah = ah;
-- 
--@@ -686,6 +810,12 @@ static int ath9k_init_firmware_version(s
-- 		return -EINVAL;
-- 	}
-- 
--+	if (priv->fw_version_major == 1 && priv->fw_version_minor < 4)
--+		set_bit(HTC_FWFLAG_NO_RMW, &priv->fw_flags);
--+
--+	dev_info(priv->dev, "FW RMW support: %s\n",
--+		test_bit(HTC_FWFLAG_NO_RMW, &priv->fw_flags) ? "Off" : "On");
--+
-- 	return 0;
-- }
-- 
----- a/drivers/net/wireless/ath/ath9k/hw.h
--+++ b/drivers/net/wireless/ath/ath9k/hw.h
--@@ -100,6 +100,18 @@
-- 			(_ah)->reg_ops.write_flush((_ah));	\
-- 	} while (0)
-- 
--+#define ENABLE_REG_RMW_BUFFER(_ah)					\
--+	do {								\
--+		if ((_ah)->reg_ops.enable_rmw_buffer)	\
--+			(_ah)->reg_ops.enable_rmw_buffer((_ah)); \
--+	} while (0)
--+
--+#define REG_RMW_BUFFER_FLUSH(_ah)					\
--+	do {								\
--+		if ((_ah)->reg_ops.rmw_flush)		\
--+			(_ah)->reg_ops.rmw_flush((_ah));	\
--+	} while (0)
--+
-- #define PR_EEP(_s, _val)						\
-- 	do {								\
-- 		len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
----- a/drivers/net/wireless/ath/ath9k/wmi.c
--+++ b/drivers/net/wireless/ath/ath9k/wmi.c
--@@ -61,6 +61,8 @@ static const char *wmi_cmd_to_name(enum
-- 		return "WMI_REG_READ_CMDID";
-- 	case WMI_REG_WRITE_CMDID:
-- 		return "WMI_REG_WRITE_CMDID";
--+	case WMI_REG_RMW_CMDID:
--+		return "WMI_REG_RMW_CMDID";
-- 	case WMI_RC_STATE_CHANGE_CMDID:
-- 		return "WMI_RC_STATE_CHANGE_CMDID";
-- 	case WMI_RC_RATE_UPDATE_CMDID:
--@@ -101,6 +103,7 @@ struct wmi *ath9k_init_wmi(struct ath9k_
-- 	spin_lock_init(&wmi->event_lock);
-- 	mutex_init(&wmi->op_mutex);
-- 	mutex_init(&wmi->multi_write_mutex);
--+	mutex_init(&wmi->multi_rmw_mutex);
-- 	init_completion(&wmi->cmd_wait);
-- 	INIT_LIST_HEAD(&wmi->pending_tx_events);
-- 	tasklet_init(&wmi->wmi_event_tasklet, ath9k_wmi_event_tasklet,
----- a/drivers/net/wireless/ath/ath9k/wmi.h
--+++ b/drivers/net/wireless/ath/ath9k/wmi.h
--@@ -112,6 +112,7 @@ enum wmi_cmd_id {
-- 	WMI_TX_STATS_CMDID,
-- 	WMI_RX_STATS_CMDID,
-- 	WMI_BITRATE_MASK_CMDID,
--+	WMI_REG_RMW_CMDID,
-- };
-- 
-- enum wmi_event_id {
--@@ -125,12 +126,19 @@ enum wmi_event_id {
-- };
-- 
-- #define MAX_CMD_NUMBER 62
--+#define MAX_RMW_CMD_NUMBER 15
-- 
-- struct register_write {
-- 	__be32 reg;
-- 	__be32 val;
-- };
-- 
--+struct register_rmw {
--+	__be32 reg;
--+	__be32 set;
--+	__be32 clr;
--+} __packed;
--+
-- struct ath9k_htc_tx_event {
-- 	int count;
-- 	struct __wmi_event_txstatus txs;
--@@ -156,10 +164,18 @@ struct wmi {
-- 
-- 	spinlock_t wmi_lock;
-- 
--+	/* multi write section */
-- 	atomic_t mwrite_cnt;
-- 	struct register_write multi_write[MAX_CMD_NUMBER];
-- 	u32 multi_write_idx;
-- 	struct mutex multi_write_mutex;
--+
--+	/* multi rmw section */
--+	atomic_t m_rmw_cnt;
--+	struct register_rmw multi_rmw[MAX_RMW_CMD_NUMBER];
--+	u32 multi_rmw_idx;
--+	struct mutex multi_rmw_mutex;
--+
-- };
-- 
-- struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv);
-diff --git a/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch b/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch
-new file mode 100644
-index 0000000..b646ab3
---- /dev/null
-+++ b/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch
-@@ -0,0 +1,186 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Tue, 2 Feb 2016 14:39:09 +0100
-+Subject: [PATCH] cfg80211: add function for 802.3 conversion with separate
-+ output buffer
-+
-+Use skb_copy_bits in preparation for allowing fragmented skbs
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/wireless/util.c
-++++ b/net/wireless/util.c
-+@@ -393,9 +393,9 @@ unsigned int ieee80211_get_hdrlen_from_s
-+ }
-+ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
-+ 
-+-unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
-++static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
-+ {
-+-	int ae = meshhdr->flags & MESH_FLAGS_AE;
-++	int ae = flags & MESH_FLAGS_AE;
-+ 	/* 802.11-2012, 8.2.4.7.3 */
-+ 	switch (ae) {
-+ 	default:
-+@@ -407,21 +407,31 @@ unsigned int ieee80211_get_mesh_hdrlen(s
-+ 		return 18;
-+ 	}
-+ }
-++
-++unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
-++{
-++	return __ieee80211_get_mesh_hdrlen(meshhdr->flags);
-++}
-+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
-+ 
-+-int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
-+-			   enum nl80211_iftype iftype)
-++static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr,
-++				    const u8 *addr, enum nl80211_iftype iftype)
-+ {
-+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-+-	u16 hdrlen, ethertype;
-+-	u8 *payload;
-+-	u8 dst[ETH_ALEN];
-+-	u8 src[ETH_ALEN] __aligned(2);
-++	struct {
-++		u8 hdr[ETH_ALEN] __aligned(2);
-++		__be16 proto;
-++	} payload;
-++	struct ethhdr tmp;
-++	u16 hdrlen;
-++	u8 mesh_flags = 0;
-+ 
-+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
-+ 		return -1;
-+ 
-+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-++	if (skb->len < hdrlen + 8)
-++		return -1;
-+ 
-+ 	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
-+ 	 * header
-+@@ -432,8 +442,11 @@ int ieee80211_data_to_8023(struct sk_buf
-+ 	 *   1     0   BSSID SA    DA    n/a
-+ 	 *   1     1   RA    TA    DA    SA
-+ 	 */
-+-	memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
-+-	memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
-++	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
-++	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
-++
-++	if (iftype == NL80211_IFTYPE_MESH_POINT)
-++		skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
-+ 
-+ 	switch (hdr->frame_control &
-+ 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-+@@ -450,44 +463,31 @@ int ieee80211_data_to_8023(struct sk_buf
-+ 			     iftype != NL80211_IFTYPE_STATION))
-+ 			return -1;
-+ 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
-+-			struct ieee80211s_hdr *meshdr =
-+-				(struct ieee80211s_hdr *) (skb->data + hdrlen);
-+-			/* make sure meshdr->flags is on the linear part */
-+-			if (!pskb_may_pull(skb, hdrlen + 1))
-+-				return -1;
-+-			if (meshdr->flags & MESH_FLAGS_AE_A4)
-++			if (mesh_flags & MESH_FLAGS_AE_A4)
-+ 				return -1;
-+-			if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
-++			if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
-+ 				skb_copy_bits(skb, hdrlen +
-+ 					offsetof(struct ieee80211s_hdr, eaddr1),
-+-				       	dst, ETH_ALEN);
-+-				skb_copy_bits(skb, hdrlen +
-+-					offsetof(struct ieee80211s_hdr, eaddr2),
-+-				        src, ETH_ALEN);
-++					tmp.h_dest, 2 * ETH_ALEN);
-+ 			}
-+-			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
-++			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
-+ 		}
-+ 		break;
-+ 	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
-+ 		if ((iftype != NL80211_IFTYPE_STATION &&
-+ 		     iftype != NL80211_IFTYPE_P2P_CLIENT &&
-+ 		     iftype != NL80211_IFTYPE_MESH_POINT) ||
-+-		    (is_multicast_ether_addr(dst) &&
-+-		     ether_addr_equal(src, addr)))
-++		    (is_multicast_ether_addr(tmp.h_dest) &&
-++		     ether_addr_equal(tmp.h_source, addr)))
-+ 			return -1;
-+ 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
-+-			struct ieee80211s_hdr *meshdr =
-+-				(struct ieee80211s_hdr *) (skb->data + hdrlen);
-+-			/* make sure meshdr->flags is on the linear part */
-+-			if (!pskb_may_pull(skb, hdrlen + 1))
-+-				return -1;
-+-			if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
-++			if (mesh_flags & MESH_FLAGS_AE_A5_A6)
-+ 				return -1;
-+-			if (meshdr->flags & MESH_FLAGS_AE_A4)
-++			if (mesh_flags & MESH_FLAGS_AE_A4)
-+ 				skb_copy_bits(skb, hdrlen +
-+ 					offsetof(struct ieee80211s_hdr, eaddr1),
-+-					src, ETH_ALEN);
-+-			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
-++					tmp.h_source, ETH_ALEN);
-++			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
-+ 		}
-+ 		break;
-+ 	case cpu_to_le16(0):
-+@@ -498,33 +498,33 @@ int ieee80211_data_to_8023(struct sk_buf
-+ 		break;
-+ 	}
-+ 
-+-	if (!pskb_may_pull(skb, hdrlen + 8))
-+-		return -1;
-+-
-+-	payload = skb->data + hdrlen;
-+-	ethertype = (payload[6] << 8) | payload[7];
-++	skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
-++	tmp.h_proto = payload.proto;
-+ 
-+-	if (likely((ether_addr_equal(payload, rfc1042_header) &&
-+-		    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-+-		   ether_addr_equal(payload, bridge_tunnel_header))) {
-++	if (likely((ether_addr_equal(payload.hdr, rfc1042_header) &&
-++		    tmp.h_proto != htons(ETH_P_AARP) &&
-++		    tmp.h_proto != htons(ETH_P_IPX)) ||
-++		   ether_addr_equal(payload.hdr, bridge_tunnel_header)))
-+ 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
-+ 		 * replace EtherType */
-+-		skb_pull(skb, hdrlen + 6);
-+-		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-+-		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-+-	} else {
-+-		struct ethhdr *ehdr;
-+-		__be16 len;
-++		hdrlen += ETH_ALEN + 2;
-++	else
-++		tmp.h_proto = htons(skb->len);
-+ 
-+-		skb_pull(skb, hdrlen);
-+-		len = htons(skb->len);
-++	pskb_pull(skb, hdrlen);
-++
-++	if (!ehdr)
-+ 		ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
-+-		memcpy(ehdr->h_dest, dst, ETH_ALEN);
-+-		memcpy(ehdr->h_source, src, ETH_ALEN);
-+-		ehdr->h_proto = len;
-+-	}
-++	memcpy(ehdr, &tmp, sizeof(tmp));
-++
-+ 	return 0;
-+ }
-++
-++int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
-++			   enum nl80211_iftype iftype)
-++{
-++	return __ieee80211_data_to_8023(skb, NULL, addr, iftype);
-++}
-+ EXPORT_SYMBOL(ieee80211_data_to_8023);
-+ 
-+ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
-diff --git a/package/kernel/mac80211/patches/320-ath9k-ar9271_hw_pa_cal-use-defs-instead-of-magin-num.patch b/package/kernel/mac80211/patches/320-ath9k-ar9271_hw_pa_cal-use-defs-instead-of-magin-num.patch
-deleted file mode 100644
-index c4dd1af..0000000
---- a/package/kernel/mac80211/patches/320-ath9k-ar9271_hw_pa_cal-use-defs-instead-of-magin-num.patch
-+++ /dev/null
-@@ -1,89 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:47 +0100
--Subject: [PATCH] ath9k: ar9271_hw_pa_cal - use defs instead of magin
-- numbers
--
--This function uses mixed styles for register names/numbers which
--is make harder reading and optimisation.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--@@ -430,22 +430,22 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	u32 regVal;
-- 	unsigned int i;
-- 	u32 regList[][2] = {
---		{ 0x786c, 0 },
---		{ 0x7854, 0 },
---		{ 0x7820, 0 },
---		{ 0x7824, 0 },
---		{ 0x7868, 0 },
---		{ 0x783c, 0 },
---		{ 0x7838, 0 } ,
---		{ 0x7828, 0 } ,
--+		{ AR9285_AN_TOP3, 0 },
--+		{ AR9285_AN_RXTXBB1, 0 },
--+		{ AR9285_AN_RF2G1, 0 },
--+		{ AR9285_AN_RF2G2, 0 },
--+		{ AR9285_AN_TOP2, 0 },
--+		{ AR9285_AN_RF2G8, 0 },
--+		{ AR9285_AN_RF2G7, 0 } ,
--+		{ AR9285_AN_RF2G3, 0 } ,
-- 	};
-- 
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-- 		regList[i][1] = REG_READ(ah, regList[i][0]);
-- 
---	regVal = REG_READ(ah, 0x7834);
--+	regVal = REG_READ(ah, AR9285_AN_RF2G6);
-- 	regVal &= (~(0x1));
---	REG_WRITE(ah, 0x7834, regVal);
--+	REG_WRITE(ah, AR9285_AN_RF2G6, regVal);
-- 	regVal = REG_READ(ah, 0x9808);
-- 	regVal |= (0x1 << 27);
-- 	REG_WRITE(ah, 0x9808, regVal);
--@@ -477,7 +477,7 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	 * does not matter since we turn it off
-- 	 */
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
---
--+	/* 7828, b0-11, ccom=fff */
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9271_AN_RF2G3_CCOMP, 0xfff);
-- 
-- 	/* Set:
--@@ -490,15 +490,16 @@ static void ar9271_hw_pa_cal(struct ath_
-- 
-- 	/* find off_6_1; */
-- 	for (i = 6; i > 0; i--) {
---		regVal = REG_READ(ah, 0x7834);
--+		regVal = REG_READ(ah, AR9285_AN_RF2G6);
-- 		regVal |= (1 << (20 + i));
---		REG_WRITE(ah, 0x7834, regVal);
--+		REG_WRITE(ah, AR9285_AN_RF2G6, regVal);
-- 		udelay(1);
-- 		/* regVal = REG_READ(ah, 0x7834); */
-- 		regVal &= (~(0x1 << (20 + i)));
---		regVal |= (MS(REG_READ(ah, 0x7840), AR9285_AN_RXTXBB1_SPARE9)
--+		regVal |= (MS(REG_READ(ah, AR9285_AN_RF2G9),
--+			      AR9285_AN_RXTXBB1_SPARE9)
-- 			    << (20 + i));
---		REG_WRITE(ah, 0x7834, regVal);
--+		REG_WRITE(ah, AR9285_AN_RF2G6, regVal);
-- 	}
-- 
-- 	regVal = (regVal >> 20) & 0x7f;
--@@ -517,9 +518,9 @@ static void ar9271_hw_pa_cal(struct ath_
-- 
-- 	ENABLE_REGWRITE_BUFFER(ah);
-- 
---	regVal = REG_READ(ah, 0x7834);
--+	regVal = REG_READ(ah, AR_AN_RF2G1_CH1);
-- 	regVal |= 0x1;
---	REG_WRITE(ah, 0x7834, regVal);
--+	REG_WRITE(ah, AR_AN_RF2G1_CH1, regVal);
-- 	regVal = REG_READ(ah, 0x9808);
-- 	regVal &= (~(0x1 << 27));
-- 	REG_WRITE(ah, 0x9808, regVal);
-diff --git a/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch b/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch
-new file mode 100644
-index 0000000..2eeed22
---- /dev/null
-+++ b/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch
-@@ -0,0 +1,159 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Tue, 2 Feb 2016 14:39:10 +0100
-+Subject: [PATCH] cfg80211: add support for non-linear skbs in
-+ ieee80211_amsdu_to_8023s
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/wireless/util.c
-++++ b/net/wireless/util.c
-+@@ -644,73 +644,75 @@ int ieee80211_data_from_8023(struct sk_b
-+ }
-+ EXPORT_SYMBOL(ieee80211_data_from_8023);
-+ 
-++static struct sk_buff *
-++__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
-++		       int offset, int len)
-++{
-++	struct sk_buff *frame;
-++
-++	if (skb->len - offset < len)
-++		return NULL;
-++
-++	/*
-++	 * Allocate and reserve two bytes more for payload
-++	 * alignment since sizeof(struct ethhdr) is 14.
-++	 */
-++	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + len);
-++
-++	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
-++	skb_copy_bits(skb, offset, skb_put(frame, len), len);
-++
-++	return frame;
-++}
-+ 
-+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
-+ 			      const u8 *addr, enum nl80211_iftype iftype,
-+ 			      const unsigned int extra_headroom,
-+ 			      bool has_80211_header)
-+ {
-++	unsigned int hlen = ALIGN(extra_headroom, 4);
-+ 	struct sk_buff *frame = NULL;
-+ 	u16 ethertype;
-+ 	u8 *payload;
-+-	const struct ethhdr *eth;
-+-	int remaining, err;
-+-	u8 dst[ETH_ALEN], src[ETH_ALEN];
-+-
-+-	if (skb_linearize(skb))
-+-		goto out;
-++	int offset = 0, remaining, err;
-++	struct ethhdr eth;
-++	bool reuse_skb = true;
-++	bool last = false;
-+ 
-+ 	if (has_80211_header) {
-+-		err = ieee80211_data_to_8023(skb, addr, iftype);
-++		err = __ieee80211_data_to_8023(skb, &eth, addr, iftype);
-+ 		if (err)
-+ 			goto out;
-+-
-+-		/* skip the wrapping header */
-+-		eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
-+-		if (!eth)
-+-			goto out;
-+-	} else {
-+-		eth = (struct ethhdr *) skb->data;
-+ 	}
-+ 
-+-	while (skb != frame) {
-++	while (!last) {
-++		unsigned int subframe_len;
-++		int len;
-+ 		u8 padding;
-+-		__be16 len = eth->h_proto;
-+-		unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
-+-
-+-		remaining = skb->len;
-+-		memcpy(dst, eth->h_dest, ETH_ALEN);
-+-		memcpy(src, eth->h_source, ETH_ALEN);
-+ 
-++		skb_copy_bits(skb, offset, &eth, sizeof(eth));
-++		len = ntohs(eth.h_proto);
-++		subframe_len = sizeof(struct ethhdr) + len;
-+ 		padding = (4 - subframe_len) & 0x3;
-++
-+ 		/* the last MSDU has no padding */
-++		remaining = skb->len - offset;
-+ 		if (subframe_len > remaining)
-+ 			goto purge;
-+ 
-+-		skb_pull(skb, sizeof(struct ethhdr));
-++		offset += sizeof(struct ethhdr);
-+ 		/* reuse skb for the last subframe */
-+-		if (remaining <= subframe_len + padding)
-++		last = remaining <= subframe_len + padding;
-++		if (!skb_is_nonlinear(skb) && last) {
-++			skb_pull(skb, offset);
-+ 			frame = skb;
-+-		else {
-+-			unsigned int hlen = ALIGN(extra_headroom, 4);
-+-			/*
-+-			 * Allocate and reserve two bytes more for payload
-+-			 * alignment since sizeof(struct ethhdr) is 14.
-+-			 */
-+-			frame = dev_alloc_skb(hlen + subframe_len + 2);
-++			reuse_skb = true;
-++		} else {
-++			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len);
-+ 			if (!frame)
-+ 				goto purge;
-+ 
-+-			skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
-+-			memcpy(skb_put(frame, ntohs(len)), skb->data,
-+-				ntohs(len));
-+-
-+-			eth = (struct ethhdr *)skb_pull(skb, ntohs(len) +
-+-							padding);
-+-			if (!eth) {
-+-				dev_kfree_skb(frame);
-+-				goto purge;
-+-			}
-++			offset += len + padding;
-+ 		}
-+ 
-+ 		skb_reset_network_header(frame);
-+@@ -719,24 +721,20 @@ void ieee80211_amsdu_to_8023s(struct sk_
-+ 
-+ 		payload = frame->data;
-+ 		ethertype = (payload[6] << 8) | payload[7];
-+-
-+ 		if (likely((ether_addr_equal(payload, rfc1042_header) &&
-+ 			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-+ 			   ether_addr_equal(payload, bridge_tunnel_header))) {
-+-			/* remove RFC1042 or Bridge-Tunnel
-+-			 * encapsulation and replace EtherType */
-+-			skb_pull(frame, 6);
-+-			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
-+-			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-+-		} else {
-+-			memcpy(skb_push(frame, sizeof(__be16)), &len,
-+-				sizeof(__be16));
-+-			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
-+-			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-++			eth.h_proto = htons(ethertype);
-++			skb_pull(frame, ETH_ALEN + 2);
-+ 		}
-++
-++		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
-+ 		__skb_queue_tail(list, frame);
-+ 	}
-+ 
-++	if (!reuse_skb)
-++		dev_kfree_skb(skb);
-++
-+ 	return;
-+ 
-+  purge:
-diff --git a/package/kernel/mac80211/patches/321-ath9k-ar9271_hw_pa_cal-use-proper-makroses.patch b/package/kernel/mac80211/patches/321-ath9k-ar9271_hw_pa_cal-use-proper-makroses.patch
-deleted file mode 100644
-index f05287d..0000000
---- a/package/kernel/mac80211/patches/321-ath9k-ar9271_hw_pa_cal-use-proper-makroses.patch
-+++ /dev/null
-@@ -1,79 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:48 +0100
--Subject: [PATCH] ath9k: ar9271_hw_pa_cal: use proper makroses.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--@@ -443,33 +443,30 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-- 		regList[i][1] = REG_READ(ah, regList[i][0]);
-- 
---	regVal = REG_READ(ah, AR9285_AN_RF2G6);
---	regVal &= (~(0x1));
---	REG_WRITE(ah, AR9285_AN_RF2G6, regVal);
---	regVal = REG_READ(ah, 0x9808);
---	regVal |= (0x1 << 27);
---	REG_WRITE(ah, 0x9808, regVal);
---
--+	/* 7834, b1=0 */
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
--+	/* 9808, b27=1 */
--+	REG_SET_BIT(ah, 0x9808, 1 << 27);
-- 	/* 786c,b23,1, pwddac=1 */
---	REG_RMW_FIELD(ah, AR9285_AN_TOP3, AR9285_AN_TOP3_PWDDAC, 1);
--+	REG_SET_BIT(ah, AR9285_AN_TOP3, AR9285_AN_TOP3_PWDDAC);
-- 	/* 7854, b5,1, pdrxtxbb=1 */
---	REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDRXTXBB1, 1);
--+	REG_SET_BIT(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDRXTXBB1);
-- 	/* 7854, b7,1, pdv2i=1 */
---	REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDV2I, 1);
--+	REG_SET_BIT(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDV2I);
-- 	/* 7854, b8,1, pddacinterface=1 */
---	REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDDACIF, 1);
--+	REG_SET_BIT(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDDACIF);
-- 	/* 7824,b12,0, offcal=0 */
---	REG_RMW_FIELD(ah, AR9285_AN_RF2G2, AR9285_AN_RF2G2_OFFCAL, 0);
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G2, AR9285_AN_RF2G2_OFFCAL);
-- 	/* 7838, b1,0, pwddb=0 */
---	REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PWDDB, 0);
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PWDDB);
-- 	/* 7820,b11,0, enpacal=0 */
---	REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_ENPACAL, 0);
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_ENPACAL);
-- 	/* 7820,b25,1, pdpadrv1=0 */
---	REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV1, 0);
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV1);
-- 	/* 7820,b24,0, pdpadrv2=0 */
---	REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV2, 0);
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV2);
-- 	/* 7820,b23,0, pdpaout=0 */
---	REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPAOUT, 0);
--+	REG_CLR_BIT(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPAOUT);
-- 	/* 783c,b14-16,7, padrvgn2tab_0=7 */
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G8, AR9285_AN_RF2G8_PADRVGN2TAB0, 7);
-- 	/*
--@@ -516,15 +513,13 @@ static void ar9271_hw_pa_cal(struct ath_
-- 		ah->pacal_info.prev_offset = regVal;
-- 	}
-- 
---	ENABLE_REGWRITE_BUFFER(ah);
-- 
---	regVal = REG_READ(ah, AR_AN_RF2G1_CH1);
---	regVal |= 0x1;
---	REG_WRITE(ah, AR_AN_RF2G1_CH1, regVal);
---	regVal = REG_READ(ah, 0x9808);
---	regVal &= (~(0x1 << 27));
---	REG_WRITE(ah, 0x9808, regVal);
--+	/* 7834, b1=1 */
--+	REG_SET_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
--+	/* 9808, b27=0 */
--+	REG_CLR_BIT(ah, 0x9808, 1 << 27);
-- 
--+	ENABLE_REGWRITE_BUFFER(ah);
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-- 		REG_WRITE(ah, regList[i][0], regList[i][1]);
-- 
-diff --git a/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch b/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch
-new file mode 100644
-index 0000000..c4155a1
---- /dev/null
-+++ b/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch
-@@ -0,0 +1,155 @@
-+From: Sven Eckelmann <sven@narfation.org>
-+Date: Tue, 26 Jan 2016 17:11:13 +0100
-+Subject: [PATCH] mac80211: Parse legacy and HT rate in injected frames
-+
-+Drivers/devices without their own rate control algorithm can get the
-+information what rates they should use from either the radiotap header of
-+injected frames or from the rate control algorithm. But the parsing of the
-+legacy rate information from the radiotap header was removed in commit
-+e6a9854b05c1 ("mac80211/drivers: rewrite the rate control API").
-+
-+The removal of this feature heavily reduced the usefulness of frame
-+injection when wanting to simulate specific transmission behavior. Having
-+rate parsing together with MCS rates and retry support allows a fine
-+grained selection of the tx behavior of injected frames for these kind of
-+tests.
-+
-+Signed-off-by: Sven Eckelmann <sven@narfation.org>
-+Cc: Simon Wunderlich <sw@simonwunderlich.de>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/include/net/mac80211.h
-++++ b/include/net/mac80211.h
-+@@ -708,12 +708,14 @@ enum mac80211_tx_info_flags {
-+  *	protocol frame (e.g. EAP)
-+  * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
-+  *	frame (PS-Poll or uAPSD).
-++ * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
-+  *
-+  * These flags are used in tx_info->control.flags.
-+  */
-+ enum mac80211_tx_control_flags {
-+ 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
-+ 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
-++	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
-+ };
-+ 
-+ /*
-+--- a/net/mac80211/tx.c
-++++ b/net/mac80211/tx.c
-+@@ -710,6 +710,10 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
-+ 
-+ 	info->control.short_preamble = txrc.short_preamble;
-+ 
-++	/* don't ask rate control when rate already injected via radiotap */
-++	if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
-++		return TX_CONTINUE;
-++
-+ 	if (tx->sta)
-+ 		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
-+ 
-+@@ -1665,15 +1669,24 @@ void ieee80211_xmit(struct ieee80211_sub
-+ 	ieee80211_tx(sdata, sta, skb, false);
-+ }
-+ 
-+-static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
-++static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
-++					struct sk_buff *skb)
-+ {
-+ 	struct ieee80211_radiotap_iterator iterator;
-+ 	struct ieee80211_radiotap_header *rthdr =
-+ 		(struct ieee80211_radiotap_header *) skb->data;
-+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-++	struct ieee80211_supported_band *sband =
-++		local->hw.wiphy->bands[info->band];
-+ 	int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
-+ 						   NULL);
-+ 	u16 txflags;
-++	u16 rate = 0;
-++	bool rate_found = false;
-++	u8 rate_retries = 0;
-++	u16 rate_flags = 0;
-++	u8 mcs_known, mcs_flags;
-++	int i;
-+ 
-+ 	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-+ 		       IEEE80211_TX_CTL_DONTFRAG;
-+@@ -1724,6 +1737,35 @@ static bool ieee80211_parse_tx_radiotap(
-+ 				info->flags |= IEEE80211_TX_CTL_NO_ACK;
-+ 			break;
-+ 
-++		case IEEE80211_RADIOTAP_RATE:
-++			rate = *iterator.this_arg;
-++			rate_flags = 0;
-++			rate_found = true;
-++			break;
-++
-++		case IEEE80211_RADIOTAP_DATA_RETRIES:
-++			rate_retries = *iterator.this_arg;
-++			break;
-++
-++		case IEEE80211_RADIOTAP_MCS:
-++			mcs_known = iterator.this_arg[0];
-++			mcs_flags = iterator.this_arg[1];
-++			if (!(mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_MCS))
-++				break;
-++
-++			rate_found = true;
-++			rate = iterator.this_arg[2];
-++			rate_flags = IEEE80211_TX_RC_MCS;
-++
-++			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_GI &&
-++			    mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
-++				rate_flags |= IEEE80211_TX_RC_SHORT_GI;
-++
-++			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
-++			    mcs_flags & IEEE80211_RADIOTAP_MCS_BW_40)
-++				rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
-++			break;
-++
-+ 		/*
-+ 		 * Please update the file
-+ 		 * Documentation/networking/mac80211-injection.txt
-+@@ -1738,6 +1780,32 @@ static bool ieee80211_parse_tx_radiotap(
-+ 	if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
-+ 		return false;
-+ 
-++	if (rate_found) {
-++		info->control.flags |= IEEE80211_TX_CTRL_RATE_INJECT;
-++
-++		for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-++			info->control.rates[i].idx = -1;
-++			info->control.rates[i].flags = 0;
-++			info->control.rates[i].count = 0;
-++		}
-++
-++		if (rate_flags & IEEE80211_TX_RC_MCS) {
-++			info->control.rates[0].idx = rate;
-++		} else {
-++			for (i = 0; i < sband->n_bitrates; i++) {
-++				if (rate * 5 != sband->bitrates[i].bitrate)
-++					continue;
-++
-++				info->control.rates[0].idx = i;
-++				break;
-++			}
-++		}
-++
-++		info->control.rates[0].flags = rate_flags;
-++		info->control.rates[0].count = min_t(u8, rate_retries + 1,
-++						     local->hw.max_rate_tries);
-++	}
-++
-+ 	/*
-+ 	 * remove the radiotap header
-+ 	 * iterator->_max_length was sanity-checked against
-+@@ -1819,7 +1887,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
-+ 		      IEEE80211_TX_CTL_INJECTED;
-+ 
-+ 	/* process and remove the injection radiotap header */
-+-	if (!ieee80211_parse_tx_radiotap(skb))
-++	if (!ieee80211_parse_tx_radiotap(local, skb))
-+ 		goto fail;
-+ 
-+ 	rcu_read_lock();
-diff --git a/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch b/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch
-deleted file mode 100644
-index 7247369..0000000
---- a/package/kernel/mac80211/patches/322-ath9k-ar9271_hw_pa_cal-use-RMW-buffer.patch
-+++ /dev/null
-@@ -1,48 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:49 +0100
--Subject: [PATCH] ath9k: ar9271_hw_pa_cal: use RMW buffer
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--@@ -436,13 +436,14 @@ static void ar9271_hw_pa_cal(struct ath_
-- 		{ AR9285_AN_RF2G2, 0 },
-- 		{ AR9285_AN_TOP2, 0 },
-- 		{ AR9285_AN_RF2G8, 0 },
---		{ AR9285_AN_RF2G7, 0 } ,
---		{ AR9285_AN_RF2G3, 0 } ,
--+		{ AR9285_AN_RF2G7, 0 },
--+		{ AR9285_AN_RF2G3, 0 },
-- 	};
-- 
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-- 		regList[i][1] = REG_READ(ah, regList[i][0]);
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	/* 7834, b1=0 */
-- 	REG_CLR_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
-- 	/* 9808, b27=1 */
--@@ -476,6 +477,7 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
-- 	/* 7828, b0-11, ccom=fff */
-- 	REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9271_AN_RF2G3_CCOMP, 0xfff);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	/* Set:
-- 	 * localmode=1,bmode=1,bmoderxtx=1,synthon=1,
--@@ -514,10 +516,12 @@ static void ar9271_hw_pa_cal(struct ath_
-- 	}
-- 
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	/* 7834, b1=1 */
-- 	REG_SET_BIT(ah, AR9285_AN_RF2G6, 1 << 0);
-- 	/* 9808, b27=0 */
-- 	REG_CLR_BIT(ah, 0x9808, 1 << 27);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	ENABLE_REGWRITE_BUFFER(ah);
-- 	for (i = 0; i < ARRAY_SIZE(regList); i++)
-diff --git a/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
-new file mode 100644
-index 0000000..e7bfb9c
---- /dev/null
-+++ b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
-@@ -0,0 +1,317 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Fri, 5 Feb 2016 01:38:51 +0100
-+Subject: [PATCH] mac80211: add A-MSDU tx support
-+
-+Requires software tx queueing support. frag_list support (for zero-copy)
-+is optional.
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/include/net/mac80211.h
-++++ b/include/net/mac80211.h
-+@@ -709,6 +709,7 @@ enum mac80211_tx_info_flags {
-+  * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
-+  *	frame (PS-Poll or uAPSD).
-+  * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
-++ * @IEEE80211_TX_CTRL_AMSDU: This frame is an A-MSDU frame
-+  *
-+  * These flags are used in tx_info->control.flags.
-+  */
-+@@ -716,6 +717,7 @@ enum mac80211_tx_control_flags {
-+ 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
-+ 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
-+ 	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
-++	IEEE80211_TX_CTRL_AMSDU			= BIT(3),
-+ };
-+ 
-+ /*
-+@@ -1728,6 +1730,7 @@ struct ieee80211_sta_rates {
-+  *		  size is min(max_amsdu_len, 7935) bytes.
-+  *	Both additional HT limits must be enforced by the low level driver.
-+  *	This is defined by the spec (IEEE 802.11-2012 section 8.3.2.2 NOTE 2).
-++ * @max_rc_amsdu_len: Maximum A-MSDU size in bytes recommended by rate control.
-+  * @txq: per-TID data TX queues (if driver uses the TXQ abstraction)
-+  */
-+ struct ieee80211_sta {
-+@@ -1748,6 +1751,7 @@ struct ieee80211_sta {
-+ 	bool mfp;
-+ 	u8 max_amsdu_subframes;
-+ 	u16 max_amsdu_len;
-++	u16 max_rc_amsdu_len;
-+ 
-+ 	struct ieee80211_txq *txq[IEEE80211_NUM_TIDS];
-+ 
-+@@ -1961,6 +1965,15 @@ struct ieee80211_txq {
-+  *	order and does not need to manage its own reorder buffer or BA session
-+  *	timeout.
-+  *
-++ * @IEEE80211_HW_TX_AMSDU: Hardware (or driver) supports software aggregated
-++ *	A-MSDU frames. Requires software tx queueing and fast-xmit support.
-++ *	When not using minstrel/minstrel_ht rate control, the driver should
-++ *	limit the maximum A-MSDU size based on the current tx rate by setting
-++ *	max_rc_amsdu_len in struct ieee80211_sta.
-++ *
-++ * @IEEE80211_HW_TX_FRAG_LIST: Hardware (or driver) supports sending frag_list
-++ *	skbs, needed for zero-copy software A-MSDU.
-++ *
-+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-+  */
-+ enum ieee80211_hw_flags {
-+@@ -1998,6 +2011,8 @@ enum ieee80211_hw_flags {
-+ 	IEEE80211_HW_BEACON_TX_STATUS,
-+ 	IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR,
-+ 	IEEE80211_HW_SUPPORTS_REORDERING_BUFFER,
-++	IEEE80211_HW_TX_AMSDU,
-++	IEEE80211_HW_TX_FRAG_LIST,
-+ 
-+ 	/* keep last, obviously */
-+ 	NUM_IEEE80211_HW_FLAGS
-+@@ -2070,6 +2085,9 @@ enum ieee80211_hw_flags {
-+  *	size is smaller (an example is LinkSys WRT120N with FW v1.0.07
-+  *	build 002 Jun 18 2012).
-+  *
-++ * @max_tx_fragments: maximum number of tx buffers per (A)-MSDU, sum
-++ *	of 1 + skb_shinfo(skb)->nr_frags for each skb in the frag_list.
-++ *
-+  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
-+  *	(if %IEEE80211_HW_QUEUE_CONTROL is set)
-+  *
-+@@ -2124,6 +2142,7 @@ struct ieee80211_hw {
-+ 	u8 max_rate_tries;
-+ 	u8 max_rx_aggregation_subframes;
-+ 	u8 max_tx_aggregation_subframes;
-++	u8 max_tx_fragments;
-+ 	u8 offchannel_tx_hw_queue;
-+ 	u8 radiotap_mcs_details;
-+ 	u16 radiotap_vht_details;
-+--- a/net/mac80211/agg-tx.c
-++++ b/net/mac80211/agg-tx.c
-+@@ -935,6 +935,7 @@ void ieee80211_process_addba_resp(struct
-+ 				  size_t len)
-+ {
-+ 	struct tid_ampdu_tx *tid_tx;
-++	struct ieee80211_txq *txq;
-+ 	u16 capab, tid;
-+ 	u8 buf_size;
-+ 	bool amsdu;
-+@@ -945,6 +946,10 @@ void ieee80211_process_addba_resp(struct
-+ 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
-+ 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
-+ 
-++	txq = sta->sta.txq[tid];
-++	if (!amsdu && txq)
-++		set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags);
-++
-+ 	mutex_lock(&sta->ampdu_mlme.mtx);
-+ 
-+ 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-+--- a/net/mac80211/debugfs.c
-++++ b/net/mac80211/debugfs.c
-+@@ -127,6 +127,8 @@ static const char *hw_flag_names[NUM_IEE
-+ 	FLAG(BEACON_TX_STATUS),
-+ 	FLAG(NEEDS_UNIQUE_STA_ADDR),
-+ 	FLAG(SUPPORTS_REORDERING_BUFFER),
-++	FLAG(TX_AMSDU),
-++	FLAG(TX_FRAG_LIST),
-+ 
-+ 	/* keep last for the build bug below */
-+ 	(void *)0x1
-+--- a/net/mac80211/ieee80211_i.h
-++++ b/net/mac80211/ieee80211_i.h
-+@@ -799,6 +799,7 @@ struct mac80211_qos_map {
-+ enum txq_info_flags {
-+ 	IEEE80211_TXQ_STOP,
-+ 	IEEE80211_TXQ_AMPDU,
-++	IEEE80211_TXQ_NO_AMSDU,
-+ };
-+ 
-+ struct txq_info {
-+--- a/net/mac80211/tx.c
-++++ b/net/mac80211/tx.c
-+@@ -1318,6 +1318,10 @@ struct sk_buff *ieee80211_tx_dequeue(str
-+ out:
-+ 	spin_unlock_bh(&txqi->queue.lock);
-+ 
-++	if (skb && skb_has_frag_list(skb) &&
-++	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
-++		skb_linearize(skb);
-++
-+ 	return skb;
-+ }
-+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
-+@@ -2757,6 +2761,163 @@ void ieee80211_clear_fast_xmit(struct st
-+ 		kfree_rcu(fast_tx, rcu_head);
-+ }
-+ 
-++static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
-++					struct sk_buff *skb, int headroom,
-++					int *subframe_len)
-++{
-++	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
-++	int padding = (4 - amsdu_len) & 3;
-++
-++	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
-++		I802_DEBUG_INC(local->tx_expand_skb_head);
-++
-++		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
-++			wiphy_debug(local->hw.wiphy,
-++				    "failed to reallocate TX buffer\n");
-++			return false;
-++		}
-++	}
-++
-++	if (padding) {
-++		*subframe_len += padding;
-++		memset(skb_put(skb, padding), 0, padding);
-++	}
-++
-++	return true;
-++}
-++
-++static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
-++					 struct ieee80211_fast_tx *fast_tx,
-++					 struct sk_buff *skb)
-++{
-++	struct ieee80211_local *local = sdata->local;
-++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-++	struct ieee80211_hdr *hdr;
-++	struct ethhdr amsdu_hdr;
-++	int hdr_len = fast_tx->hdr_len - sizeof(rfc1042_header);
-++	int subframe_len = skb->len - hdr_len;
-++	void *data;
-++	u8 *qc;
-++
-++	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
-++		return false;
-++
-++	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
-++		return true;
-++
-++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(amsdu_hdr),
-++					 &subframe_len))
-++		return false;
-++
-++	amsdu_hdr.h_proto = cpu_to_be16(subframe_len);
-++	memcpy(amsdu_hdr.h_source, skb->data + fast_tx->sa_offs, ETH_ALEN);
-++	memcpy(amsdu_hdr.h_dest, skb->data + fast_tx->da_offs, ETH_ALEN);
-++
-++	data = skb_push(skb, sizeof(amsdu_hdr));
-++	memmove(data, data + sizeof(amsdu_hdr), hdr_len);
-++	memcpy(data + hdr_len, &amsdu_hdr, sizeof(amsdu_hdr));
-++
-++	hdr = data;
-++	qc = ieee80211_get_qos_ctl(hdr);
-++	*qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
-++
-++	info->control.flags |= IEEE80211_TX_CTRL_AMSDU;
-++
-++	return true;
-++}
-++
-++static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
-++				      struct sta_info *sta,
-++				      struct ieee80211_fast_tx *fast_tx,
-++				      struct sk_buff *skb)
-++{
-++	struct ieee80211_local *local = sdata->local;
-++	u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-++	struct ieee80211_txq *txq = sta->sta.txq[tid];
-++	struct txq_info *txqi;
-++	struct sk_buff **frag_tail, *head;
-++	int subframe_len = skb->len - ETH_ALEN;
-++	u8 max_subframes = sta->sta.max_amsdu_subframes;
-++	int max_frags = local->hw.max_tx_fragments;
-++	int max_amsdu_len = sta->sta.max_amsdu_len;
-++	__be16 len;
-++	void *data;
-++	bool ret = false;
-++	int n = 1, nfrags;
-++
-++	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
-++		return false;
-++
-++	if (!txq)
-++		return false;
-++
-++	txqi = to_txq_info(txq);
-++	if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
-++		return false;
-++
-++	if (sta->sta.max_rc_amsdu_len)
-++		max_amsdu_len = min_t(int, max_amsdu_len,
-++				      sta->sta.max_rc_amsdu_len);
-++
-++	spin_lock_bh(&txqi->queue.lock);
-++
-++	head = skb_peek_tail(&txqi->queue);
-++	if (!head)
-++		goto out;
-++
-++	if (skb->len + head->len > max_amsdu_len)
-++		goto out;
-++
-++	/*
-++	 * HT A-MPDU limits maximum MPDU size to 4095 bytes. Since aggregation
-++	 * sessions are started/stopped without txq flush, use the limit here
-++	 * to avoid having to de-aggregate later.
-++	 */
-++	if (skb->len + head->len > 4095 &&
-++	    !sta->sta.vht_cap.vht_supported)
-++		goto out;
-++
-++	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-++		goto out;
-++
-++	nfrags = 1 + skb_shinfo(skb)->nr_frags;
-++	nfrags += 1 + skb_shinfo(head)->nr_frags;
-++	frag_tail = &skb_shinfo(head)->frag_list;
-++	while (*frag_tail) {
-++		nfrags += 1 + skb_shinfo(*frag_tail)->nr_frags;
-++		frag_tail = &(*frag_tail)->next;
-++		n++;
-++	}
-++
-++	if (max_subframes && n > max_subframes)
-++		goto out;
-++
-++	if (max_frags && nfrags > max_frags)
-++		goto out;
-++
-++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
-++					 &subframe_len))
-++		return false;
-++
-++	ret = true;
-++	data = skb_push(skb, ETH_ALEN + 2);
-++	memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
-++
-++	data += 2 * ETH_ALEN;
-++	len = cpu_to_be16(subframe_len);
-++	memcpy(data, &len, 2);
-++	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
-++
-++	head->len += skb->len;
-++	head->data_len += skb->len;
-++	*frag_tail = skb;
-++
-++out:
-++	spin_unlock_bh(&txqi->queue.lock);
-++
-++	return ret;
-++}
-++
-+ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
-+ 				struct net_device *dev, struct sta_info *sta,
-+ 				struct ieee80211_fast_tx *fast_tx,
-+@@ -2811,6 +2972,10 @@ static bool ieee80211_xmit_fast(struct i
-+ 
-+ 	ieee80211_tx_stats(dev, skb->len + extra_head);
-+ 
-++	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
-++	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
-++		return true;
-++
-+ 	/* will not be crypto-handled beyond what we do here, so use false
-+ 	 * as the may-encrypt argument for the resize to not account for
-+ 	 * more room than we already have in 'extra_head'
-diff --git a/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch b/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
-new file mode 100644
-index 0000000..9277b2c
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
-@@ -0,0 +1,64 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Wed, 20 Jan 2016 16:46:04 +0100
-+Subject: [PATCH] brcmfmac: fix setting primary channel for 80 MHz width
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+First of all it changes the way we calculate primary channel offset. If
-+we use e.g. 80 MHz channel with primary frequency 5180 MHz (which means
-+center frequency is 5210 MHz) it makes sense to calculate primary offset
-+as -30 MHz.
-+Then it fixes values we compare primary_offset with. We were comparing
-+offset in MHz against -2 or 2 which was resulting in picking a wrong
-+primary channel.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+@@ -247,7 +247,7 @@ static u16 chandef_to_chanspec(struct br
-+ 	brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
-+ 		  ch->chan->center_freq, ch->center_freq1, ch->width);
-+ 	ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
-+-	primary_offset = ch->center_freq1 - ch->chan->center_freq;
-++	primary_offset = ch->chan->center_freq - ch->center_freq1;
-+ 	switch (ch->width) {
-+ 	case NL80211_CHAN_WIDTH_20:
-+ 	case NL80211_CHAN_WIDTH_20_NOHT:
-+@@ -256,24 +256,21 @@ static u16 chandef_to_chanspec(struct br
-+ 		break;
-+ 	case NL80211_CHAN_WIDTH_40:
-+ 		ch_inf.bw = BRCMU_CHAN_BW_40;
-+-		if (primary_offset < 0)
-++		if (primary_offset > 0)
-+ 			ch_inf.sb = BRCMU_CHAN_SB_U;
-+ 		else
-+ 			ch_inf.sb = BRCMU_CHAN_SB_L;
-+ 		break;
-+ 	case NL80211_CHAN_WIDTH_80:
-+ 		ch_inf.bw = BRCMU_CHAN_BW_80;
-+-		if (primary_offset < 0) {
-+-			if (primary_offset < -CH_10MHZ_APART)
-+-				ch_inf.sb = BRCMU_CHAN_SB_UU;
-+-			else
-+-				ch_inf.sb = BRCMU_CHAN_SB_UL;
-+-		} else {
-+-			if (primary_offset > CH_10MHZ_APART)
-+-				ch_inf.sb = BRCMU_CHAN_SB_LL;
-+-			else
-+-				ch_inf.sb = BRCMU_CHAN_SB_LU;
-+-		}
-++		if (primary_offset == -30)
-++			ch_inf.sb = BRCMU_CHAN_SB_LL;
-++		else if (primary_offset == -10)
-++			ch_inf.sb = BRCMU_CHAN_SB_LU;
-++		else if (primary_offset == 10)
-++			ch_inf.sb = BRCMU_CHAN_SB_UL;
-++		else
-++			ch_inf.sb = BRCMU_CHAN_SB_UU;
-+ 		break;
-+ 	case NL80211_CHAN_WIDTH_80P80:
-+ 	case NL80211_CHAN_WIDTH_160:
-diff --git a/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch b/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
-new file mode 100644
-index 0000000..d7018da
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
-@@ -0,0 +1,51 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Tue, 26 Jan 2016 17:57:01 +0100
-+Subject: [PATCH] brcmfmac: analyze descriptors of current component only
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+So far we were looking for address descriptors without a check for
-+crossing current component border. In case of dealing with unsupported
-+descriptor or descriptor missing at all the code would incorrectly get
-+data from another component.
-+
-+Consider this binary-described component from BCM4366 EROM:
-+4bf83b01	TAG==CI		CID==0x83b
-+20080201	TAG==CI		PORTS==0+1	WRAPPERS==0+1
-+18400035	TAG==ADDR	SZ_SZD		TYPE_SLAVE
-+00050000
-+18107085	TAG==ADDR	SZ_4K		TYPE_SWRAP
-+
-+Driver was assigning invalid base address to this core:
-+brcmfmac:  [6 ] core 0x83b:32 base 0x18109000 wrap 0x18107000
-+which came from totally different component defined in EROM:
-+43b36701	TAG==CI		CID==0x367
-+00000201	TAG==CI		PORTS==0+1	WRAPPERS==0+0
-+18109005	TAG==ADDR	SZ_4K		TYPE_SLAVE
-+
-+This change will also allow us to support components without wrapper
-+address in the future.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+@@ -803,7 +803,14 @@ static int brcmf_chip_dmp_get_regaddr(st
-+ 				*eromaddr -= 4;
-+ 				return -EFAULT;
-+ 			}
-+-		} while (desc != DMP_DESC_ADDRESS);
-++		} while (desc != DMP_DESC_ADDRESS &&
-++			 desc != DMP_DESC_COMPONENT);
-++
-++		/* stop if we crossed current component border */
-++		if (desc == DMP_DESC_COMPONENT) {
-++			*eromaddr -= 4;
-++			return 0;
-++		}
-+ 
-+ 		/* skip upper 32-bit address descriptor */
-+ 		if (val & DMP_DESC_ADDRSIZE_GT32)
-diff --git a/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch b/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch
-new file mode 100644
-index 0000000..045ab49
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch
-@@ -0,0 +1,28 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Tue, 26 Jan 2016 17:57:02 +0100
-+Subject: [PATCH] brcmfmac: allow storing PMU core without wrapper address
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+Separated PMU core can be found in new devices and should be used for
-+accessing PMU registers (which were routed through ChipCommon so far).
-+This core is one of exceptions that doesn't have or need wrapper address
-+to be still safely accessible.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+@@ -883,7 +883,8 @@ int brcmf_chip_dmp_erom_scan(struct brcm
-+ 		rev = (val & DMP_COMP_REVISION) >> DMP_COMP_REVISION_S;
-+ 
-+ 		/* need core with ports */
-+-		if (nmw + nsw == 0)
-++		if (nmw + nsw == 0 &&
-++		    id != BCMA_CORE_PMU)
-+ 			continue;
-+ 
-+ 		/* try to obtain register address info */
-diff --git a/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch b/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch
-new file mode 100644
-index 0000000..7b7ba4f
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch
-@@ -0,0 +1,43 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Tue, 26 Jan 2016 17:57:03 +0100
-+Subject: [PATCH] brcmfmac: read extended capabilities of ChipCommon core
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+This is an extra bitfield with info about some present hardware.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+@@ -1025,6 +1025,9 @@ static int brcmf_chip_setup(struct brcmf
-+ 	/* get chipcommon capabilites */
-+ 	pub->cc_caps = chip->ops->read32(chip->ctx,
-+ 					 CORE_CC_REG(base, capabilities));
-++	pub->cc_caps_ext = chip->ops->read32(chip->ctx,
-++					     CORE_CC_REG(base,
-++							 capabilities_ext));
-+ 
-+ 	/* get pmu caps & rev */
-+ 	if (pub->cc_caps & CC_CAP_PMU) {
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+@@ -27,6 +27,7 @@
-+  * @chip: chip identifier.
-+  * @chiprev: chip revision.
-+  * @cc_caps: chipcommon core capabilities.
-++ * @cc_caps_ext: chipcommon core extended capabilities.
-+  * @pmucaps: PMU capabilities.
-+  * @pmurev: PMU revision.
-+  * @rambase: RAM base address (only applicable for ARM CR4 chips).
-+@@ -38,6 +39,7 @@ struct brcmf_chip {
-+ 	u32 chip;
-+ 	u32 chiprev;
-+ 	u32 cc_caps;
-++	u32 cc_caps_ext;
-+ 	u32 pmucaps;
-+ 	u32 pmurev;
-+ 	u32 rambase;
-diff --git a/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch b/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch
-new file mode 100644
-index 0000000..2af6fd9
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch
-@@ -0,0 +1,148 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Tue, 26 Jan 2016 17:57:04 +0100
-+Subject: [PATCH] brcmfmac: access PMU registers using standalone PMU core if
-+ available
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+On recent Broadcom chipsets PMU is present as separated core and it
-+can't be accessed using ChipCommon anymore as it fails with e.g.:
-+[   18.198412] Unhandled fault: imprecise external abort (0x1406) at 0xb6da200f
-+
-+Add a new helper function that will return a proper core that should be
-+used for accessing PMU registers.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+@@ -1014,6 +1014,7 @@ static int brcmf_chip_setup(struct brcmf
-+ {
-+ 	struct brcmf_chip *pub;
-+ 	struct brcmf_core_priv *cc;
-++	struct brcmf_core *pmu;
-+ 	u32 base;
-+ 	u32 val;
-+ 	int ret = 0;
-+@@ -1030,9 +1031,10 @@ static int brcmf_chip_setup(struct brcmf
-+ 							 capabilities_ext));
-+ 
-+ 	/* get pmu caps & rev */
-++	pmu = brcmf_chip_get_pmu(pub); /* after reading cc_caps_ext */
-+ 	if (pub->cc_caps & CC_CAP_PMU) {
-+ 		val = chip->ops->read32(chip->ctx,
-+-					CORE_CC_REG(base, pmucapabilities));
-++					CORE_CC_REG(pmu->base, pmucapabilities));
-+ 		pub->pmurev = val & PCAP_REV_MASK;
-+ 		pub->pmucaps = val;
-+ 	}
-+@@ -1131,6 +1133,23 @@ struct brcmf_core *brcmf_chip_get_chipco
-+ 	return &cc->pub;
-+ }
-+ 
-++struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub)
-++{
-++	struct brcmf_core *cc = brcmf_chip_get_chipcommon(pub);
-++	struct brcmf_core *pmu;
-++
-++	/* See if there is separated PMU core available */
-++	if (cc->rev >= 35 &&
-++	    pub->cc_caps_ext & BCMA_CC_CAP_EXT_AOB_PRESENT) {
-++		pmu = brcmf_chip_get_core(pub, BCMA_CORE_PMU);
-++		if (pmu)
-++			return pmu;
-++	}
-++
-++	/* Fallback to ChipCommon core for older hardware */
-++	return cc;
-++}
-++
-+ bool brcmf_chip_iscoreup(struct brcmf_core *pub)
-+ {
-+ 	struct brcmf_core_priv *core;
-+@@ -1301,6 +1320,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
-+ {
-+ 	u32 base, addr, reg, pmu_cc3_mask = ~0;
-+ 	struct brcmf_chip_priv *chip;
-++	struct brcmf_core *pmu = brcmf_chip_get_pmu(pub);
-+ 
-+ 	brcmf_dbg(TRACE, "Enter\n");
-+ 
-+@@ -1320,9 +1340,9 @@ bool brcmf_chip_sr_capable(struct brcmf_
-+ 	case BRCM_CC_4335_CHIP_ID:
-+ 	case BRCM_CC_4339_CHIP_ID:
-+ 		/* read PMU chipcontrol register 3 */
-+-		addr = CORE_CC_REG(base, chipcontrol_addr);
-++		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
-+ 		chip->ops->write32(chip->ctx, addr, 3);
-+-		addr = CORE_CC_REG(base, chipcontrol_data);
-++		addr = CORE_CC_REG(pmu->base, chipcontrol_data);
-+ 		reg = chip->ops->read32(chip->ctx, addr);
-+ 		return (reg & pmu_cc3_mask) != 0;
-+ 	case BRCM_CC_43430_CHIP_ID:
-+@@ -1330,12 +1350,12 @@ bool brcmf_chip_sr_capable(struct brcmf_
-+ 		reg = chip->ops->read32(chip->ctx, addr);
-+ 		return reg != 0;
-+ 	default:
-+-		addr = CORE_CC_REG(base, pmucapabilities_ext);
-++		addr = CORE_CC_REG(pmu->base, pmucapabilities_ext);
-+ 		reg = chip->ops->read32(chip->ctx, addr);
-+ 		if ((reg & PCAPEXT_SR_SUPPORTED_MASK) == 0)
-+ 			return false;
-+ 
-+-		addr = CORE_CC_REG(base, retention_ctl);
-++		addr = CORE_CC_REG(pmu->base, retention_ctl);
-+ 		reg = chip->ops->read32(chip->ctx, addr);
-+ 		return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
-+ 			       PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+@@ -85,6 +85,7 @@ struct brcmf_chip *brcmf_chip_attach(voi
-+ void brcmf_chip_detach(struct brcmf_chip *chip);
-+ struct brcmf_core *brcmf_chip_get_core(struct brcmf_chip *chip, u16 coreid);
-+ struct brcmf_core *brcmf_chip_get_chipcommon(struct brcmf_chip *chip);
-++struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub);
-+ bool brcmf_chip_iscoreup(struct brcmf_core *core);
-+ void brcmf_chip_coredisable(struct brcmf_core *core, u32 prereset, u32 reset);
-+ void brcmf_chip_resetcore(struct brcmf_core *core, u32 prereset, u32 reset,
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+@@ -3615,7 +3615,6 @@ brcmf_sdio_drivestrengthinit(struct brcm
-+ 	const struct sdiod_drive_str *str_tab = NULL;
-+ 	u32 str_mask;
-+ 	u32 str_shift;
-+-	u32 base;
-+ 	u32 i;
-+ 	u32 drivestrength_sel = 0;
-+ 	u32 cc_data_temp;
-+@@ -3658,14 +3657,15 @@ brcmf_sdio_drivestrengthinit(struct brcm
-+ 	}
-+ 
-+ 	if (str_tab != NULL) {
-++		struct brcmf_core *pmu = brcmf_chip_get_pmu(ci);
-++
-+ 		for (i = 0; str_tab[i].strength != 0; i++) {
-+ 			if (drivestrength >= str_tab[i].strength) {
-+ 				drivestrength_sel = str_tab[i].sel;
-+ 				break;
-+ 			}
-+ 		}
-+-		base = brcmf_chip_get_chipcommon(ci)->base;
-+-		addr = CORE_CC_REG(base, chipcontrol_addr);
-++		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
-+ 		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
-+ 		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-+ 		cc_data_temp &= ~str_mask;
-+@@ -3835,8 +3835,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
-+ 		goto fail;
-+ 
-+ 	/* set PMUControl so a backplane reset does PMU state reload */
-+-	reg_addr = CORE_CC_REG(brcmf_chip_get_chipcommon(bus->ci)->base,
-+-			       pmucontrol);
-++	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
-+ 	reg_val = brcmf_sdiod_regrl(bus->sdiodev, reg_addr, &err);
-+ 	if (err)
-+ 		goto fail;
-diff --git a/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch b/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch
-new file mode 100644
-index 0000000..35887fc
---- /dev/null
-+++ b/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch
-@@ -0,0 +1,38 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Tue, 26 Jan 2016 17:57:05 +0100
-+Subject: [PATCH] brcmfmac: add support for 14e4:4365 PCI ID with BCM4366
-+ chipset
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+On Broadcom ARM routers BCM4366 cards are available with 14e4:4365 ID.
-+Unfortunately this ID was already used by Broadcom for cards with
-+BCM43142, a totally different chipset requiring SoftMAC driver. To avoid
-+a conflict between brcmfmac and bcma use more specific ID entry with
-+subvendor and subdevice specified.
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+@@ -1951,6 +1951,9 @@ static const struct dev_pm_ops brcmf_pci
-+ 
-+ #define BRCMF_PCIE_DEVICE(dev_id)	{ BRCM_PCIE_VENDOR_ID_BROADCOM, dev_id,\
-+ 	PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
-++#define BRCMF_PCIE_DEVICE_SUB(dev_id, subvend, subdev)	{ \
-++	BRCM_PCIE_VENDOR_ID_BROADCOM, dev_id,\
-++	subvend, subdev, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
-+ 
-+ static struct pci_device_id brcmf_pcie_devid_table[] = {
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
-+@@ -1966,6 +1969,7 @@ static struct pci_device_id brcmf_pcie_d
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID),
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID),
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID),
-++	BRCMF_PCIE_DEVICE_SUB(0x4365, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4365),
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_DEVICE_ID),
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID),
-+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID),
-diff --git a/package/kernel/mac80211/patches/323-ath9k-add-multi_read-to-be-compatible-with-ath9k_htc.patch b/package/kernel/mac80211/patches/323-ath9k-add-multi_read-to-be-compatible-with-ath9k_htc.patch
-deleted file mode 100644
-index 246bb9d..0000000
---- a/package/kernel/mac80211/patches/323-ath9k-add-multi_read-to-be-compatible-with-ath9k_htc.patch
-+++ /dev/null
-@@ -1,35 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:50 +0100
--Subject: [PATCH] ath9k: add multi_read to be compatible with ath9k_htc
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/init.c
--+++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -141,6 +141,16 @@ static unsigned int ath9k_ioread32(void
-- 	return val;
-- }
-- 
--+static void ath9k_multi_ioread32(void *hw_priv, u32 *addr,
--+                                u32 *val, u16 count)
--+{
--+	int i;
--+
--+	for (i = 0; i < count; i++)
--+		val[i] = ath9k_ioread32(hw_priv, addr[i]);
--+}
--+
--+
-- static unsigned int __ath9k_reg_rmw(struct ath_softc *sc, u32 reg_offset,
-- 				    u32 set, u32 clr)
-- {
--@@ -530,6 +540,7 @@ static int ath9k_init_softc(u16 devid, s
-- 	ah->hw = sc->hw;
-- 	ah->hw_version.devid = devid;
-- 	ah->reg_ops.read = ath9k_ioread32;
--+	ah->reg_ops.multi_read = ath9k_multi_ioread32;
-- 	ah->reg_ops.write = ath9k_iowrite32;
-- 	ah->reg_ops.rmw = ath9k_reg_rmw;
-- 	pCap = &ah->caps;
-diff --git a/package/kernel/mac80211/patches/324-ath9k-add-new-function-ath9k_hw_read_array.patch b/package/kernel/mac80211/patches/324-ath9k-add-new-function-ath9k_hw_read_array.patch
-deleted file mode 100644
-index 2eda1c9..0000000
---- a/package/kernel/mac80211/patches/324-ath9k-add-new-function-ath9k_hw_read_array.patch
-+++ /dev/null
-@@ -1,69 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:51 +0100
--Subject: [PATCH] ath9k: add new function ath9k_hw_read_array
--
--REG_READ generate most overhead on usb bus. It send and read micro packages
--and reduce usb bandwidth. To reduce this overhead we should read in batches.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/hw.c
--+++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -121,6 +121,36 @@ void ath9k_hw_write_array(struct ath_hw
-- 	REGWRITE_BUFFER_FLUSH(ah);
-- }
-- 
--+void ath9k_hw_read_array(struct ath_hw *ah, u32 array[][2], int size)
--+{
--+	u32 *tmp_reg_list, *tmp_data;
--+	int i;
--+
--+	tmp_reg_list = kmalloc(size * sizeof(u32), GFP_KERNEL);
--+	if (!tmp_reg_list) {
--+		dev_err(ah->dev, "%s: tmp_reg_list: alloc filed\n", __func__);
--+		return;
--+	}
--+
--+	tmp_data = kmalloc(size * sizeof(u32), GFP_KERNEL);
--+	if (!tmp_data) {
--+		dev_err(ah->dev, "%s tmp_data: alloc filed\n", __func__);
--+		goto error_tmp_data;
--+	}
--+
--+	for (i = 0; i < size; i++)
--+		tmp_reg_list[i] = array[i][0];
--+
--+	REG_READ_MULTI(ah, tmp_reg_list, tmp_data, size);
--+
--+	for (i = 0; i < size; i++)
--+		array[i][1] = tmp_data[i];
--+
--+	kfree(tmp_data);
--+error_tmp_data:
--+	kfree(tmp_reg_list);
--+}
--+
-- u32 ath9k_hw_reverse_bits(u32 val, u32 n)
-- {
-- 	u32 retval;
----- a/drivers/net/wireless/ath/ath9k/hw.h
--+++ b/drivers/net/wireless/ath/ath9k/hw.h
--@@ -138,6 +138,8 @@
-- 
-- #define REG_WRITE_ARRAY(iniarray, column, regWr) \
-- 	ath9k_hw_write_array(ah, iniarray, column, &(regWr))
--+#define REG_READ_ARRAY(ah, array, size) \
--+	ath9k_hw_read_array(ah, array, size)
-- 
-- #define AR_GPIO_OUTPUT_MUX_AS_OUTPUT             0
-- #define AR_GPIO_OUTPUT_MUX_AS_PCIE_ATTENTION_LED 1
--@@ -1020,6 +1022,7 @@ void ath9k_hw_synth_delay(struct ath_hw
-- bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
-- void ath9k_hw_write_array(struct ath_hw *ah, const struct ar5416IniArray *array,
-- 			  int column, unsigned int *writecnt);
--+void ath9k_hw_read_array(struct ath_hw *ah, u32 array[][2], int size);
-- u32 ath9k_hw_reverse_bits(u32 val, u32 n);
-- u16 ath9k_hw_computetxtime(struct ath_hw *ah,
-- 			   u8 phy, int kbps,
-diff --git a/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch b/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch
-new file mode 100644
-index 0000000..6ce60f1
---- /dev/null
-+++ b/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch
-@@ -0,0 +1,32 @@
-+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-+Date: Sun, 31 Jan 2016 12:14:34 +0100
-+Subject: [PATCH] brcmfmac: treat NULL character in NVRAM as separator
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+Platform NVRAM (stored on a flash partition) has entries separated by a
-+NULL (\0) char. Our parsing code switches from VALUE state to IDLE
-+whenever it meets a NULL (\0). When that happens our IDLE handler should
-+simply consume it and analyze whatever is placed ahead.
-+
-+This fixes harmless warnings spamming debugging output:
-+[  155.165624] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=20: ignoring invalid character
-+[  155.180806] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=44: ignoring invalid character
-+[  155.195971] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=63: ignoring invalid character
-+
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+@@ -93,7 +93,7 @@ static enum nvram_parser_state brcmf_nvr
-+ 	c = nvp->data[nvp->pos];
-+ 	if (c == '\n')
-+ 		return COMMENT;
-+-	if (is_whitespace(c))
-++	if (is_whitespace(c) || c == '\0')
-+ 		goto proceed;
-+ 	if (c == '#')
-+ 		return COMMENT;
-diff --git a/package/kernel/mac80211/patches/325-ath9k-ar9271_hw_pa_cal-use-REG_READ_ARRAY.patch b/package/kernel/mac80211/patches/325-ath9k-ar9271_hw_pa_cal-use-REG_READ_ARRAY.patch
-deleted file mode 100644
-index 4e4888f..0000000
---- a/package/kernel/mac80211/patches/325-ath9k-ar9271_hw_pa_cal-use-REG_READ_ARRAY.patch
-+++ /dev/null
-@@ -1,24 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:52 +0100
--Subject: [PATCH] ath9k: ar9271_hw_pa_cal: use REG_READ_ARRAY
--
--insted of reading each register separatly
--and waste 4ms on each operation, we can
--use one shot read.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
--@@ -440,8 +440,7 @@ static void ar9271_hw_pa_cal(struct ath_
-- 		{ AR9285_AN_RF2G3, 0 },
-- 	};
-- 
---	for (i = 0; i < ARRAY_SIZE(regList); i++)
---		regList[i][1] = REG_READ(ah, regList[i][0]);
--+	REG_READ_ARRAY(ah, regList, ARRAY_SIZE(regList));
-- 
-- 	ENABLE_REG_RMW_BUFFER(ah);
-- 	/* 7834, b1=0 */
-diff --git a/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch b/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch
-new file mode 100644
-index 0000000..012dea1
---- /dev/null
-+++ b/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch
-@@ -0,0 +1,41 @@
-+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
-+Date: Mon, 25 Jan 2016 11:47:29 +0100
-+Subject: [PATCH] brcmfmac: sdio: Increase the default timeouts a bit
-+
-+On a Radxa Rock2 board with a Ampak AP6335 (Broadcom 4339 core) it seems
-+the card responds very quickly most of the time, unfortunately during
-+initialisation it sometimes seems to take just a bit over 2 seconds to
-+respond.
-+
-+This results intialization failing with message like:
-+  brcmf_c_preinit_dcmds: Retreiving cur_etheraddr failed, -52
-+  brcmf_bus_start: failed: -52
-+  brcmf_sdio_firmware_callback: dongle is not responding
-+
-+Increasing the timeout to allow for a bit more headroom allows the
-+card to initialize reliably.
-+
-+A quick search online after diagnosing/fixing this showed that Google
-+has a similar patch in their ChromeOS tree, so this doesn't seem
-+specific to the board I'm using.
-+
-+Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
-+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
-+Acked-by: Arend van Spriel <arend@broadcom.com>
-+Reviewed-by: Douglas Anderson <dianders@chromium.org>
-+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+@@ -45,8 +45,8 @@
-+ #include "chip.h"
-+ #include "firmware.h"
-+ 
-+-#define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2000)
-+-#define CTL_DONE_TIMEOUT	msecs_to_jiffies(2000)
-++#define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
-++#define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
-+ 
-+ #ifdef DEBUG
-+ 
-diff --git a/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch b/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch
-new file mode 100644
-index 0000000..71f7a40
---- /dev/null
-+++ b/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch
-@@ -0,0 +1,87 @@
-+From: Miaoqing Pan <miaoqing@codeaurora.org>
-+Date: Fri, 5 Feb 2016 09:45:50 +0800
-+Subject: [PATCH] ath9k: make NF load complete quickly and reliably
-+
-+Make NF load complete quickly and reliably. NF load execution
-+is delayed by HW to end of frame if frame Rx or Tx is ongoing.
-+Increasing timeout to max frame duration. If NF cal is ongoing
-+before NF load, stop it before load, and restart it afterwards.
-+
-+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-+---
-+
-+--- a/drivers/net/wireless/ath/ath9k/calib.c
-++++ b/drivers/net/wireless/ath/ath9k/calib.c
-+@@ -241,6 +241,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-+ 	u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
-+ 	struct ath_common *common = ath9k_hw_common(ah);
-+ 	s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
-++	u32 bb_agc_ctl = REG_READ(ah, AR_PHY_AGC_CONTROL);
-+ 
-+ 	if (ah->caldata)
-+ 		h = ah->caldata->nfCalHist;
-+@@ -264,6 +265,16 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-+ 	}
-+ 
-+ 	/*
-++	 * stop NF cal if ongoing to ensure NF load completes immediately
-++	 * (or after end rx/tx frame if ongoing)
-++	 */
-++	if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
-++		REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
-++		REG_RMW_BUFFER_FLUSH(ah);
-++		ENABLE_REG_RMW_BUFFER(ah);
-++	}
-++
-++	/*
-+ 	 * Load software filtered NF value into baseband internal minCCApwr
-+ 	 * variable.
-+ 	 */
-+@@ -276,18 +287,33 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-+ 
-+ 	/*
-+ 	 * Wait for load to complete, should be fast, a few 10s of us.
-+-	 * The max delay was changed from an original 250us to 10000us
-+-	 * since 250us often results in NF load timeout and causes deaf
-+-	 * condition during stress testing 12/12/2009
-++	 * The max delay was changed from an original 250us to 22.2 msec.
-++	 * This would increase timeout to the longest possible frame
-++	 * (11n max length 22.1 msec)
-+ 	 */
-+-	for (j = 0; j < 10000; j++) {
-++	for (j = 0; j < 22200; j++) {
-+ 		if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
-+-		     AR_PHY_AGC_CONTROL_NF) == 0)
-++			      AR_PHY_AGC_CONTROL_NF) == 0)
-+ 			break;
-+ 		udelay(10);
-+ 	}
-+ 
-+ 	/*
-++	 * Restart NF so it can continue.
-++	 */
-++	if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
-++		ENABLE_REG_RMW_BUFFER(ah);
-++		if (bb_agc_ctl & AR_PHY_AGC_CONTROL_ENABLE_NF)
-++			REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
-++				    AR_PHY_AGC_CONTROL_ENABLE_NF);
-++		if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NO_UPDATE_NF)
-++			REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
-++				    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
-++		REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
-++		REG_RMW_BUFFER_FLUSH(ah);
-++	}
-++
-++	/*
-+ 	 * We timed out waiting for the noisefloor to load, probably due to an
-+ 	 * in-progress rx. Simply return here and allow the load plenty of time
-+ 	 * to complete before the next calibration interval.  We need to avoid
-+@@ -296,7 +322,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-+ 	 * here, the baseband nf cal will just be capped by our present
-+ 	 * noisefloor until the next calibration timer.
-+ 	 */
-+-	if (j == 10000) {
-++	if (j == 22200) {
-+ 		ath_dbg(common, ANY,
-+ 			"Timeout while waiting for nf to load: AR_PHY_AGC_CONTROL=0x%x\n",
-+ 			REG_READ(ah, AR_PHY_AGC_CONTROL));
-diff --git a/package/kernel/mac80211/patches/326-ath9k-use-one-shot-read-in-ath9k_hw_update_mibstats.patch b/package/kernel/mac80211/patches/326-ath9k-use-one-shot-read-in-ath9k_hw_update_mibstats.patch
-deleted file mode 100644
-index a22cd1d..0000000
---- a/package/kernel/mac80211/patches/326-ath9k-use-one-shot-read-in-ath9k_hw_update_mibstats.patch
-+++ /dev/null
-@@ -1,39 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:53 +0100
--Subject: [PATCH] ath9k: use one shot read in ath9k_hw_update_mibstats
--
--this will reduce some overhead on usb bus.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ani.c
--+++ b/drivers/net/wireless/ath/ath9k/ani.c
--@@ -107,11 +107,21 @@ static const struct ani_cck_level_entry
-- static void ath9k_hw_update_mibstats(struct ath_hw *ah,
-- 				     struct ath9k_mib_stats *stats)
-- {
---	stats->ackrcv_bad += REG_READ(ah, AR_ACK_FAIL);
---	stats->rts_bad += REG_READ(ah, AR_RTS_FAIL);
---	stats->fcs_bad += REG_READ(ah, AR_FCS_FAIL);
---	stats->rts_good += REG_READ(ah, AR_RTS_OK);
---	stats->beacons += REG_READ(ah, AR_BEACON_CNT);
--+	u32 addr[5] = {AR_RTS_OK, AR_RTS_FAIL, AR_ACK_FAIL,
--+		       AR_FCS_FAIL, AR_BEACON_CNT};
--+	u32 data[5];
--+
--+	REG_READ_MULTI(ah, &addr[0], &data[0], 5);
--+	/* AR_RTS_OK */
--+	stats->rts_good += data[0];
--+	/* AR_RTS_FAIL */
--+	stats->rts_bad += data[1];
--+	/* AR_ACK_FAIL */
--+	stats->ackrcv_bad += data[2];
--+	/* AR_FCS_FAIL */
--+	stats->fcs_bad += data[3];
--+	/* AR_BEACON_CNT */
--+	stats->beacons += data[4];
-- }
-- 
-- static void ath9k_ani_restart(struct ath_hw *ah)
-diff --git a/package/kernel/mac80211/patches/327-ath9k-ath9k_hw_loadnf-use-REG_RMW.patch b/package/kernel/mac80211/patches/327-ath9k-ath9k_hw_loadnf-use-REG_RMW.patch
-deleted file mode 100644
-index e5a362f..0000000
---- a/package/kernel/mac80211/patches/327-ath9k-ath9k_hw_loadnf-use-REG_RMW.patch
-+++ /dev/null
-@@ -1,71 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:54 +0100
--Subject: [PATCH] ath9k: ath9k_hw_loadnf: use REG_RMW
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/calib.c
--+++ b/drivers/net/wireless/ath/ath9k/calib.c
--@@ -238,7 +238,6 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-- {
-- 	struct ath9k_nfcal_hist *h = NULL;
-- 	unsigned i, j;
---	int32_t val;
-- 	u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
-- 	struct ath_common *common = ath9k_hw_common(ah);
-- 	s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
--@@ -246,6 +245,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-- 	if (ah->caldata)
-- 		h = ah->caldata->nfCalHist;
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	for (i = 0; i < NUM_NF_READINGS; i++) {
-- 		if (chainmask & (1 << i)) {
-- 			s16 nfval;
--@@ -258,10 +258,8 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-- 			else
-- 				nfval = default_nf;
-- 
---			val = REG_READ(ah, ah->nf_regs[i]);
---			val &= 0xFFFFFE00;
---			val |= (((u32) nfval << 1) & 0x1ff);
---			REG_WRITE(ah, ah->nf_regs[i], val);
--+			REG_RMW(ah, ah->nf_regs[i],
--+				(((u32) nfval << 1) & 0x1ff), 0x1ff);
-- 		}
-- 	}
-- 
--@@ -274,6 +272,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-- 	REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
-- 		    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
-- 	REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	/*
-- 	 * Wait for load to complete, should be fast, a few 10s of us.
--@@ -309,19 +308,17 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
-- 	 * by the median we just loaded.  This will be initial (and max) value
-- 	 * of next noise floor calibration the baseband does.
-- 	 */
---	ENABLE_REGWRITE_BUFFER(ah);
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	for (i = 0; i < NUM_NF_READINGS; i++) {
-- 		if (chainmask & (1 << i)) {
-- 			if ((i >= AR5416_MAX_CHAINS) && !IS_CHAN_HT40(chan))
-- 				continue;
-- 
---			val = REG_READ(ah, ah->nf_regs[i]);
---			val &= 0xFFFFFE00;
---			val |= (((u32) (-50) << 1) & 0x1ff);
---			REG_WRITE(ah, ah->nf_regs[i], val);
--+			REG_RMW(ah, ah->nf_regs[i],
--+					(((u32) (-50) << 1) & 0x1ff), 0x1ff);
-- 		}
-- 	}
---	REGWRITE_BUFFER_FLUSH(ah);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	return 0;
-- }
-diff --git a/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch b/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch
-new file mode 100644
-index 0000000..f7f9df9
---- /dev/null
-+++ b/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch
-@@ -0,0 +1,54 @@
-+From: Henning Rogge <hrogge@gmail.com>
-+Date: Wed, 3 Feb 2016 13:58:36 +0100
-+Subject: [PATCH] mac80211: Remove MPP table entries with MPath
-+
-+Make the mesh_path_del() function remove all mpp table entries
-+that are proxied by the removed mesh path.
-+
-+Acked-by: Bob Copeland <me@bobcopeland.com>
-+Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/mac80211/mesh_pathtbl.c
-++++ b/net/mac80211/mesh_pathtbl.c
-+@@ -835,6 +835,29 @@ void mesh_path_flush_by_nexthop(struct s
-+ 	rcu_read_unlock();
-+ }
-+ 
-++static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
-++			       const u8 *proxy)
-++{
-++	struct mesh_table *tbl;
-++	struct mesh_path *mpp;
-++	struct mpath_node *node;
-++	int i;
-++
-++	rcu_read_lock();
-++	read_lock_bh(&pathtbl_resize_lock);
-++	tbl = resize_dereference_mpp_paths();
-++	for_each_mesh_entry(tbl, node, i) {
-++		mpp = node->mpath;
-++		if (ether_addr_equal(mpp->mpp, proxy)) {
-++			spin_lock(&tbl->hashwlock[i]);
-++			__mesh_path_del(tbl, node);
-++			spin_unlock(&tbl->hashwlock[i]);
-++		}
-++	}
-++	read_unlock_bh(&pathtbl_resize_lock);
-++	rcu_read_unlock();
-++}
-++
-+ static void table_flush_by_iface(struct mesh_table *tbl,
-+ 				 struct ieee80211_sub_if_data *sdata)
-+ {
-+@@ -892,6 +915,9 @@ int mesh_path_del(struct ieee80211_sub_i
-+ 	int hash_idx;
-+ 	int err = 0;
-+ 
-++	/* flush relevant mpp entries first */
-++	mpp_flush_by_proxy(sdata, addr);
-++
-+ 	read_lock_bh(&pathtbl_resize_lock);
-+ 	tbl = resize_dereference_mesh_paths();
-+ 	hash_idx = mesh_table_hash(addr, sdata, tbl);
-diff --git a/package/kernel/mac80211/patches/328-ath9k-write-buffer-related-optimisation-in-ar5008_hw.patch b/package/kernel/mac80211/patches/328-ath9k-write-buffer-related-optimisation-in-ar5008_hw.patch
-deleted file mode 100644
-index 01c8011..0000000
---- a/package/kernel/mac80211/patches/328-ath9k-write-buffer-related-optimisation-in-ar5008_hw.patch
-+++ /dev/null
-@@ -1,27 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:55 +0100
--Subject: [PATCH] ath9k: write buffer related optimisation in
-- ar5008_hw_set_channel_regs
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
--+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
--@@ -681,12 +681,13 @@ static void ar5008_hw_set_channel_regs(s
-- 			phymode |= AR_PHY_FC_DYN2040_PRI_CH;
-- 
-- 	}
--+	ENABLE_REGWRITE_BUFFER(ah);
-- 	REG_WRITE(ah, AR_PHY_TURBO, phymode);
-- 
--+	/* This function do only REG_WRITE, so
--+	 * we can include it to REGWRITE_BUFFER. */
-- 	ath9k_hw_set11nmac2040(ah, chan);
-- 
---	ENABLE_REGWRITE_BUFFER(ah);
---
-- 	REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
-- 	REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
-- 
-diff --git a/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch b/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch
-new file mode 100644
-index 0000000..740993c
---- /dev/null
-+++ b/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch
-@@ -0,0 +1,104 @@
-+From: Henning Rogge <hrogge@gmail.com>
-+Date: Wed, 3 Feb 2016 13:58:37 +0100
-+Subject: [PATCH] mac80211: let unused MPP table entries timeout
-+
-+Remember the last time when a mpp table entry is used for
-+rx or tx and remove them after MESH_PATH_EXPIRE time.
-+
-+Acked-by: Bob Copeland <me@bobcopeland.com>
-+Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/mac80211/mesh_pathtbl.c
-++++ b/net/mac80211/mesh_pathtbl.c
-+@@ -942,6 +942,46 @@ enddel:
-+ }
-+ 
-+ /**
-++ * mpp_path_del - delete a mesh proxy path from the table
-++ *
-++ * @addr: addr address (ETH_ALEN length)
-++ * @sdata: local subif
-++ *
-++ * Returns: 0 if successful
-++ */
-++static int mpp_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-++{
-++	struct mesh_table *tbl;
-++	struct mesh_path *mpath;
-++	struct mpath_node *node;
-++	struct hlist_head *bucket;
-++	int hash_idx;
-++	int err = 0;
-++
-++	read_lock_bh(&pathtbl_resize_lock);
-++	tbl = resize_dereference_mpp_paths();
-++	hash_idx = mesh_table_hash(addr, sdata, tbl);
-++	bucket = &tbl->hash_buckets[hash_idx];
-++
-++	spin_lock(&tbl->hashwlock[hash_idx]);
-++	hlist_for_each_entry(node, bucket, list) {
-++		mpath = node->mpath;
-++		if (mpath->sdata == sdata &&
-++		    ether_addr_equal(addr, mpath->dst)) {
-++			__mesh_path_del(tbl, node);
-++			goto enddel;
-++		}
-++	}
-++
-++	err = -ENXIO;
-++enddel:
-++	mesh_paths_generation++;
-++	spin_unlock(&tbl->hashwlock[hash_idx]);
-++	read_unlock_bh(&pathtbl_resize_lock);
-++	return err;
-++}
-++
-++/**
-+  * mesh_path_tx_pending - sends pending frames in a mesh path queue
-+  *
-+  * @mpath: mesh path to activate
-+@@ -1157,6 +1197,17 @@ void mesh_path_expire(struct ieee80211_s
-+ 		     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
-+ 			mesh_path_del(mpath->sdata, mpath->dst);
-+ 	}
-++
-++	tbl = rcu_dereference(mpp_paths);
-++	for_each_mesh_entry(tbl, node, i) {
-++		if (node->mpath->sdata != sdata)
-++			continue;
-++		mpath = node->mpath;
-++		if ((!(mpath->flags & MESH_PATH_FIXED)) &&
-++		    time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
-++			mpp_path_del(mpath->sdata, mpath->dst);
-++	}
-++
-+ 	rcu_read_unlock();
-+ }
-+ 
-+--- a/net/mac80211/rx.c
-++++ b/net/mac80211/rx.c
-+@@ -2291,6 +2291,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
-+ 			spin_lock_bh(&mppath->state_lock);
-+ 			if (!ether_addr_equal(mppath->mpp, mpp_addr))
-+ 				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
-++			mppath->exp_time = jiffies;
-+ 			spin_unlock_bh(&mppath->state_lock);
-+ 		}
-+ 		rcu_read_unlock();
-+--- a/net/mac80211/tx.c
-++++ b/net/mac80211/tx.c
-+@@ -2171,8 +2171,11 @@ static struct sk_buff *ieee80211_build_h
-+ 					mpp_lookup = true;
-+ 			}
-+ 
-+-			if (mpp_lookup)
-++			if (mpp_lookup) {
-+ 				mppath = mpp_path_lookup(sdata, skb->data);
-++				if (mppath)
-++					mppath->exp_time = jiffies;
-++			}
-+ 
-+ 			if (mppath && mpath)
-+ 				mesh_path_del(mpath->sdata, mpath->dst);
-diff --git a/package/kernel/mac80211/patches/329-ath9k-ath9k_hw_set_4k_power_cal_tabl-use-rmw-buffer.patch b/package/kernel/mac80211/patches/329-ath9k-ath9k_hw_set_4k_power_cal_tabl-use-rmw-buffer.patch
-deleted file mode 100644
-index e5219f2..0000000
---- a/package/kernel/mac80211/patches/329-ath9k-ath9k_hw_set_4k_power_cal_tabl-use-rmw-buffer.patch
-+++ /dev/null
-@@ -1,26 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:56 +0100
--Subject: [PATCH] ath9k: ath9k_hw_set_4k_power_cal_tabl: use rmw buffer
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
--+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
--@@ -389,6 +389,7 @@ static void ath9k_hw_set_4k_power_cal_ta
-- 		}
-- 	}
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
-- 		      (numXpdGain - 1) & 0x3);
-- 	REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
--@@ -396,6 +397,7 @@ static void ath9k_hw_set_4k_power_cal_ta
-- 	REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
-- 		      xpdGainValues[1]);
-- 	REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3, 0);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
-- 		regChainOffset = i * 0x1000;
-diff --git a/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch b/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch
-new file mode 100644
-index 0000000..0c36b1d
---- /dev/null
-+++ b/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch
-@@ -0,0 +1,143 @@
-+From: Henning Rogge <hrogge@gmail.com>
-+Date: Wed, 3 Feb 2016 13:58:38 +0100
-+Subject: [PATCH] mac80211: Unify mesh and mpp path removal function
-+
-+mpp_path_del() and mesh_path_del() are mostly the same function.
-+Move common code into a new static function.
-+
-+Acked-by: Bob Copeland <me@bobcopeland.com>
-+Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/mac80211/mesh_pathtbl.c
-++++ b/net/mac80211/mesh_pathtbl.c
-+@@ -55,16 +55,21 @@ int mpp_paths_generation;
-+ static DEFINE_RWLOCK(pathtbl_resize_lock);
-+ 
-+ 
-++static inline struct mesh_table *resize_dereference_paths(
-++	struct mesh_table __rcu *table)
-++{
-++	return rcu_dereference_protected(table,
-++					lockdep_is_held(&pathtbl_resize_lock));
-++}
-++
-+ static inline struct mesh_table *resize_dereference_mesh_paths(void)
-+ {
-+-	return rcu_dereference_protected(mesh_paths,
-+-		lockdep_is_held(&pathtbl_resize_lock));
-++	return resize_dereference_paths(mesh_paths);
-+ }
-+ 
-+ static inline struct mesh_table *resize_dereference_mpp_paths(void)
-+ {
-+-	return rcu_dereference_protected(mpp_paths,
-+-		lockdep_is_held(&pathtbl_resize_lock));
-++	return resize_dereference_paths(mpp_paths);
-+ }
-+ 
-+ /*
-+@@ -899,14 +904,17 @@ void mesh_path_flush_by_iface(struct iee
-+ }
-+ 
-+ /**
-+- * mesh_path_del - delete a mesh path from the table
-++ * table_path_del - delete a path from the mesh or mpp table
-+  *
-+- * @addr: dst address (ETH_ALEN length)
-++ * @tbl: mesh or mpp path table
-+  * @sdata: local subif
-++ * @addr: dst address (ETH_ALEN length)
-+  *
-+  * Returns: 0 if successful
-+  */
-+-int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-++static int table_path_del(struct mesh_table __rcu *rcu_tbl,
-++			  struct ieee80211_sub_if_data *sdata,
-++			  const u8 *addr)
-+ {
-+ 	struct mesh_table *tbl;
-+ 	struct mesh_path *mpath;
-+@@ -915,11 +923,7 @@ int mesh_path_del(struct ieee80211_sub_i
-+ 	int hash_idx;
-+ 	int err = 0;
-+ 
-+-	/* flush relevant mpp entries first */
-+-	mpp_flush_by_proxy(sdata, addr);
-+-
-+-	read_lock_bh(&pathtbl_resize_lock);
-+-	tbl = resize_dereference_mesh_paths();
-++	tbl = resize_dereference_paths(rcu_tbl);
-+ 	hash_idx = mesh_table_hash(addr, sdata, tbl);
-+ 	bucket = &tbl->hash_buckets[hash_idx];
-+ 
-+@@ -935,9 +939,30 @@ int mesh_path_del(struct ieee80211_sub_i
-+ 
-+ 	err = -ENXIO;
-+ enddel:
-+-	mesh_paths_generation++;
-+ 	spin_unlock(&tbl->hashwlock[hash_idx]);
-++	return err;
-++}
-++
-++/**
-++ * mesh_path_del - delete a mesh path from the table
-++ *
-++ * @addr: dst address (ETH_ALEN length)
-++ * @sdata: local subif
-++ *
-++ * Returns: 0 if successful
-++ */
-++int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-++{
-++	int err = 0;
-++
-++	/* flush relevant mpp entries first */
-++	mpp_flush_by_proxy(sdata, addr);
-++
-++	read_lock_bh(&pathtbl_resize_lock);
-++	err = table_path_del(mesh_paths, sdata, addr);
-++	mesh_paths_generation++;
-+ 	read_unlock_bh(&pathtbl_resize_lock);
-++
-+ 	return err;
-+ }
-+ 
-+@@ -951,33 +976,13 @@ enddel:
-+  */
-+ static int mpp_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-+ {
-+-	struct mesh_table *tbl;
-+-	struct mesh_path *mpath;
-+-	struct mpath_node *node;
-+-	struct hlist_head *bucket;
-+-	int hash_idx;
-+ 	int err = 0;
-+ 
-+ 	read_lock_bh(&pathtbl_resize_lock);
-+-	tbl = resize_dereference_mpp_paths();
-+-	hash_idx = mesh_table_hash(addr, sdata, tbl);
-+-	bucket = &tbl->hash_buckets[hash_idx];
-+-
-+-	spin_lock(&tbl->hashwlock[hash_idx]);
-+-	hlist_for_each_entry(node, bucket, list) {
-+-		mpath = node->mpath;
-+-		if (mpath->sdata == sdata &&
-+-		    ether_addr_equal(addr, mpath->dst)) {
-+-			__mesh_path_del(tbl, node);
-+-			goto enddel;
-+-		}
-+-	}
-+-
-+-	err = -ENXIO;
-+-enddel:
-+-	mesh_paths_generation++;
-+-	spin_unlock(&tbl->hashwlock[hash_idx]);
-++	err = table_path_del(mpp_paths, sdata, addr);
-++	mpp_paths_generation++;
-+ 	read_unlock_bh(&pathtbl_resize_lock);
-++
-+ 	return err;
-+ }
-+ 
-diff --git a/package/kernel/mac80211/patches/330-ath9k-use-rmw-buffer-in-ath9k_hw_set_operating_mode-.patch b/package/kernel/mac80211/patches/330-ath9k-use-rmw-buffer-in-ath9k_hw_set_operating_mode-.patch
-deleted file mode 100644
-index 6ce3f40..0000000
---- a/package/kernel/mac80211/patches/330-ath9k-use-rmw-buffer-in-ath9k_hw_set_operating_mode-.patch
-+++ /dev/null
-@@ -1,43 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:57 +0100
--Subject: [PATCH] ath9k: use rmw buffer in ath9k_hw_set_operating_mode
-- and ath9k_hw_reset
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/hw.c
--+++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -1227,6 +1227,7 @@ static void ath9k_hw_set_operating_mode(
-- 	u32 mask = AR_STA_ID1_STA_AP | AR_STA_ID1_ADHOC;
-- 	u32 set = AR_STA_ID1_KSRCH_MODE;
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	switch (opmode) {
-- 	case NL80211_IFTYPE_ADHOC:
-- 		if (!AR_SREV_9340_13(ah)) {
--@@ -1248,6 +1249,7 @@ static void ath9k_hw_set_operating_mode(
-- 		break;
-- 	}
-- 	REG_RMW(ah, AR_STA_ID1, set, mask);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- }
-- 
-- void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
--@@ -1960,6 +1962,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-- 	if (!ath9k_hw_mci_is_enabled(ah))
-- 		REG_WRITE(ah, AR_OBS, 8);
-- 
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	if (ah->config.rx_intr_mitigation) {
-- 		REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, ah->config.rimt_last);
-- 		REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_FIRST, ah->config.rimt_first);
--@@ -1969,6 +1972,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-- 		REG_RMW_FIELD(ah, AR_TIMT, AR_TIMT_LAST, 300);
-- 		REG_RMW_FIELD(ah, AR_TIMT, AR_TIMT_FIRST, 750);
-- 	}
--+	REG_RMW_BUFFER_FLUSH(ah);
-- 
-- 	ath9k_hw_init_bb(ah, chan);
-- 
-diff --git a/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch b/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch
-new file mode 100644
-index 0000000..4dc6d66
---- /dev/null
-+++ b/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch
-@@ -0,0 +1,51 @@
-+From: Sven Eckelmann <sven.eckelmann@open-mesh.com>
-+Date: Tue, 2 Feb 2016 08:12:26 +0100
-+Subject: [PATCH] mac80211: minstrel: Change expected throughput unit back to
-+ Kbps
-+
-+The change from cur_tp to the function
-+minstrel_get_tp_avg/minstrel_ht_get_tp_avg changed the unit used for the
-+current throughput. For example in minstrel_ht the correct
-+conversion between them would be:
-+
-+    mrs->cur_tp / 10 == minstrel_ht_get_tp_avg(..).
-+
-+This factor 10 must also be included in the calculation of
-+minstrel_get_expected_throughput and minstrel_ht_get_expected_throughput to
-+return values with the unit [Kbps] instead of [10Kbps]. Otherwise routing
-+algorithms like B.A.T.M.A.N. V will make incorrect decision based on these
-+values. Its kernel based implementation expects expected_throughput always
-+to have the unit [Kbps] and not sometimes [10Kbps] and sometimes [Kbps].
-+
-+The same requirement has iw or olsrdv2's nl80211 based statistics module
-+which retrieve the same data via NL80211_STA_INFO_TX_BITRATE.
-+
-+Cc: stable@vger.kernel.org
-+Fixes: 6a27b2c40b48 ("mac80211: restructure per-rate throughput calculation into function")
-+Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
-+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-+---
-+
-+--- a/net/mac80211/rc80211_minstrel.c
-++++ b/net/mac80211/rc80211_minstrel.c
-+@@ -711,7 +711,7 @@ static u32 minstrel_get_expected_through
-+ 	 * computing cur_tp
-+ 	 */
-+ 	tmp_mrs = &mi->r[idx].stats;
-+-	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma);
-++	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma) * 10;
-+ 	tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024;
-+ 
-+ 	return tmp_cur_tp;
-+--- a/net/mac80211/rc80211_minstrel_ht.c
-++++ b/net/mac80211/rc80211_minstrel_ht.c
-+@@ -1335,7 +1335,8 @@ static u32 minstrel_ht_get_expected_thro
-+ 	prob = mi->groups[i].rates[j].prob_ewma;
-+ 
-+ 	/* convert tp_avg from pkt per second in kbps */
-+-	tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * AVG_PKT_SIZE * 8 / 1024;
-++	tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * 10;
-++	tp_avg = tp_avg * AVG_PKT_SIZE * 8 / 1024;
-+ 
-+ 	return tp_avg;
-+ }
-diff --git a/package/kernel/mac80211/patches/331-ath9k-ath9k_hw_4k_set_board_values-use-rmw-buffer.patch b/package/kernel/mac80211/patches/331-ath9k-ath9k_hw_4k_set_board_values-use-rmw-buffer.patch
-deleted file mode 100644
-index edd6160..0000000
---- a/package/kernel/mac80211/patches/331-ath9k-ath9k_hw_4k_set_board_values-use-rmw-buffer.patch
-+++ /dev/null
-@@ -1,26 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:58 +0100
--Subject: [PATCH] ath9k: ath9k_hw_4k_set_board_values: use rmw buffer
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
--+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
--@@ -1082,6 +1082,7 @@ static void ath9k_hw_4k_set_board_values
-- 		mask = BIT(0)|BIT(5)|BIT(10)|BIT(15)|BIT(20)|BIT(25);
-- 		pwrctrl = mask * bb_desired_scale;
-- 		clr = mask * 0x1f;
--+		ENABLE_REG_RMW_BUFFER(ah);
-- 		REG_RMW(ah, AR_PHY_TX_PWRCTRL8, pwrctrl, clr);
-- 		REG_RMW(ah, AR_PHY_TX_PWRCTRL10, pwrctrl, clr);
-- 		REG_RMW(ah, AR_PHY_CH0_TX_PWRCTRL12, pwrctrl, clr);
--@@ -1096,6 +1097,7 @@ static void ath9k_hw_4k_set_board_values
-- 		clr = mask * 0x1f;
-- 		REG_RMW(ah, AR_PHY_CH0_TX_PWRCTRL11, pwrctrl, clr);
-- 		REG_RMW(ah, AR_PHY_CH0_TX_PWRCTRL13, pwrctrl, clr);
--+		REG_RMW_BUFFER_FLUSH(ah);
-- 	}
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch b/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch
-new file mode 100644
-index 0000000..1fd016f
---- /dev/null
-+++ b/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch
-@@ -0,0 +1,307 @@
-+From: Hante Meuleman <meuleman@broadcom.com>
-+Date: Sun, 7 Feb 2016 18:08:24 +0100
-+Subject: [PATCH] brcmfmac: Increase nr of supported flowrings.
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+New generation devices have firmware which has more than 256 flowrings.
-+E.g. following debugging message comes from 14e4:4365 BCM4366:
-+[  194.606245] brcmfmac: brcmf_pcie_init_ringbuffers Nr of flowrings is 264
-+
-+At various code places (related to flowrings) we were using u8 which
-+could lead to storing wrong number or infinite loops when indexing with
-+this type. This issue was quite easy to spot in brcmf_flowring_detach
-+where it led to infinite loop e.g. on failed initialization.
-+
-+This patch switches code to proper types and increases the maximum
-+number of supported flowrings to 512.
-+
-+Originally this change was sent in September 2015, but back it was
-+causing a regression on BCM43602 resulting in:
-+Unable to handle kernel NULL pointer dereference at virtual address ...
-+
-+The reason for this regression was missing update (s/u8/u16) of struct
-+brcmf_flowring_ring. This problem was handled in 9f64df9 ("brcmfmac: Fix
-+bug in flowring management."). Starting with that it's safe to apply
-+this original patch as it doesn't cause a regression anymore.
-+
-+This patch fixes an infinite loop on BCM4366 which is supported since
-+4.4 so it makes sense to apply it to stable 4.4+.
-+
-+Cc: <stable@vger.kernel.org> # 4.4+
-+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-+Signed-off-by: Arend van Spriel <arend@broadcom.com>
-+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-+---
-+
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+@@ -32,7 +32,7 @@
-+ #define BRCMF_FLOWRING_LOW		(BRCMF_FLOWRING_HIGH - 256)
-+ #define BRCMF_FLOWRING_INVALID_IFIDX	0xff
-+ 
-+-#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
-++#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16)
-+ #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
-+ 
-+ static const u8 brcmf_flowring_prio2fifo[] = {
-+@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
-+ 			  u8 prio, u8 ifidx)
-+ {
-+ 	struct brcmf_flowring_hash *hash;
-+-	u8 hash_idx;
-++	u16 hash_idx;
-+ 	u32 i;
-+ 	bool found;
-+ 	bool sta;
-+@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
-+ 	}
-+ 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
-+ 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
-++	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
-+ 	found = false;
-+ 	hash = flow->hash;
-+ 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
-+@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
-+ 			break;
-+ 		}
-+ 		hash_idx++;
-++		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
-+ 	}
-+ 	if (found)
-+ 		return hash[hash_idx].flowid;
-+@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_f
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+ 	struct brcmf_flowring_hash *hash;
-+-	u8 hash_idx;
-++	u16 hash_idx;
-+ 	u32 i;
-+ 	bool found;
-+ 	u8 fifo;
-+@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_f
-+ 	}
-+ 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
-+ 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
-++	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
-+ 	found = false;
-+ 	hash = flow->hash;
-+ 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
-+@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_f
-+ 			break;
-+ 		}
-+ 		hash_idx++;
-++		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
-+ 	}
-+ 	if (found) {
-+ 		for (i = 0; i < flow->nrofrings; i++) {
-+@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_f
-+ }
-+ 
-+ 
-+-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
-++u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+ 
-+@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowr
-+ }
-+ 
-+ 
-+-static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
-++static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
-+ 				 bool blocked)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+@@ -228,10 +232,10 @@ static void brcmf_flowring_block(struct
-+ }
-+ 
-+ 
-+-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
-++void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+-	u8 hash_idx;
-++	u16 hash_idx;
-+ 	struct sk_buff *skb;
-+ 
-+ 	ring = flow->rings[flowid];
-+@@ -253,7 +257,7 @@ void brcmf_flowring_delete(struct brcmf_
-+ }
-+ 
-+ 
-+-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
-++u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
-+ 			   struct sk_buff *skb)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+@@ -279,7 +283,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_
-+ }
-+ 
-+ 
-+-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
-++struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+ 	struct sk_buff *skb;
-+@@ -300,7 +304,7 @@ struct sk_buff *brcmf_flowring_dequeue(s
-+ }
-+ 
-+ 
-+-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
-++void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
-+ 			     struct sk_buff *skb)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+@@ -311,7 +315,7 @@ void brcmf_flowring_reinsert(struct brcm
-+ }
-+ 
-+ 
-+-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
-++u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+ 
-+@@ -326,7 +330,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flo
-+ }
-+ 
-+ 
-+-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
-++void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+ 
-+@@ -340,10 +344,10 @@ void brcmf_flowring_open(struct brcmf_fl
-+ }
-+ 
-+ 
-+-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid)
-++u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid)
-+ {
-+ 	struct brcmf_flowring_ring *ring;
-+-	u8 hash_idx;
-++	u16 hash_idx;
-+ 
-+ 	ring = flow->rings[flowid];
-+ 	hash_idx = ring->hash_id;
-+@@ -384,7 +388,7 @@ void brcmf_flowring_detach(struct brcmf_
-+ 	struct brcmf_pub *drvr = bus_if->drvr;
-+ 	struct brcmf_flowring_tdls_entry *search;
-+ 	struct brcmf_flowring_tdls_entry *remove;
-+-	u8 flowid;
-++	u16 flowid;
-+ 
-+ 	for (flowid = 0; flowid < flow->nrofrings; flowid++) {
-+ 		if (flow->rings[flowid])
-+@@ -408,7 +412,7 @@ void brcmf_flowring_configure_addr_mode(
-+ 	struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
-+ 	struct brcmf_pub *drvr = bus_if->drvr;
-+ 	u32 i;
-+-	u8 flowid;
-++	u16 flowid;
-+ 
-+ 	if (flow->addr_mode[ifidx] != addr_mode) {
-+ 		for (i = 0; i < ARRAY_SIZE(flow->hash); i++) {
-+@@ -434,7 +438,7 @@ void brcmf_flowring_delete_peer(struct b
-+ 	struct brcmf_flowring_tdls_entry *prev;
-+ 	struct brcmf_flowring_tdls_entry *search;
-+ 	u32 i;
-+-	u8 flowid;
-++	u16 flowid;
-+ 	bool sta;
-+ 
-+ 	sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT);
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
-+@@ -16,7 +16,7 @@
-+ #define BRCMFMAC_FLOWRING_H
-+ 
-+ 
-+-#define BRCMF_FLOWRING_HASHSIZE		256
-++#define BRCMF_FLOWRING_HASHSIZE		512		/* has to be 2^x */
-+ #define BRCMF_FLOWRING_INVALID_ID	0xFFFFFFFF
-+ 
-+ 
-+@@ -24,7 +24,7 @@ struct brcmf_flowring_hash {
-+ 	u8 mac[ETH_ALEN];
-+ 	u8 fifo;
-+ 	u8 ifidx;
-+-	u8 flowid;
-++	u16 flowid;
-+ };
-+ 
-+ enum ring_status {
-+@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_f
-+ 			  u8 prio, u8 ifidx);
-+ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
-+ 			  u8 prio, u8 ifidx);
-+-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid);
-+-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid);
-+-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid);
-+-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
-++void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid);
-++void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid);
-++u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid);
-++u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
-+ 			   struct sk_buff *skb);
-+-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid);
-+-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
-++struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid);
-++void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
-+ 			     struct sk_buff *skb);
-+-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid);
-+-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid);
-++u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid);
-++u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid);
-+ struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings);
-+ void brcmf_flowring_detach(struct brcmf_flowring *flow);
-+ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+@@ -677,7 +677,7 @@ static u32 brcmf_msgbuf_flowring_create(
-+ }
-+ 
-+ 
-+-static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
-++static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
-+ {
-+ 	struct brcmf_flowring *flow = msgbuf->flow;
-+ 	struct brcmf_commonring *commonring;
-+@@ -1310,7 +1310,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct
-+ }
-+ 
-+ 
-+-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
-++void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
-+ {
-+ 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
-+ 	struct msgbuf_tx_flowring_delete_req *delete;
-+@@ -1415,6 +1415,13 @@ int brcmf_proto_msgbuf_attach(struct brc
-+ 	u32 count;
-+ 
-+ 	if_msgbuf = drvr->bus_if->msgbuf;
-++
-++	if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
-++		brcmf_err("driver not configured for this many flowrings %d\n",
-++			  if_msgbuf->nrof_flowrings);
-++		if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
-++	}
-++
-+ 	msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
-+ 	if (!msgbuf)
-+ 		goto fail;
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-+@@ -33,7 +33,7 @@
-+ 
-+ 
-+ int brcmf_proto_msgbuf_rx_trigger(struct device *dev);
-+-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid);
-++void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid);
-+ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr);
-+ void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr);
-+ #else
-diff --git a/package/kernel/mac80211/patches/332-ath9k-ath9k_hw_analog_shift_rmw-use-REG_RMW.patch b/package/kernel/mac80211/patches/332-ath9k-ath9k_hw_analog_shift_rmw-use-REG_RMW.patch
-deleted file mode 100644
-index 3ce4428..0000000
---- a/package/kernel/mac80211/patches/332-ath9k-ath9k_hw_analog_shift_rmw-use-REG_RMW.patch
-+++ /dev/null
-@@ -1,27 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:29:59 +0100
--Subject: [PATCH] ath9k: ath9k_hw_analog_shift_rmw: use REG_RMW
--
--use REG_RMW in ath9k_hw_analog_shift_rmw.
--It will double execution speed on usb bus.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/eeprom.c
--+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
--@@ -27,12 +27,7 @@ void ath9k_hw_analog_shift_regwrite(stru
-- void ath9k_hw_analog_shift_rmw(struct ath_hw *ah, u32 reg, u32 mask,
-- 			       u32 shift, u32 val)
-- {
---	u32 regVal;
---
---	regVal = REG_READ(ah, reg) & ~mask;
---	regVal |= (val << shift) & mask;
---
---	REG_WRITE(ah, reg, regVal);
--+	REG_RMW(ah, reg, ((val << shift) & mask), mask);
-- 
-- 	if (ah->config.analog_shiftreg)
-- 		udelay(100);
-diff --git a/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch b/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch
-new file mode 100644
-index 0000000..e414f23
---- /dev/null
-+++ b/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch
-@@ -0,0 +1,22 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Mon, 8 Feb 2016 14:24:36 +0100
-+Subject: [PATCH] cfg80211: fix faulty variable initialization in
-+ ieee80211_amsdu_to_8023s
-+
-+reuse_skb is set to true if the code decides to use the last segment.
-+Fixes a memory leak
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/wireless/util.c
-++++ b/net/wireless/util.c
-+@@ -676,7 +676,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
-+ 	u8 *payload;
-+ 	int offset = 0, remaining, err;
-+ 	struct ethhdr eth;
-+-	bool reuse_skb = true;
-++	bool reuse_skb = false;
-+ 	bool last = false;
-+ 
-+ 	if (has_80211_header) {
-diff --git a/package/kernel/mac80211/patches/333-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_4k_set_.patch b/package/kernel/mac80211/patches/333-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_4k_set_.patch
-deleted file mode 100644
-index 8f12b36..0000000
---- a/package/kernel/mac80211/patches/333-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_4k_set_.patch
-+++ /dev/null
-@@ -1,47 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:30:01 +0100
--Subject: [PATCH] ath9k: use REG_RMW and rmw buffer in
-- ath9k_hw_4k_set_gain
--
--it is possible to reduce time needed for this function
--by rplacing REG_WRITE with REG_RMW (plus dummy 0) and putt all commands
--in same buffer.
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
--+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
--@@ -772,15 +772,14 @@ static void ath9k_hw_4k_set_gain(struct
-- 				 struct ar5416_eeprom_4k *eep,
-- 				 u8 txRxAttenLocal)
-- {
---	REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0,
---		  pModal->antCtrlChain[0]);
---
---	REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0),
---		  (REG_READ(ah, AR_PHY_TIMING_CTRL4(0)) &
---		   ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
---		     AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
---		  SM(pModal->iqCalICh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
---		  SM(pModal->iqCalQCh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
--+	ENABLE_REG_RMW_BUFFER(ah);
--+	REG_RMW(ah, AR_PHY_SWITCH_CHAIN_0,
--+		pModal->antCtrlChain[0], 0);
--+
--+	REG_RMW(ah, AR_PHY_TIMING_CTRL4(0),
--+		SM(pModal->iqCalICh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
--+		SM(pModal->iqCalQCh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF),
--+		AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF | AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF);
-- 
-- 	if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-- 	    AR5416_EEP_MINOR_VER_3) {
--@@ -819,6 +818,7 @@ static void ath9k_hw_4k_set_gain(struct
-- 		      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
-- 	REG_RMW_FIELD(ah, AR_PHY_RXGAIN + 0x1000,
-- 		      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
--+	REG_RMW_BUFFER_FLUSH(ah);
-- }
-- 
-- /*
-diff --git a/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch b/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch
-new file mode 100644
-index 0000000..6e2d0cf
---- /dev/null
-+++ b/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch
-@@ -0,0 +1,132 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Mon, 8 Feb 2016 14:33:19 +0100
-+Subject: [PATCH] cfg80211: reuse existing page fragments in A-MSDU rx
-+
-+This massively reduces data copying and thus improves rx performance
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/wireless/util.c
-++++ b/net/wireless/util.c
-+@@ -644,23 +644,93 @@ int ieee80211_data_from_8023(struct sk_b
-+ }
-+ EXPORT_SYMBOL(ieee80211_data_from_8023);
-+ 
-++static void
-++__frame_add_frag(struct sk_buff *skb, struct page *page,
-++		 void *ptr, int len, int size)
-++{
-++	struct skb_shared_info *sh = skb_shinfo(skb);
-++	int page_offset;
-++
-++	atomic_inc(&page->_count);
-++	page_offset = ptr - page_address(page);
-++	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
-++}
-++
-++static void
-++__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
-++			    int offset, int len)
-++{
-++	struct skb_shared_info *sh = skb_shinfo(skb);
-++	const skb_frag_t *frag = &sh->frags[-1];
-++	struct page *frag_page;
-++	void *frag_ptr;
-++	int frag_len, frag_size;
-++	int head_size = skb->len - skb->data_len;
-++	int cur_len;
-++
-++	frag_page = virt_to_head_page(skb->head);
-++	frag_ptr = skb->data;
-++	frag_size = head_size;
-++
-++	while (offset >= frag_size) {
-++		offset -= frag_size;
-++		frag++;
-++		frag_page = skb_frag_page(frag);
-++		frag_ptr = skb_frag_address(frag);
-++		frag_size = skb_frag_size(frag);
-++	}
-++
-++	frag_ptr += offset;
-++	frag_len = frag_size - offset;
-++
-++	cur_len = min(len, frag_len);
-++
-++	__frame_add_frag(frame, frag_page, frag_ptr, cur_len, frag_size);
-++	len -= cur_len;
-++
-++	while (len > 0) {
-++		frag++;
-++		frag_len = skb_frag_size(frag);
-++		cur_len = min(len, frag_len);
-++		__frame_add_frag(frame, skb_frag_page(frag),
-++				 skb_frag_address(frag), cur_len, frag_len);
-++		len -= cur_len;
-++	}
-++}
-++
-+ static struct sk_buff *
-+ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
-+-		       int offset, int len)
-++		       int offset, int len, bool reuse_frag)
-+ {
-+ 	struct sk_buff *frame;
-++	int cur_len = len;
-+ 
-+ 	if (skb->len - offset < len)
-+ 		return NULL;
-+ 
-+ 	/*
-++	 * When reusing framents, copy some data to the head to simplify
-++	 * ethernet header handling and speed up protocol header processing
-++	 * in the stack later.
-++	 */
-++	if (reuse_frag)
-++		cur_len = min_t(int, len, 32);
-++
-++	/*
-+ 	 * Allocate and reserve two bytes more for payload
-+ 	 * alignment since sizeof(struct ethhdr) is 14.
-+ 	 */
-+-	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + len);
-++	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
-+ 
-+ 	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
-+-	skb_copy_bits(skb, offset, skb_put(frame, len), len);
-++	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
-++
-++	len -= cur_len;
-++	if (!len)
-++		return frame;
-++
-++	offset += cur_len;
-++	__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
-+ 
-+ 	return frame;
-+ }
-+@@ -676,6 +746,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
-+ 	u8 *payload;
-+ 	int offset = 0, remaining, err;
-+ 	struct ethhdr eth;
-++	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
-+ 	bool reuse_skb = false;
-+ 	bool last = false;
-+ 
-+@@ -703,12 +774,13 @@ void ieee80211_amsdu_to_8023s(struct sk_
-+ 		offset += sizeof(struct ethhdr);
-+ 		/* reuse skb for the last subframe */
-+ 		last = remaining <= subframe_len + padding;
-+-		if (!skb_is_nonlinear(skb) && last) {
-++		if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
-+ 			skb_pull(skb, offset);
-+ 			frame = skb;
-+ 			reuse_skb = true;
-+ 		} else {
-+-			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len);
-++			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
-++						       reuse_frag);
-+ 			if (!frame)
-+ 				goto purge;
-+ 
-diff --git a/package/kernel/mac80211/patches/334-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_def_set.patch b/package/kernel/mac80211/patches/334-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_def_set.patch
-deleted file mode 100644
-index f26e059..0000000
---- a/package/kernel/mac80211/patches/334-ath9k-use-REG_RMW-and-rmw-buffer-in-ath9k_hw_def_set.patch
-+++ /dev/null
-@@ -1,67 +0,0 @@
--From: Oleksij Rempel <linux@rempel-privat.de>
--Date: Sun, 22 Mar 2015 19:30:03 +0100
--Subject: [PATCH] ath9k: use REG_RMW and rmw buffer in
-- ath9k_hw_def_set_gain
--
--Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
--+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
--@@ -466,6 +466,7 @@ static void ath9k_hw_def_set_gain(struct
-- 				  struct ar5416_eeprom_def *eep,
-- 				  u8 txRxAttenLocal, int regChainOffset, int i)
-- {
--+	ENABLE_REG_RMW_BUFFER(ah);
-- 	if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
-- 		txRxAttenLocal = pModal->txRxAttenCh[i];
-- 
--@@ -483,16 +484,12 @@ static void ath9k_hw_def_set_gain(struct
-- 			      AR_PHY_GAIN_2GHZ_XATTEN2_DB,
-- 			      pModal->xatten2Db[i]);
-- 		} else {
---			REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
---			  (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
---			   ~AR_PHY_GAIN_2GHZ_BSW_MARGIN)
---			  | SM(pModal-> bswMargin[i],
---			       AR_PHY_GAIN_2GHZ_BSW_MARGIN));
---			REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
---			  (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
---			   ~AR_PHY_GAIN_2GHZ_BSW_ATTEN)
---			  | SM(pModal->bswAtten[i],
---			       AR_PHY_GAIN_2GHZ_BSW_ATTEN));
--+			REG_RMW(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
--+				SM(pModal-> bswMargin[i], AR_PHY_GAIN_2GHZ_BSW_MARGIN),
--+				AR_PHY_GAIN_2GHZ_BSW_MARGIN);
--+			REG_RMW(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
--+				SM(pModal->bswAtten[i], AR_PHY_GAIN_2GHZ_BSW_ATTEN),
--+				AR_PHY_GAIN_2GHZ_BSW_ATTEN);
-- 		}
-- 	}
-- 
--@@ -504,17 +501,14 @@ static void ath9k_hw_def_set_gain(struct
-- 		      AR_PHY_RXGAIN + regChainOffset,
-- 		      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[i]);
-- 	} else {
---		REG_WRITE(ah,
---			  AR_PHY_RXGAIN + regChainOffset,
---			  (REG_READ(ah, AR_PHY_RXGAIN + regChainOffset) &
---			   ~AR_PHY_RXGAIN_TXRX_ATTEN)
---			  | SM(txRxAttenLocal, AR_PHY_RXGAIN_TXRX_ATTEN));
---		REG_WRITE(ah,
---			  AR_PHY_GAIN_2GHZ + regChainOffset,
---			  (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
---			   ~AR_PHY_GAIN_2GHZ_RXTX_MARGIN) |
---			  SM(pModal->rxTxMarginCh[i], AR_PHY_GAIN_2GHZ_RXTX_MARGIN));
--+		REG_RMW(ah, AR_PHY_RXGAIN + regChainOffset,
--+			SM(txRxAttenLocal, AR_PHY_RXGAIN_TXRX_ATTEN),
--+			AR_PHY_RXGAIN_TXRX_ATTEN);
--+		REG_RMW(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
--+			SM(pModal->rxTxMarginCh[i], AR_PHY_GAIN_2GHZ_RXTX_MARGIN),
--+			AR_PHY_GAIN_2GHZ_RXTX_MARGIN);
-- 	}
--+	REG_RMW_BUFFER_FLUSH(ah);
-- }
-- 
-- static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
-diff --git a/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
-new file mode 100644
-index 0000000..f8f4f09
---- /dev/null
-+++ b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
-@@ -0,0 +1,36 @@
-+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
-+Date: Wed, 10 Feb 2016 16:08:17 +0100
-+Subject: [PATCH] mac80211: fix wiphy supported_band access
-+
-+Fix wiphy supported_band access in tx radiotap parsing. In particular,
-+info->band is always set to 0 (IEEE80211_BAND_2GHZ) since it has not
-+assigned yet. This cause a kernel crash on 5GHz only devices.
-+Move ieee80211_parse_tx_radiotap() after info->band assignment
-+
-+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
-+---
-+
-+--- a/net/mac80211/tx.c
-++++ b/net/mac80211/tx.c
-+@@ -1890,10 +1890,6 @@ netdev_tx_t ieee80211_monitor_start_xmit
-+ 	info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
-+ 		      IEEE80211_TX_CTL_INJECTED;
-+ 
-+-	/* process and remove the injection radiotap header */
-+-	if (!ieee80211_parse_tx_radiotap(local, skb))
-+-		goto fail;
-+-
-+ 	rcu_read_lock();
-+ 
-+ 	/*
-+@@ -1955,6 +1951,10 @@ netdev_tx_t ieee80211_monitor_start_xmit
-+ 		goto fail_rcu;
-+ 
-+ 	info->band = chandef->chan->band;
-++	/* process and remove the injection radiotap header */
-++	if (!ieee80211_parse_tx_radiotap(local, skb))
-++		goto fail_rcu;
-++
-+ 	ieee80211_xmit(sdata, NULL, skb);
-+ 	rcu_read_unlock();
-+ 
-diff --git a/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch b/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch
-deleted file mode 100644
-index 5e63a80..0000000
---- a/package/kernel/mac80211/patches/335-0001-brcmfmac-Fix-oops-when-SDIO-device-is-removed.patch
-+++ /dev/null
-@@ -1,44 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 6 Mar 2015 18:40:38 +0100
--Subject: [PATCH] brcmfmac: Fix oops when SDIO device is removed.
--
--On removal of SDIO card both functions of card will be getting
--a remove call. When the first is hanging in ctrl frame xmit then
--the second will cause oops. This patch fixes the xmit ctrl
--handling in case of serious errors and also limits the handling
--for remove to function 1 only.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -1194,7 +1194,7 @@ static void brcmf_ops_sdio_remove(struct
-- 	brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
-- 	brcmf_dbg(SDIO, "Function: %d\n", func->num);
-- 
---	if (func->num != 1 && func->num != 2)
--+	if (func->num != 1)
-- 		return;
-- 
-- 	bus_if = dev_get_drvdata(&func->dev);
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -2740,6 +2740,11 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 	if ((bus->sdiodev->state != BRCMF_SDIOD_DATA) || (err != 0)) {
-- 		brcmf_err("failed backplane access over SDIO, halting operation\n");
-- 		atomic_set(&bus->intstatus, 0);
--+		if (bus->ctrl_frame_stat) {
--+			bus->ctrl_frame_err = -ENODEV;
--+			bus->ctrl_frame_stat = false;
--+			brcmf_sdio_wait_event_wakeup(bus);
--+		}
-- 	} else if (atomic_read(&bus->intstatus) ||
-- 		   atomic_read(&bus->ipend) > 0 ||
-- 		   (!atomic_read(&bus->fcstate) &&
-diff --git a/package/kernel/mac80211/patches/335-0002-brcmfmac-Simplify-watchdog-sleep.patch b/package/kernel/mac80211/patches/335-0002-brcmfmac-Simplify-watchdog-sleep.patch
-deleted file mode 100644
-index 201da75..0000000
---- a/package/kernel/mac80211/patches/335-0002-brcmfmac-Simplify-watchdog-sleep.patch
-+++ /dev/null
-@@ -1,157 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 6 Mar 2015 18:40:39 +0100
--Subject: [PATCH] brcmfmac: Simplify watchdog sleep.
--
--The watchdog thread is used to put the SDIO bus to sleep when the
--system is idling. This patch simplifies the way it is determined
--when sleep can be entered.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -485,10 +485,9 @@ struct brcmf_sdio {
-- #endif				/* DEBUG */
-- 
-- 	uint clkstate;		/* State of sd and backplane clock(s) */
---	bool activity;		/* Activity flag for clock down */
-- 	s32 idletime;		/* Control for activity timeout */
---	s32 idlecount;	/* Activity timeout counter */
---	s32 idleclock;	/* How to set bus driver when idle */
--+	s32 idlecount;		/* Activity timeout counter */
--+	s32 idleclock;		/* How to set bus driver when idle */
-- 	bool rxflow_mode;	/* Rx flow control mode */
-- 	bool rxflow;		/* Is rx flow control on */
-- 	bool alp_only;		/* Don't use HT clock (ALP only) */
--@@ -511,6 +510,7 @@ struct brcmf_sdio {
-- 	struct workqueue_struct *brcmf_wq;
-- 	struct work_struct datawork;
-- 	atomic_t dpc_tskcnt;
--+	atomic_t dpc_running;
-- 
-- 	bool txoff;		/* Transmit flow-controlled */
-- 	struct brcmf_sdio_count sdcnt;
--@@ -959,13 +959,8 @@ static int brcmf_sdio_clkctl(struct brcm
-- 	brcmf_dbg(SDIO, "Enter\n");
-- 
-- 	/* Early exit if we're already there */
---	if (bus->clkstate == target) {
---		if (target == CLK_AVAIL) {
---			brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
---			bus->activity = true;
---		}
--+	if (bus->clkstate == target)
-- 		return 0;
---	}
-- 
-- 	switch (target) {
-- 	case CLK_AVAIL:
--@@ -975,7 +970,6 @@ static int brcmf_sdio_clkctl(struct brcm
-- 		/* Now request HT Avail on the backplane */
-- 		brcmf_sdio_htclk(bus, true, pendok);
-- 		brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
---		bus->activity = true;
-- 		break;
-- 
-- 	case CLK_SDONLY:
--@@ -1024,17 +1018,6 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *
-- 
-- 		/* Going to sleep */
-- 		if (sleep) {
---			/* Don't sleep if something is pending */
---			if (atomic_read(&bus->intstatus) ||
---			    atomic_read(&bus->ipend) > 0 ||
---			    bus->ctrl_frame_stat ||
---			    (!atomic_read(&bus->fcstate) &&
---			    brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
---			    data_ok(bus))) {
---				 err = -EBUSY;
---				 goto done;
---			}
---
-- 			clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
-- 						   SBSDIO_FUNC1_CHIPCLKCSR,
-- 						   &err);
--@@ -1045,11 +1028,7 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *
-- 						  SBSDIO_ALP_AVAIL_REQ, &err);
-- 			}
-- 			err = brcmf_sdio_kso_control(bus, false);
---			/* disable watchdog */
---			if (!err)
---				brcmf_sdio_wd_timer(bus, 0);
-- 		} else {
---			bus->idlecount = 0;
-- 			err = brcmf_sdio_kso_control(bus, true);
-- 		}
-- 		if (err) {
--@@ -3566,7 +3545,7 @@ void brcmf_sdio_isr(struct brcmf_sdio *b
-- 	queue_work(bus->brcmf_wq, &bus->datawork);
-- }
-- 
---static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
--+static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
-- {
-- 	brcmf_dbg(TIMER, "Enter\n");
-- 
--@@ -3627,22 +3606,21 @@ static bool brcmf_sdio_bus_watchdog(stru
-- #endif				/* DEBUG */
-- 
-- 	/* On idle timeout clear activity flag and/or turn off clock */
---	if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
---		if (++bus->idlecount >= bus->idletime) {
--+	if ((atomic_read(&bus->dpc_tskcnt) == 0) &&
--+	    (atomic_read(&bus->dpc_running) == 0) &&
--+	    (bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
--+		bus->idlecount++;
--+		if (bus->idlecount > bus->idletime) {
--+			brcmf_dbg(SDIO, "idle\n");
--+			sdio_claim_host(bus->sdiodev->func[1]);
--+			brcmf_sdio_wd_timer(bus, 0);
-- 			bus->idlecount = 0;
---			if (bus->activity) {
---				bus->activity = false;
---				brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
---			} else {
---				brcmf_dbg(SDIO, "idle\n");
---				sdio_claim_host(bus->sdiodev->func[1]);
---				brcmf_sdio_bus_sleep(bus, true, false);
---				sdio_release_host(bus->sdiodev->func[1]);
---			}
--+			brcmf_sdio_bus_sleep(bus, true, false);
--+			sdio_release_host(bus->sdiodev->func[1]);
-- 		}
--+	} else {
--+		bus->idlecount = 0;
-- 	}
---
---	return (atomic_read(&bus->ipend) > 0);
-- }
-- 
-- static void brcmf_sdio_dataworker(struct work_struct *work)
--@@ -3651,8 +3629,11 @@ static void brcmf_sdio_dataworker(struct
-- 					      datawork);
-- 
-- 	while (atomic_read(&bus->dpc_tskcnt)) {
--+		atomic_set(&bus->dpc_running, 1);
-- 		atomic_set(&bus->dpc_tskcnt, 0);
-- 		brcmf_sdio_dpc(bus);
--+		bus->idlecount = 0;
--+		atomic_set(&bus->dpc_running, 0);
-- 	}
-- 	if (brcmf_sdiod_freezing(bus->sdiodev)) {
-- 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DOWN);
--@@ -4154,6 +4135,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
-- 	}
-- 	/* Initialize DPC thread */
-- 	atomic_set(&bus->dpc_tskcnt, 0);
--+	atomic_set(&bus->dpc_running, 0);
-- 
-- 	/* Assign bus interface call back */
-- 	bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
-diff --git a/package/kernel/mac80211/patches/335-0003-brcmfmac-Fix-possible-race-condition.patch b/package/kernel/mac80211/patches/335-0003-brcmfmac-Fix-possible-race-condition.patch
-deleted file mode 100644
-index 3a2de7a..0000000
---- a/package/kernel/mac80211/patches/335-0003-brcmfmac-Fix-possible-race-condition.patch
-+++ /dev/null
-@@ -1,83 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 6 Mar 2015 18:40:40 +0100
--Subject: [PATCH] brcmfmac: Fix possible race-condition.
--
--SDIO is using a "shared" variable to handoff ctl frames to DPC
--and to see when they are done. In a timeout situation this can
--lead to erroneous situation where DPC started to handle the ctl
--frame while the timeout expired. This patch will fix this by
--adding locking around the shared variable.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -2700,11 +2700,13 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
-- 	    data_ok(bus)) {
-- 		sdio_claim_host(bus->sdiodev->func[1]);
---		err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
---					      bus->ctrl_frame_len);
--+		if (bus->ctrl_frame_stat) {
--+			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
--+						      bus->ctrl_frame_len);
--+			bus->ctrl_frame_err = err;
--+			bus->ctrl_frame_stat = false;
--+		}
-- 		sdio_release_host(bus->sdiodev->func[1]);
---		bus->ctrl_frame_err = err;
---		bus->ctrl_frame_stat = false;
-- 		brcmf_sdio_wait_event_wakeup(bus);
-- 	}
-- 	/* Send queued frames (limit 1 if rx may still be pending) */
--@@ -2720,9 +2722,13 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 		brcmf_err("failed backplane access over SDIO, halting operation\n");
-- 		atomic_set(&bus->intstatus, 0);
-- 		if (bus->ctrl_frame_stat) {
---			bus->ctrl_frame_err = -ENODEV;
---			bus->ctrl_frame_stat = false;
---			brcmf_sdio_wait_event_wakeup(bus);
--+			sdio_claim_host(bus->sdiodev->func[1]);
--+			if (bus->ctrl_frame_stat) {
--+				bus->ctrl_frame_err = -ENODEV;
--+				bus->ctrl_frame_stat = false;
--+				brcmf_sdio_wait_event_wakeup(bus);
--+			}
--+			sdio_release_host(bus->sdiodev->func[1]);
-- 		}
-- 	} else if (atomic_read(&bus->intstatus) ||
-- 		   atomic_read(&bus->ipend) > 0 ||
--@@ -2930,15 +2936,20 @@ brcmf_sdio_bus_txctl(struct device *dev,
-- 	brcmf_sdio_trigger_dpc(bus);
-- 	wait_event_interruptible_timeout(bus->ctrl_wait, !bus->ctrl_frame_stat,
-- 					 msecs_to_jiffies(CTL_DONE_TIMEOUT));
---
---	if (!bus->ctrl_frame_stat) {
--+	ret = 0;
--+	if (bus->ctrl_frame_stat) {
--+		sdio_claim_host(bus->sdiodev->func[1]);
--+		if (bus->ctrl_frame_stat) {
--+			brcmf_dbg(SDIO, "ctrl_frame timeout\n");
--+			bus->ctrl_frame_stat = false;
--+			ret = -ETIMEDOUT;
--+		}
--+		sdio_release_host(bus->sdiodev->func[1]);
--+	}
--+	if (!ret) {
-- 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
-- 			  bus->ctrl_frame_err);
-- 		ret = bus->ctrl_frame_err;
---	} else {
---		brcmf_dbg(SDIO, "ctrl_frame timeout\n");
---		bus->ctrl_frame_stat = false;
---		ret = -ETIMEDOUT;
-- 	}
-- 
-- 	if (ret)
-diff --git a/package/kernel/mac80211/patches/335-0004-brcmfmac-Add-support-for-BCM4345-SDIO-chipset.patch b/package/kernel/mac80211/patches/335-0004-brcmfmac-Add-support-for-BCM4345-SDIO-chipset.patch
-deleted file mode 100644
-index c9eb900..0000000
---- a/package/kernel/mac80211/patches/335-0004-brcmfmac-Add-support-for-BCM4345-SDIO-chipset.patch
-+++ /dev/null
-@@ -1,86 +0,0 @@
--From: Syed Asifful Dayyan <syedd@broadcom.com>
--Date: Fri, 6 Mar 2015 18:40:42 +0100
--Subject: [PATCH] brcmfmac: Add support for BCM4345 SDIO chipset.
--
--These changes add support for BCM4345 SDIO chipset.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Syed Asifful Dayyan <syedd@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -1096,6 +1096,7 @@ static const struct sdio_device_id brcmf
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
--+	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4345),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
-- 	{ /* end: all zeroes */ }
-- };
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -491,6 +491,10 @@ static void brcmf_chip_get_raminfo(struc
-- 	case BRCM_CC_43362_CHIP_ID:
-- 		ci->pub.ramsize = 0x3c000;
-- 		break;
--+	case BRCM_CC_4345_CHIP_ID:
--+		ci->pub.ramsize = 0xc8000;
--+		ci->pub.rambase = 0x198000;
--+		break;
-- 	case BRCM_CC_4339_CHIP_ID:
-- 	case BRCM_CC_4354_CHIP_ID:
-- 	case BRCM_CC_4356_CHIP_ID:
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -617,6 +617,8 @@ static const struct sdiod_drive_str sdio
-- #define BCM43362_NVRAM_NAME		"brcm/brcmfmac43362-sdio.txt"
-- #define BCM4339_FIRMWARE_NAME		"brcm/brcmfmac4339-sdio.bin"
-- #define BCM4339_NVRAM_NAME		"brcm/brcmfmac4339-sdio.txt"
--+#define BCM4345_FIRMWARE_NAME		"brcm/brcmfmac4345-sdio.bin"
--+#define BCM4345_NVRAM_NAME		"brcm/brcmfmac4345-sdio.txt"
-- #define BCM4354_FIRMWARE_NAME		"brcm/brcmfmac4354-sdio.bin"
-- #define BCM4354_NVRAM_NAME		"brcm/brcmfmac4354-sdio.txt"
-- 
--@@ -640,6 +642,8 @@ MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
--+MODULE_FIRMWARE(BCM4345_FIRMWARE_NAME);
--+MODULE_FIRMWARE(BCM4345_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4354_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4354_NVRAM_NAME);
-- 
--@@ -669,6 +673,7 @@ static const struct brcmf_firmware_names
-- 	{ BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
-- 	{ BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
-- 	{ BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
--+	{ BRCM_CC_4345_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4345) },
-- 	{ BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
-- };
-- 
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -37,6 +37,7 @@
-- #define BRCM_CC_43362_CHIP_ID		43362
-- #define BRCM_CC_4335_CHIP_ID		0x4335
-- #define BRCM_CC_4339_CHIP_ID		0x4339
--+#define BRCM_CC_4345_CHIP_ID		0x4345
-- #define BRCM_CC_4354_CHIP_ID		0x4354
-- #define BRCM_CC_4356_CHIP_ID		0x4356
-- #define BRCM_CC_43566_CHIP_ID		43566
----- a/include/linux/mmc/sdio_ids.h
--+++ b/include/linux/mmc/sdio_ids.h
--@@ -33,6 +33,7 @@
-- #define SDIO_DEVICE_ID_BROADCOM_43341		0xa94d
-- #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
-- #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
--+#define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
-- #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
-- 
-- #define SDIO_VENDOR_ID_INTEL			0x0089
-diff --git a/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch b/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch
-new file mode 100644
-index 0000000..acaacf7
---- /dev/null
-+++ b/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch
-@@ -0,0 +1,61 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 18 Feb 2016 19:30:05 +0100
-+Subject: [PATCH] mac80211: minstrel_ht: set A-MSDU tx limits based on selected
-+ max_prob_rate
-+
-+Prevents excessive A-MSDU aggregation at low data rates or bad
-+conditions.
-+
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/mac80211/rc80211_minstrel_ht.c
-++++ b/net/mac80211/rc80211_minstrel_ht.c
-+@@ -883,6 +883,39 @@ minstrel_ht_set_rate(struct minstrel_pri
-+ 	ratetbl->rate[offset].flags = flags;
-+ }
-+ 
-++static int
-++minstrel_ht_get_max_amsdu_len(struct minstrel_ht_sta *mi)
-++{
-++	int group = mi->max_prob_rate / MCS_GROUP_RATES;
-++	const struct mcs_group *g = &minstrel_mcs_groups[group];
-++	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
-++
-++	/* Disable A-MSDU if max_prob_rate is bad */
-++	if (mi->groups[group].rates[rate].prob_ewma < MINSTREL_FRAC(50, 100))
-++		return 1;
-++
-++	/* If the rate is slower than single-stream MCS1, make A-MSDU limit small */
-++	if (g->duration[rate] > MCS_DURATION(1, 0, 52))
-++		return 500;
-++
-++	/*
-++	 * If the rate is slower than single-stream MCS4, limit A-MSDU to usual
-++	 * data packet size
-++	 */
-++	if (g->duration[rate] > MCS_DURATION(1, 0, 104))
-++		return 1500;
-++
-++	/*
-++	 * If the rate is slower than single-stream MCS7, limit A-MSDU to twice
-++	 * the usual data packet size
-++	 */
-++	if (g->duration[rate] > MCS_DURATION(1, 0, 260))
-++		return 3000;
-++
-++	/* unlimited */
-++	return 0;
-++}
-++
-+ static void
-+ minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
-+ {
-+@@ -907,6 +940,7 @@ minstrel_ht_update_rates(struct minstrel
-+ 		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
-+ 	}
-+ 
-++	mi->sta->max_rc_amsdu_len = minstrel_ht_get_max_amsdu_len(mi);
-+ 	rates->rate[i].idx = -1;
-+ 	rate_control_set_rates(mp->hw, mi->sta, rates);
-+ }
-diff --git a/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch b/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch
-deleted file mode 100644
-index 7a688c4..0000000
---- a/package/kernel/mac80211/patches/336-0001-brcmfmac-remove-duplication-of-ramsize-info.patch
-+++ /dev/null
-@@ -1,48 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:27 +0100
--Subject: [PATCH] brcmfmac: remove duplication of ramsize info
--
--Removing the ramsize from the brcmf_sdio structure to avoid
--duplication. The information is available in brcmf_chip
--structure.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -432,8 +432,6 @@ struct brcmf_sdio {
-- 	struct brcmf_sdio_dev *sdiodev;	/* sdio device handler */
-- 	struct brcmf_chip *ci;	/* Chip info struct */
-- 
---	u32 ramsize;		/* Size of RAM in SOCRAM (bytes) */
---
-- 	u32 hostintmask;	/* Copy of Host Interrupt Mask */
-- 	atomic_t intstatus;	/* Intstatus bits (events) pending */
-- 	atomic_t fcstate;	/* State of dongle flow-control */
--@@ -1075,7 +1073,7 @@ static int brcmf_sdio_readshared(struct
-- 	struct sdpcm_shared_le sh_le;
-- 	__le32 addr_le;
-- 
---	shaddr = bus->ci->rambase + bus->ramsize - 4;
--+	shaddr = bus->ci->rambase + bus->ci->ramsize - 4;
-- 
-- 	/*
-- 	 * Read last word in socram to determine
--@@ -3871,13 +3869,6 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
-- 		drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
-- 	brcmf_sdio_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
-- 
---	/* Get info on the SOCRAM cores... */
---	bus->ramsize = bus->ci->ramsize;
---	if (!(bus->ramsize)) {
---		brcmf_err("failed to find SOCRAM memory!\n");
---		goto fail;
---	}
---
-- 	/* Set card control so an SDIO card reset does a WLAN backplane reset */
-- 	reg_val = brcmf_sdiod_regrb(bus->sdiodev,
-- 				    SDIO_CCCR_BRCM_CARDCTRL, &err);
-diff --git a/package/kernel/mac80211/patches/336-0002-brcmfmac-always-perform-cores-checks.patch b/package/kernel/mac80211/patches/336-0002-brcmfmac-always-perform-cores-checks.patch
-deleted file mode 100644
-index e2a2074..0000000
---- a/package/kernel/mac80211/patches/336-0002-brcmfmac-always-perform-cores-checks.patch
-+++ /dev/null
-@@ -1,74 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:28 +0100
--Subject: [PATCH] brcmfmac: always perform cores checks
--
--Instead of checking the cores in the chip only if CONFIG_BRCMDBG
--is selected perform the check always and extend it with more sanity
--checking.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -419,13 +419,13 @@ static struct brcmf_core *brcmf_chip_add
-- 	return &core->pub;
-- }
-- 
---#ifdef DEBUG
-- /* safety check for chipinfo */
-- static int brcmf_chip_cores_check(struct brcmf_chip_priv *ci)
-- {
-- 	struct brcmf_core_priv *core;
-- 	bool need_socram = false;
-- 	bool has_socram = false;
--+	bool cpu_found = false;
-- 	int idx = 1;
-- 
-- 	list_for_each_entry(core, &ci->cores, list) {
--@@ -435,12 +435,14 @@ static int brcmf_chip_cores_check(struct
-- 
-- 		switch (core->pub.id) {
-- 		case BCMA_CORE_ARM_CM3:
--+			cpu_found = true;
-- 			need_socram = true;
-- 			break;
-- 		case BCMA_CORE_INTERNAL_MEM:
-- 			has_socram = true;
-- 			break;
-- 		case BCMA_CORE_ARM_CR4:
--+			cpu_found = true;
-- 			if (ci->pub.rambase == 0) {
-- 				brcmf_err("RAM base not provided with ARM CR4 core\n");
-- 				return -ENOMEM;
--@@ -451,19 +453,21 @@ static int brcmf_chip_cores_check(struct
-- 		}
-- 	}
-- 
--+	if (!cpu_found) {
--+		brcmf_err("CPU core not detected\n");
--+		return -ENXIO;
--+	}
-- 	/* check RAM core presence for ARM CM3 core */
-- 	if (need_socram && !has_socram) {
-- 		brcmf_err("RAM core not provided with ARM CM3 core\n");
-- 		return -ENODEV;
-- 	}
--+	if (!ci->pub.ramsize) {
--+		brcmf_err("RAM size is undetermined\n");
--+		return -ENOMEM;
--+	}
-- 	return 0;
-- }
---#else	/* DEBUG */
---static inline int brcmf_chip_cores_check(struct brcmf_chip_priv *ci)
---{
---	return 0;
---}
---#endif
-- 
-- static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
-- {
-diff --git a/package/kernel/mac80211/patches/336-0003-brcmfmac-rename-chip-download-functions.patch b/package/kernel/mac80211/patches/336-0003-brcmfmac-rename-chip-download-functions.patch
-deleted file mode 100644
-index a272800..0000000
---- a/package/kernel/mac80211/patches/336-0003-brcmfmac-rename-chip-download-functions.patch
-+++ /dev/null
-@@ -1,240 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:29 +0100
--Subject: [PATCH] brcmfmac: rename chip download functions
--
--The functions brcmf_chip_[enter/exit]_download() are not exclusively
--used for firmware download so rename these more appropriate.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -807,7 +807,7 @@ struct brcmf_chip *brcmf_chip_attach(voi
-- 		err = -EINVAL;
-- 	if (WARN_ON(!ops->prepare))
-- 		err = -EINVAL;
---	if (WARN_ON(!ops->exit_dl))
--+	if (WARN_ON(!ops->activate))
-- 		err = -EINVAL;
-- 	if (err < 0)
-- 		return ERR_PTR(-EINVAL);
--@@ -905,7 +905,7 @@ void brcmf_chip_resetcore(struct brcmf_c
-- }
-- 
-- static void
---brcmf_chip_cm3_enterdl(struct brcmf_chip_priv *chip)
--+brcmf_chip_cm3_set_passive(struct brcmf_chip_priv *chip)
-- {
-- 	struct brcmf_core *core;
-- 
--@@ -919,7 +919,7 @@ brcmf_chip_cm3_enterdl(struct brcmf_chip
-- 	brcmf_chip_resetcore(core, 0, 0, 0);
-- }
-- 
---static bool brcmf_chip_cm3_exitdl(struct brcmf_chip_priv *chip)
--+static bool brcmf_chip_cm3_set_active(struct brcmf_chip_priv *chip)
-- {
-- 	struct brcmf_core *core;
-- 
--@@ -929,7 +929,7 @@ static bool brcmf_chip_cm3_exitdl(struct
-- 		return false;
-- 	}
-- 
---	chip->ops->exit_dl(chip->ctx, &chip->pub, 0);
--+	chip->ops->activate(chip->ctx, &chip->pub, 0);
-- 
-- 	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_ARM_CM3);
-- 	brcmf_chip_resetcore(core, 0, 0, 0);
--@@ -938,7 +938,7 @@ static bool brcmf_chip_cm3_exitdl(struct
-- }
-- 
-- static inline void
---brcmf_chip_cr4_enterdl(struct brcmf_chip_priv *chip)
--+brcmf_chip_cr4_set_passive(struct brcmf_chip_priv *chip)
-- {
-- 	struct brcmf_core *core;
-- 
--@@ -951,11 +951,11 @@ brcmf_chip_cr4_enterdl(struct brcmf_chip
-- 			     D11_BCMA_IOCTL_PHYCLOCKEN);
-- }
-- 
---static bool brcmf_chip_cr4_exitdl(struct brcmf_chip_priv *chip, u32 rstvec)
--+static bool brcmf_chip_cr4_set_active(struct brcmf_chip_priv *chip, u32 rstvec)
-- {
-- 	struct brcmf_core *core;
-- 
---	chip->ops->exit_dl(chip->ctx, &chip->pub, rstvec);
--+	chip->ops->activate(chip->ctx, &chip->pub, rstvec);
-- 
-- 	/* restore ARM */
-- 	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_ARM_CR4);
--@@ -964,7 +964,7 @@ static bool brcmf_chip_cr4_exitdl(struct
-- 	return true;
-- }
-- 
---void brcmf_chip_enter_download(struct brcmf_chip *pub)
--+void brcmf_chip_set_passive(struct brcmf_chip *pub)
-- {
-- 	struct brcmf_chip_priv *chip;
-- 	struct brcmf_core *arm;
--@@ -974,14 +974,14 @@ void brcmf_chip_enter_download(struct br
-- 	chip = container_of(pub, struct brcmf_chip_priv, pub);
-- 	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CR4);
-- 	if (arm) {
---		brcmf_chip_cr4_enterdl(chip);
--+		brcmf_chip_cr4_set_passive(chip);
-- 		return;
-- 	}
-- 
---	brcmf_chip_cm3_enterdl(chip);
--+	brcmf_chip_cm3_set_passive(chip);
-- }
-- 
---bool brcmf_chip_exit_download(struct brcmf_chip *pub, u32 rstvec)
--+bool brcmf_chip_set_active(struct brcmf_chip *pub, u32 rstvec)
-- {
-- 	struct brcmf_chip_priv *chip;
-- 	struct brcmf_core *arm;
--@@ -991,9 +991,9 @@ bool brcmf_chip_exit_download(struct brc
-- 	chip = container_of(pub, struct brcmf_chip_priv, pub);
-- 	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CR4);
-- 	if (arm)
---		return brcmf_chip_cr4_exitdl(chip, rstvec);
--+		return brcmf_chip_cr4_set_active(chip, rstvec);
-- 
---	return brcmf_chip_cm3_exitdl(chip);
--+	return brcmf_chip_cm3_set_active(chip);
-- }
-- 
-- bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.h
--@@ -64,7 +64,7 @@ struct brcmf_core {
--  * @write32: write 32-bit value over bus.
--  * @prepare: prepare bus for core configuration.
--  * @setup: bus-specific core setup.
--- * @exit_dl: exit download state.
--+ * @active: chip becomes active.
--  *	The callback should use the provided @rstvec when non-zero.
--  */
-- struct brcmf_buscore_ops {
--@@ -72,7 +72,7 @@ struct brcmf_buscore_ops {
-- 	void (*write32)(void *ctx, u32 addr, u32 value);
-- 	int (*prepare)(void *ctx);
-- 	int (*setup)(void *ctx, struct brcmf_chip *chip);
---	void (*exit_dl)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
--+	void (*activate)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
-- };
-- 
-- struct brcmf_chip *brcmf_chip_attach(void *ctx,
--@@ -84,8 +84,8 @@ bool brcmf_chip_iscoreup(struct brcmf_co
-- void brcmf_chip_coredisable(struct brcmf_core *core, u32 prereset, u32 reset);
-- void brcmf_chip_resetcore(struct brcmf_core *core, u32 prereset, u32 reset,
-- 			  u32 postreset);
---void brcmf_chip_enter_download(struct brcmf_chip *ci);
---bool brcmf_chip_exit_download(struct brcmf_chip *ci, u32 rstvec);
--+void brcmf_chip_set_passive(struct brcmf_chip *ci);
--+bool brcmf_chip_set_active(struct brcmf_chip *ci, u32 rstvec);
-- bool brcmf_chip_sr_capable(struct brcmf_chip *pub);
-- 
-- #endif /* BRCMF_AXIDMP_H */
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -509,7 +509,7 @@ static void brcmf_pcie_attach(struct brc
-- 
-- static int brcmf_pcie_enter_download_state(struct brcmf_pciedev_info *devinfo)
-- {
---	brcmf_chip_enter_download(devinfo->ci);
--+	brcmf_chip_set_passive(devinfo->ci);
-- 
-- 	if (devinfo->ci->chip == BRCM_CC_43602_CHIP_ID) {
-- 		brcmf_pcie_select_core(devinfo, BCMA_CORE_ARM_CR4);
--@@ -536,7 +536,7 @@ static int brcmf_pcie_exit_download_stat
-- 		brcmf_chip_resetcore(core, 0, 0, 0);
-- 	}
-- 
---	return !brcmf_chip_exit_download(devinfo->ci, resetintr);
--+	return !brcmf_chip_set_active(devinfo->ci, resetintr);
-- }
-- 
-- 
--@@ -1566,8 +1566,8 @@ static int brcmf_pcie_buscoreprep(void *
-- }
-- 
-- 
---static void brcmf_pcie_buscore_exitdl(void *ctx, struct brcmf_chip *chip,
---				      u32 rstvec)
--+static void brcmf_pcie_buscore_activate(void *ctx, struct brcmf_chip *chip,
--+					u32 rstvec)
-- {
-- 	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)ctx;
-- 
--@@ -1577,7 +1577,7 @@ static void brcmf_pcie_buscore_exitdl(vo
-- 
-- static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
-- 	.prepare = brcmf_pcie_buscoreprep,
---	.exit_dl = brcmf_pcie_buscore_exitdl,
--+	.activate = brcmf_pcie_buscore_activate,
-- 	.read32 = brcmf_pcie_buscore_read32,
-- 	.write32 = brcmf_pcie_buscore_write32,
-- };
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -3357,7 +3357,7 @@ static int brcmf_sdio_download_firmware(
-- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-- 
-- 	/* Keep arm in reset */
---	brcmf_chip_enter_download(bus->ci);
--+	brcmf_chip_set_passive(bus->ci);
-- 
-- 	rstvec = get_unaligned_le32(fw->data);
-- 	brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
--@@ -3378,7 +3378,7 @@ static int brcmf_sdio_download_firmware(
-- 	}
-- 
-- 	/* Take arm out of reset */
---	if (!brcmf_chip_exit_download(bus->ci, rstvec)) {
--+	if (!brcmf_chip_set_active(bus->ci, rstvec)) {
-- 		brcmf_err("error getting out of ARM core reset\n");
-- 		goto err;
-- 	}
--@@ -3771,8 +3771,8 @@ static int brcmf_sdio_buscoreprep(void *
-- 	return 0;
-- }
-- 
---static void brcmf_sdio_buscore_exitdl(void *ctx, struct brcmf_chip *chip,
---				      u32 rstvec)
--+static void brcmf_sdio_buscore_activate(void *ctx, struct brcmf_chip *chip,
--+					u32 rstvec)
-- {
-- 	struct brcmf_sdio_dev *sdiodev = ctx;
-- 	struct brcmf_core *core;
--@@ -3815,7 +3815,7 @@ static void brcmf_sdio_buscore_write32(v
-- 
-- static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
-- 	.prepare = brcmf_sdio_buscoreprep,
---	.exit_dl = brcmf_sdio_buscore_exitdl,
--+	.activate = brcmf_sdio_buscore_activate,
-- 	.read32 = brcmf_sdio_buscore_read32,
-- 	.write32 = brcmf_sdio_buscore_write32,
-- };
--@@ -4239,12 +4239,11 @@ void brcmf_sdio_remove(struct brcmf_sdio
-- 				sdio_claim_host(bus->sdiodev->func[1]);
-- 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-- 				/* Leave the device in state where it is
---				 * 'quiet'. This is done by putting it in
---				 * download_state which essentially resets
---				 * all necessary cores.
--+				 * 'passive'. This is done by resetting all
--+				 * necessary cores.
-- 				 */
-- 				msleep(20);
---				brcmf_chip_enter_download(bus->ci);
--+				brcmf_chip_set_passive(bus->ci);
-- 				brcmf_sdio_clkctl(bus, CLK_NONE, false);
-- 				sdio_release_host(bus->sdiodev->func[1]);
-- 			}
-diff --git a/package/kernel/mac80211/patches/336-0004-brcmfmac-assure-device-is-ready-for-download-after-b.patch b/package/kernel/mac80211/patches/336-0004-brcmfmac-assure-device-is-ready-for-download-after-b.patch
-deleted file mode 100644
-index 6b1dd81..0000000
---- a/package/kernel/mac80211/patches/336-0004-brcmfmac-assure-device-is-ready-for-download-after-b.patch
-+++ /dev/null
-@@ -1,61 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:30 +0100
--Subject: [PATCH] brcmfmac: assure device is ready for download after
-- brcmf_chip_attach()
--
--Make the brcmf_chip_attach() function responsible for putting the
--device in a state where it is accessible for firmware download.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -786,12 +786,6 @@ static int brcmf_chip_setup(struct brcmf
-- 	if (chip->ops->setup)
-- 		ret = chip->ops->setup(chip->ctx, pub);
-- 
---	/*
---	 * Make sure any on-chip ARM is off (in case strapping is wrong),
---	 * or downloaded code was already running.
---	 */
---	brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CM3);
---	brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CR4);
-- 	return ret;
-- }
-- 
--@@ -833,6 +827,8 @@ struct brcmf_chip *brcmf_chip_attach(voi
-- 	if (err < 0)
-- 		goto fail;
-- 
--+	/* assure chip is passive for download */
--+	brcmf_chip_set_passive(&chip->pub);
-- 	return &chip->pub;
-- 
-- fail:
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -509,8 +509,6 @@ static void brcmf_pcie_attach(struct brc
-- 
-- static int brcmf_pcie_enter_download_state(struct brcmf_pciedev_info *devinfo)
-- {
---	brcmf_chip_set_passive(devinfo->ci);
---
-- 	if (devinfo->ci->chip == BRCM_CC_43602_CHIP_ID) {
-- 		brcmf_pcie_select_core(devinfo, BCMA_CORE_ARM_CR4);
-- 		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_ARMCR4REG_BANKIDX,
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -3356,9 +3356,6 @@ static int brcmf_sdio_download_firmware(
-- 	sdio_claim_host(bus->sdiodev->func[1]);
-- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-- 
---	/* Keep arm in reset */
---	brcmf_chip_set_passive(bus->ci);
---
-- 	rstvec = get_unaligned_le32(fw->data);
-- 	brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
-- 
-diff --git a/package/kernel/mac80211/patches/336-0005-brcmfmac-extract-ram-size-info-from-internal-memory-.patch b/package/kernel/mac80211/patches/336-0005-brcmfmac-extract-ram-size-info-from-internal-memory-.patch
-deleted file mode 100644
-index bcc2ed4..0000000
---- a/package/kernel/mac80211/patches/336-0005-brcmfmac-extract-ram-size-info-from-internal-memory-.patch
-+++ /dev/null
-@@ -1,367 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:31 +0100
--Subject: [PATCH] brcmfmac: extract ram size info from internal memory
-- registers
--
--Instead of hard-coded memory sizes it is possible to obtain that
--information from the internal memory registers.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -100,9 +100,6 @@
-- #define BCM4329_CORE_SOCRAM_BASE	0x18003000
-- /* ARM Cortex M3 core, ID 0x82a */
-- #define BCM4329_CORE_ARM_BASE		0x18002000
---#define BCM4329_RAMSIZE			0x48000
---/* bcm43143 */
---#define BCM43143_RAMSIZE		0x70000
-- 
-- #define CORE_SB(base, field) \
-- 		(base + SBCONFIGOFF + offsetof(struct sbconfig, field))
--@@ -150,6 +147,78 @@ struct sbconfig {
-- 	u32 sbidhigh;	/* identification */
-- };
-- 
--+/* bankidx and bankinfo reg defines corerev >= 8 */
--+#define SOCRAM_BANKINFO_RETNTRAM_MASK	0x00010000
--+#define SOCRAM_BANKINFO_SZMASK		0x0000007f
--+#define SOCRAM_BANKIDX_ROM_MASK		0x00000100
--+
--+#define SOCRAM_BANKIDX_MEMTYPE_SHIFT	8
--+/* socram bankinfo memtype */
--+#define SOCRAM_MEMTYPE_RAM		0
--+#define SOCRAM_MEMTYPE_R0M		1
--+#define SOCRAM_MEMTYPE_DEVRAM		2
--+
--+#define SOCRAM_BANKINFO_SZBASE		8192
--+#define SRCI_LSS_MASK		0x00f00000
--+#define SRCI_LSS_SHIFT		20
--+#define	SRCI_SRNB_MASK		0xf0
--+#define	SRCI_SRNB_SHIFT		4
--+#define	SRCI_SRBSZ_MASK		0xf
--+#define	SRCI_SRBSZ_SHIFT	0
--+#define SR_BSZ_BASE		14
--+
--+struct sbsocramregs {
--+	u32 coreinfo;
--+	u32 bwalloc;
--+	u32 extracoreinfo;
--+	u32 biststat;
--+	u32 bankidx;
--+	u32 standbyctrl;
--+
--+	u32 errlogstatus;	/* rev 6 */
--+	u32 errlogaddr;	/* rev 6 */
--+	/* used for patching rev 3 & 5 */
--+	u32 cambankidx;
--+	u32 cambankstandbyctrl;
--+	u32 cambankpatchctrl;
--+	u32 cambankpatchtblbaseaddr;
--+	u32 cambankcmdreg;
--+	u32 cambankdatareg;
--+	u32 cambankmaskreg;
--+	u32 PAD[1];
--+	u32 bankinfo;	/* corev 8 */
--+	u32 bankpda;
--+	u32 PAD[14];
--+	u32 extmemconfig;
--+	u32 extmemparitycsr;
--+	u32 extmemparityerrdata;
--+	u32 extmemparityerrcnt;
--+	u32 extmemwrctrlandsize;
--+	u32 PAD[84];
--+	u32 workaround;
--+	u32 pwrctl;		/* corerev >= 2 */
--+	u32 PAD[133];
--+	u32 sr_control;     /* corerev >= 15 */
--+	u32 sr_status;      /* corerev >= 15 */
--+	u32 sr_address;     /* corerev >= 15 */
--+	u32 sr_data;        /* corerev >= 15 */
--+};
--+
--+#define SOCRAMREGOFFS(_f)	offsetof(struct sbsocramregs, _f)
--+
--+#define ARMCR4_CAP		(0x04)
--+#define ARMCR4_BANKIDX		(0x40)
--+#define ARMCR4_BANKINFO		(0x44)
--+#define ARMCR4_BANKPDA		(0x4C)
--+
--+#define	ARMCR4_TCBBNB_MASK	0xf0
--+#define	ARMCR4_TCBBNB_SHIFT	4
--+#define	ARMCR4_TCBANB_MASK	0xf
--+#define	ARMCR4_TCBANB_SHIFT	0
--+
--+#define	ARMCR4_BSZ_MASK		0x3f
--+#define	ARMCR4_BSZ_MULT		8192
--+
-- struct brcmf_core_priv {
-- 	struct brcmf_core pub;
-- 	u32 wrapbase;
--@@ -443,10 +512,6 @@ static int brcmf_chip_cores_check(struct
-- 			break;
-- 		case BCMA_CORE_ARM_CR4:
-- 			cpu_found = true;
---			if (ci->pub.rambase == 0) {
---				brcmf_err("RAM base not provided with ARM CR4 core\n");
---				return -ENOMEM;
---			}
-- 			break;
-- 		default:
-- 			break;
--@@ -462,60 +527,160 @@ static int brcmf_chip_cores_check(struct
-- 		brcmf_err("RAM core not provided with ARM CM3 core\n");
-- 		return -ENODEV;
-- 	}
---	if (!ci->pub.ramsize) {
---		brcmf_err("RAM size is undetermined\n");
---		return -ENOMEM;
---	}
-- 	return 0;
-- }
-- 
---static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
--+static u32 brcmf_chip_core_read32(struct brcmf_core_priv *core, u16 reg)
-- {
---	switch (ci->pub.chip) {
---	case BRCM_CC_4329_CHIP_ID:
---		ci->pub.ramsize = BCM4329_RAMSIZE;
---		break;
---	case BRCM_CC_43143_CHIP_ID:
---		ci->pub.ramsize = BCM43143_RAMSIZE;
---		break;
---	case BRCM_CC_43241_CHIP_ID:
---		ci->pub.ramsize = 0x90000;
---		break;
---	case BRCM_CC_4330_CHIP_ID:
---		ci->pub.ramsize = 0x48000;
---		break;
--+	return core->chip->ops->read32(core->chip->ctx, core->pub.base + reg);
--+}
--+
--+static void brcmf_chip_core_write32(struct brcmf_core_priv *core,
--+				    u16 reg, u32 val)
--+{
--+	core->chip->ops->write32(core->chip->ctx, core->pub.base + reg, val);
--+}
--+
--+static bool brcmf_chip_socram_banksize(struct brcmf_core_priv *core, u8 idx,
--+				       u32 *banksize)
--+{
--+	u32 bankinfo;
--+	u32 bankidx = (SOCRAM_MEMTYPE_RAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
--+
--+	bankidx |= idx;
--+	brcmf_chip_core_write32(core, SOCRAMREGOFFS(bankidx), bankidx);
--+	bankinfo = brcmf_chip_core_read32(core, SOCRAMREGOFFS(bankinfo));
--+	*banksize = (bankinfo & SOCRAM_BANKINFO_SZMASK) + 1;
--+	*banksize *= SOCRAM_BANKINFO_SZBASE;
--+	return !!(bankinfo & SOCRAM_BANKINFO_RETNTRAM_MASK);
--+}
--+
--+static void brcmf_chip_socram_ramsize(struct brcmf_core_priv *sr, u32 *ramsize,
--+				      u32 *srsize)
--+{
--+	u32 coreinfo;
--+	uint nb, banksize, lss;
--+	bool retent;
--+	int i;
--+
--+	*ramsize = 0;
--+	*srsize = 0;
--+
--+	if (WARN_ON(sr->pub.rev < 4))
--+		return;
--+
--+	if (!brcmf_chip_iscoreup(&sr->pub))
--+		brcmf_chip_resetcore(&sr->pub, 0, 0, 0);
--+
--+	/* Get info for determining size */
--+	coreinfo = brcmf_chip_core_read32(sr, SOCRAMREGOFFS(coreinfo));
--+	nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
--+
--+	if ((sr->pub.rev <= 7) || (sr->pub.rev == 12)) {
--+		banksize = (coreinfo & SRCI_SRBSZ_MASK);
--+		lss = (coreinfo & SRCI_LSS_MASK) >> SRCI_LSS_SHIFT;
--+		if (lss != 0)
--+			nb--;
--+		*ramsize = nb * (1 << (banksize + SR_BSZ_BASE));
--+		if (lss != 0)
--+			*ramsize += (1 << ((lss - 1) + SR_BSZ_BASE));
--+	} else {
--+		nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
--+		for (i = 0; i < nb; i++) {
--+			retent = brcmf_chip_socram_banksize(sr, i, &banksize);
--+			*ramsize += banksize;
--+			if (retent)
--+				*srsize += banksize;
--+		}
--+	}
--+
--+	/* hardcoded save&restore memory sizes */
--+	switch (sr->chip->pub.chip) {
-- 	case BRCM_CC_4334_CHIP_ID:
---	case BRCM_CC_43340_CHIP_ID:
---		ci->pub.ramsize = 0x80000;
--+		if (sr->chip->pub.chiprev < 2)
--+			*srsize = (32 * 1024);
-- 		break;
---	case BRCM_CC_4335_CHIP_ID:
---		ci->pub.ramsize = 0xc0000;
---		ci->pub.rambase = 0x180000;
---		break;
---	case BRCM_CC_43362_CHIP_ID:
---		ci->pub.ramsize = 0x3c000;
--+	default:
-- 		break;
--+	}
--+}
--+
--+/** Return the TCM-RAM size of the ARMCR4 core. */
--+static u32 brcmf_chip_tcm_ramsize(struct brcmf_core_priv *cr4)
--+{
--+	u32 corecap;
--+	u32 memsize = 0;
--+	u32 nab;
--+	u32 nbb;
--+	u32 totb;
--+	u32 bxinfo;
--+	u32 idx;
--+
--+	corecap = brcmf_chip_core_read32(cr4, ARMCR4_CAP);
--+
--+	nab = (corecap & ARMCR4_TCBANB_MASK) >> ARMCR4_TCBANB_SHIFT;
--+	nbb = (corecap & ARMCR4_TCBBNB_MASK) >> ARMCR4_TCBBNB_SHIFT;
--+	totb = nab + nbb;
--+
--+	for (idx = 0; idx < totb; idx++) {
--+		brcmf_chip_core_write32(cr4, ARMCR4_BANKIDX, idx);
--+		bxinfo = brcmf_chip_core_read32(cr4, ARMCR4_BANKINFO);
--+		memsize += ((bxinfo & ARMCR4_BSZ_MASK) + 1) * ARMCR4_BSZ_MULT;
--+	}
--+
--+	return memsize;
--+}
--+
--+static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
--+{
--+	switch (ci->pub.chip) {
-- 	case BRCM_CC_4345_CHIP_ID:
---		ci->pub.ramsize = 0xc8000;
---		ci->pub.rambase = 0x198000;
---		break;
--+		return 0x198000;
--+	case BRCM_CC_4335_CHIP_ID:
-- 	case BRCM_CC_4339_CHIP_ID:
-- 	case BRCM_CC_4354_CHIP_ID:
-- 	case BRCM_CC_4356_CHIP_ID:
-- 	case BRCM_CC_43567_CHIP_ID:
-- 	case BRCM_CC_43569_CHIP_ID:
-- 	case BRCM_CC_43570_CHIP_ID:
---		ci->pub.ramsize = 0xc0000;
---		ci->pub.rambase = 0x180000;
---		break;
-- 	case BRCM_CC_43602_CHIP_ID:
---		ci->pub.ramsize = 0xf0000;
---		ci->pub.rambase = 0x180000;
---		break;
--+		return 0x180000;
-- 	default:
-- 		brcmf_err("unknown chip: %s\n", ci->pub.name);
-- 		break;
-- 	}
--+	return 0;
--+}
--+
--+static int brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
--+{
--+	struct brcmf_core_priv *mem_core;
--+	struct brcmf_core *mem;
--+
--+	mem = brcmf_chip_get_core(&ci->pub, BCMA_CORE_ARM_CR4);
--+	if (mem) {
--+		mem_core = container_of(mem, struct brcmf_core_priv, pub);
--+		ci->pub.ramsize = brcmf_chip_tcm_ramsize(mem_core);
--+		ci->pub.rambase = brcmf_chip_tcm_rambase(ci);
--+		if (!ci->pub.rambase) {
--+			brcmf_err("RAM base not provided with ARM CR4 core\n");
--+			return -EINVAL;
--+		}
--+	} else {
--+		mem = brcmf_chip_get_core(&ci->pub, BCMA_CORE_INTERNAL_MEM);
--+		mem_core = container_of(mem, struct brcmf_core_priv, pub);
--+		brcmf_chip_socram_ramsize(mem_core, &ci->pub.ramsize,
--+					  &ci->pub.srsize);
--+	}
--+	brcmf_dbg(INFO, "RAM: base=0x%x size=%d (0x%x) sr=%d (0x%x)\n",
--+		  ci->pub.rambase, ci->pub.ramsize, ci->pub.ramsize,
--+		  ci->pub.srsize, ci->pub.srsize);
--+
--+	if (!ci->pub.ramsize) {
--+		brcmf_err("RAM size is undetermined\n");
--+		return -ENOMEM;
--+	}
--+	return 0;
-- }
-- 
-- static u32 brcmf_chip_dmp_get_desc(struct brcmf_chip_priv *ci, u32 *eromaddr,
--@@ -668,6 +833,7 @@ static int brcmf_chip_recognition(struct
-- 	struct brcmf_core *core;
-- 	u32 regdata;
-- 	u32 socitype;
--+	int ret;
-- 
-- 	/* Get CC core rev
-- 	 * Chipid is assume to be at offset 0 from SI_ENUM_BASE
--@@ -720,9 +886,13 @@ static int brcmf_chip_recognition(struct
-- 		return -ENODEV;
-- 	}
-- 
---	brcmf_chip_get_raminfo(ci);
---
---	return brcmf_chip_cores_check(ci);
--+	ret = brcmf_chip_cores_check(ci);
--+	if (ret)
--+		return ret;
--+
--+	/* assure chip is passive for core access */
--+	brcmf_chip_set_passive(&ci->pub);
--+	return brcmf_chip_get_raminfo(ci);
-- }
-- 
-- static void brcmf_chip_disable_arm(struct brcmf_chip_priv *chip, u16 id)
--@@ -827,8 +997,6 @@ struct brcmf_chip *brcmf_chip_attach(voi
-- 	if (err < 0)
-- 		goto fail;
-- 
---	/* assure chip is passive for download */
---	brcmf_chip_set_passive(&chip->pub);
-- 	return &chip->pub;
-- 
-- fail:
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.h
--@@ -30,7 +30,8 @@
--  * @pmucaps: PMU capabilities.
--  * @pmurev: PMU revision.
--  * @rambase: RAM base address (only applicable for ARM CR4 chips).
--- * @ramsize: amount of RAM on chip.
--+ * @ramsize: amount of RAM on chip including retention.
--+ * @srsize: amount of retention RAM on chip.
--  * @name: string representation of the chip identifier.
--  */
-- struct brcmf_chip {
--@@ -41,6 +42,7 @@ struct brcmf_chip {
-- 	u32 pmurev;
-- 	u32 rambase;
-- 	u32 ramsize;
--+	u32 srsize;
-- 	char name[8];
-- };
-- 
-diff --git a/package/kernel/mac80211/patches/336-0006-brcmfmac-take-save-restore-memory-into-account-for-S.patch b/package/kernel/mac80211/patches/336-0006-brcmfmac-take-save-restore-memory-into-account-for-S.patch
-deleted file mode 100644
-index 69618a7..0000000
---- a/package/kernel/mac80211/patches/336-0006-brcmfmac-take-save-restore-memory-into-account-for-S.patch
-+++ /dev/null
-@@ -1,96 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:32 +0100
--Subject: [PATCH] brcmfmac: take save&restore memory into account for SDIO
-- shared info
--
--The firmware provides pointer to SDIO shared information at end of
--RAM during firmware initialization. End of RAM is obviously determined
--by the actual ram size, but part of that may be used for save&restore
--memory. In that case another location in RAM will hold the pointer.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -1067,44 +1067,47 @@ static inline bool brcmf_sdio_valid_shar
-- static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
-- 				 struct sdpcm_shared *sh)
-- {
---	u32 addr;
--+	u32 addr = 0;
-- 	int rv;
-- 	u32 shaddr = 0;
-- 	struct sdpcm_shared_le sh_le;
-- 	__le32 addr_le;
-- 
---	shaddr = bus->ci->rambase + bus->ci->ramsize - 4;
--+	sdio_claim_host(bus->sdiodev->func[1]);
--+	brcmf_sdio_bus_sleep(bus, false, false);
-- 
-- 	/*
-- 	 * Read last word in socram to determine
-- 	 * address of sdpcm_shared structure
-- 	 */
---	sdio_claim_host(bus->sdiodev->func[1]);
---	brcmf_sdio_bus_sleep(bus, false, false);
---	rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
---	sdio_release_host(bus->sdiodev->func[1]);
--+	shaddr = bus->ci->rambase + bus->ci->ramsize - 4;
--+	if (!bus->ci->rambase && brcmf_chip_sr_capable(bus->ci))
--+		shaddr -= bus->ci->srsize;
--+	rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr,
--+			       (u8 *)&addr_le, 4);
-- 	if (rv < 0)
---		return rv;
---
---	addr = le32_to_cpu(addr_le);
---
---	brcmf_dbg(SDIO, "sdpcm_shared address 0x%08X\n", addr);
--+		goto fail;
-- 
-- 	/*
-- 	 * Check if addr is valid.
-- 	 * NVRAM length at the end of memory should have been overwritten.
-- 	 */
--+	addr = le32_to_cpu(addr_le);
-- 	if (!brcmf_sdio_valid_shared_address(addr)) {
---			brcmf_err("invalid sdpcm_shared address 0x%08X\n",
---				  addr);
---			return -EINVAL;
--+		brcmf_err("invalid sdpcm_shared address 0x%08X\n", addr);
--+		rv = -EINVAL;
--+		goto fail;
-- 	}
-- 
--+	brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
--+
-- 	/* Read hndrte_shared structure */
-- 	rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
-- 			       sizeof(struct sdpcm_shared_le));
-- 	if (rv < 0)
---		return rv;
--+		goto fail;
--+
--+	sdio_release_host(bus->sdiodev->func[1]);
-- 
-- 	/* Endianness */
-- 	sh->flags = le32_to_cpu(sh_le.flags);
--@@ -1121,8 +1124,13 @@ static int brcmf_sdio_readshared(struct
-- 			  sh->flags & SDPCM_SHARED_VERSION_MASK);
-- 		return -EPROTO;
-- 	}
---
-- 	return 0;
--+
--+fail:
--+	brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
--+		  rv, addr);
--+	sdio_release_host(bus->sdiodev->func[1]);
--+	return rv;
-- }
-- 
-- static void brcmf_sdio_get_console_addr(struct brcmf_sdio *bus)
-diff --git a/package/kernel/mac80211/patches/336-0007-brcmfmac-fix-watchdog-timer-regression.patch b/package/kernel/mac80211/patches/336-0007-brcmfmac-fix-watchdog-timer-regression.patch
-deleted file mode 100644
-index 1b10dbb..0000000
---- a/package/kernel/mac80211/patches/336-0007-brcmfmac-fix-watchdog-timer-regression.patch
-+++ /dev/null
-@@ -1,59 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 11 Mar 2015 16:11:33 +0100
--Subject: [PATCH] brcmfmac: fix watchdog timer regression
--
--The watchdog timer is used to put the device in a low-power mode when
--it is idle for some time. This timer is stopped during that mode and
--should be restarted upon activity. This has been broken by commit
--d4150fced0365 ("brcmfmac: Simplify watchdog sleep."). This patch
--restores the behaviour as it was before that commit.
--
--Reported-by: Pontus Fuchs <pontusf@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -972,7 +972,6 @@ static int brcmf_sdio_clkctl(struct brcm
-- 			brcmf_sdio_sdclk(bus, true);
-- 		/* Now request HT Avail on the backplane */
-- 		brcmf_sdio_htclk(bus, true, pendok);
---		brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-- 		break;
-- 
-- 	case CLK_SDONLY:
--@@ -984,7 +983,6 @@ static int brcmf_sdio_clkctl(struct brcm
-- 		else
-- 			brcmf_err("request for %d -> %d\n",
-- 				  bus->clkstate, target);
---		brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-- 		break;
-- 
-- 	case CLK_NONE:
--@@ -993,7 +991,6 @@ static int brcmf_sdio_clkctl(struct brcm
-- 			brcmf_sdio_htclk(bus, false, false);
-- 		/* Now remove the SD clock */
-- 		brcmf_sdio_sdclk(bus, false);
---		brcmf_sdio_wd_timer(bus, 0);
-- 		break;
-- 	}
-- #ifdef DEBUG
--@@ -1048,6 +1045,7 @@ end:
-- 			brcmf_sdio_clkctl(bus, CLK_NONE, pendok);
-- 	} else {
-- 		brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
--+		brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-- 	}
-- 	bus->sleeping = sleep;
-- 	brcmf_dbg(SDIO, "new state %s\n",
--@@ -4242,6 +4240,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
-- 		if (bus->ci) {
-- 			if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
-- 				sdio_claim_host(bus->sdiodev->func[1]);
--+				brcmf_sdio_wd_timer(bus, 0);
-- 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-- 				/* Leave the device in state where it is
-- 				 * 'passive'. This is done by resetting all
-diff --git a/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch b/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch
-new file mode 100644
-index 0000000..32a2ad6
---- /dev/null
-+++ b/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch
-@@ -0,0 +1,31 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Thu, 18 Feb 2016 19:45:33 +0100
-+Subject: [PATCH] mac80211: minstrel_ht: set default tx aggregation timeout to
-+ 0
-+
-+The value 5000 was put here with the addition of the timeout field to
-+ieee80211_start_tx_ba_session. It was originally added in mac80211 to
-+save resources for drivers like iwlwifi, which only supports a limited
-+number of concurrent aggregation sessions.
-+
-+Since iwlwifi does not use minstrel_ht and other drivers don't need
-+this, 0 is a better default - especially since there have been
-+recent reports of aggregation setup related issues reproduced with
-+ath9k. This should improve stability without causing any adverse
-+effects.
-+
-+Cc: stable@vger.kernel.org
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/mac80211/rc80211_minstrel_ht.c
-++++ b/net/mac80211/rc80211_minstrel_ht.c
-+@@ -692,7 +692,7 @@ minstrel_aggr_check(struct ieee80211_sta
-+ 	if (likely(sta->ampdu_mlme.tid_tx[tid]))
-+ 		return;
-+ 
-+-	ieee80211_start_tx_ba_session(pubsta, tid, 5000);
-++	ieee80211_start_tx_ba_session(pubsta, tid, 0);
-+ }
-+ 
-+ static void
-diff --git a/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch b/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch
-deleted file mode 100644
-index af76f13..0000000
---- a/package/kernel/mac80211/patches/337-0001-brcmfmac-avoid-runtime-pm-for-sdio-host-controller.patch
-+++ /dev/null
-@@ -1,44 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:21 +0100
--Subject: [PATCH] brcmfmac: avoid runtime-pm for sdio host controller
--
--Several host controllers supporting runtime-pm are causing issues
--with our sdio wireless cards because they disable the sdio interrupt
--upon going into runtime suspend. This patch avoids that by doing
--a pm_runtime_forbid() call during the probe. Tested with Sony Vaio
--Duo 13 which uses sdhci-acpi host controller.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -29,6 +29,7 @@
-- #include <linux/mmc/host.h>
-- #include <linux/platform_device.h>
-- #include <linux/platform_data/brcmfmac-sdio.h>
--+#include <linux/pm_runtime.h>
-- #include <linux/suspend.h>
-- #include <linux/errno.h>
-- #include <linux/module.h>
--@@ -1006,6 +1007,7 @@ static int brcmf_sdiod_remove(struct brc
-- 	sg_free_table(&sdiodev->sgtable);
-- 	sdiodev->sbwad = 0;
-- 
--+	pm_runtime_allow(sdiodev->func[1]->card->host->parent);
-- 	return 0;
-- }
-- 
--@@ -1074,7 +1076,7 @@ static int brcmf_sdiod_probe(struct brcm
-- 		ret = -ENODEV;
-- 		goto out;
-- 	}
---
--+	pm_runtime_forbid(host->parent);
-- out:
-- 	if (ret)
-- 		brcmf_sdiod_remove(sdiodev);
-diff --git a/package/kernel/mac80211/patches/337-0002-brcmfmac-Add-necessary-memory-barriers-for-SDIO.patch b/package/kernel/mac80211/patches/337-0002-brcmfmac-Add-necessary-memory-barriers-for-SDIO.patch
-deleted file mode 100644
-index c419cc6..0000000
---- a/package/kernel/mac80211/patches/337-0002-brcmfmac-Add-necessary-memory-barriers-for-SDIO.patch
-+++ /dev/null
-@@ -1,171 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:22 +0100
--Subject: [PATCH] brcmfmac: Add necessary memory barriers for SDIO.
--
--SDIO uses a thread to handle all communication with the device,
--for this data is exchanged between threads. This data needs proper
--memory barriers to make sure that data "exchange" is going correct.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -507,8 +507,8 @@ struct brcmf_sdio {
-- 
-- 	struct workqueue_struct *brcmf_wq;
-- 	struct work_struct datawork;
---	atomic_t dpc_tskcnt;
---	atomic_t dpc_running;
--+	bool dpc_triggered;
--+	bool dpc_running;
-- 
-- 	bool txoff;		/* Transmit flow-controlled */
-- 	struct brcmf_sdio_count sdcnt;
--@@ -2713,6 +2713,7 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
-- 						      bus->ctrl_frame_len);
-- 			bus->ctrl_frame_err = err;
--+			wmb();
-- 			bus->ctrl_frame_stat = false;
-- 		}
-- 		sdio_release_host(bus->sdiodev->func[1]);
--@@ -2734,6 +2735,7 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 			sdio_claim_host(bus->sdiodev->func[1]);
-- 			if (bus->ctrl_frame_stat) {
-- 				bus->ctrl_frame_err = -ENODEV;
--+				wmb();
-- 				bus->ctrl_frame_stat = false;
-- 				brcmf_sdio_wait_event_wakeup(bus);
-- 			}
--@@ -2744,7 +2746,7 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 		   (!atomic_read(&bus->fcstate) &&
-- 		    brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
-- 		    data_ok(bus))) {
---		atomic_inc(&bus->dpc_tskcnt);
--+		bus->dpc_triggered = true;
-- 	}
-- }
-- 
--@@ -2940,6 +2942,7 @@ brcmf_sdio_bus_txctl(struct device *dev,
-- 	/* Send from dpc */
-- 	bus->ctrl_frame_buf = msg;
-- 	bus->ctrl_frame_len = msglen;
--+	wmb();
-- 	bus->ctrl_frame_stat = true;
-- 
-- 	brcmf_sdio_trigger_dpc(bus);
--@@ -2958,6 +2961,7 @@ brcmf_sdio_bus_txctl(struct device *dev,
-- 	if (!ret) {
-- 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
-- 			  bus->ctrl_frame_err);
--+		rmb();
-- 		ret = bus->ctrl_frame_err;
-- 	}
-- 
--@@ -3526,8 +3530,8 @@ done:
-- 
-- void brcmf_sdio_trigger_dpc(struct brcmf_sdio *bus)
-- {
---	if (atomic_read(&bus->dpc_tskcnt) == 0) {
---		atomic_inc(&bus->dpc_tskcnt);
--+	if (!bus->dpc_triggered) {
--+		bus->dpc_triggered = true;
-- 		queue_work(bus->brcmf_wq, &bus->datawork);
-- 	}
-- }
--@@ -3558,7 +3562,7 @@ void brcmf_sdio_isr(struct brcmf_sdio *b
-- 	if (!bus->intr)
-- 		brcmf_err("isr w/o interrupt configured!\n");
-- 
---	atomic_inc(&bus->dpc_tskcnt);
--+	bus->dpc_triggered = true;
-- 	queue_work(bus->brcmf_wq, &bus->datawork);
-- }
-- 
--@@ -3578,7 +3582,7 @@ static void brcmf_sdio_bus_watchdog(stru
-- 		if (!bus->intr ||
-- 		    (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
-- 
---			if (atomic_read(&bus->dpc_tskcnt) == 0) {
--+			if (!bus->dpc_triggered) {
-- 				u8 devpend;
-- 
-- 				sdio_claim_host(bus->sdiodev->func[1]);
--@@ -3596,7 +3600,7 @@ static void brcmf_sdio_bus_watchdog(stru
-- 				bus->sdcnt.pollcnt++;
-- 				atomic_set(&bus->ipend, 1);
-- 
---				atomic_inc(&bus->dpc_tskcnt);
--+				bus->dpc_triggered = true;
-- 				queue_work(bus->brcmf_wq, &bus->datawork);
-- 			}
-- 		}
--@@ -3623,17 +3627,21 @@ static void brcmf_sdio_bus_watchdog(stru
-- #endif				/* DEBUG */
-- 
-- 	/* On idle timeout clear activity flag and/or turn off clock */
---	if ((atomic_read(&bus->dpc_tskcnt) == 0) &&
---	    (atomic_read(&bus->dpc_running) == 0) &&
---	    (bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
---		bus->idlecount++;
---		if (bus->idlecount > bus->idletime) {
---			brcmf_dbg(SDIO, "idle\n");
---			sdio_claim_host(bus->sdiodev->func[1]);
---			brcmf_sdio_wd_timer(bus, 0);
--+	if (!bus->dpc_triggered) {
--+		rmb();
--+		if ((!bus->dpc_running) && (bus->idletime > 0) &&
--+		    (bus->clkstate == CLK_AVAIL)) {
--+			bus->idlecount++;
--+			if (bus->idlecount > bus->idletime) {
--+				brcmf_dbg(SDIO, "idle\n");
--+				sdio_claim_host(bus->sdiodev->func[1]);
--+				brcmf_sdio_wd_timer(bus, 0);
--+				bus->idlecount = 0;
--+				brcmf_sdio_bus_sleep(bus, true, false);
--+				sdio_release_host(bus->sdiodev->func[1]);
--+			}
--+		} else {
-- 			bus->idlecount = 0;
---			brcmf_sdio_bus_sleep(bus, true, false);
---			sdio_release_host(bus->sdiodev->func[1]);
-- 		}
-- 	} else {
-- 		bus->idlecount = 0;
--@@ -3645,13 +3653,14 @@ static void brcmf_sdio_dataworker(struct
-- 	struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
-- 					      datawork);
-- 
---	while (atomic_read(&bus->dpc_tskcnt)) {
---		atomic_set(&bus->dpc_running, 1);
---		atomic_set(&bus->dpc_tskcnt, 0);
--+	bus->dpc_running = true;
--+	wmb();
--+	while (ACCESS_ONCE(bus->dpc_triggered)) {
--+		bus->dpc_triggered = false;
-- 		brcmf_sdio_dpc(bus);
-- 		bus->idlecount = 0;
---		atomic_set(&bus->dpc_running, 0);
-- 	}
--+	bus->dpc_running = false;
-- 	if (brcmf_sdiod_freezing(bus->sdiodev)) {
-- 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DOWN);
-- 		brcmf_sdiod_try_freeze(bus->sdiodev);
--@@ -4144,8 +4153,8 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
-- 		bus->watchdog_tsk = NULL;
-- 	}
-- 	/* Initialize DPC thread */
---	atomic_set(&bus->dpc_tskcnt, 0);
---	atomic_set(&bus->dpc_running, 0);
--+	bus->dpc_triggered = false;
--+	bus->dpc_running = false;
-- 
-- 	/* Assign bus interface call back */
-- 	bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
-diff --git a/package/kernel/mac80211/patches/337-0003-brcmfmac-Remove-unnecessary-new-line-in-pcie-console.patch b/package/kernel/mac80211/patches/337-0003-brcmfmac-Remove-unnecessary-new-line-in-pcie-console.patch
-deleted file mode 100644
-index 1bc98a0..0000000
---- a/package/kernel/mac80211/patches/337-0003-brcmfmac-Remove-unnecessary-new-line-in-pcie-console.patch
-+++ /dev/null
-@@ -1,26 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:24 +0100
--Subject: [PATCH] brcmfmac: Remove unnecessary new-line in pcie console
-- logging.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -651,10 +651,9 @@ static void brcmf_pcie_bus_console_read(
-- 			console->log_str[console->log_idx] = ch;
-- 			console->log_idx++;
-- 		}
---
-- 		if (ch == '\n') {
-- 			console->log_str[console->log_idx] = 0;
---			brcmf_dbg(PCIE, "CONSOLE: %s\n", console->log_str);
--+			brcmf_dbg(PCIE, "CONSOLE: %s", console->log_str);
-- 			console->log_idx = 0;
-- 		}
-- 	}
-diff --git a/package/kernel/mac80211/patches/337-0004-brcmfmac-add-MODULE_FIRMWARE-macros-for-bcm4356-PCIe.patch b/package/kernel/mac80211/patches/337-0004-brcmfmac-add-MODULE_FIRMWARE-macros-for-bcm4356-PCIe.patch
-deleted file mode 100644
-index fcf0bf3..0000000
---- a/package/kernel/mac80211/patches/337-0004-brcmfmac-add-MODULE_FIRMWARE-macros-for-bcm4356-PCIe.patch
-+++ /dev/null
-@@ -1,26 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:25 +0100
--Subject: [PATCH] brcmfmac: add MODULE_FIRMWARE() macros for bcm4356 PCIe
-- device
--
--The BCM4356 PCIe wireless device was added recently but overlooked
--the fact that the MODULE_FIRMWARE() macros were missing for the
--firmwares needed by this device.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -189,6 +189,8 @@ MODULE_FIRMWARE(BRCMF_PCIE_43602_FW_NAME
-- MODULE_FIRMWARE(BRCMF_PCIE_43602_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4354_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4354_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4356_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4356_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_NVRAM_NAME);
-- 
-diff --git a/package/kernel/mac80211/patches/337-0005-brcmfmac-add-support-for-BCM43430-SDIO-chipset.patch b/package/kernel/mac80211/patches/337-0005-brcmfmac-add-support-for-BCM43430-SDIO-chipset.patch
-deleted file mode 100644
-index b3e9bc9..0000000
---- a/package/kernel/mac80211/patches/337-0005-brcmfmac-add-support-for-BCM43430-SDIO-chipset.patch
-+++ /dev/null
-@@ -1,138 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:26 +0100
--Subject: [PATCH] brcmfmac: add support for BCM43430 SDIO chipset
--
--This patch added support for the BCM43430 802.11n SDIO chipset.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -1098,6 +1098,7 @@ static const struct sdio_device_id brcmf
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
--+	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4345),
-- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
-- 	{ /* end: all zeroes */ }
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -600,6 +600,12 @@ static void brcmf_chip_socram_ramsize(st
-- 		if (sr->chip->pub.chiprev < 2)
-- 			*srsize = (32 * 1024);
-- 		break;
--+	case BRCM_CC_43430_CHIP_ID:
--+		/* assume sr for now as we can not check
--+		 * firmware sr capability at this point.
--+		 */
--+		*srsize = (64 * 1024);
--+		break;
-- 	default:
-- 		break;
-- 	}
--@@ -1072,6 +1078,7 @@ static void
-- brcmf_chip_cm3_set_passive(struct brcmf_chip_priv *chip)
-- {
-- 	struct brcmf_core *core;
--+	struct brcmf_core_priv *sr;
-- 
-- 	brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CM3);
-- 	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_80211);
--@@ -1081,6 +1088,13 @@ brcmf_chip_cm3_set_passive(struct brcmf_
-- 			     D11_BCMA_IOCTL_PHYCLOCKEN);
-- 	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_INTERNAL_MEM);
-- 	brcmf_chip_resetcore(core, 0, 0, 0);
--+
--+	/* disable bank #3 remap for this device */
--+	if (chip->pub.chip == BRCM_CC_43430_CHIP_ID) {
--+		sr = container_of(core, struct brcmf_core_priv, pub);
--+		brcmf_chip_core_write32(sr, SOCRAMREGOFFS(bankidx), 3);
--+		brcmf_chip_core_write32(sr, SOCRAMREGOFFS(bankpda), 0);
--+	}
-- }
-- 
-- static bool brcmf_chip_cm3_set_active(struct brcmf_chip_priv *chip)
--@@ -1188,6 +1202,10 @@ bool brcmf_chip_sr_capable(struct brcmf_
-- 		addr = CORE_CC_REG(base, chipcontrol_data);
-- 		reg = chip->ops->read32(chip->ctx, addr);
-- 		return (reg & pmu_cc3_mask) != 0;
--+	case BRCM_CC_43430_CHIP_ID:
--+		addr = CORE_CC_REG(base, sr_control1);
--+		reg = chip->ops->read32(chip->ctx, addr);
--+		return reg != 0;
-- 	default:
-- 		addr = CORE_CC_REG(base, pmucapabilities_ext);
-- 		reg = chip->ops->read32(chip->ctx, addr);
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -615,6 +615,8 @@ static const struct sdiod_drive_str sdio
-- #define BCM43362_NVRAM_NAME		"brcm/brcmfmac43362-sdio.txt"
-- #define BCM4339_FIRMWARE_NAME		"brcm/brcmfmac4339-sdio.bin"
-- #define BCM4339_NVRAM_NAME		"brcm/brcmfmac4339-sdio.txt"
--+#define BCM43430_FIRMWARE_NAME		"brcm/brcmfmac43430-sdio.bin"
--+#define BCM43430_NVRAM_NAME		"brcm/brcmfmac43430-sdio.txt"
-- #define BCM4345_FIRMWARE_NAME		"brcm/brcmfmac4345-sdio.bin"
-- #define BCM4345_NVRAM_NAME		"brcm/brcmfmac4345-sdio.txt"
-- #define BCM4354_FIRMWARE_NAME		"brcm/brcmfmac4354-sdio.bin"
--@@ -640,6 +642,8 @@ MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
--+MODULE_FIRMWARE(BCM43430_FIRMWARE_NAME);
--+MODULE_FIRMWARE(BCM43430_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4345_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4345_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4354_FIRMWARE_NAME);
--@@ -671,6 +675,7 @@ static const struct brcmf_firmware_names
-- 	{ BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
-- 	{ BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
-- 	{ BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
--+	{ BRCM_CC_43430_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43430) },
-- 	{ BRCM_CC_4345_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4345) },
-- 	{ BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
-- };
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -37,6 +37,7 @@
-- #define BRCM_CC_43362_CHIP_ID		43362
-- #define BRCM_CC_4335_CHIP_ID		0x4335
-- #define BRCM_CC_4339_CHIP_ID		0x4339
--+#define BRCM_CC_43430_CHIP_ID		43430
-- #define BRCM_CC_4345_CHIP_ID		0x4345
-- #define BRCM_CC_4354_CHIP_ID		0x4354
-- #define BRCM_CC_4356_CHIP_ID		0x4356
----- a/drivers/net/wireless/brcm80211/include/chipcommon.h
--+++ b/drivers/net/wireless/brcm80211/include/chipcommon.h
--@@ -183,7 +183,14 @@ struct chipcregs {
-- 	u8 uart1lsr;
-- 	u8 uart1msr;
-- 	u8 uart1scratch;
---	u32 PAD[126];
--+	u32 PAD[62];
--+
--+	/* save/restore, corerev >= 48 */
--+	u32 sr_capability;          /* 0x500 */
--+	u32 sr_control0;            /* 0x504 */
--+	u32 sr_control1;            /* 0x508 */
--+	u32 gpio_control;           /* 0x50C */
--+	u32 PAD[60];
-- 
-- 	/* PMU registers (corerev >= 20) */
-- 	u32 pmucontrol;	/* 0x600 */
----- a/include/linux/mmc/sdio_ids.h
--+++ b/include/linux/mmc/sdio_ids.h
--@@ -33,6 +33,7 @@
-- #define SDIO_DEVICE_ID_BROADCOM_43341		0xa94d
-- #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
-- #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
--+#define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
-- #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
-- #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
-- 
-diff --git a/package/kernel/mac80211/patches/337-0006-brcmfmac-only-support-the-BCM43455-7-device.patch b/package/kernel/mac80211/patches/337-0006-brcmfmac-only-support-the-BCM43455-7-device.patch
-deleted file mode 100644
-index c3d7bc2..0000000
---- a/package/kernel/mac80211/patches/337-0006-brcmfmac-only-support-the-BCM43455-7-device.patch
-+++ /dev/null
-@@ -1,50 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:27 +0100
--Subject: [PATCH] brcmfmac: only support the BCM43455/7 device
--
--Recently support was added for the BCM4345 SDIO chipset by
--commit 9c51026509d7 ("brcmfmac: Add support for BCM4345 SDIO chipset")
--however this was verified using a BCM43455 device, which is
--a more recent revision of the chip. This patch assure that
--older revisions are not probed as they would fail.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Syed Asifful Dayyan <syedd@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -617,8 +617,8 @@ static const struct sdiod_drive_str sdio
-- #define BCM4339_NVRAM_NAME		"brcm/brcmfmac4339-sdio.txt"
-- #define BCM43430_FIRMWARE_NAME		"brcm/brcmfmac43430-sdio.bin"
-- #define BCM43430_NVRAM_NAME		"brcm/brcmfmac43430-sdio.txt"
---#define BCM4345_FIRMWARE_NAME		"brcm/brcmfmac4345-sdio.bin"
---#define BCM4345_NVRAM_NAME		"brcm/brcmfmac4345-sdio.txt"
--+#define BCM43455_FIRMWARE_NAME		"brcm/brcmfmac43455-sdio.bin"
--+#define BCM43455_NVRAM_NAME		"brcm/brcmfmac43455-sdio.txt"
-- #define BCM4354_FIRMWARE_NAME		"brcm/brcmfmac4354-sdio.bin"
-- #define BCM4354_NVRAM_NAME		"brcm/brcmfmac4354-sdio.txt"
-- 
--@@ -644,8 +644,8 @@ MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM43430_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM43430_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4345_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4345_NVRAM_NAME);
--+MODULE_FIRMWARE(BCM43455_FIRMWARE_NAME);
--+MODULE_FIRMWARE(BCM43455_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4354_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4354_NVRAM_NAME);
-- 
--@@ -676,7 +676,7 @@ static const struct brcmf_firmware_names
-- 	{ BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
-- 	{ BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
-- 	{ BRCM_CC_43430_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43430) },
---	{ BRCM_CC_4345_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4345) },
--+	{ BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, BRCMF_FIRMWARE_NVRAM(BCM43455) },
-- 	{ BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
-- };
-- 
-diff --git a/package/kernel/mac80211/patches/337-0007-brcmfmac-remove-support-for-unreleased-BCM4354-PCIe.patch b/package/kernel/mac80211/patches/337-0007-brcmfmac-remove-support-for-unreleased-BCM4354-PCIe.patch
-deleted file mode 100644
-index a62cfdf..0000000
---- a/package/kernel/mac80211/patches/337-0007-brcmfmac-remove-support-for-unreleased-BCM4354-PCIe.patch
-+++ /dev/null
-@@ -1,52 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 18 Mar 2015 13:25:28 +0100
--Subject: [PATCH] brcmfmac: remove support for unreleased BCM4354 PCIe
--
--There are no known BCM4354 PCIe devices released so removing
--support from the driver until proven otherwise.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -47,8 +47,6 @@ enum brcmf_pcie_state {
-- 
-- #define BRCMF_PCIE_43602_FW_NAME		"brcm/brcmfmac43602-pcie.bin"
-- #define BRCMF_PCIE_43602_NVRAM_NAME		"brcm/brcmfmac43602-pcie.txt"
---#define BRCMF_PCIE_4354_FW_NAME			"brcm/brcmfmac4354-pcie.bin"
---#define BRCMF_PCIE_4354_NVRAM_NAME		"brcm/brcmfmac4354-pcie.txt"
-- #define BRCMF_PCIE_4356_FW_NAME			"brcm/brcmfmac4356-pcie.bin"
-- #define BRCMF_PCIE_4356_NVRAM_NAME		"brcm/brcmfmac4356-pcie.txt"
-- #define BRCMF_PCIE_43570_FW_NAME		"brcm/brcmfmac43570-pcie.bin"
--@@ -187,8 +185,6 @@ enum brcmf_pcie_state {
-- 
-- MODULE_FIRMWARE(BRCMF_PCIE_43602_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43602_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4354_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4354_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4356_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4356_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME);
--@@ -1327,10 +1323,6 @@ static int brcmf_pcie_get_fwnames(struct
-- 		fw_name = BRCMF_PCIE_43602_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_43602_NVRAM_NAME;
-- 		break;
---	case BRCM_CC_4354_CHIP_ID:
---		fw_name = BRCMF_PCIE_4354_FW_NAME;
---		nvram_name = BRCMF_PCIE_4354_NVRAM_NAME;
---		break;
-- 	case BRCM_CC_4356_CHIP_ID:
-- 		fw_name = BRCMF_PCIE_4356_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_4356_NVRAM_NAME;
--@@ -1855,7 +1847,6 @@ cleanup:
-- 	PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
-- 
-- static struct pci_device_id brcmf_pcie_devid_table[] = {
---	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
-diff --git a/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch b/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch
-new file mode 100644
-index 0000000..229351b
---- /dev/null
-+++ b/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch
-@@ -0,0 +1,26 @@
-+From: Felix Fietkau <nbd@openwrt.org>
-+Date: Wed, 24 Feb 2016 12:03:13 +0100
-+Subject: [PATCH] mac80211: minstrel_ht: fix a logic error in RTS/CTS handling
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=UTF-8
-+Content-Transfer-Encoding: 8bit
-+
-+RTS/CTS needs to be enabled if the rate is a fallback rate *or* if it's
-+a dual-stream rate and the sta is in dynamic SMPS mode.
-+
-+Fixes: a3ebb4e1b763 ("mac80211: minstrel_ht: handle peers in dynamic SMPS")
-+Reported-by: Matías Richart <mrichart@fing.edu.uy>
-+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-+---
-+
-+--- a/net/mac80211/rc80211_minstrel_ht.c
-++++ b/net/mac80211/rc80211_minstrel_ht.c
-+@@ -872,7 +872,7 @@ minstrel_ht_set_rate(struct minstrel_pri
-+ 	 *  - if station is in dynamic SMPS (and streams > 1)
-+ 	 *  - for fallback rates, to increase chances of getting through
-+ 	 */
-+-	if (offset > 0 &&
-++	if (offset > 0 ||
-+ 	    (mi->sta->smps_mode == IEEE80211_SMPS_DYNAMIC &&
-+ 	     group->streams > 1)) {
-+ 		ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
-diff --git a/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch b/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch
-deleted file mode 100644
-index 366ff85..0000000
---- a/package/kernel/mac80211/patches/338-brcmfmac-disable-MBSS-feature-for-BCM43362.patch
-+++ /dev/null
-@@ -1,28 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Fri, 20 Mar 2015 22:18:17 +0100
--Subject: [PATCH] brcmfmac: disable MBSS feature for BCM43362
--
--The BCM43362 firmware falsely reports it is capable of providing
--MBSS. As a result AP mode no longer works for this device. Therefor
--disable MBSS in the driver for this chipset.
--
--Cc: stable@vger.kernel.org # 3.19.y
--Reported-by: Jorg Krause <jkrause@posteo.de>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--@@ -126,7 +126,8 @@ void brcmf_feat_attach(struct brcmf_pub
-- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
-- 	if (drvr->bus_if->wowl_supported)
-- 		brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
---	brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
--+	if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
--+		brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
-- 
-- 	/* set chip related quirks */
-- 	switch (drvr->bus_if->chip) {
-diff --git a/package/kernel/mac80211/patches/339-0001-brcmfmac-use-static-superset-of-channels-for-wiphy-b.patch b/package/kernel/mac80211/patches/339-0001-brcmfmac-use-static-superset-of-channels-for-wiphy-b.patch
-deleted file mode 100644
-index 6e461f6..0000000
---- a/package/kernel/mac80211/patches/339-0001-brcmfmac-use-static-superset-of-channels-for-wiphy-b.patch
-+++ /dev/null
-@@ -1,300 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:24 +0200
--Subject: [PATCH] brcmfmac: use static superset of channels for wiphy
-- bands
--
--The driver was constructing a list of channels per wiphy band
--by querying the device. This list is not what the hardware is
--able to do as it is already filtered by the country setting in
--the device. As user-space may change the country this would
--require updating the channel list which is not recommended [1].
--This patch introduces a superset of channels. The individual
--channels are disabled appropriately by querying the device.
--
--[1] http://mid.gmane.org/1426706320.3001.21.camel@sipsolutions.net
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -129,13 +129,47 @@ static struct ieee80211_rate __wl_rates[
-- 	RATETAB_ENT(BRCM_RATE_54M, 0),
-- };
-- 
---#define wl_a_rates		(__wl_rates + 4)
---#define wl_a_rates_size	8
-- #define wl_g_rates		(__wl_rates + 0)
---#define wl_g_rates_size	12
--+#define wl_g_rates_size		ARRAY_SIZE(__wl_rates)
--+#define wl_a_rates		(__wl_rates + 4)
--+#define wl_a_rates_size		(wl_g_rates_size - 4)
--+
--+#define CHAN2G(_channel, _freq) {				\
--+	.band			= IEEE80211_BAND_2GHZ,		\
--+	.center_freq		= (_freq),			\
--+	.hw_value		= (_channel),			\
--+	.flags			= IEEE80211_CHAN_DISABLED,	\
--+	.max_antenna_gain	= 0,				\
--+	.max_power		= 30,				\
--+}
--+
--+#define CHAN5G(_channel) {					\
--+	.band			= IEEE80211_BAND_5GHZ,		\
--+	.center_freq		= 5000 + (5 * (_channel)),	\
--+	.hw_value		= (_channel),			\
--+	.flags			= IEEE80211_CHAN_DISABLED,	\
--+	.max_antenna_gain	= 0,				\
--+	.max_power		= 30,				\
--+}
--+
--+static struct ieee80211_channel __wl_2ghz_channels[] = {
--+	CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
--+	CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
--+	CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
--+	CHAN2G(13, 2472), CHAN2G(14, 2484)
--+};
--+
--+static struct ieee80211_channel __wl_5ghz_channels[] = {
--+	CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
--+	CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
--+	CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
--+	CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
--+	CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
--+	CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
--+};
-- 
-- /* Band templates duplicated per wiphy. The channel info
--- * is filled in after querying the device.
--+ * above is added to the band during setup.
--  */
-- static const struct ieee80211_supported_band __wl_band_2ghz = {
-- 	.band = IEEE80211_BAND_2GHZ,
--@@ -143,7 +177,7 @@ static const struct ieee80211_supported_
-- 	.n_bitrates = wl_g_rates_size,
-- };
-- 
---static const struct ieee80211_supported_band __wl_band_5ghz_a = {
--+static const struct ieee80211_supported_band __wl_band_5ghz = {
-- 	.band = IEEE80211_BAND_5GHZ,
-- 	.bitrates = wl_a_rates,
-- 	.n_bitrates = wl_a_rates_size,
--@@ -5252,40 +5286,6 @@ dongle_scantime_out:
-- 	return err;
-- }
-- 
---/* Filter the list of channels received from firmware counting only
--- * the 20MHz channels. The wiphy band data only needs those which get
--- * flagged to indicate if they can take part in higher bandwidth.
--- */
---static void brcmf_count_20mhz_channels(struct brcmf_cfg80211_info *cfg,
---				       struct brcmf_chanspec_list *chlist,
---				       u32 chcnt[])
---{
---	u32 total = le32_to_cpu(chlist->count);
---	struct brcmu_chan ch;
---	int i;
---
---	for (i = 0; i < total; i++) {
---		ch.chspec = (u16)le32_to_cpu(chlist->element[i]);
---		cfg->d11inf.decchspec(&ch);
---
---		/* Firmware gives a ordered list. We skip non-20MHz
---		 * channels is 2G. For 5G we can abort upon reaching
---		 * a non-20MHz channel in the list.
---		 */
---		if (ch.bw != BRCMU_CHAN_BW_20) {
---			if (ch.band == BRCMU_CHAN_BAND_5G)
---				break;
---			else
---				continue;
---		}
---
---		if (ch.band == BRCMU_CHAN_BAND_2G)
---			chcnt[0] += 1;
---		else if (ch.band == BRCMU_CHAN_BAND_5G)
---			chcnt[1] += 1;
---	}
---}
---
-- static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
-- 					   struct brcmu_chan *ch)
-- {
--@@ -5321,7 +5321,6 @@ static int brcmf_construct_chaninfo(stru
-- 	u32 i, j;
-- 	u32 total;
-- 	u32 chaninfo;
---	u32 chcnt[2] = { 0, 0 };
-- 	u32 index;
-- 
-- 	pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
--@@ -5338,42 +5337,15 @@ static int brcmf_construct_chaninfo(stru
-- 		goto fail_pbuf;
-- 	}
-- 
---	brcmf_count_20mhz_channels(cfg, list, chcnt);
-- 	wiphy = cfg_to_wiphy(cfg);
---	if (chcnt[0]) {
---		band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
---			       GFP_KERNEL);
---		if (band == NULL) {
---			err = -ENOMEM;
---			goto fail_pbuf;
---		}
---		band->channels = kcalloc(chcnt[0], sizeof(*channel),
---					 GFP_KERNEL);
---		if (band->channels == NULL) {
---			kfree(band);
---			err = -ENOMEM;
---			goto fail_pbuf;
---		}
---		band->n_channels = 0;
---		wiphy->bands[IEEE80211_BAND_2GHZ] = band;
---	}
---	if (chcnt[1]) {
---		band = kmemdup(&__wl_band_5ghz_a, sizeof(__wl_band_5ghz_a),
---			       GFP_KERNEL);
---		if (band == NULL) {
---			err = -ENOMEM;
---			goto fail_band2g;
---		}
---		band->channels = kcalloc(chcnt[1], sizeof(*channel),
---					 GFP_KERNEL);
---		if (band->channels == NULL) {
---			kfree(band);
---			err = -ENOMEM;
---			goto fail_band2g;
---		}
---		band->n_channels = 0;
---		wiphy->bands[IEEE80211_BAND_5GHZ] = band;
---	}
--+	band = wiphy->bands[IEEE80211_BAND_2GHZ];
--+	if (band)
--+		for (i = 0; i < band->n_channels; i++)
--+			band->channels[i].flags = IEEE80211_CHAN_DISABLED;
--+	band = wiphy->bands[IEEE80211_BAND_5GHZ];
--+	if (band)
--+		for (i = 0; i < band->n_channels; i++)
--+			band->channels[i].flags = IEEE80211_CHAN_DISABLED;
-- 
-- 	total = le32_to_cpu(list->count);
-- 	for (i = 0; i < total; i++) {
--@@ -5388,6 +5360,8 @@ static int brcmf_construct_chaninfo(stru
-- 			brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
-- 			continue;
-- 		}
--+		if (!band)
--+			continue;
-- 		if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
-- 		    ch.bw == BRCMU_CHAN_BW_40)
-- 			continue;
--@@ -5415,9 +5389,9 @@ static int brcmf_construct_chaninfo(stru
-- 		} else if (ch.bw == BRCMU_CHAN_BW_40) {
-- 			brcmf_update_bw40_channel_flag(&channel[index], &ch);
-- 		} else {
---			/* disable other bandwidths for now as mentioned
---			 * order assure they are enabled for subsequent
---			 * chanspecs.
--+			/* enable the channel and disable other bandwidths
--+			 * for now as mentioned order assure they are enabled
--+			 * for subsequent chanspecs.
-- 			 */
-- 			channel[index].flags = IEEE80211_CHAN_NO_HT40 |
-- 					       IEEE80211_CHAN_NO_80MHZ;
--@@ -5436,16 +5410,8 @@ static int brcmf_construct_chaninfo(stru
-- 						IEEE80211_CHAN_NO_IR;
-- 			}
-- 		}
---		if (index == band->n_channels)
---			band->n_channels++;
-- 	}
---	kfree(pbuf);
---	return 0;
-- 
---fail_band2g:
---	kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
---	kfree(wiphy->bands[IEEE80211_BAND_2GHZ]);
---	wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
-- fail_pbuf:
-- 	kfree(pbuf);
-- 	return err;
--@@ -5778,7 +5744,12 @@ static void brcmf_wiphy_wowl_params(stru
-- 
-- static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
-- {
--+	struct ieee80211_supported_band *band;
-- 	struct ieee80211_iface_combination ifc_combo;
--+	__le32 bandlist[3];
--+	u32 n_bands;
--+	int err, i;
--+
-- 	wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
-- 	wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
-- 	wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
--@@ -5820,7 +5791,52 @@ static int brcmf_setup_wiphy(struct wiph
-- 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
-- 		brcmf_wiphy_wowl_params(wiphy);
-- 
---	return brcmf_setup_wiphybands(wiphy);
--+	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
--+				     sizeof(bandlist));
--+	if (err) {
--+		brcmf_err("could not obtain band info: err=%d\n", err);
--+		return err;
--+	}
--+	/* first entry in bandlist is number of bands */
--+	n_bands = le32_to_cpu(bandlist[0]);
--+	for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
--+		if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
--+			band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
--+				       GFP_KERNEL);
--+			if (!band)
--+				return -ENOMEM;
--+
--+			band->channels = kmemdup(&__wl_2ghz_channels,
--+						 sizeof(__wl_2ghz_channels),
--+						 GFP_KERNEL);
--+			if (!band->channels) {
--+				kfree(band);
--+				return -ENOMEM;
--+			}
--+
--+			band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
--+			wiphy->bands[IEEE80211_BAND_2GHZ] = band;
--+		}
--+		if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
--+			band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
--+				       GFP_KERNEL);
--+			if (!band)
--+				return -ENOMEM;
--+
--+			band->channels = kmemdup(&__wl_5ghz_channels,
--+						 sizeof(__wl_5ghz_channels),
--+						 GFP_KERNEL);
--+			if (!band->channels) {
--+				kfree(band);
--+				return -ENOMEM;
--+			}
--+
--+			band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
--+			wiphy->bands[IEEE80211_BAND_5GHZ] = band;
--+		}
--+	}
--+	err = brcmf_setup_wiphybands(wiphy);
--+	return err;
-- }
-- 
-- static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
--@@ -6011,6 +6027,9 @@ static void brcmf_cfg80211_reg_notifier(
-- 
-- static void brcmf_free_wiphy(struct wiphy *wiphy)
-- {
--+	if (!wiphy)
--+		return;
--+
-- 	kfree(wiphy->iface_combinations);
-- 	if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
-- 		kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
-diff --git a/package/kernel/mac80211/patches/339-0002-brcmfmac-update-wiphy-band-information-upon-updating.patch b/package/kernel/mac80211/patches/339-0002-brcmfmac-update-wiphy-band-information-upon-updating.patch
-deleted file mode 100644
-index a0c22eb..0000000
---- a/package/kernel/mac80211/patches/339-0002-brcmfmac-update-wiphy-band-information-upon-updating.patch
-+++ /dev/null
-@@ -1,29 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:25 +0200
--Subject: [PATCH] brcmfmac: update wiphy band information upon updating
-- regulatory domain
--
--When change the country code the available channels may change. So
--the wiphy bands should be updated accordingly.
--
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6022,7 +6022,11 @@ static void brcmf_cfg80211_reg_notifier(
-- 	memset(&ccreq, 0, sizeof(ccreq));
-- 	ccreq.rev = cpu_to_le32(-1);
-- 	memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
---	brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
--+	if (brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq))) {
--+		brcmf_err("firmware rejected country setting\n");
--+		return;
--+	}
--+	brcmf_setup_wiphybands(wiphy);
-- }
-- 
-- static void brcmf_free_wiphy(struct wiphy *wiphy)
-diff --git a/package/kernel/mac80211/patches/339-0003-brcmfmac-add-description-for-feature-flags.patch b/package/kernel/mac80211/patches/339-0003-brcmfmac-add-description-for-feature-flags.patch
-deleted file mode 100644
-index 193f507..0000000
---- a/package/kernel/mac80211/patches/339-0003-brcmfmac-add-description-for-feature-flags.patch
-+++ /dev/null
-@@ -1,24 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:26 +0200
--Subject: [PATCH] brcmfmac: add description for feature flags
--
--Some feature flags were not described in the header file. Adding
--the description.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--@@ -19,7 +19,9 @@
-- /*
--  * Features:
--  *
--+ * MBSS: multiple BSSID support (eg. guest network in AP mode).
--  * MCHAN: multi-channel for concurrent P2P.
--+ * WOWL: Wake-On-WLAN.
--  */
-- #define BRCMF_FEAT_LIST \
-- 	BRCMF_FEAT_DEF(MBSS) \
-diff --git a/package/kernel/mac80211/patches/339-0004-brcmfmac-make-scheduled-scan-support-conditional.patch b/package/kernel/mac80211/patches/339-0004-brcmfmac-make-scheduled-scan-support-conditional.patch
-deleted file mode 100644
-index 42330b4..0000000
---- a/package/kernel/mac80211/patches/339-0004-brcmfmac-make-scheduled-scan-support-conditional.patch
-+++ /dev/null
-@@ -1,51 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:27 +0200
--Subject: [PATCH] brcmfmac: make scheduled scan support conditional
--
--The scheduled scan support depends on firmware supporting the PNO
--feature. This feature is optional so add a feature flag for this
--in the driver and announce scheduled scan support accordingly.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -5782,7 +5782,8 @@ static int brcmf_setup_wiphy(struct wiph
-- 		wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
-- 	wiphy->mgmt_stypes = brcmf_txrx_stypes;
-- 	wiphy->max_remain_on_channel_duration = 5000;
---	brcmf_wiphy_pno_params(wiphy);
--+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
--+		brcmf_wiphy_pno_params(wiphy);
-- 
-- 	/* vendor commands/events support */
-- 	wiphy->vendor_commands = brcmf_vendor_cmds;
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--@@ -124,6 +124,7 @@ void brcmf_feat_attach(struct brcmf_pub
-- 	struct brcmf_if *ifp = drvr->iflist[0];
-- 
-- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
--+	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
-- 	if (drvr->bus_if->wowl_supported)
-- 		brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
-- 	if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--@@ -21,11 +21,13 @@
--  *
--  * MBSS: multiple BSSID support (eg. guest network in AP mode).
--  * MCHAN: multi-channel for concurrent P2P.
--+ * PNO: preferred network offload.
--  * WOWL: Wake-On-WLAN.
--  */
-- #define BRCMF_FEAT_LIST \
-- 	BRCMF_FEAT_DEF(MBSS) \
-- 	BRCMF_FEAT_DEF(MCHAN) \
--+	BRCMF_FEAT_DEF(PNO) \
-- 	BRCMF_FEAT_DEF(WOWL)
-- /*
--  * Quirks:
-diff --git a/package/kernel/mac80211/patches/339-0005-brcmfmac-add-support-for-BCM4324-rev-B5-chipset.patch b/package/kernel/mac80211/patches/339-0005-brcmfmac-add-support-for-BCM4324-rev-B5-chipset.patch
-deleted file mode 100644
-index b859d46..0000000
---- a/package/kernel/mac80211/patches/339-0005-brcmfmac-add-support-for-BCM4324-rev-B5-chipset.patch
-+++ /dev/null
-@@ -1,43 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:28 +0200
--Subject: [PATCH] brcmfmac: add support for BCM4324 rev B5 chipset
--
--This patch adds support for the BCM4324 B5 revision. This device
--is similar to BCM43241 from driver and firmware perspective. It
--is known to be used in Lenovo Thinkpad Tablet devices.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -601,6 +601,8 @@ static const struct sdiod_drive_str sdio
-- #define BCM43241B0_NVRAM_NAME		"brcm/brcmfmac43241b0-sdio.txt"
-- #define BCM43241B4_FIRMWARE_NAME	"brcm/brcmfmac43241b4-sdio.bin"
-- #define BCM43241B4_NVRAM_NAME		"brcm/brcmfmac43241b4-sdio.txt"
--+#define BCM43241B5_FIRMWARE_NAME	"brcm/brcmfmac43241b5-sdio.bin"
--+#define BCM43241B5_NVRAM_NAME		"brcm/brcmfmac43241b5-sdio.txt"
-- #define BCM4329_FIRMWARE_NAME		"brcm/brcmfmac4329-sdio.bin"
-- #define BCM4329_NVRAM_NAME		"brcm/brcmfmac4329-sdio.txt"
-- #define BCM4330_FIRMWARE_NAME		"brcm/brcmfmac4330-sdio.bin"
--@@ -628,6 +630,8 @@ MODULE_FIRMWARE(BCM43241B0_FIRMWARE_NAME
-- MODULE_FIRMWARE(BCM43241B0_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM43241B4_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM43241B4_NVRAM_NAME);
--+MODULE_FIRMWARE(BCM43241B5_FIRMWARE_NAME);
--+MODULE_FIRMWARE(BCM43241B5_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4329_FIRMWARE_NAME);
-- MODULE_FIRMWARE(BCM4329_NVRAM_NAME);
-- MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
--@@ -667,7 +671,8 @@ enum brcmf_firmware_type {
-- static const struct brcmf_firmware_names brcmf_fwname_data[] = {
-- 	{ BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43143) },
-- 	{ BRCM_CC_43241_CHIP_ID, 0x0000001F, BRCMF_FIRMWARE_NVRAM(BCM43241B0) },
---	{ BRCM_CC_43241_CHIP_ID, 0xFFFFFFE0, BRCMF_FIRMWARE_NVRAM(BCM43241B4) },
--+	{ BRCM_CC_43241_CHIP_ID, 0x00000020, BRCMF_FIRMWARE_NVRAM(BCM43241B4) },
--+	{ BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, BRCMF_FIRMWARE_NVRAM(BCM43241B5) },
-- 	{ BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
-- 	{ BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
-- 	{ BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
-diff --git a/package/kernel/mac80211/patches/339-0006-brcmfmac-process-interrupt-regardless-sdiod-state.patch b/package/kernel/mac80211/patches/339-0006-brcmfmac-process-interrupt-regardless-sdiod-state.patch
-deleted file mode 100644
-index d420308..0000000
---- a/package/kernel/mac80211/patches/339-0006-brcmfmac-process-interrupt-regardless-sdiod-state.patch
-+++ /dev/null
-@@ -1,27 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:29 +0200
--Subject: [PATCH] brcmfmac: process interrupt regardless sdiod state
--
--When the sdio bus state is not ready to process we abort the
--interrupt service routine. This is not wanted as it keeps the
--interrupt source active. Better clear the interrupt source.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -3555,10 +3555,6 @@ void brcmf_sdio_isr(struct brcmf_sdio *b
-- 		return;
-- 	}
-- 
---	if (bus->sdiodev->state != BRCMF_SDIOD_DATA) {
---		brcmf_err("bus is down. we have nothing to do\n");
---		return;
---	}
-- 	/* Count the interrupt call */
-- 	bus->sdcnt.intrcount++;
-- 	if (in_interrupt())
-diff --git a/package/kernel/mac80211/patches/339-0007-brcmfmac-fix-sdio-suspend-and-resume.patch b/package/kernel/mac80211/patches/339-0007-brcmfmac-fix-sdio-suspend-and-resume.patch
-deleted file mode 100644
-index ac5584e..0000000
---- a/package/kernel/mac80211/patches/339-0007-brcmfmac-fix-sdio-suspend-and-resume.patch
-+++ /dev/null
-@@ -1,68 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:30 +0200
--Subject: [PATCH] brcmfmac: fix sdio suspend and resume
--
--commit 330b4e4be937 ("brcmfmac: Add wowl support for SDIO devices.")
--changed the behaviour by removing the MMC_PM_KEEP_POWER flag for
--non-wowl scenario, which needs to be restored. Another necessary
--change is to mark the card as being non-removable. With this in place
--the suspend resume test passes successfully doing:
--
-- # echo devices > /sys/power/pm_test
-- # echo mem > /sys/power/state
--
--Note that power may still be switched off when system is going
--in S3 state.
--
--Reported-by: Fu, Zhonghui <<zhonghui.fu@linux.intel.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -1011,6 +1011,14 @@ static int brcmf_sdiod_remove(struct brc
-- 	return 0;
-- }
-- 
--+static void brcmf_sdiod_host_fixup(struct mmc_host *host)
--+{
--+	/* runtime-pm powers off the device */
--+	pm_runtime_forbid(host->parent);
--+	/* avoid removal detection upon resume */
--+	host->caps |= MMC_CAP_NONREMOVABLE;
--+}
--+
-- static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
-- {
-- 	struct sdio_func *func;
--@@ -1076,7 +1084,7 @@ static int brcmf_sdiod_probe(struct brcm
-- 		ret = -ENODEV;
-- 		goto out;
-- 	}
---	pm_runtime_forbid(host->parent);
--+	brcmf_sdiod_host_fixup(host);
-- out:
-- 	if (ret)
-- 		brcmf_sdiod_remove(sdiodev);
--@@ -1246,15 +1254,15 @@ static int brcmf_ops_sdio_suspend(struct
-- 	brcmf_sdiod_freezer_on(sdiodev);
-- 	brcmf_sdio_wd_timer(sdiodev->bus, 0);
-- 
--+	sdio_flags = MMC_PM_KEEP_POWER;
-- 	if (sdiodev->wowl_enabled) {
---		sdio_flags = MMC_PM_KEEP_POWER;
-- 		if (sdiodev->pdata->oob_irq_supported)
-- 			enable_irq_wake(sdiodev->pdata->oob_irq_nr);
-- 		else
---			sdio_flags = MMC_PM_WAKE_SDIO_IRQ;
---		if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
---			brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
--+			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
-- 	}
--+	if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
--+		brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
-- 	return 0;
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/339-0008-brcmfmac-add-support-for-BCM4358-PCIe-device.patch b/package/kernel/mac80211/patches/339-0008-brcmfmac-add-support-for-BCM4358-PCIe-device.patch
-deleted file mode 100644
-index a521b65..0000000
---- a/package/kernel/mac80211/patches/339-0008-brcmfmac-add-support-for-BCM4358-PCIe-device.patch
-+++ /dev/null
-@@ -1,77 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:31 +0200
--Subject: [PATCH] brcmfmac: add support for BCM4358 PCIe device
--
--This patch adds support for the BCM4358 2x2 11ac device.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -649,6 +649,7 @@ static u32 brcmf_chip_tcm_rambase(struct
-- 	case BRCM_CC_43567_CHIP_ID:
-- 	case BRCM_CC_43569_CHIP_ID:
-- 	case BRCM_CC_43570_CHIP_ID:
--+	case BRCM_CC_4358_CHIP_ID:
-- 	case BRCM_CC_43602_CHIP_ID:
-- 		return 0x180000;
-- 	default:
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -51,6 +51,8 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_4356_NVRAM_NAME		"brcm/brcmfmac4356-pcie.txt"
-- #define BRCMF_PCIE_43570_FW_NAME		"brcm/brcmfmac43570-pcie.bin"
-- #define BRCMF_PCIE_43570_NVRAM_NAME		"brcm/brcmfmac43570-pcie.txt"
--+#define BRCMF_PCIE_4358_FW_NAME			"brcm/brcmfmac4358-pcie.bin"
--+#define BRCMF_PCIE_4358_NVRAM_NAME		"brcm/brcmfmac4358-pcie.txt"
-- 
-- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
-- 
--@@ -189,6 +191,8 @@ MODULE_FIRMWARE(BRCMF_PCIE_4356_FW_NAME)
-- MODULE_FIRMWARE(BRCMF_PCIE_4356_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4358_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4358_NVRAM_NAME);
-- 
-- 
-- struct brcmf_pcie_console {
--@@ -1333,6 +1337,10 @@ static int brcmf_pcie_get_fwnames(struct
-- 		fw_name = BRCMF_PCIE_43570_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_43570_NVRAM_NAME;
-- 		break;
--+	case BRCM_CC_4358_CHIP_ID:
--+		fw_name = BRCMF_PCIE_4358_FW_NAME;
--+		nvram_name = BRCMF_PCIE_4358_NVRAM_NAME;
--+		break;
-- 	default:
-- 		brcmf_err("Unsupported chip 0x%04x\n", devinfo->ci->chip);
-- 		return -ENODEV;
--@@ -1850,6 +1858,7 @@ static struct pci_device_id brcmf_pcie_d
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4358_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID),
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -45,6 +45,7 @@
-- #define BRCM_CC_43567_CHIP_ID		43567
-- #define BRCM_CC_43569_CHIP_ID		43569
-- #define BRCM_CC_43570_CHIP_ID		43570
--+#define BRCM_CC_4358_CHIP_ID		0x4358
-- #define BRCM_CC_43602_CHIP_ID		43602
-- 
-- /* USB Device IDs */
--@@ -59,6 +60,7 @@
-- #define BRCM_PCIE_4356_DEVICE_ID	0x43ec
-- #define BRCM_PCIE_43567_DEVICE_ID	0x43d3
-- #define BRCM_PCIE_43570_DEVICE_ID	0x43d9
--+#define BRCM_PCIE_4358_DEVICE_ID	0x43e9
-- #define BRCM_PCIE_43602_DEVICE_ID	0x43ba
-- #define BRCM_PCIE_43602_2G_DEVICE_ID	0x43bb
-- #define BRCM_PCIE_43602_5G_DEVICE_ID	0x43bc
-diff --git a/package/kernel/mac80211/patches/339-0009-brcmfmac-add-additional-43602-pcie-device-id.patch b/package/kernel/mac80211/patches/339-0009-brcmfmac-add-additional-43602-pcie-device-id.patch
-deleted file mode 100644
-index bcbb984..0000000
---- a/package/kernel/mac80211/patches/339-0009-brcmfmac-add-additional-43602-pcie-device-id.patch
-+++ /dev/null
-@@ -1,30 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:32 +0200
--Subject: [PATCH] brcmfmac: add additional 43602 pcie device id.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -1862,6 +1862,7 @@ static struct pci_device_id brcmf_pcie_d
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID),
-- 	{ /* end: all zeroes */ }
-- };
-- 
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -64,6 +64,7 @@
-- #define BRCM_PCIE_43602_DEVICE_ID	0x43ba
-- #define BRCM_PCIE_43602_2G_DEVICE_ID	0x43bb
-- #define BRCM_PCIE_43602_5G_DEVICE_ID	0x43bc
--+#define BRCM_PCIE_43602_RAW_DEVICE_ID	43602
-- 
-- /* brcmsmac IDs */
-- #define BCM4313_D11N2G_ID	0x4727	/* 4313 802.11n 2.4G device */
-diff --git a/package/kernel/mac80211/patches/339-0010-brcmfmac-Add-support-for-multiple-PCIE-devices-in-nv.patch b/package/kernel/mac80211/patches/339-0010-brcmfmac-Add-support-for-multiple-PCIE-devices-in-nv.patch
-deleted file mode 100644
-index 5f9bbea..0000000
---- a/package/kernel/mac80211/patches/339-0010-brcmfmac-Add-support-for-multiple-PCIE-devices-in-nv.patch
-+++ /dev/null
-@@ -1,351 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Tue, 14 Apr 2015 20:10:33 +0200
--Subject: [PATCH] brcmfmac: Add support for multiple PCIE devices in
-- nvram.
--
--With PCIE it is possible to support multiple devices with the
--same device type. They all load the same nvram file. In order to
--support this the nvram can specify which part of the nvram is
--for which pcie device. This patch adds support for these new
--types of nvram files.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -23,6 +23,10 @@
-- #include "debug.h"
-- #include "firmware.h"
-- 
--+#define BRCMF_FW_MAX_NVRAM_SIZE			64000
--+#define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
--+#define BRCMF_FW_NVRAM_PCIEDEV_LEN		9	/* pcie/1/4/ */
--+
-- char brcmf_firmware_path[BRCMF_FW_PATH_LEN];
-- module_param_string(firmware_path, brcmf_firmware_path,
-- 		    BRCMF_FW_PATH_LEN, 0440);
--@@ -46,6 +50,8 @@ enum nvram_parser_state {
--  * @column: current column in line.
--  * @pos: byte offset in input buffer.
--  * @entry: start position of key,value entry.
--+ * @multi_dev_v1: detect pcie multi device v1 (compressed).
--+ * @multi_dev_v2: detect pcie multi device v2.
--  */
-- struct nvram_parser {
-- 	enum nvram_parser_state state;
--@@ -56,6 +62,8 @@ struct nvram_parser {
-- 	u32 column;
-- 	u32 pos;
-- 	u32 entry;
--+	bool multi_dev_v1;
--+	bool multi_dev_v2;
-- };
-- 
-- static bool is_nvram_char(char c)
--@@ -108,6 +116,10 @@ static enum nvram_parser_state brcmf_nvr
-- 			st = COMMENT;
-- 		else
-- 			st = VALUE;
--+		if (strncmp(&nvp->fwnv->data[nvp->entry], "devpath", 7) == 0)
--+			nvp->multi_dev_v1 = true;
--+		if (strncmp(&nvp->fwnv->data[nvp->entry], "pcie/", 5) == 0)
--+			nvp->multi_dev_v2 = true;
-- 	} else if (!is_nvram_char(c)) {
-- 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
-- 			  nvp->line, nvp->column);
--@@ -133,6 +145,8 @@ brcmf_nvram_handle_value(struct nvram_pa
-- 		ekv = (u8 *)&nvp->fwnv->data[nvp->pos];
-- 		skv = (u8 *)&nvp->fwnv->data[nvp->entry];
-- 		cplen = ekv - skv;
--+		if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
--+			return END;
-- 		/* copy to output buffer */
-- 		memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
-- 		nvp->nvram_len += cplen;
--@@ -180,10 +194,18 @@ static enum nvram_parser_state
-- static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
-- 				   const struct firmware *nv)
-- {
--+	size_t size;
--+
-- 	memset(nvp, 0, sizeof(*nvp));
-- 	nvp->fwnv = nv;
--+	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
--+	if (nv->size > BRCMF_FW_MAX_NVRAM_SIZE)
--+		size = BRCMF_FW_MAX_NVRAM_SIZE;
--+	else
--+		size = nv->size;
-- 	/* Alloc for extra 0 byte + roundup by 4 + length field */
---	nvp->nvram = kzalloc(nv->size + 1 + 3 + sizeof(u32), GFP_KERNEL);
--+	size += 1 + 3 + sizeof(u32);
--+	nvp->nvram = kzalloc(size, GFP_KERNEL);
-- 	if (!nvp->nvram)
-- 		return -ENOMEM;
-- 
--@@ -192,12 +214,136 @@ static int brcmf_init_nvram_parser(struc
-- 	return 0;
-- }
-- 
--+/* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
--+ * devices. Strip it down for one device, use domain_nr/bus_nr to determine
--+ * which data is to be returned. v1 is the version where nvram is stored
--+ * compressed and "devpath" maps to index for valid entries.
--+ */
--+static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
--+				    u16 bus_nr)
--+{
--+	u32 i, j;
--+	bool found;
--+	u8 *nvram;
--+	u8 id;
--+
--+	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
--+	if (!nvram)
--+		goto fail;
--+
--+	/* min length: devpath0=pcie/1/4/ + 0:x=y */
--+	if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
--+		goto fail;
--+
--+	/* First search for the devpathX and see if it is the configuration
--+	 * for domain_nr/bus_nr. Search complete nvp
--+	 */
--+	found = false;
--+	i = 0;
--+	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
--+		/* Format: devpathX=pcie/Y/Z/
--+		 * Y = domain_nr, Z = bus_nr, X = virtual ID
--+		 */
--+		if ((strncmp(&nvp->nvram[i], "devpath", 7) == 0) &&
--+		    (strncmp(&nvp->nvram[i + 8], "=pcie/", 6) == 0)) {
--+			if (((nvp->nvram[i + 14] - '0') == domain_nr) &&
--+			    ((nvp->nvram[i + 16] - '0') == bus_nr)) {
--+				id = nvp->nvram[i + 7] - '0';
--+				found = true;
--+				break;
--+			}
--+		}
--+		while (nvp->nvram[i] != 0)
--+			i++;
--+		i++;
--+	}
--+	if (!found)
--+		goto fail;
--+
--+	/* Now copy all valid entries, release old nvram and assign new one */
--+	i = 0;
--+	j = 0;
--+	while (i < nvp->nvram_len) {
--+		if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
--+			i += 2;
--+			while (nvp->nvram[i] != 0) {
--+				nvram[j] = nvp->nvram[i];
--+				i++;
--+				j++;
--+			}
--+			nvram[j] = 0;
--+			j++;
--+		}
--+		while (nvp->nvram[i] != 0)
--+			i++;
--+		i++;
--+	}
--+	kfree(nvp->nvram);
--+	nvp->nvram = nvram;
--+	nvp->nvram_len = j;
--+	return;
--+
--+fail:
--+	kfree(nvram);
--+	nvp->nvram_len = 0;
--+}
--+
--+/* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
--+ * devices. Strip it down for one device, use domain_nr/bus_nr to determine
--+ * which data is to be returned. v2 is the version where nvram is stored
--+ * uncompressed, all relevant valid entries are identified by
--+ * pcie/domain_nr/bus_nr:
--+ */
--+static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
--+				    u16 bus_nr)
--+{
--+	u32 i, j;
--+	u8 *nvram;
--+
--+	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
--+	if (!nvram)
--+		goto fail;
--+
--+	/* Copy all valid entries, release old nvram and assign new one.
--+	 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
--+	 * Y = bus_nr.
--+	 */
--+	i = 0;
--+	j = 0;
--+	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_PCIEDEV_LEN) {
--+		if ((strncmp(&nvp->nvram[i], "pcie/", 5) == 0) &&
--+		    (nvp->nvram[i + 6] == '/') && (nvp->nvram[i + 8] == '/') &&
--+		    ((nvp->nvram[i + 5] - '0') == domain_nr) &&
--+		    ((nvp->nvram[i + 7] - '0') == bus_nr)) {
--+			i += BRCMF_FW_NVRAM_PCIEDEV_LEN;
--+			while (nvp->nvram[i] != 0) {
--+				nvram[j] = nvp->nvram[i];
--+				i++;
--+				j++;
--+			}
--+			nvram[j] = 0;
--+			j++;
--+		}
--+		while (nvp->nvram[i] != 0)
--+			i++;
--+		i++;
--+	}
--+	kfree(nvp->nvram);
--+	nvp->nvram = nvram;
--+	nvp->nvram_len = j;
--+	return;
--+fail:
--+	kfree(nvram);
--+	nvp->nvram_len = 0;
--+}
--+
-- /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
--  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
--  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
--  * End of buffer is completed with token identifying length of buffer.
--  */
---static void *brcmf_fw_nvram_strip(const struct firmware *nv, u32 *new_length)
--+static void *brcmf_fw_nvram_strip(const struct firmware *nv, u32 *new_length,
--+				  u16 domain_nr, u16 bus_nr)
-- {
-- 	struct nvram_parser nvp;
-- 	u32 pad;
--@@ -212,6 +358,16 @@ static void *brcmf_fw_nvram_strip(const
-- 		if (nvp.state == END)
-- 			break;
-- 	}
--+	if (nvp.multi_dev_v1)
--+		brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
--+	else if (nvp.multi_dev_v2)
--+		brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
--+
--+	if (nvp.nvram_len == 0) {
--+		kfree(nvp.nvram);
--+		return NULL;
--+	}
--+
-- 	pad = nvp.nvram_len;
-- 	*new_length = roundup(nvp.nvram_len + 1, 4);
-- 	while (pad != *new_length) {
--@@ -239,6 +395,8 @@ struct brcmf_fw {
-- 	u16 flags;
-- 	const struct firmware *code;
-- 	const char *nvram_name;
--+	u16 domain_nr;
--+	u16 bus_nr;
-- 	void (*done)(struct device *dev, const struct firmware *fw,
-- 		     void *nvram_image, u32 nvram_len);
-- };
--@@ -254,7 +412,8 @@ static void brcmf_fw_request_nvram_done(
-- 		goto fail;
-- 
-- 	if (fw) {
---		nvram = brcmf_fw_nvram_strip(fw, &nvram_length);
--+		nvram = brcmf_fw_nvram_strip(fw, &nvram_length,
--+					     fwctx->domain_nr, fwctx->bus_nr);
-- 		release_firmware(fw);
-- 		if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-- 			goto fail;
--@@ -309,11 +468,12 @@ fail:
-- 	kfree(fwctx);
-- }
-- 
---int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
---			   const char *code, const char *nvram,
---			   void (*fw_cb)(struct device *dev,
---					 const struct firmware *fw,
---					 void *nvram_image, u32 nvram_len))
--+int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
--+				const char *code, const char *nvram,
--+				void (*fw_cb)(struct device *dev,
--+					      const struct firmware *fw,
--+					      void *nvram_image, u32 nvram_len),
--+				u16 domain_nr, u16 bus_nr)
-- {
-- 	struct brcmf_fw *fwctx;
-- 
--@@ -333,8 +493,21 @@ int brcmf_fw_get_firmwares(struct device
-- 	fwctx->done = fw_cb;
-- 	if (flags & BRCMF_FW_REQUEST_NVRAM)
-- 		fwctx->nvram_name = nvram;
--+	fwctx->domain_nr = domain_nr;
--+	fwctx->bus_nr = bus_nr;
-- 
-- 	return request_firmware_nowait(THIS_MODULE, true, code, dev,
-- 				       GFP_KERNEL, fwctx,
-- 				       brcmf_fw_request_code_done);
-- }
--+
--+int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
--+			   const char *code, const char *nvram,
--+			   void (*fw_cb)(struct device *dev,
--+					 const struct firmware *fw,
--+					 void *nvram_image, u32 nvram_len))
--+{
--+	return brcmf_fw_get_firmwares_pcie(dev, flags, code, nvram, fw_cb, 0,
--+					   0);
--+}
--+
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.h
--@@ -32,6 +32,12 @@ void brcmf_fw_nvram_free(void *nvram);
--  * fails it will not use the callback, but call device_release_driver()
--  * instead which will call the driver .remove() callback.
--  */
--+int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
--+				const char *code, const char *nvram,
--+				void (*fw_cb)(struct device *dev,
--+					      const struct firmware *fw,
--+					      void *nvram_image, u32 nvram_len),
--+				u16 domain_nr, u16 bus_nr);
-- int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
-- 			   const char *code, const char *nvram,
-- 			   void (*fw_cb)(struct device *dev,
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -1649,8 +1649,13 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
-- 	struct brcmf_pciedev_info *devinfo;
-- 	struct brcmf_pciedev *pcie_bus_dev;
-- 	struct brcmf_bus *bus;
--+	u16 domain_nr;
--+	u16 bus_nr;
-- 
---	brcmf_dbg(PCIE, "Enter %x:%x\n", pdev->vendor, pdev->device);
--+	domain_nr = pci_domain_nr(pdev->bus) + 1;
--+	bus_nr = pdev->bus->number;
--+	brcmf_dbg(PCIE, "Enter %x:%x (%d/%d)\n", pdev->vendor, pdev->device,
--+		  domain_nr, bus_nr);
-- 
-- 	ret = -ENOMEM;
-- 	devinfo = kzalloc(sizeof(*devinfo), GFP_KERNEL);
--@@ -1699,10 +1704,10 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
-- 	if (ret)
-- 		goto fail_bus;
-- 
---	ret = brcmf_fw_get_firmwares(bus->dev, BRCMF_FW_REQUEST_NVRAM |
---					       BRCMF_FW_REQ_NV_OPTIONAL,
---				     devinfo->fw_name, devinfo->nvram_name,
---				     brcmf_pcie_setup);
--+	ret = brcmf_fw_get_firmwares_pcie(bus->dev, BRCMF_FW_REQUEST_NVRAM |
--+						    BRCMF_FW_REQ_NV_OPTIONAL,
--+					  devinfo->fw_name, devinfo->nvram_name,
--+					  brcmf_pcie_setup, domain_nr, bus_nr);
-- 	if (ret == 0)
-- 		return 0;
-- fail_bus:
-diff --git a/package/kernel/mac80211/patches/340-brcmfmac-cleanup-a-sizeof.patch b/package/kernel/mac80211/patches/340-brcmfmac-cleanup-a-sizeof.patch
-deleted file mode 100644
-index d26e118..0000000
---- a/package/kernel/mac80211/patches/340-brcmfmac-cleanup-a-sizeof.patch
-+++ /dev/null
-@@ -1,23 +0,0 @@
--From: Dan Carpenter <dan.carpenter@oracle.com>
--Date: Thu, 7 May 2015 12:59:19 +0300
--Subject: [PATCH] brcmfmac: cleanup a sizeof()
--
--"flowrings" and "*flowrings" are both pointers so this always returns
--sizeof(void *) and the current code works fine.  But "*flowrings" is
--intended here and static checkers complain, so lets change it.
--
--Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -1617,7 +1617,7 @@ static void brcmf_pcie_setup(struct devi
-- 		bus->msgbuf->commonrings[i] =
-- 				&devinfo->shared.commonrings[i]->commonring;
-- 
---	flowrings = kcalloc(devinfo->shared.nrof_flowrings, sizeof(flowrings),
--+	flowrings = kcalloc(devinfo->shared.nrof_flowrings, sizeof(*flowrings),
-- 			    GFP_KERNEL);
-- 	if (!flowrings)
-- 		goto fail;
-diff --git a/package/kernel/mac80211/patches/341-brcmfmac-check-result-of-USB-firmware-request.patch b/package/kernel/mac80211/patches/341-brcmfmac-check-result-of-USB-firmware-request.patch
-deleted file mode 100644
-index 9b2880d..0000000
---- a/package/kernel/mac80211/patches/341-brcmfmac-check-result-of-USB-firmware-request.patch
-+++ /dev/null
-@@ -1,33 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Thu, 7 May 2015 14:13:03 +0200
--Subject: [PATCH] brcmfmac: check result of USB firmware request
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--This prevents silence failures with driver waiting (infinitely) for a
--callback.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--@@ -1270,8 +1270,13 @@ static int brcmf_usb_probe_cb(struct brc
-- 	bus->chiprev = bus_pub->chiprev;
-- 
-- 	/* request firmware here */
---	brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo), NULL,
---			       brcmf_usb_probe_phase2);
--+	ret = brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo),
--+				     NULL, brcmf_usb_probe_phase2);
--+	if (ret) {
--+		brcmf_err("firmware request failed: %d\n", ret);
--+		goto fail;
--+	}
--+
-- 	return 0;
-- 
-- fail:
-diff --git a/package/kernel/mac80211/patches/342-brcmfmac-prohibit-ACPI-power-management-for-brcmfmac.patch b/package/kernel/mac80211/patches/342-brcmfmac-prohibit-ACPI-power-management-for-brcmfmac.patch
-deleted file mode 100644
-index d46b300..0000000
---- a/package/kernel/mac80211/patches/342-brcmfmac-prohibit-ACPI-power-management-for-brcmfmac.patch
-+++ /dev/null
-@@ -1,47 +0,0 @@
--From: "Fu, Zhonghui" <zhonghui.fu@linux.intel.com>
--Date: Mon, 11 May 2015 10:41:32 +0800
--Subject: [PATCH] brcmfmac: prohibit ACPI power management for brcmfmac driver
--
--ACPI will manage WiFi chip's power state during suspend/resume
--process on some tablet platforms(such as ASUS T100TA). This is
--not supported by brcmfmac driver now, and the context of WiFi
--chip will be damaged after resume. This patch informs ACPI not
--to manage WiFi chip's power state.
--
--Signed-off-by: Zhonghui Fu <zhonghui.fu@linux.intel.com>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -33,6 +33,7 @@
-- #include <linux/suspend.h>
-- #include <linux/errno.h>
-- #include <linux/module.h>
--+#include <linux/acpi.h>
-- #include <net/cfg80211.h>
-- 
-- #include <defs.h>
--@@ -1122,6 +1123,8 @@ static int brcmf_ops_sdio_probe(struct s
-- 	int err;
-- 	struct brcmf_sdio_dev *sdiodev;
-- 	struct brcmf_bus *bus_if;
--+	struct device *dev;
--+	struct acpi_device *adev;
-- 
-- 	brcmf_dbg(SDIO, "Enter\n");
-- 	brcmf_dbg(SDIO, "Class=%x\n", func->class);
--@@ -1129,6 +1132,12 @@ static int brcmf_ops_sdio_probe(struct s
-- 	brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
-- 	brcmf_dbg(SDIO, "Function#: %d\n", func->num);
-- 
--+	/* prohibit ACPI power management for this device */
--+	dev = &func->dev;
--+	adev = ACPI_COMPANION(dev);
--+	if (adev)
--+		adev->flags.power_manageable = 0;
--+
-- 	/* Consume func num 1 but dont do anything with it. */
-- 	if (func->num == 1)
-- 		return 0;
-diff --git a/package/kernel/mac80211/patches/343-brcmfmac-avoid-gcc-5.1-warning.patch b/package/kernel/mac80211/patches/343-brcmfmac-avoid-gcc-5.1-warning.patch
-deleted file mode 100644
-index 9b4609f..0000000
---- a/package/kernel/mac80211/patches/343-brcmfmac-avoid-gcc-5.1-warning.patch
-+++ /dev/null
-@@ -1,30 +0,0 @@
--From: Arnd Bergmann <arnd@arndb.de>
--Date: Tue, 12 May 2015 23:54:25 +0200
--Subject: [PATCH] brcmfmac: avoid gcc-5.1 warning
--
--gcc-5.0 gained a new warning in the fwsignal portion of the brcmfmac
--driver:
--
--drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c: In function 'brcmf_fws_txs_process':
--drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c:1478:8: warning: 'skb' may be used uninitialized in this function [-Wmaybe-uninitialized]
--
--This is a false positive, and marking the brcmf_fws_hanger_poppkt function
--as 'static inline' makes the warning go away. I have checked the object
--file output and while a little code gets moved around, the size of
--the binary remains identical.
--
--Signed-off-by: Arnd Bergmann <arnd@arndb.de>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -635,7 +635,7 @@ static int brcmf_fws_hanger_pushpkt(stru
-- 	return 0;
-- }
-- 
---static int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
--+static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
-- 					  u32 slot_id, struct sk_buff **pktout,
-- 					  bool remove_item)
-- {
-diff --git a/package/kernel/mac80211/patches/344-0001-brcmfmac-allow-device-tree-node-without-interrupts-p.patch b/package/kernel/mac80211/patches/344-0001-brcmfmac-allow-device-tree-node-without-interrupts-p.patch
-deleted file mode 100644
-index b16782d..0000000
---- a/package/kernel/mac80211/patches/344-0001-brcmfmac-allow-device-tree-node-without-interrupts-p.patch
-+++ /dev/null
-@@ -1,45 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 20 May 2015 14:09:47 +0200
--Subject: [PATCH] brcmfmac: allow device tree node without 'interrupts'
-- property
--
--As described in the device tree bindings for 'brcm,bcm4329-fmac'
--nodes, the interrupts property is optional. So adding a check
--for the presence of this property before attempting to parse
--and map the interrupt. If not present or parsing fails return
--and fallback to in-band sdio interrupt.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
--@@ -39,10 +39,16 @@ void brcmf_of_probe(struct brcmf_sdio_de
-- 	if (!sdiodev->pdata)
-- 		return;
-- 
--+	if (of_property_read_u32(np, "brcm,drive-strength", &val) == 0)
--+		sdiodev->pdata->drive_strength = val;
--+
--+	/* make sure there are interrupts defined in the node */
--+	if (!of_find_property(np, "interrupts", NULL))
--+		return;
--+
-- 	irq = irq_of_parse_and_map(np, 0);
-- 	if (!irq) {
-- 		brcmf_err("interrupt could not be mapped\n");
---		devm_kfree(dev, sdiodev->pdata);
-- 		return;
-- 	}
-- 	irqf = irqd_get_trigger_type(irq_get_irq_data(irq));
--@@ -50,7 +56,4 @@ void brcmf_of_probe(struct brcmf_sdio_de
-- 	sdiodev->pdata->oob_irq_supported = true;
-- 	sdiodev->pdata->oob_irq_nr = irq;
-- 	sdiodev->pdata->oob_irq_flags = irqf;
---
---	if (of_property_read_u32(np, "brcm,drive-strength", &val) == 0)
---		sdiodev->pdata->drive_strength = val;
-- }
-diff --git a/package/kernel/mac80211/patches/344-0002-brcmfmac-Improve-throughput-by-scheduling-msbug-flow.patch b/package/kernel/mac80211/patches/344-0002-brcmfmac-Improve-throughput-by-scheduling-msbug-flow.patch
-deleted file mode 100644
-index f81250e..0000000
---- a/package/kernel/mac80211/patches/344-0002-brcmfmac-Improve-throughput-by-scheduling-msbug-flow.patch
-+++ /dev/null
-@@ -1,87 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 20 May 2015 14:09:48 +0200
--Subject: [PATCH] brcmfmac: Improve throughput by scheduling msbug flow worker.
--
--The tx flow worker in msgbuf gets scheduled at tx till a certain
--threshold has been reached. Then the tx completes will take over
--the scheduling. When amsdu and ampdu is used the frames are
--transferred wireless in a very bulky fashion, in combination
--with this scheduling algorithm and buffer limiters in the stack
--this can result in limited throughput. This change causes the
--flow worker to be scheduled more frequently from tx.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
--@@ -249,8 +249,8 @@ void brcmf_flowring_delete(struct brcmf_
-- }
-- 
-- 
---void brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
---			    struct sk_buff *skb)
--+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
--+			   struct sk_buff *skb)
-- {
-- 	struct brcmf_flowring_ring *ring;
-- 
--@@ -271,6 +271,7 @@ void brcmf_flowring_enqueue(struct brcmf
-- 		if (skb_queue_len(&ring->skblist) < BRCMF_FLOWRING_LOW)
-- 			brcmf_flowring_block(flow, flowid, false);
-- 	}
--+	return skb_queue_len(&ring->skblist);
-- }
-- 
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
--@@ -64,8 +64,8 @@ u32 brcmf_flowring_create(struct brcmf_f
-- void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid);
-- void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid);
-- u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid);
---void brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
---			    struct sk_buff *skb);
--+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
--+			   struct sk_buff *skb);
-- struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid);
-- void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
-- 			     struct sk_buff *skb);
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -73,7 +73,7 @@
-- #define BRCMF_MSGBUF_TX_FLUSH_CNT1		32
-- #define BRCMF_MSGBUF_TX_FLUSH_CNT2		96
-- 
---#define BRCMF_MSGBUF_DELAY_TXWORKER_THRS	64
--+#define BRCMF_MSGBUF_DELAY_TXWORKER_THRS	96
-- #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS	32
-- 
-- struct msgbuf_common_hdr {
--@@ -797,6 +797,8 @@ static int brcmf_msgbuf_txdata(struct br
-- 	struct brcmf_flowring *flow = msgbuf->flow;
-- 	struct ethhdr *eh = (struct ethhdr *)(skb->data);
-- 	u32 flowid;
--+	u32 queue_count;
--+	bool force;
-- 
-- 	flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
-- 	if (flowid == BRCMF_FLOWRING_INVALID_ID) {
--@@ -804,8 +806,9 @@ static int brcmf_msgbuf_txdata(struct br
-- 		if (flowid == BRCMF_FLOWRING_INVALID_ID)
-- 			return -ENOMEM;
-- 	}
---	brcmf_flowring_enqueue(flow, flowid, skb);
---	brcmf_msgbuf_schedule_txdata(msgbuf, flowid, false);
--+	queue_count = brcmf_flowring_enqueue(flow, flowid, skb);
--+	force = ((queue_count % BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) == 0);
--+	brcmf_msgbuf_schedule_txdata(msgbuf, flowid, force);
-- 
-- 	return 0;
-- }
-diff --git a/package/kernel/mac80211/patches/344-0003-brcmfmac-remove-pci-shared-structure-rev4-support.patch b/package/kernel/mac80211/patches/344-0003-brcmfmac-remove-pci-shared-structure-rev4-support.patch
-deleted file mode 100644
-index 61153c4..0000000
---- a/package/kernel/mac80211/patches/344-0003-brcmfmac-remove-pci-shared-structure-rev4-support.patch
-+++ /dev/null
-@@ -1,41 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Wed, 20 May 2015 14:09:49 +0200
--Subject: [PATCH] brcmfmac: remove pci shared structure rev4 support
--
--All pcie full dongle chips supported by fmac are using rev 5+ shared
--structure. This patch removes the rev4 related code.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -112,10 +112,9 @@ enum brcmf_pcie_state {
-- 						 BRCMF_PCIE_MB_INT_D2H3_DB0 | \
-- 						 BRCMF_PCIE_MB_INT_D2H3_DB1)
-- 
---#define BRCMF_PCIE_MIN_SHARED_VERSION		4
--+#define BRCMF_PCIE_MIN_SHARED_VERSION		5
-- #define BRCMF_PCIE_MAX_SHARED_VERSION		5
-- #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
---#define BRCMF_PCIE_SHARED_TXPUSH_SUPPORT	0x4000
-- 
-- #define BRCMF_PCIE_FLAGS_HTOD_SPLIT		0x4000
-- #define BRCMF_PCIE_FLAGS_DTOH_SPLIT		0x8000
--@@ -1280,11 +1279,6 @@ brcmf_pcie_init_share_ram_info(struct br
-- 		brcmf_err("Unsupported PCIE version %d\n", version);
-- 		return -EINVAL;
-- 	}
---	if (shared->flags & BRCMF_PCIE_SHARED_TXPUSH_SUPPORT) {
---		brcmf_err("Unsupported legacy TX mode 0x%x\n",
---			  shared->flags & BRCMF_PCIE_SHARED_TXPUSH_SUPPORT);
---		return -EINVAL;
---	}
-- 
-- 	addr = sharedram_addr + BRCMF_SHARED_MAX_RXBUFPOST_OFFSET;
-- 	shared->max_rxbufpost = brcmf_pcie_read_tcm16(devinfo, addr);
-diff --git a/package/kernel/mac80211/patches/344-0004-brcmfmac-remove-dummy-cache-flush-invalidate-functio.patch b/package/kernel/mac80211/patches/344-0004-brcmfmac-remove-dummy-cache-flush-invalidate-functio.patch
-deleted file mode 100644
-index 8c8eebe..0000000
---- a/package/kernel/mac80211/patches/344-0004-brcmfmac-remove-dummy-cache-flush-invalidate-functio.patch
-+++ /dev/null
-@@ -1,120 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Wed, 20 May 2015 14:09:50 +0200
--Subject: [PATCH] brcmfmac: remove dummy cache flush/invalidate function
--
--brcmf_dma_flush and brcmf_dma_invalidate_cache are not necessary and
--have never been implemented.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
--@@ -22,17 +22,6 @@
-- #include "core.h"
-- #include "commonring.h"
-- 
---
---/* dma flushing needs implementation for mips and arm platforms. Should
--- * be put in util. Note, this is not real flushing. It is virtual non
--- * cached memory. Only write buffers should have to be drained. Though
--- * this may be different depending on platform......
--- * SEE ALSO msgbuf.c
--- */
---#define brcmf_dma_flush(addr, len)
---#define brcmf_dma_invalidate_cache(addr, len)
---
---
-- void brcmf_commonring_register_cb(struct brcmf_commonring *commonring,
-- 				  int (*cr_ring_bell)(void *ctx),
-- 				  int (*cr_update_rptr)(void *ctx),
--@@ -206,14 +195,9 @@ int brcmf_commonring_write_complete(stru
-- 	address = commonring->buf_addr;
-- 	address += (commonring->f_ptr * commonring->item_len);
-- 	if (commonring->f_ptr > commonring->w_ptr) {
---		brcmf_dma_flush(address,
---				(commonring->depth - commonring->f_ptr) *
---				commonring->item_len);
-- 		address = commonring->buf_addr;
-- 		commonring->f_ptr = 0;
-- 	}
---	brcmf_dma_flush(address, (commonring->w_ptr - commonring->f_ptr) *
---			commonring->item_len);
-- 
-- 	commonring->f_ptr = commonring->w_ptr;
-- 
--@@ -258,8 +242,6 @@ void *brcmf_commonring_get_read_ptr(stru
-- 	if (commonring->r_ptr == commonring->depth)
-- 		commonring->r_ptr = 0;
-- 
---	brcmf_dma_invalidate_cache(ret_addr, *n_ items * commonring->item_len);
---
-- 	return ret_addr;
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -278,16 +278,6 @@ struct brcmf_msgbuf_pktids {
-- 	struct brcmf_msgbuf_pktid *array;
-- };
-- 
---
---/* dma flushing needs implementation for mips and arm platforms. Should
--- * be put in util. Note, this is not real flushing. It is virtual non
--- * cached memory. Only write buffers should have to be drained. Though
--- * this may be different depending on platform......
--- */
---#define brcmf_dma_flush(addr, len)
---#define brcmf_dma_invalidate_cache(addr, len)
---
---
-- static void brcmf_msgbuf_rxbuf_ioctlresp_post(struct brcmf_msgbuf *msgbuf);
-- 
-- 
--@@ -462,7 +452,6 @@ static int brcmf_msgbuf_tx_ioctl(struct
-- 		memcpy(msgbuf->ioctbuf, buf, buf_len);
-- 	else
-- 		memset(msgbuf->ioctbuf, 0, buf_len);
---	brcmf_dma_flush(ioctl_buf, buf_len);
-- 
-- 	err = brcmf_commonring_write_complete(commonring);
-- 	brcmf_commonring_unlock(commonring);
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -276,15 +276,6 @@ static const u32 brcmf_ring_itemsize[BRC
-- };
-- 
-- 
---/* dma flushing needs implementation for mips and arm platforms. Should
--- * be put in util. Note, this is not real flushing. It is virtual non
--- * cached memory. Only write buffers should have to be drained. Though
--- * this may be different depending on platform......
--- */
---#define brcmf_dma_flush(addr, len)
---#define brcmf_dma_invalidate_cache(addr, len)
---
---
-- static u32
-- brcmf_pcie_read_reg32(struct brcmf_pciedev_info *devinfo, u32 reg_offset)
-- {
--@@ -1174,7 +1165,6 @@ static int brcmf_pcie_init_scratchbuffer
-- 		goto fail;
-- 
-- 	memset(devinfo->shared.scratch, 0, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
---	brcmf_dma_flush(devinfo->shared.scratch, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
-- 
-- 	addr = devinfo->shared.tcm_base_address +
-- 	       BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
--@@ -1192,7 +1182,6 @@ static int brcmf_pcie_init_scratchbuffer
-- 		goto fail;
-- 
-- 	memset(devinfo->shared.ringupd, 0, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
---	brcmf_dma_flush(devinfo->shared.ringupd, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
-- 
-- 	addr = devinfo->shared.tcm_base_address +
-- 	       BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
-diff --git a/package/kernel/mac80211/patches/344-0005-brcmfmac-add-support-for-dma-indices-feature.patch b/package/kernel/mac80211/patches/344-0005-brcmfmac-add-support-for-dma-indices-feature.patch
-deleted file mode 100644
-index 2f50abd..0000000
---- a/package/kernel/mac80211/patches/344-0005-brcmfmac-add-support-for-dma-indices-feature.patch
-+++ /dev/null
-@@ -1,270 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Wed, 20 May 2015 14:09:51 +0200
--Subject: [PATCH] brcmfmac: add support for dma indices feature
--
--PCIe full dongle firmware can support a dma indices feature with which
--firmware can update/fetch the read/write indices of message buffer
--rings on both host to dongle and dongle to host directions. The support is
--announced by firmware through shared flags.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -115,6 +115,8 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_MIN_SHARED_VERSION		5
-- #define BRCMF_PCIE_MAX_SHARED_VERSION		5
-- #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
--+#define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
--+#define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
-- 
-- #define BRCMF_PCIE_FLAGS_HTOD_SPLIT		0x4000
-- #define BRCMF_PCIE_FLAGS_DTOH_SPLIT		0x8000
--@@ -146,6 +148,10 @@ enum brcmf_pcie_state {
-- #define BRCMF_SHARED_RING_H2D_R_IDX_PTR_OFFSET	8
-- #define BRCMF_SHARED_RING_D2H_W_IDX_PTR_OFFSET	12
-- #define BRCMF_SHARED_RING_D2H_R_IDX_PTR_OFFSET	16
--+#define BRCMF_SHARED_RING_H2D_WP_HADDR_OFFSET	20
--+#define BRCMF_SHARED_RING_H2D_RP_HADDR_OFFSET	28
--+#define BRCMF_SHARED_RING_D2H_WP_HADDR_OFFSET	36
--+#define BRCMF_SHARED_RING_D2H_RP_HADDR_OFFSET	44
-- #define BRCMF_SHARED_RING_TCM_MEMLOC_OFFSET	0
-- #define BRCMF_SHARED_RING_MAX_SUB_QUEUES	52
-- 
--@@ -247,6 +253,13 @@ struct brcmf_pciedev_info {
-- 	bool mbdata_completed;
-- 	bool irq_allocated;
-- 	bool wowl_enabled;
--+	u8 dma_idx_sz;
--+	void *idxbuf;
--+	u32 idxbuf_sz;
--+	dma_addr_t idxbuf_dmahandle;
--+	u16 (*read_ptr)(struct brcmf_pciedev_info *devinfo, u32 mem_offset);
--+	void (*write_ptr)(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
--+			  u16 value);
-- };
-- 
-- struct brcmf_pcie_ringbuf {
--@@ -323,6 +336,25 @@ brcmf_pcie_write_tcm16(struct brcmf_pcie
-- }
-- 
-- 
--+static u16
--+brcmf_pcie_read_idx(struct brcmf_pciedev_info *devinfo, u32 mem_offset)
--+{
--+	u16 *address = devinfo->idxbuf + mem_offset;
--+
--+	return (*(address));
--+}
--+
--+
--+static void
--+brcmf_pcie_write_idx(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
--+		     u16 value)
--+{
--+	u16 *address = devinfo->idxbuf + mem_offset;
--+
--+	*(address) = value;
--+}
--+
--+
-- static u32
-- brcmf_pcie_read_tcm32(struct brcmf_pciedev_info *devinfo, u32 mem_offset)
-- {
--@@ -868,7 +900,7 @@ static int brcmf_pcie_ring_mb_write_rptr
-- 	brcmf_dbg(PCIE, "W r_ptr %d (%d), ring %d\n", commonring->r_ptr,
-- 		  commonring->w_ptr, ring->id);
-- 
---	brcmf_pcie_write_tcm16(devinfo, ring->r_idx_addr, commonring->r_ptr);
--+	devinfo->write_ptr(devinfo, ring->r_idx_addr, commonring->r_ptr);
-- 
-- 	return 0;
-- }
--@@ -886,7 +918,7 @@ static int brcmf_pcie_ring_mb_write_wptr
-- 	brcmf_dbg(PCIE, "W w_ptr %d (%d), ring %d\n", commonring->w_ptr,
-- 		  commonring->r_ptr, ring->id);
-- 
---	brcmf_pcie_write_tcm16(devinfo, ring->w_idx_addr, commonring->w_ptr);
--+	devinfo->write_ptr(devinfo, ring->w_idx_addr, commonring->w_ptr);
-- 
-- 	return 0;
-- }
--@@ -915,7 +947,7 @@ static int brcmf_pcie_ring_mb_update_rpt
-- 	if (devinfo->state != BRCMFMAC_PCIE_STATE_UP)
-- 		return -EIO;
-- 
---	commonring->r_ptr = brcmf_pcie_read_tcm16(devinfo, ring->r_idx_addr);
--+	commonring->r_ptr = devinfo->read_ptr(devinfo, ring->r_idx_addr);
-- 
-- 	brcmf_dbg(PCIE, "R r_ptr %d (%d), ring %d\n", commonring->r_ptr,
-- 		  commonring->w_ptr, ring->id);
--@@ -933,7 +965,7 @@ static int brcmf_pcie_ring_mb_update_wpt
-- 	if (devinfo->state != BRCMFMAC_PCIE_STATE_UP)
-- 		return -EIO;
-- 
---	commonring->w_ptr = brcmf_pcie_read_tcm16(devinfo, ring->w_idx_addr);
--+	commonring->w_ptr = devinfo->read_ptr(devinfo, ring->w_idx_addr);
-- 
-- 	brcmf_dbg(PCIE, "R w_ptr %d (%d), ring %d\n", commonring->w_ptr,
-- 		  commonring->r_ptr, ring->id);
--@@ -1038,6 +1070,13 @@ static void brcmf_pcie_release_ringbuffe
-- 	}
-- 	kfree(devinfo->shared.flowrings);
-- 	devinfo->shared.flowrings = NULL;
--+	if (devinfo->idxbuf) {
--+		dma_free_coherent(&devinfo->pdev->dev,
--+				  devinfo->idxbuf_sz,
--+				  devinfo->idxbuf,
--+				  devinfo->idxbuf_dmahandle);
--+		devinfo->idxbuf = NULL;
--+	}
-- }
-- 
-- 
--@@ -1053,19 +1092,72 @@ static int brcmf_pcie_init_ringbuffers(s
-- 	u32 addr;
-- 	u32 ring_mem_ptr;
-- 	u32 i;
--+	u64 address;
--+	u32 bufsz;
-- 	u16 max_sub_queues;
--+	u8 idx_offset;
-- 
-- 	ring_addr = devinfo->shared.ring_info_addr;
-- 	brcmf_dbg(PCIE, "Base ring addr = 0x%08x\n", ring_addr);
--+	addr = ring_addr + BRCMF_SHARED_RING_MAX_SUB_QUEUES;
--+	max_sub_queues = brcmf_pcie_read_tcm16(devinfo, addr);
-- 
---	addr = ring_addr + BRCMF_SHARED_RING_D2H_W_IDX_PTR_OFFSET;
---	d2h_w_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
---	addr = ring_addr + BRCMF_SHARED_RING_D2H_R_IDX_PTR_OFFSET;
---	d2h_r_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
---	addr = ring_addr + BRCMF_SHARED_RING_H2D_W_IDX_PTR_OFFSET;
---	h2d_w_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
---	addr = ring_addr + BRCMF_SHARED_RING_H2D_R_IDX_PTR_OFFSET;
---	h2d_r_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
--+	if (devinfo->dma_idx_sz != 0) {
--+		bufsz = (BRCMF_NROF_D2H_COMMON_MSGRINGS + max_sub_queues) *
--+			devinfo->dma_idx_sz * 2;
--+		devinfo->idxbuf = dma_alloc_coherent(&devinfo->pdev->dev, bufsz,
--+						     &devinfo->idxbuf_dmahandle,
--+						     GFP_KERNEL);
--+		if (!devinfo->idxbuf)
--+			devinfo->dma_idx_sz = 0;
--+	}
--+
--+	if (devinfo->dma_idx_sz == 0) {
--+		addr = ring_addr + BRCMF_SHARED_RING_D2H_W_IDX_PTR_OFFSET;
--+		d2h_w_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
--+		addr = ring_addr + BRCMF_SHARED_RING_D2H_R_IDX_PTR_OFFSET;
--+		d2h_r_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
--+		addr = ring_addr + BRCMF_SHARED_RING_H2D_W_IDX_PTR_OFFSET;
--+		h2d_w_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
--+		addr = ring_addr + BRCMF_SHARED_RING_H2D_R_IDX_PTR_OFFSET;
--+		h2d_r_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
--+		idx_offset = sizeof(u32);
--+		devinfo->write_ptr = brcmf_pcie_write_tcm16;
--+		devinfo->read_ptr = brcmf_pcie_read_tcm16;
--+		brcmf_dbg(PCIE, "Using TCM indices\n");
--+	} else {
--+		memset(devinfo->idxbuf, 0, bufsz);
--+		devinfo->idxbuf_sz = bufsz;
--+		idx_offset = devinfo->dma_idx_sz;
--+		devinfo->write_ptr = brcmf_pcie_write_idx;
--+		devinfo->read_ptr = brcmf_pcie_read_idx;
--+
--+		h2d_w_idx_ptr = 0;
--+		addr = ring_addr + BRCMF_SHARED_RING_H2D_WP_HADDR_OFFSET;
--+		address = (u64)devinfo->idxbuf_dmahandle;
--+		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
--+		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
--+
--+		h2d_r_idx_ptr = h2d_w_idx_ptr + max_sub_queues * idx_offset;
--+		addr = ring_addr + BRCMF_SHARED_RING_H2D_RP_HADDR_OFFSET;
--+		address += max_sub_queues * idx_offset;
--+		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
--+		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
--+
--+		d2h_w_idx_ptr = h2d_r_idx_ptr + max_sub_queues * idx_offset;
--+		addr = ring_addr + BRCMF_SHARED_RING_D2H_WP_HADDR_OFFSET;
--+		address += max_sub_queues * idx_offset;
--+		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
--+		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
--+
--+		d2h_r_idx_ptr = d2h_w_idx_ptr +
--+				BRCMF_NROF_D2H_COMMON_MSGRINGS * idx_offset;
--+		addr = ring_addr + BRCMF_SHARED_RING_D2H_RP_HADDR_OFFSET;
--+		address += BRCMF_NROF_D2H_COMMON_MSGRINGS * idx_offset;
--+		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
--+		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
--+		brcmf_dbg(PCIE, "Using host memory indices\n");
--+	}
-- 
-- 	addr = ring_addr + BRCMF_SHARED_RING_TCM_MEMLOC_OFFSET;
-- 	ring_mem_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
--@@ -1079,8 +1171,8 @@ static int brcmf_pcie_init_ringbuffers(s
-- 		ring->id = i;
-- 		devinfo->shared.commonrings[i] = ring;
-- 
---		h2d_w_idx_ptr += sizeof(u32);
---		h2d_r_idx_ptr += sizeof(u32);
--+		h2d_w_idx_ptr += idx_offset;
--+		h2d_r_idx_ptr += idx_offset;
-- 		ring_mem_ptr += BRCMF_RING_MEM_SZ;
-- 	}
-- 
--@@ -1094,13 +1186,11 @@ static int brcmf_pcie_init_ringbuffers(s
-- 		ring->id = i;
-- 		devinfo->shared.commonrings[i] = ring;
-- 
---		d2h_w_idx_ptr += sizeof(u32);
---		d2h_r_idx_ptr += sizeof(u32);
--+		d2h_w_idx_ptr += idx_offset;
--+		d2h_r_idx_ptr += idx_offset;
-- 		ring_mem_ptr += BRCMF_RING_MEM_SZ;
-- 	}
-- 
---	addr = ring_addr + BRCMF_SHARED_RING_MAX_SUB_QUEUES;
---	max_sub_queues = brcmf_pcie_read_tcm16(devinfo, addr);
-- 	devinfo->shared.nrof_flowrings =
-- 			max_sub_queues - BRCMF_NROF_H2D_COMMON_MSGRINGS;
-- 	rings = kcalloc(devinfo->shared.nrof_flowrings, sizeof(*ring),
--@@ -1124,15 +1214,15 @@ static int brcmf_pcie_init_ringbuffers(s
-- 					     ring);
-- 		ring->w_idx_addr = h2d_w_idx_ptr;
-- 		ring->r_idx_addr = h2d_r_idx_ptr;
---		h2d_w_idx_ptr += sizeof(u32);
---		h2d_r_idx_ptr += sizeof(u32);
--+		h2d_w_idx_ptr += idx_offset;
--+		h2d_r_idx_ptr += idx_offset;
-- 	}
-- 	devinfo->shared.flowrings = rings;
-- 
-- 	return 0;
-- 
-- fail:
---	brcmf_err("Allocating commonring buffers failed\n");
--+	brcmf_err("Allocating ring buffers failed\n");
-- 	brcmf_pcie_release_ringbuffers(devinfo);
-- 	return -ENOMEM;
-- }
--@@ -1269,6 +1359,14 @@ brcmf_pcie_init_share_ram_info(struct br
-- 		return -EINVAL;
-- 	}
-- 
--+	/* check firmware support dma indicies */
--+	if (shared->flags & BRCMF_PCIE_SHARED_DMA_INDEX) {
--+		if (shared->flags & BRCMF_PCIE_SHARED_DMA_2B_IDX)
--+			devinfo->dma_idx_sz = sizeof(u16);
--+		else
--+			devinfo->dma_idx_sz = sizeof(u32);
--+	}
--+
-- 	addr = sharedram_addr + BRCMF_SHARED_MAX_RXBUFPOST_OFFSET;
-- 	shared->max_rxbufpost = brcmf_pcie_read_tcm16(devinfo, addr);
-- 	if (shared->max_rxbufpost == 0)
-diff --git a/package/kernel/mac80211/patches/345-brcmfmac-avoid-null-pointer-access-when-brcmf_msgbuf.patch b/package/kernel/mac80211/patches/345-brcmfmac-avoid-null-pointer-access-when-brcmf_msgbuf.patch
-deleted file mode 100644
-index 28408d2..0000000
---- a/package/kernel/mac80211/patches/345-brcmfmac-avoid-null-pointer-access-when-brcmf_msgbuf.patch
-+++ /dev/null
-@@ -1,102 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Tue, 26 May 2015 13:19:46 +0200
--Subject: [PATCH] brcmfmac: avoid null pointer access when
-- brcmf_msgbuf_get_pktid() fails
--
--The function brcmf_msgbuf_get_pktid() may return a NULL pointer so
--the callers should check the return pointer before accessing it to
--avoid the crash below (see [1]):
--
--brcmfmac: brcmf_msgbuf_get_pktid: Invalid packet id 273 (not in use)
--BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
--IP: [<ffffffff8145b225>] skb_pull+0x5/0x50
--PGD 0
--Oops: 0000 [#1] PREEMPT SMP
--Modules linked in: pci_stub vboxpci(O) vboxnetflt(O) vboxnetadp(O) vboxdrv(O)
-- snd_hda_codec_hdmi bnep mousedev hid_generic ushwmon msr ext4 crc16 mbcache
-- jbd2 sd_mod uas usb_storage ahci libahci libata scsi_mod xhci_pci xhci_hcd
-- usbcore usb_common
--CPU: 0 PID: 1661 Comm: irq/61-brcmf_pc Tainted: G O    4.0.1-MacbookPro-ARCH #1
--Hardware name: Apple Inc. MacBookPro12,1/Mac-E43C1C25D4880AD6,
-- BIOS MBP121.88Z.0167.B02.1503241251 03/24/2015
--task: ffff880264203cc0 ti: ffff88025ffe4000 task.ti: ffff88025ffe4000
--RIP: 0010:[<ffffffff8145b225>]  [<ffffffff8145b225>] skb_pull+0x5/0x50
--RSP: 0018:ffff88025ffe7d40  EFLAGS: 00010202
--RAX: 0000000000000000 RBX: ffff88008a33c000 RCX: 0000000000000044
--RDX: 0000000000000000 RSI: 000000000000004a RDI: 0000000000000000
--RBP: ffff88025ffe7da8 R08: 0000000000000096 R09: 000000000000004a
--R10: 0000000000000000 R11: 000000000000048e R12: ffff88025ff14f00
--R13: 0000000000000000 R14: ffff880263b48200 R15: ffff88008a33c000
--FS:  0000000000000000(0000) GS:ffff88026ec00000(0000) knlGS:0000000000000000
--CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
--CR2: 0000000000000080 CR3: 000000000180b000 CR4: 00000000003407f0
--Stack:
-- ffffffffa06aed74 ffff88025ffe7dc8 ffff880263b48270 ffff880263b48278
-- 05ea88020000004a 0002ffff81014635 000000001720b2f6 ffff88026ec116c0
-- ffff880263b48200 0000000000010000 ffff880263b4ae00 ffff880264203cc0
--Call Trace:
-- [<ffffffffa06aed74>] ? brcmf_msgbuf_process_rx+0x404/0x480 [brcmfmac]
-- [<ffffffff810cea60>] ? irq_finalize_oneshot.part.30+0xf0/0xf0
-- [<ffffffffa06afb55>] brcmf_proto_msgbuf_rx_trigger+0x35/0xf0 [brcmfmac]
-- [<ffffffffa06baf2a>] brcmf_pcie_isr_thread_v2+0x8a/0x130 [brcmfmac]
-- [<ffffffff810cea80>] irq_thread_fn+0x20/0x50
-- [<ffffffff810ceddf>] irq_thread+0x13f/0x170
-- [<ffffffff810cebf0>] ? wake_threads_waitq+0x30/0x30
-- [<ffffffff810ceca0>] ? irq_thread_dtor+0xb0/0xb0
-- [<ffffffff81092a08>] kthread+0xd8/0xf0
-- [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
-- [<ffffffff8156d898>] ret_from_fork+0x58/0x90
-- [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
--Code: 01 83 e2 f7 88 50 01 48 83 c4 08 5b 5d f3 c3 0f 1f 80 00 00 00 00 83 e2
-- f7 88 50 01 c3 66 0f 1f 84 00 00 00 00 00 0f 1f
--RIP  [<ffffffff8145b225>] skb_pull+0x5/0x50
-- RSP <ffff88025ffe7d40>
--CR2: 0000000000000080
-----[ end trace b074c0f90e7c997d ]---
--
--[1] http://mid.gmane.org/20150430193259.GA5630@googlemail.com
--
--Cc: <stable@vger.kernel.org> # v3.18, v3.19, v4.0, v4.1
--Reported-by: Michael Hornung <mhornung.linux@gmail.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -500,11 +500,9 @@ static int brcmf_msgbuf_query_dcmd(struc
-- 				     msgbuf->rx_pktids,
-- 				     msgbuf->ioctl_resp_pktid);
-- 	if (msgbuf->ioctl_resp_ret_len != 0) {
---		if (!skb) {
---			brcmf_err("Invalid packet id idx recv'd %d\n",
---				  msgbuf->ioctl_resp_pktid);
--+		if (!skb)
-- 			return -EBADF;
---		}
--+
-- 		memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
-- 				       len : msgbuf->ioctl_resp_ret_len);
-- 	}
--@@ -866,10 +864,8 @@ brcmf_msgbuf_process_txstatus(struct brc
-- 	flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
-- 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
-- 				     msgbuf->tx_pktids, idx);
---	if (!skb) {
---		brcmf_err("Invalid packet id idx recv'd %d\n", idx);
--+	if (!skb)
-- 		return;
---	}
-- 
-- 	set_bit(flowid, msgbuf->txstatus_done_map);
-- 	commonring = msgbuf->flowrings[flowid];
--@@ -1148,6 +1144,8 @@ brcmf_msgbuf_process_rx_complete(struct
-- 
-- 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
-- 				     msgbuf->rx_pktids, idx);
--+	if (!skb)
--+		return;
-- 
-- 	if (data_offset)
-- 		skb_pull(skb, data_offset);
-diff --git a/package/kernel/mac80211/patches/346-brcmfmac-fix-invalid-access-to-struct-acpi_device-fi.patch b/package/kernel/mac80211/patches/346-brcmfmac-fix-invalid-access-to-struct-acpi_device-fi.patch
-deleted file mode 100644
-index f023034..0000000
---- a/package/kernel/mac80211/patches/346-brcmfmac-fix-invalid-access-to-struct-acpi_device-fi.patch
-+++ /dev/null
-@@ -1,63 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 27 May 2015 19:31:41 +0200
--Subject: [PATCH] brcmfmac: fix invalid access to struct acpi_device fields
--
--The fields of struct acpi_device are only known when CONFIG_ACPI is
--defined. Fix this by using a helper function. This will resolve the
--issue found in linux-next:
--
-- ../brcmfmac/bcmsdh.c: In function 'brcmf_ops_sdio_probe':
-- ../brcmfmac/bcmsdh.c:1139:7: error: dereferencing pointer to incomplete type
--   adev->flags.power_manageable = 0;
--       ^
--
--Fixes: f0992ace680c ("brcmfmac: prohibit ACPI power management ...")
--Cc: Fu, Zhonghui <zhonghui.fu@linux.intel.com>
--Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -1117,6 +1117,18 @@ MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_id
-- static struct brcmfmac_sdio_platform_data *brcmfmac_sdio_pdata;
-- 
-- 
--+static void brcmf_sdiod_acpi_set_power_manageable(struct device *dev,
--+						  int val)
--+{
--+#if IS_ENABLED(CONFIG_ACPI)
--+	struct acpi_device *adev;
--+
--+	adev = ACPI_COMPANION(dev);
--+	if (adev)
--+		adev->flags.power_manageable = 0;
--+#endif
--+}
--+
-- static int brcmf_ops_sdio_probe(struct sdio_func *func,
-- 				const struct sdio_device_id *id)
-- {
--@@ -1124,7 +1136,6 @@ static int brcmf_ops_sdio_probe(struct s
-- 	struct brcmf_sdio_dev *sdiodev;
-- 	struct brcmf_bus *bus_if;
-- 	struct device *dev;
---	struct acpi_device *adev;
-- 
-- 	brcmf_dbg(SDIO, "Enter\n");
-- 	brcmf_dbg(SDIO, "Class=%x\n", func->class);
--@@ -1132,11 +1143,9 @@ static int brcmf_ops_sdio_probe(struct s
-- 	brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
-- 	brcmf_dbg(SDIO, "Function#: %d\n", func->num);
-- 
---	/* prohibit ACPI power management for this device */
-- 	dev = &func->dev;
---	adev = ACPI_COMPANION(dev);
---	if (adev)
---		adev->flags.power_manageable = 0;
--+	/* prohibit ACPI power management for this device */
--+	brcmf_sdiod_acpi_set_power_manageable(dev, 0);
-- 
-- 	/* Consume func num 1 but dont do anything with it. */
-- 	if (func->num == 1)
-diff --git a/package/kernel/mac80211/patches/347-brcmfmac-simplify-check-stripping-v2-NVRAM.patch b/package/kernel/mac80211/patches/347-brcmfmac-simplify-check-stripping-v2-NVRAM.patch
-deleted file mode 100644
-index 2bfd44f..0000000
---- a/package/kernel/mac80211/patches/347-brcmfmac-simplify-check-stripping-v2-NVRAM.patch
-+++ /dev/null
-@@ -1,56 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Wed, 20 May 2015 09:34:21 +0200
--Subject: [PATCH] brcmfmac: simplify check stripping v2 NVRAM
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--Comparing NVRAM entry with a full filtering string is simpler than
--comparing it with a short prefix and then checking random chars at magic
--offsets. The cost of snprintf relatively low, we execute it just once.
--Tested on BCM43602 with NVRAM hacked to use V2 format.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -25,7 +25,7 @@
-- 
-- #define BRCMF_FW_MAX_NVRAM_SIZE			64000
-- #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
---#define BRCMF_FW_NVRAM_PCIEDEV_LEN		9	/* pcie/1/4/ */
--+#define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
-- 
-- char brcmf_firmware_path[BRCMF_FW_PATH_LEN];
-- module_param_string(firmware_path, brcmf_firmware_path,
--@@ -297,6 +297,8 @@ fail:
-- static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
-- 				    u16 bus_nr)
-- {
--+	char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
--+	size_t len;
-- 	u32 i, j;
-- 	u8 *nvram;
-- 
--@@ -308,14 +310,13 @@ static void brcmf_fw_strip_multi_v2(stru
-- 	 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
-- 	 * Y = bus_nr.
-- 	 */
--+	snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
--+	len = strlen(prefix);
-- 	i = 0;
-- 	j = 0;
---	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_PCIEDEV_LEN) {
---		if ((strncmp(&nvp->nvram[i], "pcie/", 5) == 0) &&
---		    (nvp->nvram[i + 6] == '/') && (nvp->nvram[i + 8] == '/') &&
---		    ((nvp->nvram[i + 5] - '0') == domain_nr) &&
---		    ((nvp->nvram[i + 7] - '0') == bus_nr)) {
---			i += BRCMF_FW_NVRAM_PCIEDEV_LEN;
--+	while (i < nvp->nvram_len - len) {
--+		if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
--+			i += len;
-- 			while (nvp->nvram[i] != 0) {
-- 				nvram[j] = nvp->nvram[i];
-- 				i++;
-diff --git a/package/kernel/mac80211/patches/348-brcmfmac-simplify-check-finding-NVRAM-v1-device-path.patch b/package/kernel/mac80211/patches/348-brcmfmac-simplify-check-finding-NVRAM-v1-device-path.patch
-deleted file mode 100644
-index 0e65114..0000000
---- a/package/kernel/mac80211/patches/348-brcmfmac-simplify-check-finding-NVRAM-v1-device-path.patch
-+++ /dev/null
-@@ -1,57 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Wed, 20 May 2015 11:01:08 +0200
--Subject: [PATCH] brcmfmac: simplify check finding NVRAM v1 device path
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--With a simple use of snprintf and small buffer we can compare NVRAM
--entry value with a full string. This way we avoid checking random chars
--at magic offsets.
--Tested on BCM43602 with NVRAM hacked to use v1 format.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -222,6 +222,10 @@ static int brcmf_init_nvram_parser(struc
-- static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
-- 				    u16 bus_nr)
-- {
--+	/* Device path with a leading '=' key-value separator */
--+	char pcie_path[] = "=pcie/?/?";
--+	size_t pcie_len;
--+
-- 	u32 i, j;
-- 	bool found;
-- 	u8 *nvram;
--@@ -238,6 +242,9 @@ static void brcmf_fw_strip_multi_v1(stru
-- 	/* First search for the devpathX and see if it is the configuration
-- 	 * for domain_nr/bus_nr. Search complete nvp
-- 	 */
--+	snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
--+		 bus_nr);
--+	pcie_len = strlen(pcie_path);
-- 	found = false;
-- 	i = 0;
-- 	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
--@@ -245,13 +252,10 @@ static void brcmf_fw_strip_multi_v1(stru
-- 		 * Y = domain_nr, Z = bus_nr, X = virtual ID
-- 		 */
-- 		if ((strncmp(&nvp->nvram[i], "devpath", 7) == 0) &&
---		    (strncmp(&nvp->nvram[i + 8], "=pcie/", 6) == 0)) {
---			if (((nvp->nvram[i + 14] - '0') == domain_nr) &&
---			    ((nvp->nvram[i + 16] - '0') == bus_nr)) {
---				id = nvp->nvram[i + 7] - '0';
---				found = true;
---				break;
---			}
--+		    (strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len) == 0)) {
--+			id = nvp->nvram[i + 7] - '0';
--+			found = true;
--+			break;
-- 		}
-- 		while (nvp->nvram[i] != 0)
-- 			i++;
-diff --git a/package/kernel/mac80211/patches/349-brcmfmac-treat-0-as-end-of-comment-when-parsing-NVRA.patch b/package/kernel/mac80211/patches/349-brcmfmac-treat-0-as-end-of-comment-when-parsing-NVRA.patch
-deleted file mode 100644
-index dc174e5..0000000
---- a/package/kernel/mac80211/patches/349-brcmfmac-treat-0-as-end-of-comment-when-parsing-NVRA.patch
-+++ /dev/null
-@@ -1,45 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Wed, 20 May 2015 13:59:54 +0200
--Subject: [PATCH] brcmfmac: treat \0 as end of comment when parsing NVRAM
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--This fixes brcmfmac dealing with NVRAM coming from platform e.g. from a
--flash MTD partition. In such cases entries are separated by \0 instead
--of \n which caused ignoring whole content after the first "comment".
--While platform NVRAM doesn't usually contain comments, we switch to
--COMMENT state after e.g. finding an unexpected char in key name.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -162,17 +162,20 @@ brcmf_nvram_handle_value(struct nvram_pa
-- static enum nvram_parser_state
-- brcmf_nvram_handle_comment(struct nvram_parser *nvp)
-- {
---	char *eol, *sol;
--+	char *eoc, *sol;
-- 
-- 	sol = (char *)&nvp->fwnv->data[nvp->pos];
---	eol = strchr(sol, '\n');
---	if (eol == NULL)
---		return END;
--+	eoc = strchr(sol, '\n');
--+	if (!eoc) {
--+		eoc = strchr(sol, '\0');
--+		if (!eoc)
--+			return END;
--+	}
-- 
-- 	/* eat all moving to next line */
-- 	nvp->line++;
-- 	nvp->column = 1;
---	nvp->pos += (eol - sol) + 1;
--+	nvp->pos += (eoc - sol) + 1;
-- 	return IDLE;
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/350-brcmfmac-allow-NVRAM-values-to-contain-spaces.patch b/package/kernel/mac80211/patches/350-brcmfmac-allow-NVRAM-values-to-contain-spaces.patch
-deleted file mode 100644
-index 5700142..0000000
---- a/package/kernel/mac80211/patches/350-brcmfmac-allow-NVRAM-values-to-contain-spaces.patch
-+++ /dev/null
-@@ -1,50 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Sat, 23 May 2015 09:15:33 +0200
--Subject: [PATCH] brcmfmac: allow NVRAM values to contain spaces
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--Platform NVRAMs often contain values with spaces. Even if right now most
--firmware-supported entries are simple values, we shouldn't reject these
--with spaces. It was semi-confirmed by Broadcom in the early patch adding
--support for platform NVRAMs.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -66,6 +66,12 @@ struct nvram_parser {
-- 	bool multi_dev_v2;
-- };
-- 
--+/**
--+ * is_nvram_char() - check if char is a valid one for NVRAM entry
--+ *
--+ * It accepts all printable ASCII chars except for '#' which opens a comment.
--+ * Please note that ' ' (space) while accepted is not a valid key name char.
--+ */
-- static bool is_nvram_char(char c)
-- {
-- 	/* comment marker excluded */
--@@ -73,7 +79,7 @@ static bool is_nvram_char(char c)
-- 		return false;
-- 
-- 	/* key and value may have any other readable character */
---	return (c > 0x20 && c < 0x7f);
--+	return (c >= 0x20 && c < 0x7f);
-- }
-- 
-- static bool is_whitespace(char c)
--@@ -120,7 +126,7 @@ static enum nvram_parser_state brcmf_nvr
-- 			nvp->multi_dev_v1 = true;
-- 		if (strncmp(&nvp->fwnv->data[nvp->entry], "pcie/", 5) == 0)
-- 			nvp->multi_dev_v2 = true;
---	} else if (!is_nvram_char(c)) {
--+	} else if (!is_nvram_char(c) || c == ' ') {
-- 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
-- 			  nvp->line, nvp->column);
-- 		return COMMENT;
-diff --git a/package/kernel/mac80211/patches/351-ath9k-fix-DMA-stop-sequence-for-AR9003.patch b/package/kernel/mac80211/patches/351-ath9k-fix-DMA-stop-sequence-for-AR9003.patch
-deleted file mode 100644
-index 814b0d7..0000000
---- a/package/kernel/mac80211/patches/351-ath9k-fix-DMA-stop-sequence-for-AR9003.patch
-+++ /dev/null
-@@ -1,33 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Tue, 2 Jun 2015 10:35:46 +0200
--Subject: [PATCH] ath9k: fix DMA stop sequence for AR9003+
--
--AR93xx and newer needs to stop rx before tx to avoid getting the DMA
--engine or MAC into a stuck state.
--This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam.
--
--Cc: stable@vger.kernel.org
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/main.c
--+++ b/drivers/net/wireless/ath/ath9k/main.c
--@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath
-- 	ath_stop_ani(sc);
-- 	ath9k_hw_disable_interrupts(ah);
-- 
---	if (!ath_drain_all_txq(sc))
---		ret = false;
---
---	if (!ath_stoprecv(sc))
---		ret = false;
--+	if (AR_SREV_9300_20_OR_LATER(ah)) {
--+		ret &= ath_stoprecv(sc);
--+		ret &= ath_drain_all_txq(sc);
--+	} else {
--+		ret &= ath_drain_all_txq(sc);
--+		ret &= ath_stoprecv(sc);
--+	}
-- 
-- 	return ret;
-- }
-diff --git a/package/kernel/mac80211/patches/352-brcmfmac-support-NVRAMs-containing-pci-devpaths-inst.patch b/package/kernel/mac80211/patches/352-brcmfmac-support-NVRAMs-containing-pci-devpaths-inst.patch
-deleted file mode 100644
-index 7bbd57e..0000000
---- a/package/kernel/mac80211/patches/352-brcmfmac-support-NVRAMs-containing-pci-devpaths-inst.patch
-+++ /dev/null
-@@ -1,56 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Thu, 28 May 2015 14:19:21 +0200
--Subject: [PATCH] brcmfmac: support NVRAMs containing pci devpaths (instead of
-- pcie)
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--Recently Broadcom added support for NVRAMs with entries for multiple
--PCIe devices. One of the supported formats is based on prefixes defined
--like: devpath0=pcie/1/4/ and entries like 0:foo=bar 0:baz=qux etc.
--
--Unfortunately there are also a bit older devices using different way of
--defining prefixes, e.g. SmartRG SR400ac (2 x BCM43602) with entries:
--devpath0=pci/1/1/
--devpath1=pci/2/1
--Broadcom stated this old format will never be used/supported by brcmfmac
--but given the simplicity of this patch I'll insist on supporting it.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -232,6 +232,8 @@ static void brcmf_fw_strip_multi_v1(stru
-- 				    u16 bus_nr)
-- {
-- 	/* Device path with a leading '=' key-value separator */
--+	char pci_path[] = "=pci/?/?";
--+	size_t pci_len;
-- 	char pcie_path[] = "=pcie/?/?";
-- 	size_t pcie_len;
-- 
--@@ -251,6 +253,9 @@ static void brcmf_fw_strip_multi_v1(stru
-- 	/* First search for the devpathX and see if it is the configuration
-- 	 * for domain_nr/bus_nr. Search complete nvp
-- 	 */
--+	snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
--+		 bus_nr);
--+	pci_len = strlen(pci_path);
-- 	snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
-- 		 bus_nr);
-- 	pcie_len = strlen(pcie_path);
--@@ -260,8 +265,9 @@ static void brcmf_fw_strip_multi_v1(stru
-- 		/* Format: devpathX=pcie/Y/Z/
-- 		 * Y = domain_nr, Z = bus_nr, X = virtual ID
-- 		 */
---		if ((strncmp(&nvp->nvram[i], "devpath", 7) == 0) &&
---		    (strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len) == 0)) {
--+		if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
--+		    (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
--+		     !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
-- 			id = nvp->nvram[i + 7] - '0';
-- 			found = true;
-- 			break;
-diff --git a/package/kernel/mac80211/patches/353-brcmfmac-set-wiphy-perm_addr-to-hardware-MAC-address.patch b/package/kernel/mac80211/patches/353-brcmfmac-set-wiphy-perm_addr-to-hardware-MAC-address.patch
-deleted file mode 100644
-index 1eff6ed..0000000
---- a/package/kernel/mac80211/patches/353-brcmfmac-set-wiphy-perm_addr-to-hardware-MAC-address.patch
-+++ /dev/null
-@@ -1,23 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Sun, 31 May 2015 02:52:26 +0200
--Subject: [PATCH] brcmfmac: set wiphy perm_addr to hardware MAC address
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--This allows e.g. user space to use /sys/class/ieee80211/*/macaddress
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6070,6 +6070,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
-- 		brcmf_err("Could not allocate wiphy device\n");
-- 		return NULL;
-- 	}
--+	memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
-- 	set_wiphy_dev(wiphy, busdev);
-- 
-- 	cfg = wiphy_priv(wiphy);
-diff --git a/package/kernel/mac80211/patches/354-brcmfmac-use-direct-data-pointer-in-NVRAM-parser-str.patch b/package/kernel/mac80211/patches/354-brcmfmac-use-direct-data-pointer-in-NVRAM-parser-str.patch
-deleted file mode 100644
-index c6e83dd..0000000
---- a/package/kernel/mac80211/patches/354-brcmfmac-use-direct-data-pointer-in-NVRAM-parser-str.patch
-+++ /dev/null
-@@ -1,144 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Thu, 4 Jun 2015 22:11:07 +0200
--Subject: [PATCH] brcmfmac: use direct data pointer in NVRAM parser struct
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--As we plan to add support for platform NVRAM we should store direct
--data pointer without the extra struct firmware layer. This will allow
--us to support other sources with the only requirement being u8 buffer.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -43,7 +43,7 @@ enum nvram_parser_state {
--  * struct nvram_parser - internal info for parser.
--  *
--  * @state: current parser state.
--- * @fwnv: input buffer being parsed.
--+ * @data: input buffer being parsed.
--  * @nvram: output buffer with parse result.
--  * @nvram_len: lenght of parse result.
--  * @line: current line.
--@@ -55,7 +55,7 @@ enum nvram_parser_state {
--  */
-- struct nvram_parser {
-- 	enum nvram_parser_state state;
---	const struct firmware *fwnv;
--+	const u8 *data;
-- 	u8 *nvram;
-- 	u32 nvram_len;
-- 	u32 line;
--@@ -91,7 +91,7 @@ static enum nvram_parser_state brcmf_nvr
-- {
-- 	char c;
-- 
---	c = nvp->fwnv->data[nvp->pos];
--+	c = nvp->data[nvp->pos];
-- 	if (c == '\n')
-- 		return COMMENT;
-- 	if (is_whitespace(c))
--@@ -115,16 +115,16 @@ static enum nvram_parser_state brcmf_nvr
-- 	enum nvram_parser_state st = nvp->state;
-- 	char c;
-- 
---	c = nvp->fwnv->data[nvp->pos];
--+	c = nvp->data[nvp->pos];
-- 	if (c == '=') {
-- 		/* ignore RAW1 by treating as comment */
---		if (strncmp(&nvp->fwnv->data[nvp->entry], "RAW1", 4) == 0)
--+		if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
-- 			st = COMMENT;
-- 		else
-- 			st = VALUE;
---		if (strncmp(&nvp->fwnv->data[nvp->entry], "devpath", 7) == 0)
--+		if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
-- 			nvp->multi_dev_v1 = true;
---		if (strncmp(&nvp->fwnv->data[nvp->entry], "pcie/", 5) == 0)
--+		if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
-- 			nvp->multi_dev_v2 = true;
-- 	} else if (!is_nvram_char(c) || c == ' ') {
-- 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
--@@ -145,11 +145,11 @@ brcmf_nvram_handle_value(struct nvram_pa
-- 	char *ekv;
-- 	u32 cplen;
-- 
---	c = nvp->fwnv->data[nvp->pos];
--+	c = nvp->data[nvp->pos];
-- 	if (!is_nvram_char(c)) {
-- 		/* key,value pair complete */
---		ekv = (u8 *)&nvp->fwnv->data[nvp->pos];
---		skv = (u8 *)&nvp->fwnv->data[nvp->entry];
--+		ekv = (u8 *)&nvp->data[nvp->pos];
--+		skv = (u8 *)&nvp->data[nvp->entry];
-- 		cplen = ekv - skv;
-- 		if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
-- 			return END;
--@@ -170,7 +170,7 @@ brcmf_nvram_handle_comment(struct nvram_
-- {
-- 	char *eoc, *sol;
-- 
---	sol = (char *)&nvp->fwnv->data[nvp->pos];
--+	sol = (char *)&nvp->data[nvp->pos];
-- 	eoc = strchr(sol, '\n');
-- 	if (!eoc) {
-- 		eoc = strchr(sol, '\0');
--@@ -201,17 +201,17 @@ static enum nvram_parser_state
-- };
-- 
-- static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
---				   const struct firmware *nv)
--+				   const u8 *data, size_t data_len)
-- {
-- 	size_t size;
-- 
-- 	memset(nvp, 0, sizeof(*nvp));
---	nvp->fwnv = nv;
--+	nvp->data = data;
-- 	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
---	if (nv->size > BRCMF_FW_MAX_NVRAM_SIZE)
--+	if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
-- 		size = BRCMF_FW_MAX_NVRAM_SIZE;
-- 	else
---		size = nv->size;
--+		size = data_len;
-- 	/* Alloc for extra 0 byte + roundup by 4 + length field */
-- 	size += 1 + 3 + sizeof(u32);
-- 	nvp->nvram = kzalloc(size, GFP_KERNEL);
--@@ -362,18 +362,18 @@ fail:
--  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
--  * End of buffer is completed with token identifying length of buffer.
--  */
---static void *brcmf_fw_nvram_strip(const struct firmware *nv, u32 *new_length,
---				  u16 domain_nr, u16 bus_nr)
--+static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
--+				  u32 *new_length, u16 domain_nr, u16 bus_nr)
-- {
-- 	struct nvram_parser nvp;
-- 	u32 pad;
-- 	u32 token;
-- 	__le32 token_le;
-- 
---	if (brcmf_init_nvram_parser(&nvp, nv) < 0)
--+	if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
-- 		return NULL;
-- 
---	while (nvp.pos < nv->size) {
--+	while (nvp.pos < data_len) {
-- 		nvp.state = nv_parser_states[nvp.state](&nvp);
-- 		if (nvp.state == END)
-- 			break;
--@@ -432,7 +432,7 @@ static void brcmf_fw_request_nvram_done(
-- 		goto fail;
-- 
-- 	if (fw) {
---		nvram = brcmf_fw_nvram_strip(fw, &nvram_length,
--+		nvram = brcmf_fw_nvram_strip(fw->data, fw->size, &nvram_length,
-- 					     fwctx->domain_nr, fwctx->bus_nr);
-- 		release_firmware(fw);
-- 		if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-diff --git a/package/kernel/mac80211/patches/355-b43-fix-support-for-14e4-4321-PCI-dev-with-BCM4321-c.patch b/package/kernel/mac80211/patches/355-b43-fix-support-for-14e4-4321-PCI-dev-with-BCM4321-c.patch
-deleted file mode 100644
-index 4ecef3b..0000000
---- a/package/kernel/mac80211/patches/355-b43-fix-support-for-14e4-4321-PCI-dev-with-BCM4321-c.patch
-+++ /dev/null
-@@ -1,32 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Sat, 6 Jun 2015 22:45:59 +0200
--Subject: [PATCH] b43: fix support for 14e4:4321 PCI dev with BCM4321 chipset
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--It seems Broadcom released two devices with conflicting device id. There
--are for sure 14e4:4321 PCI devices with BCM4321 (N-PHY) chipset, they
--can be found in routers, e.g. Netgear WNR834Bv2. However, according to
--Broadcom public sources 0x4321 is also used for 5 GHz BCM4306 (G-PHY).
--It's unsure if they meant PCI device id, or "virtual" id (from SPROM).
--To distinguish these devices lets check PHY type (G vs. N).
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Cc: <stable@vger.kernel.org> # 3.16+
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
--@@ -5365,6 +5365,10 @@ static void b43_supported_bands(struct b
-- 		*have_5ghz_phy = true;
-- 		return;
-- 	case 0x4321: /* BCM4306 */
--+		/* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
--+		if (dev->phy.type != B43_PHYTYPE_G)
--+			break;
--+		/* fall through */
-- 	case 0x4313: /* BCM4311 */
-- 	case 0x431a: /* BCM4318 */
-- 	case 0x432a: /* BCM4321 */
-diff --git a/package/kernel/mac80211/patches/356-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/356-ath9k-force-rx_clear-when-disabling-rx.patch
-deleted file mode 100644
-index bddb15a..0000000
---- a/package/kernel/mac80211/patches/356-ath9k-force-rx_clear-when-disabling-rx.patch
-+++ /dev/null
-@@ -1,31 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Sun, 7 Jun 2015 13:53:35 +0200
--Subject: [PATCH] ath9k: force rx_clear when disabling rx
--
--This makes stopping Rx more reliable and should reduce the frequency of
--Rx related DMA stop warnings
--
--Cc: stable@vger.kernel.org
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/mac.c
--+++ b/drivers/net/wireless/ath/ath9k/mac.c
--@@ -677,13 +677,15 @@ void ath9k_hw_startpcureceive(struct ath
-- 
-- 	ath9k_ani_reset(ah, is_scanning);
-- 
---	REG_CLR_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
--+	REG_CLR_BIT(ah, AR_DIAG_SW,
--+		    AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT | AR_DIAG_FORCE_RX_CLEAR);
-- }
-- EXPORT_SYMBOL(ath9k_hw_startpcureceive);
-- 
-- void ath9k_hw_abortpcurecv(struct ath_hw *ah)
-- {
---	REG_SET_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_ABORT | AR_DIAG_RX_DIS);
--+	REG_SET_BIT(ah, AR_DIAG_SW,
--+		    AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT | AR_DIAG_FORCE_RX_CLEAR);
-- 
-- 	ath9k_hw_disable_mib_counters(ah);
-- }
-diff --git a/package/kernel/mac80211/patches/357-0001-brcmfmac-Update-msgbuf-read-pointer-quicker.patch b/package/kernel/mac80211/patches/357-0001-brcmfmac-Update-msgbuf-read-pointer-quicker.patch
-deleted file mode 100644
-index 74df9f9..0000000
---- a/package/kernel/mac80211/patches/357-0001-brcmfmac-Update-msgbuf-read-pointer-quicker.patch
-+++ /dev/null
-@@ -1,109 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Mon, 8 Jun 2015 14:38:32 +0200
--Subject: [PATCH] brcmfmac: Update msgbuf read pointer quicker.
--
--On device to host data using msgbuf the read pointer gets updated
--once all data is processed. Updating this pointer more frequently
--allows the firmware to add more data quicker. This will result in
--slightly higher and more stable throughput on CPU bounded host
--processors.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
--@@ -223,8 +223,6 @@ void brcmf_commonring_write_cancel(struc
-- void *brcmf_commonring_get_read_ptr(struct brcmf_commonring *commonring,
-- 				    u16 *n_items)
-- {
---	void *ret_addr;
---
-- 	if (commonring->cr_update_wptr)
-- 		commonring->cr_update_wptr(commonring->cr_ctx);
-- 
--@@ -235,19 +233,18 @@ void *brcmf_commonring_get_read_ptr(stru
-- 	if (*n_items == 0)
-- 		return NULL;
-- 
---	ret_addr = commonring->buf_addr +
---		   (commonring->r_ptr * commonring->item_len);
---
---	commonring->r_ptr += *n_items;
---	if (commonring->r_ptr == commonring->depth)
---		commonring->r_ptr = 0;
---
---	return ret_addr;
--+	return commonring->buf_addr +
--+	       (commonring->r_ptr * commonring->item_len);
-- }
-- 
-- 
---int brcmf_commonring_read_complete(struct brcmf_commonring *commonring)
--+int brcmf_commonring_read_complete(struct brcmf_commonring *commonring,
--+				   u16 n_items)
-- {
--+	commonring->r_ptr += n_items;
--+	if (commonring->r_ptr == commonring->depth)
--+		commonring->r_ptr = 0;
--+
-- 	if (commonring->cr_write_rptr)
-- 		return commonring->cr_write_rptr(commonring->cr_ctx);
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
--@@ -62,7 +62,8 @@ void brcmf_commonring_write_cancel(struc
-- 				   u16 n_items);
-- void *brcmf_commonring_get_read_ptr(struct brcmf_commonring *commonring,
-- 				    u16 *n_items);
---int brcmf_commonring_read_complete(struct brcmf_commonring *commonring);
--+int brcmf_commonring_read_complete(struct brcmf_commonring *commonring,
--+				   u16 n_items);
-- 
-- #define brcmf_commonring_n_items(commonring) (commonring->depth)
-- #define brcmf_commonring_len_item(commonring) (commonring->item_len)
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -75,6 +75,8 @@
-- 
-- #define BRCMF_MSGBUF_DELAY_TXWORKER_THRS	96
-- #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS	32
--+#define BRCMF_MSGBUF_UPDATE_RX_PTR_THRS		48
--+
-- 
-- struct msgbuf_common_hdr {
-- 	u8				msgtype;
--@@ -1257,19 +1259,27 @@ static void brcmf_msgbuf_process_rx(stru
-- {
-- 	void *buf;
-- 	u16 count;
--+	u16 processed;
-- 
-- again:
-- 	buf = brcmf_commonring_get_read_ptr(commonring, &count);
-- 	if (buf == NULL)
-- 		return;
-- 
--+	processed = 0;
-- 	while (count) {
-- 		brcmf_msgbuf_process_msgtype(msgbuf,
-- 					     buf + msgbuf->rx_dataoffset);
-- 		buf += brcmf_commonring_len_item(commonring);
--+		processed++;
--+		if (processed == BRCMF_MSGBUF_UPDATE_RX_PTR_THRS) {
--+			brcmf_commonring_read_complete(commonring, processed);
--+			processed = 0;
--+		}
-- 		count--;
-- 	}
---	brcmf_commonring_read_complete(commonring);
--+	if (processed)
--+		brcmf_commonring_read_complete(commonring, processed);
-- 
-- 	if (commonring->r_ptr == 0)
-- 		goto again;
-diff --git a/package/kernel/mac80211/patches/357-0002-brcmfmac-remove-chipinfo-debugfs-entry.patch b/package/kernel/mac80211/patches/357-0002-brcmfmac-remove-chipinfo-debugfs-entry.patch
-deleted file mode 100644
-index 9e5b486..0000000
---- a/package/kernel/mac80211/patches/357-0002-brcmfmac-remove-chipinfo-debugfs-entry.patch
-+++ /dev/null
-@@ -1,39 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Mon, 8 Jun 2015 14:38:33 +0200
--Subject: [PATCH] brcmfmac: remove chipinfo debugfs entry
--
--The information provided by chipinfo is also provided by the
--revinfo debugfs entry. Removing it from debugfs.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--@@ -41,15 +41,6 @@ void brcmf_debugfs_exit(void)
-- 	root_folder = NULL;
-- }
-- 
---static int brcmf_debugfs_chipinfo_read(struct seq_file *seq, void *data)
---{
---	struct brcmf_bus *bus = dev_get_drvdata(seq->private);
---
---	seq_printf(seq, "chip: %x(%u) rev %u\n",
---		   bus->chip, bus->chip, bus->chiprev);
---	return 0;
---}
---
-- int brcmf_debugfs_attach(struct brcmf_pub *drvr)
-- {
-- 	struct device *dev = drvr->bus_if->dev;
--@@ -58,7 +49,6 @@ int brcmf_debugfs_attach(struct brcmf_pu
-- 		return -ENODEV;
-- 
-- 	drvr->dbgfs_dir = debugfs_create_dir(dev_name(dev), root_folder);
---	brcmf_debugfs_add_entry(drvr, "chipinfo", brcmf_debugfs_chipinfo_read);
-- 
-- 	return PTR_ERR_OR_ZERO(drvr->dbgfs_dir);
-- }
-diff --git a/package/kernel/mac80211/patches/357-0003-brcmfmac-remove-watchdog-reset-from-brcmf_pcie_busco.patch b/package/kernel/mac80211/patches/357-0003-brcmfmac-remove-watchdog-reset-from-brcmf_pcie_busco.patch
-deleted file mode 100644
-index c38b2cd..0000000
---- a/package/kernel/mac80211/patches/357-0003-brcmfmac-remove-watchdog-reset-from-brcmf_pcie_busco.patch
-+++ /dev/null
-@@ -1,53 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Mon, 8 Jun 2015 14:38:34 +0200
--Subject: [PATCH] brcmfmac: remove watchdog reset from
-- brcmf_pcie_buscoreprep()
--
--The watchdog reset as done in brcmf_pcie_buscoreprep() is not
--sufficient. It needs to modify PCIe core registers as well
--which is properly done by brcmf_pcie_reset_device() after the
--chip recognition is done. So the faulty watchdog reset can be
--removed as it was causing driver reload to fail and hang the
--system requiring a power-cycle. Instead the call to to the
--brcmf_pcie_reset_device() function is done twice in the unload.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -1629,20 +1629,7 @@ static void brcmf_pcie_buscore_write32(v
-- 
-- static int brcmf_pcie_buscoreprep(void *ctx)
-- {
---	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)ctx;
---	int err;
---
---	err = brcmf_pcie_get_resource(devinfo);
---	if (err == 0) {
---		/* Set CC watchdog to reset all the cores on the chip to bring
---		 * back dongle to a sane state.
---		 */
---		brcmf_pcie_buscore_write32(ctx, CORE_CC_REG(SI_ENUM_BASE,
---							    watchdog), 4);
---		msleep(100);
---	}
---
---	return err;
--+	return brcmf_pcie_get_resource(ctx);
-- }
-- 
-- 
--@@ -1824,6 +1811,7 @@ brcmf_pcie_remove(struct pci_dev *pdev)
-- 		brcmf_pcie_intr_disable(devinfo);
-- 
-- 	brcmf_detach(&pdev->dev);
--+	brcmf_pcie_reset_device(devinfo);
-- 
-- 	kfree(bus->bus_priv.pcie);
-- 	kfree(bus->msgbuf->flowrings);
-diff --git a/package/kernel/mac80211/patches/357-0004-brcmfmac-use-debugfs_create_devm_seqfile-helper-func.patch b/package/kernel/mac80211/patches/357-0004-brcmfmac-use-debugfs_create_devm_seqfile-helper-func.patch
-deleted file mode 100644
-index 756fbb2..0000000
---- a/package/kernel/mac80211/patches/357-0004-brcmfmac-use-debugfs_create_devm_seqfile-helper-func.patch
-+++ /dev/null
-@@ -1,69 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Mon, 8 Jun 2015 14:38:35 +0200
--Subject: [PATCH] brcmfmac: use debugfs_create_devm_seqfile() helper
-- function
--
--Some time ago the function debugfs_create_devm_seqfile() was
--introduced in debugfs. The caller simply needs to provide a
--device pointer and read function. The function brcmf_debugfs_add_entry()
--is now simply a wrapper only doing the work for CONFIG_BRCMDBG.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--@@ -64,44 +64,12 @@ struct dentry *brcmf_debugfs_get_devdir(
-- 	return drvr->dbgfs_dir;
-- }
-- 
---struct brcmf_debugfs_entry {
---	int (*read)(struct seq_file *seq, void *data);
---	struct brcmf_pub *drvr;
---};
---
---static int brcmf_debugfs_entry_open(struct inode *inode, struct file *f)
---{
---	struct brcmf_debugfs_entry *entry = inode->i_private;
---
---	return single_open(f, entry->read, entry->drvr->bus_if->dev);
---}
---
---static const struct file_operations brcmf_debugfs_def_ops = {
---	.owner = THIS_MODULE,
---	.open = brcmf_debugfs_entry_open,
---	.release = single_release,
---	.read = seq_read,
---	.llseek = seq_lseek
---};
---
-- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
-- 			    int (*read_fn)(struct seq_file *seq, void *data))
-- {
---	struct dentry *dentry =  drvr->dbgfs_dir;
---	struct brcmf_debugfs_entry *entry;
---
---	if (IS_ERR_OR_NULL(dentry))
---		return -ENOENT;
---
---	entry = devm_kzalloc(drvr->bus_if->dev, sizeof(*entry), GFP_KERNEL);
---	if (!entry)
---		return -ENOMEM;
---
---	entry->read = read_fn;
---	entry->drvr = drvr;
---
---	dentry = debugfs_create_file(fn, S_IRUGO, dentry, entry,
---				     &brcmf_debugfs_def_ops);
--+	struct dentry *e;
-- 
---	return PTR_ERR_OR_ZERO(dentry);
--+	e = debugfs_create_devm_seqfile(drvr->bus_if->dev, fn,
--+					drvr->dbgfs_dir, read_fn);
--+	return PTR_ERR_OR_ZERO(e);
-- }
-diff --git a/package/kernel/mac80211/patches/358-ath9k_hw-fix-device-ID-check-for-AR956x.patch b/package/kernel/mac80211/patches/358-ath9k_hw-fix-device-ID-check-for-AR956x.patch
-deleted file mode 100644
-index 2674efb..0000000
---- a/package/kernel/mac80211/patches/358-ath9k_hw-fix-device-ID-check-for-AR956x.patch
-+++ /dev/null
-@@ -1,20 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Sun, 21 Jun 2015 19:45:59 +0200
--Subject: [PATCH] ath9k_hw: fix device ID check for AR956x
--
--Because of the missing return, the macVersion value was being
--overwritten with an invalid register read
--
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/hw.c
--+++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -278,6 +278,7 @@ static void ath9k_hw_read_revisions(stru
-- 		return;
-- 	case AR9300_DEVID_QCA956X:
-- 		ah->hw_version.macVersion = AR_SREV_VERSION_9561;
--+		return;
-- 	}
-- 
-- 	val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
-diff --git a/package/kernel/mac80211/patches/359-0001-brcmfmac-Check-if-firmware-supports-p2p.patch b/package/kernel/mac80211/patches/359-0001-brcmfmac-Check-if-firmware-supports-p2p.patch
-deleted file mode 100644
-index ff24a4a..0000000
---- a/package/kernel/mac80211/patches/359-0001-brcmfmac-Check-if-firmware-supports-p2p.patch
-+++ /dev/null
-@@ -1,42 +0,0 @@
--From: Pontus Fuchs <pontusf@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:17 +0200
--Subject: [PATCH] brcmfmac: Check if firmware supports p2p
--
--Add a feature flag to reflect the firmware's p2p capability.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--@@ -129,6 +129,7 @@ void brcmf_feat_attach(struct brcmf_pub
-- 		brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
-- 	if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
-- 		brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
--+	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_P2P, "p2p");
-- 
-- 	/* set chip related quirks */
-- 	switch (drvr->bus_if->chip) {
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--@@ -23,12 +23,14 @@
--  * MCHAN: multi-channel for concurrent P2P.
--  * PNO: preferred network offload.
--  * WOWL: Wake-On-WLAN.
--+ * P2P: peer-to-peer
--  */
-- #define BRCMF_FEAT_LIST \
-- 	BRCMF_FEAT_DEF(MBSS) \
-- 	BRCMF_FEAT_DEF(MCHAN) \
-- 	BRCMF_FEAT_DEF(PNO) \
---	BRCMF_FEAT_DEF(WOWL)
--+	BRCMF_FEAT_DEF(WOWL) \
--+	BRCMF_FEAT_DEF(P2P)
-- /*
--  * Quirks:
--  *
-diff --git a/package/kernel/mac80211/patches/359-0002-brcmfmac-Build-wiphy-mode-and-interface-combinations.patch b/package/kernel/mac80211/patches/359-0002-brcmfmac-Build-wiphy-mode-and-interface-combinations.patch
-deleted file mode 100644
-index 3876ba0..0000000
---- a/package/kernel/mac80211/patches/359-0002-brcmfmac-Build-wiphy-mode-and-interface-combinations.patch
-+++ /dev/null
-@@ -1,198 +0,0 @@
--From: Pontus Fuchs <pontusf@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:18 +0200
--Subject: [PATCH] brcmfmac: Build wiphy mode and interface combinations
-- dynamically
--
--Switch from using semi hard coded interface combinations. This makes
--it easier to announce what the firmware actually supports. This fixes
--the case where brcmfmac announces p2p but the firmware doesn't
--support it.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -52,8 +52,6 @@
-- #define BRCMF_PNO_SCAN_COMPLETE		1
-- #define BRCMF_PNO_SCAN_INCOMPLETE	0
-- 
---#define BRCMF_IFACE_MAX_CNT		3
---
-- #define WPA_OUI				"\x00\x50\xF2"	/* WPA OUI */
-- #define WPA_OUI_TYPE			1
-- #define RSN_OUI				"\x00\x0F\xAC"	/* RSN OUI */
--@@ -5639,53 +5637,6 @@ static int brcmf_setup_wiphybands(struct
-- 	return 0;
-- }
-- 
---static const struct ieee80211_iface_limit brcmf_iface_limits_mbss[] = {
---	{
---		.max = 1,
---		.types = BIT(NL80211_IFTYPE_STATION) |
---			 BIT(NL80211_IFTYPE_ADHOC)
---	},
---	{
---		.max = 4,
---		.types = BIT(NL80211_IFTYPE_AP)
---	},
---	{
---		.max = 1,
---		.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
---			 BIT(NL80211_IFTYPE_P2P_GO)
---	},
---	{
---		.max = 1,
---		.types = BIT(NL80211_IFTYPE_P2P_DEVICE)
---	}
---};
---
---static const struct ieee80211_iface_limit brcmf_iface_limits_sbss[] = {
---	{
---		.max = 2,
---		.types = BIT(NL80211_IFTYPE_STATION) |
---			 BIT(NL80211_IFTYPE_ADHOC) |
---			 BIT(NL80211_IFTYPE_AP)
---	},
---	{
---		.max = 1,
---		.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
---			 BIT(NL80211_IFTYPE_P2P_GO)
---	},
---	{
---		.max = 1,
---		.types = BIT(NL80211_IFTYPE_P2P_DEVICE)
---	}
---};
---static struct ieee80211_iface_combination brcmf_iface_combos[] = {
---	{
---		 .max_interfaces = BRCMF_IFACE_MAX_CNT,
---		 .num_different_channels = 1,
---		 .n_limits = ARRAY_SIZE(brcmf_iface_limits_sbss),
---		 .limits = brcmf_iface_limits_sbss,
---	}
---};
---
-- static const struct ieee80211_txrx_stypes
-- brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
-- 	[NL80211_IFTYPE_STATION] = {
--@@ -5715,6 +5666,67 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
-- 	}
-- };
-- 
--+static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
--+{
--+	struct ieee80211_iface_combination *combo = NULL;
--+	struct ieee80211_iface_limit *limits = NULL;
--+	int i = 0, max_iface_cnt;
--+
--+	combo = kzalloc(sizeof(*combo), GFP_KERNEL);
--+	if (!combo)
--+		goto err;
--+
--+	limits = kzalloc(sizeof(*limits) * 4, GFP_KERNEL);
--+	if (!limits)
--+		goto err;
--+
--+	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
--+				 BIT(NL80211_IFTYPE_ADHOC) |
--+				 BIT(NL80211_IFTYPE_AP);
--+
--+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
--+		combo->num_different_channels = 2;
--+	else
--+		combo->num_different_channels = 1;
--+
--+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
--+		limits[i].max = 1;
--+		limits[i++].types = BIT(NL80211_IFTYPE_STATION);
--+		limits[i].max = 4;
--+		limits[i++].types = BIT(NL80211_IFTYPE_AP);
--+		max_iface_cnt = 5;
--+	} else {
--+		limits[i].max = 2;
--+		limits[i++].types = BIT(NL80211_IFTYPE_STATION) |
--+				    BIT(NL80211_IFTYPE_AP);
--+		max_iface_cnt = 2;
--+	}
--+
--+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P)) {
--+		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
--+					  BIT(NL80211_IFTYPE_P2P_GO) |
--+					  BIT(NL80211_IFTYPE_P2P_DEVICE);
--+		limits[i].max = 1;
--+		limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
--+				    BIT(NL80211_IFTYPE_P2P_GO);
--+		limits[i].max = 1;
--+		limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
--+		max_iface_cnt += 2;
--+	}
--+	combo->max_interfaces = max_iface_cnt;
--+	combo->limits = limits;
--+	combo->n_limits = i;
--+
--+	wiphy->iface_combinations = combo;
--+	wiphy->n_iface_combinations = 1;
--+	return 0;
--+
--+err:
--+	kfree(limits);
--+	kfree(combo);
--+	return -ENOMEM;
--+}
--+
-- static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
-- {
-- 	/* scheduled scan settings */
--@@ -5745,7 +5757,6 @@ static void brcmf_wiphy_wowl_params(stru
-- static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
-- {
-- 	struct ieee80211_supported_band *band;
---	struct ieee80211_iface_combination ifc_combo;
-- 	__le32 bandlist[3];
-- 	u32 n_bands;
-- 	int err, i;
--@@ -5753,24 +5764,11 @@ static int brcmf_setup_wiphy(struct wiph
-- 	wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
-- 	wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
-- 	wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
---	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
---				 BIT(NL80211_IFTYPE_ADHOC) |
---				 BIT(NL80211_IFTYPE_AP) |
---				 BIT(NL80211_IFTYPE_P2P_CLIENT) |
---				 BIT(NL80211_IFTYPE_P2P_GO) |
---				 BIT(NL80211_IFTYPE_P2P_DEVICE);
---	/* need VSDB firmware feature for concurrent channels */
---	ifc_combo = brcmf_iface_combos[0];
---	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
---		ifc_combo.num_different_channels = 2;
---	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
---		ifc_combo.n_limits = ARRAY_SIZE(brcmf_iface_limits_mbss),
---		ifc_combo.limits = brcmf_iface_limits_mbss;
---	}
---	wiphy->iface_combinations = kmemdup(&ifc_combo,
---					    sizeof(ifc_combo),
---					    GFP_KERNEL);
---	wiphy->n_iface_combinations = ARRAY_SIZE(brcmf_iface_combos);
--+
--+	err = brcmf_setup_ifmodes(wiphy, ifp);
--+	if (err)
--+		return err;
--+
-- 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
-- 	wiphy->cipher_suites = __wl_cipher_suites;
-- 	wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
--@@ -6035,6 +6033,8 @@ static void brcmf_free_wiphy(struct wiph
-- 	if (!wiphy)
-- 		return;
-- 
--+	if (wiphy->iface_combinations)
--+		kfree(wiphy->iface_combinations->limits);
-- 	kfree(wiphy->iface_combinations);
-- 	if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
-- 		kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
-diff --git a/package/kernel/mac80211/patches/359-0003-brcmfmac-rework-.get_station-callback.patch b/package/kernel/mac80211/patches/359-0003-brcmfmac-rework-.get_station-callback.patch
-deleted file mode 100644
-index 7bd0686..0000000
---- a/package/kernel/mac80211/patches/359-0003-brcmfmac-rework-.get_station-callback.patch
-+++ /dev/null
-@@ -1,326 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:19 +0200
--Subject: [PATCH] brcmfmac: rework .get_station() callback
--
--The .get_station() cfg80211 callback is used in several scenarios. In
--managed mode it can obtain information about the access-point and its
--BSS parameters. In managed mode it can also obtain information about
--TDLS peers. In AP mode it can obtain information about connected
--clients.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -2395,27 +2395,80 @@ brcmf_cfg80211_reconfigure_wep(struct br
-- 		brcmf_err("set wsec error (%d)\n", err);
-- }
-- 
--+static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
--+{
--+	struct nl80211_sta_flag_update *sfu;
--+
--+	brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
--+	si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
--+	sfu = &si->sta_flags;
--+	sfu->mask = BIT(NL80211_STA_FLAG_WME) |
--+		    BIT(NL80211_STA_FLAG_AUTHENTICATED) |
--+		    BIT(NL80211_STA_FLAG_ASSOCIATED) |
--+		    BIT(NL80211_STA_FLAG_AUTHORIZED);
--+	if (fw_sta_flags & BRCMF_STA_WME)
--+		sfu->set |= BIT(NL80211_STA_FLAG_WME);
--+	if (fw_sta_flags & BRCMF_STA_AUTHE)
--+		sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
--+	if (fw_sta_flags & BRCMF_STA_ASSOC)
--+		sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
--+	if (fw_sta_flags & BRCMF_STA_AUTHO)
--+		sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
--+}
--+
--+static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
--+{
--+	struct {
--+		__le32 len;
--+		struct brcmf_bss_info_le bss_le;
--+	} *buf;
--+	u16 capability;
--+	int err;
--+
--+	buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
--+	if (!buf)
--+		return;
--+
--+	buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
--+	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
--+				     WL_BSS_INFO_MAX);
--+	if (err) {
--+		brcmf_err("Failed to get bss info (%d)\n", err);
--+		return;
--+	}
--+	si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
--+	si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
--+	si->bss_param.dtim_period = buf->bss_le.dtim_period;
--+	capability = le16_to_cpu(buf->bss_le.capability);
--+	if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
--+		si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
--+	if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
--+		si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
--+	if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
--+		si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
--+}
--+
-- static s32
-- brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
-- 			   const u8 *mac, struct station_info *sinfo)
-- {
-- 	struct brcmf_if *ifp = netdev_priv(ndev);
---	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
---	struct brcmf_scb_val_le scb_val;
---	int rssi;
---	s32 rate;
-- 	s32 err = 0;
---	u8 *bssid = profile->bssid;
-- 	struct brcmf_sta_info_le sta_info_le;
---	u32 beacon_period;
---	u32 dtim_period;
--+	u32 sta_flags;
--+	u32 is_tdls_peer;
-- 
-- 	brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
-- 	if (!check_vif_up(ifp->vif))
-- 		return -EIO;
-- 
---	if (brcmf_is_apmode(ifp->vif)) {
---		memcpy(&sta_info_le, mac, ETH_ALEN);
--+	memset(&sta_info_le, 0, sizeof(sta_info_le));
--+	memcpy(&sta_info_le, mac, ETH_ALEN);
--+	err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
--+				       &sta_info_le,
--+				       sizeof(sta_info_le));
--+	is_tdls_peer = !err;
--+	if (err) {
-- 		err = brcmf_fil_iovar_data_get(ifp, "sta_info",
-- 					       &sta_info_le,
-- 					       sizeof(sta_info_le));
--@@ -2423,73 +2476,48 @@ brcmf_cfg80211_get_station(struct wiphy
-- 			brcmf_err("GET STA INFO failed, %d\n", err);
-- 			goto done;
-- 		}
---		sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
---		sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
---		if (le32_to_cpu(sta_info_le.flags) & BRCMF_STA_ASSOC) {
---			sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
---			sinfo->connected_time = le32_to_cpu(sta_info_le.in);
---		}
---		brcmf_dbg(TRACE, "STA idle time : %d ms, connected time :%d sec\n",
---			  sinfo->inactive_time, sinfo->connected_time);
---	} else if (ifp->vif->wdev.iftype == NL80211_IFTYPE_STATION) {
---		if (memcmp(mac, bssid, ETH_ALEN)) {
---			brcmf_err("Wrong Mac address cfg_mac-%pM wl_bssid-%pM\n",
---				  mac, bssid);
---			err = -ENOENT;
---			goto done;
---		}
---		/* Report the current tx rate */
---		err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
---		if (err) {
---			brcmf_err("Could not get rate (%d)\n", err);
---			goto done;
---		} else {
--+	}
--+	brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
--+	sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
--+	sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
--+	sta_flags = le32_to_cpu(sta_info_le.flags);
--+	brcmf_convert_sta_flags(sta_flags, sinfo);
--+	sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
--+	if (is_tdls_peer)
--+		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
--+	else
--+		sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
--+	if (sta_flags & BRCMF_STA_ASSOC) {
--+		sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
--+		sinfo->connected_time = le32_to_cpu(sta_info_le.in);
--+		brcmf_fill_bss_param(ifp, sinfo);
--+	}
--+	if (sta_flags & BRCMF_STA_SCBSTATS) {
--+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
--+		sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
--+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
--+		sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
--+		sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
--+		sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
--+		sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
--+		sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
--+		if (sinfo->tx_packets) {
-- 			sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
---			sinfo->txrate.legacy = rate * 5;
---			brcmf_dbg(CONN, "Rate %d Mbps\n", rate / 2);
--+			sinfo->txrate.legacy = le32_to_cpu(sta_info_le.tx_rate);
--+			sinfo->txrate.legacy /= 100;
-- 		}
---
---		if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
---			     &ifp->vif->sme_state)) {
---			memset(&scb_val, 0, sizeof(scb_val));
---			err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
---						     &scb_val, sizeof(scb_val));
---			if (err) {
---				brcmf_err("Could not get rssi (%d)\n", err);
---				goto done;
---			} else {
---				rssi = le32_to_cpu(scb_val.val);
---				sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
---				sinfo->signal = rssi;
---				brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
---			}
---			err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_BCNPRD,
---						    &beacon_period);
---			if (err) {
---				brcmf_err("Could not get beacon period (%d)\n",
---					  err);
---				goto done;
---			} else {
---				sinfo->bss_param.beacon_interval =
---					beacon_period;
---				brcmf_dbg(CONN, "Beacon peroid %d\n",
---					  beacon_period);
---			}
---			err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_DTIMPRD,
---						    &dtim_period);
---			if (err) {
---				brcmf_err("Could not get DTIM period (%d)\n",
---					  err);
---				goto done;
---			} else {
---				sinfo->bss_param.dtim_period = dtim_period;
---				brcmf_dbg(CONN, "DTIM peroid %d\n",
---					  dtim_period);
---			}
---			sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
--+		if (sinfo->rx_packets) {
--+			sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
--+			sinfo->rxrate.legacy = le32_to_cpu(sta_info_le.rx_rate);
--+			sinfo->rxrate.legacy /= 100;
--+		}
--+		if (le16_to_cpu(sta_info_le.ver) >= 4) {
--+			sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
--+			sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
--+			sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
--+			sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
-- 		}
---	} else
---		err = -EPERM;
--+	}
-- done:
-- 	brcmf_dbg(TRACE, "Exit\n");
-- 	return err;
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--@@ -32,7 +32,11 @@
-- #define	BRCMF_BSS_INFO_VERSION	109 /* curr ver of brcmf_bss_info_le struct */
-- #define BRCMF_BSS_RSSI_ON_CHANNEL	0x0002
-- 
---#define BRCMF_STA_ASSOC			0x10		/* Associated */
--+#define BRCMF_STA_WME              0x00000002      /* WMM association */
--+#define BRCMF_STA_AUTHE            0x00000008      /* Authenticated */
--+#define BRCMF_STA_ASSOC            0x00000010      /* Associated */
--+#define BRCMF_STA_AUTHO            0x00000020      /* Authorized */
--+#define BRCMF_STA_SCBSTATS         0x00004000      /* Per STA debug stats */
-- 
-- /* size of brcmf_scan_params not including variable length array */
-- #define BRCMF_SCAN_PARAMS_FIXED_SIZE	64
--@@ -113,6 +117,7 @@
-- #define BRCMF_WOWL_MAXPATTERNSIZE	128
-- 
-- #define BRCMF_COUNTRY_BUF_SZ		4
--+#define BRCMF_ANT_MAX			4
-- 
-- /* join preference types for join_pref iovar */
-- enum brcmf_join_pref_types {
--@@ -456,25 +461,61 @@ struct brcmf_channel_info_le {
-- };
-- 
-- struct brcmf_sta_info_le {
---	__le16	ver;		/* version of this struct */
---	__le16	len;		/* length in bytes of this structure */
---	__le16	cap;		/* sta's advertised capabilities */
---	__le32	flags;		/* flags defined below */
---	__le32	idle;		/* time since data pkt rx'd from sta */
---	u8	ea[ETH_ALEN];		/* Station address */
---	__le32	count;			/* # rates in this set */
---	u8	rates[BRCMF_MAXRATES_IN_SET];	/* rates in 500kbps units */
--+	__le16 ver;		/* version of this struct */
--+	__le16 len;		/* length in bytes of this structure */
--+	__le16 cap;		/* sta's advertised capabilities */
--+	__le32 flags;		/* flags defined below */
--+	__le32 idle;		/* time since data pkt rx'd from sta */
--+	u8 ea[ETH_ALEN];		/* Station address */
--+	__le32 count;			/* # rates in this set */
--+	u8 rates[BRCMF_MAXRATES_IN_SET];	/* rates in 500kbps units */
-- 						/* w/hi bit set if basic */
---	__le32	in;		/* seconds elapsed since associated */
---	__le32	listen_interval_inms; /* Min Listen interval in ms for STA */
---	__le32	tx_pkts;	/* # of packets transmitted */
---	__le32	tx_failures;	/* # of packets failed */
---	__le32	rx_ucast_pkts;	/* # of unicast packets received */
---	__le32	rx_mcast_pkts;	/* # of multicast packets received */
---	__le32	tx_rate;	/* Rate of last successful tx frame */
---	__le32	rx_rate;	/* Rate of last successful rx frame */
---	__le32	rx_decrypt_succeeds;	/* # of packet decrypted successfully */
---	__le32	rx_decrypt_failures;	/* # of packet decrypted failed */
--+	__le32 in;		/* seconds elapsed since associated */
--+	__le32 listen_interval_inms; /* Min Listen interval in ms for STA */
--+	__le32 tx_pkts;	/* # of packets transmitted */
--+	__le32 tx_failures;	/* # of packets failed */
--+	__le32 rx_ucast_pkts;	/* # of unicast packets received */
--+	__le32 rx_mcast_pkts;	/* # of multicast packets received */
--+	__le32 tx_rate;	/* Rate of last successful tx frame */
--+	__le32 rx_rate;	/* Rate of last successful rx frame */
--+	__le32 rx_decrypt_succeeds;	/* # of packet decrypted successfully */
--+	__le32 rx_decrypt_failures;	/* # of packet decrypted failed */
--+	__le32 tx_tot_pkts;    /* # of tx pkts (ucast + mcast) */
--+	__le32 rx_tot_pkts;    /* # of data packets recvd (uni + mcast) */
--+	__le32 tx_mcast_pkts;  /* # of mcast pkts txed */
--+	__le64 tx_tot_bytes;   /* data bytes txed (ucast + mcast) */
--+	__le64 rx_tot_bytes;   /* data bytes recvd (ucast + mcast) */
--+	__le64 tx_ucast_bytes; /* data bytes txed (ucast) */
--+	__le64 tx_mcast_bytes; /* # data bytes txed (mcast) */
--+	__le64 rx_ucast_bytes; /* data bytes recvd (ucast) */
--+	__le64 rx_mcast_bytes; /* data bytes recvd (mcast) */
--+	s8 rssi[BRCMF_ANT_MAX];   /* per antenna rssi */
--+	s8 nf[BRCMF_ANT_MAX];     /* per antenna noise floor */
--+	__le16 aid;                    /* association ID */
--+	__le16 ht_capabilities;        /* advertised ht caps */
--+	__le16 vht_flags;              /* converted vht flags */
--+	__le32 tx_pkts_retry_cnt;      /* # of frames where a retry was
--+					 * exhausted.
--+					 */
--+	__le32 tx_pkts_retry_exhausted; /* # of user frames where a retry
--+					 * was exhausted
--+					 */
--+	s8 rx_lastpkt_rssi[BRCMF_ANT_MAX]; /* Per antenna RSSI of last
--+					    * received data frame.
--+					    */
--+	/* TX WLAN retry/failure statistics:
--+	 * Separated for host requested frames and locally generated frames.
--+	 * Include unicast frame only where the retries/failures can be counted.
--+	 */
--+	__le32 tx_pkts_total;          /* # user frames sent successfully */
--+	__le32 tx_pkts_retries;        /* # user frames retries */
--+	__le32 tx_pkts_fw_total;       /* # FW generated sent successfully */
--+	__le32 tx_pkts_fw_retries;     /* # retries for FW generated frames */
--+	__le32 tx_pkts_fw_retry_exhausted;     /* # FW generated where a retry
--+						* was exhausted
--+						*/
--+	__le32 rx_pkts_retried;        /* # rx with retry bit set */
--+	__le32 tx_rate_fallback;       /* lowest fallback TX rate */
-- };
-- 
-- struct brcmf_chanspec_list {
-diff --git a/package/kernel/mac80211/patches/359-0004-brcmfmac-have-sdio-return-EIO-when-device-communicat.patch b/package/kernel/mac80211/patches/359-0004-brcmfmac-have-sdio-return-EIO-when-device-communicat.patch
-deleted file mode 100644
-index 302bc3e..0000000
---- a/package/kernel/mac80211/patches/359-0004-brcmfmac-have-sdio-return-EIO-when-device-communicat.patch
-+++ /dev/null
-@@ -1,56 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:20 +0200
--Subject: [PATCH] brcmfmac: have sdio return -EIO when device communication
-- is not possible
--
--The bus interface functions txctl and rxctl may be used while the device
--can not be accessed, eg. upon driver .remove() callback. This patch will
--immediately return -EIO when this is the case which speeds up the module
--unload.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--@@ -988,6 +988,7 @@ static void brcmf_sdiod_freezer_detach(s
-- 
-- static int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev)
-- {
--+	sdiodev->state = BRCMF_SDIOD_DOWN;
-- 	if (sdiodev->bus) {
-- 		brcmf_sdio_remove(sdiodev->bus);
-- 		sdiodev->bus = NULL;
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -2820,6 +2820,8 @@ static int brcmf_sdio_bus_txdata(struct
-- 	struct brcmf_sdio *bus = sdiodev->bus;
-- 
-- 	brcmf_dbg(TRACE, "Enter: pkt: data %p len %d\n", pkt->data, pkt->len);
--+	if (sdiodev->state != BRCMF_SDIOD_DATA)
--+		return -EIO;
-- 
-- 	/* Add space for the header */
-- 	skb_push(pkt, bus->tx_hdrlen);
--@@ -2948,6 +2950,8 @@ brcmf_sdio_bus_txctl(struct device *dev,
-- 	int ret;
-- 
-- 	brcmf_dbg(TRACE, "Enter\n");
--+	if (sdiodev->state != BRCMF_SDIOD_DATA)
--+		return -EIO;
-- 
-- 	/* Send from dpc */
-- 	bus->ctrl_frame_buf = msg;
--@@ -3238,6 +3242,8 @@ brcmf_sdio_bus_rxctl(struct device *dev,
-- 	struct brcmf_sdio *bus = sdiodev->bus;
-- 
-- 	brcmf_dbg(TRACE, "Enter\n");
--+	if (sdiodev->state != BRCMF_SDIOD_DATA)
--+		return -EIO;
-- 
-- 	/* Wait until control frame is available */
-- 	timeleft = brcmf_sdio_dcmd_resp_wait(bus, &bus->rxlen, &pending);
-diff --git a/package/kernel/mac80211/patches/359-0005-ath9k-make-DMA-stop-related-messages-debug-only.patch b/package/kernel/mac80211/patches/359-0005-ath9k-make-DMA-stop-related-messages-debug-only.patch
-deleted file mode 100644
-index 34af6d2..0000000
---- a/package/kernel/mac80211/patches/359-0005-ath9k-make-DMA-stop-related-messages-debug-only.patch
-+++ /dev/null
-@@ -1,74 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Thu, 2 Jul 2015 13:35:05 +0200
--Subject: [PATCH] ath9k: make DMA stop related messages debug-only
--
--A long time ago, ath9k had issues during reset where the DMA engine
--would stay active and could potentially corrupt memory.
--To debug those issues, the driver would print warnings whenever they
--occur.
--
--Nowadays, these issues are gone and the primary cause of these messages
--is if the MAC is stuck during reset or busy processing a long
--transmission. This is fairly harmless, yet these messages continue to
--worry users.
--
--To reduce the number of bogus bug reports, turn these messages into
--debug messages and count their occurence in the "reset" debugfs file.
--
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/debug.c
--+++ b/drivers/net/wireless/ath/ath9k/debug.c
--@@ -765,6 +765,8 @@ static int read_file_reset(struct seq_fi
-- 		[RESET_TYPE_BEACON_STUCK] = "Stuck Beacon",
-- 		[RESET_TYPE_MCI] = "MCI Reset",
-- 		[RESET_TYPE_CALIBRATION] = "Calibration error",
--+		[RESET_TX_DMA_ERROR] = "Tx DMA stop error",
--+		[RESET_RX_DMA_ERROR] = "Rx DMA stop error",
-- 	};
-- 	int i;
-- 
----- a/drivers/net/wireless/ath/ath9k/debug.h
--+++ b/drivers/net/wireless/ath/ath9k/debug.h
--@@ -50,6 +50,8 @@ enum ath_reset_type {
-- 	RESET_TYPE_BEACON_STUCK,
-- 	RESET_TYPE_MCI,
-- 	RESET_TYPE_CALIBRATION,
--+	RESET_TX_DMA_ERROR,
--+	RESET_RX_DMA_ERROR,
-- 	__RESET_TYPE_MAX
-- };
-- 
----- a/drivers/net/wireless/ath/ath9k/recv.c
--+++ b/drivers/net/wireless/ath/ath9k/recv.c
--@@ -496,10 +496,9 @@ bool ath_stoprecv(struct ath_softc *sc)
-- 
-- 	if (!(ah->ah_flags & AH_UNPLUGGED) &&
-- 	    unlikely(!stopped)) {
---		ath_err(ath9k_hw_common(sc->sc_ah),
---			"Could not stop RX, we could be "
---			"confusing the DMA engine when we start RX up\n");
---		ATH_DBG_WARN_ON_ONCE(!stopped);
--+		ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
--+			"Failed to stop Rx DMA\n");
--+		RESET_STAT_INC(sc, RESET_RX_DMA_ERROR);
-- 	}
-- 	return stopped && !reset;
-- }
----- a/drivers/net/wireless/ath/ath9k/xmit.c
--+++ b/drivers/net/wireless/ath/ath9k/xmit.c
--@@ -1896,8 +1896,11 @@ bool ath_drain_all_txq(struct ath_softc
-- 			npend |= BIT(i);
-- 	}
-- 
---	if (npend)
---		ath_err(common, "Failed to stop TX DMA, queues=0x%03x!\n", npend);
--+	if (npend) {
--+		RESET_STAT_INC(sc, RESET_TX_DMA_ERROR);
--+		ath_dbg(common, RESET,
--+			"Failed to stop TX DMA, queues=0x%03x!\n", npend);
--+	}
-- 
-- 	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-- 		if (!ATH_TXQ_SETUP(sc, i))
-diff --git a/package/kernel/mac80211/patches/359-0006-brcmfmac-free-ifp-for-non-netdev-interface-in-p2p-mo.patch b/package/kernel/mac80211/patches/359-0006-brcmfmac-free-ifp-for-non-netdev-interface-in-p2p-mo.patch
-deleted file mode 100644
-index 06f2dce..0000000
---- a/package/kernel/mac80211/patches/359-0006-brcmfmac-free-ifp-for-non-netdev-interface-in-p2p-mo.patch
-+++ /dev/null
-@@ -1,44 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:21 +0200
--Subject: [PATCH] brcmfmac: free ifp for non-netdev interface in p2p module
--
--Making it more clear by freeing the ifp in same place where the
--vif object is freed.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -867,8 +867,6 @@ static void brcmf_del_if(struct brcmf_pu
-- 		}
-- 		/* unregister will take care of freeing it */
-- 		unregister_netdev(ifp->ndev);
---	} else {
---		kfree(ifp);
-- 	}
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2238,6 +2238,7 @@ static void brcmf_p2p_delete_p2pdev(stru
-- {
-- 	cfg80211_unregister_wdev(&vif->wdev);
-- 	p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
--+	kfree(vif->ifp);
-- 	brcmf_free_vif(vif);
-- }
-- 
--@@ -2361,6 +2362,8 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 		break;
-- 
-- 	case NL80211_IFTYPE_P2P_DEVICE:
--+		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
--+		brcmf_p2p_deinit_discovery(p2p);
-- 		brcmf_p2p_delete_p2pdev(p2p, vif);
-- 		return 0;
-- 	default:
-diff --git a/package/kernel/mac80211/patches/359-0007-brcmfmac-move-p2p-attach-detach-functions.patch b/package/kernel/mac80211/patches/359-0007-brcmfmac-move-p2p-attach-detach-functions.patch
-deleted file mode 100644
-index 0a6e093..0000000
---- a/package/kernel/mac80211/patches/359-0007-brcmfmac-move-p2p-attach-detach-functions.patch
-+++ /dev/null
-@@ -1,225 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:22 +0200
--Subject: [PATCH] brcmfmac: move p2p attach/detach functions
--
--Moving two functions in p2p.c as is so next change will be
--easier to review.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -1908,105 +1908,6 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probere
-- 
-- 
-- /**
--- * brcmf_p2p_attach() - attach for P2P.
--- *
--- * @cfg: driver private data for cfg80211 interface.
--- */
---s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
---{
---	struct brcmf_if *pri_ifp;
---	struct brcmf_if *p2p_ifp;
---	struct brcmf_cfg80211_vif *p2p_vif;
---	struct brcmf_p2p_info *p2p;
---	struct brcmf_pub *drvr;
---	s32 bssidx;
---	s32 err = 0;
---
---	p2p = &cfg->p2p;
---	p2p->cfg = cfg;
---
---	drvr = cfg->pub;
---
---	pri_ifp = drvr->iflist[0];
---	p2p_ifp = drvr->iflist[1];
---
---	p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
---
---	if (p2p_ifp) {
---		p2p_vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_P2P_DEVICE,
---					  false);
---		if (IS_ERR(p2p_vif)) {
---			brcmf_err("could not create discovery vif\n");
---			err = -ENOMEM;
---			goto exit;
---		}
---
---		p2p_vif->ifp = p2p_ifp;
---		p2p_ifp->vif = p2p_vif;
---		p2p_vif->wdev.netdev = p2p_ifp->ndev;
---		p2p_ifp->ndev->ieee80211_ptr = &p2p_vif->wdev;
---		SET_NETDEV_DEV(p2p_ifp->ndev, wiphy_dev(cfg->wiphy));
---
---		p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = p2p_vif;
---
---		brcmf_p2p_generate_bss_mac(p2p, NULL);
---		memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
---		brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
---
---		/* Initialize P2P Discovery in the firmware */
---		err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
---		if (err < 0) {
---			brcmf_err("set p2p_disc error\n");
---			brcmf_free_vif(p2p_vif);
---			goto exit;
---		}
---		/* obtain bsscfg index for P2P discovery */
---		err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
---		if (err < 0) {
---			brcmf_err("retrieving discover bsscfg index failed\n");
---			brcmf_free_vif(p2p_vif);
---			goto exit;
---		}
---		/* Verify that firmware uses same bssidx as driver !! */
---		if (p2p_ifp->bssidx != bssidx) {
---			brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
---				  bssidx, p2p_ifp->bssidx);
---			brcmf_free_vif(p2p_vif);
---			goto exit;
---		}
---
---		init_completion(&p2p->send_af_done);
---		INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
---		init_completion(&p2p->afx_hdl.act_frm_scan);
---		init_completion(&p2p->wait_next_af);
---	}
---exit:
---	return err;
---}
---
---
---/**
--- * brcmf_p2p_detach() - detach P2P.
--- *
--- * @p2p: P2P specific data.
--- */
---void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
---{
---	struct brcmf_cfg80211_vif *vif;
---
---	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
---	if (vif != NULL) {
---		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
---		brcmf_p2p_deinit_discovery(p2p);
---		/* remove discovery interface */
---		brcmf_free_vif(vif);
---		p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
---	}
---	/* just set it all to zero */
---	memset(p2p, 0, sizeof(*p2p));
---}
---
---/**
--  * brcmf_p2p_get_current_chanspec() - Get current operation channel.
--  *
--  * @p2p: P2P specific data.
--@@ -2425,3 +2326,102 @@ void brcmf_p2p_stop_device(struct wiphy
-- 	clear_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state);
-- 	mutex_unlock(&cfg->usr_sync);
-- }
--+
--+/**
--+ * brcmf_p2p_attach() - attach for P2P.
--+ *
--+ * @cfg: driver private data for cfg80211 interface.
--+ */
--+s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
--+{
--+	struct brcmf_if *pri_ifp;
--+	struct brcmf_if *p2p_ifp;
--+	struct brcmf_cfg80211_vif *p2p_vif;
--+	struct brcmf_p2p_info *p2p;
--+	struct brcmf_pub *drvr;
--+	s32 bssidx;
--+	s32 err = 0;
--+
--+	p2p = &cfg->p2p;
--+	p2p->cfg = cfg;
--+
--+	drvr = cfg->pub;
--+
--+	pri_ifp = drvr->iflist[0];
--+	p2p_ifp = drvr->iflist[1];
--+
--+	p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
--+
--+	if (p2p_ifp) {
--+		p2p_vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_P2P_DEVICE,
--+					  false);
--+		if (IS_ERR(p2p_vif)) {
--+			brcmf_err("could not create discovery vif\n");
--+			err = -ENOMEM;
--+			goto exit;
--+		}
--+
--+		p2p_vif->ifp = p2p_ifp;
--+		p2p_ifp->vif = p2p_vif;
--+		p2p_vif->wdev.netdev = p2p_ifp->ndev;
--+		p2p_ifp->ndev->ieee80211_ptr = &p2p_vif->wdev;
--+		SET_NETDEV_DEV(p2p_ifp->ndev, wiphy_dev(cfg->wiphy));
--+
--+		p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = p2p_vif;
--+
--+		brcmf_p2p_generate_bss_mac(p2p, NULL);
--+		memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
--+		brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
--+
--+		/* Initialize P2P Discovery in the firmware */
--+		err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
--+		if (err < 0) {
--+			brcmf_err("set p2p_disc error\n");
--+			brcmf_free_vif(p2p_vif);
--+			goto exit;
--+		}
--+		/* obtain bsscfg index for P2P discovery */
--+		err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
--+		if (err < 0) {
--+			brcmf_err("retrieving discover bsscfg index failed\n");
--+			brcmf_free_vif(p2p_vif);
--+			goto exit;
--+		}
--+		/* Verify that firmware uses same bssidx as driver !! */
--+		if (p2p_ifp->bssidx != bssidx) {
--+			brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
--+				  bssidx, p2p_ifp->bssidx);
--+			brcmf_free_vif(p2p_vif);
--+			goto exit;
--+		}
--+
--+		init_completion(&p2p->send_af_done);
--+		INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
--+		init_completion(&p2p->afx_hdl.act_frm_scan);
--+		init_completion(&p2p->wait_next_af);
--+	}
--+exit:
--+	return err;
--+}
--+
--+/**
--+ * brcmf_p2p_detach() - detach P2P.
--+ *
--+ * @p2p: P2P specific data.
--+ */
--+void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
--+{
--+	struct brcmf_cfg80211_vif *vif;
--+
--+	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
--+	if (vif != NULL) {
--+		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
--+		brcmf_p2p_deinit_discovery(p2p);
--+		/* remove discovery interface */
--+		brcmf_free_vif(vif);
--+		p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
--+	}
--+	/* just set it all to zero */
--+	memset(p2p, 0, sizeof(*p2p));
--+}
--+
-diff --git a/package/kernel/mac80211/patches/359-0008-brcmfmac-assure-p2pdev-is-unregistered-upon-driver-u.patch b/package/kernel/mac80211/patches/359-0008-brcmfmac-assure-p2pdev-is-unregistered-upon-driver-u.patch
-deleted file mode 100644
-index 72e8eed..0000000
---- a/package/kernel/mac80211/patches/359-0008-brcmfmac-assure-p2pdev-is-unregistered-upon-driver-u.patch
-+++ /dev/null
-@@ -1,63 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 11 Jun 2015 00:12:23 +0200
--Subject: [PATCH] brcmfmac: assure p2pdev is unregistered upon driver
-- unload
--
--When unloading the driver with a p2pdev interface it resulted in
--a warning upon calling wiphy_unregister() and subsequently a crash
--in the driver. This patch assures the p2pdev is unregistered calling
--unregister_wdev() before doing the wiphy_unregister().
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6206,10 +6206,8 @@ void brcmf_cfg80211_detach(struct brcmf_
-- 	if (!cfg)
-- 		return;
-- 
---	WARN_ON(!list_empty(&cfg->vif_list));
---	wiphy_unregister(cfg->wiphy);
-- 	brcmf_btcoex_detach(cfg);
---	brcmf_p2p_detach(&cfg->p2p);
--+	wiphy_unregister(cfg->wiphy);
-- 	wl_deinit_priv(cfg);
-- 	brcmf_free_wiphy(cfg->wiphy);
-- }
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -1098,6 +1098,7 @@ void brcmf_detach(struct device *dev)
-- 
-- 	/* stop firmware event handling */
-- 	brcmf_fweh_detach(drvr);
--+	brcmf_p2p_detach(&drvr->config->p2p);
-- 
-- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -16,6 +16,7 @@
-- #include <linux/slab.h>
-- #include <linux/netdevice.h>
-- #include <linux/etherdevice.h>
--+#include <linux/rtnetlink.h>
-- #include <net/cfg80211.h>
-- 
-- #include <brcmu_wifi.h>
--@@ -2418,8 +2419,9 @@ void brcmf_p2p_detach(struct brcmf_p2p_i
-- 		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
-- 		brcmf_p2p_deinit_discovery(p2p);
-- 		/* remove discovery interface */
---		brcmf_free_vif(vif);
---		p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
--+		rtnl_lock();
--+		brcmf_p2p_delete_p2pdev(p2p, vif);
--+		rtnl_unlock();
-- 	}
-- 	/* just set it all to zero */
-- 	memset(p2p, 0, sizeof(*p2p));
-diff --git a/package/kernel/mac80211/patches/360-0001-brcmfmac-fix-double-free-of-p2pdev-interface.patch b/package/kernel/mac80211/patches/360-0001-brcmfmac-fix-double-free-of-p2pdev-interface.patch
-deleted file mode 100644
-index 179c77e..0000000
---- a/package/kernel/mac80211/patches/360-0001-brcmfmac-fix-double-free-of-p2pdev-interface.patch
-+++ /dev/null
-@@ -1,27 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Mon, 15 Jun 2015 22:48:38 +0200
--Subject: [PATCH] brcmfmac: fix double free of p2pdev interface
--
--When freeing the driver ifp pointer it should also be removed from
--the driver interface list, which is what brcmf_remove_interface()
--does. Otherwise, the ifp pointer will be freed twice triggering
--a kernel oops.
--
--Fixes: f37d69a4babc ("brcmfmac: free ifp for non-netdev interface in p2p module")
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2140,7 +2140,7 @@ static void brcmf_p2p_delete_p2pdev(stru
-- {
-- 	cfg80211_unregister_wdev(&vif->wdev);
-- 	p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
---	kfree(vif->ifp);
--+	brcmf_remove_interface(vif->ifp->drvr, vif->ifp->bssidx);
-- 	brcmf_free_vif(vif);
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch b/package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch
-deleted file mode 100644
-index e4f88b5..0000000
---- a/package/kernel/mac80211/patches/360-0002-brcmfmac-make-brcmf_p2p_detach-call-conditional.patch
-+++ /dev/null
-@@ -1,29 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Mon, 15 Jun 2015 22:48:39 +0200
--Subject: [PATCH] brcmfmac: make brcmf_p2p_detach() call conditional
--
--During verification of error handling in brcmf_cfg80211_attach() a
--null pointer dereference occurred upon calling brcmf_p2p_detach()
--from brcmf_detach(). This should only be called when the
--brcmf_cfg80211_attach() has succeeded.
--
--Fixes: f7a40873d2fa ("brcmfmac: assure p2pdev is unregistered upon driver unload")
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -1098,7 +1098,8 @@ void brcmf_detach(struct device *dev)
-- 
-- 	/* stop firmware event handling */
-- 	brcmf_fweh_detach(drvr);
---	brcmf_p2p_detach(&drvr->config->p2p);
--+	if (drvr->config)
--+		brcmf_p2p_detach(&drvr->config->p2p);
-- 
-- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
-- 
-diff --git a/package/kernel/mac80211/patches/361-brcmfmac-set-wiphy-s-addresses-to-provide-valid-MACs.patch b/package/kernel/mac80211/patches/361-brcmfmac-set-wiphy-s-addresses-to-provide-valid-MACs.patch
-deleted file mode 100644
-index 0a81237..0000000
---- a/package/kernel/mac80211/patches/361-brcmfmac-set-wiphy-s-addresses-to-provide-valid-MACs.patch
-+++ /dev/null
-@@ -1,67 +0,0 @@
--From: Rafa? Mi?ecki <zajec5@gmail.com>
--Date: Thu, 9 Jul 2015 17:07:08 +0200
--Subject: [PATCH] brcmfmac: set wiphy's addresses to provide valid MACs
--
--Broadcom's firmware requires every BSS to use MAC address with unique
--last few bits. The amount of bits may depend on a particular firmware,
--it was verified to be 2 for BCM43602 one.
--If this condition won't be fulfilled firmware will reject such MAC:
--brcmfmac: _brcmf_set_mac_address: Setting cur_etheraddr failed, -52
--
--We don't want to simply set addr_mask as it would also disallow using
--locally administrated bit. Instead let's build a list of addresses
--manually enabling 0x2 bit for extra interfaces.
--
--Signed-off-by: Rafa? Mi?ecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -5784,6 +5784,7 @@ static void brcmf_wiphy_wowl_params(stru
-- 
-- static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
-- {
--+	struct brcmf_pub *drvr = ifp->drvr;
-- 	struct ieee80211_supported_band *band;
-- 	__le32 bandlist[3];
-- 	u32 n_bands;
--@@ -5797,6 +5798,19 @@ static int brcmf_setup_wiphy(struct wiph
-- 	if (err)
-- 		return err;
-- 
--+	for (i = 0; i < wiphy->iface_combinations->max_interfaces &&
--+	     i < ARRAY_SIZE(drvr->addresses); i++) {
--+		u8 *addr = drvr->addresses[i].addr;
--+
--+		memcpy(addr, drvr->mac, ETH_ALEN);
--+		if (i) {
--+			addr[0] |= BIT(1);
--+			addr[ETH_ALEN - 1] ^= i;
--+		}
--+	}
--+	wiphy->addresses = drvr->addresses;
--+	wiphy->n_addresses = i;
--+
-- 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
-- 	wiphy->cipher_suites = __wl_cipher_suites;
-- 	wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -21,6 +21,7 @@
-- #ifndef BRCMFMAC_CORE_H
-- #define BRCMFMAC_CORE_H
-- 
--+#include <net/cfg80211.h>
-- #include "fweh.h"
-- 
-- #define TOE_TX_CSUM_OL		0x00000001
--@@ -118,6 +119,8 @@ struct brcmf_pub {
-- 	/* Multicast data packets sent to dongle */
-- 	unsigned long tx_multicast;
-- 
--+	struct mac_address addresses[BRCMF_MAX_IFS];
--+
-- 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
-- 
-- 	struct mutex proto_block;
-diff --git a/package/kernel/mac80211/patches/362-brcmfmac-dhd_sdio.c-use-existing-atomic_or-primitive.patch b/package/kernel/mac80211/patches/362-brcmfmac-dhd_sdio.c-use-existing-atomic_or-primitive.patch
-deleted file mode 100644
-index e44f121..0000000
---- a/package/kernel/mac80211/patches/362-brcmfmac-dhd_sdio.c-use-existing-atomic_or-primitive.patch
-+++ /dev/null
-@@ -1,45 +0,0 @@
--From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
--Date: Thu, 9 Jul 2015 13:43:18 +0530
--Subject: [PATCH] brcmfmac: dhd_sdio.c: use existing atomic_or primitive
--
--There's already a generic implementation so use that instead.
--
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -2564,15 +2564,6 @@ static inline void brcmf_sdio_clrintr(st
-- 	}
-- }
-- 
---static void atomic_orr(int val, atomic_t *v)
---{
---	int old_val;
---
---	old_val = atomic_read(v);
---	while (atomic_cmpxchg(v, old_val, val | old_val) != old_val)
---		old_val = atomic_read(v);
---}
---
-- static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
-- {
-- 	struct brcmf_core *buscore;
--@@ -2595,7 +2586,7 @@ static int brcmf_sdio_intr_rstatus(struc
-- 	if (val) {
-- 		brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
-- 		bus->sdcnt.f1regdata++;
---		atomic_orr(val, &bus->intstatus);
--+		atomic_or(val, &bus->intstatus);
-- 	}
-- 
-- 	return ret;
--@@ -2712,7 +2703,7 @@ static void brcmf_sdio_dpc(struct brcmf_
-- 
-- 	/* Keep still-pending events for next scheduling */
-- 	if (intstatus)
---		atomic_orr(intstatus, &bus->intstatus);
--+		atomic_or(intstatus, &bus->intstatus);
-- 
-- 	brcmf_sdio_clrintr(bus);
-- 
-diff --git a/package/kernel/mac80211/patches/363-0001-brcmfmac-check-all-combinations-when-setting-wiphy-s.patch b/package/kernel/mac80211/patches/363-0001-brcmfmac-check-all-combinations-when-setting-wiphy-s.patch
-deleted file mode 100644
-index 76ca143..0000000
---- a/package/kernel/mac80211/patches/363-0001-brcmfmac-check-all-combinations-when-setting-wiphy-s.patch
-+++ /dev/null
-@@ -1,46 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Thu, 20 Aug 2015 00:16:42 +0200
--Subject: [PATCH] brcmfmac: check all combinations when setting wiphy's
-- addresses
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--Broadcom is working on better reflection of interface combinations. With
--upcoming patches we may have 1st combination supporting less interfaces
--than others.
--To don't run out of addresses check all combinations to find the one
--with the greatest max_interfaces value.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -5785,7 +5785,9 @@ static void brcmf_wiphy_wowl_params(stru
-- static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
-- {
-- 	struct brcmf_pub *drvr = ifp->drvr;
--+	const struct ieee80211_iface_combination *combo;
-- 	struct ieee80211_supported_band *band;
--+	u16 max_interfaces = 0;
-- 	__le32 bandlist[3];
-- 	u32 n_bands;
-- 	int err, i;
--@@ -5798,8 +5800,13 @@ static int brcmf_setup_wiphy(struct wiph
-- 	if (err)
-- 		return err;
-- 
---	for (i = 0; i < wiphy->iface_combinations->max_interfaces &&
---	     i < ARRAY_SIZE(drvr->addresses); i++) {
--+	for (i = 0, combo = wiphy->iface_combinations;
--+	     i < wiphy->n_iface_combinations; i++, combo++) {
--+		max_interfaces = max(max_interfaces, combo->max_interfaces);
--+	}
--+
--+	for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
--+	     i++) {
-- 		u8 *addr = drvr->addresses[i].addr;
-- 
-- 		memcpy(addr, drvr->mac, ETH_ALEN);
-diff --git a/package/kernel/mac80211/patches/363-0002-brcmfmac-correct-interface-combination-info.patch b/package/kernel/mac80211/patches/363-0002-brcmfmac-correct-interface-combination-info.patch
-deleted file mode 100644
-index c4a0720..0000000
---- a/package/kernel/mac80211/patches/363-0002-brcmfmac-correct-interface-combination-info.patch
-+++ /dev/null
-@@ -1,204 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 20 Aug 2015 22:06:03 +0200
--Subject: [PATCH] brcmfmac: correct interface combination info
--
--The interface combination provided by brcmfmac did not truly reflect
--the combinations supported by driver and/or firmware.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -5694,63 +5694,132 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
-- 	}
-- };
-- 
--+/**
--+ * brcmf_setup_ifmodes() - determine interface modes and combinations.
--+ *
--+ * @wiphy: wiphy object.
--+ * @ifp: interface object needed for feat module api.
--+ *
--+ * The interface modes and combinations are determined dynamically here
--+ * based on firmware functionality.
--+ *
--+ * no p2p and no mbss:
--+ *
--+ *	#STA <= 1, #AP <= 1, channels = 1, 2 total
--+ *
--+ * no p2p and mbss:
--+ *
--+ *	#STA <= 1, #AP <= 1, channels = 1, 2 total
--+ *	#AP <= 4, matching BI, channels = 1, 4 total
--+ *
--+ * p2p, no mchan, and mbss:
--+ *
--+ *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
--+ *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
--+ *	#AP <= 4, matching BI, channels = 1, 4 total
--+ *
--+ * p2p, mchan, and mbss:
--+ *
--+ *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
--+ *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
--+ *	#AP <= 4, matching BI, channels = 1, 4 total
--+ */
-- static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
-- {
-- 	struct ieee80211_iface_combination *combo = NULL;
---	struct ieee80211_iface_limit *limits = NULL;
---	int i = 0, max_iface_cnt;
--+	struct ieee80211_iface_limit *c0_limits = NULL;
--+	struct ieee80211_iface_limit *p2p_limits = NULL;
--+	struct ieee80211_iface_limit *mbss_limits = NULL;
--+	bool mbss, p2p;
--+	int i, c, n_combos;
-- 
---	combo = kzalloc(sizeof(*combo), GFP_KERNEL);
--+	mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
--+	p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
--+
--+	n_combos = 1 + !!p2p + !!mbss;
--+	combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
-- 	if (!combo)
-- 		goto err;
-- 
---	limits = kzalloc(sizeof(*limits) * 4, GFP_KERNEL);
---	if (!limits)
--+	c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
--+	if (!c0_limits)
-- 		goto err;
-- 
--+	if (p2p) {
--+		p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
--+		if (!p2p_limits)
--+			goto err;
--+	}
--+
--+	if (mbss) {
--+		mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
--+		if (!mbss_limits)
--+			goto err;
--+	}
--+
-- 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
-- 				 BIT(NL80211_IFTYPE_ADHOC) |
-- 				 BIT(NL80211_IFTYPE_AP);
-- 
---	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
---		combo->num_different_channels = 2;
---	else
---		combo->num_different_channels = 1;
---
---	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
---		limits[i].max = 1;
---		limits[i++].types = BIT(NL80211_IFTYPE_STATION);
---		limits[i].max = 4;
---		limits[i++].types = BIT(NL80211_IFTYPE_AP);
---		max_iface_cnt = 5;
---	} else {
---		limits[i].max = 2;
---		limits[i++].types = BIT(NL80211_IFTYPE_STATION) |
---				    BIT(NL80211_IFTYPE_AP);
---		max_iface_cnt = 2;
---	}
---
---	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P)) {
--+	c = 0;
--+	i = 0;
--+	combo[c].num_different_channels = 1;
--+	c0_limits[i].max = 1;
--+	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
--+	if (p2p) {
--+		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
--+			combo[c].num_different_channels = 2;
-- 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
-- 					  BIT(NL80211_IFTYPE_P2P_GO) |
-- 					  BIT(NL80211_IFTYPE_P2P_DEVICE);
---		limits[i].max = 1;
---		limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
---				    BIT(NL80211_IFTYPE_P2P_GO);
---		limits[i].max = 1;
---		limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
---		max_iface_cnt += 2;
---	}
---	combo->max_interfaces = max_iface_cnt;
---	combo->limits = limits;
---	combo->n_limits = i;
--+		c0_limits[i].max = 1;
--+		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
--+		c0_limits[i].max = 1;
--+		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
--+				       BIT(NL80211_IFTYPE_P2P_GO);
--+	} else {
--+		c0_limits[i].max = 1;
--+		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
--+	}
--+	combo[c].max_interfaces = i;
--+	combo[c].n_limits = i;
--+	combo[c].limits = c0_limits;
--+
--+	if (p2p) {
--+		c++;
--+		i = 0;
--+		combo[c].num_different_channels = 1;
--+		p2p_limits[i].max = 1;
--+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
--+		p2p_limits[i].max = 1;
--+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
--+		p2p_limits[i].max = 1;
--+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
--+		p2p_limits[i].max = 1;
--+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
--+		combo[c].max_interfaces = i;
--+		combo[c].n_limits = i;
--+		combo[c].limits = p2p_limits;
--+	}
-- 
--+	if (mbss) {
--+		c++;
--+		combo[c].beacon_int_infra_match = true;
--+		combo[c].num_different_channels = 1;
--+		mbss_limits[0].max = 4;
--+		mbss_limits[0].types = BIT(NL80211_IFTYPE_AP);
--+		combo[c].max_interfaces = 4;
--+		combo[c].n_limits = 1;
--+		combo[c].limits = mbss_limits;
--+	}
--+	wiphy->n_iface_combinations = n_combos;
-- 	wiphy->iface_combinations = combo;
---	wiphy->n_iface_combinations = 1;
-- 	return 0;
-- 
-- err:
---	kfree(limits);
--+	kfree(c0_limits);
--+	kfree(p2p_limits);
--+	kfree(mbss_limits);
-- 	kfree(combo);
-- 	return -ENOMEM;
-- }
--@@ -6079,11 +6148,15 @@ static void brcmf_cfg80211_reg_notifier(
-- 
-- static void brcmf_free_wiphy(struct wiphy *wiphy)
-- {
--+	int i;
--+
-- 	if (!wiphy)
-- 		return;
-- 
---	if (wiphy->iface_combinations)
---		kfree(wiphy->iface_combinations->limits);
--+	if (wiphy->iface_combinations) {
--+		for (i = 0; i < wiphy->n_iface_combinations; i++)
--+			kfree(wiphy->iface_combinations[i].limits);
--+	}
-- 	kfree(wiphy->iface_combinations);
-- 	if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
-- 		kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
-diff --git a/package/kernel/mac80211/patches/363-0003-brcmfmac-add-debugfs-entry-for-msgbuf-statistics.patch b/package/kernel/mac80211/patches/363-0003-brcmfmac-add-debugfs-entry-for-msgbuf-statistics.patch
-deleted file mode 100644
-index 9768ef2..0000000
---- a/package/kernel/mac80211/patches/363-0003-brcmfmac-add-debugfs-entry-for-msgbuf-statistics.patch
-+++ /dev/null
-@@ -1,87 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Thu, 20 Aug 2015 22:06:04 +0200
--Subject: [PATCH] brcmfmac: add debugfs entry for msgbuf statistics
--
--Expose ring buffer read/write pointers and other useful statistics
--through debugfs.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -1360,6 +1360,60 @@ void brcmf_msgbuf_delete_flowring(struct
-- 	}
-- }
-- 
--+#ifdef DEBUG
--+static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
--+{
--+	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
--+	struct brcmf_pub *drvr = bus_if->drvr;
--+	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
--+	struct brcmf_commonring *commonring;
--+	u16 i;
--+	struct brcmf_flowring_ring *ring;
--+	struct brcmf_flowring_hash *hash;
--+
--+	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
--+	seq_printf(seq, "h2d_ctl_submit: rp %4u, wp %4u, depth %4u\n",
--+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
--+	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
--+	seq_printf(seq, "h2d_rx_submit:  rp %4u, wp %4u, depth %4u\n",
--+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
--+	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
--+	seq_printf(seq, "d2h_ctl_cmplt:  rp %4u, wp %4u, depth %4u\n",
--+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
--+	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
--+	seq_printf(seq, "d2h_tx_cmplt:   rp %4u, wp %4u, depth %4u\n",
--+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
--+	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
--+	seq_printf(seq, "d2h_rx_cmplt:   rp %4u, wp %4u, depth %4u\n",
--+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
--+
--+	seq_printf(seq, "\nh2d_flowrings: depth %u\n",
--+		   BRCMF_H2D_TXFLOWRING_MAX_ITEM);
--+	seq_puts(seq, "Active flowrings:\n");
--+	hash = msgbuf->flow->hash;
--+	for (i = 0; i < msgbuf->flow->nrofrings; i++) {
--+		if (!msgbuf->flow->rings[i])
--+			continue;
--+		ring = msgbuf->flow->rings[i];
--+		if (ring->status != RING_OPEN)
--+			continue;
--+		commonring = msgbuf->flowrings[i];
--+		hash = &msgbuf->flow->hash[ring->hash_id];
--+		seq_printf(seq, "id %3u: rp %4u, wp %4u, qlen %4u, blocked %u\n"
--+				"        ifidx %u, fifo %u, da %pM\n",
--+				i, commonring->r_ptr, commonring->w_ptr,
--+				skb_queue_len(&ring->skblist), ring->blocked,
--+				hash->ifidx, hash->fifo, hash->mac);
--+	}
--+
--+	return 0;
--+}
--+#else
--+static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
--+{
--+	return 0;
--+}
--+#endif
-- 
-- int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
-- {
--@@ -1460,6 +1514,8 @@ int brcmf_proto_msgbuf_attach(struct brc
-- 	spin_lock_init(&msgbuf->flowring_work_lock);
-- 	INIT_LIST_HEAD(&msgbuf->work_queue);
-- 
--+	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
--+
-- 	return 0;
-- 
-- fail:
-diff --git a/package/kernel/mac80211/patches/363-0004-brcmfmac-make-use-of-cfg80211_check_combinations.patch b/package/kernel/mac80211/patches/363-0004-brcmfmac-make-use-of-cfg80211_check_combinations.patch
-deleted file mode 100644
-index 2b84cf9..0000000
---- a/package/kernel/mac80211/patches/363-0004-brcmfmac-make-use-of-cfg80211_check_combinations.patch
-+++ /dev/null
-@@ -1,83 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 20 Aug 2015 22:06:05 +0200
--Subject: [PATCH] brcmfmac: make use of cfg80211_check_combinations()
--
--Use cfg80211_check_combinations() so we can bail out early when an
--interface add or change results in an invalid combination.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -469,6 +469,36 @@ brcmf_find_wpsie(const u8 *parse, u32 le
-- 	return NULL;
-- }
-- 
--+static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
--+				     struct brcmf_cfg80211_vif *vif,
--+				     enum nl80211_iftype new_type)
--+{
--+	int iftype_num[NUM_NL80211_IFTYPES];
--+	struct brcmf_cfg80211_vif *pos;
--+
--+	memset(&iftype_num[0], 0, sizeof(iftype_num));
--+	list_for_each_entry(pos, &cfg->vif_list, list)
--+		if (pos == vif)
--+			iftype_num[new_type]++;
--+		else
--+			iftype_num[pos->wdev.iftype]++;
--+
--+	return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
--+}
--+
--+static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
--+				  enum nl80211_iftype new_type)
--+{
--+	int iftype_num[NUM_NL80211_IFTYPES];
--+	struct brcmf_cfg80211_vif *pos;
--+
--+	memset(&iftype_num[0], 0, sizeof(iftype_num));
--+	list_for_each_entry(pos, &cfg->vif_list, list)
--+		iftype_num[pos->wdev.iftype]++;
--+
--+	iftype_num[new_type]++;
--+	return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
--+}
-- 
-- static void convert_key_from_CPU(struct brcmf_wsec_key *key,
-- 				 struct brcmf_wsec_key_le *key_le)
--@@ -662,8 +692,14 @@ static struct wireless_dev *brcmf_cfg802
-- 						     struct vif_params *params)
-- {
-- 	struct wireless_dev *wdev;
--+	int err;
-- 
-- 	brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
--+	err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
--+	if (err) {
--+		brcmf_err("iface validation failed: err=%d\n", err);
--+		return ERR_PTR(err);
--+	}
-- 	switch (type) {
-- 	case NL80211_IFTYPE_ADHOC:
-- 	case NL80211_IFTYPE_STATION:
--@@ -822,8 +858,12 @@ brcmf_cfg80211_change_iface(struct wiphy
-- 	s32 ap = 0;
-- 	s32 err = 0;
-- 
---	brcmf_dbg(TRACE, "Enter, ndev=%p, type=%d\n", ndev, type);
---
--+	brcmf_dbg(TRACE, "Enter, idx=%d, type=%d\n", ifp->bssidx, type);
--+	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
--+	if (err) {
--+		brcmf_err("iface validation failed: err=%d\n", err);
--+		return err;
--+	}
-- 	switch (type) {
-- 	case NL80211_IFTYPE_MONITOR:
-- 	case NL80211_IFTYPE_WDS:
-diff --git a/package/kernel/mac80211/patches/363-0005-brcmfmac-block-the-correct-flowring-when-backup-queu.patch b/package/kernel/mac80211/patches/363-0005-brcmfmac-block-the-correct-flowring-when-backup-queu.patch
-deleted file mode 100644
-index 2d5f7b9..0000000
---- a/package/kernel/mac80211/patches/363-0005-brcmfmac-block-the-correct-flowring-when-backup-queu.patch
-+++ /dev/null
-@@ -1,48 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Thu, 20 Aug 2015 22:06:06 +0200
--Subject: [PATCH] brcmfmac: block the correct flowring when backup queue
-- overflow
--
--brcmf_flowring_block blocks the last active flowring under the same
--interface instead of the one provided by caller. This could lead to a
--dead lock of netif stop if there are more than one flowring under the
--interface and the traffic is high enough so brcmf_flowring_enqueue can
--not unblock the ring right away.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
--@@ -194,11 +194,15 @@ static void brcmf_flowring_block(struct
-- 	spin_lock_irqsave(&flow->block_lock, flags);
-- 
-- 	ring = flow->rings[flowid];
--+	if (ring->blocked == blocked) {
--+		spin_unlock_irqrestore(&flow->block_lock, flags);
--+		return;
--+	}
-- 	ifidx = brcmf_flowring_ifidx_get(flow, flowid);
-- 
-- 	currently_blocked = false;
-- 	for (i = 0; i < flow->nrofrings; i++) {
---		if (flow->rings[i]) {
--+		if ((flow->rings[i]) && (i != flowid)) {
-- 			ring = flow->rings[i];
-- 			if ((ring->status == RING_OPEN) &&
-- 			    (brcmf_flowring_ifidx_get(flow, i) == ifidx)) {
--@@ -209,8 +213,8 @@ static void brcmf_flowring_block(struct
-- 			}
-- 		}
-- 	}
---	ring->blocked = blocked;
---	if (currently_blocked == blocked) {
--+	flow->rings[flowid]->blocked = blocked;
--+	if (currently_blocked) {
-- 		spin_unlock_irqrestore(&flow->block_lock, flags);
-- 		return;
-- 	}
-diff --git a/package/kernel/mac80211/patches/363-0006-brcmfmac-bump-highest-event-number-for-4339-firmware.patch b/package/kernel/mac80211/patches/363-0006-brcmfmac-bump-highest-event-number-for-4339-firmware.patch
-deleted file mode 100644
-index 7378401..0000000
---- a/package/kernel/mac80211/patches/363-0006-brcmfmac-bump-highest-event-number-for-4339-firmware.patch
-+++ /dev/null
-@@ -1,52 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 20 Aug 2015 22:06:07 +0200
--Subject: [PATCH] brcmfmac: bump highest event number for 4339 firmware
--
--The event mask length is determined by the highest event number
--that is specified in the driver. When this length is shorter than
--firmware expects setting event mask will fail and device becomes
--pretty useless. This issue was reported with bcm4339 firmware that
--was recently released.
--
--Reported-by: Pontus Fuchs <pontusf@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
--@@ -85,7 +85,6 @@ struct brcmf_event;
-- 	BRCMF_ENUM_DEF(IF, 54) \
-- 	BRCMF_ENUM_DEF(P2P_DISC_LISTEN_COMPLETE, 55) \
-- 	BRCMF_ENUM_DEF(RSSI, 56) \
---	BRCMF_ENUM_DEF(PFN_SCAN_COMPLETE, 57) \
-- 	BRCMF_ENUM_DEF(EXTLOG_MSG, 58) \
-- 	BRCMF_ENUM_DEF(ACTION_FRAME, 59) \
-- 	BRCMF_ENUM_DEF(ACTION_FRAME_COMPLETE, 60) \
--@@ -103,8 +102,7 @@ struct brcmf_event;
-- 	BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
-- 	BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
-- 	BRCMF_ENUM_DEF(TDLS_PEER_EVENT, 92) \
---	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
---	BRCMF_ENUM_DEF(PSTA_PRIMARY_INTF_IND, 128)
--+	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
-- 
-- #define BRCMF_ENUM_DEF(id, val) \
-- 	BRCMF_E_##id = (val),
--@@ -112,7 +110,11 @@ struct brcmf_event;
-- /* firmware event codes sent by the dongle */
-- enum brcmf_fweh_event_code {
-- 	BRCMF_FWEH_EVENT_ENUM_DEFLIST
---	BRCMF_E_LAST
--+	/* this determines event mask length which must match
--+	 * minimum length check in device firmware so it is
--+	 * hard-coded here.
--+	 */
--+	BRCMF_E_LAST = 139
-- };
-- #undef BRCMF_ENUM_DEF
-- 
-diff --git a/package/kernel/mac80211/patches/365-0001-brcmfmac-consolidate-ifp-lookup-in-driver-core.patch b/package/kernel/mac80211/patches/365-0001-brcmfmac-consolidate-ifp-lookup-in-driver-core.patch
-deleted file mode 100644
-index 97444b3..0000000
---- a/package/kernel/mac80211/patches/365-0001-brcmfmac-consolidate-ifp-lookup-in-driver-core.patch
-+++ /dev/null
-@@ -1,138 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:53 +0200
--Subject: [PATCH] brcmfmac: consolidate ifp lookup in driver core
--
--In rx path the firmware provide an interface index which is used to
--map to a struct brcmf_if instance. However, this involves some trick
--that is done in two places. This is changed by having driver core
--providing brcmf_get_ifp() function.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--@@ -276,6 +276,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 			 struct sk_buff *pktbuf)
-- {
-- 	struct brcmf_proto_bcdc_header *h;
--+	struct brcmf_if *ifp;
-- 
-- 	brcmf_dbg(BCDC, "Enter\n");
-- 
--@@ -289,30 +290,21 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 	trace_brcmf_bcdchdr(pktbuf->data);
-- 	h = (struct brcmf_proto_bcdc_header *)(pktbuf->data);
-- 
---	*ifidx = BCDC_GET_IF_IDX(h);
---	if (*ifidx >= BRCMF_MAX_IFS) {
---		brcmf_err("rx data ifnum out of range (%d)\n", *ifidx);
--+	ifp = brcmf_get_ifp(drvr, BCDC_GET_IF_IDX(h));
--+	if (IS_ERR_OR_NULL(ifp)) {
--+		brcmf_dbg(INFO, "no matching ifp found\n");
-- 		return -EBADE;
-- 	}
---	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
---	 * events this is easy because it contains the bssidx which maps
---	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
---	 * bssidx 1 is used for p2p0 and no data can be received or
---	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
---	 */
---	if (*ifidx)
---		(*ifidx)++;
---
-- 	if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
-- 	    BCDC_PROTO_VER) {
-- 		brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
---			  brcmf_ifname(drvr, *ifidx), h->flags);
--+			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
-- 		return -EBADE;
-- 	}
-- 
-- 	if (h->flags & BCDC_FLAG_SUM_GOOD) {
-- 		brcmf_dbg(BCDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
---			  brcmf_ifname(drvr, *ifidx), h->flags);
--+			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
-- 		pktbuf->ip_summed = CHECKSUM_UNNECESSARY;
-- 	}
-- 
--@@ -320,12 +312,15 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 
-- 	skb_pull(pktbuf, BCDC_HEADER_LEN);
-- 	if (do_fws)
---		brcmf_fws_hdrpull(drvr, *ifidx, h->data_offset << 2, pktbuf);
--+		brcmf_fws_hdrpull(drvr, ifp->ifidx, h->data_offset << 2,
--+				  pktbuf);
-- 	else
-- 		skb_pull(pktbuf, h->data_offset << 2);
-- 
-- 	if (pktbuf->len == 0)
-- 		return -ENODATA;
--+
--+	*ifidx = ifp->ifidx;
-- 	return 0;
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -83,6 +83,25 @@ char *brcmf_ifname(struct brcmf_pub *drv
-- 	return "<if_none>";
-- }
-- 
--+struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
--+{
--+	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
--+		brcmf_err("ifidx %d out of range\n", ifidx);
--+		return ERR_PTR(-ERANGE);
--+	}
--+
--+	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
--+	 * events this is easy because it contains the bssidx which maps
--+	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
--+	 * bssidx 1 is used for p2p0 and no data can be received or
--+	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
--+	 */
--+	if (ifidx)
--+		ifidx++;
--+
--+	return drvr->iflist[ifidx];
--+}
--+
-- static void _brcmf_set_multicast_list(struct work_struct *work)
-- {
-- 	struct brcmf_if *ifp;
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -202,7 +202,7 @@ int brcmf_netdev_wait_pend8021x(struct b
-- 
-- /* Return pointer to interface name */
-- char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
---
--+struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-- 			      char *name, u8 *mac_addr);
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -1081,16 +1081,8 @@ brcmf_msgbuf_rx_skb(struct brcmf_msgbuf
-- {
-- 	struct brcmf_if *ifp;
-- 
---	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
---	 * events this is easy because it contains the bssidx which maps
---	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
---	 * bssidx 1 is used for p2p0 and no data can be received or
---	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
---	 */
---	if (ifidx)
---		(ifidx)++;
---	ifp = msgbuf->drvr->iflist[ifidx];
---	if (!ifp || !ifp->ndev) {
--+	ifp = brcmf_get_ifp(msgbuf->drvr, ifidx);
--+	if (IS_ERR_OR_NULL(ifp) || !ifp->ndev) {
-- 		brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
-- 		brcmu_pkt_buf_free_skb(skb);
-- 		return;
-diff --git a/package/kernel/mac80211/patches/365-0002-brcmfmac-make-brcmf_proto_hdrpull-return-struct-brcm.patch b/package/kernel/mac80211/patches/365-0002-brcmfmac-make-brcmf_proto_hdrpull-return-struct-brcm.patch
-deleted file mode 100644
-index 632714c..0000000
---- a/package/kernel/mac80211/patches/365-0002-brcmfmac-make-brcmf_proto_hdrpull-return-struct-brcm.patch
-+++ /dev/null
-@@ -1,222 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:54 +0200
--Subject: [PATCH] brcmfmac: make brcmf_proto_hdrpull() return struct
-- brcmf_if instance
--
--Avoid spreading the ifidx in the driver, but have it return the
--struct brcmf_if instance.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--@@ -272,11 +272,11 @@ brcmf_proto_bcdc_hdrpush(struct brcmf_pu
-- }
-- 
-- static int
---brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
---			 struct sk_buff *pktbuf)
--+brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws,
--+			 struct sk_buff *pktbuf, struct brcmf_if **ifp)
-- {
-- 	struct brcmf_proto_bcdc_header *h;
---	struct brcmf_if *ifp;
--+	struct brcmf_if *tmp_if;
-- 
-- 	brcmf_dbg(BCDC, "Enter\n");
-- 
--@@ -290,21 +290,21 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 	trace_brcmf_bcdchdr(pktbuf->data);
-- 	h = (struct brcmf_proto_bcdc_header *)(pktbuf->data);
-- 
---	ifp = brcmf_get_ifp(drvr, BCDC_GET_IF_IDX(h));
---	if (IS_ERR_OR_NULL(ifp)) {
--+	tmp_if = brcmf_get_ifp(drvr, BCDC_GET_IF_IDX(h));
--+	if (!tmp_if) {
-- 		brcmf_dbg(INFO, "no matching ifp found\n");
-- 		return -EBADE;
-- 	}
-- 	if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
-- 	    BCDC_PROTO_VER) {
-- 		brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
---			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
--+			  brcmf_ifname(drvr, tmp_if->ifidx), h->flags);
-- 		return -EBADE;
-- 	}
-- 
-- 	if (h->flags & BCDC_FLAG_SUM_GOOD) {
-- 		brcmf_dbg(BCDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
---			  brcmf_ifname(drvr, ifp->ifidx), h->flags);
--+			  brcmf_ifname(drvr, tmp_if->ifidx), h->flags);
-- 		pktbuf->ip_summed = CHECKSUM_UNNECESSARY;
-- 	}
-- 
--@@ -312,7 +312,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 
-- 	skb_pull(pktbuf, BCDC_HEADER_LEN);
-- 	if (do_fws)
---		brcmf_fws_hdrpull(drvr, ifp->ifidx, h->data_offset << 2,
--+		brcmf_fws_hdrpull(drvr, tmp_if->ifidx, h->data_offset << 2,
-- 				  pktbuf);
-- 	else
-- 		skb_pull(pktbuf, h->data_offset << 2);
--@@ -320,7 +320,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 	if (pktbuf->len == 0)
-- 		return -ENODATA;
-- 
---	*ifidx = ifp->ifidx;
--+	*ifp = tmp_if;
-- 	return 0;
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -87,7 +87,7 @@ struct brcmf_if *brcmf_get_ifp(struct br
-- {
-- 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
-- 		brcmf_err("ifidx %d out of range\n", ifidx);
---		return ERR_PTR(-ERANGE);
--+		return NULL;
-- 	}
-- 
-- 	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
--@@ -539,17 +539,15 @@ void brcmf_rx_frame(struct device *dev,
-- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-- 	struct brcmf_pub *drvr = bus_if->drvr;
-- 	struct brcmf_skb_reorder_data *rd;
---	u8 ifidx;
-- 	int ret;
-- 
-- 	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
-- 
-- 	/* process and remove protocol-specific header */
---	ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
---	ifp = drvr->iflist[ifidx];
--+	ret = brcmf_proto_hdrpull(drvr, true, skb, &ifp);
-- 
-- 	if (ret || !ifp || !ifp->ndev) {
---		if ((ret != -ENODATA) && ifp)
--+		if (ret != -ENODATA && ifp)
-- 			ifp->stats.rx_errors++;
-- 		brcmu_pkt_buf_free_skb(skb);
-- 		return;
--@@ -592,17 +590,17 @@ void brcmf_txcomplete(struct device *dev
-- {
-- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-- 	struct brcmf_pub *drvr = bus_if->drvr;
---	u8 ifidx;
--+	struct brcmf_if *ifp;
-- 
-- 	/* await txstatus signal for firmware if active */
-- 	if (brcmf_fws_fc_active(drvr->fws)) {
-- 		if (!success)
-- 			brcmf_fws_bustxfail(drvr->fws, txp);
-- 	} else {
---		if (brcmf_proto_hdrpull(drvr, false, &ifidx, txp))
--+		if (brcmf_proto_hdrpull(drvr, false, txp, &ifp))
-- 			brcmu_pkt_buf_free_skb(txp);
-- 		else
---			brcmf_txfinalize(drvr, txp, ifidx, success);
--+			brcmf_txfinalize(drvr, txp, ifp->ifidx, success);
-- 	}
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -1448,7 +1448,7 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-- 	struct sk_buff *skb;
-- 	struct brcmf_skbuff_cb *skcb;
-- 	struct brcmf_fws_mac_descriptor *entry = NULL;
---	u8 ifidx;
--+	struct brcmf_if *ifp;
-- 
-- 	brcmf_dbg(DATA, "flags %d\n", flags);
-- 
--@@ -1497,15 +1497,16 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-- 	}
-- 	brcmf_fws_macdesc_return_req_credit(skb);
-- 
---	if (brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb)) {
--+	ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
--+	if (ret) {
-- 		brcmu_pkt_buf_free_skb(skb);
-- 		return -EINVAL;
-- 	}
-- 	if (!remove_from_hanger)
---		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifidx,
--+		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifp->ifidx,
-- 						    genbit, seq);
-- 	if (remove_from_hanger || ret)
---		brcmf_txfinalize(fws->drvr, skb, ifidx, true);
--+		brcmf_txfinalize(fws->drvr, skb, ifp->ifidx, true);
-- 
-- 	return 0;
-- }
--@@ -1848,7 +1849,7 @@ static int brcmf_fws_commit_skb(struct b
-- 		entry->transit_count--;
-- 		if (entry->suppressed)
-- 			entry->suppr_transit_count--;
---		brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
--+		(void)brcmf_proto_hdrpull(fws->drvr, false, skb, NULL);
-- 		goto rollback;
-- 	}
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -522,7 +522,7 @@ static int brcmf_msgbuf_set_dcmd(struct
-- 
-- 
-- static int brcmf_msgbuf_hdrpull(struct brcmf_pub *drvr, bool do_fws,
---				u8 *ifidx, struct sk_buff *skb)
--+				struct sk_buff *skb, struct brcmf_if **ifp)
-- {
-- 	return -ENODEV;
-- }
--@@ -1082,7 +1082,7 @@ brcmf_msgbuf_rx_skb(struct brcmf_msgbuf
-- 	struct brcmf_if *ifp;
-- 
-- 	ifp = brcmf_get_ifp(msgbuf->drvr, ifidx);
---	if (IS_ERR_OR_NULL(ifp) || !ifp->ndev) {
--+	if (!ifp || !ifp->ndev) {
-- 		brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
-- 		brcmu_pkt_buf_free_skb(skb);
-- 		return;
----- a/drivers/net/wireless/brcm80211/brcmfmac/proto.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/proto.h
--@@ -24,8 +24,8 @@ enum proto_addr_mode {
-- 
-- 
-- struct brcmf_proto {
---	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
---		       struct sk_buff *skb);
--+	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
--+		       struct sk_buff *skb, struct brcmf_if **ifp);
-- 	int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
-- 			  void *buf, uint len);
-- 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
--@@ -46,9 +46,19 @@ int brcmf_proto_attach(struct brcmf_pub
-- void brcmf_proto_detach(struct brcmf_pub *drvr);
-- 
-- static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
---				      u8 *ifidx, struct sk_buff *skb)
--+				      struct sk_buff *skb,
--+				      struct brcmf_if **ifp)
-- {
---	return drvr->proto->hdrpull(drvr, do_fws, ifidx, skb);
--+	struct brcmf_if *tmp = NULL;
--+
--+	/* assure protocol is always called with
--+	 * non-null initialized pointer.
--+	 */
--+	if (ifp)
--+		*ifp = NULL;
--+	else
--+		ifp = &tmp;
--+	return drvr->proto->hdrpull(drvr, do_fws, skb, ifp);
-- }
-- static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
-- 					 uint cmd, void *buf, uint len)
-diff --git a/package/kernel/mac80211/patches/365-0003-brcmfmac-change-parameters-for-brcmf_remove_interfac.patch b/package/kernel/mac80211/patches/365-0003-brcmfmac-change-parameters-for-brcmf_remove_interfac.patch
-deleted file mode 100644
-index 2d15a77..0000000
---- a/package/kernel/mac80211/patches/365-0003-brcmfmac-change-parameters-for-brcmf_remove_interfac.patch
-+++ /dev/null
-@@ -1,87 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:55 +0200
--Subject: [PATCH] brcmfmac: change parameters for
-- brcmf_remove_interface()
--
--Just pass the interface to be removed, ie. the struct brcmf_if instance.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -4982,7 +4982,7 @@ brcmf_notify_connect_status_ap(struct br
-- 		brcmf_dbg(CONN, "AP mode link down\n");
-- 		complete(&cfg->vif_disabled);
-- 		if (ifp->vif->mbss)
---			brcmf_remove_interface(ifp->drvr, ifp->bssidx);
--+			brcmf_remove_interface(ifp);
-- 		return 0;
-- 	}
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -887,12 +887,13 @@ static void brcmf_del_if(struct brcmf_pu
-- 	}
-- }
-- 
---void brcmf_remove_interface(struct brcmf_pub *drvr, u32 bssidx)
--+void brcmf_remove_interface(struct brcmf_if *ifp)
-- {
---	if (drvr->iflist[bssidx]) {
---		brcmf_fws_del_interface(drvr->iflist[bssidx]);
---		brcmf_del_if(drvr, bssidx);
---	}
--+	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bssidx] != ifp))
--+		return;
--+
--+	brcmf_fws_del_interface(ifp);
--+	brcmf_del_if(ifp->drvr, ifp->bssidx);
-- }
-- 
-- int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr)
--@@ -1122,7 +1123,7 @@ void brcmf_detach(struct device *dev)
-- 
-- 	/* make sure primary interface removed last */
-- 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
---		brcmf_remove_interface(drvr, i);
--+		brcmf_remove_interface(drvr->iflist[i]);
-- 
-- 	brcmf_cfg80211_detach(drvr->config);
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -206,7 +206,7 @@ struct brcmf_if *brcmf_get_ifp(struct br
-- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-- 			      char *name, u8 *mac_addr);
---void brcmf_remove_interface(struct brcmf_pub *drvr, u32 bssidx);
--+void brcmf_remove_interface(struct brcmf_if *ifp);
-- int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
-- void brcmf_txflowblock_if(struct brcmf_if *ifp,
-- 			  enum brcmf_netif_stop_reason reason, bool state);
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -222,7 +222,7 @@ static void brcmf_fweh_handle_if_event(s
-- 	err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
-- 
-- 	if (ifp && ifevent->action == BRCMF_E_IF_DEL)
---		brcmf_remove_interface(drvr, ifevent->bssidx);
--+		brcmf_remove_interface(ifp);
-- }
-- 
-- /**
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2140,7 +2140,7 @@ static void brcmf_p2p_delete_p2pdev(stru
-- {
-- 	cfg80211_unregister_wdev(&vif->wdev);
-- 	p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
---	brcmf_remove_interface(vif->ifp->drvr, vif->ifp->bssidx);
--+	brcmf_remove_interface(vif->ifp);
-- 	brcmf_free_vif(vif);
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/365-0004-brcmfmac-only-call-brcmf_cfg80211_detach-when-attach.patch b/package/kernel/mac80211/patches/365-0004-brcmfmac-only-call-brcmf_cfg80211_detach-when-attach.patch
-deleted file mode 100644
-index 2b61f4e..0000000
---- a/package/kernel/mac80211/patches/365-0004-brcmfmac-only-call-brcmf_cfg80211_detach-when-attach.patch
-+++ /dev/null
-@@ -1,92 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:56 +0200
--Subject: [PATCH] brcmfmac: only call brcmf_cfg80211_detach() when attach
-- was successful
--
--In brcmf_bus_start() the function brcmf_cfg80211_attach() is called which
--may fail. If this happens we should not call brcmf_cfg80211_detach() in
--the failure path as it will result in NULL pointer dereference:
--
--  brcmf_fweh_activate_events: Set event_msgs error (-5)
--  brcmf_bus_start: failed: -5
--  brcmf_sdio_firmware_callback: dongle is not responding
--  BUG: unable to handle kernel NULL pointer dereference at 0000000000000068
--  IP: [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
--  PGD 0
--  Oops: 0000 [#1] SMP
--  Modules linked in: brcmfmac(O) brcmutil(O) cfg80211 auth_rpcgss
--  CPU: 1 PID: 45 Comm: kworker/1:1 Tainted: G           O
--  Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
--  Workqueue: events request_firmware_work_func
--  task: ffff880036c09ac0 ti: ffff880036dd4000 task.ti: ffff880036dd4000
--  RIP: 0010:[<ffffffff811e8f08>]  [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
--  RSP: 0018:ffff880036dd7a28  EFLAGS: 00010246
--  RAX: ffff880036c09ac0 RBX: 0000000000000000 RCX: 000000007fffffff
--  RDX: 0000000000000000 RSI: ffffffff816578b9 RDI: 0000000000000000
--  RBP: ffff880036dd7a48 R08: 0000000000000000 R09: ffff880036c0b340
--  R10: 00000000000002ec R11: ffff880036dd7b08 R12: ffffffff816578b9
--  R13: 0000000000000000 R14: ffffffff816578b9 R15: ffff8800c6c87000
--  FS:  0000000000000000(0000) GS:ffff88012bc40000(0000) knlGS:0000000000000000
--  CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
--  CR2: 0000000000000068 CR3: 0000000001a0b000 CR4: 00000000000006e0
--  Stack:
--   0000000000000000 ffffffff816578b9 0000000000000000 ffff8800c0d003c8
--   ffff880036dd7a78 ffffffff811e8ff5 0000000ffffffff1 ffffffff81a9b060
--   ffff8800c789f880 ffff8800c0d00000 ffff880036dd7a98 ffffffff811ebe0d
--  Call Trace:
--   [<ffffffff811e8ff5>] kernfs_find_and_get_ns+0x35/0x60
--   [<ffffffff811ebe0d>] sysfs_unmerge_group+0x1d/0x60
--   [<ffffffff81404ef2>] dpm_sysfs_remove+0x22/0x60
--   [<ffffffff813f9db9>] device_del+0x49/0x240
--   [<ffffffff815da768>] rfkill_unregister+0x58/0xc0
--   [<ffffffffa06bd91b>] wiphy_unregister+0xab/0x2f0 [cfg80211]
--   [<ffffffffa0742fe3>] brcmf_cfg80211_detach+0x23/0x50 [brcmfmac]
--   [<ffffffffa074d986>] brcmf_detach+0x86/0xe0 [brcmfmac]
--   [<ffffffffa0757de8>] brcmf_sdio_remove+0x48/0x120 [brcmfmac]
--   [<ffffffffa0758ed9>] brcmf_sdiod_remove+0x29/0xd0 [brcmfmac]
--   [<ffffffffa0759031>] brcmf_ops_sdio_remove+0xb1/0x110 [brcmfmac]
--   [<ffffffffa001c267>] sdio_bus_remove+0x37/0x100 [mmc_core]
--   [<ffffffff813fe026>] __device_release_driver+0x96/0x130
--   [<ffffffff813fe0e3>] device_release_driver+0x23/0x30
--   [<ffffffffa0754bc8>] brcmf_sdio_firmware_callback+0x2a8/0x5d0 [brcmfmac]
--   [<ffffffffa074deaf>] brcmf_fw_request_nvram_done+0x15f/0x5e0 [brcmfmac]
--   [<ffffffff8140142f>] ? devres_add+0x3f/0x50
--   [<ffffffff810642b5>] ? usermodehelper_read_unlock+0x15/0x20
--   [<ffffffff81400000>] ? platform_match+0x70/0xa0
--   [<ffffffff8140f400>] request_firmware_work_func+0x30/0x60
--   [<ffffffff8106828c>] process_one_work+0x14c/0x3d0
--   [<ffffffff8106862a>] worker_thread+0x11a/0x450
--   [<ffffffff81068510>] ? process_one_work+0x3d0/0x3d0
--   [<ffffffff8106d692>] kthread+0xd2/0xf0
--   [<ffffffff8106d5c0>] ? kthread_create_on_node+0x180/0x180
--   [<ffffffff815ed35f>] ret_from_fork+0x3f/0x70
--   [<ffffffff8106d5c0>] ? kthread_create_on_node+0x180/0x180
--  Code: e9 40 fe ff ff 48 89 d8 eb 87 66 0f 1f 84 00 00 00 00 00 66 66 66 66
--	90 55 48 89 e5 41 56 49 89 f6 41 55 49 89 d5 31 d2 41 54 53 <0f> b7
--	47 68 48 8b 5f 48 66 c1 e8 05 83 e0 01 4d 85 ed 0f b6 c8
--  RIP  [<ffffffff811e8f08>] kernfs_find_ns+0x18/0xd0
--   RSP <ffff880036dd7a28>
--  CR2: 0000000000000068
--  ---[ end trace 87d6ec0d3fe46740 ]---
--
--Reported-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -1049,7 +1049,10 @@ int brcmf_bus_start(struct device *dev)
-- fail:
-- 	if (ret < 0) {
-- 		brcmf_err("failed: %d\n", ret);
---		brcmf_cfg80211_detach(drvr->config);
--+		if (drvr->config) {
--+			brcmf_cfg80211_detach(drvr->config);
--+			drvr->config = NULL;
--+		}
-- 		if (drvr->fws) {
-- 			brcmf_fws_del_interface(ifp);
-- 			brcmf_fws_deinit(drvr);
-diff --git a/package/kernel/mac80211/patches/365-0005-brcmfmac-correct-detection-of-p2pdev-interface-event.patch b/package/kernel/mac80211/patches/365-0005-brcmfmac-correct-detection-of-p2pdev-interface-event.patch
-deleted file mode 100644
-index 868b0a8..0000000
---- a/package/kernel/mac80211/patches/365-0005-brcmfmac-correct-detection-of-p2pdev-interface-event.patch
-+++ /dev/null
-@@ -1,105 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:57 +0200
--Subject: [PATCH] brcmfmac: correct detection of p2pdev interface event
--
--The p2pdev interface is setup in firmware resulting in a interface
--event. This event has role and no-if flag. When role is p2p client
--and no-if flag is set it indicates that this is the p2pdev interface.
--This info is used in handling the event and adding interface in the
--driver.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -795,7 +795,7 @@ fail:
-- }
-- 
-- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
---			      char *name, u8 *mac_addr)
--+			      bool is_p2pdev, char *name, u8 *mac_addr)
-- {
-- 	struct brcmf_if *ifp;
-- 	struct net_device *ndev;
--@@ -821,7 +821,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 		}
-- 	}
-- 
---	if (!brcmf_p2p_enable && bssidx == 1) {
--+	if (!brcmf_p2p_enable && is_p2pdev) {
-- 		/* this is P2P_DEVICE interface */
-- 		brcmf_dbg(INFO, "allocate non-netdev interface\n");
-- 		ifp = kzalloc(sizeof(*ifp), GFP_KERNEL);
--@@ -999,12 +999,12 @@ int brcmf_bus_start(struct device *dev)
-- 	brcmf_dbg(TRACE, "\n");
-- 
-- 	/* add primary networking interface */
---	ifp = brcmf_add_if(drvr, 0, 0, "wlan%d", NULL);
--+	ifp = brcmf_add_if(drvr, 0, 0, false, "wlan%d", NULL);
-- 	if (IS_ERR(ifp))
-- 		return PTR_ERR(ifp);
-- 
-- 	if (brcmf_p2p_enable)
---		p2p_ifp = brcmf_add_if(drvr, 1, 0, "p2p%d", NULL);
--+		p2p_ifp = brcmf_add_if(drvr, 1, 0, false, "p2p%d", NULL);
-- 	else
-- 		p2p_ifp = NULL;
-- 	if (IS_ERR(p2p_ifp))
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -205,7 +205,7 @@ char *brcmf_ifname(struct brcmf_pub *drv
-- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
---			      char *name, u8 *mac_addr);
--+			      bool is_p2pdev, char *name, u8 *mac_addr);
-- void brcmf_remove_interface(struct brcmf_if *ifp);
-- int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
-- void brcmf_txflowblock_if(struct brcmf_if *ifp,
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -179,6 +179,7 @@ static void brcmf_fweh_handle_if_event(s
-- {
-- 	struct brcmf_if_event *ifevent = data;
-- 	struct brcmf_if *ifp;
--+	bool is_p2pdev;
-- 	int err = 0;
-- 
-- 	brcmf_dbg(EVENT, "action: %u idx: %u bsscfg: %u flags: %u role: %u\n",
--@@ -186,18 +187,16 @@ static void brcmf_fweh_handle_if_event(s
-- 		  ifevent->flags, ifevent->role);
-- 
-- 	/* The P2P Device interface event must not be ignored
---	 * contrary to what firmware tells us. The only way to
---	 * distinguish the P2P Device is by looking at the ifidx
---	 * and bssidx received.
--+	 * contrary to what firmware tells us.
-- 	 */
---	if (!(ifevent->ifidx == 0 && ifevent->bssidx == 1) &&
---	    (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) {
--+	is_p2pdev = (ifevent->flags & BRCMF_E_IF_FLAG_NOIF) &&
--+		    ifevent->role == BRCMF_E_IF_ROLE_P2P_CLIENT;
--+	if (!is_p2pdev && (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) {
-- 		brcmf_dbg(EVENT, "event can be ignored\n");
-- 		return;
-- 	}
-- 	if (ifevent->ifidx >= BRCMF_MAX_IFS) {
---		brcmf_err("invalid interface index: %u\n",
---			  ifevent->ifidx);
--+		brcmf_err("invalid interface index: %u\n", ifevent->ifidx);
-- 		return;
-- 	}
-- 
--@@ -207,7 +206,7 @@ static void brcmf_fweh_handle_if_event(s
-- 		brcmf_dbg(EVENT, "adding %s (%pM)\n", emsg->ifname,
-- 			  emsg->addr);
-- 		ifp = brcmf_add_if(drvr, ifevent->bssidx, ifevent->ifidx,
---				   emsg->ifname, emsg->addr);
--+				   is_p2pdev, emsg->ifname, emsg->addr);
-- 		if (IS_ERR(ifp))
-- 			return;
-- 		brcmf_fws_add_interface(ifp);
-diff --git a/package/kernel/mac80211/patches/365-0006-brcmfmac-use-brcmf_get_ifp-to-map-ifidx-to-struct-br.patch b/package/kernel/mac80211/patches/365-0006-brcmfmac-use-brcmf_get_ifp-to-map-ifidx-to-struct-br.patch
-deleted file mode 100644
-index aebbfa6..0000000
---- a/package/kernel/mac80211/patches/365-0006-brcmfmac-use-brcmf_get_ifp-to-map-ifidx-to-struct-br.patch
-+++ /dev/null
-@@ -1,126 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:58 +0200
--Subject: [PATCH] brcmfmac: use brcmf_get_ifp() to map ifidx to struct
-- brcmf_if instance
--
--The knowledge on how to map the interface index to a struct brcmf_if
--instance is in brcmf_get_ifp() so use that function when only the
--interface index is known instead of accessing brcmf_pub::iflist
--directly.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
--@@ -149,7 +149,7 @@ static s32 brcmf_btcoex_params_read(stru
-- static void brcmf_btcoex_boost_wifi(struct brcmf_btcoex_info *btci,
-- 				    bool trump_sco)
-- {
---	struct brcmf_if *ifp = btci->cfg->pub->iflist[0];
--+	struct brcmf_if *ifp = brcmf_get_ifp(btci->cfg->pub, 0);
-- 
-- 	if (trump_sco && !btci->saved_regs_part2) {
-- 		/* this should reduce eSCO agressive
--@@ -468,7 +468,7 @@ int brcmf_btcoex_set_mode(struct brcmf_c
-- {
-- 	struct brcmf_cfg80211_info *cfg = wiphy_priv(vif->wdev.wiphy);
-- 	struct brcmf_btcoex_info *btci = cfg->btcoex;
---	struct brcmf_if *ifp = cfg->pub->iflist[0];
--+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
-- 
-- 	switch (mode) {
-- 	case BRCMF_BTCOEX_DISABLED:
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6212,7 +6212,7 @@ static void brcmf_free_wiphy(struct wiph
-- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
-- 						  struct device *busdev)
-- {
---	struct net_device *ndev = drvr->iflist[0]->ndev;
--+	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
-- 	struct brcmf_cfg80211_info *cfg;
-- 	struct wiphy *wiphy;
-- 	struct brcmf_cfg80211_vif *vif;
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--@@ -121,7 +121,7 @@ static void brcmf_feat_iovar_int_set(str
-- 
-- void brcmf_feat_attach(struct brcmf_pub *drvr)
-- {
---	struct brcmf_if *ifp = drvr->iflist[0];
--+	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
-- 
-- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
-- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
----- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
--@@ -221,7 +221,7 @@ static void brcmf_flowring_block(struct
-- 
-- 	bus_if = dev_get_drvdata(flow->dev);
-- 	drvr = bus_if->drvr;
---	ifp = drvr->iflist[ifidx];
--+	ifp = brcmf_get_ifp(drvr, ifidx);
-- 	brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW, blocked);
-- 
-- 	spin_unlock_irqrestore(&flow->block_lock, flags);
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -334,7 +334,7 @@ void brcmf_fweh_attach(struct brcmf_pub
-- void brcmf_fweh_detach(struct brcmf_pub *drvr)
-- {
-- 	struct brcmf_fweh_info *fweh = &drvr->fweh;
---	struct brcmf_if *ifp = drvr->iflist[0];
--+	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
-- 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
-- 
-- 	if (ifp) {
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -972,7 +972,7 @@ static void
-- brcmf_fws_flow_control_check(struct brcmf_fws_info *fws, struct pktq *pq,
-- 			     u8 if_id)
-- {
---	struct brcmf_if *ifp = fws->drvr->iflist[!if_id ? 0 : if_id + 1];
--+	struct brcmf_if *ifp = brcmf_get_ifp(fws->drvr, if_id);
-- 
-- 	if (WARN_ON(!ifp))
-- 		return;
--@@ -2118,6 +2118,7 @@ static int brcmf_debugfs_fws_stats_read(
-- int brcmf_fws_init(struct brcmf_pub *drvr)
-- {
-- 	struct brcmf_fws_info *fws;
--+	struct brcmf_if *ifp;
-- 	u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
-- 	int rc;
-- 	u32 mode;
--@@ -2177,21 +2178,22 @@ int brcmf_fws_init(struct brcmf_pub *drv
-- 	 * continue. Set mode back to none indicating not enabled.
-- 	 */
-- 	fws->fw_signals = true;
---	if (brcmf_fil_iovar_int_set(drvr->iflist[0], "tlv", tlv)) {
--+	ifp = brcmf_get_ifp(drvr, 0);
--+	if (brcmf_fil_iovar_int_set(ifp, "tlv", tlv)) {
-- 		brcmf_err("failed to set bdcv2 tlv signaling\n");
-- 		fws->fcmode = BRCMF_FWS_FCMODE_NONE;
-- 		fws->fw_signals = false;
-- 	}
-- 
---	if (brcmf_fil_iovar_int_set(drvr->iflist[0], "ampdu_hostreorder", 1))
--+	if (brcmf_fil_iovar_int_set(ifp, "ampdu_hostreorder", 1))
-- 		brcmf_dbg(INFO, "enabling AMPDU host-reorder failed\n");
-- 
-- 	/* Enable seq number reuse, if supported */
---	if (brcmf_fil_iovar_int_get(drvr->iflist[0], "wlfc_mode", &mode) == 0) {
--+	if (brcmf_fil_iovar_int_get(ifp, "wlfc_mode", &mode) == 0) {
-- 		if (BRCMF_FWS_MODE_GET_REUSESEQ(mode)) {
-- 			mode = 0;
-- 			BRCMF_FWS_MODE_SET_REUSESEQ(mode, 1);
---			if (brcmf_fil_iovar_int_set(drvr->iflist[0],
--+			if (brcmf_fil_iovar_int_set(ifp,
-- 						    "wlfc_mode", mode) == 0) {
-- 				BRCMF_FWS_MODE_SET_REUSESEQ(fws->mode, 1);
-- 			}
-diff --git a/package/kernel/mac80211/patches/365-0007-brcmfmac-pass-struct-brcmf_if-instance-in-brcmf_txfi.patch b/package/kernel/mac80211/patches/365-0007-brcmfmac-pass-struct-brcmf_if-instance-in-brcmf_txfi.patch
-deleted file mode 100644
-index 23a7b6f..0000000
---- a/package/kernel/mac80211/patches/365-0007-brcmfmac-pass-struct-brcmf_if-instance-in-brcmf_txfi.patch
-+++ /dev/null
-@@ -1,122 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:14:59 +0200
--Subject: [PATCH] brcmfmac: pass struct brcmf_if instance in
-- brcmf_txfinalize()
--
--Most call sites of brcmf_txfinalize already have struct brcmf_if
--instance so pass that to brcmf_txfinalize() as the function
--needs it anyway.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -560,17 +560,11 @@ void brcmf_rx_frame(struct device *dev,
-- 		brcmf_netif_rx(ifp, skb);
-- }
-- 
---void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
---		      bool success)
--+void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success)
-- {
---	struct brcmf_if *ifp;
-- 	struct ethhdr *eh;
-- 	u16 type;
-- 
---	ifp = drvr->iflist[ifidx];
---	if (!ifp)
---		goto done;
---
-- 	eh = (struct ethhdr *)(txp->data);
-- 	type = ntohs(eh->h_proto);
-- 
--@@ -582,7 +576,7 @@ void brcmf_txfinalize(struct brcmf_pub *
-- 
-- 	if (!success)
-- 		ifp->stats.tx_errors++;
---done:
--+
-- 	brcmu_pkt_buf_free_skb(txp);
-- }
-- 
--@@ -600,7 +594,7 @@ void brcmf_txcomplete(struct device *dev
-- 		if (brcmf_proto_hdrpull(drvr, false, txp, &ifp))
-- 			brcmu_pkt_buf_free_skb(txp);
-- 		else
---			brcmf_txfinalize(drvr, txp, ifp->ifidx, success);
--+			brcmf_txfinalize(ifp, txp, success);
-- 	}
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -210,8 +210,7 @@ void brcmf_remove_interface(struct brcmf
-- int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
-- void brcmf_txflowblock_if(struct brcmf_if *ifp,
-- 			  enum brcmf_netif_stop_reason reason, bool state);
---void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
---		      bool success);
--+void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
-- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
-- 
-- /* Sets dongle media info (drv_version, mac address). */
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -1506,7 +1506,7 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-- 		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifp->ifidx,
-- 						    genbit, seq);
-- 	if (remove_from_hanger || ret)
---		brcmf_txfinalize(fws->drvr, skb, ifp->ifidx, true);
--+		brcmf_txfinalize(ifp, skb, true);
-- 
-- 	return 0;
-- }
--@@ -1905,7 +1905,7 @@ int brcmf_fws_process_skb(struct brcmf_i
-- 	if (fws->avoid_queueing) {
-- 		rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
-- 		if (rc < 0)
---			brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
--+			brcmf_txfinalize(ifp, skb, false);
-- 		return rc;
-- 	}
-- 
--@@ -1929,7 +1929,7 @@ int brcmf_fws_process_skb(struct brcmf_i
-- 		brcmf_fws_schedule_deq(fws);
-- 	} else {
-- 		brcmf_err("drop skb: no hanger slot\n");
---		brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
--+		brcmf_txfinalize(ifp, skb, false);
-- 		rc = -ENOMEM;
-- 	}
-- 	brcmf_fws_unlock(fws);
--@@ -2009,8 +2009,9 @@ static void brcmf_fws_dequeue_worker(str
-- 				ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
-- 				brcmf_fws_lock(fws);
-- 				if (ret < 0)
---					brcmf_txfinalize(drvr, skb, ifidx,
---							 false);
--+					brcmf_txfinalize(brcmf_get_ifp(drvr,
--+								       ifidx),
--+							 skb, false);
-- 				if (fws->bus_flow_blocked)
-- 					break;
-- 			}
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -873,7 +873,11 @@ brcmf_msgbuf_process_txstatus(struct brc
-- 	commonring = msgbuf->flowrings[flowid];
-- 	atomic_dec(&commonring->outstanding_tx);
-- 
---	brcmf_txfinalize(msgbuf->drvr, skb, tx_status->msg.ifidx, true);
--+	/* Hante: i believe this was a bug as tx_status->msg.ifidx was used
--+	 * in brcmf_txfinalize as index in drvr->iflist. Can you confirm/deny?
--+	 */
--+	brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
--+			 skb, true);
-- }
-- 
-- 
-diff --git a/package/kernel/mac80211/patches/365-0008-brcmfmac-add-mapping-for-interface-index-to-bsscfg-i.patch b/package/kernel/mac80211/patches/365-0008-brcmfmac-add-mapping-for-interface-index-to-bsscfg-i.patch
-deleted file mode 100644
-index 8ddc0a6..0000000
---- a/package/kernel/mac80211/patches/365-0008-brcmfmac-add-mapping-for-interface-index-to-bsscfg-i.patch
-+++ /dev/null
-@@ -1,92 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:15:00 +0200
--Subject: [PATCH] brcmfmac: add mapping for interface index to bsscfg
-- index
--
--Because the P2P Device interface in firmware uses the same interface
--index as the primary interface we use the bsscfg index as index in the
--struct brcmf_pub::iflist. However, in the data path we get the interface
--index and not the bsscfg index. So we need a mapping of interface index
--to bsscfg index, which can be determined upon handle adding the interface.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -85,21 +85,20 @@ char *brcmf_ifname(struct brcmf_pub *drv
-- 
-- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
-- {
--+	struct brcmf_if *ifp;
--+	s32 bssidx;
--+
-- 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
-- 		brcmf_err("ifidx %d out of range\n", ifidx);
-- 		return NULL;
-- 	}
-- 
---	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
---	 * events this is easy because it contains the bssidx which maps
---	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
---	 * bssidx 1 is used for p2p0 and no data can be received or
---	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
---	 */
---	if (ifidx)
---		ifidx++;
--+	ifp = NULL;
--+	bssidx = drvr->if2bss[ifidx];
--+	if (bssidx >= 0)
--+		ifp = drvr->iflist[bssidx];
-- 
---	return drvr->iflist[ifidx];
--+	return ifp;
-- }
-- 
-- static void _brcmf_set_multicast_list(struct work_struct *work)
--@@ -831,6 +830,8 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 
-- 		ifp = netdev_priv(ndev);
-- 		ifp->ndev = ndev;
--+		/* store mapping ifidx to bssidx */
--+		drvr->if2bss[ifidx] = bssidx;
-- 	}
-- 
-- 	ifp->drvr = drvr;
--@@ -855,6 +856,7 @@ static void brcmf_del_if(struct brcmf_pu
-- 	struct brcmf_if *ifp;
-- 
-- 	ifp = drvr->iflist[bssidx];
--+	drvr->if2bss[ifp->ifidx] = -1;
-- 	drvr->iflist[bssidx] = NULL;
-- 	if (!ifp) {
-- 		brcmf_err("Null interface, idx=%d\n", bssidx);
--@@ -862,6 +864,7 @@ static void brcmf_del_if(struct brcmf_pu
-- 	}
-- 	brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifp->ifidx);
-- 	if (ifp->ndev) {
--+		drvr->if2bss[ifp->ifidx] = -1;
-- 		if (bssidx == 0) {
-- 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
-- 				rtnl_lock();
--@@ -926,6 +929,7 @@ int brcmf_attach(struct device *dev)
-- 	if (!drvr)
-- 		return -ENOMEM;
-- 
--+	memset(drvr->if2bss, 0xFF, sizeof(drvr->if2bss));
-- 	mutex_init(&drvr->proto_block);
-- 
-- 	/* Link to bus module */
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -122,6 +122,7 @@ struct brcmf_pub {
-- 	struct mac_address addresses[BRCMF_MAX_IFS];
-- 
-- 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
--+	s32 if2bss[BRCMF_MAX_IFS];
-- 
-- 	struct mutex proto_block;
-- 	unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
-diff --git a/package/kernel/mac80211/patches/365-0009-brcmfmac-add-dedicated-debug-level-for-firmware-cons.patch b/package/kernel/mac80211/patches/365-0009-brcmfmac-add-dedicated-debug-level-for-firmware-cons.patch
-deleted file mode 100644
-index a0a798b..0000000
---- a/package/kernel/mac80211/patches/365-0009-brcmfmac-add-dedicated-debug-level-for-firmware-cons.patch
-+++ /dev/null
-@@ -1,103 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:15:01 +0200
--Subject: [PATCH] brcmfmac: add dedicated debug level for firmware
-- console logging
--
--Both PCIe and SDIO devices have the possibility to log the firmware
--console output in kernel log. For PCIe it is logged when PCIE debug
--level is enabled. For SDIO it is logged when user specifies a non-zero
--console interval through debugfs. This patch tries to make it a
--bit more consistent. The firmware console output is only logged when
--FWCON debug level is enabled.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--@@ -37,6 +37,7 @@
-- #define BRCMF_SDIO_VAL		0x00020000
-- #define BRCMF_MSGBUF_VAL	0x00040000
-- #define BRCMF_PCIE_VAL		0x00080000
--+#define BRCMF_FWCON_VAL		0x00100000
-- 
-- /* set default print format */
-- #undef pr_fmt
--@@ -78,6 +79,7 @@ do {								\
-- #define BRCMF_GLOM_ON()		(brcmf_msg_level & BRCMF_GLOM_VAL)
-- #define BRCMF_EVENT_ON()	(brcmf_msg_level & BRCMF_EVENT_VAL)
-- #define BRCMF_FIL_ON()		(brcmf_msg_level & BRCMF_FIL_VAL)
--+#define BRCMF_FWCON_ON()	(brcmf_msg_level & BRCMF_FWCON_VAL)
-- 
-- #else /* defined(DEBUG) || defined(CPTCFG_BRCM_TRACING) */
-- 
--@@ -90,6 +92,7 @@ do {								\
-- #define BRCMF_GLOM_ON()		0
-- #define BRCMF_EVENT_ON()	0
-- #define BRCMF_FIL_ON()		0
--+#define BRCMF_FWCON_ON()	0
-- 
-- #endif /* defined(DEBUG) || defined(CPTCFG_BRCM_TRACING) */
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -644,7 +644,7 @@ static void brcmf_pcie_bus_console_init(
-- 	addr = console->base_addr + BRCMF_CONSOLE_BUFSIZE_OFFSET;
-- 	console->bufsize = brcmf_pcie_read_tcm32(devinfo, addr);
-- 
---	brcmf_dbg(PCIE, "Console: base %x, buf %x, size %d\n",
--+	brcmf_dbg(FWCON, "Console: base %x, buf %x, size %d\n",
-- 		  console->base_addr, console->buf_addr, console->bufsize);
-- }
-- 
--@@ -656,6 +656,9 @@ static void brcmf_pcie_bus_console_read(
-- 	u8 ch;
-- 	u32 newidx;
-- 
--+	if (!BRCMF_FWCON_ON())
--+		return;
--+
-- 	console = &devinfo->shared.console;
-- 	addr = console->base_addr + BRCMF_CONSOLE_WRITEIDX_OFFSET;
-- 	newidx = brcmf_pcie_read_tcm32(devinfo, addr);
--@@ -677,7 +680,7 @@ static void brcmf_pcie_bus_console_read(
-- 		}
-- 		if (ch == '\n') {
-- 			console->log_str[console->log_idx] = 0;
---			brcmf_dbg(PCIE, "CONSOLE: %s", console->log_str);
--+			pr_debug("CONSOLE: %s", console->log_str);
-- 			console->log_idx = 0;
-- 		}
-- 	}
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -123,6 +123,7 @@ struct rte_console {
-- 
-- #define BRCMF_FIRSTREAD	(1 << 6)
-- 
--+#define BRCMF_CONSOLE	10	/* watchdog interval to poll console */
-- 
-- /* SBSDIO_DEVICE_CTL */
-- 
--@@ -3204,6 +3205,8 @@ static void brcmf_sdio_debugfs_create(st
-- 	if (IS_ERR_OR_NULL(dentry))
-- 		return;
-- 
--+	bus->console_interval = BRCMF_CONSOLE;
--+
-- 	brcmf_debugfs_add_entry(drvr, "forensics", brcmf_sdio_forensic_read);
-- 	brcmf_debugfs_add_entry(drvr, "counters",
-- 				brcmf_debugfs_sdio_count_read);
--@@ -3613,7 +3616,7 @@ static void brcmf_sdio_bus_watchdog(stru
-- 	}
-- #ifdef DEBUG
-- 	/* Poll for console output periodically */
---	if (bus->sdiodev->state == BRCMF_SDIOD_DATA &&
--+	if (bus->sdiodev->state == BRCMF_SDIOD_DATA && BRCMF_FWCON_ON() &&
-- 	    bus->console_interval != 0) {
-- 		bus->console.count += BRCMF_WD_POLL_MS;
-- 		if (bus->console.count >= bus->console_interval) {
-diff --git a/package/kernel/mac80211/patches/365-0010-brcmfmac-remove-ifidx-parameter-from-brcmf_fws_txsta.patch b/package/kernel/mac80211/patches/365-0010-brcmfmac-remove-ifidx-parameter-from-brcmf_fws_txsta.patch
-deleted file mode 100644
-index 53e7ede..0000000
---- a/package/kernel/mac80211/patches/365-0010-brcmfmac-remove-ifidx-parameter-from-brcmf_fws_txsta.patch
-+++ /dev/null
-@@ -1,34 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:15:02 +0200
--Subject: [PATCH] brcmfmac: remove ifidx parameter from
-- brcmf_fws_txstatus_suppressed()
--
--The brcmf_fws_txstatus_suppressed() function prototype specifies an
--ifidx parameter which is not used within the function implementation.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -1398,7 +1398,7 @@ done:
-- }
-- 
-- static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
---					 struct sk_buff *skb, u8 ifidx,
--+					 struct sk_buff *skb,
-- 					 u32 genbit, u16 seq)
-- {
-- 	struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
--@@ -1503,7 +1503,7 @@ brcmf_fws_txs_process(struct brcmf_fws_i
-- 		return -EINVAL;
-- 	}
-- 	if (!remove_from_hanger)
---		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifp->ifidx,
--+		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
-- 						    genbit, seq);
-- 	if (remove_from_hanger || ret)
-- 		brcmf_txfinalize(ifp, skb, true);
-diff --git a/package/kernel/mac80211/patches/365-0011-brcmfmac-change-prototype-for-brcmf_fws_hdrpull.patch b/package/kernel/mac80211/patches/365-0011-brcmfmac-change-prototype-for-brcmf_fws_hdrpull.patch
-deleted file mode 100644
-index bb05235..0000000
---- a/package/kernel/mac80211/patches/365-0011-brcmfmac-change-prototype-for-brcmf_fws_hdrpull.patch
-+++ /dev/null
-@@ -1,97 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:15:03 +0200
--Subject: [PATCH] brcmfmac: change prototype for brcmf_fws_hdrpull()
--
--Instead of passing ifidx and drvr just pass struct brcmf_if pointer
--which holds both parameters.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--@@ -312,8 +312,7 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 
-- 	skb_pull(pktbuf, BCDC_HEADER_LEN);
-- 	if (do_fws)
---		brcmf_fws_hdrpull(drvr, tmp_if->ifidx, h->data_offset << 2,
---				  pktbuf);
--+		brcmf_fws_hdrpull(tmp_if, h->data_offset << 2, pktbuf);
-- 	else
-- 		skb_pull(pktbuf, h->data_offset << 2);
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -1616,11 +1616,10 @@ static int brcmf_fws_notify_bcmc_credit_
-- 	return 0;
-- }
-- 
---int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
---		      struct sk_buff *skb)
--+void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
-- {
-- 	struct brcmf_skb_reorder_data *rd;
---	struct brcmf_fws_info *fws = drvr->fws;
--+	struct brcmf_fws_info *fws = ifp->drvr->fws;
-- 	u8 *signal_data;
-- 	s16 data_len;
-- 	u8 type;
--@@ -1630,20 +1629,20 @@ int brcmf_fws_hdrpull(struct brcmf_pub *
-- 	s32 err;
-- 
-- 	brcmf_dbg(HDRS, "enter: ifidx %d, skblen %u, sig %d\n",
---		  ifidx, skb->len, signal_len);
--+		  ifp->ifidx, skb->len, siglen);
-- 
---	WARN_ON(signal_len > skb->len);
--+	WARN_ON(siglen > skb->len);
-- 
---	if (!signal_len)
---		return 0;
--+	if (!siglen)
--+		return;
-- 	/* if flow control disabled, skip to packet data and leave */
-- 	if ((!fws) || (!fws->fw_signals)) {
---		skb_pull(skb, signal_len);
---		return 0;
--+		skb_pull(skb, siglen);
--+		return;
-- 	}
-- 
-- 	fws->stats.header_pulls++;
---	data_len = signal_len;
--+	data_len = siglen;
-- 	signal_data = skb->data;
-- 
-- 	status = BRCMF_FWS_RET_OK_NOSCHEDULE;
--@@ -1731,14 +1730,12 @@ int brcmf_fws_hdrpull(struct brcmf_pub *
-- 	/* signalling processing result does
-- 	 * not affect the actual ethernet packet.
-- 	 */
---	skb_pull(skb, signal_len);
--+	skb_pull(skb, siglen);
-- 
-- 	/* this may be a signal-only packet
-- 	 */
-- 	if (skb->len == 0)
-- 		fws->stats.header_only_pkt++;
---
---	return 0;
-- }
-- 
-- static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
--@@ -21,8 +21,7 @@
-- int brcmf_fws_init(struct brcmf_pub *drvr);
-- void brcmf_fws_deinit(struct brcmf_pub *drvr);
-- bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
---int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
---		      struct sk_buff *skb);
--+void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
-- int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb);
-- 
-- void brcmf_fws_reset_interface(struct brcmf_if *ifp);
-diff --git a/package/kernel/mac80211/patches/365-0012-brcmfmac-introduce-brcmf_net_detach-function.patch b/package/kernel/mac80211/patches/365-0012-brcmfmac-introduce-brcmf_net_detach-function.patch
-deleted file mode 100644
-index ba92c67..0000000
---- a/package/kernel/mac80211/patches/365-0012-brcmfmac-introduce-brcmf_net_detach-function.patch
-+++ /dev/null
-@@ -1,99 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 26 Aug 2015 22:15:04 +0200
--Subject: [PATCH] brcmfmac: introduce brcmf_net_detach() function
--
--In case of error during brcmf_bus_start() the network interfaces were
--freed using free_netdev(). However, the interfaces may have additional
--memory allocated which is not freed. The netdev has destructor set to
--brcmf_cfg80211_free_netdev() which frees the additional memory if
--allocated and call free_netdev(). The brcmf_net_detach() either calls
--brcmf_cfg80211_free_netdev() directly or uses unregister_netdev() when
--struct net_device::reg_state indicates the netdev was registered.
--
--Reported-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -4746,7 +4746,8 @@ void brcmf_cfg80211_free_netdev(struct n
-- 	ifp = netdev_priv(ndev);
-- 	vif = ifp->vif;
-- 
---	brcmf_free_vif(vif);
--+	if (vif)
--+		brcmf_free_vif(vif);
-- 	free_netdev(ndev);
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -718,8 +718,6 @@ int brcmf_net_attach(struct brcmf_if *if
-- 	}
-- 
-- 	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
---
---	ndev->destructor = brcmf_cfg80211_free_netdev;
-- 	return 0;
-- 
-- fail:
--@@ -729,6 +727,14 @@ fail:
-- 	return -EBADE;
-- }
-- 
--+static void brcmf_net_detach(struct net_device *ndev)
--+{
--+	if (ndev->reg_state == NETREG_REGISTERED)
--+		unregister_netdev(ndev);
--+	else
--+		brcmf_cfg80211_free_netdev(ndev);
--+}
--+
-- static int brcmf_net_p2p_open(struct net_device *ndev)
-- {
-- 	brcmf_dbg(TRACE, "Enter\n");
--@@ -805,8 +811,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 			  ifp->ndev->name);
-- 		if (ifidx) {
-- 			netif_stop_queue(ifp->ndev);
---			unregister_netdev(ifp->ndev);
---			free_netdev(ifp->ndev);
--+			brcmf_net_detach(ifp->ndev);
-- 			drvr->iflist[bssidx] = NULL;
-- 		} else {
-- 			brcmf_err("ignore IF event\n");
--@@ -828,6 +833,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 		if (!ndev)
-- 			return ERR_PTR(-ENOMEM);
-- 
--+		ndev->destructor = brcmf_cfg80211_free_netdev;
-- 		ifp = netdev_priv(ndev);
-- 		ifp->ndev = ndev;
-- 		/* store mapping ifidx to bssidx */
--@@ -879,8 +885,7 @@ static void brcmf_del_if(struct brcmf_pu
-- 			cancel_work_sync(&ifp->setmacaddr_work);
-- 			cancel_work_sync(&ifp->multicast_work);
-- 		}
---		/* unregister will take care of freeing it */
---		unregister_netdev(ifp->ndev);
--+		brcmf_net_detach(ifp->ndev);
-- 	}
-- }
-- 
--@@ -1056,11 +1061,11 @@ fail:
-- 			brcmf_fws_deinit(drvr);
-- 		}
-- 		if (drvr->iflist[0]) {
---			free_netdev(ifp->ndev);
--+			brcmf_net_detach(ifp->ndev);
-- 			drvr->iflist[0] = NULL;
-- 		}
-- 		if (p2p_ifp) {
---			free_netdev(p2p_ifp->ndev);
--+			brcmf_net_detach(p2p_ifp->ndev);
-- 			drvr->iflist[1] = NULL;
-- 		}
-- 		return ret;
-diff --git a/package/kernel/mac80211/patches/366-brcmfmac-Reset-PCIE-devices-after-recognition.patch b/package/kernel/mac80211/patches/366-brcmfmac-Reset-PCIE-devices-after-recognition.patch
-deleted file mode 100644
-index 5a7e447..0000000
---- a/package/kernel/mac80211/patches/366-brcmfmac-Reset-PCIE-devices-after-recognition.patch
-+++ /dev/null
-@@ -1,193 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 27 Aug 2015 16:14:06 +0200
--Subject: [PATCH] brcmfmac: Reset PCIE devices after recognition.
--
--When PCIE type devices are being FW reloaded without being properly
--reset then the device ends up in a locked state, requiring the
--device to be completely powered down. This patch adds a reset
--through watchdog at the moment the device (cores) has been
--recognized. This will solve warm reboot issues.
--
--Cc: Rafal Milecki <zajec5@gmail.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -101,6 +101,9 @@
-- /* ARM Cortex M3 core, ID 0x82a */
-- #define BCM4329_CORE_ARM_BASE		0x18002000
-- 
--+/* Max possibly supported memory size (limited by IO mapped memory) */
--+#define BRCMF_CHIP_MAX_MEMSIZE		(4 * 1024 * 1024)
--+
-- #define CORE_SB(base, field) \
-- 		(base + SBCONFIGOFF + offsetof(struct sbconfig, field))
-- #define	SBCOREREV(sbidh) \
--@@ -687,6 +690,12 @@ static int brcmf_chip_get_raminfo(struct
-- 		brcmf_err("RAM size is undetermined\n");
-- 		return -ENOMEM;
-- 	}
--+
--+	if (ci->pub.ramsize > BRCMF_CHIP_MAX_MEMSIZE) {
--+		brcmf_err("RAM size is incorrect\n");
--+		return -ENOMEM;
--+	}
--+
-- 	return 0;
-- }
-- 
--@@ -899,6 +908,15 @@ static int brcmf_chip_recognition(struct
-- 
-- 	/* assure chip is passive for core access */
-- 	brcmf_chip_set_passive(&ci->pub);
--+
--+	/* Call bus specific reset function now. Cores have been determined
--+	 * but further access may require a chip specific reset at this point.
--+	 */
--+	if (ci->ops->reset) {
--+		ci->ops->reset(ci->ctx, &ci->pub);
--+		brcmf_chip_set_passive(&ci->pub);
--+	}
--+
-- 	return brcmf_chip_get_raminfo(ci);
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.h
--@@ -73,6 +73,7 @@ struct brcmf_buscore_ops {
-- 	u32 (*read32)(void *ctx, u32 addr);
-- 	void (*write32)(void *ctx, u32 addr, u32 value);
-- 	int (*prepare)(void *ctx);
--+	int (*reset)(void *ctx, struct brcmf_chip *chip);
-- 	int (*setup)(void *ctx, struct brcmf_chip *chip);
-- 	void (*activate)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
-- };
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -74,6 +74,8 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_REG_INTMASK			0x94
-- #define BRCMF_PCIE_REG_SBMBX			0x98
-- 
--+#define BRCMF_PCIE_REG_LINK_STATUS_CTRL		0xBC
--+
-- #define BRCMF_PCIE_PCIE2REG_INTMASK		0x24
-- #define BRCMF_PCIE_PCIE2REG_MAILBOXINT		0x48
-- #define BRCMF_PCIE_PCIE2REG_MAILBOXMASK		0x4C
--@@ -466,6 +468,7 @@ brcmf_pcie_select_core(struct brcmf_pcie
-- 
-- static void brcmf_pcie_reset_device(struct brcmf_pciedev_info *devinfo)
-- {
--+	struct brcmf_core *core;
-- 	u16 cfg_offset[] = { BRCMF_PCIE_CFGREG_STATUS_CMD,
-- 			     BRCMF_PCIE_CFGREG_PM_CSR,
-- 			     BRCMF_PCIE_CFGREG_MSI_CAP,
--@@ -484,32 +487,38 @@ static void brcmf_pcie_reset_device(stru
-- 	if (!devinfo->ci)
-- 		return;
-- 
--+	/* Disable ASPM */
-- 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
---	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR,
---			       BRCMF_PCIE_CFGREG_LINK_STATUS_CTRL);
---	lsc = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA);
--+	pci_read_config_dword(devinfo->pdev, BRCMF_PCIE_REG_LINK_STATUS_CTRL,
--+			      &lsc);
-- 	val = lsc & (~BRCMF_PCIE_LINK_STATUS_CTRL_ASPM_ENAB);
---	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA, val);
--+	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_LINK_STATUS_CTRL,
--+			       val);
-- 
--+	/* Watchdog reset */
-- 	brcmf_pcie_select_core(devinfo, BCMA_CORE_CHIPCOMMON);
-- 	WRITECC32(devinfo, watchdog, 4);
-- 	msleep(100);
-- 
--+	/* Restore ASPM */
-- 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
---	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR,
---			       BRCMF_PCIE_CFGREG_LINK_STATUS_CTRL);
---	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA, lsc);
--+	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_LINK_STATUS_CTRL,
--+			       lsc);
-- 
---	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
---	for (i = 0; i < ARRAY_SIZE(cfg_offset); i++) {
---		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR,
---				       cfg_offset[i]);
---		val = brcmf_pcie_read_reg32(devinfo,
---					    BRCMF_PCIE_PCIE2REG_CONFIGDATA);
---		brcmf_dbg(PCIE, "config offset 0x%04x, value 0x%04x\n",
---			  cfg_offset[i], val);
---		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGDATA,
---				       val);
--+	core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
--+	if (core->rev <= 13) {
--+		for (i = 0; i < ARRAY_SIZE(cfg_offset); i++) {
--+			brcmf_pcie_write_reg32(devinfo,
--+					       BRCMF_PCIE_PCIE2REG_CONFIGADDR,
--+					       cfg_offset[i]);
--+			val = brcmf_pcie_read_reg32(devinfo,
--+				BRCMF_PCIE_PCIE2REG_CONFIGDATA);
--+			brcmf_dbg(PCIE, "config offset 0x%04x, value 0x%04x\n",
--+				  cfg_offset[i], val);
--+			brcmf_pcie_write_reg32(devinfo,
--+					       BRCMF_PCIE_PCIE2REG_CONFIGDATA,
--+					       val);
--+		}
-- 	}
-- }
-- 
--@@ -519,8 +528,6 @@ static void brcmf_pcie_attach(struct brc
-- 	u32 config;
-- 
-- 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
---	if (brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_INTMASK) != 0)
---		brcmf_pcie_reset_device(devinfo);
-- 	/* BAR1 window may not be sized properly */
-- 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-- 	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR, 0x4e0);
--@@ -1636,6 +1643,23 @@ static int brcmf_pcie_buscoreprep(void *
-- }
-- 
-- 
--+static int brcmf_pcie_buscore_reset(void *ctx, struct brcmf_chip *chip)
--+{
--+	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)ctx;
--+	u32 val;
--+
--+	devinfo->ci = chip;
--+	brcmf_pcie_reset_device(devinfo);
--+
--+	val = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT);
--+	if (val != 0xffffffff)
--+		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT,
--+				       val);
--+
--+	return 0;
--+}
--+
--+
-- static void brcmf_pcie_buscore_activate(void *ctx, struct brcmf_chip *chip,
-- 					u32 rstvec)
-- {
--@@ -1647,6 +1671,7 @@ static void brcmf_pcie_buscore_activate(
-- 
-- static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
-- 	.prepare = brcmf_pcie_buscoreprep,
--+	.reset = brcmf_pcie_buscore_reset,
-- 	.activate = brcmf_pcie_buscore_activate,
-- 	.read32 = brcmf_pcie_buscore_read32,
-- 	.write32 = brcmf_pcie_buscore_write32,
--@@ -1814,7 +1839,6 @@ brcmf_pcie_remove(struct pci_dev *pdev)
-- 		brcmf_pcie_intr_disable(devinfo);
-- 
-- 	brcmf_detach(&pdev->dev);
---	brcmf_pcie_reset_device(devinfo);
-- 
-- 	kfree(bus->bus_priv.pcie);
-- 	kfree(bus->msgbuf->flowrings);
-diff --git a/package/kernel/mac80211/patches/367-ath10k-fix-DMA-related-firmware-crashes-on-multiple-.patch b/package/kernel/mac80211/patches/367-ath10k-fix-DMA-related-firmware-crashes-on-multiple-.patch
-deleted file mode 100644
-index f7b3e40..0000000
---- a/package/kernel/mac80211/patches/367-ath10k-fix-DMA-related-firmware-crashes-on-multiple-.patch
-+++ /dev/null
-@@ -1,24 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Sun, 13 Sep 2015 22:26:10 +0200
--Subject: [PATCH] ath10k: fix DMA related firmware crashes on multiple devices
--
--Some platforms really don't like DMA bursts of 256 bytes, and this
--causes the firmware to crash when sending beacons.
--Also, changing this based on the firmware version does not seem to make
--much sense, so use 128 bytes for all versions.
--
--Cc: stable@vger.kernel.org
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath10k/hw.h
--+++ b/drivers/net/wireless/ath/ath10k/hw.h
--@@ -253,7 +253,7 @@ struct ath10k_pktlog_hdr {
-- #define TARGET_10X_MAX_FRAG_ENTRIES		0
-- 
-- /* 10.2 parameters */
---#define TARGET_10_2_DMA_BURST_SIZE		1
--+#define TARGET_10_2_DMA_BURST_SIZE		0
-- 
-- /* Target specific defines for WMI-TLV firmware */
-- #define TARGET_TLV_NUM_VDEVS			3
-diff --git a/package/kernel/mac80211/patches/368-ath9k-declare-required-extra-tx-headroom.patch b/package/kernel/mac80211/patches/368-ath9k-declare-required-extra-tx-headroom.patch
-deleted file mode 100644
-index c420d20..0000000
---- a/package/kernel/mac80211/patches/368-ath9k-declare-required-extra-tx-headroom.patch
-+++ /dev/null
-@@ -1,22 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Thu, 24 Sep 2015 16:57:37 +0200
--Subject: [PATCH] ath9k: declare required extra tx headroom
--
--ath9k inserts padding between the 802.11 header and the data area (to
--align it). Since it didn't declare this extra required headroom, this
--led to some nasty issues like randomly dropped packets in some setups.
--
--Cc: stable@vger.kernel.org
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/drivers/net/wireless/ath/ath9k/init.c
--+++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -867,6 +867,7 @@ static void ath9k_set_hw_capab(struct at
-- 	hw->max_rate_tries = 10;
-- 	hw->sta_data_size = sizeof(struct ath_node);
-- 	hw->vif_data_size = sizeof(struct ath_vif);
--+	hw->extra_tx_headroom = 4;
-- 
-- 	hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
-- 	hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
-diff --git a/package/kernel/mac80211/patches/369-mac80211-initialize-tid-field-in-struct-ieee80211_tx.patch b/package/kernel/mac80211/patches/369-mac80211-initialize-tid-field-in-struct-ieee80211_tx.patch
-deleted file mode 100644
-index 1478efa..0000000
---- a/package/kernel/mac80211/patches/369-mac80211-initialize-tid-field-in-struct-ieee80211_tx.patch
-+++ /dev/null
-@@ -1,21 +0,0 @@
--From: Felix Fietkau <nbd@openwrt.org>
--Date: Mon, 5 Oct 2015 17:41:25 +0200
--Subject: [PATCH] mac80211: initialize tid field in struct ieee80211_txq
--
--Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-----
--
----- a/net/mac80211/util.c
--+++ b/net/mac80211/util.c
--@@ -3323,9 +3323,11 @@ void ieee80211_init_tx_queue(struct ieee
-- 	if (sta) {
-- 		txqi->txq.sta = &sta->sta;
-- 		sta->sta.txq[tid] = &txqi->txq;
--+		txqi->txq.tid = tid;
-- 		txqi->txq.ac = ieee802_1d_to_ac[tid & 7];
-- 	} else {
-- 		sdata->vif.txq = &txqi->txq;
--+		txqi->txq.tid = 0;
-- 		txqi->txq.ac = IEEE80211_AC_BE;
-- 	}
-- }
-diff --git a/package/kernel/mac80211/patches/370-0001-brcmfmac-Fix-exception-handling.patch b/package/kernel/mac80211/patches/370-0001-brcmfmac-Fix-exception-handling.patch
-deleted file mode 100644
-index bcd1031..0000000
---- a/package/kernel/mac80211/patches/370-0001-brcmfmac-Fix-exception-handling.patch
-+++ /dev/null
-@@ -1,24 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:04 +0200
--Subject: [PATCH] brcmfmac: Fix exception handling.
--
--In some exception situations the ifp->vif was not properly assigned
--which could result in crash.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6331,6 +6331,7 @@ wiphy_unreg_out:
-- priv_out:
-- 	wl_deinit_priv(cfg);
-- 	brcmf_free_vif(vif);
--+	ifp->vif = NULL;
-- wiphy_out:
-- 	brcmf_free_wiphy(wiphy);
-- 	return NULL;
-diff --git a/package/kernel/mac80211/patches/370-0002-brcmfmac-Add-support-for-the-BCM4350-PCIE-device.patch b/package/kernel/mac80211/patches/370-0002-brcmfmac-Add-support-for-the-BCM4350-PCIE-device.patch
-deleted file mode 100644
-index f4ab77b..0000000
---- a/package/kernel/mac80211/patches/370-0002-brcmfmac-Add-support-for-the-BCM4350-PCIE-device.patch
-+++ /dev/null
-@@ -1,81 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:05 +0200
--Subject: [PATCH] brcmfmac: Add support for the BCM4350 PCIE device.
--
--This patch adds support fo the BRCM4350 2x2 11ac PCIE device.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -647,6 +647,7 @@ static u32 brcmf_chip_tcm_rambase(struct
-- 		return 0x198000;
-- 	case BRCM_CC_4335_CHIP_ID:
-- 	case BRCM_CC_4339_CHIP_ID:
--+	case BRCM_CC_4350_CHIP_ID:
-- 	case BRCM_CC_4354_CHIP_ID:
-- 	case BRCM_CC_4356_CHIP_ID:
-- 	case BRCM_CC_43567_CHIP_ID:
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -47,6 +47,8 @@ enum brcmf_pcie_state {
-- 
-- #define BRCMF_PCIE_43602_FW_NAME		"brcm/brcmfmac43602-pcie.bin"
-- #define BRCMF_PCIE_43602_NVRAM_NAME		"brcm/brcmfmac43602-pcie.txt"
--+#define BRCMF_PCIE_4350_FW_NAME			"brcm/brcmfmac4350-pcie.bin"
--+#define BRCMF_PCIE_4350_NVRAM_NAME		"brcm/brcmfmac4350-pcie.txt"
-- #define BRCMF_PCIE_4356_FW_NAME			"brcm/brcmfmac4356-pcie.bin"
-- #define BRCMF_PCIE_4356_NVRAM_NAME		"brcm/brcmfmac4356-pcie.txt"
-- #define BRCMF_PCIE_43570_FW_NAME		"brcm/brcmfmac43570-pcie.bin"
--@@ -194,6 +196,8 @@ enum brcmf_pcie_state {
-- 
-- MODULE_FIRMWARE(BRCMF_PCIE_43602_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43602_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4350_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4350_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4356_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4356_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME);
--@@ -1418,6 +1422,10 @@ static int brcmf_pcie_get_fwnames(struct
-- 		fw_name = BRCMF_PCIE_43602_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_43602_NVRAM_NAME;
-- 		break;
--+	case BRCM_CC_4350_CHIP_ID:
--+		fw_name = BRCMF_PCIE_4350_FW_NAME;
--+		nvram_name = BRCMF_PCIE_4350_NVRAM_NAME;
--+		break;
-- 	case BRCM_CC_4356_CHIP_ID:
-- 		fw_name = BRCMF_PCIE_4356_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_4356_NVRAM_NAME;
--@@ -1956,6 +1964,7 @@ cleanup:
-- 	PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
-- 
-- static struct pci_device_id brcmf_pcie_devid_table[] = {
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -39,6 +39,7 @@
-- #define BRCM_CC_4339_CHIP_ID		0x4339
-- #define BRCM_CC_43430_CHIP_ID		43430
-- #define BRCM_CC_4345_CHIP_ID		0x4345
--+#define BRCM_CC_4350_CHIP_ID		0x4350
-- #define BRCM_CC_4354_CHIP_ID		0x4354
-- #define BRCM_CC_4356_CHIP_ID		0x4356
-- #define BRCM_CC_43566_CHIP_ID		43566
--@@ -56,6 +57,7 @@
-- #define BRCM_USB_BCMFW_DEVICE_ID	0x0bdc
-- 
-- /* PCIE Device IDs */
--+#define BRCM_PCIE_4350_DEVICE_ID	0x43a3
-- #define BRCM_PCIE_4354_DEVICE_ID	0x43df
-- #define BRCM_PCIE_4356_DEVICE_ID	0x43ec
-- #define BRCM_PCIE_43567_DEVICE_ID	0x43d3
-diff --git a/package/kernel/mac80211/patches/370-0003-brcmfmac-Fix-set-and-get-tx-power-functions.patch b/package/kernel/mac80211/patches/370-0003-brcmfmac-Fix-set-and-get-tx-power-functions.patch
-deleted file mode 100644
-index 62fdd8d..0000000
---- a/package/kernel/mac80211/patches/370-0003-brcmfmac-Fix-set-and-get-tx-power-functions.patch
-+++ /dev/null
-@@ -1,218 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:06 +0200
--Subject: [PATCH] brcmfmac: Fix set and get tx-power functions.
--
--Implementation of tx-power (get and set) related functions are
--still assuming mW interface. This is wrong as functions use dbm
--(or mbm) nowadays. As a result a tx power configuration could
--result in wrong power configuration.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -236,89 +236,6 @@ static int brcmf_roamoff;
-- module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
-- MODULE_PARM_DESC(roamoff, "do not use internal roaming engine");
-- 
---/* Quarter dBm units to mW
--- * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
--- * Table is offset so the last entry is largest mW value that fits in
--- * a u16.
--- */
---
---#define QDBM_OFFSET 153		/* Offset for first entry */
---#define QDBM_TABLE_LEN 40	/* Table size */
---
---/* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
--- * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
--- */
---#define QDBM_TABLE_LOW_BOUND 6493	/* Low bound */
---
---/* Largest mW value that will round down to the last table entry,
--- * QDBM_OFFSET + QDBM_TABLE_LEN-1.
--- * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) +
--- * mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
--- */
---#define QDBM_TABLE_HIGH_BOUND 64938	/* High bound */
---
---static const u16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
---/* qdBm:	+0	+1	+2	+3	+4	+5	+6	+7 */
---/* 153: */ 6683, 7079, 7499, 7943, 8414, 8913, 9441, 10000,
---/* 161: */ 10593, 11220, 11885, 12589, 13335, 14125, 14962, 15849,
---/* 169: */ 16788, 17783, 18836, 19953, 21135, 22387, 23714, 25119,
---/* 177: */ 26607, 28184, 29854, 31623, 33497, 35481, 37584, 39811,
---/* 185: */ 42170, 44668, 47315, 50119, 53088, 56234, 59566, 63096
---};
---
---static u16 brcmf_qdbm_to_mw(u8 qdbm)
---{
---	uint factor = 1;
---	int idx = qdbm - QDBM_OFFSET;
---
---	if (idx >= QDBM_TABLE_LEN)
---		/* clamp to max u16 mW value */
---		return 0xFFFF;
---
---	/* scale the qdBm index up to the range of the table 0-40
---	 * where an offset of 40 qdBm equals a factor of 10 mW.
---	 */
---	while (idx < 0) {
---		idx += 40;
---		factor *= 10;
---	}
---
---	/* return the mW value scaled down to the correct factor of 10,
---	 * adding in factor/2 to get proper rounding.
---	 */
---	return (nqdBm_to_mW_map[idx] + factor / 2) / factor;
---}
---
---static u8 brcmf_mw_to_qdbm(u16 mw)
---{
---	u8 qdbm;
---	int offset;
---	uint mw_uint = mw;
---	uint boundary;
---
---	/* handle boundary case */
---	if (mw_uint <= 1)
---		return 0;
---
---	offset = QDBM_OFFSET;
---
---	/* move mw into the range of the table */
---	while (mw_uint < QDBM_TABLE_LOW_BOUND) {
---		mw_uint *= 10;
---		offset -= 40;
---	}
---
---	for (qdbm = 0; qdbm < QDBM_TABLE_LEN - 1; qdbm++) {
---		boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm + 1] -
---						    nqdBm_to_mW_map[qdbm]) / 2;
---		if (mw_uint < boundary)
---			break;
---	}
---
---	qdbm += (u8) offset;
---
---	return qdbm;
---}
-- 
-- static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
-- 			       struct cfg80211_chan_def *ch)
--@@ -2016,16 +1933,14 @@ static s32
-- brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
-- 			    enum nl80211_tx_power_setting type, s32 mbm)
-- {
---
-- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
-- 	struct net_device *ndev = cfg_to_ndev(cfg);
-- 	struct brcmf_if *ifp = netdev_priv(ndev);
---	u16 txpwrmw;
---	s32 err = 0;
---	s32 disable = 0;
---	s32 dbm = MBM_TO_DBM(mbm);
--+	s32 err;
--+	s32 disable;
--+	u32 qdbm = 127;
-- 
---	brcmf_dbg(TRACE, "Enter\n");
--+	brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
-- 	if (!check_vif_up(ifp->vif))
-- 		return -EIO;
-- 
--@@ -2034,12 +1949,20 @@ brcmf_cfg80211_set_tx_power(struct wiphy
-- 		break;
-- 	case NL80211_TX_POWER_LIMITED:
-- 	case NL80211_TX_POWER_FIXED:
---		if (dbm < 0) {
--+		if (mbm < 0) {
-- 			brcmf_err("TX_POWER_FIXED - dbm is negative\n");
-- 			err = -EINVAL;
-- 			goto done;
-- 		}
--+		qdbm =  MBM_TO_DBM(4 * mbm);
--+		if (qdbm > 127)
--+			qdbm = 127;
--+		qdbm |= WL_TXPWR_OVERRIDE;
-- 		break;
--+	default:
--+		brcmf_err("Unsupported type %d\n", type);
--+		err = -EINVAL;
--+		goto done;
-- 	}
-- 	/* Make sure radio is off or on as far as software is concerned */
-- 	disable = WL_RADIO_SW_DISABLE << 16;
--@@ -2047,52 +1970,44 @@ brcmf_cfg80211_set_tx_power(struct wiphy
-- 	if (err)
-- 		brcmf_err("WLC_SET_RADIO error (%d)\n", err);
-- 
---	if (dbm > 0xffff)
---		txpwrmw = 0xffff;
---	else
---		txpwrmw = (u16) dbm;
---	err = brcmf_fil_iovar_int_set(ifp, "qtxpower",
---				      (s32)brcmf_mw_to_qdbm(txpwrmw));
--+	err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
-- 	if (err)
-- 		brcmf_err("qtxpower error (%d)\n", err);
---	cfg->conf->tx_power = dbm;
-- 
-- done:
---	brcmf_dbg(TRACE, "Exit\n");
--+	brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
-- 	return err;
-- }
-- 
---static s32 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy,
---				       struct wireless_dev *wdev,
---				       s32 *dbm)
--+static s32
--+brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
--+			    s32 *dbm)
-- {
-- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
---	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
---	s32 txpwrdbm;
---	u8 result;
---	s32 err = 0;
--+	struct net_device *ndev = cfg_to_ndev(cfg);
--+	struct brcmf_if *ifp = netdev_priv(ndev);
--+	s32 qdbm = 0;
--+	s32 err;
-- 
-- 	brcmf_dbg(TRACE, "Enter\n");
-- 	if (!check_vif_up(ifp->vif))
-- 		return -EIO;
-- 
---	err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &txpwrdbm);
--+	err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
-- 	if (err) {
-- 		brcmf_err("error (%d)\n", err);
-- 		goto done;
-- 	}
---
---	result = (u8) (txpwrdbm & ~WL_TXPWR_OVERRIDE);
---	*dbm = (s32) brcmf_qdbm_to_mw(result);
--+	*dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
-- 
-- done:
---	brcmf_dbg(TRACE, "Exit\n");
--+	brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
-- 	return err;
-- }
-- 
-- static s32
-- brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
---			       u8 key_idx, bool unicast, bool multicast)
--+				  u8 key_idx, bool unicast, bool multicast)
-- {
-- 	struct brcmf_if *ifp = netdev_priv(ndev);
-- 	u32 index;
-diff --git a/package/kernel/mac80211/patches/370-0004-brcmfmac-Only-assign-primary-netdev-to-if2bss-array.patch b/package/kernel/mac80211/patches/370-0004-brcmfmac-Only-assign-primary-netdev-to-if2bss-array.patch
-deleted file mode 100644
-index c51365f..0000000
---- a/package/kernel/mac80211/patches/370-0004-brcmfmac-Only-assign-primary-netdev-to-if2bss-array.patch
-+++ /dev/null
-@@ -1,73 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:07 +0200
--Subject: [PATCH] brcmfmac: Only assign primary netdev to if2bss array.
--
--The if2bss allows for translation of ifidx to bssidx which has a 1:n
--relation. Therefor only the first (primary) netdev should be
--assigned in this array. This fixes the p2pon=1 module param usage.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -53,6 +53,8 @@ MODULE_LICENSE("Dual BSD/GPL");
-- #define BRCMF_RXREORDER_EXPIDX_VALID		0x08
-- #define BRCMF_RXREORDER_NEW_HOLE		0x10
-- 
--+#define BRCMF_BSSIDX_INVALID			-1
--+
-- /* Error bits */
-- int brcmf_msg_level;
-- module_param_named(debug, brcmf_msg_level, int, S_IRUSR | S_IWUSR);
--@@ -837,7 +839,8 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 		ifp = netdev_priv(ndev);
-- 		ifp->ndev = ndev;
-- 		/* store mapping ifidx to bssidx */
---		drvr->if2bss[ifidx] = bssidx;
--+		if (drvr->if2bss[ifidx] == BRCMF_BSSIDX_INVALID)
--+			drvr->if2bss[ifidx] = bssidx;
-- 	}
-- 
-- 	ifp->drvr = drvr;
--@@ -862,15 +865,15 @@ static void brcmf_del_if(struct brcmf_pu
-- 	struct brcmf_if *ifp;
-- 
-- 	ifp = drvr->iflist[bssidx];
---	drvr->if2bss[ifp->ifidx] = -1;
-- 	drvr->iflist[bssidx] = NULL;
-- 	if (!ifp) {
-- 		brcmf_err("Null interface, idx=%d\n", bssidx);
-- 		return;
-- 	}
-- 	brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifp->ifidx);
--+	if (drvr->if2bss[ifp->ifidx] == bssidx)
--+		drvr->if2bss[ifp->ifidx] = BRCMF_BSSIDX_INVALID;
-- 	if (ifp->ndev) {
---		drvr->if2bss[ifp->ifidx] = -1;
-- 		if (bssidx == 0) {
-- 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
-- 				rtnl_lock();
--@@ -926,6 +929,7 @@ int brcmf_attach(struct device *dev)
-- {
-- 	struct brcmf_pub *drvr = NULL;
-- 	int ret = 0;
--+	int i;
-- 
-- 	brcmf_dbg(TRACE, "Enter\n");
-- 
--@@ -934,7 +938,9 @@ int brcmf_attach(struct device *dev)
-- 	if (!drvr)
-- 		return -ENOMEM;
-- 
---	memset(drvr->if2bss, 0xFF, sizeof(drvr->if2bss));
--+	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
--+		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
--+
-- 	mutex_init(&drvr->proto_block);
-- 
-- 	/* Link to bus module */
-diff --git a/package/kernel/mac80211/patches/370-0005-brcmfmac-Inform-p2p-module-about-p2pon-through-API.patch b/package/kernel/mac80211/patches/370-0005-brcmfmac-Inform-p2p-module-about-p2pon-through-API.patch
-deleted file mode 100644
-index 3c1058d..0000000
---- a/package/kernel/mac80211/patches/370-0005-brcmfmac-Inform-p2p-module-about-p2pon-through-API.patch
-+++ /dev/null
-@@ -1,113 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:08 +0200
--Subject: [PATCH] brcmfmac: Inform p2p module about p2pon through API
--
--When the p2pon module param is used then p2p attach will initialize
--p2p device iface in the firmware, but it is doing that by checking
--data. It is cleaner to pass the p2pon information to p2p by API.
--This information is also needed for other patch.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6126,7 +6126,8 @@ static void brcmf_free_wiphy(struct wiph
-- }
-- 
-- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
---						  struct device *busdev)
--+						  struct device *busdev,
--+						  bool p2pdev_forced)
-- {
-- 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
-- 	struct brcmf_cfg80211_info *cfg;
--@@ -6218,7 +6219,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
-- 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-- 	}
-- 
---	err = brcmf_p2p_attach(cfg);
--+	err = brcmf_p2p_attach(cfg, p2pdev_forced);
-- 	if (err) {
-- 		brcmf_err("P2P initilisation failed (%d)\n", err);
-- 		goto wiphy_unreg_out;
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--@@ -469,7 +469,8 @@ brcmf_cfg80211_connect_info *cfg_to_conn
-- }
-- 
-- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
---						  struct device *busdev);
--+						  struct device *busdev,
--+						  bool p2pdev_forced);
-- void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
-- s32 brcmf_cfg80211_up(struct net_device *ndev);
-- s32 brcmf_cfg80211_down(struct net_device *ndev);
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -1044,7 +1044,8 @@ int brcmf_bus_start(struct device *dev)
-- 
-- 	brcmf_fws_add_interface(ifp);
-- 
---	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev);
--+	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev,
--+					     brcmf_p2p_enable);
-- 	if (drvr->config == NULL) {
-- 		ret = -ENOMEM;
-- 		goto fail;
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2333,7 +2333,7 @@ void brcmf_p2p_stop_device(struct wiphy
--  *
--  * @cfg: driver private data for cfg80211 interface.
--  */
---s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
--+s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced)
-- {
-- 	struct brcmf_if *pri_ifp;
-- 	struct brcmf_if *p2p_ifp;
--@@ -2348,11 +2348,15 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
-- 
-- 	drvr = cfg->pub;
-- 
---	pri_ifp = drvr->iflist[0];
---	p2p_ifp = drvr->iflist[1];
---
--+	pri_ifp = brcmf_get_ifp(drvr, 0);
-- 	p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
-- 
--+	if (p2pdev_forced) {
--+		p2p_ifp = drvr->iflist[1];
--+	} else {
--+		p2p_ifp = NULL;
--+		p2p->p2pdev_dynamically = true;
--+	}
-- 	if (p2p_ifp) {
-- 		p2p_vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_P2P_DEVICE,
-- 					  false);
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
--@@ -124,6 +124,7 @@ struct afx_hdl {
--  * @wait_next_af: thread synchronizing struct.
--  * @gon_req_action: about to send go negotiation requets frame.
--  * @block_gon_req_tx: drop tx go negotiation requets frame.
--+ * @p2pdev_dynamically: is p2p device if created by module param or supplicant.
--  */
-- struct brcmf_p2p_info {
-- 	struct brcmf_cfg80211_info *cfg;
--@@ -144,9 +145,10 @@ struct brcmf_p2p_info {
-- 	struct completion wait_next_af;
-- 	bool gon_req_action;
-- 	bool block_gon_req_tx;
--+	bool p2pdev_dynamically;
-- };
-- 
---s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg);
--+s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced);
-- void brcmf_p2p_detach(struct brcmf_p2p_info *p2p);
-- struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
-- 				       enum nl80211_iftype type, u32 *flags,
-diff --git a/package/kernel/mac80211/patches/370-0006-brcmfmac-Fix-bug-in-flowring-management.patch b/package/kernel/mac80211/patches/370-0006-brcmfmac-Fix-bug-in-flowring-management.patch
-deleted file mode 100644
-index 66b2117..0000000
---- a/package/kernel/mac80211/patches/370-0006-brcmfmac-Fix-bug-in-flowring-management.patch
-+++ /dev/null
-@@ -1,26 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:09 +0200
--Subject: [PATCH] brcmfmac: Fix bug in flowring management.
--
--The hash index stored in the flowrings is of type u16 but gets
--stored in u8. This can result in incorrect indexing and possibly
--result in crashes. This patch fixes the type.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
--@@ -34,7 +34,7 @@ enum ring_status {
-- };
-- 
-- struct brcmf_flowring_ring {
---	u8 hash_id;
--+	u16 hash_id;
-- 	bool blocked;
-- 	enum ring_status status;
-- 	struct sk_buff_head skblist;
-diff --git a/package/kernel/mac80211/patches/370-0007-brcmfmac-Make-p2pon-module-param-always-available.patch b/package/kernel/mac80211/patches/370-0007-brcmfmac-Make-p2pon-module-param-always-available.patch
-deleted file mode 100644
-index c143c3b..0000000
---- a/package/kernel/mac80211/patches/370-0007-brcmfmac-Make-p2pon-module-param-always-available.patch
-+++ /dev/null
-@@ -1,29 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:10 +0200
--Subject: [PATCH] brcmfmac: Make p2pon module param always available.
--
--p2pon module param is currently under define BRCMDBG. Though it is
--a needed option for older versions of the wpa_supplicant which do not
--support the P2P_DEVICE interface.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -62,10 +62,8 @@ MODULE_PARM_DESC(debug, "level of debug
-- 
-- /* P2P0 enable */
-- static int brcmf_p2p_enable;
---#ifdef CPTCFG_BRCMDBG
-- module_param_named(p2pon, brcmf_p2p_enable, int, 0);
---MODULE_PARM_DESC(p2pon, "enable p2p management functionality");
---#endif
--+MODULE_PARM_DESC(p2pon, "enable legacy p2p management functionality");
-- 
-- char *brcmf_ifname(struct brcmf_pub *drvr, int ifidx)
-- {
-diff --git a/package/kernel/mac80211/patches/370-0008-brcmfmac-Workaround-in-change-vif-for-wpa_supplicant.patch b/package/kernel/mac80211/patches/370-0008-brcmfmac-Workaround-in-change-vif-for-wpa_supplicant.patch
-deleted file mode 100644
-index 15ac2d9..0000000
---- a/package/kernel/mac80211/patches/370-0008-brcmfmac-Workaround-in-change-vif-for-wpa_supplicant.patch
-+++ /dev/null
-@@ -1,76 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:11 +0200
--Subject: [PATCH] brcmfmac: Workaround in change vif for wpa_supplicant
-- support.
--
--Different wpa_supplicants have different behavior and expectations
--regarding the change_virtual_intf behavior. This patch implements
--a workaround for the different versions and possible brcmfmac
--configuration.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -776,6 +776,37 @@ brcmf_cfg80211_change_iface(struct wiphy
-- 	s32 err = 0;
-- 
-- 	brcmf_dbg(TRACE, "Enter, idx=%d, type=%d\n", ifp->bssidx, type);
--+
--+	/* WAR: There are a number of p2p interface related problems which
--+	 * need to be handled initially (before doing the validate).
--+	 * wpa_supplicant tends to do iface changes on p2p device/client/go
--+	 * which are not always possible/allowed. However we need to return
--+	 * OK otherwise the wpa_supplicant wont start. The situation differs
--+	 * on configuration and setup (p2pon=1 module param). The first check
--+	 * is to see if the request is a change to station for p2p iface.
--+	 */
--+	if ((type == NL80211_IFTYPE_STATION) &&
--+	    ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
--+	     (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
--+	     (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
--+		brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
--+		/* Now depending on whether module param p2pon=1 was used the
--+		 * response needs to be either 0 or EOPNOTSUPP. The reason is
--+		 * that if p2pon=1 is used, but a newer supplicant is used then
--+		 * we should return an error, as this combination wont work.
--+		 * In other situations 0 is returned and supplicant will start
--+		 * normally. It will give a trace in cfg80211, but it is the
--+		 * only way to get it working. Unfortunately this will result
--+		 * in situation where we wont support new supplicant in
--+		 * combination with module param p2pon=1, but that is the way
--+		 * it is. If the user tries this then unloading of driver might
--+		 * fail/lock.
--+		 */
--+		if (cfg->p2p.p2pdev_dynamically)
--+			return -EOPNOTSUPP;
--+		else
--+			return 0;
--+	}
-- 	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
-- 	if (err) {
-- 		brcmf_err("iface validation failed: err=%d\n", err);
--@@ -791,18 +822,6 @@ brcmf_cfg80211_change_iface(struct wiphy
-- 		infra = 0;
-- 		break;
-- 	case NL80211_IFTYPE_STATION:
---		/* Ignore change for p2p IF. Unclear why supplicant does this */
---		if ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
---		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO)) {
---			brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
---			/* WAR: It is unexpected to get a change of VIF for P2P
---			 * IF, but it happens. The request can not be handled
---			 * but returning EPERM causes a crash. Returning 0
---			 * without setting ieee80211_ptr->iftype causes trace
---			 * (WARN_ON) but it works with wpa_supplicant
---			 */
---			return 0;
---		}
-- 		infra = 1;
-- 		break;
-- 	case NL80211_IFTYPE_AP:
-diff --git a/package/kernel/mac80211/patches/370-0009-brcmfmac-Deleting-of-p2p-device-is-leaking-memory.patch b/package/kernel/mac80211/patches/370-0009-brcmfmac-Deleting-of-p2p-device-is-leaking-memory.patch
-deleted file mode 100644
-index 1988b5c..0000000
---- a/package/kernel/mac80211/patches/370-0009-brcmfmac-Deleting-of-p2p-device-is-leaking-memory.patch
-+++ /dev/null
-@@ -1,124 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:12 +0200
--Subject: [PATCH] brcmfmac: Deleting of p2p device is leaking memory.
--
--When a p2p device gets deleted, the memory for the vif is not being
--released. This is solved by reorganizing the cleanup path and
--properly freeing the memory.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -887,6 +887,16 @@ static void brcmf_del_if(struct brcmf_pu
-- 			cancel_work_sync(&ifp->multicast_work);
-- 		}
-- 		brcmf_net_detach(ifp->ndev);
--+	} else {
--+		/* Only p2p device interfaces which get dynamically created
--+		 * end up here. In this case the p2p module should be informed
--+		 * about the removal of the interface within the firmware. If
--+		 * not then p2p commands towards the firmware will cause some
--+		 * serious troublesome side effects. The p2p module will clean
--+		 * up the ifp if needed.
--+		 */
--+		brcmf_p2p_ifp_removed(ifp);
--+		kfree(ifp);
-- 	}
-- }
-- 
--@@ -894,7 +904,8 @@ void brcmf_remove_interface(struct brcmf
-- {
-- 	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bssidx] != ifp))
-- 		return;
---
--+	brcmf_dbg(TRACE, "Enter, bssidx=%d, ifidx=%d\n", ifp->bssidx,
--+		  ifp->ifidx);
-- 	brcmf_fws_del_interface(ifp);
-- 	brcmf_del_if(ifp->drvr, ifp->bssidx);
-- }
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2131,20 +2131,6 @@ fail:
-- }
-- 
-- /**
--- * brcmf_p2p_delete_p2pdev() - delete P2P_DEVICE virtual interface.
--- *
--- * @vif: virtual interface object to delete.
--- */
---static void brcmf_p2p_delete_p2pdev(struct brcmf_p2p_info *p2p,
---				    struct brcmf_cfg80211_vif *vif)
---{
---	cfg80211_unregister_wdev(&vif->wdev);
---	p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
---	brcmf_remove_interface(vif->ifp);
---	brcmf_free_vif(vif);
---}
---
---/**
--  * brcmf_p2p_add_vif() - create a new P2P virtual interface.
--  *
--  * @wiphy: wiphy device of new interface.
--@@ -2264,9 +2250,11 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 		break;
-- 
-- 	case NL80211_IFTYPE_P2P_DEVICE:
--+		if (!p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
--+			return 0;
-- 		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
-- 		brcmf_p2p_deinit_discovery(p2p);
---		brcmf_p2p_delete_p2pdev(p2p, vif);
--+		brcmf_remove_interface(vif->ifp);
-- 		return 0;
-- 	default:
-- 		return -ENOTSUPP;
--@@ -2298,6 +2286,21 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 	return err;
-- }
-- 
--+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
--+{
--+	struct brcmf_cfg80211_info *cfg;
--+	struct brcmf_cfg80211_vif *vif;
--+
--+	brcmf_dbg(INFO, "P2P: device interface removed\n");
--+	vif = ifp->vif;
--+	cfg = wdev_to_cfg(&vif->wdev);
--+	cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
--+	rtnl_lock();
--+	cfg80211_unregister_wdev(&vif->wdev);
--+	rtnl_unlock();
--+	brcmf_free_vif(vif);
--+}
--+
-- int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev)
-- {
-- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--@@ -2422,10 +2425,7 @@ void brcmf_p2p_detach(struct brcmf_p2p_i
-- 	if (vif != NULL) {
-- 		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
-- 		brcmf_p2p_deinit_discovery(p2p);
---		/* remove discovery interface */
---		rtnl_lock();
---		brcmf_p2p_delete_p2pdev(p2p, vif);
---		rtnl_unlock();
--+		brcmf_remove_interface(vif->ifp);
-- 	}
-- 	/* just set it all to zero */
-- 	memset(p2p, 0, sizeof(*p2p));
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
--@@ -156,6 +156,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
-- int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
-- int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
-- 		       enum brcmf_fil_p2p_if_types if_type);
--+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
-- int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
-- void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
-- int brcmf_p2p_scan_prep(struct wiphy *wiphy,
-diff --git a/package/kernel/mac80211/patches/370-0010-brcmfmac-Only-handle-p2p_stop_device-if-vif-is-valid.patch b/package/kernel/mac80211/patches/370-0010-brcmfmac-Only-handle-p2p_stop_device-if-vif-is-valid.patch
-deleted file mode 100644
-index 5225c9e..0000000
---- a/package/kernel/mac80211/patches/370-0010-brcmfmac-Only-handle-p2p_stop_device-if-vif-is-valid.patch
-+++ /dev/null
-@@ -1,40 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:13 +0200
--Subject: [PATCH] brcmfmac: Only handle p2p_stop_device if vif is valid
--
--In some situations it is possible that vif has been removed while
--cfg80211 invokes the p2p_stop_device handler. This will result in
--crash.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2324,11 +2324,17 @@ void brcmf_p2p_stop_device(struct wiphy
-- 	struct brcmf_cfg80211_vif *vif;
-- 
-- 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
---	mutex_lock(&cfg->usr_sync);
---	(void)brcmf_p2p_deinit_discovery(p2p);
---	brcmf_abort_scanning(cfg);
---	clear_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state);
---	mutex_unlock(&cfg->usr_sync);
--+	/* This call can be result of the unregister_wdev call. In that case
--+	 * we dont want to do anything anymore. Just return. The config vif
--+	 * will have been cleared at this point.
--+	 */
--+	if (p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif == vif) {
--+		mutex_lock(&cfg->usr_sync);
--+		(void)brcmf_p2p_deinit_discovery(p2p);
--+		brcmf_abort_scanning(cfg);
--+		clear_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state);
--+		mutex_unlock(&cfg->usr_sync);
--+	}
-- }
-- 
-- /**
-diff --git a/package/kernel/mac80211/patches/370-0011-brcmfmac-Fix-p2p-bug-for-older-firmwares.patch b/package/kernel/mac80211/patches/370-0011-brcmfmac-Fix-p2p-bug-for-older-firmwares.patch
-deleted file mode 100644
-index e2f24e8..0000000
---- a/package/kernel/mac80211/patches/370-0011-brcmfmac-Fix-p2p-bug-for-older-firmwares.patch
-+++ /dev/null
-@@ -1,35 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:14 +0200
--Subject: [PATCH] brcmfmac: Fix p2p bug for older firmwares.
--
--Some devices with older firmwares are reporting new p2p device
--interface with the wrong type. Accept this type to get p2p
--working for these devices.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -186,11 +186,13 @@ static void brcmf_fweh_handle_if_event(s
-- 		  ifevent->action, ifevent->ifidx, ifevent->bssidx,
-- 		  ifevent->flags, ifevent->role);
-- 
---	/* The P2P Device interface event must not be ignored
---	 * contrary to what firmware tells us.
--+	/* The P2P Device interface event must not be ignored contrary to what
--+	 * firmware tells us. Older firmware uses p2p noif, with sta role.
--+	 * This should be accepted.
-- 	 */
---	is_p2pdev = (ifevent->flags & BRCMF_E_IF_FLAG_NOIF) &&
---		    ifevent->role == BRCMF_E_IF_ROLE_P2P_CLIENT;
--+	is_p2pdev = ((ifevent->flags & BRCMF_E_IF_FLAG_NOIF) &&
--+		     (ifevent->role == BRCMF_E_IF_ROLE_P2P_CLIENT ||
--+		      ifevent->role == BRCMF_E_IF_ROLE_STA));
-- 	if (!is_p2pdev && (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) {
-- 		brcmf_dbg(EVENT, "event can be ignored\n");
-- 		return;
-diff --git a/package/kernel/mac80211/patches/370-0012-brcmfmac-Add-module-parameter-to-disable-features.patch b/package/kernel/mac80211/patches/370-0012-brcmfmac-Add-module-parameter-to-disable-features.patch
-deleted file mode 100644
-index 52c787f..0000000
---- a/package/kernel/mac80211/patches/370-0012-brcmfmac-Add-module-parameter-to-disable-features.patch
-+++ /dev/null
-@@ -1,54 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:15 +0200
--Subject: [PATCH] brcmfmac: Add module parameter to disable features.
--
--For debugging purpose it is very handy to be able to disable
--features. It has happened a few times that new features turned
--out not always being properly detected for all devices/firmwares.
--Making it possible to disable the feature with a module parameter
--will make testing/debugging easier.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--@@ -15,6 +15,7 @@
--  */
-- 
-- #include <linux/netdevice.h>
--+#include <linux/module.h>
-- 
-- #include <brcm_hw_ids.h>
-- #include "core.h"
--@@ -23,6 +24,12 @@
-- #include "fwil.h"
-- #include "feature.h"
-- 
--+
--+/* Module param feature_disable (global for all devices) */
--+static int brcmf_feature_disable;
--+module_param_named(feature_disable, brcmf_feature_disable, int, 0);
--+MODULE_PARM_DESC(feature_disable, "Disable features");
--+
-- /*
--  * expand feature list to array of feature strings.
--  */
--@@ -131,6 +138,12 @@ void brcmf_feat_attach(struct brcmf_pub
-- 		brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
-- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_P2P, "p2p");
-- 
--+	if (brcmf_feature_disable) {
--+		brcmf_dbg(INFO, "Features: 0x%02x, disable: 0x%02x\n",
--+			  ifp->drvr->feat_flags, brcmf_feature_disable);
--+		ifp->drvr->feat_flags &= ~brcmf_feature_disable;
--+	}
--+
-- 	/* set chip related quirks */
-- 	switch (drvr->bus_if->chip) {
-- 	case BRCM_CC_43236_CHIP_ID:
-diff --git a/package/kernel/mac80211/patches/370-0013-brcmfmac-Fix-race-condition-bug-when-deleting-p2p-in.patch b/package/kernel/mac80211/patches/370-0013-brcmfmac-Fix-race-condition-bug-when-deleting-p2p-in.patch
-deleted file mode 100644
-index 58a638a..0000000
---- a/package/kernel/mac80211/patches/370-0013-brcmfmac-Fix-race-condition-bug-when-deleting-p2p-in.patch
-+++ /dev/null
-@@ -1,80 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:16 +0200
--Subject: [PATCH] brcmfmac: Fix race condition bug when deleting p2p interface.
--
--When p2p device interface gets deleted by deinitialising discovery
--it will result in an event which removes the interface, but that is
--also done by delete p2p interface code. This results in race
--condition which sometimes results in lockup/crash. With this patch
--the delete device interface will wait for the event (with timeout)
--removing the possible race condition. Also on the stop device call
--from cfg80211 the deinitialisation of the discovery device should
--be avoided as it can result in a similar situation.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2238,6 +2238,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 	brcmf_dbg(TRACE, "delete P2P vif\n");
-- 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
-- 
--+	brcmf_cfg80211_arm_vif_event(cfg, vif);
-- 	switch (vif->wdev.iftype) {
-- 	case NL80211_IFTYPE_P2P_CLIENT:
-- 		if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
--@@ -2254,8 +2255,6 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 			return 0;
-- 		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
-- 		brcmf_p2p_deinit_discovery(p2p);
---		brcmf_remove_interface(vif->ifp);
---		return 0;
-- 	default:
-- 		return -ENOTSUPP;
-- 	}
--@@ -2267,10 +2266,11 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 		wait_for_completion_timeout(&cfg->vif_disabled,
-- 					    msecs_to_jiffies(500));
-- 
---	brcmf_vif_clear_mgmt_ies(vif);
---
---	brcmf_cfg80211_arm_vif_event(cfg, vif);
---	err = brcmf_p2p_release_p2p_if(vif);
--+	err = 0;
--+	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {
--+		brcmf_vif_clear_mgmt_ies(vif);
--+		err = brcmf_p2p_release_p2p_if(vif);
--+	}
-- 	if (!err) {
-- 		/* wait for firmware event */
-- 		err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_DEL,
--@@ -2280,8 +2280,12 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
-- 		else
-- 			err = 0;
-- 	}
--+	if (err)
--+		brcmf_remove_interface(vif->ifp);
--+
-- 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
---	p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
--+	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
--+		p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
-- 
-- 	return err;
-- }
--@@ -2330,7 +2334,9 @@ void brcmf_p2p_stop_device(struct wiphy
-- 	 */
-- 	if (p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif == vif) {
-- 		mutex_lock(&cfg->usr_sync);
---		(void)brcmf_p2p_deinit_discovery(p2p);
--+		/* Set the discovery state to SCAN */
--+		(void)brcmf_p2p_set_discover_state(vif->ifp,
--+						   WL_P2P_DISC_ST_SCAN, 0, 0);
-- 		brcmf_abort_scanning(cfg);
-- 		clear_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state);
-- 		mutex_unlock(&cfg->usr_sync);
-diff --git a/package/kernel/mac80211/patches/370-0014-brcmfmac-Add-support-for-the-BCM4365-and-BCM4366-PCI.patch b/package/kernel/mac80211/patches/370-0014-brcmfmac-Add-support-for-the-BCM4365-and-BCM4366-PCI.patch
-deleted file mode 100644
-index d0bbf2a..0000000
---- a/package/kernel/mac80211/patches/370-0014-brcmfmac-Add-support-for-the-BCM4365-and-BCM4366-PCI.patch
-+++ /dev/null
-@@ -1,277 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:17 +0200
--Subject: [PATCH] brcmfmac: Add support for the BCM4365 and BCM4366 PCIE
-- devices.
--
--This patch adds support for the BCM4365 and BCM4366 11ac Wave2
--PCIE devices.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -208,6 +208,7 @@ struct sbsocramregs {
-- };
-- 
-- #define SOCRAMREGOFFS(_f)	offsetof(struct sbsocramregs, _f)
--+#define SYSMEMREGOFFS(_f)	offsetof(struct sbsocramregs, _f)
-- 
-- #define ARMCR4_CAP		(0x04)
-- #define ARMCR4_BANKIDX		(0x40)
--@@ -516,6 +517,9 @@ static int brcmf_chip_cores_check(struct
-- 		case BCMA_CORE_ARM_CR4:
-- 			cpu_found = true;
-- 			break;
--+		case BCMA_CORE_ARM_CA7:
--+			cpu_found = true;
--+			break;
-- 		default:
-- 			break;
-- 		}
--@@ -614,6 +618,29 @@ static void brcmf_chip_socram_ramsize(st
-- 	}
-- }
-- 
--+/** Return the SYS MEM size */
--+static u32 brcmf_chip_sysmem_ramsize(struct brcmf_core_priv *sysmem)
--+{
--+	u32 memsize = 0;
--+	u32 coreinfo;
--+	u32 idx;
--+	u32 nb;
--+	u32 banksize;
--+
--+	if (!brcmf_chip_iscoreup(&sysmem->pub))
--+		brcmf_chip_resetcore(&sysmem->pub, 0, 0, 0);
--+
--+	coreinfo = brcmf_chip_core_read32(sysmem, SYSMEMREGOFFS(coreinfo));
--+	nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
--+
--+	for (idx = 0; idx < nb; idx++) {
--+		brcmf_chip_socram_banksize(sysmem, idx, &banksize);
--+		memsize += banksize;
--+	}
--+
--+	return memsize;
--+}
--+
-- /** Return the TCM-RAM size of the ARMCR4 core. */
-- static u32 brcmf_chip_tcm_ramsize(struct brcmf_core_priv *cr4)
-- {
--@@ -656,6 +683,9 @@ static u32 brcmf_chip_tcm_rambase(struct
-- 	case BRCM_CC_4358_CHIP_ID:
-- 	case BRCM_CC_43602_CHIP_ID:
-- 		return 0x180000;
--+	case BRCM_CC_4365_CHIP_ID:
--+	case BRCM_CC_4366_CHIP_ID:
--+		return 0x200000;
-- 	default:
-- 		brcmf_err("unknown chip: %s\n", ci->pub.name);
-- 		break;
--@@ -678,10 +708,28 @@ static int brcmf_chip_get_raminfo(struct
-- 			return -EINVAL;
-- 		}
-- 	} else {
---		mem = brcmf_chip_get_core(&ci->pub, BCMA_CORE_INTERNAL_MEM);
---		mem_core = container_of(mem, struct brcmf_core_priv, pub);
---		brcmf_chip_socram_ramsize(mem_core, &ci->pub.ramsize,
---					  &ci->pub.srsize);
--+		mem = brcmf_chip_get_core(&ci->pub, BCMA_CORE_SYS_MEM);
--+		if (mem) {
--+			mem_core = container_of(mem, struct brcmf_core_priv,
--+						pub);
--+			ci->pub.ramsize = brcmf_chip_sysmem_ramsize(mem_core);
--+			ci->pub.rambase = brcmf_chip_tcm_rambase(ci);
--+			if (!ci->pub.rambase) {
--+				brcmf_err("RAM base not provided with ARM CA7 core\n");
--+				return -EINVAL;
--+			}
--+		} else {
--+			mem = brcmf_chip_get_core(&ci->pub,
--+						  BCMA_CORE_INTERNAL_MEM);
--+			if (!mem) {
--+				brcmf_err("No memory cores found\n");
--+				return -ENOMEM;
--+			}
--+			mem_core = container_of(mem, struct brcmf_core_priv,
--+						pub);
--+			brcmf_chip_socram_ramsize(mem_core, &ci->pub.ramsize,
--+						  &ci->pub.srsize);
--+		}
-- 	}
-- 	brcmf_dbg(INFO, "RAM: base=0x%x size=%d (0x%x) sr=%d (0x%x)\n",
-- 		  ci->pub.rambase, ci->pub.ramsize, ci->pub.ramsize,
--@@ -924,7 +972,7 @@ static int brcmf_chip_recognition(struct
-- static void brcmf_chip_disable_arm(struct brcmf_chip_priv *chip, u16 id)
-- {
-- 	struct brcmf_core *core;
---	struct brcmf_core_priv *cr4;
--+	struct brcmf_core_priv *cpu;
-- 	u32 val;
-- 
-- 
--@@ -937,10 +985,11 @@ static void brcmf_chip_disable_arm(struc
-- 		brcmf_chip_coredisable(core, 0, 0);
-- 		break;
-- 	case BCMA_CORE_ARM_CR4:
---		cr4 = container_of(core, struct brcmf_core_priv, pub);
--+	case BCMA_CORE_ARM_CA7:
--+		cpu = container_of(core, struct brcmf_core_priv, pub);
-- 
-- 		/* clear all IOCTL bits except HALT bit */
---		val = chip->ops->read32(chip->ctx, cr4->wrapbase + BCMA_IOCTL);
--+		val = chip->ops->read32(chip->ctx, cpu->wrapbase + BCMA_IOCTL);
-- 		val &= ARMCR4_BCMA_IOCTL_CPUHALT;
-- 		brcmf_chip_resetcore(core, val, ARMCR4_BCMA_IOCTL_CPUHALT,
-- 				     ARMCR4_BCMA_IOCTL_CPUHALT);
--@@ -1162,6 +1211,33 @@ static bool brcmf_chip_cr4_set_active(st
-- 	return true;
-- }
-- 
--+static inline void
--+brcmf_chip_ca7_set_passive(struct brcmf_chip_priv *chip)
--+{
--+	struct brcmf_core *core;
--+
--+	brcmf_chip_disable_arm(chip, BCMA_CORE_ARM_CA7);
--+
--+	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_80211);
--+	brcmf_chip_resetcore(core, D11_BCMA_IOCTL_PHYRESET |
--+				   D11_BCMA_IOCTL_PHYCLOCKEN,
--+			     D11_BCMA_IOCTL_PHYCLOCKEN,
--+			     D11_BCMA_IOCTL_PHYCLOCKEN);
--+}
--+
--+static bool brcmf_chip_ca7_set_active(struct brcmf_chip_priv *chip, u32 rstvec)
--+{
--+	struct brcmf_core *core;
--+
--+	chip->ops->activate(chip->ctx, &chip->pub, rstvec);
--+
--+	/* restore ARM */
--+	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_ARM_CA7);
--+	brcmf_chip_resetcore(core, ARMCR4_BCMA_IOCTL_CPUHALT, 0, 0);
--+
--+	return true;
--+}
--+
-- void brcmf_chip_set_passive(struct brcmf_chip *pub)
-- {
-- 	struct brcmf_chip_priv *chip;
--@@ -1175,8 +1251,16 @@ void brcmf_chip_set_passive(struct brcmf
-- 		brcmf_chip_cr4_set_passive(chip);
-- 		return;
-- 	}
---
---	brcmf_chip_cm3_set_passive(chip);
--+	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CA7);
--+	if (arm) {
--+		brcmf_chip_ca7_set_passive(chip);
--+		return;
--+	}
--+	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CM3);
--+	if (arm) {
--+		brcmf_chip_cm3_set_passive(chip);
--+		return;
--+	}
-- }
-- 
-- bool brcmf_chip_set_active(struct brcmf_chip *pub, u32 rstvec)
--@@ -1190,8 +1274,14 @@ bool brcmf_chip_set_active(struct brcmf_
-- 	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CR4);
-- 	if (arm)
-- 		return brcmf_chip_cr4_set_active(chip, rstvec);
--+	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CA7);
--+	if (arm)
--+		return brcmf_chip_ca7_set_active(chip, rstvec);
--+	arm = brcmf_chip_get_core(pub, BCMA_CORE_ARM_CM3);
--+	if (arm)
--+		return brcmf_chip_cm3_set_active(chip);
-- 
---	return brcmf_chip_cm3_set_active(chip);
--+	return false;
-- }
-- 
-- bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -55,6 +55,10 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_43570_NVRAM_NAME		"brcm/brcmfmac43570-pcie.txt"
-- #define BRCMF_PCIE_4358_FW_NAME			"brcm/brcmfmac4358-pcie.bin"
-- #define BRCMF_PCIE_4358_NVRAM_NAME		"brcm/brcmfmac4358-pcie.txt"
--+#define BRCMF_PCIE_4365_FW_NAME			"brcm/brcmfmac4365b-pcie.bin"
--+#define BRCMF_PCIE_4365_NVRAM_NAME		"brcm/brcmfmac4365b-pcie.txt"
--+#define BRCMF_PCIE_4366_FW_NAME			"brcm/brcmfmac4366b-pcie.bin"
--+#define BRCMF_PCIE_4366_NVRAM_NAME		"brcm/brcmfmac4366b-pcie.txt"
-- 
-- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
-- 
--@@ -204,6 +208,10 @@ MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4358_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4358_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4365_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4365_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4366_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4366_NVRAM_NAME);
-- 
-- 
-- struct brcmf_pcie_console {
--@@ -1440,6 +1448,14 @@ static int brcmf_pcie_get_fwnames(struct
-- 		fw_name = BRCMF_PCIE_4358_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_4358_NVRAM_NAME;
-- 		break;
--+	case BRCM_CC_4365_CHIP_ID:
--+		fw_name = BRCMF_PCIE_4365_FW_NAME;
--+		nvram_name = BRCMF_PCIE_4365_NVRAM_NAME;
--+		break;
--+	case BRCM_CC_4366_CHIP_ID:
--+		fw_name = BRCMF_PCIE_4366_FW_NAME;
--+		nvram_name = BRCMF_PCIE_4366_NVRAM_NAME;
--+		break;
-- 	default:
-- 		brcmf_err("Unsupported chip 0x%04x\n", devinfo->ci->chip);
-- 		return -ENODEV;
--@@ -1973,6 +1989,12 @@ static struct pci_device_id brcmf_pcie_d
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID),
-- 	{ /* end: all zeroes */ }
-- };
-- 
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -48,6 +48,8 @@
-- #define BRCM_CC_43570_CHIP_ID		43570
-- #define BRCM_CC_4358_CHIP_ID		0x4358
-- #define BRCM_CC_43602_CHIP_ID		43602
--+#define BRCM_CC_4365_CHIP_ID		0x4365
--+#define BRCM_CC_4366_CHIP_ID		0x4366
-- 
-- /* USB Device IDs */
-- #define BRCM_USB_43143_DEVICE_ID	0xbd1e
--@@ -67,6 +69,13 @@
-- #define BRCM_PCIE_43602_2G_DEVICE_ID	0x43bb
-- #define BRCM_PCIE_43602_5G_DEVICE_ID	0x43bc
-- #define BRCM_PCIE_43602_RAW_DEVICE_ID	43602
--+#define BRCM_PCIE_4365_DEVICE_ID	0x43ca
--+#define BRCM_PCIE_4365_2G_DEVICE_ID	0x43cb
--+#define BRCM_PCIE_4365_5G_DEVICE_ID	0x43cc
--+#define BRCM_PCIE_4366_DEVICE_ID	0x43c3
--+#define BRCM_PCIE_4366_2G_DEVICE_ID	0x43c4
--+#define BRCM_PCIE_4366_5G_DEVICE_ID	0x43c5
--+
-- 
-- /* brcmsmac IDs */
-- #define BCM4313_D11N2G_ID	0x4727	/* 4313 802.11n 2.4G device */
-diff --git a/package/kernel/mac80211/patches/370-0015-brcmfmac-Fix-TDLS-setup-by-properly-handling-p2p-noi.patch b/package/kernel/mac80211/patches/370-0015-brcmfmac-Fix-TDLS-setup-by-properly-handling-p2p-noi.patch
-deleted file mode 100644
-index d33c803..0000000
---- a/package/kernel/mac80211/patches/370-0015-brcmfmac-Fix-TDLS-setup-by-properly-handling-p2p-noi.patch
-+++ /dev/null
-@@ -1,120 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:18 +0200
--Subject: [PATCH] brcmfmac: Fix TDLS setup by properly handling p2p noif.
--
--There is a workaround needed for p2p device setup which breaks tdls
--functionality. This patch fixes that by properly signalling fweh that
--p2p device setup is ongoing.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -188,11 +188,13 @@ static void brcmf_fweh_handle_if_event(s
-- 
-- 	/* The P2P Device interface event must not be ignored contrary to what
-- 	 * firmware tells us. Older firmware uses p2p noif, with sta role.
---	 * This should be accepted.
--+	 * This should be accepted when p2pdev_setup is ongoing. TDLS setup will
--+	 * use the same ifevent and should be ignored.
-- 	 */
-- 	is_p2pdev = ((ifevent->flags & BRCMF_E_IF_FLAG_NOIF) &&
-- 		     (ifevent->role == BRCMF_E_IF_ROLE_P2P_CLIENT ||
---		      ifevent->role == BRCMF_E_IF_ROLE_STA));
--+		      ((ifevent->role == BRCMF_E_IF_ROLE_STA) &&
--+		       (drvr->fweh.p2pdev_setup_ongoing))));
-- 	if (!is_p2pdev && (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) {
-- 		brcmf_dbg(EVENT, "event can be ignored\n");
-- 		return;
--@@ -316,6 +318,17 @@ event_free:
-- }
-- 
-- /**
--+ * brcmf_fweh_p2pdev_setup() - P2P device setup ongoing (or not).
--+ *
--+ * @ifp: ifp on which setup is taking place or finished.
--+ * @ongoing: p2p device setup in progress (or not).
--+ */
--+void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing)
--+{
--+	ifp->drvr->fweh.p2pdev_setup_ongoing = ongoing;
--+}
--+
--+/**
--  * brcmf_fweh_attach() - initialize firmware event handling.
--  *
--  * @drvr: driver information object.
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
--@@ -230,12 +230,14 @@ typedef int (*brcmf_fweh_handler_t)(stru
-- /**
--  * struct brcmf_fweh_info - firmware event handling information.
--  *
--+ * @p2pdev_setup_ongoing: P2P device creation in progress.
--  * @event_work: event worker.
--  * @evt_q_lock: lock for event queue protection.
--  * @event_q: event queue.
--  * @evt_handler: registered event handlers.
--  */
-- struct brcmf_fweh_info {
--+	bool p2pdev_setup_ongoing;
-- 	struct work_struct event_work;
-- 	spinlock_t evt_q_lock;
-- 	struct list_head event_q;
--@@ -255,6 +257,7 @@ void brcmf_fweh_unregister(struct brcmf_
-- int brcmf_fweh_activate_events(struct brcmf_if *ifp);
-- void brcmf_fweh_process_event(struct brcmf_pub *drvr,
-- 			      struct brcmf_event *event_packet);
--+void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing);
-- 
-- static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
-- 					  struct sk_buff *skb)
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2084,11 +2084,13 @@ static struct wireless_dev *brcmf_p2p_cr
-- 	brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
-- 
-- 	brcmf_cfg80211_arm_vif_event(p2p->cfg, p2p_vif);
--+	brcmf_fweh_p2pdev_setup(pri_ifp, true);
-- 
-- 	/* Initialize P2P Discovery in the firmware */
-- 	err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
-- 	if (err < 0) {
-- 		brcmf_err("set p2p_disc error\n");
--+		brcmf_fweh_p2pdev_setup(pri_ifp, false);
-- 		brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
-- 		goto fail;
-- 	}
--@@ -2097,6 +2099,7 @@ static struct wireless_dev *brcmf_p2p_cr
-- 	err = brcmf_cfg80211_wait_vif_event_timeout(p2p->cfg, BRCMF_E_IF_ADD,
-- 						    msecs_to_jiffies(1500));
-- 	brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
--+	brcmf_fweh_p2pdev_setup(pri_ifp, false);
-- 	if (!err) {
-- 		brcmf_err("timeout occurred\n");
-- 		err = -EIO;
--@@ -2393,6 +2396,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
-- 		memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
-- 		brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
-- 
--+		brcmf_fweh_p2pdev_setup(pri_ifp, true);
--+
-- 		/* Initialize P2P Discovery in the firmware */
-- 		err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
-- 		if (err < 0) {
--@@ -2419,8 +2424,9 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
-- 		INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
-- 		init_completion(&p2p->afx_hdl.act_frm_scan);
-- 		init_completion(&p2p->wait_next_af);
---	}
-- exit:
--+		brcmf_fweh_p2pdev_setup(pri_ifp, false);
--+	}
-- 	return err;
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/370-0016-brcmfmac-Accept-events-when-TDLS-is-used-in-combinat.patch b/package/kernel/mac80211/patches/370-0016-brcmfmac-Accept-events-when-TDLS-is-used-in-combinat.patch
-deleted file mode 100644
-index b880078..0000000
---- a/package/kernel/mac80211/patches/370-0016-brcmfmac-Accept-events-when-TDLS-is-used-in-combinat.patch
-+++ /dev/null
-@@ -1,29 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Fri, 18 Sep 2015 22:08:19 +0200
--Subject: [PATCH] brcmfmac: Accept events when TDLS is used in combination with
-- p2p.
--
--TDLS events are mapped back to primary interface but when p2p is in
--use then this fails because the check was incorrect by checking
--bsscfg number. Which can be different when a p2p device has been
--created.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -300,8 +300,7 @@ static void brcmf_fweh_event_worker(stru
-- 			goto event_free;
-- 		}
-- 
---		if ((event->code == BRCMF_E_TDLS_PEER_EVENT) &&
---		    (emsg.bsscfgidx == 1))
--+		if (event->code == BRCMF_E_TDLS_PEER_EVENT)
-- 			ifp = drvr->iflist[0];
-- 		else
-- 			ifp = drvr->iflist[emsg.bsscfgidx];
-diff --git a/package/kernel/mac80211/patches/371-brcmfmac-include-linux-atomic.h.patch b/package/kernel/mac80211/patches/371-brcmfmac-include-linux-atomic.h.patch
-deleted file mode 100644
-index 9311a9d..0000000
---- a/package/kernel/mac80211/patches/371-brcmfmac-include-linux-atomic.h.patch
-+++ /dev/null
-@@ -1,23 +0,0 @@
--From: Hauke Mehrtens <hauke@hauke-m.de>
--Date: Sat, 19 Sep 2015 12:47:20 +0200
--Subject: [PATCH] brcmfmac: include linux/atomic.h
--
--brcmfmac uses atomic_or() and other atomic_* functions, but does not
--include linux/atomic.h. This file gets included by some other header
--file so this normally does not cause problems.
--
--Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -15,6 +15,7 @@
--  */
-- 
-- #include <linux/types.h>
--+#include <linux/atomic.h>
-- #include <linux/kernel.h>
-- #include <linux/kthread.h>
-- #include <linux/printk.h>
-diff --git a/package/kernel/mac80211/patches/372-0001-brcmfmac-expose-device-memory-to-devcoredump-subsyst.patch b/package/kernel/mac80211/patches/372-0001-brcmfmac-expose-device-memory-to-devcoredump-subsyst.patch
-deleted file mode 100644
-index cf3f278..0000000
---- a/package/kernel/mac80211/patches/372-0001-brcmfmac-expose-device-memory-to-devcoredump-subsyst.patch
-+++ /dev/null
-@@ -1,347 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:11 +0200
--Subject: [PATCH] brcmfmac: expose device memory to devcoredump subsystem
--
--Upon PSM watchdog event received from firmware the driver will obtain
--a memory snapshot of the device and expose it to user-space through
--the devcoredump framework. This will trigger a uevent.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/Kconfig
--+++ b/drivers/net/wireless/brcm80211/Kconfig
--@@ -85,5 +85,6 @@ config BRCM_TRACING
-- config BRCMDBG
-- 	bool "Broadcom driver debug functions"
-- 	depends on BRCMSMAC || BRCMFMAC
--+	select WANT_DEV_COREDUMP
-- 	---help---
-- 	  Selecting this enables additional code for debug purposes.
----- a/drivers/net/wireless/brcm80211/brcmfmac/bus.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
--@@ -65,6 +65,8 @@ struct brcmf_bus_dcmd {
--  * @rxctl: receive a control response message from dongle.
--  * @gettxq: obtain a reference of bus transmit queue (optional).
--  * @wowl_config: specify if dongle is configured for wowl when going to suspend
--+ * @get_ramsize: obtain size of device memory.
--+ * @get_memdump: obtain device memory dump in provided buffer.
--  *
--  * This structure provides an abstract interface towards the
--  * bus specific driver. For control messages to common driver
--@@ -79,6 +81,8 @@ struct brcmf_bus_ops {
-- 	int (*rxctl)(struct device *dev, unsigned char *msg, uint len);
-- 	struct pktq * (*gettxq)(struct device *dev);
-- 	void (*wowl_config)(struct device *dev, bool enabled);
--+	size_t (*get_ramsize)(struct device *dev);
--+	int (*get_memdump)(struct device *dev, void *data, size_t len);
-- };
-- 
-- 
--@@ -185,6 +189,23 @@ void brcmf_bus_wowl_config(struct brcmf_
-- 		bus->ops->wowl_config(bus->dev, enabled);
-- }
-- 
--+static inline size_t brcmf_bus_get_ramsize(struct brcmf_bus *bus)
--+{
--+	if (!bus->ops->get_ramsize)
--+		return 0;
--+
--+	return bus->ops->get_ramsize(bus->dev);
--+}
--+
--+static inline
--+int brcmf_bus_get_memdump(struct brcmf_bus *bus, void *data, size_t len)
--+{
--+	if (!bus->ops->get_memdump)
--+		return -EOPNOTSUPP;
--+
--+	return bus->ops->get_memdump(bus->dev, data, len);
--+}
--+
-- /*
--  * interface functions from common layer
--  */
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -957,8 +957,8 @@ int brcmf_attach(struct device *dev)
-- 	drvr->bus_if = dev_get_drvdata(dev);
-- 	drvr->bus_if->drvr = drvr;
-- 
---	/* create device debugfs folder */
---	brcmf_debugfs_attach(drvr);
--+	/* attach debug facilities */
--+	brcmf_debug_attach(drvr);
-- 
-- 	/* Attach and link in the protocol */
-- 	ret = brcmf_proto_attach(drvr);
--@@ -1155,7 +1155,7 @@ void brcmf_detach(struct device *dev)
-- 
-- 	brcmf_proto_detach(drvr);
-- 
---	brcmf_debugfs_detach(drvr);
--+	brcmf_debug_detach(drvr);
-- 	bus_if->drvr = NULL;
-- 	kfree(drvr);
-- }
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--@@ -16,15 +16,45 @@
-- #include <linux/debugfs.h>
-- #include <linux/netdevice.h>
-- #include <linux/module.h>
--+#include <linux/devcoredump.h>
-- 
-- #include <brcmu_wifi.h>
-- #include <brcmu_utils.h>
-- #include "core.h"
-- #include "bus.h"
--+#include "fweh.h"
-- #include "debug.h"
-- 
-- static struct dentry *root_folder;
-- 
--+static int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
--+				      size_t len)
--+{
--+	void *dump;
--+	size_t ramsize;
--+
--+	ramsize = brcmf_bus_get_ramsize(bus);
--+	if (ramsize) {
--+		dump = vzalloc(len + ramsize);
--+		if (!dump)
--+			return -ENOMEM;
--+		memcpy(dump, data, len);
--+		brcmf_bus_get_memdump(bus, dump + len, ramsize);
--+		dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL);
--+	}
--+	return 0;
--+}
--+
--+static int brcmf_debug_psm_watchdog_notify(struct brcmf_if *ifp,
--+					   const struct brcmf_event_msg *evtmsg,
--+					   void *data)
--+{
--+	brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
--+
--+	return brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
--+					  evtmsg->datalen);
--+}
--+
-- void brcmf_debugfs_init(void)
-- {
-- 	root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
--@@ -41,7 +71,7 @@ void brcmf_debugfs_exit(void)
-- 	root_folder = NULL;
-- }
-- 
---int brcmf_debugfs_attach(struct brcmf_pub *drvr)
--+int brcmf_debug_attach(struct brcmf_pub *drvr)
-- {
-- 	struct device *dev = drvr->bus_if->dev;
-- 
--@@ -49,12 +79,18 @@ int brcmf_debugfs_attach(struct brcmf_pu
-- 		return -ENODEV;
-- 
-- 	drvr->dbgfs_dir = debugfs_create_dir(dev_name(dev), root_folder);
--+	if (IS_ERR(drvr->dbgfs_dir))
--+		return PTR_ERR(drvr->dbgfs_dir);
-- 
---	return PTR_ERR_OR_ZERO(drvr->dbgfs_dir);
--+
--+	return brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
--+				   brcmf_debug_psm_watchdog_notify);
-- }
-- 
---void brcmf_debugfs_detach(struct brcmf_pub *drvr)
--+void brcmf_debug_detach(struct brcmf_pub *drvr)
-- {
--+	brcmf_fweh_unregister(drvr, BRCMF_E_PSM_WATCHDOG);
--+
-- 	if (!IS_ERR_OR_NULL(drvr->dbgfs_dir))
-- 		debugfs_remove_recursive(drvr->dbgfs_dir);
-- }
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--@@ -109,8 +109,8 @@ struct brcmf_pub;
-- #ifdef DEBUG
-- void brcmf_debugfs_init(void);
-- void brcmf_debugfs_exit(void);
---int brcmf_debugfs_attach(struct brcmf_pub *drvr);
---void brcmf_debugfs_detach(struct brcmf_pub *drvr);
--+int brcmf_debug_attach(struct brcmf_pub *drvr);
--+void brcmf_debug_detach(struct brcmf_pub *drvr);
-- struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
-- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
-- 			    int (*read_fn)(struct seq_file *seq, void *data));
--@@ -121,11 +121,11 @@ static inline void brcmf_debugfs_init(vo
-- static inline void brcmf_debugfs_exit(void)
-- {
-- }
---static inline int brcmf_debugfs_attach(struct brcmf_pub *drvr)
--+static inline int brcmf_debug_attach(struct brcmf_pub *drvr)
-- {
-- 	return 0;
-- }
---static inline void brcmf_debugfs_detach(struct brcmf_pub *drvr)
--+static inline void brcmf_debug_detach(struct brcmf_pub *drvr)
-- {
-- }
-- static inline
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -448,6 +448,47 @@ brcmf_pcie_copy_mem_todev(struct brcmf_p
-- }
-- 
-- 
--+static void
--+brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
--+			  void *dstaddr, u32 len)
--+{
--+	void __iomem *address = devinfo->tcm + mem_offset;
--+	__le32 *dst32;
--+	__le16 *dst16;
--+	u8 *dst8;
--+
--+	if (((ulong)address & 4) || ((ulong)dstaddr & 4) || (len & 4)) {
--+		if (((ulong)address & 2) || ((ulong)dstaddr & 2) || (len & 2)) {
--+			dst8 = (u8 *)dstaddr;
--+			while (len) {
--+				*dst8 = ioread8(address);
--+				address++;
--+				dst8++;
--+				len--;
--+			}
--+		} else {
--+			len = len / 2;
--+			dst16 = (__le16 *)dstaddr;
--+			while (len) {
--+				*dst16 = cpu_to_le16(ioread16(address));
--+				address += 2;
--+				dst16++;
--+				len--;
--+			}
--+		}
--+	} else {
--+		len = len / 4;
--+		dst32 = (__le32 *)dstaddr;
--+		while (len) {
--+			*dst32 = cpu_to_le32(ioread32(address));
--+			address += 4;
--+			dst32++;
--+			len--;
--+		}
--+	}
--+}
--+
--+
-- #define WRITECC32(devinfo, reg, value) brcmf_pcie_write_reg32(devinfo, \
-- 		CHIPCREGOFFS(reg), value)
-- 
--@@ -1352,12 +1393,36 @@ static void brcmf_pcie_wowl_config(struc
-- }
-- 
-- 
--+static size_t brcmf_pcie_get_ramsize(struct device *dev)
--+{
--+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--+	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
--+	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
--+
--+	return devinfo->ci->ramsize - devinfo->ci->srsize;
--+}
--+
--+
--+static int brcmf_pcie_get_memdump(struct device *dev, void *data, size_t len)
--+{
--+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--+	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
--+	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
--+
--+	brcmf_dbg(PCIE, "dump at 0x%08X: len=%zu\n", devinfo->ci->rambase, len);
--+	brcmf_pcie_copy_dev_tomem(devinfo, devinfo->ci->rambase, data, len);
--+	return 0;
--+}
--+
--+
-- static struct brcmf_bus_ops brcmf_pcie_bus_ops = {
-- 	.txdata = brcmf_pcie_tx,
-- 	.stop = brcmf_pcie_down,
-- 	.txctl = brcmf_pcie_tx_ctlpkt,
-- 	.rxctl = brcmf_pcie_rx_ctlpkt,
-- 	.wowl_config = brcmf_pcie_wowl_config,
--+	.get_ramsize = brcmf_pcie_get_ramsize,
--+	.get_memdump = brcmf_pcie_get_memdump,
-- };
-- 
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -3539,6 +3539,51 @@ done:
-- 	return err;
-- }
-- 
--+static size_t brcmf_sdio_bus_get_ramsize(struct device *dev)
--+{
--+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
--+	struct brcmf_sdio *bus = sdiodev->bus;
--+
--+	return bus->ci->ramsize - bus->ci->srsize;
--+}
--+
--+static int brcmf_sdio_bus_get_memdump(struct device *dev, void *data,
--+				      size_t mem_size)
--+{
--+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
--+	struct brcmf_sdio *bus = sdiodev->bus;
--+	int err;
--+	int address;
--+	int offset;
--+	int len;
--+
--+	brcmf_dbg(INFO, "dump at 0x%08x: size=%zu\n", bus->ci->rambase,
--+		  mem_size);
--+
--+	address = bus->ci->rambase;
--+	offset = err = 0;
--+	sdio_claim_host(sdiodev->func[1]);
--+	while (offset < mem_size) {
--+		len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
--+		      mem_size - offset;
--+		err = brcmf_sdiod_ramrw(sdiodev, false, address, data, len);
--+		if (err) {
--+			brcmf_err("error %d on reading %d membytes at 0x%08x\n",
--+				  err, len, address);
--+			goto done;
--+		}
--+		data += len;
--+		offset += len;
--+		address += len;
--+	}
--+
--+done:
--+	sdio_release_host(sdiodev->func[1]);
--+	return err;
--+}
--+
-- void brcmf_sdio_trigger_dpc(struct brcmf_sdio *bus)
-- {
-- 	if (!bus->dpc_triggered) {
--@@ -3987,7 +4032,9 @@ static struct brcmf_bus_ops brcmf_sdio_b
-- 	.txctl = brcmf_sdio_bus_txctl,
-- 	.rxctl = brcmf_sdio_bus_rxctl,
-- 	.gettxq = brcmf_sdio_bus_gettxq,
---	.wowl_config = brcmf_sdio_wowl_config
--+	.wowl_config = brcmf_sdio_wowl_config,
--+	.get_ramsize = brcmf_sdio_bus_get_ramsize,
--+	.get_memdump = brcmf_sdio_bus_get_memdump,
-- };
-- 
-- static void brcmf_sdio_firmware_callback(struct device *dev,
-diff --git a/package/kernel/mac80211/patches/372-0002-brcmfmac-Fix-race-condition-between-USB-probe-load-a.patch b/package/kernel/mac80211/patches/372-0002-brcmfmac-Fix-race-condition-between-USB-probe-load-a.patch
-deleted file mode 100644
-index 5b82bca..0000000
---- a/package/kernel/mac80211/patches/372-0002-brcmfmac-Fix-race-condition-between-USB-probe-load-a.patch
-+++ /dev/null
-@@ -1,108 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:12 +0200
--Subject: [PATCH] brcmfmac: Fix race condition between USB probe/load and
-- disconnect.
--
--When a USB device gets disconnected due to for example removal
--then it is possible that it is still in the loading phase due to
--the asynchronous load routines. These routines can then possible
--access memory which has been freed. Fix this by mutex locking the
--device init phase.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--@@ -144,6 +144,7 @@ struct brcmf_usbdev_info {
-- 
-- 	struct usb_device *usbdev;
-- 	struct device *dev;
--+	struct mutex dev_init_lock;
-- 
-- 	int ctl_in_pipe, ctl_out_pipe;
-- 	struct urb *ctl_urb; /* URB for control endpoint */
--@@ -1204,6 +1205,8 @@ static void brcmf_usb_probe_phase2(struc
-- 	int ret;
-- 
-- 	brcmf_dbg(USB, "Start fw downloading\n");
--+
--+	devinfo = bus->bus_priv.usb->devinfo;
-- 	ret = check_file(fw->data);
-- 	if (ret < 0) {
-- 		brcmf_err("invalid firmware\n");
--@@ -1211,7 +1214,6 @@ static void brcmf_usb_probe_phase2(struc
-- 		goto error;
-- 	}
-- 
---	devinfo = bus->bus_priv.usb->devinfo;
-- 	devinfo->image = fw->data;
-- 	devinfo->image_len = fw->size;
-- 
--@@ -1224,9 +1226,11 @@ static void brcmf_usb_probe_phase2(struc
-- 	if (ret)
-- 		goto error;
-- 
--+	mutex_unlock(&devinfo->dev_init_lock);
-- 	return;
-- error:
-- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret);
--+	mutex_unlock(&devinfo->dev_init_lock);
-- 	device_release_driver(dev);
-- }
-- 
--@@ -1264,6 +1268,7 @@ static int brcmf_usb_probe_cb(struct brc
-- 		if (ret)
-- 			goto fail;
-- 		/* we are done */
--+		mutex_unlock(&devinfo->dev_init_lock);
-- 		return 0;
-- 	}
-- 	bus->chip = bus_pub->devid;
--@@ -1317,6 +1322,12 @@ brcmf_usb_probe(struct usb_interface *in
-- 
-- 	devinfo->usbdev = usb;
-- 	devinfo->dev = &usb->dev;
--+	/* Take an init lock, to protect for disconnect while still loading.
--+	 * Necessary because of the asynchronous firmware load construction
--+	 */
--+	mutex_init(&devinfo->dev_init_lock);
--+	mutex_lock(&devinfo->dev_init_lock);
--+
-- 	usb_set_intfdata(intf, devinfo);
-- 
-- 	/* Check that the device supports only one configuration */
--@@ -1391,6 +1402,7 @@ brcmf_usb_probe(struct usb_interface *in
-- 	return 0;
-- 
-- fail:
--+	mutex_unlock(&devinfo->dev_init_lock);
-- 	kfree(devinfo);
-- 	usb_set_intfdata(intf, NULL);
-- 	return ret;
--@@ -1403,8 +1415,19 @@ brcmf_usb_disconnect(struct usb_interfac
-- 
-- 	brcmf_dbg(USB, "Enter\n");
-- 	devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
---	brcmf_usb_disconnect_cb(devinfo);
---	kfree(devinfo);
--+
--+	if (devinfo) {
--+		mutex_lock(&devinfo->dev_init_lock);
--+		/* Make sure that devinfo still exists. Firmware probe routines
--+		 * may have released the device and cleared the intfdata.
--+		 */
--+		if (!usb_get_intfdata(intf))
--+			goto done;
--+
--+		brcmf_usb_disconnect_cb(devinfo);
--+		kfree(devinfo);
--+	}
--+done:
-- 	brcmf_dbg(USB, "Exit\n");
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/372-0003-brcmfmac-rename-firmware_path-to-alternative_fw_path.patch b/package/kernel/mac80211/patches/372-0003-brcmfmac-rename-firmware_path-to-alternative_fw_path.patch
-deleted file mode 100644
-index f877c23..0000000
---- a/package/kernel/mac80211/patches/372-0003-brcmfmac-rename-firmware_path-to-alternative_fw_path.patch
-+++ /dev/null
-@@ -1,28 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:13 +0200
--Subject: [PATCH] brcmfmac: rename firmware_path to alternative_fw_path
--
--In brcmfmac the module parameter "firmware_path" is used as an
--alternative relative path under the search path used by firmware_class
--or ueventhelper. Rename the parameter to alternative_fw_path to avoid
--confusion.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -28,7 +28,7 @@
-- #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
-- 
-- char brcmf_firmware_path[BRCMF_FW_PATH_LEN];
---module_param_string(firmware_path, brcmf_firmware_path,
--+module_param_string(alternative_fw_path, brcmf_firmware_path,
-- 		    BRCMF_FW_PATH_LEN, 0440);
-- 
-- enum nvram_parser_state {
-diff --git a/package/kernel/mac80211/patches/372-0004-brcmfmac-remove-conversational-comment.patch b/package/kernel/mac80211/patches/372-0004-brcmfmac-remove-conversational-comment.patch
-deleted file mode 100644
-index 0bfd9ef..0000000
---- a/package/kernel/mac80211/patches/372-0004-brcmfmac-remove-conversational-comment.patch
-+++ /dev/null
-@@ -1,25 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:14 +0200
--Subject: [PATCH] brcmfmac: remove conversational comment
--
--Removing a comment that was only useful during the review of
--the change that introduced it and which should never have been
--submitted.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
--@@ -873,9 +873,6 @@ brcmf_msgbuf_process_txstatus(struct brc
-- 	commonring = msgbuf->flowrings[flowid];
-- 	atomic_dec(&commonring->outstanding_tx);
-- 
---	/* Hante: i believe this was a bug as tx_status->msg.ifidx was used
---	 * in brcmf_txfinalize as index in drvr->iflist. Can you confirm/deny?
---	 */
-- 	brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
-- 			 skb, true);
-- }
-diff --git a/package/kernel/mac80211/patches/372-0005-brcmfmac-Rework-p2p-attach-use-single-method-for-p2p.patch b/package/kernel/mac80211/patches/372-0005-brcmfmac-Rework-p2p-attach-use-single-method-for-p2p.patch
-deleted file mode 100644
-index 3ffada8..0000000
---- a/package/kernel/mac80211/patches/372-0005-brcmfmac-Rework-p2p-attach-use-single-method-for-p2p.patch
-+++ /dev/null
-@@ -1,226 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:15 +0200
--Subject: [PATCH] brcmfmac: Rework p2p attach, use single method for p2p dev
-- creation.
--
--When module param p2pon is used a p2p device is created at init.
--This patch reworks how this is done by using the same method as
--for a dynamically (by user space) created p2p device.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -6237,6 +6237,17 @@ struct brcmf_cfg80211_info *brcmf_cfg802
-- 		else
-- 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-- 	}
--+	/* p2p might require that "if-events" get processed by fweh. So
--+	 * activate the already registered event handlers now and activate
--+	 * the rest when initialization has completed. drvr->config needs to
--+	 * be assigned before activating events.
--+	 */
--+	drvr->config = cfg;
--+	err = brcmf_fweh_activate_events(ifp);
--+	if (err) {
--+		brcmf_err("FWEH activation failed (%d)\n", err);
--+		goto wiphy_unreg_out;
--+	}
-- 
-- 	err = brcmf_p2p_attach(cfg, p2pdev_forced);
-- 	if (err) {
--@@ -6259,6 +6270,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
-- 				    brcmf_notify_tdls_peer_event);
-- 	}
-- 
--+	/* (re-) activate FWEH event handling */
--+	err = brcmf_fweh_activate_events(ifp);
--+	if (err) {
--+		brcmf_err("FWEH activation failed (%d)\n", err);
--+		goto wiphy_unreg_out;
--+	}
--+
-- 	return cfg;
-- 
-- wiphy_unreg_out:
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -828,8 +828,8 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 	} else {
-- 		brcmf_dbg(INFO, "allocate netdev interface\n");
-- 		/* Allocate netdev, including space for private structure */
---		ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN,
---				    ether_setup);
--+		ndev = alloc_netdev(sizeof(*ifp), is_p2pdev ? "p2p%d" : name,
--+				    NET_NAME_UNKNOWN, ether_setup);
-- 		if (!ndev)
-- 			return ERR_PTR(-ENOMEM);
-- 
--@@ -1021,12 +1021,7 @@ int brcmf_bus_start(struct device *dev)
-- 	if (IS_ERR(ifp))
-- 		return PTR_ERR(ifp);
-- 
---	if (brcmf_p2p_enable)
---		p2p_ifp = brcmf_add_if(drvr, 1, 0, false, "p2p%d", NULL);
---	else
---		p2p_ifp = NULL;
---	if (IS_ERR(p2p_ifp))
---		p2p_ifp = NULL;
--+	p2p_ifp = NULL;
-- 
-- 	/* signal bus ready */
-- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
--@@ -1060,11 +1055,13 @@ int brcmf_bus_start(struct device *dev)
-- 		goto fail;
-- 	}
-- 
---	ret = brcmf_fweh_activate_events(ifp);
---	if (ret < 0)
---		goto fail;
---
-- 	ret = brcmf_net_attach(ifp, false);
--+
--+	if ((!ret) && (brcmf_p2p_enable)) {
--+		p2p_ifp = drvr->iflist[1];
--+		if (p2p_ifp)
--+			ret = brcmf_net_p2p_attach(p2p_ifp);
--+	}
-- fail:
-- 	if (ret < 0) {
-- 		brcmf_err("failed: %d\n", ret);
--@@ -1076,20 +1073,12 @@ fail:
-- 			brcmf_fws_del_interface(ifp);
-- 			brcmf_fws_deinit(drvr);
-- 		}
---		if (drvr->iflist[0]) {
--+		if (ifp)
-- 			brcmf_net_detach(ifp->ndev);
---			drvr->iflist[0] = NULL;
---		}
---		if (p2p_ifp) {
--+		if (p2p_ifp)
-- 			brcmf_net_detach(p2p_ifp->ndev);
---			drvr->iflist[1] = NULL;
---		}
-- 		return ret;
-- 	}
---	if ((brcmf_p2p_enable) && (p2p_ifp))
---		if (brcmf_net_p2p_attach(p2p_ifp) < 0)
---			brcmf_p2p_enable = 0;
---
-- 	return 0;
-- }
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -213,7 +213,8 @@ static void brcmf_fweh_handle_if_event(s
-- 				   is_p2pdev, emsg->ifname, emsg->addr);
-- 		if (IS_ERR(ifp))
-- 			return;
---		brcmf_fws_add_interface(ifp);
--+		if (!is_p2pdev)
--+			brcmf_fws_add_interface(ifp);
-- 		if (!drvr->fweh.evt_handler[BRCMF_E_IF])
-- 			if (brcmf_net_attach(ifp, false) < 0)
-- 				return;
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2350,83 +2350,30 @@ void brcmf_p2p_stop_device(struct wiphy
--  * brcmf_p2p_attach() - attach for P2P.
--  *
--  * @cfg: driver private data for cfg80211 interface.
--+ * @p2pdev_forced: create p2p device interface at attach.
--  */
-- s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced)
-- {
---	struct brcmf_if *pri_ifp;
---	struct brcmf_if *p2p_ifp;
---	struct brcmf_cfg80211_vif *p2p_vif;
-- 	struct brcmf_p2p_info *p2p;
---	struct brcmf_pub *drvr;
---	s32 bssidx;
--+	struct brcmf_if *pri_ifp;
-- 	s32 err = 0;
--+	void *err_ptr;
-- 
-- 	p2p = &cfg->p2p;
-- 	p2p->cfg = cfg;
-- 
---	drvr = cfg->pub;
---
---	pri_ifp = brcmf_get_ifp(drvr, 0);
--+	pri_ifp = brcmf_get_ifp(cfg->pub, 0);
-- 	p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
-- 
-- 	if (p2pdev_forced) {
---		p2p_ifp = drvr->iflist[1];
--+		err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
--+		if (IS_ERR(err_ptr)) {
--+			brcmf_err("P2P device creation failed.\n");
--+			err = PTR_ERR(err_ptr);
--+		}
-- 	} else {
---		p2p_ifp = NULL;
-- 		p2p->p2pdev_dynamically = true;
-- 	}
---	if (p2p_ifp) {
---		p2p_vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_P2P_DEVICE,
---					  false);
---		if (IS_ERR(p2p_vif)) {
---			brcmf_err("could not create discovery vif\n");
---			err = -ENOMEM;
---			goto exit;
---		}
---
---		p2p_vif->ifp = p2p_ifp;
---		p2p_ifp->vif = p2p_vif;
---		p2p_vif->wdev.netdev = p2p_ifp->ndev;
---		p2p_ifp->ndev->ieee80211_ptr = &p2p_vif->wdev;
---		SET_NETDEV_DEV(p2p_ifp->ndev, wiphy_dev(cfg->wiphy));
---
---		p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = p2p_vif;
---
---		brcmf_p2p_generate_bss_mac(p2p, NULL);
---		memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
---		brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
---
---		brcmf_fweh_p2pdev_setup(pri_ifp, true);
---
---		/* Initialize P2P Discovery in the firmware */
---		err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
---		if (err < 0) {
---			brcmf_err("set p2p_disc error\n");
---			brcmf_free_vif(p2p_vif);
---			goto exit;
---		}
---		/* obtain bsscfg index for P2P discovery */
---		err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
---		if (err < 0) {
---			brcmf_err("retrieving discover bsscfg index failed\n");
---			brcmf_free_vif(p2p_vif);
---			goto exit;
---		}
---		/* Verify that firmware uses same bssidx as driver !! */
---		if (p2p_ifp->bssidx != bssidx) {
---			brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
---				  bssidx, p2p_ifp->bssidx);
---			brcmf_free_vif(p2p_vif);
---			goto exit;
---		}
---
---		init_completion(&p2p->send_af_done);
---		INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
---		init_completion(&p2p->afx_hdl.act_frm_scan);
---		init_completion(&p2p->wait_next_af);
---exit:
---		brcmf_fweh_p2pdev_setup(pri_ifp, false);
---	}
-- 	return err;
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/372-0006-brcmfmac-Fix-station-info-rate-information.patch b/package/kernel/mac80211/patches/372-0006-brcmfmac-Fix-station-info-rate-information.patch
-deleted file mode 100644
-index 0abcf1e..0000000
---- a/package/kernel/mac80211/patches/372-0006-brcmfmac-Fix-station-info-rate-information.patch
-+++ /dev/null
-@@ -1,36 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:16 +0200
--Subject: [PATCH] brcmfmac: Fix station info rate information.
--
--Txrate and rxrate in get_station got assigned first with value
--in kbps and then divided by 100 to get it in 100kbps unit. The
--problem with that is that type of rate is u16 which resulted
--in incorrect values for high data rate values.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -2477,13 +2477,13 @@ brcmf_cfg80211_get_station(struct wiphy
-- 		sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
-- 		if (sinfo->tx_packets) {
-- 			sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
---			sinfo->txrate.legacy = le32_to_cpu(sta_info_le.tx_rate);
---			sinfo->txrate.legacy /= 100;
--+			sinfo->txrate.legacy =
--+				le32_to_cpu(sta_info_le.tx_rate) / 100;
-- 		}
-- 		if (sinfo->rx_packets) {
-- 			sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
---			sinfo->rxrate.legacy = le32_to_cpu(sta_info_le.rx_rate);
---			sinfo->rxrate.legacy /= 100;
--+			sinfo->rxrate.legacy =
--+				le32_to_cpu(sta_info_le.rx_rate) / 100;
-- 		}
-- 		if (le16_to_cpu(sta_info_le.ver) >= 4) {
-- 			sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
-diff --git a/package/kernel/mac80211/patches/372-0007-brcmfmac-Add-RSSI-information-to-get_station.patch b/package/kernel/mac80211/patches/372-0007-brcmfmac-Add-RSSI-information-to-get_station.patch
-deleted file mode 100644
-index bb03d67..0000000
---- a/package/kernel/mac80211/patches/372-0007-brcmfmac-Add-RSSI-information-to-get_station.patch
-+++ /dev/null
-@@ -1,50 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:17 +0200
--Subject: [PATCH] brcmfmac: Add RSSI information to get_station.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -2431,6 +2431,9 @@ brcmf_cfg80211_get_station(struct wiphy
-- 	struct brcmf_sta_info_le sta_info_le;
-- 	u32 sta_flags;
-- 	u32 is_tdls_peer;
--+	s32 total_rssi;
--+	s32 count_rssi;
--+	u32 i;
-- 
-- 	brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
-- 	if (!check_vif_up(ifp->vif))
--@@ -2491,6 +2494,26 @@ brcmf_cfg80211_get_station(struct wiphy
-- 			sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
-- 			sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
-- 		}
--+		total_rssi = 0;
--+		count_rssi = 0;
--+		for (i = 0; i < BRCMF_ANT_MAX; i++) {
--+			if (sta_info_le.rssi[i]) {
--+				sinfo->chain_signal_avg[count_rssi] =
--+					sta_info_le.rssi[i];
--+				sinfo->chain_signal[count_rssi] =
--+					sta_info_le.rssi[i];
--+				total_rssi += sta_info_le.rssi[i];
--+				count_rssi++;
--+			}
--+		}
--+		if (count_rssi) {
--+			sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
--+			sinfo->chains = count_rssi;
--+
--+			sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
--+			total_rssi /= count_rssi;
--+			sinfo->signal = total_rssi;
--+		}
-- 	}
-- done:
-- 	brcmf_dbg(TRACE, "Exit\n");
-diff --git a/package/kernel/mac80211/patches/372-0008-brcmfmac-Add-dump_station-support-to-cfg80221-ops.patch b/package/kernel/mac80211/patches/372-0008-brcmfmac-Add-dump_station-support-to-cfg80221-ops.patch
-deleted file mode 100644
-index a6bafd2..0000000
---- a/package/kernel/mac80211/patches/372-0008-brcmfmac-Add-dump_station-support-to-cfg80221-ops.patch
-+++ /dev/null
-@@ -1,107 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:18 +0200
--Subject: [PATCH] brcmfmac: Add dump_station support to cfg80221 ops.
--
--With this feature it becomes possible to request a station
--assoc list.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -2520,6 +2520,35 @@ done:
-- 	return err;
-- }
-- 
--+static int
--+brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
--+			    int idx, u8 *mac, struct station_info *sinfo)
--+{
--+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--+	struct brcmf_if *ifp = netdev_priv(ndev);
--+	s32 err;
--+
--+	brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
--+
--+	if (idx == 0) {
--+		cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
--+		err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
--+					     &cfg->assoclist,
--+					     sizeof(cfg->assoclist));
--+		if (err) {
--+			brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
--+				  err);
--+			cfg->assoclist.count = 0;
--+			return -EOPNOTSUPP;
--+		}
--+	}
--+	if (idx < le32_to_cpu(cfg->assoclist.count)) {
--+		memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
--+		return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
--+	}
--+	return -ENOENT;
--+}
--+
-- static s32
-- brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
-- 			   bool enabled, s32 timeout)
--@@ -4619,6 +4648,7 @@ static struct cfg80211_ops wl_cfg80211_o
-- 	.join_ibss = brcmf_cfg80211_join_ibss,
-- 	.leave_ibss = brcmf_cfg80211_leave_ibss,
-- 	.get_station = brcmf_cfg80211_get_station,
--+	.dump_station = brcmf_cfg80211_dump_station,
-- 	.set_tx_power = brcmf_cfg80211_set_tx_power,
-- 	.get_tx_power = brcmf_cfg80211_get_tx_power,
-- 	.add_key = brcmf_cfg80211_add_key,
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--@@ -407,6 +407,7 @@ struct brcmf_cfg80211_info {
-- 	struct brcmu_d11inf d11inf;
-- 	bool wowl_enabled;
-- 	u32 pre_wowl_pmmode;
--+	struct brcmf_assoclist_le assoclist;
-- };
-- 
-- /**
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
--@@ -72,6 +72,7 @@
-- #define BRCMF_C_GET_BSS_INFO			136
-- #define BRCMF_C_GET_BANDLIST			140
-- #define BRCMF_C_SET_SCB_TIMEOUT			158
--+#define BRCMF_C_GET_ASSOCLIST			159
-- #define BRCMF_C_GET_PHYLIST			180
-- #define BRCMF_C_SET_SCAN_CHANNEL_TIME		185
-- #define BRCMF_C_SET_SCAN_UNASSOC_TIME		187
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--@@ -119,6 +119,8 @@
-- #define BRCMF_COUNTRY_BUF_SZ		4
-- #define BRCMF_ANT_MAX			4
-- 
--+#define BRCMF_MAX_ASSOCLIST		128
--+
-- /* join preference types for join_pref iovar */
-- enum brcmf_join_pref_types {
-- 	BRCMF_JOIN_PREF_RSSI = 1,
--@@ -621,4 +623,15 @@ struct brcmf_rev_info_le {
-- 	__le32 nvramrev;
-- };
-- 
--+/**
--+ * struct brcmf_assoclist_le - request assoc list.
--+ *
--+ * @count: indicates number of stations.
--+ * @mac: MAC addresses of stations.
--+ */
--+struct brcmf_assoclist_le {
--+	__le32 count;
--+	u8 mac[BRCMF_MAX_ASSOCLIST][ETH_ALEN];
--+};
--+
-- #endif /* FWIL_TYPES_H_ */
-diff --git a/package/kernel/mac80211/patches/372-0009-brcmfmac-Move-brcmf_c_preinit_dcmds-prototype-to-cor.patch b/package/kernel/mac80211/patches/372-0009-brcmfmac-Move-brcmf_c_preinit_dcmds-prototype-to-cor.patch
-deleted file mode 100644
-index dc54904..0000000
---- a/package/kernel/mac80211/patches/372-0009-brcmfmac-Move-brcmf_c_preinit_dcmds-prototype-to-cor.patch
-+++ /dev/null
-@@ -1,42 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:19 +0200
--Subject: [PATCH] brcmfmac: Move brcmf_c_preinit_dcmds prototype to correct
-- file.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/common.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.h
--@@ -17,4 +17,7 @@
-- 
-- extern const u8 ALLFFMAC[ETH_ALEN];
-- 
--+/* Sets dongle media info (drv_version, mac address). */
--+int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
--+
-- #endif /* BRCMFMAC_COMMON_H */
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -33,6 +33,7 @@
-- #include "feature.h"
-- #include "proto.h"
-- #include "pcie.h"
--+#include "common.h"
-- 
-- MODULE_AUTHOR("Broadcom Corporation");
-- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -214,7 +214,4 @@ void brcmf_txflowblock_if(struct brcmf_i
-- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
-- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
-- 
---/* Sets dongle media info (drv_version, mac address). */
---int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
---
-- #endif /* BRCMFMAC_CORE_H */
-diff --git a/package/kernel/mac80211/patches/372-0010-brcmfmac-Remove-unused-state-AP-creating.patch b/package/kernel/mac80211/patches/372-0010-brcmfmac-Remove-unused-state-AP-creating.patch
-deleted file mode 100644
-index c6a7363..0000000
---- a/package/kernel/mac80211/patches/372-0010-brcmfmac-Remove-unused-state-AP-creating.patch
-+++ /dev/null
-@@ -1,55 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:20 +0200
--Subject: [PATCH] brcmfmac: Remove unused state AP creating.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -839,7 +839,6 @@ brcmf_cfg80211_change_iface(struct wiphy
-- 			err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
-- 		}
-- 		if (!err) {
---			set_bit(BRCMF_VIF_STATUS_AP_CREATING, &vif->sme_state);
-- 			brcmf_dbg(INFO, "IF Type = AP\n");
-- 		}
-- 	} else {
--@@ -4250,7 +4249,6 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
-- 
-- 		brcmf_dbg(TRACE, "GO mode configuration complete\n");
-- 	}
---	clear_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
-- 	set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
-- 
-- exit:
--@@ -4315,7 +4313,6 @@ static int brcmf_cfg80211_stop_ap(struct
-- 	}
-- 	brcmf_set_mpc(ifp, 1);
-- 	brcmf_configure_arp_offload(ifp, true);
---	set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
-- 	clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
-- 
-- 	return err;
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--@@ -143,7 +143,6 @@ struct brcmf_cfg80211_profile {
--  * @BRCMF_VIF_STATUS_CONNECTING: connect/join in progress.
--  * @BRCMF_VIF_STATUS_CONNECTED: connected/joined succesfully.
--  * @BRCMF_VIF_STATUS_DISCONNECTING: disconnect/disable in progress.
--- * @BRCMF_VIF_STATUS_AP_CREATING: interface configured for AP operation.
--  * @BRCMF_VIF_STATUS_AP_CREATED: AP operation started.
--  */
-- enum brcmf_vif_status {
--@@ -151,7 +150,6 @@ enum brcmf_vif_status {
-- 	BRCMF_VIF_STATUS_CONNECTING,
-- 	BRCMF_VIF_STATUS_CONNECTED,
-- 	BRCMF_VIF_STATUS_DISCONNECTING,
---	BRCMF_VIF_STATUS_AP_CREATING,
-- 	BRCMF_VIF_STATUS_AP_CREATED
-- };
-- 
-diff --git a/package/kernel/mac80211/patches/372-0011-brcmfmac-Properly-set-carrier-state-of-netdev.patch b/package/kernel/mac80211/patches/372-0011-brcmfmac-Properly-set-carrier-state-of-netdev.patch
-deleted file mode 100644
-index c0948de..0000000
---- a/package/kernel/mac80211/patches/372-0011-brcmfmac-Properly-set-carrier-state-of-netdev.patch
-+++ /dev/null
-@@ -1,122 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 8 Oct 2015 20:33:21 +0200
--Subject: [PATCH] brcmfmac: Properly set carrier state of netdev.
--
--Use the netif_carrier api to correctly set carrier state on the
--different modes.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -4250,6 +4250,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
-- 		brcmf_dbg(TRACE, "GO mode configuration complete\n");
-- 	}
-- 	set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
--+	brcmf_net_setcarrier(ifp, true);
-- 
-- exit:
-- 	if ((err) && (!mbss)) {
--@@ -4314,6 +4315,7 @@ static int brcmf_cfg80211_stop_ap(struct
-- 	brcmf_set_mpc(ifp, 1);
-- 	brcmf_configure_arp_offload(ifp, true);
-- 	clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
--+	brcmf_net_setcarrier(ifp, false);
-- 
-- 	return err;
-- }
--@@ -5023,6 +5025,7 @@ brcmf_notify_connect_status(struct brcmf
-- 				&ifp->vif->sme_state);
-- 		} else
-- 			brcmf_bss_connect_done(cfg, ndev, e, true);
--+		brcmf_net_setcarrier(ifp, true);
-- 	} else if (brcmf_is_linkdown(e)) {
-- 		brcmf_dbg(CONN, "Linkdown\n");
-- 		if (!brcmf_is_ibssmode(ifp->vif)) {
--@@ -5032,6 +5035,7 @@ brcmf_notify_connect_status(struct brcmf
-- 		brcmf_init_prof(ndev_to_prof(ndev));
-- 		if (ndev != cfg_to_ndev(cfg))
-- 			complete(&cfg->vif_disabled);
--+		brcmf_net_setcarrier(ifp, false);
-- 	} else if (brcmf_is_nonetwork(cfg, e)) {
-- 		if (brcmf_is_ibssmode(ifp->vif))
-- 			clear_bit(BRCMF_VIF_STATUS_CONNECTING,
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -635,8 +635,7 @@ static int brcmf_netdev_stop(struct net_
-- 
-- 	brcmf_cfg80211_down(ndev);
-- 
---	/* Set state and stop OS transmissions */
---	netif_stop_queue(ndev);
--+	brcmf_net_setcarrier(ifp, false);
-- 
-- 	return 0;
-- }
--@@ -670,8 +669,8 @@ static int brcmf_netdev_open(struct net_
-- 		return -EIO;
-- 	}
-- 
---	/* Allow transmit calls */
---	netif_start_queue(ndev);
--+	/* Clear, carrier, set when connected or AP mode. */
--+	netif_carrier_off(ndev);
-- 	return 0;
-- }
-- 
--@@ -736,6 +735,24 @@ static void brcmf_net_detach(struct net_
-- 		brcmf_cfg80211_free_netdev(ndev);
-- }
-- 
--+void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
--+{
--+	struct net_device *ndev;
--+
--+	brcmf_dbg(TRACE, "Enter, idx=%d carrier=%d\n", ifp->bssidx, on);
--+
--+	ndev = ifp->ndev;
--+	brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_DISCONNECTED, !on);
--+	if (on) {
--+		if (!netif_carrier_ok(ndev))
--+			netif_carrier_on(ndev);
--+
--+	} else {
--+		if (netif_carrier_ok(ndev))
--+			netif_carrier_off(ndev);
--+	}
--+}
--+
-- static int brcmf_net_p2p_open(struct net_device *ndev)
-- {
-- 	brcmf_dbg(TRACE, "Enter\n");
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -154,10 +154,13 @@ struct brcmf_fws_mac_descriptor;
--  *	netif stopped due to firmware signalling flow control.
--  * @BRCMF_NETIF_STOP_REASON_FLOW:
--  *	netif stopped due to flowring full.
--+ * @BRCMF_NETIF_STOP_REASON_DISCONNECTED:
--+ *	netif stopped due to not being connected (STA mode).
--  */
-- enum brcmf_netif_stop_reason {
---	BRCMF_NETIF_STOP_REASON_FWS_FC = 1,
---	BRCMF_NETIF_STOP_REASON_FLOW = 2
--+	BRCMF_NETIF_STOP_REASON_FWS_FC = BIT(0),
--+	BRCMF_NETIF_STOP_REASON_FLOW = BIT(1),
--+	BRCMF_NETIF_STOP_REASON_DISCONNECTED = BIT(2)
-- };
-- 
-- /**
--@@ -213,5 +216,6 @@ void brcmf_txflowblock_if(struct brcmf_i
-- 			  enum brcmf_netif_stop_reason reason, bool state);
-- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
-- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
--+void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
-- 
-- #endif /* BRCMFMAC_CORE_H */
-diff --git a/package/kernel/mac80211/patches/373-brcm80211-Add-support-for-brcm4371.patch b/package/kernel/mac80211/patches/373-brcm80211-Add-support-for-brcm4371.patch
-deleted file mode 100644
-index ea6fad1..0000000
---- a/package/kernel/mac80211/patches/373-brcm80211-Add-support-for-brcm4371.patch
-+++ /dev/null
-@@ -1,78 +0,0 @@
--From: Eric Caruso <ejcaruso@google.com>
--Date: Wed, 14 Oct 2015 12:34:11 -0700
--Subject: [PATCH] brcm80211: Add support for brcm4371
--
--This is a new Broadcom chip and we should be able to recognize it.
--
--Signed-off-by: Eric Caruso <ejcaruso@google.com>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -682,6 +682,7 @@ static u32 brcmf_chip_tcm_rambase(struct
-- 	case BRCM_CC_43570_CHIP_ID:
-- 	case BRCM_CC_4358_CHIP_ID:
-- 	case BRCM_CC_43602_CHIP_ID:
--+	case BRCM_CC_4371_CHIP_ID:
-- 		return 0x180000;
-- 	case BRCM_CC_4365_CHIP_ID:
-- 	case BRCM_CC_4366_CHIP_ID:
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -59,6 +59,8 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_4365_NVRAM_NAME		"brcm/brcmfmac4365b-pcie.txt"
-- #define BRCMF_PCIE_4366_FW_NAME			"brcm/brcmfmac4366b-pcie.bin"
-- #define BRCMF_PCIE_4366_NVRAM_NAME		"brcm/brcmfmac4366b-pcie.txt"
--+#define BRCMF_PCIE_4371_FW_NAME			"brcm/brcmfmac4371-pcie.bin"
--+#define BRCMF_PCIE_4371_NVRAM_NAME		"brcm/brcmfmac4371-pcie.txt"
-- 
-- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
-- 
--@@ -212,6 +214,8 @@ MODULE_FIRMWARE(BRCMF_PCIE_4365_FW_NAME)
-- MODULE_FIRMWARE(BRCMF_PCIE_4365_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4366_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4366_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4371_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4371_NVRAM_NAME);
-- 
-- 
-- struct brcmf_pcie_console {
--@@ -1521,6 +1525,10 @@ static int brcmf_pcie_get_fwnames(struct
-- 		fw_name = BRCMF_PCIE_4366_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_4366_NVRAM_NAME;
-- 		break;
--+	case BRCM_CC_4371_CHIP_ID:
--+		fw_name = BRCMF_PCIE_4371_FW_NAME;
--+		nvram_name = BRCMF_PCIE_4371_NVRAM_NAME;
--+		break;
-- 	default:
-- 		brcmf_err("Unsupported chip 0x%04x\n", devinfo->ci->chip);
-- 		return -ENODEV;
--@@ -2060,6 +2068,7 @@ static struct pci_device_id brcmf_pcie_d
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID),
-- 	{ /* end: all zeroes */ }
-- };
-- 
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -50,6 +50,7 @@
-- #define BRCM_CC_43602_CHIP_ID		43602
-- #define BRCM_CC_4365_CHIP_ID		0x4365
-- #define BRCM_CC_4366_CHIP_ID		0x4366
--+#define BRCM_CC_4371_CHIP_ID		0x4371
-- 
-- /* USB Device IDs */
-- #define BRCM_USB_43143_DEVICE_ID	0xbd1e
--@@ -75,6 +76,7 @@
-- #define BRCM_PCIE_4366_DEVICE_ID	0x43c3
-- #define BRCM_PCIE_4366_2G_DEVICE_ID	0x43c4
-- #define BRCM_PCIE_4366_5G_DEVICE_ID	0x43c5
--+#define BRCM_PCIE_4371_DEVICE_ID	0x440d
-- 
-- 
-- /* brcmsmac IDs */
-diff --git a/package/kernel/mac80211/patches/374-0001-brcmfmac-Add-support-for-the-BCM4359-11ac-RSDB-PCIE-.patch b/package/kernel/mac80211/patches/374-0001-brcmfmac-Add-support-for-the-BCM4359-11ac-RSDB-PCIE-.patch
-deleted file mode 100644
-index 221bae6..0000000
---- a/package/kernel/mac80211/patches/374-0001-brcmfmac-Add-support-for-the-BCM4359-11ac-RSDB-PCIE-.patch
-+++ /dev/null
-@@ -1,78 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:11 +0100
--Subject: [PATCH] brcmfmac: Add support for the BCM4359 11ac RSDB PCIE device.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
--@@ -681,6 +681,7 @@ static u32 brcmf_chip_tcm_rambase(struct
-- 	case BRCM_CC_43569_CHIP_ID:
-- 	case BRCM_CC_43570_CHIP_ID:
-- 	case BRCM_CC_4358_CHIP_ID:
--+	case BRCM_CC_4359_CHIP_ID:
-- 	case BRCM_CC_43602_CHIP_ID:
-- 	case BRCM_CC_4371_CHIP_ID:
-- 		return 0x180000;
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -55,6 +55,8 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_43570_NVRAM_NAME		"brcm/brcmfmac43570-pcie.txt"
-- #define BRCMF_PCIE_4358_FW_NAME			"brcm/brcmfmac4358-pcie.bin"
-- #define BRCMF_PCIE_4358_NVRAM_NAME		"brcm/brcmfmac4358-pcie.txt"
--+#define BRCMF_PCIE_4359_FW_NAME			"brcm/brcmfmac4359-pcie.bin"
--+#define BRCMF_PCIE_4359_NVRAM_NAME		"brcm/brcmfmac4359-pcie.txt"
-- #define BRCMF_PCIE_4365_FW_NAME			"brcm/brcmfmac4365b-pcie.bin"
-- #define BRCMF_PCIE_4365_NVRAM_NAME		"brcm/brcmfmac4365b-pcie.txt"
-- #define BRCMF_PCIE_4366_FW_NAME			"brcm/brcmfmac4366b-pcie.bin"
--@@ -210,6 +212,8 @@ MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME
-- MODULE_FIRMWARE(BRCMF_PCIE_43570_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4358_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4358_NVRAM_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4359_FW_NAME);
--+MODULE_FIRMWARE(BRCMF_PCIE_4359_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4365_FW_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4365_NVRAM_NAME);
-- MODULE_FIRMWARE(BRCMF_PCIE_4366_FW_NAME);
--@@ -1517,6 +1521,10 @@ static int brcmf_pcie_get_fwnames(struct
-- 		fw_name = BRCMF_PCIE_4358_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_4358_NVRAM_NAME;
-- 		break;
--+	case BRCM_CC_4359_CHIP_ID:
--+		fw_name = BRCMF_PCIE_4359_FW_NAME;
--+		nvram_name = BRCMF_PCIE_4359_NVRAM_NAME;
--+		break;
-- 	case BRCM_CC_4365_CHIP_ID:
-- 		fw_name = BRCMF_PCIE_4365_FW_NAME;
-- 		nvram_name = BRCMF_PCIE_4365_NVRAM_NAME;
--@@ -2058,6 +2066,7 @@ static struct pci_device_id brcmf_pcie_d
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4358_DEVICE_ID),
--+	BRCMF_PCIE_DEVICE(BRCM_PCIE_4359_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID),
-- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID),
----- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
--@@ -47,6 +47,7 @@
-- #define BRCM_CC_43569_CHIP_ID		43569
-- #define BRCM_CC_43570_CHIP_ID		43570
-- #define BRCM_CC_4358_CHIP_ID		0x4358
--+#define BRCM_CC_4359_CHIP_ID		0x4359
-- #define BRCM_CC_43602_CHIP_ID		43602
-- #define BRCM_CC_4365_CHIP_ID		0x4365
-- #define BRCM_CC_4366_CHIP_ID		0x4366
--@@ -66,6 +67,7 @@
-- #define BRCM_PCIE_43567_DEVICE_ID	0x43d3
-- #define BRCM_PCIE_43570_DEVICE_ID	0x43d9
-- #define BRCM_PCIE_4358_DEVICE_ID	0x43e9
--+#define BRCM_PCIE_4359_DEVICE_ID	0x43ef
-- #define BRCM_PCIE_43602_DEVICE_ID	0x43ba
-- #define BRCM_PCIE_43602_2G_DEVICE_ID	0x43bb
-- #define BRCM_PCIE_43602_5G_DEVICE_ID	0x43bc
-diff --git a/package/kernel/mac80211/patches/374-0002-brcmfmac-Simplify-and-fix-usage-of-brcmf_ifname.patch b/package/kernel/mac80211/patches/374-0002-brcmfmac-Simplify-and-fix-usage-of-brcmf_ifname.patch
-deleted file mode 100644
-index 331896b..0000000
---- a/package/kernel/mac80211/patches/374-0002-brcmfmac-Simplify-and-fix-usage-of-brcmf_ifname.patch
-+++ /dev/null
-@@ -1,110 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:12 +0100
--Subject: [PATCH] brcmfmac: Simplify and fix usage of brcmf_ifname.
--
--brcmf_ifname is a debug function to return a name related to an ifp,
--but is using a rather complex implementation. It was also used
--wrongly from bcdc as it did not use the bsscfgidx as it was supposed
--to, but bssidx. This patch fixes that bug and simplifies
--brcmf_ifname.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
--@@ -187,7 +187,8 @@ retry:
-- 		goto retry;
-- 	if (id != bcdc->reqid) {
-- 		brcmf_err("%s: unexpected request id %d (expected %d)\n",
---			  brcmf_ifname(drvr, ifidx), id, bcdc->reqid);
--+			  brcmf_ifname(brcmf_get_ifp(drvr, ifidx)), id,
--+			  bcdc->reqid);
-- 		ret = -EINVAL;
-- 		goto done;
-- 	}
--@@ -234,7 +235,8 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
-- 
-- 	if (id != bcdc->reqid) {
-- 		brcmf_err("%s: unexpected request id %d (expected %d)\n",
---			  brcmf_ifname(drvr, ifidx), id, bcdc->reqid);
--+			  brcmf_ifname(brcmf_get_ifp(drvr, ifidx)), id,
--+			  bcdc->reqid);
-- 		ret = -EINVAL;
-- 		goto done;
-- 	}
--@@ -298,13 +300,13 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
-- 	if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
-- 	    BCDC_PROTO_VER) {
-- 		brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
---			  brcmf_ifname(drvr, tmp_if->ifidx), h->flags);
--+			  brcmf_ifname(tmp_if), h->flags);
-- 		return -EBADE;
-- 	}
-- 
-- 	if (h->flags & BCDC_FLAG_SUM_GOOD) {
-- 		brcmf_dbg(BCDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
---			  brcmf_ifname(drvr, tmp_if->ifidx), h->flags);
--+			  brcmf_ifname(tmp_if), h->flags);
-- 		pktbuf->ip_summed = CHECKSUM_UNNECESSARY;
-- 	}
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -66,20 +66,13 @@ static int brcmf_p2p_enable;
-- module_param_named(p2pon, brcmf_p2p_enable, int, 0);
-- MODULE_PARM_DESC(p2pon, "enable legacy p2p management functionality");
-- 
---char *brcmf_ifname(struct brcmf_pub *drvr, int ifidx)
--+char *brcmf_ifname(struct brcmf_if *ifp)
-- {
---	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
---		brcmf_err("ifidx %d out of range\n", ifidx);
---		return "<if_bad>";
---	}
---
---	if (drvr->iflist[ifidx] == NULL) {
---		brcmf_err("null i/f %d\n", ifidx);
--+	if (!ifp)
-- 		return "<if_null>";
---	}
-- 
---	if (drvr->iflist[ifidx]->ndev)
---		return drvr->iflist[ifidx]->ndev->name;
--+	if (ifp->ndev)
--+		return ifp->ndev->name;
-- 
-- 	return "<if_none>";
-- }
--@@ -237,14 +230,14 @@ static netdev_tx_t brcmf_netdev_start_xm
-- 		struct sk_buff *skb2;
-- 
-- 		brcmf_dbg(INFO, "%s: insufficient headroom\n",
---			  brcmf_ifname(drvr, ifp->bssidx));
--+			  brcmf_ifname(ifp));
-- 		drvr->bus_if->tx_realloc++;
-- 		skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
-- 		dev_kfree_skb(skb);
-- 		skb = skb2;
-- 		if (skb == NULL) {
-- 			brcmf_err("%s: skb_realloc_headroom failed\n",
---				  brcmf_ifname(drvr, ifp->bssidx));
--+				  brcmf_ifname(ifp));
-- 			ret = -ENOMEM;
-- 			goto done;
-- 		}
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -205,7 +205,7 @@ struct brcmf_skb_reorder_data {
-- int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
-- 
-- /* Return pointer to interface name */
---char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
--+char *brcmf_ifname(struct brcmf_if *ifp);
-- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
-- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
-diff --git a/package/kernel/mac80211/patches/374-0003-brcmfmac-Remove-unnecessary-check-from-start_xmit.patch b/package/kernel/mac80211/patches/374-0003-brcmfmac-Remove-unnecessary-check-from-start_xmit.patch
-deleted file mode 100644
-index 4d60521..0000000
---- a/package/kernel/mac80211/patches/374-0003-brcmfmac-Remove-unnecessary-check-from-start_xmit.patch
-+++ /dev/null
-@@ -1,32 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:13 +0100
--Subject: [PATCH] brcmfmac: Remove unnecessary check from start_xmit.
--
--The brcmf_netdev_start_xmit checks if the ndev is still valid by
--checking if it still exists in database. This check is not needed
--and therefor removed.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -217,14 +217,6 @@ static netdev_tx_t brcmf_netdev_start_xm
-- 		goto done;
-- 	}
-- 
---	if (!drvr->iflist[ifp->bssidx]) {
---		brcmf_err("bad ifidx %d\n", ifp->bssidx);
---		netif_stop_queue(ndev);
---		dev_kfree_skb(skb);
---		ret = -ENODEV;
---		goto done;
---	}
---
-- 	/* Make sure there's enough room for any header */
-- 	if (skb_headroom(skb) < drvr->hdrlen) {
-- 		struct sk_buff *skb2;
-diff --git a/package/kernel/mac80211/patches/374-0004-brcmfmac-Remove-unncessary-variable-irq_requested.patch b/package/kernel/mac80211/patches/374-0004-brcmfmac-Remove-unncessary-variable-irq_requested.patch
-deleted file mode 100644
-index 5030297..0000000
---- a/package/kernel/mac80211/patches/374-0004-brcmfmac-Remove-unncessary-variable-irq_requested.patch
-+++ /dev/null
-@@ -1,49 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:14 +0100
--Subject: [PATCH] brcmfmac: Remove unncessary variable irq_requested.
--
--The variable irq_requested is unneeded as the functionality
--it is providing, is also provided by the variable irq_allocated.
--
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -257,7 +257,6 @@ struct brcmf_pcie_core_info {
-- struct brcmf_pciedev_info {
-- 	enum brcmf_pcie_state state;
-- 	bool in_irq;
---	bool irq_requested;
-- 	struct pci_dev *pdev;
-- 	char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
-- 	char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
--@@ -889,7 +888,6 @@ static int brcmf_pcie_request_irq(struct
-- 
-- 	brcmf_dbg(PCIE, "Enter\n");
-- 	/* is it a v1 or v2 implementation */
---	devinfo->irq_requested = false;
-- 	pci_enable_msi(pdev);
-- 	if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1) {
-- 		if (request_threaded_irq(pdev->irq,
--@@ -912,7 +910,6 @@ static int brcmf_pcie_request_irq(struct
-- 			return -EIO;
-- 		}
-- 	}
---	devinfo->irq_requested = true;
-- 	devinfo->irq_allocated = true;
-- 	return 0;
-- }
--@@ -930,9 +927,6 @@ static void brcmf_pcie_release_irq(struc
-- 	pdev = devinfo->pdev;
-- 
-- 	brcmf_pcie_intr_disable(devinfo);
---	if (!devinfo->irq_requested)
---		return;
---	devinfo->irq_requested = false;
-- 	free_irq(pdev->irq, devinfo);
-- 	pci_disable_msi(pdev);
-- 
-diff --git a/package/kernel/mac80211/patches/374-0005-brcmfmac-Disable-runtime-pm-for-USB.patch b/package/kernel/mac80211/patches/374-0005-brcmfmac-Disable-runtime-pm-for-USB.patch
-deleted file mode 100644
-index f2afb90..0000000
---- a/package/kernel/mac80211/patches/374-0005-brcmfmac-Disable-runtime-pm-for-USB.patch
-+++ /dev/null
-@@ -1,26 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:15 +0100
--Subject: [PATCH] brcmfmac: Disable runtime pm for USB.
--
--Currently runtime pm is enabled for USB, but it is not properly
--supported by driver. This patch disables the runtime PM support
--completely for USB, as it currently can result in problems on
--some systems.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--@@ -1504,7 +1504,6 @@ static struct usb_driver brcmf_usbdrvr =
-- 	.suspend = brcmf_usb_suspend,
-- 	.resume = brcmf_usb_resume,
-- 	.reset_resume = brcmf_usb_reset_resume,
---	.supports_autosuspend = 1,
-- #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0))
-- 	.disable_hub_initiated_lpm = 1,
-- #endif
-diff --git a/package/kernel/mac80211/patches/374-0006-brcmfmac-Add-RSDB-support.patch b/package/kernel/mac80211/patches/374-0006-brcmfmac-Add-RSDB-support.patch
-deleted file mode 100644
-index 78a95c5..0000000
---- a/package/kernel/mac80211/patches/374-0006-brcmfmac-Add-RSDB-support.patch
-+++ /dev/null
-@@ -1,65 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:16 +0100
--Subject: [PATCH] brcmfmac: Add RSDB support.
--
--Broadcom devices with a single 802.11 core can work on two band
--concurrently using VSDB feature, ie. Virtual Simultaneous Dual-Band.
--For devices that are fitted with two 802.11 cores and RF paths the
--driver should support a firmware feature called RSDB, which stands
--for Real Simultaneous Dual-Band. RSDB works almost autonomously in
--firmware except for AP config. When the device supports RSDB then
--the interface should not be brought down when configuring it,
--otherwise the link (if configured) on the other interface will be
--lost.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--[kvalo@codeaurora.org: changed the commit log based on discussion]
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -4182,7 +4182,9 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
-- 			}
-- 		}
-- 
---		if (dev_role == NL80211_IFTYPE_AP) {
--+		if ((dev_role == NL80211_IFTYPE_AP) &&
--+		    ((ifp->ifidx == 0) ||
--+		     !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
-- 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
-- 			if (err < 0) {
-- 				brcmf_err("BRCMF_C_DOWN error %d\n", err);
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
--@@ -137,6 +137,7 @@ void brcmf_feat_attach(struct brcmf_pub
-- 	if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
-- 		brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
-- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_P2P, "p2p");
--+	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_RSDB, "rsdb_mode");
-- 
-- 	if (brcmf_feature_disable) {
-- 		brcmf_dbg(INFO, "Features: 0x%02x, disable: 0x%02x\n",
----- a/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.h
--@@ -24,13 +24,16 @@
--  * PNO: preferred network offload.
--  * WOWL: Wake-On-WLAN.
--  * P2P: peer-to-peer
--+ * RSDB: Real Simultaneous Dual Band
--  */
-- #define BRCMF_FEAT_LIST \
-- 	BRCMF_FEAT_DEF(MBSS) \
-- 	BRCMF_FEAT_DEF(MCHAN) \
-- 	BRCMF_FEAT_DEF(PNO) \
-- 	BRCMF_FEAT_DEF(WOWL) \
---	BRCMF_FEAT_DEF(P2P)
--+	BRCMF_FEAT_DEF(P2P) \
--+	BRCMF_FEAT_DEF(RSDB)
--+
-- /*
--  * Quirks:
--  *
-diff --git a/package/kernel/mac80211/patches/374-0007-brcmfmac-Use-consistent-naming-for-bsscfgidx.patch b/package/kernel/mac80211/patches/374-0007-brcmfmac-Use-consistent-naming-for-bsscfgidx.patch
-deleted file mode 100644
-index d1e7264..0000000
---- a/package/kernel/mac80211/patches/374-0007-brcmfmac-Use-consistent-naming-for-bsscfgidx.patch
-+++ /dev/null
-@@ -1,533 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:17 +0100
--Subject: [PATCH] brcmfmac: Use consistent naming for bsscfgidx.
--
--The variable bsscfgidx is used in different places with different
--names, e.g. bsscfg, bssidx, bsscfg_idx. This patch cleans this up
--by using bsscfgidx everywhere.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -775,7 +775,8 @@ brcmf_cfg80211_change_iface(struct wiphy
-- 	s32 ap = 0;
-- 	s32 err = 0;
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d, type=%d\n", ifp->bssidx, type);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
--+		  type);
-- 
-- 	/* WAR: There are a number of p2p interface related problems which
-- 	 * need to be handled initially (before doing the validate).
--@@ -2920,7 +2921,7 @@ brcmf_cfg80211_escan_handler(struct brcm
-- 	status = e->status;
-- 
-- 	if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
---		brcmf_err("scan not ready, bssidx=%d\n", ifp->bssidx);
--+		brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 		return -EPERM;
-- 	}
-- 
--@@ -3876,7 +3877,8 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
-- 	ifp = vif->ifp;
-- 	saved_ie = &vif->saved_ie;
-- 
---	brcmf_dbg(TRACE, "bssidx %d, pktflag : 0x%02X\n", ifp->bssidx, pktflag);
--+	brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
--+		  pktflag);
-- 	iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
-- 	if (!iovar_ie_buf)
-- 		return -ENOMEM;
--@@ -4240,7 +4242,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
-- 			brcmf_err("setting ssid failed %d\n", err);
-- 			goto exit;
-- 		}
---		bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
--+		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
-- 		bss_enable.enable = cpu_to_le32(1);
-- 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
-- 					       sizeof(bss_enable));
--@@ -4307,7 +4309,7 @@ static int brcmf_cfg80211_stop_ap(struct
-- 		if (err < 0)
-- 			brcmf_err("BRCMF_C_UP error %d\n", err);
-- 	} else {
---		bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
--+		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
-- 		bss_enable.enable = cpu_to_le32(0);
-- 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
-- 					       sizeof(bss_enable));
--@@ -5093,9 +5095,9 @@ static s32 brcmf_notify_vif_event(struct
-- 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
-- 	struct brcmf_cfg80211_vif *vif;
-- 
---	brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfg %u\n",
--+	brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
-- 		  ifevent->action, ifevent->flags, ifevent->ifidx,
---		  ifevent->bssidx);
--+		  ifevent->bsscfgidx);
-- 
-- 	mutex_lock(&event->vif_event_lock);
-- 	event->action = ifevent->action;
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -80,7 +80,7 @@ char *brcmf_ifname(struct brcmf_if *ifp)
-- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
-- {
-- 	struct brcmf_if *ifp;
---	s32 bssidx;
--+	s32 bsscfgidx;
-- 
-- 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
-- 		brcmf_err("ifidx %d out of range\n", ifidx);
--@@ -88,9 +88,9 @@ struct brcmf_if *brcmf_get_ifp(struct br
-- 	}
-- 
-- 	ifp = NULL;
---	bssidx = drvr->if2bss[ifidx];
---	if (bssidx >= 0)
---		ifp = drvr->iflist[bssidx];
--+	bsscfgidx = drvr->if2bss[ifidx];
--+	if (bsscfgidx >= 0)
--+		ifp = drvr->iflist[bsscfgidx];
-- 
-- 	return ifp;
-- }
--@@ -108,7 +108,7 @@ static void _brcmf_set_multicast_list(st
-- 
-- 	ifp = container_of(work, struct brcmf_if, multicast_work);
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	ndev = ifp->ndev;
-- 
--@@ -168,7 +168,7 @@ _brcmf_set_mac_address(struct work_struc
-- 
-- 	ifp = container_of(work, struct brcmf_if, setmacaddr_work);
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", ifp->mac_addr,
-- 				       ETH_ALEN);
--@@ -206,7 +206,7 @@ static netdev_tx_t brcmf_netdev_start_xm
-- 	struct brcmf_pub *drvr = ifp->drvr;
-- 	struct ethhdr *eh = (struct ethhdr *)(skb->data);
-- 
---	brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	/* Can the device send data? */
-- 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
--@@ -267,8 +267,8 @@ void brcmf_txflowblock_if(struct brcmf_i
-- 	if (!ifp || !ifp->ndev)
-- 		return;
-- 
---	brcmf_dbg(TRACE, "enter: idx=%d stop=0x%X reason=%d state=%d\n",
---		  ifp->bssidx, ifp->netif_stop, reason, state);
--+	brcmf_dbg(TRACE, "enter: bsscfgidx=%d stop=0x%X reason=%d state=%d\n",
--+		  ifp->bsscfgidx, ifp->netif_stop, reason, state);
-- 
-- 	spin_lock_irqsave(&ifp->netif_stop_lock, flags);
-- 	if (state) {
--@@ -587,7 +587,7 @@ static struct net_device_stats *brcmf_ne
-- {
-- 	struct brcmf_if *ifp = netdev_priv(ndev);
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	return &ifp->stats;
-- }
--@@ -616,7 +616,7 @@ static int brcmf_netdev_stop(struct net_
-- {
-- 	struct brcmf_if *ifp = netdev_priv(ndev);
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	brcmf_cfg80211_down(ndev);
-- 
--@@ -632,7 +632,7 @@ static int brcmf_netdev_open(struct net_
-- 	struct brcmf_bus *bus_if = drvr->bus_if;
-- 	u32 toe_ol;
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	/* If bus is not ready, can't continue */
-- 	if (bus_if->state != BRCMF_BUS_UP) {
--@@ -674,7 +674,7 @@ int brcmf_net_attach(struct brcmf_if *if
-- 	struct net_device *ndev;
-- 	s32 err;
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d mac=%pM\n", ifp->bssidx,
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
-- 		  ifp->mac_addr);
-- 	ndev = ifp->ndev;
-- 
--@@ -706,7 +706,7 @@ int brcmf_net_attach(struct brcmf_if *if
-- 	return 0;
-- 
-- fail:
---	drvr->iflist[ifp->bssidx] = NULL;
--+	drvr->iflist[ifp->bsscfgidx] = NULL;
-- 	ndev->netdev_ops = NULL;
-- 	free_netdev(ndev);
-- 	return -EBADE;
--@@ -724,7 +724,8 @@ void brcmf_net_setcarrier(struct brcmf_i
-- {
-- 	struct net_device *ndev;
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d carrier=%d\n", ifp->bssidx, on);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d carrier=%d\n", ifp->bsscfgidx,
--+		  on);
-- 
-- 	ndev = ifp->ndev;
-- 	brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_DISCONNECTED, !on);
--@@ -771,7 +772,7 @@ static int brcmf_net_p2p_attach(struct b
-- {
-- 	struct net_device *ndev;
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d mac=%pM\n", ifp->bssidx,
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
-- 		  ifp->mac_addr);
-- 	ndev = ifp->ndev;
-- 
--@@ -790,21 +791,21 @@ static int brcmf_net_p2p_attach(struct b
-- 	return 0;
-- 
-- fail:
---	ifp->drvr->iflist[ifp->bssidx] = NULL;
--+	ifp->drvr->iflist[ifp->bsscfgidx] = NULL;
-- 	ndev->netdev_ops = NULL;
-- 	free_netdev(ndev);
-- 	return -EBADE;
-- }
-- 
---struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
--+struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
-- 			      bool is_p2pdev, char *name, u8 *mac_addr)
-- {
-- 	struct brcmf_if *ifp;
-- 	struct net_device *ndev;
-- 
---	brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifidx);
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx, ifidx);
-- 
---	ifp = drvr->iflist[bssidx];
--+	ifp = drvr->iflist[bsscfgidx];
-- 	/*
-- 	 * Delete the existing interface before overwriting it
-- 	 * in case we missed the BRCMF_E_IF_DEL event.
--@@ -815,7 +816,7 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 		if (ifidx) {
-- 			netif_stop_queue(ifp->ndev);
-- 			brcmf_net_detach(ifp->ndev);
---			drvr->iflist[bssidx] = NULL;
--+			drvr->iflist[bsscfgidx] = NULL;
-- 		} else {
-- 			brcmf_err("ignore IF event\n");
-- 			return ERR_PTR(-EINVAL);
--@@ -839,15 +840,15 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 		ndev->destructor = brcmf_cfg80211_free_netdev;
-- 		ifp = netdev_priv(ndev);
-- 		ifp->ndev = ndev;
---		/* store mapping ifidx to bssidx */
--+		/* store mapping ifidx to bsscfgidx */
-- 		if (drvr->if2bss[ifidx] == BRCMF_BSSIDX_INVALID)
---			drvr->if2bss[ifidx] = bssidx;
--+			drvr->if2bss[ifidx] = bsscfgidx;
-- 	}
-- 
-- 	ifp->drvr = drvr;
---	drvr->iflist[bssidx] = ifp;
--+	drvr->iflist[bsscfgidx] = ifp;
-- 	ifp->ifidx = ifidx;
---	ifp->bssidx = bssidx;
--+	ifp->bsscfgidx = bsscfgidx;
-- 
-- 	init_waitqueue_head(&ifp->pend_8021x_wait);
-- 	spin_lock_init(&ifp->netif_stop_lock);
--@@ -861,21 +862,22 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 	return ifp;
-- }
-- 
---static void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
--+static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx)
-- {
-- 	struct brcmf_if *ifp;
-- 
---	ifp = drvr->iflist[bssidx];
---	drvr->iflist[bssidx] = NULL;
--+	ifp = drvr->iflist[bsscfgidx];
--+	drvr->iflist[bsscfgidx] = NULL;
-- 	if (!ifp) {
---		brcmf_err("Null interface, idx=%d\n", bssidx);
--+		brcmf_err("Null interface, bsscfgidx=%d\n", bsscfgidx);
-- 		return;
-- 	}
---	brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifp->ifidx);
---	if (drvr->if2bss[ifp->ifidx] == bssidx)
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
--+		  ifp->ifidx);
--+	if (drvr->if2bss[ifp->ifidx] == bsscfgidx)
-- 		drvr->if2bss[ifp->ifidx] = BRCMF_BSSIDX_INVALID;
-- 	if (ifp->ndev) {
---		if (bssidx == 0) {
--+		if (bsscfgidx == 0) {
-- 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
-- 				rtnl_lock();
-- 				brcmf_netdev_stop(ifp->ndev);
--@@ -905,12 +907,12 @@ static void brcmf_del_if(struct brcmf_pu
-- 
-- void brcmf_remove_interface(struct brcmf_if *ifp)
-- {
---	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bssidx] != ifp))
--+	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bsscfgidx] != ifp))
-- 		return;
---	brcmf_dbg(TRACE, "Enter, bssidx=%d, ifidx=%d\n", ifp->bssidx,
--+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
-- 		  ifp->ifidx);
-- 	brcmf_fws_del_interface(ifp);
---	brcmf_del_if(ifp->drvr, ifp->bssidx);
--+	brcmf_del_if(ifp->drvr, ifp->bsscfgidx);
-- }
-- 
-- int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr)
--@@ -925,10 +927,10 @@ int brcmf_get_next_free_bsscfgidx(struct
-- 	highest = 2;
-- 	for (ifidx = 0; ifidx < BRCMF_MAX_IFS; ifidx++) {
-- 		if (drvr->iflist[ifidx]) {
---			if (drvr->iflist[ifidx]->bssidx == bsscfgidx)
--+			if (drvr->iflist[ifidx]->bsscfgidx == bsscfgidx)
-- 				bsscfgidx = highest + 1;
---			else if (drvr->iflist[ifidx]->bssidx > highest)
---				highest = drvr->iflist[ifidx]->bssidx;
--+			else if (drvr->iflist[ifidx]->bsscfgidx > highest)
--+				highest = drvr->iflist[ifidx]->bsscfgidx;
-- 		} else {
-- 			available = true;
-- 		}
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
--@@ -174,7 +174,7 @@ enum brcmf_netif_stop_reason {
--  * @multicast_work: worker object for multicast provisioning.
--  * @fws_desc: interface specific firmware-signalling descriptor.
--  * @ifidx: interface index in device firmware.
--- * @bssidx: index of bss associated with this interface.
--+ * @bsscfgidx: index of bss associated with this interface.
--  * @mac_addr: assigned mac address.
--  * @netif_stop: bitmap indicates reason why netif queues are stopped.
--  * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
--@@ -190,7 +190,7 @@ struct brcmf_if {
-- 	struct work_struct multicast_work;
-- 	struct brcmf_fws_mac_descriptor *fws_desc;
-- 	int ifidx;
---	s32 bssidx;
--+	s32 bsscfgidx;
-- 	u8 mac_addr[ETH_ALEN];
-- 	u8 netif_stop;
-- 	spinlock_t netif_stop_lock;
--@@ -208,7 +208,7 @@ int brcmf_netdev_wait_pend8021x(struct b
-- char *brcmf_ifname(struct brcmf_if *ifp);
-- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
---struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
--+struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
-- 			      bool is_p2pdev, char *name, u8 *mac_addr);
-- void brcmf_remove_interface(struct brcmf_if *ifp);
-- int brcmf_get_next_free_bsscfgidx(struct brcmf_pub *drvr);
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
--@@ -49,7 +49,7 @@ static int brcmf_debug_psm_watchdog_noti
-- 					   const struct brcmf_event_msg *evtmsg,
-- 					   void *data)
-- {
---	brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
-- 
-- 	return brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
-- 					  evtmsg->datalen);
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
--@@ -182,8 +182,8 @@ static void brcmf_fweh_handle_if_event(s
-- 	bool is_p2pdev;
-- 	int err = 0;
-- 
---	brcmf_dbg(EVENT, "action: %u idx: %u bsscfg: %u flags: %u role: %u\n",
---		  ifevent->action, ifevent->ifidx, ifevent->bssidx,
--+	brcmf_dbg(EVENT, "action: %u ifidx: %u bsscfgidx: %u flags: %u role: %u\n",
--+		  ifevent->action, ifevent->ifidx, ifevent->bsscfgidx,
-- 		  ifevent->flags, ifevent->role);
-- 
-- 	/* The P2P Device interface event must not be ignored contrary to what
--@@ -204,12 +204,12 @@ static void brcmf_fweh_handle_if_event(s
-- 		return;
-- 	}
-- 
---	ifp = drvr->iflist[ifevent->bssidx];
--+	ifp = drvr->iflist[ifevent->bsscfgidx];
-- 
-- 	if (ifevent->action == BRCMF_E_IF_ADD) {
-- 		brcmf_dbg(EVENT, "adding %s (%pM)\n", emsg->ifname,
-- 			  emsg->addr);
---		ifp = brcmf_add_if(drvr, ifevent->bssidx, ifevent->ifidx,
--+		ifp = brcmf_add_if(drvr, ifevent->bsscfgidx, ifevent->ifidx,
-- 				   is_p2pdev, emsg->ifname, emsg->addr);
-- 		if (IS_ERR(ifp))
-- 			return;
----- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
--@@ -219,7 +219,7 @@ struct brcmf_if_event {
-- 	u8 ifidx;
-- 	u8 action;
-- 	u8 flags;
---	u8 bssidx;
--+	u8 bsscfgidx;
-- 	u8 role;
-- };
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
--@@ -293,22 +293,22 @@ brcmf_fil_iovar_int_get(struct brcmf_if
-- }
-- 
-- static u32
---brcmf_create_bsscfg(s32 bssidx, char *name, char *data, u32 datalen, char *buf,
---		    u32 buflen)
--+brcmf_create_bsscfg(s32 bsscfgidx, char *name, char *data, u32 datalen,
--+		    char *buf, u32 buflen)
-- {
-- 	const s8 *prefix = "bsscfg:";
-- 	s8 *p;
-- 	u32 prefixlen;
-- 	u32 namelen;
-- 	u32 iolen;
---	__le32 bssidx_le;
--+	__le32 bsscfgidx_le;
-- 
---	if (bssidx == 0)
--+	if (bsscfgidx == 0)
-- 		return brcmf_create_iovar(name, data, datalen, buf, buflen);
-- 
-- 	prefixlen = strlen(prefix);
-- 	namelen = strlen(name) + 1; /* lengh of iovar  name + null */
---	iolen = prefixlen + namelen + sizeof(bssidx_le) + datalen;
--+	iolen = prefixlen + namelen + sizeof(bsscfgidx_le) + datalen;
-- 
-- 	if (buflen < iolen) {
-- 		brcmf_err("buffer is too short\n");
--@@ -326,9 +326,9 @@ brcmf_create_bsscfg(s32 bssidx, char *na
-- 	p += namelen;
-- 
-- 	/* bss config index as first data */
---	bssidx_le = cpu_to_le32(bssidx);
---	memcpy(p, &bssidx_le, sizeof(bssidx_le));
---	p += sizeof(bssidx_le);
--+	bsscfgidx_le = cpu_to_le32(bsscfgidx);
--+	memcpy(p, &bsscfgidx_le, sizeof(bsscfgidx_le));
--+	p += sizeof(bsscfgidx_le);
-- 
-- 	/* parameter buffer follows */
-- 	if (datalen)
--@@ -347,12 +347,12 @@ brcmf_fil_bsscfg_data_set(struct brcmf_i
-- 
-- 	mutex_lock(&drvr->proto_block);
-- 
---	brcmf_dbg(FIL, "ifidx=%d, bssidx=%d, name=%s, len=%d\n", ifp->ifidx,
---		  ifp->bssidx, name, len);
--+	brcmf_dbg(FIL, "ifidx=%d, bsscfgidx=%d, name=%s, len=%d\n", ifp->ifidx,
--+		  ifp->bsscfgidx, name, len);
-- 	brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-- 			   min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
-- 
---	buflen = brcmf_create_bsscfg(ifp->bssidx, name, data, len,
--+	buflen = brcmf_create_bsscfg(ifp->bsscfgidx, name, data, len,
-- 				     drvr->proto_buf, sizeof(drvr->proto_buf));
-- 	if (buflen) {
-- 		err = brcmf_fil_cmd_data(ifp, BRCMF_C_SET_VAR, drvr->proto_buf,
--@@ -376,7 +376,7 @@ brcmf_fil_bsscfg_data_get(struct brcmf_i
-- 
-- 	mutex_lock(&drvr->proto_block);
-- 
---	buflen = brcmf_create_bsscfg(ifp->bssidx, name, data, len,
--+	buflen = brcmf_create_bsscfg(ifp->bsscfgidx, name, data, len,
-- 				     drvr->proto_buf, sizeof(drvr->proto_buf));
-- 	if (buflen) {
-- 		err = brcmf_fil_cmd_data(ifp, BRCMF_C_GET_VAR, drvr->proto_buf,
--@@ -387,8 +387,8 @@ brcmf_fil_bsscfg_data_get(struct brcmf_i
-- 		err = -EPERM;
-- 		brcmf_err("Creating bsscfg failed\n");
-- 	}
---	brcmf_dbg(FIL, "ifidx=%d, bssidx=%d, name=%s, len=%d\n", ifp->ifidx,
---		  ifp->bssidx, name, len);
--+	brcmf_dbg(FIL, "ifidx=%d, bsscfgidx=%d, name=%s, len=%d\n", ifp->ifidx,
--+		  ifp->bsscfgidx, name, len);
-- 	brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-- 			   min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--@@ -170,7 +170,7 @@ struct brcmf_fil_af_params_le {
-- };
-- 
-- struct brcmf_fil_bss_enable_le {
---	__le32 bsscfg_idx;
--+	__le32 bsscfgidx;
-- 	__le32 enable;
-- };
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -719,7 +719,7 @@ static void brcmf_fws_macdesc_init(struc
-- 	desc->state = BRCMF_FWS_STATE_OPEN;
-- 	desc->requested_credit = 0;
-- 	desc->requested_packet = 0;
---	/* depending on use may need ifp->bssidx instead */
--+	/* depending on use may need ifp->bsscfgidx instead */
-- 	desc->interface_id = ifidx;
-- 	desc->ac_bitmap = 0xff; /* update this when handling APSD */
-- 	if (addr)
--@@ -1938,7 +1938,7 @@ void brcmf_fws_reset_interface(struct br
-- {
-- 	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
-- 
---	brcmf_dbg(TRACE, "enter: idx=%d\n", ifp->bssidx);
--+	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
-- 	if (!entry)
-- 		return;
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -2067,7 +2067,7 @@ static struct wireless_dev *brcmf_p2p_cr
-- 	struct brcmf_if *p2p_ifp;
-- 	struct brcmf_if *pri_ifp;
-- 	int err;
---	u32 bssidx;
--+	u32 bsscfgidx;
-- 
-- 	if (p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
-- 		return ERR_PTR(-ENOSPC);
--@@ -2113,13 +2113,13 @@ static struct wireless_dev *brcmf_p2p_cr
-- 	memcpy(&p2p_vif->wdev.address, p2p->dev_addr, sizeof(p2p->dev_addr));
-- 
-- 	/* verify bsscfg index for P2P discovery */
---	err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
--+	err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bsscfgidx);
-- 	if (err < 0) {
-- 		brcmf_err("retrieving discover bsscfg index failed\n");
-- 		goto fail;
-- 	}
-- 
---	WARN_ON(p2p_ifp->bssidx != bssidx);
--+	WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx);
-- 
-- 	init_completion(&p2p->send_af_done);
-- 	INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
-diff --git a/package/kernel/mac80211/patches/374-0008-brcmfmac-Use-new-methods-for-pcie-Power-Management.patch b/package/kernel/mac80211/patches/374-0008-brcmfmac-Use-new-methods-for-pcie-Power-Management.patch
-deleted file mode 100644
-index fb2b85e..0000000
---- a/package/kernel/mac80211/patches/374-0008-brcmfmac-Use-new-methods-for-pcie-Power-Management.patch
-+++ /dev/null
-@@ -1,163 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:18 +0100
--Subject: [PATCH] brcmfmac: Use new methods for pcie Power Management.
--
--Currently the legacy methods suspend and resume are used for pcie
--devices. This is not the preferable method and is also causing
--issues with some setups when doing hibernate. Changing this to
--use the new PM methods.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -1388,10 +1388,6 @@ static void brcmf_pcie_wowl_config(struc
-- 
-- 	brcmf_dbg(PCIE, "Configuring WOWL, enabled=%d\n", enabled);
-- 	devinfo->wowl_enabled = enabled;
---	if (enabled)
---		device_set_wakeup_enable(&devinfo->pdev->dev, true);
---	else
---		device_set_wakeup_enable(&devinfo->pdev->dev, false);
-- }
-- 
-- 
--@@ -1961,15 +1957,14 @@ brcmf_pcie_remove(struct pci_dev *pdev)
-- #ifdef CONFIG_PM
-- 
-- 
---static int brcmf_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
--+static int brcmf_pcie_pm_enter_D3(struct device *dev)
-- {
-- 	struct brcmf_pciedev_info *devinfo;
-- 	struct brcmf_bus *bus;
---	int err;
-- 
---	brcmf_dbg(PCIE, "Enter, state=%d, pdev=%p\n", state.event, pdev);
--+	brcmf_err("Enter\n");
-- 
---	bus = dev_get_drvdata(&pdev->dev);
--+	bus = dev_get_drvdata(dev);
-- 	devinfo = bus->bus_priv.pcie->devinfo;
-- 
-- 	brcmf_bus_change_state(bus, BRCMF_BUS_DOWN);
--@@ -1984,62 +1979,45 @@ static int brcmf_pcie_suspend(struct pci
-- 		brcmf_err("Timeout on response for entering D3 substate\n");
-- 		return -EIO;
-- 	}
---	brcmf_pcie_send_mb_data(devinfo, BRCMF_H2D_HOST_D0_INFORM_IN_USE);
-- 
---	err = pci_save_state(pdev);
---	if (err)
---		brcmf_err("pci_save_state failed, err=%d\n", err);
---	if ((err) || (!devinfo->wowl_enabled)) {
---		brcmf_chip_detach(devinfo->ci);
---		devinfo->ci = NULL;
---		brcmf_pcie_remove(pdev);
---		return 0;
---	}
--+	devinfo->state = BRCMFMAC_PCIE_STATE_DOWN;
-- 
---	return pci_prepare_to_sleep(pdev);
--+	return 0;
-- }
-- 
---static int brcmf_pcie_resume(struct pci_dev *pdev)
--+
--+static int brcmf_pcie_pm_leave_D3(struct device *dev)
-- {
-- 	struct brcmf_pciedev_info *devinfo;
-- 	struct brcmf_bus *bus;
--+	struct pci_dev *pdev;
-- 	int err;
-- 
---	bus = dev_get_drvdata(&pdev->dev);
---	brcmf_dbg(PCIE, "Enter, pdev=%p, bus=%p\n", pdev, bus);
--+	brcmf_err("Enter\n");
-- 
---	err = pci_set_power_state(pdev, PCI_D0);
---	if (err) {
---		brcmf_err("pci_set_power_state failed, err=%d\n", err);
---		goto cleanup;
---	}
---	pci_restore_state(pdev);
---	pci_enable_wake(pdev, PCI_D3hot, false);
---	pci_enable_wake(pdev, PCI_D3cold, false);
--+	bus = dev_get_drvdata(dev);
--+	devinfo = bus->bus_priv.pcie->devinfo;
--+	brcmf_dbg(PCIE, "Enter, dev=%p, bus=%p\n", dev, bus);
-- 
-- 	/* Check if device is still up and running, if so we are ready */
---	if (bus) {
---		devinfo = bus->bus_priv.pcie->devinfo;
---		if (brcmf_pcie_read_reg32(devinfo,
---					  BRCMF_PCIE_PCIE2REG_INTMASK) != 0) {
---			if (brcmf_pcie_send_mb_data(devinfo,
---						    BRCMF_H2D_HOST_D0_INFORM))
---				goto cleanup;
---			brcmf_dbg(PCIE, "Hot resume, continue....\n");
---			brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
---			brcmf_bus_change_state(bus, BRCMF_BUS_UP);
---			brcmf_pcie_intr_enable(devinfo);
---			return 0;
---		}
--+	if (brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_INTMASK) != 0) {
--+		brcmf_dbg(PCIE, "Try to wakeup device....\n");
--+		if (brcmf_pcie_send_mb_data(devinfo, BRCMF_H2D_HOST_D0_INFORM))
--+			goto cleanup;
--+		brcmf_dbg(PCIE, "Hot resume, continue....\n");
--+		devinfo->state = BRCMFMAC_PCIE_STATE_UP;
--+		brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
--+		brcmf_bus_change_state(bus, BRCMF_BUS_UP);
--+		brcmf_pcie_intr_enable(devinfo);
--+		return 0;
-- 	}
-- 
-- cleanup:
---	if (bus) {
---		devinfo = bus->bus_priv.pcie->devinfo;
---		brcmf_chip_detach(devinfo->ci);
---		devinfo->ci = NULL;
---		brcmf_pcie_remove(pdev);
---	}
--+	brcmf_chip_detach(devinfo->ci);
--+	devinfo->ci = NULL;
--+	pdev = devinfo->pdev;
--+	brcmf_pcie_remove(pdev);
--+
-- 	err = brcmf_pcie_probe(pdev, NULL);
-- 	if (err)
-- 		brcmf_err("probe after resume failed, err=%d\n", err);
--@@ -2048,6 +2026,14 @@ cleanup:
-- }
-- 
-- 
--+static const struct dev_pm_ops brcmf_pciedrvr_pm = {
--+	.suspend = brcmf_pcie_pm_enter_D3,
--+	.resume = brcmf_pcie_pm_leave_D3,
--+	.freeze = brcmf_pcie_pm_enter_D3,
--+	.restore = brcmf_pcie_pm_leave_D3,
--+};
--+
--+
-- #endif /* CONFIG_PM */
-- 
-- 
--@@ -2086,9 +2072,8 @@ static struct pci_driver brcmf_pciedrvr
-- 	.probe = brcmf_pcie_probe,
-- 	.remove = brcmf_pcie_remove,
-- #ifdef CONFIG_PM
---	.suspend = brcmf_pcie_suspend,
---	.resume = brcmf_pcie_resume
---#endif /* CONFIG_PM */
--+	.driver.pm = &brcmf_pciedrvr_pm,
--+#endif
-- };
-- 
-- 
-diff --git a/package/kernel/mac80211/patches/374-0009-brcmfmac-Add-wowl-wake-indication-report.patch b/package/kernel/mac80211/patches/374-0009-brcmfmac-Add-wowl-wake-indication-report.patch
-deleted file mode 100644
-index 4324cc7..0000000
---- a/package/kernel/mac80211/patches/374-0009-brcmfmac-Add-wowl-wake-indication-report.patch
-+++ /dev/null
-@@ -1,129 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Thu, 29 Oct 2015 20:33:19 +0100
--Subject: [PATCH] brcmfmac: Add wowl wake indication report.
--
--On wakeup of the system (resume) a wowl wakeup indication report
--can be sent to cfg80211. This patch adds support for this. The
--report specifies if the device was responsible for the wakeup
--and if so, will specify the exact reason.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -3061,6 +3061,67 @@ static s32 brcmf_config_wowl_pattern(str
-- 	return ret;
-- }
-- 
--+#ifdef CPTCFG_PM
--+
--+static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
--+{
--+	struct brcmf_wowl_wakeind_le wake_ind_le;
--+	struct cfg80211_wowlan_wakeup wakeup_data;
--+	struct cfg80211_wowlan_wakeup *wakeup;
--+	u32 wakeind;
--+	s32 err;
--+
--+	err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
--+				       sizeof(wake_ind_le));
--+	if (!err) {
--+		brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
--+		return;
--+	}
--+
--+	wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
--+	if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
--+		       BRCMF_WOWL_RETR | BRCMF_WOWL_NET)) {
--+		wakeup = &wakeup_data;
--+		memset(&wakeup_data, 0, sizeof(wakeup_data));
--+		wakeup_data.pattern_idx = -1;
--+
--+		if (wakeind & BRCMF_WOWL_MAGIC) {
--+			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
--+			wakeup_data.magic_pkt = true;
--+		}
--+		if (wakeind & BRCMF_WOWL_DIS) {
--+			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
--+			wakeup_data.disconnect = true;
--+		}
--+		if (wakeind & BRCMF_WOWL_BCN) {
--+			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
--+			wakeup_data.disconnect = true;
--+		}
--+		if (wakeind & BRCMF_WOWL_RETR) {
--+			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
--+			wakeup_data.disconnect = true;
--+		}
--+		if (wakeind & BRCMF_WOWL_NET) {
--+			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
--+			/* For now always map to pattern 0, no API to get
--+			 * correct information available at the moment.
--+			 */
--+			wakeup_data.pattern_idx = 0;
--+		}
--+	} else {
--+		wakeup = NULL;
--+	}
--+	cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
--+}
--+
--+#else
--+
--+static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
--+{
--+}
--+
--+#endif /* CPTCFG_PM */
--+
-- static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
-- {
-- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--@@ -3070,11 +3131,12 @@ static s32 brcmf_cfg80211_resume(struct
-- 	brcmf_dbg(TRACE, "Enter\n");
-- 
-- 	if (cfg->wowl_enabled) {
--+		brcmf_report_wowl_wakeind(wiphy, ifp);
--+		brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
--+		brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
-- 		brcmf_configure_arp_offload(ifp, true);
-- 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
-- 				      cfg->pre_wowl_pmmode);
---		brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
---		brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
-- 		cfg->wowl_enabled = false;
-- 	}
-- 	return 0;
--@@ -3108,6 +3170,7 @@ static void brcmf_configure_wowl(struct
-- 				wowl->patterns[i].pkt_offset);
-- 		}
-- 	}
--+	brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear", strlen("clear"));
-- 	brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
-- 	brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
-- 	brcmf_bus_wowl_config(cfg->pub->bus_if, true);
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--@@ -634,4 +634,16 @@ struct brcmf_assoclist_le {
-- 	u8 mac[BRCMF_MAX_ASSOCLIST][ETH_ALEN];
-- };
-- 
--+/**
--+ * struct brcmf_wowl_wakeind_le - Wakeup indicators
--+ *	Note: note both fields contain same information.
--+ *
--+ * @pci_wakeind: Whether PCI PMECSR PMEStatus bit was set.
--+ * @ucode_wakeind: What wakeup-event indication was set by ucode
--+ */
--+struct brcmf_wowl_wakeind_le {
--+	__le32 pci_wakeind;
--+	__le32 ucode_wakeind;
--+};
--+
-- #endif /* FWIL_TYPES_H_ */
-diff --git a/package/kernel/mac80211/patches/375-brcmfmac-constify-brcmf_bus_ops-structures.patch b/package/kernel/mac80211/patches/375-brcmfmac-constify-brcmf_bus_ops-structures.patch
-deleted file mode 100644
-index a0cc231..0000000
---- a/package/kernel/mac80211/patches/375-brcmfmac-constify-brcmf_bus_ops-structures.patch
-+++ /dev/null
-@@ -1,57 +0,0 @@
--From: Julia Lawall <Julia.Lawall@lip6.fr>
--Date: Sat, 14 Nov 2015 17:22:07 +0100
--Subject: [PATCH] brcmfmac: constify brcmf_bus_ops structures
--
--The brcmf_bus_ops structures are never modified, so declare them as const.
--
--Done with the help of Coccinelle.
--
--Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/bus.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
--@@ -137,7 +137,7 @@ struct brcmf_bus {
-- 	bool always_use_fws_queue;
-- 	bool wowl_supported;
-- 
---	struct brcmf_bus_ops *ops;
--+	const struct brcmf_bus_ops *ops;
-- 	struct brcmf_bus_msgbuf *msgbuf;
-- };
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -1413,7 +1413,7 @@ static int brcmf_pcie_get_memdump(struct
-- }
-- 
-- 
---static struct brcmf_bus_ops brcmf_pcie_bus_ops = {
--+static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
-- 	.txdata = brcmf_pcie_tx,
-- 	.stop = brcmf_pcie_down,
-- 	.txctl = brcmf_pcie_tx_ctlpkt,
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -4025,7 +4025,7 @@ brcmf_sdio_watchdog(unsigned long data)
-- 	}
-- }
-- 
---static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
--+static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
-- 	.stop = brcmf_sdio_bus_stop,
-- 	.preinit = brcmf_sdio_bus_preinit,
-- 	.txdata = brcmf_sdio_bus_txdata,
----- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--@@ -1163,7 +1163,7 @@ static void brcmf_usb_wowl_config(struct
-- 		device_set_wakeup_enable(devinfo->dev, false);
-- }
-- 
---static struct brcmf_bus_ops brcmf_usb_bus_ops = {
--+static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
-- 	.txdata = brcmf_usb_tx,
-- 	.stop = brcmf_usb_down,
-- 	.txctl = brcmf_usb_tx_ctlpkt,
-diff --git a/package/kernel/mac80211/patches/376-0001-brcmfmac-Cleanup-ssid-storage.patch b/package/kernel/mac80211/patches/376-0001-brcmfmac-Cleanup-ssid-storage.patch
-deleted file mode 100644
-index 83f1ebe..0000000
---- a/package/kernel/mac80211/patches/376-0001-brcmfmac-Cleanup-ssid-storage.patch
-+++ /dev/null
-@@ -1,251 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:37 +0100
--Subject: [PATCH] brcmfmac: Cleanup ssid storage.
--
--SSIDs used for connect and p2p got stored, but never used.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -959,7 +959,7 @@ brcmf_run_escan(struct brcmf_cfg80211_in
-- 		params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
-- 
-- 		/* Allocate space for populating ssids in struct */
---		params_size += sizeof(struct brcmf_ssid) * request->n_ssids;
--+		params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
-- 	}
-- 
-- 	params = kzalloc(params_size, GFP_KERNEL);
--@@ -1291,6 +1291,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
-- 	s32 wsec = 0;
-- 	s32 bcnprd;
-- 	u16 chanspec;
--+	u32 ssid_len;
-- 
-- 	brcmf_dbg(TRACE, "Enter\n");
-- 	if (!check_vif_up(ifp->vif))
--@@ -1368,17 +1369,15 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
-- 	memset(&join_params, 0, sizeof(struct brcmf_join_params));
-- 
-- 	/* SSID */
---	profile->ssid.SSID_len = min_t(u32, params->ssid_len, 32);
---	memcpy(profile->ssid.SSID, params->ssid, profile->ssid.SSID_len);
---	memcpy(join_params.ssid_le.SSID, params->ssid, profile->ssid.SSID_len);
---	join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
--+	ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
--+	memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
--+	join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
-- 	join_params_size = sizeof(join_params.ssid_le);
-- 
-- 	/* BSSID */
-- 	if (params->bssid) {
-- 		memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
---		join_params_size = sizeof(join_params.ssid_le) +
---				   BRCMF_ASSOC_PARAMS_FIXED_SIZE;
--+		join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
-- 		memcpy(profile->bssid, params->bssid, ETH_ALEN);
-- 	} else {
-- 		eth_broadcast_addr(join_params.params_le.bssid);
--@@ -1728,7 +1727,6 @@ brcmf_cfg80211_connect(struct wiphy *wip
-- {
-- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
-- 	struct brcmf_if *ifp = netdev_priv(ndev);
---	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
-- 	struct ieee80211_channel *chan = sme->channel;
-- 	struct brcmf_join_params join_params;
-- 	size_t join_params_size;
--@@ -1739,6 +1737,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
-- 	struct brcmf_ext_join_params_le *ext_join_params;
-- 	u16 chanspec;
-- 	s32 err = 0;
--+	u32 ssid_len;
-- 
-- 	brcmf_dbg(TRACE, "Enter\n");
-- 	if (!check_vif_up(ifp->vif))
--@@ -1824,15 +1823,6 @@ brcmf_cfg80211_connect(struct wiphy *wip
-- 		goto done;
-- 	}
-- 
---	profile->ssid.SSID_len = min_t(u32, (u32)sizeof(profile->ssid.SSID),
---				       (u32)sme->ssid_len);
---	memcpy(&profile->ssid.SSID, sme->ssid, profile->ssid.SSID_len);
---	if (profile->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
---		profile->ssid.SSID[profile->ssid.SSID_len] = 0;
---		brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n", profile->ssid.SSID,
---			  profile->ssid.SSID_len);
---	}
---
-- 	/* Join with specific BSSID and cached SSID
-- 	 * If SSID is zero join based on BSSID only
-- 	 */
--@@ -1845,9 +1835,12 @@ brcmf_cfg80211_connect(struct wiphy *wip
-- 		err = -ENOMEM;
-- 		goto done;
-- 	}
---	ext_join_params->ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
---	memcpy(&ext_join_params->ssid_le.SSID, sme->ssid,
---	       profile->ssid.SSID_len);
--+	ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
--+	ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
--+	memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
--+	if (ssid_len < IEEE80211_MAX_SSID_LEN)
--+		brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
--+			  ext_join_params->ssid_le.SSID, ssid_len);
-- 
-- 	/* Set up join scan parameters */
-- 	ext_join_params->scan_le.scan_type = -1;
--@@ -1895,8 +1888,8 @@ brcmf_cfg80211_connect(struct wiphy *wip
-- 	memset(&join_params, 0, sizeof(join_params));
-- 	join_params_size = sizeof(join_params.ssid_le);
-- 
---	memcpy(&join_params.ssid_le.SSID, sme->ssid, profile->ssid.SSID_len);
---	join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
--+	memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
--+	join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
-- 
-- 	if (sme->bssid)
-- 		memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
--@@ -2775,9 +2768,7 @@ CleanUp:
-- static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
-- 				 struct brcmf_if *ifp)
-- {
---	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ifp->ndev);
-- 	struct brcmf_bss_info_le *bi;
---	struct brcmf_ssid *ssid;
-- 	const struct brcmf_tlv *tim;
-- 	u16 beacon_interval;
-- 	u8 dtim_period;
--@@ -2789,8 +2780,6 @@ static s32 brcmf_update_bss_info(struct
-- 	if (brcmf_is_ibssmode(ifp->vif))
-- 		return err;
-- 
---	ssid = &profile->ssid;
---
-- 	*(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
-- 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
-- 				     cfg->extra_buf, WL_EXTRA_BUF_MAX);
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--@@ -124,13 +124,11 @@ struct brcmf_cfg80211_security {
-- /**
--  * struct brcmf_cfg80211_profile - profile information.
--  *
--- * @ssid: ssid of associated/associating ap.
--  * @bssid: bssid of joined/joining ibss.
--  * @sec: security information.
--  * @key: key information
--  */
-- struct brcmf_cfg80211_profile {
---	struct brcmf_ssid ssid;
-- 	u8 bssid[ETH_ALEN];
-- 	struct brcmf_cfg80211_security sec;
-- 	struct brcmf_wsec_key key[BRCMF_MAX_DEFAULT_KEYS];
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--@@ -282,14 +282,9 @@ struct brcm_rateset_le {
-- 	u8 rates[BRCMF_MAXRATES_IN_SET];
-- };
-- 
---struct brcmf_ssid {
---	u32 SSID_len;
---	unsigned char SSID[32];
---};
---
-- struct brcmf_ssid_le {
-- 	__le32 SSID_len;
---	unsigned char SSID[32];
--+	unsigned char SSID[IEEE80211_MAX_SSID_LEN];
-- };
-- 
-- struct brcmf_scan_params_le {
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -642,7 +642,6 @@ static s32 brcmf_p2p_escan(struct brcmf_
-- 	struct brcmf_cfg80211_vif *vif;
-- 	struct brcmf_p2p_scan_le *p2p_params;
-- 	struct brcmf_scan_params_le *sparams;
---	struct brcmf_ssid ssid;
-- 
-- 	memsize += num_chans * sizeof(__le16);
-- 	memblk = kzalloc(memsize, GFP_KERNEL);
--@@ -655,16 +654,16 @@ static s32 brcmf_p2p_escan(struct brcmf_
-- 		ret = -EINVAL;
-- 		goto exit;
-- 	}
--+	p2p_params = (struct brcmf_p2p_scan_le *)memblk;
--+	sparams = &p2p_params->eparams.params_le;
-- 
-- 	switch (search_state) {
-- 	case WL_P2P_DISC_ST_SEARCH:
-- 		/*
-- 		 * If we in SEARCH STATE, we don't need to set SSID explictly
---		 * because dongle use P2P WILDCARD internally by default
--+		 * because dongle use P2P WILDCARD internally by default, use
--+		 * null ssid, which it is already due to kzalloc.
-- 		 */
---		/* use null ssid */
---		ssid.SSID_len = 0;
---		memset(ssid.SSID, 0, sizeof(ssid.SSID));
-- 		break;
-- 	case WL_P2P_DISC_ST_SCAN:
-- 		/*
--@@ -673,8 +672,10 @@ static s32 brcmf_p2p_escan(struct brcmf_
-- 		 * P2P WILDCARD because we just do broadcast scan unless
-- 		 * setting SSID.
-- 		 */
---		ssid.SSID_len = BRCMF_P2P_WILDCARD_SSID_LEN;
---		memcpy(ssid.SSID, BRCMF_P2P_WILDCARD_SSID, ssid.SSID_len);
--+		sparams->ssid_le.SSID_len =
--+				cpu_to_le32(BRCMF_P2P_WILDCARD_SSID_LEN);
--+		memcpy(sparams->ssid_le.SSID, BRCMF_P2P_WILDCARD_SSID,
--+		       BRCMF_P2P_WILDCARD_SSID_LEN);
-- 		break;
-- 	default:
-- 		brcmf_err(" invalid search state %d\n", search_state);
--@@ -687,11 +688,9 @@ static s32 brcmf_p2p_escan(struct brcmf_
-- 	/*
-- 	 * set p2p scan parameters.
-- 	 */
---	p2p_params = (struct brcmf_p2p_scan_le *)memblk;
-- 	p2p_params->type = 'E';
-- 
-- 	/* determine the scan engine parameters */
---	sparams = &p2p_params->eparams.params_le;
-- 	sparams->bss_type = DOT11_BSSTYPE_ANY;
-- 	if (p2p->cfg->active_scan)
-- 		sparams->scan_type = 0;
--@@ -699,9 +698,6 @@ static s32 brcmf_p2p_escan(struct brcmf_
-- 		sparams->scan_type = 1;
-- 
-- 	eth_broadcast_addr(sparams->bssid);
---	if (ssid.SSID_len)
---		memcpy(sparams->ssid_le.SSID, ssid.SSID, ssid.SSID_len);
---	sparams->ssid_le.SSID_len = cpu_to_le32(ssid.SSID_len);
-- 	sparams->home_time = cpu_to_le32(P2PAPI_SCAN_HOME_TIME_MS);
-- 
-- 	/*
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
--@@ -112,7 +112,6 @@ struct afx_hdl {
--  * @int_addr: P2P interface address.
--  * @bss_idx: informate for P2P bss types.
--  * @listen_timer: timer for @WL_P2P_DISC_ST_LISTEN discover state.
--- * @ssid: ssid for P2P GO.
--  * @listen_channel: channel for @WL_P2P_DISC_ST_LISTEN discover state.
--  * @remain_on_channel: contains copy of struct used by cfg80211.
--  * @remain_on_channel_cookie: cookie counter for remain on channel cmd
--@@ -133,7 +132,6 @@ struct brcmf_p2p_info {
-- 	u8 int_addr[ETH_ALEN];
-- 	struct p2p_bss bss_idx[P2PAPI_BSSCFG_MAX];
-- 	struct timer_list listen_timer;
---	struct brcmf_ssid ssid;
-- 	u8 listen_channel;
-- 	struct ieee80211_channel remain_on_channel;
-- 	u32 remain_on_channel_cookie;
-diff --git a/package/kernel/mac80211/patches/376-0002-brcmfmac-Return-actual-error-by-fwil.patch b/package/kernel/mac80211/patches/376-0002-brcmfmac-Return-actual-error-by-fwil.patch
-deleted file mode 100644
-index 8672c18..0000000
---- a/package/kernel/mac80211/patches/376-0002-brcmfmac-Return-actual-error-by-fwil.patch
-+++ /dev/null
-@@ -1,31 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:38 +0100
--Subject: [PATCH] brcmfmac: Return actual error by fwil.
--
--FWIL is always mapping back errors to EBADE. This is not very
--conventient when trying to understand problems by reading logs.
--Some callers print the error code, but that is quite useless
--when the exact error code is not returned. It also makes it
--impossible to differentiate based on error code. This patch
--changes the return of EBADE into the actual error code.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
--@@ -126,7 +126,8 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
-- 
-- 	brcmf_dbg(FIL, "Failed: %s (%d)\n",
-- 		  brcmf_fil_get_errstr((u32)(-err)), err);
---	return -EBADE;
--+
--+	return err;
-- }
-- 
-- s32
-diff --git a/package/kernel/mac80211/patches/376-0003-brcmfmac-Change-error-print-on-wlan0-existence.patch b/package/kernel/mac80211/patches/376-0003-brcmfmac-Change-error-print-on-wlan0-existence.patch
-deleted file mode 100644
-index 1cfab21..0000000
---- a/package/kernel/mac80211/patches/376-0003-brcmfmac-Change-error-print-on-wlan0-existence.patch
-+++ /dev/null
-@@ -1,41 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:39 +0100
--Subject: [PATCH] brcmfmac: Change error print on wlan0 existence.
--
--During initialization of the device, but also on some other
--moments the driver prints an error that the netdev already exists.
--This is a result of the way the driver is initializing the
--firmware and not really an error. The code is not treating it as
--an error either. This error print has resulted in many questions
--by users and is confusing and incorrect. This patch changes the
--error log into a debug info log.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -811,14 +811,15 @@ struct brcmf_if *brcmf_add_if(struct brc
-- 	 * in case we missed the BRCMF_E_IF_DEL event.
-- 	 */
-- 	if (ifp) {
---		brcmf_err("ERROR: netdev:%s already exists\n",
---			  ifp->ndev->name);
-- 		if (ifidx) {
--+			brcmf_err("ERROR: netdev:%s already exists\n",
--+				  ifp->ndev->name);
-- 			netif_stop_queue(ifp->ndev);
-- 			brcmf_net_detach(ifp->ndev);
-- 			drvr->iflist[bsscfgidx] = NULL;
-- 		} else {
---			brcmf_err("ignore IF event\n");
--+			brcmf_dbg(INFO, "netdev:%s ignore IF event\n",
--+				  ifp->ndev->name);
-- 			return ERR_PTR(-EINVAL);
-- 		}
-- 	}
-diff --git a/package/kernel/mac80211/patches/376-0004-brcmfmac-no-retries-on-rxglom-superframe-errors.patch b/package/kernel/mac80211/patches/376-0004-brcmfmac-no-retries-on-rxglom-superframe-errors.patch
-deleted file mode 100644
-index dfc3a98..0000000
---- a/package/kernel/mac80211/patches/376-0004-brcmfmac-no-retries-on-rxglom-superframe-errors.patch
-+++ /dev/null
-@@ -1,76 +0,0 @@
--From: Franky Lin <frankyl@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:40 +0100
--Subject: [PATCH] brcmfmac: no retries on rxglom superframe errors
--
--Aborting the current read attempt on the superframe also removes the
--packet from the pipeline. Retries should not be attempted on the next
--packet since it would not be a superframe(either a superframe descriptor
--or other data packet) and should not be handled by brcmf_sdio_rxglom
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Signed-off-by: Franky Lin <frankyl@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -460,7 +460,6 @@ struct brcmf_sdio {
-- 
-- 	struct sk_buff *glomd;	/* Packet containing glomming descriptor */
-- 	struct sk_buff_head glom; /* Packet list for glommed superframe */
---	uint glomerr;		/* Glom packet read errors */
-- 
-- 	u8 *rxbuf;		/* Buffer for receiving control packets */
-- 	uint rxblen;		/* Allocated length of rxbuf */
--@@ -1654,20 +1653,15 @@ static u8 brcmf_sdio_rxglom(struct brcmf
-- 		sdio_release_host(bus->sdiodev->func[1]);
-- 		bus->sdcnt.f2rxdata++;
-- 
---		/* On failure, kill the superframe, allow a couple retries */
--+		/* On failure, kill the superframe */
-- 		if (errcode < 0) {
-- 			brcmf_err("glom read of %d bytes failed: %d\n",
-- 				  dlen, errcode);
-- 
-- 			sdio_claim_host(bus->sdiodev->func[1]);
---			if (bus->glomerr++ < 3) {
---				brcmf_sdio_rxfail(bus, true, true);
---			} else {
---				bus->glomerr = 0;
---				brcmf_sdio_rxfail(bus, true, false);
---				bus->sdcnt.rxglomfail++;
---				brcmf_sdio_free_glom(bus);
---			}
--+			brcmf_sdio_rxfail(bus, true, false);
--+			bus->sdcnt.rxglomfail++;
--+			brcmf_sdio_free_glom(bus);
-- 			sdio_release_host(bus->sdiodev->func[1]);
-- 			return 0;
-- 		}
--@@ -1708,19 +1702,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
-- 		}
-- 
-- 		if (errcode) {
---			/* Terminate frame on error, request
---				 a couple retries */
--+			/* Terminate frame on error */
-- 			sdio_claim_host(bus->sdiodev->func[1]);
---			if (bus->glomerr++ < 3) {
---				/* Restore superframe header space */
---				skb_push(pfirst, sfdoff);
---				brcmf_sdio_rxfail(bus, true, true);
---			} else {
---				bus->glomerr = 0;
---				brcmf_sdio_rxfail(bus, true, false);
---				bus->sdcnt.rxglomfail++;
---				brcmf_sdio_free_glom(bus);
---			}
--+			brcmf_sdio_rxfail(bus, true, false);
--+			bus->sdcnt.rxglomfail++;
--+			brcmf_sdio_free_glom(bus);
-- 			sdio_release_host(bus->sdiodev->func[1]);
-- 			bus->cur_read.len = 0;
-- 			return 0;
-diff --git a/package/kernel/mac80211/patches/376-0005-brcmfmac-Remove-redundant-parameter-action-from-scan.patch b/package/kernel/mac80211/patches/376-0005-brcmfmac-Remove-redundant-parameter-action-from-scan.patch
-deleted file mode 100644
-index ede1f47..0000000
---- a/package/kernel/mac80211/patches/376-0005-brcmfmac-Remove-redundant-parameter-action-from-scan.patch
-+++ /dev/null
-@@ -1,108 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:41 +0100
--Subject: [PATCH] brcmfmac: Remove redundant parameter action from scan.
--
--ESCAN is always performed using action start scan. No need to
--pass this parameter on to different functions.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -945,7 +945,7 @@ static void brcmf_escan_prep(struct brcm
-- 
-- static s32
-- brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
---		struct cfg80211_scan_request *request, u16 action)
--+		struct cfg80211_scan_request *request)
-- {
-- 	s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
-- 			  offsetof(struct brcmf_escan_params_le, params_le);
--@@ -970,7 +970,7 @@ brcmf_run_escan(struct brcmf_cfg80211_in
-- 	BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
-- 	brcmf_escan_prep(cfg, &params->params_le, request);
-- 	params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
---	params->action = cpu_to_le16(action);
--+	params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
-- 	params->sync_id = cpu_to_le16(0x1234);
-- 
-- 	err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
--@@ -1012,7 +1012,7 @@ brcmf_do_escan(struct brcmf_cfg80211_inf
-- 	results->count = 0;
-- 	results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
-- 
---	err = escan->run(cfg, ifp, request, WL_ESCAN_ACTION_START);
--+	err = escan->run(cfg, ifp, request);
-- 	if (err)
-- 		brcmf_scan_config_mpc(ifp, 1);
-- 	return err;
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--@@ -231,7 +231,7 @@ struct escan_info {
-- 	struct wiphy *wiphy;
-- 	struct brcmf_if *ifp;
-- 	s32 (*run)(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
---		   struct cfg80211_scan_request *request, u16 action);
--+		   struct cfg80211_scan_request *request);
-- };
-- 
-- /**
----- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
--@@ -625,11 +625,10 @@ exit:
--  * @num_chans: number of channels to scan.
--  * @chanspecs: channel parameters for @num_chans channels.
--  * @search_state: P2P discover state to use.
--- * @action: scan action to pass to firmware.
--  * @bss_type: type of P2P bss.
--  */
-- static s32 brcmf_p2p_escan(struct brcmf_p2p_info *p2p, u32 num_chans,
---			   u16 chanspecs[], s32 search_state, u16 action,
--+			   u16 chanspecs[], s32 search_state,
-- 			   enum p2p_bss_type bss_type)
-- {
-- 	s32 ret = 0;
--@@ -738,7 +737,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
-- 
-- 	/* set the escan specific parameters */
-- 	p2p_params->eparams.version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
---	p2p_params->eparams.action =  cpu_to_le16(action);
--+	p2p_params->eparams.action =  cpu_to_le16(WL_ESCAN_ACTION_START);
-- 	p2p_params->eparams.sync_id = cpu_to_le16(0x1234);
-- 	/* perform p2p scan on primary device */
-- 	ret = brcmf_fil_bsscfg_data_set(vif->ifp, "p2p_scan", memblk, memsize);
--@@ -762,8 +761,7 @@ exit:
--  */
-- static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
-- 			       struct brcmf_if *ifp,
---			       struct cfg80211_scan_request *request,
---			       u16 action)
--+			       struct cfg80211_scan_request *request)
-- {
-- 	struct brcmf_p2p_info *p2p = &cfg->p2p;
-- 	s32 err = 0;
--@@ -823,7 +821,7 @@ static s32 brcmf_p2p_run_escan(struct br
-- 			num_nodfs++;
-- 		}
-- 		err = brcmf_p2p_escan(p2p, num_nodfs, chanspecs, search_state,
---				      action, P2PAPI_BSSCFG_DEVICE);
--+				      P2PAPI_BSSCFG_DEVICE);
-- 		kfree(chanspecs);
-- 	}
-- exit:
--@@ -1092,8 +1090,7 @@ static s32 brcmf_p2p_act_frm_search(stru
-- 		default_chan_list[2] = ch.chspec;
-- 	}
-- 	err = brcmf_p2p_escan(p2p, channel_cnt, default_chan_list,
---			      WL_P2P_DISC_ST_SEARCH, WL_ESCAN_ACTION_START,
---			      P2PAPI_BSSCFG_DEVICE);
--+			      WL_P2P_DISC_ST_SEARCH, P2PAPI_BSSCFG_DEVICE);
-- 	kfree(default_chan_list);
-- exit:
-- 	return err;
-diff --git a/package/kernel/mac80211/patches/376-0006-brcmfmac-Cleanup-roaming-configuration.patch b/package/kernel/mac80211/patches/376-0006-brcmfmac-Cleanup-roaming-configuration.patch
-deleted file mode 100644
-index 41b8770..0000000
---- a/package/kernel/mac80211/patches/376-0006-brcmfmac-Cleanup-roaming-configuration.patch
-+++ /dev/null
-@@ -1,180 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:42 +0100
--Subject: [PATCH] brcmfmac: Cleanup roaming configuration.
--
--Put all roaming configuration related code in one place and
--configure timeout based upon roaming setting.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -4755,7 +4755,6 @@ struct brcmf_cfg80211_vif *brcmf_alloc_v
-- 	vif->wdev.iftype = type;
-- 
-- 	vif->pm_block = pm_block;
---	vif->roam_off = -1;
-- 
-- 	brcmf_init_prof(&vif->profile);
-- 
--@@ -5305,35 +5304,33 @@ static void init_vif_event(struct brcmf_
-- 	mutex_init(&event->vif_event_lock);
-- }
-- 
---static s32
---brcmf_dongle_roam(struct brcmf_if *ifp, u32 bcn_timeout)
--+static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
-- {
---	s32 err = 0;
--+	s32 err;
--+	u32 bcn_timeout;
-- 	__le32 roamtrigger[2];
-- 	__le32 roam_delta[2];
-- 
---	/*
---	 * Setup timeout if Beacons are lost and roam is
---	 * off to report link down
---	 */
---	if (brcmf_roamoff) {
---		err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
---		if (err) {
---			brcmf_err("bcn_timeout error (%d)\n", err);
---			goto dongle_rom_out;
---		}
--+	/* Configure beacon timeout value based upon roaming setting */
--+	if (brcmf_roamoff)
--+		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
--+	else
--+		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
--+	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
--+	if (err) {
--+		brcmf_err("bcn_timeout error (%d)\n", err);
--+		goto roam_setup_done;
-- 	}
-- 
---	/*
---	 * Enable/Disable built-in roaming to allow supplicant
---	 * to take care of roaming
--+	/* Enable/Disable built-in roaming to allow supplicant to take care of
--+	 * roaming.
-- 	 */
-- 	brcmf_dbg(INFO, "Internal Roaming = %s\n",
-- 		  brcmf_roamoff ? "Off" : "On");
-- 	err = brcmf_fil_iovar_int_set(ifp, "roam_off", !!(brcmf_roamoff));
-- 	if (err) {
-- 		brcmf_err("roam_off error (%d)\n", err);
---		goto dongle_rom_out;
--+		goto roam_setup_done;
-- 	}
-- 
-- 	roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
--@@ -5342,7 +5339,7 @@ brcmf_dongle_roam(struct brcmf_if *ifp,
-- 				     (void *)roamtrigger, sizeof(roamtrigger));
-- 	if (err) {
-- 		brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
---		goto dongle_rom_out;
--+		goto roam_setup_done;
-- 	}
-- 
-- 	roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
--@@ -5351,10 +5348,10 @@ brcmf_dongle_roam(struct brcmf_if *ifp,
-- 				     (void *)roam_delta, sizeof(roam_delta));
-- 	if (err) {
-- 		brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
---		goto dongle_rom_out;
--+		goto roam_setup_done;
-- 	}
-- 
---dongle_rom_out:
--+roam_setup_done:
-- 	return err;
-- }
-- 
--@@ -6069,7 +6066,7 @@ static s32 brcmf_config_dongle(struct br
-- 	brcmf_dbg(INFO, "power save set to %s\n",
-- 		  (power_mode ? "enabled" : "disabled"));
-- 
---	err = brcmf_dongle_roam(ifp, WL_BEACON_TIMEOUT);
--+	err = brcmf_dongle_roam(ifp);
-- 	if (err)
-- 		goto default_conf_out;
-- 	err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
--@@ -28,7 +28,6 @@
-- #define WL_EXTRA_BUF_MAX		2048
-- #define WL_ROAM_TRIGGER_LEVEL		-75
-- #define WL_ROAM_DELTA			20
---#define WL_BEACON_TIMEOUT		3
-- 
-- #define WL_SCAN_CHANNEL_TIME		40
-- #define WL_SCAN_UNASSOC_TIME		40
--@@ -77,6 +76,9 @@
-- 
-- #define BRCMF_MAX_DEFAULT_KEYS		4
-- 
--+/* beacon loss timeout defaults */
--+#define BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON	2
--+#define BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF	4
-- 
-- /**
--  * enum brcmf_scan_status - scan engine status
--@@ -178,7 +180,6 @@ struct vif_saved_ie {
--  * @ifp: lower layer interface pointer
--  * @wdev: wireless device.
--  * @profile: profile information.
--- * @roam_off: roaming state.
--  * @sme_state: SME state using enum brcmf_vif_status bits.
--  * @pm_block: power-management blocked.
--  * @list: linked list.
--@@ -189,7 +190,6 @@ struct brcmf_cfg80211_vif {
-- 	struct brcmf_if *ifp;
-- 	struct wireless_dev wdev;
-- 	struct brcmf_cfg80211_profile profile;
---	s32 roam_off;
-- 	unsigned long sme_state;
-- 	bool pm_block;
-- 	struct vif_saved_ie saved_ie;
----- a/drivers/net/wireless/brcm80211/brcmfmac/common.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
--@@ -29,7 +29,6 @@
-- 
-- const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-- 
---#define BRCMF_DEFAULT_BCN_TIMEOUT	3
-- #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME	40
-- #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME	40
-- 
--@@ -107,26 +106,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
-- 		goto done;
-- 	}
-- 
---	/*
---	 * Setup timeout if Beacons are lost and roam is off to report
---	 * link down
---	 */
---	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout",
---				      BRCMF_DEFAULT_BCN_TIMEOUT);
---	if (err) {
---		brcmf_err("bcn_timeout error (%d)\n", err);
---		goto done;
---	}
---
---	/* Enable/Disable build-in roaming to allowed ext supplicant to take
---	 * of romaing
---	 */
---	err = brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
---	if (err) {
---		brcmf_err("roam_off error (%d)\n", err);
---		goto done;
---	}
---
-- 	/* Setup join_pref to select target by RSSI(with boost on 5GHz) */
-- 	join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
-- 	join_pref_params[0].len = 2;
-diff --git a/package/kernel/mac80211/patches/376-0007-brcmfmac-Add-beamforming-support.patch b/package/kernel/mac80211/patches/376-0007-brcmfmac-Add-beamforming-support.patch
-deleted file mode 100644
-index 395166b..0000000
---- a/package/kernel/mac80211/patches/376-0007-brcmfmac-Add-beamforming-support.patch
-+++ /dev/null
-@@ -1,115 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:43 +0100
--Subject: [PATCH] brcmfmac: Add beamforming support.
--
--Some devices support beamforming. This patch enables tx beamforming
--if supported and reports beamforming capabilities per channel if
--supported.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -5671,7 +5671,8 @@ static __le16 brcmf_get_mcs_map(u32 ncha
-- }
-- 
-- static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
---				 u32 bw_cap[2], u32 nchain)
--+				 u32 bw_cap[2], u32 nchain, u32 txstreams,
--+				 u32 txbf_bfe_cap, u32 txbf_bfr_cap)
-- {
-- 	__le16 mcs_map;
-- 
--@@ -5690,6 +5691,25 @@ static void brcmf_update_vht_cap(struct
-- 	mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
-- 	band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
-- 	band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
--+
--+	/* Beamforming support information */
--+	if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
--+		band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
--+	if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
--+		band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
--+	if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
--+		band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
--+	if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
--+		band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
--+
--+	if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
--+		band->vht_cap.cap |=
--+			(2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
--+		band->vht_cap.cap |= ((txstreams - 1) <<
--+				IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
--+		band->vht_cap.cap |=
--+			IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
--+	}
-- }
-- 
-- static int brcmf_setup_wiphybands(struct wiphy *wiphy)
--@@ -5704,6 +5724,9 @@ static int brcmf_setup_wiphybands(struct
-- 	int err;
-- 	s32 i;
-- 	struct ieee80211_supported_band *band;
--+	u32 txstreams = 0;
--+	u32 txbf_bfe_cap = 0;
--+	u32 txbf_bfr_cap = 0;
-- 
-- 	(void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
-- 	err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
--@@ -5732,6 +5755,14 @@ static int brcmf_setup_wiphybands(struct
-- 		return err;
-- 	}
-- 
--+	if (vhtmode) {
--+		(void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
--+		(void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
--+					      &txbf_bfe_cap);
--+		(void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
--+					      &txbf_bfr_cap);
--+	}
--+
-- 	wiphy = cfg_to_wiphy(cfg);
-- 	for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
-- 		band = wiphy->bands[i];
--@@ -5741,7 +5772,8 @@ static int brcmf_setup_wiphybands(struct
-- 		if (nmode)
-- 			brcmf_update_ht_cap(band, bw_cap, nchain);
-- 		if (vhtmode)
---			brcmf_update_vht_cap(band, bw_cap, nchain);
--+			brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
--+					     txbf_bfe_cap, txbf_bfr_cap);
-- 	}
-- 
-- 	return 0;
----- a/drivers/net/wireless/brcm80211/brcmfmac/common.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
--@@ -153,6 +153,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
-- 		goto done;
-- 	}
-- 
--+	/* Enable tx beamforming, errors can be ignored (not supported) */
--+	(void)brcmf_fil_iovar_int_set(ifp, "txbf", 1);
--+
-- 	/* do bus specific preinit here */
-- 	err = brcmf_bus_preinit(ifp->drvr->bus_if);
-- done:
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
--@@ -121,6 +121,11 @@
-- 
-- #define BRCMF_MAX_ASSOCLIST		128
-- 
--+#define BRCMF_TXBF_SU_BFE_CAP		BIT(0)
--+#define BRCMF_TXBF_MU_BFE_CAP		BIT(1)
--+#define BRCMF_TXBF_SU_BFR_CAP		BIT(0)
--+#define BRCMF_TXBF_MU_BFR_CAP		BIT(1)
--+
-- /* join preference types for join_pref iovar */
-- enum brcmf_join_pref_types {
-- 	BRCMF_JOIN_PREF_RSSI = 1,
-diff --git a/package/kernel/mac80211/patches/376-0008-brcmfmac-assure-net_ratelimit-is-declared-before-use.patch b/package/kernel/mac80211/patches/376-0008-brcmfmac-assure-net_ratelimit-is-declared-before-use.patch
-deleted file mode 100644
-index d471eb5..0000000
---- a/package/kernel/mac80211/patches/376-0008-brcmfmac-assure-net_ratelimit-is-declared-before-use.patch
-+++ /dev/null
-@@ -1,25 +0,0 @@
--From: Arend van Spriel <arend@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:45 +0100
--Subject: [PATCH] brcmfmac: assure net_ratelimit() is declared before use
--
--Under some kernel configuration we get build issue with implicit
--declaration of net_ratelimit() function. Fix this by explicitly
--including the file providing the prototype.
--
--Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--@@ -17,6 +17,8 @@
-- #ifndef BRCMFMAC_DEBUG_H
-- #define BRCMFMAC_DEBUG_H
-- 
--+#include <linux/net.h>	/* net_ratelimit() */
--+
-- /* message levels */
-- #define BRCMF_TRACE_VAL		0x00000002
-- #define BRCMF_INFO_VAL		0x00000004
-diff --git a/package/kernel/mac80211/patches/376-0009-brcmfmac-Unify-methods-to-define-and-map-firmware-fi.patch b/package/kernel/mac80211/patches/376-0009-brcmfmac-Unify-methods-to-define-and-map-firmware-fi.patch
-deleted file mode 100644
-index 0ec9d10..0000000
---- a/package/kernel/mac80211/patches/376-0009-brcmfmac-Unify-methods-to-define-and-map-firmware-fi.patch
-+++ /dev/null
-@@ -1,664 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:46 +0100
--Subject: [PATCH] brcmfmac: Unify methods to define and map firmware files.
--
--All bus drivers (sdio, usb and pcie) require firmware files which
--needs to be downloaded to the device, The definitions and mapping
--of device id and revision to firmware and nvram file is done by
--each bus driver. This patch creates common functions and defines
--to simplify and unify the definition of these firmware and nvram
--files and mapping.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -27,9 +27,9 @@
-- #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
-- #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
-- 
---char brcmf_firmware_path[BRCMF_FW_PATH_LEN];
--+static char brcmf_firmware_path[BRCMF_FW_NAME_LEN];
-- module_param_string(alternative_fw_path, brcmf_firmware_path,
---		    BRCMF_FW_PATH_LEN, 0440);
--+		    BRCMF_FW_NAME_LEN, 0440);
-- 
-- enum nvram_parser_state {
-- 	IDLE,
--@@ -531,3 +531,43 @@ int brcmf_fw_get_firmwares(struct device
-- 					   0);
-- }
-- 
--+int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
--+			      struct brcmf_firmware_mapping mapping_table[],
--+			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
--+			      char nvram_name[BRCMF_FW_NAME_LEN])
--+{
--+	u32 i;
--+	char end;
--+
--+	for (i = 0; i < table_size; i++) {
--+		if (mapping_table[i].chipid == chip &&
--+		    mapping_table[i].revmask & BIT(chiprev))
--+			break;
--+	}
--+
--+	if (i == table_size) {
--+		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
--+		return -ENODEV;
--+	}
--+
--+	/* check if firmware path is provided by module parameter */
--+	if (brcmf_firmware_path[0] != '\0') {
--+		strlcpy(fw_name, brcmf_firmware_path, BRCMF_FW_NAME_LEN);
--+		if ((nvram_name) && (mapping_table[i].nvram))
--+			strlcpy(nvram_name, brcmf_firmware_path,
--+				BRCMF_FW_NAME_LEN);
--+
--+		end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
--+		if (end != '/') {
--+			strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
--+			if ((nvram_name) && (mapping_table[i].nvram))
--+				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
--+		}
--+	}
--+	strlcat(fw_name, mapping_table[i].fw, BRCMF_FW_NAME_LEN);
--+	if ((nvram_name) && (mapping_table[i].nvram))
--+		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
--+
--+	return 0;
--+}
--+
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.h
--@@ -21,11 +21,51 @@
-- #define BRCMF_FW_REQ_FLAGS		0x00F0
-- #define  BRCMF_FW_REQ_NV_OPTIONAL	0x0010
-- 
---#define	BRCMF_FW_PATH_LEN	256
---#define	BRCMF_FW_NAME_LEN	32
--+#define	BRCMF_FW_NAME_LEN		320
-- 
---extern char brcmf_firmware_path[];
--+#define BRCMF_FW_DEFAULT_PATH		"brcm/"
-- 
--+/**
--+ * struct brcmf_firmware_mapping - Used to map chipid/revmask to firmware
--+ *	filename and nvram filename. Each bus type implementation should create
--+ *	a table of firmware mappings (using the macros defined below).
--+ *
--+ * @chipid: ID of chip.
--+ * @revmask: bitmask of revisions, e.g. 0x10 means rev 4 only, 0xf means rev 0-3
--+ * @fw: name of the firmware file.
--+ * @nvram: name of nvram file.
--+ */
--+struct brcmf_firmware_mapping {
--+	u32 chipid;
--+	u32 revmask;
--+	const char *fw;
--+	const char *nvram;
--+};
--+
--+#define BRCMF_FW_NVRAM_DEF(fw_nvram_name, fw, nvram) \
--+static const char BRCM_ ## fw_nvram_name ## _FIRMWARE_NAME[] = \
--+	BRCMF_FW_DEFAULT_PATH fw; \
--+static const char BRCM_ ## fw_nvram_name ## _NVRAM_NAME[] = \
--+	BRCMF_FW_DEFAULT_PATH nvram; \
--+MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw); \
--+MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH nvram)
--+
--+#define BRCMF_FW_DEF(fw_name, fw) \
--+static const char BRCM_ ## fw_name ## _FIRMWARE_NAME[] = \
--+	BRCMF_FW_DEFAULT_PATH fw; \
--+MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw) \
--+
--+#define BRCMF_FW_NVRAM_ENTRY(chipid, mask, name) \
--+	{ chipid, mask, \
--+	  BRCM_ ## name ## _FIRMWARE_NAME, BRCM_ ## name ## _NVRAM_NAME }
--+
--+#define BRCMF_FW_ENTRY(chipid, mask, name) \
--+	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_NAME, NULL }
--+
--+int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
--+			      struct brcmf_firmware_mapping mapping_table[],
--+			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
--+			      char nvram_name[BRCMF_FW_NAME_LEN]);
-- void brcmf_fw_nvram_free(void *nvram);
-- /*
--  * Request firmware(s) asynchronously. When the asynchronous request
----- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
--@@ -44,25 +44,29 @@ enum brcmf_pcie_state {
-- 	BRCMFMAC_PCIE_STATE_UP
-- };
-- 
---
---#define BRCMF_PCIE_43602_FW_NAME		"brcm/brcmfmac43602-pcie.bin"
---#define BRCMF_PCIE_43602_NVRAM_NAME		"brcm/brcmfmac43602-pcie.txt"
---#define BRCMF_PCIE_4350_FW_NAME			"brcm/brcmfmac4350-pcie.bin"
---#define BRCMF_PCIE_4350_NVRAM_NAME		"brcm/brcmfmac4350-pcie.txt"
---#define BRCMF_PCIE_4356_FW_NAME			"brcm/brcmfmac4356-pcie.bin"
---#define BRCMF_PCIE_4356_NVRAM_NAME		"brcm/brcmfmac4356-pcie.txt"
---#define BRCMF_PCIE_43570_FW_NAME		"brcm/brcmfmac43570-pcie.bin"
---#define BRCMF_PCIE_43570_NVRAM_NAME		"brcm/brcmfmac43570-pcie.txt"
---#define BRCMF_PCIE_4358_FW_NAME			"brcm/brcmfmac4358-pcie.bin"
---#define BRCMF_PCIE_4358_NVRAM_NAME		"brcm/brcmfmac4358-pcie.txt"
---#define BRCMF_PCIE_4359_FW_NAME			"brcm/brcmfmac4359-pcie.bin"
---#define BRCMF_PCIE_4359_NVRAM_NAME		"brcm/brcmfmac4359-pcie.txt"
---#define BRCMF_PCIE_4365_FW_NAME			"brcm/brcmfmac4365b-pcie.bin"
---#define BRCMF_PCIE_4365_NVRAM_NAME		"brcm/brcmfmac4365b-pcie.txt"
---#define BRCMF_PCIE_4366_FW_NAME			"brcm/brcmfmac4366b-pcie.bin"
---#define BRCMF_PCIE_4366_NVRAM_NAME		"brcm/brcmfmac4366b-pcie.txt"
---#define BRCMF_PCIE_4371_FW_NAME			"brcm/brcmfmac4371-pcie.bin"
---#define BRCMF_PCIE_4371_NVRAM_NAME		"brcm/brcmfmac4371-pcie.txt"
--+BRCMF_FW_NVRAM_DEF(43602, "brcmfmac43602-pcie.bin", "brcmfmac43602-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4350, "brcmfmac4350-pcie.bin", "brcmfmac4350-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-pcie.bin", "brcmfmac4356-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(43570, "brcmfmac43570-pcie.bin", "brcmfmac43570-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-pcie.bin", "brcmfmac4358-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
--+BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
--+
--+static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFFFF, 4350),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFFF, 4365B),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFFF, 4366B),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
--+};
-- 
-- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
-- 
--@@ -202,26 +206,6 @@ enum brcmf_pcie_state {
-- #define BRCMF_PCIE_LINK_STATUS_CTRL_ASPM_ENAB	3
-- 
-- 
---MODULE_FIRMWARE(BRCMF_PCIE_43602_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_43602_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4350_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4350_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4356_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4356_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_43570_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_43570_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4358_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4358_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4359_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4359_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4365_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4365_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4366_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4366_NVRAM_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4371_FW_NAME);
---MODULE_FIRMWARE(BRCMF_PCIE_4371_NVRAM_NAME);
---
---
-- struct brcmf_pcie_console {
-- 	u32 base_addr;
-- 	u32 buf_addr;
--@@ -258,8 +242,8 @@ struct brcmf_pciedev_info {
-- 	enum brcmf_pcie_state state;
-- 	bool in_irq;
-- 	struct pci_dev *pdev;
---	char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
---	char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
--+	char fw_name[BRCMF_FW_NAME_LEN];
--+	char nvram_name[BRCMF_FW_NAME_LEN];
-- 	void __iomem *regs;
-- 	void __iomem *tcm;
-- 	u32 tcm_size;
--@@ -1478,84 +1462,6 @@ brcmf_pcie_init_share_ram_info(struct br
-- }
-- 
-- 
---static int brcmf_pcie_get_fwnames(struct brcmf_pciedev_info *devinfo)
---{
---	char *fw_name;
---	char *nvram_name;
---	uint fw_len, nv_len;
---	char end;
---
---	brcmf_dbg(PCIE, "Enter, chip 0x%04x chiprev %d\n", devinfo->ci->chip,
---		  devinfo->ci->chiprev);
---
---	switch (devinfo->ci->chip) {
---	case BRCM_CC_43602_CHIP_ID:
---		fw_name = BRCMF_PCIE_43602_FW_NAME;
---		nvram_name = BRCMF_PCIE_43602_NVRAM_NAME;
---		break;
---	case BRCM_CC_4350_CHIP_ID:
---		fw_name = BRCMF_PCIE_4350_FW_NAME;
---		nvram_name = BRCMF_PCIE_4350_NVRAM_NAME;
---		break;
---	case BRCM_CC_4356_CHIP_ID:
---		fw_name = BRCMF_PCIE_4356_FW_NAME;
---		nvram_name = BRCMF_PCIE_4356_NVRAM_NAME;
---		break;
---	case BRCM_CC_43567_CHIP_ID:
---	case BRCM_CC_43569_CHIP_ID:
---	case BRCM_CC_43570_CHIP_ID:
---		fw_name = BRCMF_PCIE_43570_FW_NAME;
---		nvram_name = BRCMF_PCIE_43570_NVRAM_NAME;
---		break;
---	case BRCM_CC_4358_CHIP_ID:
---		fw_name = BRCMF_PCIE_4358_FW_NAME;
---		nvram_name = BRCMF_PCIE_4358_NVRAM_NAME;
---		break;
---	case BRCM_CC_4359_CHIP_ID:
---		fw_name = BRCMF_PCIE_4359_FW_NAME;
---		nvram_name = BRCMF_PCIE_4359_NVRAM_NAME;
---		break;
---	case BRCM_CC_4365_CHIP_ID:
---		fw_name = BRCMF_PCIE_4365_FW_NAME;
---		nvram_name = BRCMF_PCIE_4365_NVRAM_NAME;
---		break;
---	case BRCM_CC_4366_CHIP_ID:
---		fw_name = BRCMF_PCIE_4366_FW_NAME;
---		nvram_name = BRCMF_PCIE_4366_NVRAM_NAME;
---		break;
---	case BRCM_CC_4371_CHIP_ID:
---		fw_name = BRCMF_PCIE_4371_FW_NAME;
---		nvram_name = BRCMF_PCIE_4371_NVRAM_NAME;
---		break;
---	default:
---		brcmf_err("Unsupported chip 0x%04x\n", devinfo->ci->chip);
---		return -ENODEV;
---	}
---
---	fw_len = sizeof(devinfo->fw_name) - 1;
---	nv_len = sizeof(devinfo->nvram_name) - 1;
---	/* check if firmware path is provided by module parameter */
---	if (brcmf_firmware_path[0] != '\0') {
---		strncpy(devinfo->fw_name, brcmf_firmware_path, fw_len);
---		strncpy(devinfo->nvram_name, brcmf_firmware_path, nv_len);
---		fw_len -= strlen(devinfo->fw_name);
---		nv_len -= strlen(devinfo->nvram_name);
---
---		end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
---		if (end != '/') {
---			strncat(devinfo->fw_name, "/", fw_len);
---			strncat(devinfo->nvram_name, "/", nv_len);
---			fw_len--;
---			nv_len--;
---		}
---	}
---	strncat(devinfo->fw_name, fw_name, fw_len);
---	strncat(devinfo->nvram_name, nvram_name, nv_len);
---
---	return 0;
---}
---
---
-- static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
-- 					const struct firmware *fw, void *nvram,
-- 					u32 nvram_len)
--@@ -1891,7 +1797,10 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
-- 	bus->wowl_supported = pci_pme_capable(pdev, PCI_D3hot);
-- 	dev_set_drvdata(&pdev->dev, bus);
-- 
---	ret = brcmf_pcie_get_fwnames(devinfo);
--+	ret = brcmf_fw_map_chip_to_name(devinfo->ci->chip, devinfo->ci->chiprev,
--+					brcmf_pcie_fwnames,
--+					ARRAY_SIZE(brcmf_pcie_fwnames),
--+					devinfo->fw_name, devinfo->nvram_name);
-- 	if (ret)
-- 		goto fail_bus;
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
--@@ -596,136 +596,41 @@ static const struct sdiod_drive_str sdio
-- 	{4,  0x1}
-- };
-- 
---#define BCM43143_FIRMWARE_NAME		"brcm/brcmfmac43143-sdio.bin"
---#define BCM43143_NVRAM_NAME		"brcm/brcmfmac43143-sdio.txt"
---#define BCM43241B0_FIRMWARE_NAME	"brcm/brcmfmac43241b0-sdio.bin"
---#define BCM43241B0_NVRAM_NAME		"brcm/brcmfmac43241b0-sdio.txt"
---#define BCM43241B4_FIRMWARE_NAME	"brcm/brcmfmac43241b4-sdio.bin"
---#define BCM43241B4_NVRAM_NAME		"brcm/brcmfmac43241b4-sdio.txt"
---#define BCM43241B5_FIRMWARE_NAME	"brcm/brcmfmac43241b5-sdio.bin"
---#define BCM43241B5_NVRAM_NAME		"brcm/brcmfmac43241b5-sdio.txt"
---#define BCM4329_FIRMWARE_NAME		"brcm/brcmfmac4329-sdio.bin"
---#define BCM4329_NVRAM_NAME		"brcm/brcmfmac4329-sdio.txt"
---#define BCM4330_FIRMWARE_NAME		"brcm/brcmfmac4330-sdio.bin"
---#define BCM4330_NVRAM_NAME		"brcm/brcmfmac4330-sdio.txt"
---#define BCM4334_FIRMWARE_NAME		"brcm/brcmfmac4334-sdio.bin"
---#define BCM4334_NVRAM_NAME		"brcm/brcmfmac4334-sdio.txt"
---#define BCM43340_FIRMWARE_NAME		"brcm/brcmfmac43340-sdio.bin"
---#define BCM43340_NVRAM_NAME		"brcm/brcmfmac43340-sdio.txt"
---#define BCM4335_FIRMWARE_NAME		"brcm/brcmfmac4335-sdio.bin"
---#define BCM4335_NVRAM_NAME		"brcm/brcmfmac4335-sdio.txt"
---#define BCM43362_FIRMWARE_NAME		"brcm/brcmfmac43362-sdio.bin"
---#define BCM43362_NVRAM_NAME		"brcm/brcmfmac43362-sdio.txt"
---#define BCM4339_FIRMWARE_NAME		"brcm/brcmfmac4339-sdio.bin"
---#define BCM4339_NVRAM_NAME		"brcm/brcmfmac4339-sdio.txt"
---#define BCM43430_FIRMWARE_NAME		"brcm/brcmfmac43430-sdio.bin"
---#define BCM43430_NVRAM_NAME		"brcm/brcmfmac43430-sdio.txt"
---#define BCM43455_FIRMWARE_NAME		"brcm/brcmfmac43455-sdio.bin"
---#define BCM43455_NVRAM_NAME		"brcm/brcmfmac43455-sdio.txt"
---#define BCM4354_FIRMWARE_NAME		"brcm/brcmfmac4354-sdio.bin"
---#define BCM4354_NVRAM_NAME		"brcm/brcmfmac4354-sdio.txt"
---
---MODULE_FIRMWARE(BCM43143_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43143_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43241B0_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43241B0_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43241B4_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43241B4_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43241B5_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43241B5_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4329_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4329_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43340_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43340_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43430_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43430_NVRAM_NAME);
---MODULE_FIRMWARE(BCM43455_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM43455_NVRAM_NAME);
---MODULE_FIRMWARE(BCM4354_FIRMWARE_NAME);
---MODULE_FIRMWARE(BCM4354_NVRAM_NAME);
---
---struct brcmf_firmware_names {
---	u32 chipid;
---	u32 revmsk;
---	const char *bin;
---	const char *nv;
--+BRCMF_FW_NVRAM_DEF(43143, "brcmfmac43143-sdio.bin", "brcmfmac43143-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43241B0, "brcmfmac43241b0-sdio.bin",
--+		   "brcmfmac43241b0-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43241B4, "brcmfmac43241b4-sdio.bin",
--+		   "brcmfmac43241b4-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43241B5, "brcmfmac43241b5-sdio.bin",
--+		   "brcmfmac43241b5-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(4329, "brcmfmac4329-sdio.bin", "brcmfmac4329-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(4330, "brcmfmac4330-sdio.bin", "brcmfmac4330-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(4334, "brcmfmac4334-sdio.bin", "brcmfmac4334-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340-sdio.bin", "brcmfmac43340-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(4335, "brcmfmac4335-sdio.bin", "brcmfmac4335-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43362, "brcmfmac43362-sdio.bin", "brcmfmac43362-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(4339, "brcmfmac4339-sdio.bin", "brcmfmac4339-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43430, "brcmfmac43430-sdio.bin", "brcmfmac43430-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
--+BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
--+
--+static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFF, 43430),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
--+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354)
-- };
-- 
---enum brcmf_firmware_type {
---	BRCMF_FIRMWARE_BIN,
---	BRCMF_FIRMWARE_NVRAM
---};
---
---#define BRCMF_FIRMWARE_NVRAM(name) \
---	name ## _FIRMWARE_NAME, name ## _NVRAM_NAME
---
---static const struct brcmf_firmware_names brcmf_fwname_data[] = {
---	{ BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43143) },
---	{ BRCM_CC_43241_CHIP_ID, 0x0000001F, BRCMF_FIRMWARE_NVRAM(BCM43241B0) },
---	{ BRCM_CC_43241_CHIP_ID, 0x00000020, BRCMF_FIRMWARE_NVRAM(BCM43241B4) },
---	{ BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, BRCMF_FIRMWARE_NVRAM(BCM43241B5) },
---	{ BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
---	{ BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
---	{ BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
---	{ BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43340) },
---	{ BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
---	{ BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
---	{ BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
---	{ BRCM_CC_43430_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43430) },
---	{ BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, BRCMF_FIRMWARE_NVRAM(BCM43455) },
---	{ BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
---};
---
---static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
---				  struct brcmf_sdio_dev *sdiodev)
---{
---	int i;
---	char end;
---
---	for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
---		if (brcmf_fwname_data[i].chipid == ci->chip &&
---		    brcmf_fwname_data[i].revmsk & BIT(ci->chiprev))
---			break;
---	}
---
---	if (i == ARRAY_SIZE(brcmf_fwname_data)) {
---		brcmf_err("Unknown chipid %d [%d]\n", ci->chip, ci->chiprev);
---		return -ENODEV;
---	}
---
---	/* check if firmware path is provided by module parameter */
---	if (brcmf_firmware_path[0] != '\0') {
---		strlcpy(sdiodev->fw_name, brcmf_firmware_path,
---			sizeof(sdiodev->fw_name));
---		strlcpy(sdiodev->nvram_name, brcmf_firmware_path,
---			sizeof(sdiodev->nvram_name));
---
---		end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
---		if (end != '/') {
---			strlcat(sdiodev->fw_name, "/",
---				sizeof(sdiodev->fw_name));
---			strlcat(sdiodev->nvram_name, "/",
---				sizeof(sdiodev->nvram_name));
---		}
---	}
---	strlcat(sdiodev->fw_name, brcmf_fwname_data[i].bin,
---		sizeof(sdiodev->fw_name));
---	strlcat(sdiodev->nvram_name, brcmf_fwname_data[i].nv,
---		sizeof(sdiodev->nvram_name));
---
---	return 0;
---}
---
-- static void pkt_align(struct sk_buff *p, int len, int align)
-- {
-- 	uint datalign;
--@@ -4252,7 +4157,10 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
-- 	brcmf_sdio_debugfs_create(bus);
-- 	brcmf_dbg(INFO, "completed!!\n");
-- 
---	ret = brcmf_sdio_get_fwnames(bus->ci, sdiodev);
--+	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
--+					brcmf_sdio_fwnames,
--+					ARRAY_SIZE(brcmf_sdio_fwnames),
--+					sdiodev->fw_name, sdiodev->nvram_name);
-- 	if (ret)
-- 		goto fail;
-- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
--@@ -195,8 +195,8 @@ struct brcmf_sdio_dev {
-- 	uint max_segment_size;
-- 	uint txglomsz;
-- 	struct sg_table sgtable;
---	char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
---	char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
--+	char fw_name[BRCMF_FW_NAME_LEN];
--+	char nvram_name[BRCMF_FW_NAME_LEN];
-- 	bool wowl_enabled;
-- 	enum brcmf_sdiod_state state;
-- 	struct brcmf_sdiod_freezer *freezer;
----- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
--@@ -43,10 +43,20 @@
-- #define BRCMF_USB_CBCTL_READ		1
-- #define BRCMF_USB_MAX_PKT_SIZE		1600
-- 
---#define BRCMF_USB_43143_FW_NAME		"brcm/brcmfmac43143.bin"
---#define BRCMF_USB_43236_FW_NAME		"brcm/brcmfmac43236b.bin"
---#define BRCMF_USB_43242_FW_NAME		"brcm/brcmfmac43242a.bin"
---#define BRCMF_USB_43569_FW_NAME		"brcm/brcmfmac43569.bin"
--+BRCMF_FW_DEF(43143, "brcmfmac43143.bin");
--+BRCMF_FW_DEF(43236B, "brcmfmac43236b.bin");
--+BRCMF_FW_DEF(43242A, "brcmfmac43242a.bin");
--+BRCMF_FW_DEF(43569, "brcmfmac43569.bin");
--+
--+static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
--+	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
--+	BRCMF_FW_ENTRY(BRCM_CC_43235_CHIP_ID, 0x00000008, 43236B),
--+	BRCMF_FW_ENTRY(BRCM_CC_43236_CHIP_ID, 0x00000008, 43236B),
--+	BRCMF_FW_ENTRY(BRCM_CC_43238_CHIP_ID, 0x00000008, 43236B),
--+	BRCMF_FW_ENTRY(BRCM_CC_43242_CHIP_ID, 0xFFFFFFFF, 43242A),
--+	BRCMF_FW_ENTRY(BRCM_CC_43566_CHIP_ID, 0xFFFFFFFF, 43569),
--+	BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43569)
--+};
-- 
-- #define TRX_MAGIC		0x30524448	/* "HDR0" */
-- #define TRX_MAX_OFFSET		3		/* Max number of file offsets */
--@@ -139,6 +149,7 @@ struct brcmf_usbdev_info {
-- 	struct brcmf_usbreq *tx_reqs;
-- 	struct brcmf_usbreq *rx_reqs;
-- 
--+	char fw_name[BRCMF_FW_NAME_LEN];
-- 	const u8 *image;	/* buffer for combine fw and nvram */
-- 	int image_len;
-- 
--@@ -983,45 +994,15 @@ static int brcmf_usb_dlrun(struct brcmf_
-- 	return 0;
-- }
-- 
---static bool brcmf_usb_chip_support(int chipid, int chiprev)
---{
---	switch(chipid) {
---	case BRCM_CC_43143_CHIP_ID:
---		return true;
---	case BRCM_CC_43235_CHIP_ID:
---	case BRCM_CC_43236_CHIP_ID:
---	case BRCM_CC_43238_CHIP_ID:
---		return (chiprev == 3);
---	case BRCM_CC_43242_CHIP_ID:
---		return true;
---	case BRCM_CC_43566_CHIP_ID:
---	case BRCM_CC_43569_CHIP_ID:
---		return true;
---	default:
---		break;
---	}
---	return false;
---}
---
-- static int
-- brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
-- {
---	int devid, chiprev;
-- 	int err;
-- 
-- 	brcmf_dbg(USB, "Enter\n");
-- 	if (devinfo == NULL)
-- 		return -ENODEV;
-- 
---	devid = devinfo->bus_pub.devid;
---	chiprev = devinfo->bus_pub.chiprev;
---
---	if (!brcmf_usb_chip_support(devid, chiprev)) {
---		brcmf_err("unsupported chip %d rev %d\n",
---			  devid, chiprev);
---		return -EINVAL;
---	}
---
-- 	if (!devinfo->image) {
-- 		brcmf_err("No firmware!\n");
-- 		return -ENOENT;
--@@ -1071,25 +1052,6 @@ static int check_file(const u8 *headers)
-- 	return -1;
-- }
-- 
---static const char *brcmf_usb_get_fwname(struct brcmf_usbdev_info *devinfo)
---{
---	switch (devinfo->bus_pub.devid) {
---	case BRCM_CC_43143_CHIP_ID:
---		return BRCMF_USB_43143_FW_NAME;
---	case BRCM_CC_43235_CHIP_ID:
---	case BRCM_CC_43236_CHIP_ID:
---	case BRCM_CC_43238_CHIP_ID:
---		return BRCMF_USB_43236_FW_NAME;
---	case BRCM_CC_43242_CHIP_ID:
---		return BRCMF_USB_43242_FW_NAME;
---	case BRCM_CC_43566_CHIP_ID:
---	case BRCM_CC_43569_CHIP_ID:
---		return BRCMF_USB_43569_FW_NAME;
---	default:
---		return NULL;
---	}
---}
---
-- 
-- static
-- struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
--@@ -1274,9 +1236,16 @@ static int brcmf_usb_probe_cb(struct brc
-- 	bus->chip = bus_pub->devid;
-- 	bus->chiprev = bus_pub->chiprev;
-- 
--+	ret = brcmf_fw_map_chip_to_name(bus_pub->devid, bus_pub->chiprev,
--+					brcmf_usb_fwnames,
--+					ARRAY_SIZE(brcmf_usb_fwnames),
--+					devinfo->fw_name, NULL);
--+	if (ret)
--+		goto fail;
--+
-- 	/* request firmware here */
---	ret = brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo),
---				     NULL, brcmf_usb_probe_phase2);
--+	ret = brcmf_fw_get_firmwares(dev, 0, devinfo->fw_name, NULL,
--+				     brcmf_usb_probe_phase2);
-- 	if (ret) {
-- 		brcmf_err("firmware request failed: %d\n", ret);
-- 		goto fail;
--@@ -1472,8 +1441,7 @@ static int brcmf_usb_reset_resume(struct
-- 
-- 	brcmf_dbg(USB, "Enter\n");
-- 
---	return brcmf_fw_get_firmwares(&usb->dev, 0,
---				      brcmf_usb_get_fwname(devinfo), NULL,
--+	return brcmf_fw_get_firmwares(&usb->dev, 0, devinfo->fw_name, NULL,
-- 				      brcmf_usb_probe_phase2);
-- }
-- 
--@@ -1491,10 +1459,6 @@ static struct usb_device_id brcmf_usb_de
-- };
-- 
-- MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
---MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
---MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
---MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
---MODULE_FIRMWARE(BRCMF_USB_43569_FW_NAME);
-- 
-- static struct usb_driver brcmf_usbdrvr = {
-- 	.name = KBUILD_MODNAME,
-diff --git a/package/kernel/mac80211/patches/376-0010-brcmfmac-Fix-double-free-on-exception-at-module-load.patch b/package/kernel/mac80211/patches/376-0010-brcmfmac-Fix-double-free-on-exception-at-module-load.patch
-deleted file mode 100644
-index 2174d09..0000000
---- a/package/kernel/mac80211/patches/376-0010-brcmfmac-Fix-double-free-on-exception-at-module-load.patch
-+++ /dev/null
-@@ -1,22 +0,0 @@
--From: Hante Meuleman <meuleman@broadcom.com>
--Date: Wed, 25 Nov 2015 11:32:47 +0100
--Subject: [PATCH] brcmfmac: Fix double free on exception at module load.
--
--Reviewed-by: Arend Van Spriel <arend@broadcom.com>
--Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
--Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
--Signed-off-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -1083,6 +1083,8 @@ fail:
-- 			brcmf_net_detach(ifp->ndev);
-- 		if (p2p_ifp)
-- 			brcmf_net_detach(p2p_ifp->ndev);
--+		drvr->iflist[0] = NULL;
--+		drvr->iflist[1] = NULL;
-- 		return ret;
-- 	}
-- 	return 0;
-diff --git a/package/kernel/mac80211/patches/377-brcmfmac-only-lock-and-unlock-fws-if-fws-is-not-null.patch b/package/kernel/mac80211/patches/377-brcmfmac-only-lock-and-unlock-fws-if-fws-is-not-null.patch
-deleted file mode 100644
-index 8ec1441..0000000
---- a/package/kernel/mac80211/patches/377-brcmfmac-only-lock-and-unlock-fws-if-fws-is-not-null.patch
-+++ /dev/null
-@@ -1,30 +0,0 @@
--From: Colin Ian King <colin.king@canonical.com>
--Date: Wed, 2 Dec 2015 11:45:10 +0000
--Subject: [PATCH] brcmfmac: only lock and unlock fws if fws is not null
--
--There is a null ptr check for fws to set bcmc_credit_check, however,
--there a lock and unlock on fws should only performed if fwts is
--also not null to also avoid a potential null pointer deference.
--
--Signed-off-by: Colin Ian King <colin.king@canonical.com>
--Acked-by: Arend van Spriel <arend@broadcom.com>
--Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
--@@ -1609,10 +1609,11 @@ static int brcmf_fws_notify_bcmc_credit_
-- {
-- 	struct brcmf_fws_info *fws = ifp->drvr->fws;
-- 
---	brcmf_fws_lock(fws);
---	if (fws)
--+	if (fws) {
--+		brcmf_fws_lock(fws);
-- 		fws->bcmc_credit_check = true;
---	brcmf_fws_unlock(fws);
--+		brcmf_fws_unlock(fws);
--+	}
-- 	return 0;
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/400-ath_move_debug_code.patch b/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
-index 298f722..72e9a41 100644
---- a/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
-+++ b/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
-@@ -14,7 +14,7 @@
-  ccflags-y += -D__CHECK_ENDIAN__
- --- a/drivers/net/wireless/ath/ath.h
- +++ b/drivers/net/wireless/ath/ath.h
--@@ -316,13 +316,6 @@ void _ath_dbg(struct ath_common *common,
-+@@ -318,13 +318,6 @@ void _ath_dbg(struct ath_common *common,
-  #endif /* CPTCFG_ATH_DEBUG */
-  
-  /** Returns string describing opmode, or NULL if unknown mode. */
-diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
-index 2dac505..7351353 100644
---- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
-+++ b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
-@@ -47,9 +47,9 @@
-  
- --- a/drivers/net/wireless/ath/Kconfig
- +++ b/drivers/net/wireless/ath/Kconfig
--@@ -22,6 +22,9 @@ menuconfig ATH_CARDS
-+@@ -23,6 +23,9 @@ config WLAN_VENDOR_ATH
-  
-- if ATH_CARDS
-+ if WLAN_VENDOR_ATH
-  
- +config ATH_USER_REGD
- +	bool "Do not enforce EEPROM regulatory restrictions"
-@@ -59,9 +59,9 @@
-  	---help---
- --- a/.local-symbols
- +++ b/.local-symbols
--@@ -89,6 +89,7 @@ RTL8187_LEDS=
-+@@ -125,6 +125,7 @@ ADM8211=
-  ATH_COMMON=
-- ATH_CARDS=
-+ WLAN_VENDOR_ATH=
-  ATH_DEBUG=
- +ATH_USER_REGD=
-  ATH_TRACEPOINTS=
-diff --git a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
-index 1476953..1ef5545 100644
---- a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
-+++ b/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
-@@ -1,6 +1,6 @@
- --- a/net/wireless/reg.c
- +++ b/net/wireless/reg.c
--@@ -2368,6 +2368,8 @@ void regulatory_hint_country_ie(struct w
-+@@ -2411,6 +2411,8 @@ void regulatory_hint_country_ie(struct w
-  	enum environment_cap env = ENVIRON_ANY;
-  	struct regulatory_request *request = NULL, *lr;
-  
-@@ -9,11 +9,11 @@
-  	/* IE len must be evenly divisible by 2 */
-  	if (country_ie_len & 0x01)
-  		return;
--@@ -2571,6 +2573,7 @@ static void restore_regulatory_settings(
-+@@ -2617,6 +2619,7 @@ static void restore_regulatory_settings(
-  
-  void regulatory_hint_disconnect(void)
-  {
- +	return;
-- 	REG_DBG_PRINT("All devices are disconnected, going to restore regulatory settings\n");
-+ 	pr_debug("All devices are disconnected, going to restore regulatory settings\n");
-  	restore_regulatory_settings(false);
-  }
-diff --git a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
-index 93760f9..1a62484 100644
---- a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
-+++ b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/init.c
- +++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -715,6 +715,7 @@ static const struct ieee80211_iface_limi
-+@@ -722,6 +722,7 @@ static const struct ieee80211_iface_limi
-  				 BIT(NL80211_IFTYPE_AP) },
-  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
-  				 BIT(NL80211_IFTYPE_P2P_GO) },
-diff --git a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
-index aa521d2..924b62e 100644
---- a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
-+++ b/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
-@@ -121,7 +121,7 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
-  	debugfs_create_file("antenna", S_IWUSR | S_IRUSR, phydir, ah,
- --- a/drivers/net/wireless/ath/ath5k/ath5k.h
- +++ b/drivers/net/wireless/ath/ath5k/ath5k.h
--@@ -1371,6 +1371,7 @@ struct ath5k_hw {
-+@@ -1372,6 +1372,7 @@ struct ath5k_hw {
-  	u8			ah_coverage_class;
-  	bool			ah_ack_bitrate_high;
-  	u8			ah_bwmode;
-diff --git a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
-index ed2cfee..d2a3b96 100644
---- a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
-+++ b/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/hw.c
- +++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -389,13 +389,8 @@ static void ath9k_hw_init_config(struct
-+@@ -390,13 +390,8 @@ static void ath9k_hw_init_config(struct
-  
-  	ah->config.rx_intr_mitigation = true;
-  
-@@ -14,5 +14,5 @@
- +	ah->config.rimt_last = 250;
- +	ah->config.rimt_first = 500;
-  
-- 	/*
-- 	 * We need this for PCI devices only (Cardbus, PCI, miniPCI)
-+ 	if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
-+ 		ah->config.pll_pwrsave = 7;
-diff --git a/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch b/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
-index d4104f0..6766111 100644
---- a/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
-+++ b/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/ath9k.h
- +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
--@@ -87,7 +87,7 @@ int ath_descdma_setup(struct ath_softc *
-+@@ -88,7 +88,7 @@ int ath_descdma_setup(struct ath_softc *
-  		(_l) &= ((_sz) - 1);		\
-  	} while (0)
-  
-diff --git a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
-index 40b5c81..c84d1bc 100644
---- a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
-+++ b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/hw.c
- +++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -647,6 +647,7 @@ int ath9k_hw_init(struct ath_hw *ah)
-+@@ -651,6 +651,7 @@ int ath9k_hw_init(struct ath_hw *ah)
-  
-  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
-  	switch (ah->hw_version.devid) {
-diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
-index 0c50a0b..e151a12 100644
---- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
-+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
-@@ -1,6 +1,6 @@
- --- a/include/net/cfg80211.h
- +++ b/include/net/cfg80211.h
--@@ -2320,6 +2320,7 @@ struct cfg80211_qos_map {
-+@@ -2363,6 +2363,7 @@ struct cfg80211_qos_map {
-   *	(as advertised by the nl80211 feature flag.)
-   * @get_tx_power: store the current TX power into the dbm variable;
-   *	return 0 if successful
-@@ -8,7 +8,7 @@
-   *
-   * @set_wds_peer: set the WDS peer for a WDS interface
-   *
--@@ -2576,6 +2577,7 @@ struct cfg80211_ops {
-+@@ -2624,6 +2625,7 @@ struct cfg80211_ops {
-  				enum nl80211_tx_power_setting type, int mbm);
-  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
-  				int *dbm);
-@@ -18,7 +18,7 @@
-  				const u8 *addr);
- --- a/include/net/mac80211.h
- +++ b/include/net/mac80211.h
--@@ -1171,6 +1171,7 @@ enum ieee80211_smps_mode {
-+@@ -1286,6 +1286,7 @@ enum ieee80211_smps_mode {
-   *
-   * @power_level: requested transmit power (in dBm), backward compatibility
-   *	value only that is set to the minimum of all interfaces
-@@ -26,19 +26,19 @@
-   *
-   * @chandef: the channel definition to tune to
-   * @radar_enabled: whether radar detection is enabled
--@@ -1192,6 +1193,7 @@ struct ieee80211_conf {
-+@@ -1306,6 +1307,7 @@ enum ieee80211_smps_mode {
-+ struct ieee80211_conf {
-  	u32 flags;
-  	int power_level, dynamic_ps_timeout;
-- 	int max_sleep_period;
- +	int max_antenna_gain;
-  
-  	u16 listen_interval;
-  	u8 ps_dtim_period;
- --- a/include/uapi/linux/nl80211.h
- +++ b/include/uapi/linux/nl80211.h
--@@ -1760,6 +1760,9 @@ enum nl80211_commands {
--  * @NL80211_ATTR_REG_INDOOR: flag attribute, if set indicates that the device
--  *      is operating in an indoor environment.
-+@@ -1790,6 +1790,9 @@ enum nl80211_commands {
-+  *	between scans. The scan plans are executed sequentially.
-+  *	Each scan plan is a nested attribute of &enum nl80211_sched_scan_plan.
-   *
- + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
- + *	transmit power to stay within regulatory limits. u32, dBi.
-@@ -46,9 +46,9 @@
-   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-   * @NL80211_ATTR_MAX: highest attribute number currently defined
-   * @__NL80211_ATTR_AFTER_LAST: internal use
--@@ -2129,6 +2132,8 @@ enum nl80211_attrs {
-- 
-- 	NL80211_ATTR_REG_INDOOR,
-+@@ -2164,6 +2167,8 @@ enum nl80211_attrs {
-+ 	NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
-+ 	NL80211_ATTR_SCHED_SCAN_PLANS,
-  
- +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- +
-@@ -57,7 +57,7 @@
-  	__NL80211_ATTR_AFTER_LAST,
- --- a/net/mac80211/cfg.c
- +++ b/net/mac80211/cfg.c
--@@ -2208,6 +2208,19 @@ static int ieee80211_get_tx_power(struct
-+@@ -2229,6 +2229,19 @@ static int ieee80211_get_tx_power(struct
-  	return 0;
-  }
-  
-@@ -77,7 +77,7 @@
-  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
-  				  const u8 *addr)
-  {
--@@ -3771,6 +3784,7 @@ const struct cfg80211_ops mac80211_confi
-+@@ -3403,6 +3416,7 @@ const struct cfg80211_ops mac80211_confi
-  	.set_wiphy_params = ieee80211_set_wiphy_params,
-  	.set_tx_power = ieee80211_set_tx_power,
-  	.get_tx_power = ieee80211_get_tx_power,
-@@ -87,7 +87,7 @@
-  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
- --- a/net/mac80211/ieee80211_i.h
- +++ b/net/mac80211/ieee80211_i.h
--@@ -1333,6 +1333,7 @@ struct ieee80211_local {
-+@@ -1318,6 +1318,7 @@ struct ieee80211_local {
-  	int dynamic_ps_forced_timeout;
-  
-  	int user_power_level; /* in dBm, for all interfaces */
-@@ -97,7 +97,7 @@
-  
- --- a/net/mac80211/main.c
- +++ b/net/mac80211/main.c
--@@ -98,7 +98,7 @@ static u32 ieee80211_hw_conf_chan(struct
-+@@ -93,7 +93,7 @@ static u32 ieee80211_hw_conf_chan(struct
-  	struct ieee80211_sub_if_data *sdata;
-  	struct cfg80211_chan_def chandef = {};
-  	u32 changed = 0;
-@@ -106,7 +106,7 @@
-  	u32 offchannel_flag;
-  
-  	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
--@@ -155,6 +155,12 @@ static u32 ieee80211_hw_conf_chan(struct
-+@@ -150,6 +150,12 @@ static u32 ieee80211_hw_conf_chan(struct
-  	}
-  	rcu_read_unlock();
-  
-@@ -119,7 +119,7 @@
-  	if (local->hw.conf.power_level != power) {
-  		changed |= IEEE80211_CONF_CHANGE_POWER;
-  		local->hw.conf.power_level = power;
--@@ -578,6 +584,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
-+@@ -586,6 +592,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
-  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
-  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
-  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
-@@ -129,7 +129,7 @@
-  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
- --- a/net/wireless/nl80211.c
- +++ b/net/wireless/nl80211.c
--@@ -400,6 +400,7 @@ static const struct nla_policy nl80211_p
-+@@ -403,6 +403,7 @@ static const struct nla_policy nl80211_p
-  	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
-  	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
-  	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
-@@ -137,7 +137,7 @@
-  };
-  
-  /* policy for the key attributes */
--@@ -2206,6 +2207,20 @@ static int nl80211_set_wiphy(struct sk_b
-+@@ -2220,6 +2221,20 @@ static int nl80211_set_wiphy(struct sk_b
-  		if (result)
-  			return result;
-  	}
-diff --git a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
-index 7512811..5a5e464 100644
---- a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
-+++ b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
-@@ -24,7 +24,7 @@
-  struct ath_softc {
-  	struct ieee80211_hw *hw;
-  	struct device *dev;
--@@ -1004,9 +1014,8 @@ struct ath_softc {
-+@@ -1005,9 +1015,8 @@ struct ath_softc {
-  	spinlock_t chan_lock;
-  
-  #ifdef CPTCFG_MAC80211_LEDS
-@@ -54,7 +54,8 @@
- +			  (brightness != LED_OFF) ^ led->gpio->active_low);
- +	ath9k_ps_restore(sc);
- +}
--+
-+ 
-+-	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
- +static int ath_add_led(struct ath_softc *sc, struct ath_led *led)
- +{
- +	const struct gpio_led *gpio = led->gpio;
-@@ -63,8 +64,7 @@
- +	led->cdev.name = gpio->name;
- +	led->cdev.default_trigger = gpio->default_trigger;
- +	led->cdev.brightness_set = ath_led_brightness;
-- 
---	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
-++
- +	ret = led_classdev_register(wiphy_dev(sc->hw->wiphy), &led->cdev);
- +	if (ret < 0)
- +		return ret;
-@@ -159,7 +159,7 @@
- +		trigger = ieee80211_get_radio_led_name(sc->hw);
-  
- -	sc->led_registered = true;
--+	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, 1);
-++	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
-  }
-  
-  void ath_fill_led_pin(struct ath_softc *sc)
-diff --git a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
-index dc33cd0..7c10ea6 100644
---- a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
-+++ b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
-@@ -59,7 +59,7 @@
- @@ -120,6 +141,12 @@ void ath_init_leds(struct ath_softc *sc)
-  		trigger = ieee80211_get_radio_led_name(sc->hw);
-  
-- 	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, 1);
-+ 	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
- +
- +	if (!pdata)
- +		return;
-diff --git a/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
-new file mode 100644
-index 0000000..6d62a2b
---- /dev/null
-+++ b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
-@@ -0,0 +1,20 @@
-+--- a/include/linux/ath9k_platform.h
-++++ b/include/linux/ath9k_platform.h
-+@@ -36,6 +36,7 @@ struct ath9k_platform_data {
-+ 	bool tx_gain_buffalo;
-+ 	bool disable_2ghz;
-+ 	bool disable_5ghz;
-++	bool led_active_high;
-+ 
-+ 	int (*get_mac_revision)(void);
-+ 	int (*external_reset)(void);
-+--- a/drivers/net/wireless/ath/ath9k/init.c
-++++ b/drivers/net/wireless/ath/ath9k/init.c
-+@@ -577,6 +577,7 @@ static int ath9k_init_softc(u16 devid, s
-+ 		ah->external_reset = pdata->external_reset;
-+ 		ah->disable_2ghz = pdata->disable_2ghz;
-+ 		ah->disable_5ghz = pdata->disable_5ghz;
-++		ah->config.led_active_high = pdata->led_active_high;
-+ 		if (!pdata->endian_check)
-+ 			ah->ah_flags |= AH_NO_EEP_SWAP;
-+ 	}
-diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
-index 08c5a0f..e83c6bf 100644
---- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
-+++ b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
-@@ -62,7 +62,7 @@
-  	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
- --- a/drivers/net/wireless/ath/ath9k/hw.h
- +++ b/drivers/net/wireless/ath/ath9k/hw.h
--@@ -513,6 +513,12 @@ enum {
-+@@ -519,6 +519,12 @@ enum {
-  	ATH9K_RESET_COLD,
-  };
-  
-@@ -75,7 +75,7 @@
-  struct ath9k_hw_version {
-  	u32 magic;
-  	u16 devid;
--@@ -794,6 +800,8 @@ struct ath_hw {
-+@@ -804,6 +810,8 @@ struct ath_hw {
-  	u32 rfkill_polarity;
-  	u32 ah_flags;
-  
-@@ -84,7 +84,7 @@
-  	bool reset_power_on;
-  	bool htc_reset_init;
-  
--@@ -1055,6 +1063,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
-+@@ -1066,6 +1074,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
-  bool ath9k_hw_check_alive(struct ath_hw *ah);
-  
-  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
-@@ -94,7 +94,7 @@
-  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
- --- a/drivers/net/wireless/ath/ath9k/hw.c
- +++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -1804,6 +1804,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
-+@@ -1819,6 +1819,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
-  }
-  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
-  
-@@ -115,7 +115,7 @@
-  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
-  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
-  {
--@@ -2012,6 +2026,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-+@@ -2027,6 +2041,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-  		ar9003_hw_disable_phy_restart(ah);
-  
-  	ath9k_hw_apply_gpio_override(ah);
-diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
-index 8c9b34c..d7bb5a1 100644
---- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
-+++ b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/hw.h
- +++ b/drivers/net/wireless/ath/ath9k/hw.h
--@@ -710,6 +710,7 @@ struct ath_spec_scan {
-+@@ -720,6 +720,7 @@ struct ath_spec_scan {
-   * @config_pci_powersave:
-   * @calibrate: periodic calibration for NF, ANI, IQ, ADC gain, ADC-DC
-   *
-@@ -8,7 +8,7 @@
-   * @spectral_scan_config: set parameters for spectral scan and enable/disable it
-   * @spectral_scan_trigger: trigger a spectral scan run
-   * @spectral_scan_wait: wait for a spectral scan run to finish
--@@ -732,6 +733,7 @@ struct ath_hw_ops {
-+@@ -742,6 +743,7 @@ struct ath_hw_ops {
-  			struct ath_hw_antcomb_conf *antconf);
-  	void (*antdiv_comb_conf_set)(struct ath_hw *ah,
-  			struct ath_hw_antcomb_conf *antconf);
-@@ -18,7 +18,7 @@
-  	void (*spectral_scan_trigger)(struct ath_hw *ah);
- --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
- +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
--@@ -1999,6 +1999,26 @@ void ar9003_hw_init_rate_txpower(struct
-+@@ -1998,6 +1998,26 @@ void ar9003_hw_init_rate_txpower(struct
-  	}
-  }
-  
-@@ -45,7 +45,7 @@
-  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
-  {
-  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
--@@ -2035,6 +2055,7 @@ void ar9003_hw_attach_phy_ops(struct ath
-+@@ -2034,6 +2054,7 @@ void ar9003_hw_attach_phy_ops(struct ath
-  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
-  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
-  
-@@ -55,7 +55,7 @@
-  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
- --- a/drivers/net/wireless/ath/ath9k/init.c
- +++ b/drivers/net/wireless/ath/ath9k/init.c
--@@ -703,7 +703,8 @@ static void ath9k_init_txpower_limits(st
-+@@ -711,7 +711,8 @@ static void ath9k_init_txpower_limits(st
-  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
-  		ath9k_init_band_txpower(sc, IEEE80211_BAND_5GHZ);
-  
-@@ -65,7 +65,7 @@
-  }
-  
-  static const struct ieee80211_iface_limit if_limits[] = {
--@@ -896,6 +897,18 @@ static void ath9k_set_hw_capab(struct at
-+@@ -897,6 +898,18 @@ static void ath9k_set_hw_capab(struct at
-  	SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
-  }
-  
-@@ -84,7 +84,7 @@
-  int ath9k_init_device(u16 devid, struct ath_softc *sc,
-  		    const struct ath_bus_ops *bus_ops)
-  {
--@@ -941,6 +954,8 @@ int ath9k_init_device(u16 devid, struct
-+@@ -942,6 +955,8 @@ int ath9k_init_device(u16 devid, struct
-  		ARRAY_SIZE(ath9k_tpt_blink));
-  #endif
-  
-@@ -110,7 +110,7 @@
-  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
- --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
- +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
--@@ -1316,9 +1316,30 @@ void ar5008_hw_init_rate_txpower(struct
-+@@ -1327,9 +1327,30 @@ void ar5008_hw_init_rate_txpower(struct
-  	}
-  }
-  
-@@ -141,7 +141,7 @@
-  	static const u32 ar5416_cca_regs[6] = {
-  		AR_PHY_CCA,
-  		AR_PHY_CH1_CCA,
--@@ -1333,6 +1354,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
-+@@ -1344,6 +1365,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
-  	if (ret)
-  	    return ret;
-  
-diff --git a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
-index 240b898..8768c5d 100644
---- a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
-+++ b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/hw.c
- +++ b/drivers/net/wireless/ath/ath9k/hw.c
--@@ -245,6 +245,19 @@ void ath9k_hw_get_channel_centers(struct
-+@@ -246,6 +246,19 @@ void ath9k_hw_get_channel_centers(struct
-  		centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
-  }
-  
-@@ -20,7 +20,7 @@
-  /******************/
-  /* Chip Revisions */
-  /******************/
--@@ -1382,6 +1395,9 @@ static bool ath9k_hw_set_reset(struct at
-+@@ -1397,6 +1410,9 @@ static bool ath9k_hw_set_reset(struct at
-  	if (AR_SREV_9100(ah))
-  		udelay(50);
-  
-@@ -30,7 +30,7 @@
-  	return true;
-  }
-  
--@@ -1481,6 +1497,9 @@ static bool ath9k_hw_chip_reset(struct a
-+@@ -1496,6 +1512,9 @@ static bool ath9k_hw_chip_reset(struct a
-  		ar9003_hw_internal_regulator_apply(ah);
-  	ath9k_hw_init_pll(ah, chan);
-  
-@@ -40,7 +40,7 @@
-  	return true;
-  }
-  
--@@ -1782,8 +1801,14 @@ static int ath9k_hw_do_fastcc(struct ath
-+@@ -1797,8 +1816,14 @@ static int ath9k_hw_do_fastcc(struct ath
-  	if (AR_SREV_9271(ah))
-  		ar9002_hw_load_ani_reg(ah, chan);
-  
-@@ -55,7 +55,7 @@
-  	return -EINVAL;
-  }
-  
--@@ -2037,6 +2062,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-+@@ -2052,6 +2077,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
-  		ath9k_hw_set_radar_params(ah);
-  	}
-  
-diff --git a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
-index 9610372..3d24ccd 100644
---- a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
-+++ b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
- +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
--@@ -945,55 +945,6 @@ static bool ar5008_hw_ani_control_new(st
-+@@ -956,55 +956,6 @@ static bool ar5008_hw_ani_control_new(st
-  		 * on == 0 means more noise imm
-  		 */
-  		u32 on = param ? 1 : 0;
-@@ -79,7 +79,7 @@
-  static const u8 ofdm2pwr[] = {
-  	ALL_TARGET_LEGACY_6_24,
-  	ALL_TARGET_LEGACY_6_24,
--@@ -1090,11 +1076,6 @@ static bool ar9003_hw_ani_control(struct
-+@@ -1089,11 +1075,6 @@ static bool ar9003_hw_ani_control(struct
-  	struct ath_common *common = ath9k_hw_common(ah);
-  	struct ath9k_channel *chan = ah->curchan;
-  	struct ar5416AniState *aniState = &ah->ani;
-@@ -91,7 +91,7 @@
-  	s32 value, value2;
-  
-  	switch (cmd & ah->ani_function) {
--@@ -1108,61 +1089,6 @@ static bool ar9003_hw_ani_control(struct
-+@@ -1107,61 +1088,6 @@ static bool ar9003_hw_ani_control(struct
-  		 */
-  		u32 on = param ? 1 : 0;
-  
-diff --git a/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch b/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch
-index c0dc4fe..bd81555 100644
---- a/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch
-+++ b/package/kernel/mac80211/patches/600-0001-rt2x00-rt2800lib-move-rt2800_drv_data-declaration-in.patch
-@@ -16,36 +16,18 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
- Changes since v1: ---
- ---
-- drivers/net/wireless/rt2x00/rt2800.h    |   13 -------------
-- drivers/net/wireless/rt2x00/rt2800lib.h |   11 +++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   13 -------------
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.h |   11 +++++++++++
-  2 files changed, 11 insertions(+), 13 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
--@@ -2960,17 +2960,4 @@ enum rt2800_eeprom_word {
--  */
-- #define BCN_TBTT_OFFSET 64
-- 
---/*
--- * RT2800 driver data structure
--- */
---struct rt2800_drv_data {
---	u8 calibration_bw20;
---	u8 calibration_bw40;
---	u8 bbp25;
---	u8 bbp26;
---	u8 txmixer_gain_24g;
---	u8 txmixer_gain_5g;
---	unsigned int tbtt_tick;
---};
---
-- #endif /* RT2800_H */
----- a/drivers/net/wireless/rt2x00/rt2800lib.h
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
--@@ -20,6 +20,17 @@
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+@@ -20,6 +20,20 @@
-  #ifndef RT2800LIB_H
-  #define RT2800LIB_H
-  
-++#include "rt2800.h"
-++
- +/* RT2800 driver data structure */
- +struct rt2800_drv_data {
- +	u8 calibration_bw20;
-@@ -55,8 +37,30 @@ Changes since v1: ---
- +	u8 txmixer_gain_24g;
- +	u8 txmixer_gain_5g;
- +	unsigned int tbtt_tick;
-++	DECLARE_BITMAP(sta_ids, STA_IDS_SIZE);
- +};
- +
-  struct rt2800_ops {
-  	void (*register_read)(struct rt2x00_dev *rt2x00dev,
-  			      const unsigned int offset, u32 *value);
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-+@@ -2969,18 +2969,4 @@ enum rt2800_eeprom_word {
-+ #define WCID_END	222
-+ #define STA_IDS_SIZE	(WCID_END - WCID_START + 2)
-+ 
-+-/*
-+- * RT2800 driver data structure
-+- */
-+-struct rt2800_drv_data {
-+-	u8 calibration_bw20;
-+-	u8 calibration_bw40;
-+-	u8 bbp25;
-+-	u8 bbp26;
-+-	u8 txmixer_gain_24g;
-+-	u8 txmixer_gain_5g;
-+-	unsigned int tbtt_tick;
-+-	DECLARE_BITMAP(sta_ids, STA_IDS_SIZE);
-+-};
-+-
-+ #endif /* RT2800_H */
-diff --git a/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch b/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
-index 6bad6ac..8245909 100644
---- a/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
-+++ b/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
-@@ -18,13 +18,13 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- Changes since v1:
-   - don't enable the new flag for RT3071 and RT5592
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    4 ++++
-- drivers/net/wireless/rt2x00/rt2800lib.h |   13 +++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    4 ++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.h |   13 +++++++++++++
-  2 files changed, 17 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7747,6 +7747,7 @@ static int rt2800_probe_rt(struct rt2x00
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7722,6 +7722,7 @@ static int rt2800_probe_rt(struct rt2x00
-  
-  int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
-  {
-@@ -32,7 +32,7 @@ Changes since v1:
-  	int retval;
-  	u32 reg;
-  
--@@ -7754,6 +7755,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7729,6 +7730,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	if (retval)
-  		return retval;
-  
-@@ -42,11 +42,11 @@ Changes since v1:
-  	/*
-  	 * Allocate eeprom data.
-  	 */
----- a/drivers/net/wireless/rt2x00/rt2800lib.h
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
--@@ -20,6 +20,10 @@
-- #ifndef RT2800LIB_H
-- #define RT2800LIB_H
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+@@ -22,6 +22,10 @@
-+ 
-+ #include "rt2800.h"
-  
- +enum rt2800_flag {
- +	RT2800_HAS_HIGH_SHARED_MEM,
-@@ -55,16 +55,16 @@ Changes since v1:
-  /* RT2800 driver data structure */
-  struct rt2800_drv_data {
-  	u8 calibration_bw20;
--@@ -29,6 +33,8 @@ struct rt2800_drv_data {
-- 	u8 txmixer_gain_24g;
-+@@ -32,6 +36,8 @@ struct rt2800_drv_data {
-  	u8 txmixer_gain_5g;
-  	unsigned int tbtt_tick;
-+ 	DECLARE_BITMAP(sta_ids, STA_IDS_SIZE);
- +
- +	unsigned long rt2800_flags;
-  };
-  
-  struct rt2800_ops {
--@@ -61,6 +67,13 @@ struct rt2800_ops {
-+@@ -64,6 +70,13 @@ struct rt2800_ops {
-  	__le32 *(*drv_get_txwi)(struct queue_entry *entry);
-  };
-  
-diff --git a/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch b/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
-index 9f8dfcc..7abfcd1 100644
---- a/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
-+++ b/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
-@@ -17,17 +17,17 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
- Changes since v1: ---
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c  |   55 +++++++++++++++++++++++++++++-
-- drivers/net/wireless/rt2x00/rt2800lib.h  |   32 +++++++++++++++++
-- drivers/net/wireless/rt2x00/rt2800mmio.c |   26 ++++++++++++++
-- drivers/net/wireless/rt2x00/rt2800mmio.h |    4 +++
-- drivers/net/wireless/rt2x00/rt2800pci.c  |   14 ++++++++
-- drivers/net/wireless/rt2x00/rt2800soc.c  |    3 ++
-- drivers/net/wireless/rt2x00/rt2800usb.c  |   31 +++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c  |   55 +++++++++++++++++++++++++++++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.h  |   32 +++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   26 ++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.h |    4 +++
-+ drivers/net/wireless/ralink/rt2x00/rt2800pci.c  |   14 ++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800soc.c  |    3 ++
-+ drivers/net/wireless/ralink/rt2x00/rt2800usb.c  |   31 +++++++++++++++++
-  7 files changed, 164 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -451,11 +451,13 @@ void rt2800_mcu_request(struct rt2x00_de
-  		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
-  		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
-@@ -175,7 +175,7 @@ Changes since v1: ---
-  
-  	/*
-  	 * Update WCID information
--@@ -1437,8 +1467,11 @@ int rt2800_config_pairwise_key(struct rt
-+@@ -1405,8 +1435,11 @@ int rt2800_config_pairwise_key(struct rt
-  		       sizeof(key_entry.rx_mic));
-  
-  		offset = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
-@@ -187,7 +187,7 @@ Changes since v1: ---
-  	}
-  
-  	/*
--@@ -4908,14 +4941,19 @@ static int rt2800_init_registers(struct
-+@@ -4885,14 +4918,19 @@ static int rt2800_init_registers(struct
-  	/*
-  	 * ASIC will keep garbage value after boot, clear encryption keys.
-  	 */
-@@ -207,7 +207,7 @@ Changes since v1: ---
-  	}
-  
-  	/*
--@@ -5041,8 +5079,10 @@ static int rt2800_wait_bbp_ready(struct
-+@@ -5018,8 +5056,10 @@ static int rt2800_wait_bbp_ready(struct
-  	 * BBP was enabled after firmware was loaded,
-  	 * but we need to reactivate it now.
-  	 */
-@@ -218,7 +218,7 @@ Changes since v1: ---
-  	msleep(1);
-  
-  	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
--@@ -6738,11 +6778,19 @@ int rt2800_enable_radio(struct rt2x00_de
-+@@ -6715,11 +6755,19 @@ int rt2800_enable_radio(struct rt2x00_de
-  	/*
-  	 * Send signal during boot time to initialize firmware.
-  	 */
-@@ -239,7 +239,7 @@ Changes since v1: ---
-  	msleep(1);
-  
-  	/*
--@@ -7751,6 +7799,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7726,6 +7774,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	int retval;
-  	u32 reg;
-  
-@@ -248,22 +248,22 @@ Changes since v1: ---
-  	retval = rt2800_probe_rt(rt2x00dev);
-  	if (retval)
-  		return retval;
--@@ -7830,8 +7880,11 @@ void rt2800_get_tkip_seq(struct ieee8021
-- 	u32 offset;
-+@@ -7809,8 +7859,11 @@ void rt2800_get_key_seq(struct ieee80211
-+ 		return;
-  
-- 	offset = MAC_IVEIV_ENTRY(hw_key_idx);
-+ 	offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
- +
- +	rt2800_shared_mem_lock(rt2x00dev);
-  	rt2800_register_multiread(rt2x00dev, offset,
-  				      &iveiv_entry, sizeof(iveiv_entry));
- +	rt2800_shared_mem_unlock(rt2x00dev);
-  
-- 	memcpy(iv16, &iveiv_entry.iv[0], sizeof(*iv16));
-- 	memcpy(iv32, &iveiv_entry.iv[4], sizeof(*iv32));
----- a/drivers/net/wireless/rt2x00/rt2800lib.h
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
--@@ -35,6 +35,11 @@ struct rt2800_drv_data {
-- 	unsigned int tbtt_tick;
-+ 	memcpy(&seq->tkip.iv16, &iveiv_entry.iv[0], 2);
-+ 	memcpy(&seq->tkip.iv32, &iveiv_entry.iv[4], 4);
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+@@ -38,6 +38,11 @@ struct rt2800_drv_data {
-+ 	DECLARE_BITMAP(sta_ids, STA_IDS_SIZE);
-  
-  	unsigned long rt2800_flags;
- +
-@@ -274,7 +274,7 @@ Changes since v1: ---
-  };
-  
-  struct rt2800_ops {
--@@ -65,6 +70,10 @@ struct rt2800_ops {
-+@@ -68,6 +73,10 @@ struct rt2800_ops {
-  				  const u8 *data, const size_t len);
-  	int (*drv_init_registers)(struct rt2x00_dev *rt2x00dev);
-  	__le32 *(*drv_get_txwi)(struct queue_entry *entry);
-@@ -285,7 +285,7 @@ Changes since v1: ---
-  };
-  
-  static inline bool rt2800_has_high_shared_mem(struct rt2x00_dev *rt2x00dev)
--@@ -74,6 +83,29 @@ static inline bool rt2800_has_high_share
-+@@ -77,6 +86,29 @@ static inline bool rt2800_has_high_share
-  	return test_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
-  }
-  
-@@ -315,8 +315,8 @@ Changes since v1: ---
-  static inline void rt2800_register_read(struct rt2x00_dev *rt2x00dev,
-  					const unsigned int offset,
-  					u32 *value)
----- a/drivers/net/wireless/rt2x00/rt2800mmio.c
--+++ b/drivers/net/wireless/rt2x00/rt2800mmio.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
- @@ -820,8 +820,10 @@ int rt2800mmio_init_registers(struct rt2
-  	rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
-  	rt2x00mmio_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
-@@ -359,8 +359,8 @@ Changes since v1: ---
-  MODULE_AUTHOR(DRV_PROJECT);
-  MODULE_VERSION(DRV_VERSION);
-  MODULE_DESCRIPTION("rt2800 MMIO library");
----- a/drivers/net/wireless/rt2x00/rt2800mmio.h
--+++ b/drivers/net/wireless/rt2x00/rt2800mmio.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
- @@ -160,4 +160,8 @@ int rt2800mmio_init_registers(struct rt2
-  /* Device state switch handlers. */
-  int rt2800mmio_enable_radio(struct rt2x00_dev *rt2x00dev);
-@@ -370,8 +370,8 @@ Changes since v1: ---
- +void rt2800mmio_shmem_unlock(struct rt2x00_dev *rt2x00dev);
- +
-  #endif /* RT2800MMIO_H */
----- a/drivers/net/wireless/rt2x00/rt2800pci.c
--+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
- @@ -69,7 +69,9 @@ static void rt2800pci_mcu_status(struct
-  		return;
-  
-@@ -444,8 +444,8 @@ Changes since v1: ---
-  };
-  
-  static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
----- a/drivers/net/wireless/rt2x00/rt2800soc.c
--+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
- @@ -176,6 +176,9 @@ static const struct rt2800_ops rt2800soc
-  	.drv_write_firmware	= rt2800soc_write_firmware,
-  	.drv_init_registers	= rt2800mmio_init_registers,
-@@ -456,8 +456,8 @@ Changes since v1: ---
-  };
-  
-  static const struct rt2x00lib_ops rt2800soc_rt2x00_ops = {
----- a/drivers/net/wireless/rt2x00/rt2800usb.c
--+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
- @@ -51,6 +51,27 @@ static bool rt2800usb_hwcrypt_disabled(s
-  	return modparam_nohwcrypt;
-  }
-@@ -486,7 +486,7 @@ Changes since v1: ---
-  /*
-   * Queue handlers.
-   */
--@@ -294,8 +315,10 @@ static int rt2800usb_write_firmware(stru
-+@@ -299,8 +320,10 @@ static int rt2800usb_write_firmware(stru
-  					      data + offset, length);
-  	}
-  
-@@ -497,7 +497,7 @@ Changes since v1: ---
-  
-  	/*
-  	 * Send firmware request to device to load firmware,
--@@ -310,7 +333,10 @@ static int rt2800usb_write_firmware(stru
-+@@ -315,7 +338,10 @@ static int rt2800usb_write_firmware(stru
-  	}
-  
-  	msleep(10);
-@@ -508,7 +508,7 @@ Changes since v1: ---
-  
-  	return 0;
-  }
--@@ -328,8 +354,10 @@ static int rt2800usb_init_registers(stru
-+@@ -333,8 +359,10 @@ static int rt2800usb_init_registers(stru
-  	if (rt2800_wait_csr_ready(rt2x00dev))
-  		return -EBUSY;
-  
-@@ -519,7 +519,7 @@ Changes since v1: ---
-  
-  	reg = 0;
-  	rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
--@@ -859,6 +887,9 @@ static const struct rt2800_ops rt2800usb
-+@@ -863,6 +891,9 @@ static const struct rt2800_ops rt2800usb
-  	.drv_write_firmware	= rt2800usb_write_firmware,
-  	.drv_init_registers	= rt2800usb_init_registers,
-  	.drv_get_txwi		= rt2800usb_get_txwi,
-diff --git a/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch b/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch
-index b8c1914..985a3b9 100644
---- a/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch
-+++ b/package/kernel/mac80211/patches/600-0004-rt2x00-rt2800lib-fix-beacon-generation-on-RT3593.patch
-@@ -23,12 +23,12 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
- Changes since v1: ---
- ---
-- drivers/net/wireless/rt2x00/rt2800.h    |    3 +++
-- drivers/net/wireless/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    3 +++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
-  2 files changed, 47 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -574,6 +574,7 @@
-  #define PBF_SYS_CTRL			0x0400
-  #define PBF_SYS_CTRL_READY		FIELD32(0x00000080)
-@@ -46,8 +46,8 @@ Changes since v1: ---
-  #define BEACON_BASE_TO_OFFSET(_base)	(((_base) - 0x4000) / 64)
-  
-  /*
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -82,6 +82,39 @@ static inline bool rt2800_is_305x_soc(st
-  	return false;
-  }
-diff --git a/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch b/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
-index e7eb630..02b2acf 100644
---- a/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
-+++ b/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
-@@ -18,13 +18,13 @@ new field with the actually used value.
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    5 ++++-
-- drivers/net/wireless/rt2x00/rt2800lib.h |    1 +
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    5 ++++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.h |    1 +
-  2 files changed, 5 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -4638,6 +4638,7 @@ EXPORT_SYMBOL_GPL(rt2800_link_tuner);
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -4615,6 +4615,7 @@ EXPORT_SYMBOL_GPL(rt2800_link_tuner);
-   */
-  static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
-  {
-@@ -32,7 +32,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  	u32 reg;
-  	u16 eeprom;
-  	unsigned int i;
--@@ -5003,7 +5004,7 @@ static int rt2800_init_registers(struct
-+@@ -4980,7 +4981,7 @@ static int rt2800_init_registers(struct
-  	/*
-  	 * Clear all beacons
-  	 */
-@@ -41,7 +41,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  		rt2800_clear_beacon_register(rt2x00dev, i);
-  
-  	if (rt2x00_is_usb(rt2x00dev)) {
--@@ -7852,6 +7853,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -7827,6 +7828,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	if (rt2x00_rt(rt2x00dev, RT3593))
-  		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
-  
-@@ -50,13 +50,13 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  	/*
-  	 * Allocate eeprom data.
-  	 */
----- a/drivers/net/wireless/rt2x00/rt2800lib.h
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
--@@ -33,6 +33,7 @@ struct rt2800_drv_data {
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+@@ -35,6 +35,7 @@ struct rt2800_drv_data {
-  	u8 txmixer_gain_24g;
-  	u8 txmixer_gain_5g;
-  	unsigned int tbtt_tick;
- +	unsigned int hw_beacon_count;
-+ 	DECLARE_BITMAP(sta_ids, STA_IDS_SIZE);
-  
-  	unsigned long rt2800_flags;
-- 
-diff --git a/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch b/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch
-index b79b4be..4e735d3 100644
---- a/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch
-+++ b/package/kernel/mac80211/patches/600-0006-rt2x00-rt2800lib-init-additional-beacon-offset-regis.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: init additional beacon offset registers
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800.h    |   14 ++++++++++++++
-- drivers/net/wireless/rt2x00/rt2800lib.c |   24 ++++++++++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   14 ++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   24 ++++++++++++++++++++++++
-  2 files changed, 38 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -629,6 +629,20 @@
-   */
-  #define PBF_DBG				0x043c
-@@ -32,9 +32,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  /*
-   * RF registers
-   */
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -4650,6 +4650,30 @@ static int rt2800_init_registers(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -4627,6 +4627,30 @@ static int rt2800_init_registers(struct
-  	if (ret)
-  		return ret;
-  
-diff --git a/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch b/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
-index 180c5e3..e909272 100644
---- a/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
-+++ b/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix max supported beacon count for RT3593
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    5 ++++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    5 ++++-
-  1 file changed, 4 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7877,7 +7877,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7852,7 +7852,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	if (rt2x00_rt(rt2x00dev, RT3593))
-  		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
-  
-diff --git a/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch b/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
-index 8a10c6e..565e39d 100644
---- a/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0008-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
-@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: allow to build rt2800soc module for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/Kconfig |    2 +-
-+ drivers/net/wireless/ralink/rt2x00/Kconfig |    2 +-
-  1 file changed, 1 insertion(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/Kconfig
--+++ b/drivers/net/wireless/rt2x00/Kconfig
-+--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
-++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
- @@ -210,7 +210,7 @@ endif
-  config RT2800SOC
-  	tristate "Ralink WiSoC support"
-diff --git a/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch b/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
-index 31aa34a..7fe38e0 100644
---- a/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable support for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    1 +
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
-  1 file changed, 1 insertion(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7847,6 +7847,7 @@ static int rt2800_probe_rt(struct rt2x00
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7822,6 +7822,7 @@ static int rt2800_probe_rt(struct rt2x00
-  	case RT3390:
-  	case RT3572:
-  	case RT3593:
-diff --git a/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch b/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
-index a90c590..253a0c0 100644
---- a/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
-+++ b/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add rf_vals for RF3853
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800.h    |    4 +-
-- drivers/net/wireless/rt2x00/rt2800lib.c |   65 +++++++++++++++++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    4 +-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   65 +++++++++++++++++++++++++++++++
-  2 files changed, 68 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -48,7 +48,8 @@
-   * RF2853 2.4G/5G 3T3R
-   * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
-@@ -29,9 +29,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  #define RF5360				0x5360
-  #define RF5362				0x5362
-  #define RF5370				0x5370
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7465,6 +7465,66 @@ static const struct rf_channel rf_vals_3
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7442,6 +7442,66 @@ static const struct rf_channel rf_vals_3
-  	{173, 0x61, 0, 9},
-  };
-  
-@@ -98,7 +98,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  static const struct rf_channel rf_vals_5592_xtal20[] = {
-  	/* Channel, N, K, mod, R */
-  	{1, 482, 4, 10, 3},
--@@ -7694,6 +7754,11 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -7669,6 +7729,11 @@ static int rt2800_probe_hw_mode(struct r
-  		spec->channels = rf_vals_3x;
-  		break;
-  
-diff --git a/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch b/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
-index ab2673b..f15c22b 100644
---- a/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
-+++ b/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable VCO calibration for RF3853
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    2 ++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
-  1 file changed, 2 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -4402,6 +4402,7 @@ void rt2800_vco_calibration(struct rt2x0
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -4379,6 +4379,7 @@ void rt2800_vco_calibration(struct rt2x0
-  	case RF3053:
-  	case RF3070:
-  	case RF3290:
-@@ -18,7 +18,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  	case RF5360:
-  	case RF5362:
-  	case RF5370:
--@@ -7873,6 +7874,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -7848,6 +7849,7 @@ static int rt2800_probe_hw_mode(struct r
-  	case RF3053:
-  	case RF3070:
-  	case RF3290:
-diff --git a/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch b/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch
-index 05ed444..c120f2c 100644
---- a/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch
-+++ b/package/kernel/mac80211/patches/600-0012-rt2x00-rt2800lib-add-channel-configuration-function-.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add channel configuration function for
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |  208 +++++++++++++++++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  208 +++++++++++++++++++++++++++++++
-  1 file changed, 208 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -2649,6 +2649,211 @@ static void rt2800_config_channel_rf3053
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -2626,6 +2626,211 @@ static void rt2800_config_channel_rf3053
-  	}
-  }
-  
-@@ -223,7 +223,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  #define POWER_BOUND		0x27
-  #define POWER_BOUND_5G		0x2b
-  
--@@ -3261,6 +3466,9 @@ static void rt2800_config_channel(struct
-+@@ -3238,6 +3443,9 @@ static void rt2800_config_channel(struct
-  	case RF3322:
-  		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
-  		break;
-diff --git a/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch b/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch
-index 3b50775..f006304 100644
---- a/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch
-+++ b/package/kernel/mac80211/patches/600-0013-rt2x00-rt2800lib-enable-RF3853-support.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable RF3853 support
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    1 +
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
-  1 file changed, 1 insertion(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7430,6 +7430,7 @@ static int rt2800_init_eeprom(struct rt2
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7407,6 +7407,7 @@ static int rt2800_init_eeprom(struct rt2
-  	case RF3290:
-  	case RF3320:
-  	case RF3322:
-diff --git a/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch b/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
-index 4dfb068..a56bfa8 100644
---- a/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
-+++ b/package/kernel/mac80211/patches/600-0014-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add MAC register initialization for
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800.h    |   14 ++++++++++++++
-- drivers/net/wireless/rt2x00/rt2800lib.c |   19 ++++++++++++++++---
-+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   14 ++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   19 ++++++++++++++++---
-  2 files changed, 30 insertions(+), 3 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -1588,6 +1588,20 @@
-  #define TX_PWR_CFG_9_STBC7_CH2		FIELD32(0x00000f00)
-  
-@@ -33,9 +33,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-   * RX_FILTER_CFG: RX configuration register.
-   */
-  #define RX_FILTER_CFG			0x1400
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -5005,6 +5005,12 @@ static int rt2800_init_registers(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -4982,6 +4982,12 @@ static int rt2800_init_registers(struct
-  			rt2800_register_write(rt2x00dev, TX_SW_CFG2,
-  					      0x00000000);
-  		}
-@@ -48,7 +48,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
-  		   rt2x00_rt(rt2x00dev, RT5392) ||
-  		   rt2x00_rt(rt2x00dev, RT5592)) {
--@@ -5035,9 +5041,11 @@ static int rt2800_init_registers(struct
-+@@ -5012,9 +5018,11 @@ static int rt2800_init_registers(struct
-  
-  	rt2800_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
-  	rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
-@@ -63,7 +63,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  		rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 2);
-  	else
-  		rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
--@@ -5190,6 +5198,11 @@ static int rt2800_init_registers(struct
-+@@ -5167,6 +5175,11 @@ static int rt2800_init_registers(struct
-  	reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
-  	rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
-  
-diff --git a/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch b/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
-index 837c025..d68ad50 100644
---- a/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
-+++ b/package/kernel/mac80211/patches/600-0015-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
-@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800soc: fix rt2800soc_disable_radio for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800soc.c |    9 ++++++++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800soc.c |    9 ++++++++-
-  1 file changed, 8 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800soc.c
--+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
- @@ -51,9 +51,16 @@ static bool rt2800soc_hwcrypt_disabled(s
-  
-  static void rt2800soc_disable_radio(struct rt2x00_dev *rt2x00dev)
-diff --git a/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch b/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
-index 6663b78..9532632 100644
---- a/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
-+++ b/package/kernel/mac80211/patches/600-0016-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add BBP register initialization for
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
-  1 file changed, 44 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -5808,6 +5808,47 @@ static void rt2800_init_bbp_3593(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -5785,6 +5785,47 @@ static void rt2800_init_bbp_3593(struct
-  		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
-  }
-  
-@@ -59,7 +59,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
-  {
-  	int ant, div_mode;
--@@ -6026,6 +6067,9 @@ static void rt2800_init_bbp(struct rt2x0
-+@@ -6003,6 +6044,9 @@ static void rt2800_init_bbp(struct rt2x0
-  	case RT3593:
-  		rt2800_init_bbp_3593(rt2x00dev);
-  		return;
-diff --git a/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch b/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
-index 6e66f14..936fa35 100644
---- a/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0017-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add RFCSR initialization for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800.h    |    1 +
-- drivers/net/wireless/rt2x00/rt2800lib.c |  141 +++++++++++++++++++++++++++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    1 +
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  141 +++++++++++++++++++++++++++++++
-  2 files changed, 142 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -2171,6 +2171,7 @@ struct mac_iveiv_entry {
-  /*
-   * RFCSR 2:
-@@ -19,9 +19,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  #define RFCSR2_RESCAL_EN		FIELD8(0x80)
-  
-  /*
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -6843,6 +6843,144 @@ static void rt2800_init_rfcsr_3593(struc
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -6820,6 +6820,144 @@ static void rt2800_init_rfcsr_3593(struc
-  	/* TODO: enable stream mode support */
-  }
-  
-@@ -166,7 +166,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
-  {
-  	rt2800_rf_init_calibration(rt2x00dev, 2);
--@@ -7074,6 +7212,9 @@ static void rt2800_init_rfcsr(struct rt2
-+@@ -7051,6 +7189,9 @@ static void rt2800_init_rfcsr(struct rt2
-  	case RT3390:
-  		rt2800_init_rfcsr_3390(rt2x00dev);
-  		break;
-diff --git a/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch b/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
-index 57af961..ae899f7 100644
---- a/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
-+++ b/package/kernel/mac80211/patches/600-0018-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
-@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use the extended EEPROM map for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -342,7 +342,8 @@ static unsigned int rt2800_eeprom_word_i
-  		      wiphy_name(rt2x00dev->hw->wiphy), word))
-  		return 0;
-diff --git a/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch b/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
-index 9390f7e..bcaf676 100644
---- a/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0019-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: force rf type to RF3853 on RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    2 ++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
-  1 file changed, 2 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7611,6 +7611,8 @@ static int rt2800_init_eeprom(struct rt2
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7588,6 +7588,8 @@ static int rt2800_init_eeprom(struct rt2
-  	    rt2x00_rt(rt2x00dev, RT5390) ||
-  	    rt2x00_rt(rt2x00dev, RT5392))
-  		rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
-diff --git a/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch b/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
-index 1cba4f6..3169c10 100644
---- a/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
-+++ b/package/kernel/mac80211/patches/600-0020-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: add channel configuration code for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |   72 +++++++++++++++++++++++++++++--
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   72 +++++++++++++++++++++++++++++--
-  1 file changed, 69 insertions(+), 3 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -3429,6 +3429,36 @@ static char rt2800_txpower_to_dev(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -3406,6 +3406,36 @@ static char rt2800_txpower_to_dev(struct
-  		return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER);
-  }
-  
-@@ -47,7 +47,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
-  				  struct ieee80211_conf *conf,
-  				  struct rf_channel *rf,
--@@ -3447,6 +3477,12 @@ static void rt2800_config_channel(struct
-+@@ -3424,6 +3454,12 @@ static void rt2800_config_channel(struct
-  			rt2800_txpower_to_dev(rt2x00dev, rf->channel,
-  					      info->default_power3);
-  
-@@ -60,7 +60,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  	switch (rt2x00dev->chip.rf) {
-  	case RF2020:
-  	case RF3020:
--@@ -3530,6 +3566,15 @@ static void rt2800_config_channel(struct
-+@@ -3507,6 +3543,15 @@ static void rt2800_config_channel(struct
-  		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
-  		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
-  		rt2800_bbp_write(rt2x00dev, 77, 0x98);
-@@ -76,7 +76,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  	} else {
-  		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
-  		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
--@@ -3542,6 +3587,7 @@ static void rt2800_config_channel(struct
-+@@ -3519,6 +3564,7 @@ static void rt2800_config_channel(struct
-  		    !rt2x00_rt(rt2x00dev, RT5392)) {
-  			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-  				rt2800_bbp_write(rt2x00dev, 82, 0x62);
-@@ -84,7 +84,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  				rt2800_bbp_write(rt2x00dev, 75, 0x46);
-  			} else {
-  				if (rt2x00_rt(rt2x00dev, RT3593))
--@@ -3550,19 +3596,22 @@ static void rt2800_config_channel(struct
-+@@ -3527,19 +3573,22 @@ static void rt2800_config_channel(struct
-  					rt2800_bbp_write(rt2x00dev, 82, 0x84);
-  				rt2800_bbp_write(rt2x00dev, 75, 0x50);
-  			}
-@@ -110,7 +110,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  			rt2800_bbp_write(rt2x00dev, 83, 0x9a);
-  
-  		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
--@@ -3684,6 +3733,23 @@ static void rt2800_config_channel(struct
-+@@ -3661,6 +3710,23 @@ static void rt2800_config_channel(struct
-  
-  		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
-  
-diff --git a/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch b/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
-index 1773128..fa646d2 100644
---- a/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
-+++ b/package/kernel/mac80211/patches/600-0021-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix txpower_to_dev function for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    6 ++++--
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
-  1 file changed, 4 insertions(+), 2 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -3416,13 +3416,15 @@ static char rt2800_txpower_to_dev(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -3393,13 +3393,15 @@ static char rt2800_txpower_to_dev(struct
-  				  unsigned int channel,
-  				  char txpower)
-  {
-diff --git a/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch b/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
-index 36f0a4c..c068769 100644
---- a/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
-+++ b/package/kernel/mac80211/patches/600-0022-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct txpower calculation function
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -4635,7 +4635,8 @@ static void rt2800_config_txpower(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -4612,7 +4612,8 @@ static void rt2800_config_txpower(struct
-  				  struct ieee80211_channel *chan,
-  				  int power_level)
-  {
-diff --git a/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch b/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
-index 8119f97..74d80de 100644
---- a/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
-+++ b/package/kernel/mac80211/patches/600-0023-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: hardcode txmixer gain values to zero for
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    6 ++++--
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
-  1 file changed, 4 insertions(+), 2 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7493,7 +7493,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7470,7 +7470,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
-  {
-  	u16 word;
-  
-@@ -21,7 +21,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  		return 0;
-  
-  	rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG, &word);
--@@ -7507,7 +7508,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
-+@@ -7484,7 +7485,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
-  {
-  	u16 word;
-  
-diff --git a/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch b/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
-index 53435aa..1259286 100644
---- a/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0024-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
-@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct [RT]XWI size for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    1 +
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
-  1 file changed, 1 insertion(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -558,6 +558,7 @@ void rt2800_get_txwi_rxwi_size(struct rt
-  {
-  	switch (rt2x00dev->chip.rt) {
-diff --git a/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch b/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch
-index 08f3f88..0dcc027 100644
---- a/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0025-rt2x00-rt2800lib-use-correct-beacon-base-for-RT3883.patch
-@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct beacon base for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -983,7 +983,8 @@ EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
-  static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
-  					  unsigned int index)
-diff --git a/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch b/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
-index dfbdee7..6ce224a 100644
---- a/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: use correct beacon count for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -8428,7 +8428,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -8403,7 +8403,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	if (rt2x00_rt(rt2x00dev, RT3593))
-  		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
-  
-diff --git a/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch b/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
-index 22f7110..3936368 100644
---- a/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
-+++ b/package/kernel/mac80211/patches/600-0027-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix antenna configuration for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -1961,7 +1961,8 @@ void rt2800_config_ant(struct rt2x00_dev
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -1938,7 +1938,8 @@ void rt2800_config_ant(struct rt2x00_dev
-  	rt2800_bbp_write(rt2x00dev, 3, r3);
-  	rt2800_bbp_write(rt2x00dev, 1, r1);
-  
-diff --git a/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch b/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
-index 9945f38..f028587 100644
---- a/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
-+++ b/package/kernel/mac80211/patches/600-0028-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix LNA gain configuration for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    6 ++++--
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
-  1 file changed, 4 insertions(+), 2 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -1984,7 +1984,8 @@ static void rt2800_config_lna_gain(struc
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -1961,7 +1961,8 @@ static void rt2800_config_lna_gain(struc
-  		rt2800_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
-  		lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
-  	} else if (libconf->rf.channel <= 128) {
-@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  			rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2, &eeprom);
-  			lna_gain = rt2x00_get_field16(eeprom,
-  						      EEPROM_EXT_LNA2_A1);
--@@ -1994,7 +1995,8 @@ static void rt2800_config_lna_gain(struc
-+@@ -1971,7 +1972,8 @@ static void rt2800_config_lna_gain(struc
-  						      EEPROM_RSSI_BG2_LNA_A1);
-  		}
-  	} else {
-diff --git a/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch b/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
-index beadea8..ab8c625 100644
---- a/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0029-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix VGC setup for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |   11 +++++++++--
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   11 +++++++++--
-  1 file changed, 9 insertions(+), 2 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -4835,7 +4835,8 @@ static u8 rt2800_get_default_vgc(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -4812,7 +4812,8 @@ static u8 rt2800_get_default_vgc(struct
-  		else
-  			vgc = 0x2e + rt2x00dev->lna_gain;
-  	} else { /* 5GHZ band */
-@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  			vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
-  		else if (rt2x00_rt(rt2x00dev, RT5592))
-  			vgc = 0x24 + (2 * rt2x00dev->lna_gain);
--@@ -4855,7 +4856,8 @@ static inline void rt2800_set_vgc(struct
-+@@ -4832,7 +4833,8 @@ static inline void rt2800_set_vgc(struct
-  {
-  	if (qual->vgc_level != vgc_level) {
-  		if (rt2x00_rt(rt2x00dev, RT3572) ||
-@@ -30,7 +30,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
-  						       vgc_level);
-  		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
--@@ -4902,6 +4904,11 @@ void rt2800_link_tuner(struct rt2x00_dev
-+@@ -4879,6 +4881,11 @@ void rt2800_link_tuner(struct rt2x00_dev
-  		}
-  		break;
-  
-diff --git a/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch b/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
-index a6c0f58..49830a1 100644
---- a/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
-+++ b/package/kernel/mac80211/patches/600-0030-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix EEPROM LNA validation for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    9 ++++++---
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    9 ++++++---
-  1 file changed, 6 insertions(+), 3 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7630,7 +7630,8 @@ static int rt2800_validate_eeprom(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7607,7 +7607,8 @@ static int rt2800_validate_eeprom(struct
-  	rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &word);
-  	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
-  		rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
-@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  		if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
-  		    rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
-  			rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
--@@ -7650,7 +7651,8 @@ static int rt2800_validate_eeprom(struct
-+@@ -7627,7 +7628,8 @@ static int rt2800_validate_eeprom(struct
-  	rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &word);
-  	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
-  		rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
-@@ -30,7 +30,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  		if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
-  		    rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
-  			rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
--@@ -7658,7 +7660,8 @@ static int rt2800_validate_eeprom(struct
-+@@ -7635,7 +7637,8 @@ static int rt2800_validate_eeprom(struct
-  	}
-  	rt2800_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
-  
-diff --git a/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch b/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
-index 910f9ec..6e22847 100644
---- a/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
-+++ b/package/kernel/mac80211/patches/600-0031-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
-@@ -5,12 +5,12 @@ Subject: [PATCH] rt2x00: rt2800lib: fix txpower compensation for RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 +++
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 +++
-  1 file changed, 3 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -4005,6 +4005,9 @@ static u8 rt2800_compensate_txpower(stru
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -3982,6 +3982,9 @@ static u8 rt2800_compensate_txpower(stru
-  	if (rt2x00_rt(rt2x00dev, RT3593))
-  		return min_t(u8, txpower, 0xc);
-  
-diff --git a/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch b/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
-index bcdfc67..25753af 100644
---- a/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
-+++ b/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800lib: enable RT2800_HAS_HIGH_SHARED_MEM for
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -8441,7 +8441,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -8416,7 +8416,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	if (retval)
-  		return retval;
-  
-diff --git a/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch b/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch
-index dc06e6a..4f2e754 100644
---- a/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch
-+++ b/package/kernel/mac80211/patches/600-0033-rt2x00-rt2800lib-use-high-memory-for-beacons-on-RT38.patch
-@@ -5,11 +5,11 @@ Subject: [PATCH] rt2x00: rt2800lib: use high memory for beacons on RT3883
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800lib.c |    3 ++-
-+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
-  1 file changed, 2 insertions(+), 1 deletion(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -97,7 +97,8 @@ static inline void rt2800_shared_mem_sel
-  
-  static inline bool rt2800_beacon_uses_high_mem(struct rt2x00_dev *rt2x00dev)
-diff --git a/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch b/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
-index 212eb4e..a497b5e 100644
---- a/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
-+++ b/package/kernel/mac80211/patches/600-0034-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: rt2800mmio: add a workaround for spurious
- 
- Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
-- drivers/net/wireless/rt2x00/rt2x00.h     |    5 +++
-+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
-+ drivers/net/wireless/ralink/rt2x00/rt2x00.h     |    5 +++
-  2 files changed, 65 insertions(+), 12 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/rt2800mmio.c
--+++ b/drivers/net/wireless/rt2x00/rt2800mmio.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
- @@ -415,9 +415,9 @@ void rt2800mmio_autowake_tasklet(unsigne
-  }
-  EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
-@@ -120,9 +120,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
-  		/*
-  		 * Never disable the TX_FIFO_STATUS interrupt.
-  		 */
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
--@@ -987,6 +987,11 @@ struct rt2x00_dev {
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -991,6 +991,11 @@ struct rt2x00_dev {
-  	int rf_channel;
-  
-  	/*
-diff --git a/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch b/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch
-index 08c8fa6..a407161 100644
---- a/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch
-+++ b/package/kernel/mac80211/patches/601-rt2x00-set_pci_mwi.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2x00pci.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00pci.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00pci.c
- @@ -94,8 +94,10 @@ int rt2x00pci_probe(struct pci_dev *pci_
-  
-  	pci_set_master(pci_dev);
-diff --git a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
-index 8c71075..7a183a4 100644
---- a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
-+++ b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
-@@ -20,8 +20,8 @@
- +};
- +
- +#endif /* _RT2X00_PLATFORM_H */
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
- @@ -38,6 +38,7 @@
-  #include <linux/kfifo.h>
-  #include <linux/hrtimer.h>
-diff --git a/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
-index 8f650a2..bc056cd 100644
---- a/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
-+++ b/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
-@@ -1,15 +1,15 @@
- --- a/.local-symbols
- +++ b/.local-symbols
--@@ -263,6 +263,7 @@ RT2X00_LIB_FIRMWARE=
-+@@ -329,6 +329,7 @@ RT2X00_LIB_FIRMWARE=
-  RT2X00_LIB_CRYPTO=
-  RT2X00_LIB_LEDS=
-  RT2X00_LIB_DEBUGFS=
- +RT2X00_LIB_EEPROM=
-  RT2X00_DEBUG=
-- RTL_CARDS=
-- RTL8192CE=
----- a/drivers/net/wireless/rt2x00/Kconfig
--+++ b/drivers/net/wireless/rt2x00/Kconfig
-+ WLAN_VENDOR_REALTEK=
-+ RTL8180=
-+--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
-++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
- @@ -69,6 +69,7 @@ config RT2800PCI
-  	select RT2X00_LIB_MMIO
-  	select RT2X00_LIB_PCI
-@@ -26,7 +26,7 @@
-  	select RT2800_LIB
-  	select RT2800_LIB_MMIO
-  	---help---
--@@ -266,6 +268,9 @@ config RT2X00_LIB_FIRMWARE
-+@@ -265,6 +267,9 @@ config RT2X00_LIB_FIRMWARE
-  config RT2X00_LIB_CRYPTO
-  	bool
-  
-@@ -36,8 +36,8 @@
-  config RT2X00_LIB_LEDS
-  	bool
-  	default y if (RT2X00_LIB=y && LEDS_CLASS=y) || (RT2X00_LIB=m && LEDS_CLASS!=n)
----- a/drivers/net/wireless/rt2x00/Makefile
--+++ b/drivers/net/wireless/rt2x00/Makefile
-+--- a/drivers/net/wireless/ralink/rt2x00/Makefile
-++++ b/drivers/net/wireless/ralink/rt2x00/Makefile
- @@ -7,6 +7,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
-  rt2x00lib-$(CPTCFG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
-  rt2x00lib-$(CPTCFG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
-@@ -46,9 +46,9 @@
-  
-  obj-$(CPTCFG_RT2X00_LIB)		+= rt2x00lib.o
-  obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
----- a/drivers/net/wireless/rt2x00/rt2800lib.h
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
--@@ -43,6 +43,8 @@ struct rt2800_drv_data {
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+@@ -46,6 +46,8 @@ struct rt2800_drv_data {
-  	} shmem_lock;
-  };
-  
-@@ -57,7 +57,7 @@
-  struct rt2800_ops {
-  	void (*register_read)(struct rt2x00_dev *rt2x00dev,
-  			      const unsigned int offset, u32 *value);
--@@ -176,6 +178,15 @@ static inline int rt2800_read_eeprom(str
-+@@ -179,6 +181,15 @@ static inline int rt2800_read_eeprom(str
-  {
-  	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
-  
-@@ -73,8 +73,8 @@
-  	return rt2800ops->read_eeprom(rt2x00dev);
-  }
-  
----- a/drivers/net/wireless/rt2x00/rt2800soc.c
--+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
- @@ -102,19 +102,6 @@ static int rt2800soc_set_device_state(st
-  	return retval;
-  }
-@@ -103,9 +103,9 @@
-  	.hwcrypt_disabled	= rt2800soc_hwcrypt_disabled,
-  	.drv_write_firmware	= rt2800soc_write_firmware,
-  	.drv_init_registers	= rt2800mmio_init_registers,
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
--@@ -695,6 +695,7 @@ enum rt2x00_capability_flags {
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -697,6 +697,7 @@ enum rt2x00_capability_flags {
-  	REQUIRE_HT_TX_DESC,
-  	REQUIRE_PS_AUTOWAKE,
-  	REQUIRE_DELAYED_RFKILL,
-@@ -113,7 +113,7 @@
-  
-  	/*
-  	 * Capabilities
--@@ -964,6 +965,11 @@ struct rt2x00_dev {
-+@@ -968,6 +969,11 @@ struct rt2x00_dev {
-  	const struct firmware *fw;
-  
-  	/*
-@@ -125,9 +125,9 @@
-  	 * FIFO for storing tx status reports between isr and tasklet.
-  	 */
-  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
----- a/drivers/net/wireless/rt2x00/rt2x00dev.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
--@@ -1334,6 +1334,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+@@ -1335,6 +1335,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
-  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
-  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
-  
-@@ -138,7 +138,7 @@
-  	/*
-  	 * Let the driver probe the device to detect the capabilities.
-  	 */
--@@ -1474,6 +1478,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
-+@@ -1475,6 +1479,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
-  	 * Free the driver data.
-  	 */
-  	kfree(rt2x00dev->drv_data);
-@@ -151,7 +151,7 @@
-  EXPORT_SYMBOL_GPL(rt2x00lib_remove_dev);
-  
- --- /dev/null
--+++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
- @@ -0,0 +1,111 @@
- +/*
- +	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
-@@ -264,8 +264,8 @@
- +	release_firmware(rt2x00dev->eeprom_file);
- +	rt2x00dev->eeprom_file = NULL;
- +}
----- a/drivers/net/wireless/rt2x00/rt2x00lib.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
- @@ -320,6 +320,22 @@ static inline void rt2x00lib_free_firmwa
-  #endif /* CPTCFG_RT2X00_LIB_FIRMWARE */
-  
-@@ -289,8 +289,8 @@
-   * Debugfs handlers.
-   */
-  #ifdef CPTCFG_RT2X00_LIB_DEBUGFS
----- a/drivers/net/wireless/rt2x00/rt2x00soc.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
- @@ -92,6 +92,7 @@ int rt2x00soc_probe(struct platform_devi
-  	rt2x00dev->hw = hw;
-  	rt2x00dev->irq = platform_get_irq(pdev, 0);
-diff --git a/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch
-index 4bc6f37..9dffef1 100644
---- a/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch
-+++ b/package/kernel/mac80211/patches/604-rt2x00-of_load_eeprom_filename.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2x00eeprom.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
- @@ -26,6 +26,7 @@
-  
-  #include <linux/kernel.h>
-diff --git a/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
-index 75f0415..5dceff8 100644
---- a/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
-+++ b/package/kernel/mac80211/patches/605-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
-@@ -6,12 +6,12 @@ Subject: [PATCH] rt2x00: load eeprom on SoC from a mtd device defines inside
- 
- Signed-off-by: John Crispin <blogic@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/Kconfig     |    1 +
-- drivers/net/wireless/rt2x00/rt2800pci.c |   44 ++++++++++++++++++++++++++-----
-+ drivers/net/wireless/ralink/rt2x00/Kconfig     |    1 +
-+ drivers/net/wireless/ralink/rt2x00/rt2800pci.c |   44 ++++++++++++++++++++++++++-----
-  2 files changed, 39 insertions(+), 6 deletions(-)
- 
----- a/drivers/net/wireless/rt2x00/Kconfig
--+++ b/drivers/net/wireless/rt2x00/Kconfig
-+--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
-++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
- @@ -219,6 +219,7 @@ config RT2800SOC
-  	select RT2X00_LIB_EEPROM
-  	select RT2800_LIB
-@@ -20,8 +20,8 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
-  	---help---
-  	  This adds support for Ralink WiSoC devices.
-  	  Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
----- a/drivers/net/wireless/rt2x00/rt2x00eeprom.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
- @@ -26,11 +26,66 @@
-  
-  #include <linux/kernel.h>
-@@ -79,7 +79,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
- +	if (!ret) {
- +		rt2x00dev->eeprom_file = &mtd_fw;
- +		mtd_fw.size = len;
--+		mtd_fw.data = rt2x00dev->eeprom;
-++		mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
- +	}
- +#endif
- +
-diff --git a/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
-index 70f7b78..d923e05 100644
---- a/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
-+++ b/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
-@@ -10,8 +10,8 @@
-  };
-  
-  #endif /* _RT2X00_PLATFORM_H */
----- a/drivers/net/wireless/rt2x00/rt2x00dev.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
- @@ -940,6 +940,22 @@ static int rt2x00lib_probe_hw_modes(stru
-  	unsigned int num_rates;
-  	unsigned int i;
-@@ -35,9 +35,9 @@
-  	num_rates = 0;
-  	if (spec->supported_rates & SUPPORT_RATE_CCK)
-  		num_rates += 4;
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
--@@ -403,6 +403,7 @@ struct hw_mode_spec {
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -405,6 +405,7 @@ struct hw_mode_spec {
-  	unsigned int supported_bands;
-  #define SUPPORT_BAND_2GHZ	0x00000001
-  #define SUPPORT_BAND_5GHZ	0x00000002
-diff --git a/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
-index a35bd55..a645ba1 100644
---- a/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
-+++ b/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
-@@ -8,8 +8,8 @@
-  
-  	int disable_2ghz;
-  	int disable_5ghz;
----- a/drivers/net/wireless/rt2x00/rt2x00dev.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
- @@ -931,6 +931,18 @@ static void rt2x00lib_rate(struct ieee80
-  		entry->flags |= IEEE80211_RATE_SHORT_PREAMBLE;
-  }
-@@ -29,9 +29,9 @@
-  static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
-  				    struct hw_mode_spec *spec)
-  {
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
--@@ -1410,6 +1410,7 @@ static inline void rt2x00debug_dump_fram
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -1414,6 +1414,7 @@ static inline void rt2x00debug_dump_fram
-   */
-  u32 rt2x00lib_get_bssidx(struct rt2x00_dev *rt2x00dev,
-  			 struct ieee80211_vif *vif);
-@@ -39,8 +39,8 @@
-  
-  /*
-   * Interrupt context handlers.
----- a/drivers/net/wireless/rt2x00/rt61pci.c
--+++ b/drivers/net/wireless/rt2x00/rt61pci.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
- @@ -2392,6 +2392,7 @@ static int rt61pci_validate_eeprom(struc
-  	u32 reg;
-  	u16 word;
-diff --git a/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
-index 63a8641..3fdaae7 100644
---- a/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
-+++ b/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2x00dev.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
- @@ -26,6 +26,7 @@
-  #include <linux/module.h>
-  #include <linux/slab.h>
-diff --git a/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch b/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
-index 067d2ea..c69d330 100644
---- a/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
-+++ b/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
-@@ -1,6 +1,6 @@
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -3552,11 +3552,18 @@ static void rt2800_config_channel(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -3529,11 +3529,18 @@ static void rt2800_config_channel(struct
-  	/*
-  	 * Change BBP settings
-  	 */
-@@ -19,7 +19,7 @@
-  	} else if (rt2x00_rt(rt2x00dev, RT3593)) {
-  		if (rf->channel > 14) {
-  			/* Disable CCK Packet detection on 5GHz */
--@@ -6618,6 +6625,12 @@ static void rt2800_init_rfcsr_3290(struc
-+@@ -6595,6 +6602,12 @@ static void rt2800_init_rfcsr_3290(struc
-  
-  static void rt2800_init_rfcsr_3352(struct rt2x00_dev *rt2x00dev)
-  {
-@@ -32,7 +32,7 @@
-  	rt2800_rf_init_calibration(rt2x00dev, 30);
-  
-  	rt2800_rfcsr_write(rt2x00dev, 0, 0xf0);
--@@ -6653,15 +6666,30 @@ static void rt2800_init_rfcsr_3352(struc
-+@@ -6630,15 +6643,30 @@ static void rt2800_init_rfcsr_3352(struc
-  	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-  	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
-  	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
-@@ -66,7 +66,7 @@
-  	rt2800_rfcsr_write(rt2x00dev, 43, 0xdb);
-  	rt2800_rfcsr_write(rt2x00dev, 44, 0xdb);
-  	rt2800_rfcsr_write(rt2x00dev, 45, 0xdb);
--@@ -6669,15 +6697,20 @@ static void rt2800_init_rfcsr_3352(struc
-+@@ -6646,15 +6674,20 @@ static void rt2800_init_rfcsr_3352(struc
-  	rt2800_rfcsr_write(rt2x00dev, 47, 0x0d);
-  	rt2800_rfcsr_write(rt2x00dev, 48, 0x14);
-  	rt2800_rfcsr_write(rt2x00dev, 49, 0x00);
-@@ -96,7 +96,7 @@
-  	rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
-  	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
-  	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
--@@ -7698,6 +7731,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7675,6 +7708,7 @@ static int rt2800_init_eeprom(struct rt2
-  	 * RT53xx: defined in "EEPROM_CHIP_ID" field
-  	 */
-  	if (rt2x00_rt(rt2x00dev, RT3290) ||
-@@ -104,7 +104,7 @@
-  	    rt2x00_rt(rt2x00dev, RT5390) ||
-  	    rt2x00_rt(rt2x00dev, RT5392))
-  		rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
--@@ -7793,7 +7827,8 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7770,7 +7804,8 @@ static int rt2800_init_eeprom(struct rt2
-  	/*
-  	 * Detect if this device has Bluetooth co-existence.
-  	 */
-@@ -114,7 +114,7 @@
-  		__set_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags);
-  
-  	/*
--@@ -7822,6 +7857,22 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7799,6 +7834,22 @@ static int rt2800_init_eeprom(struct rt2
-  					EIRP_MAX_TX_POWER_LIMIT)
-  		__set_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags);
-  
-@@ -137,8 +137,8 @@
-  	return 0;
-  }
-  
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -2335,6 +2335,12 @@ struct mac_iveiv_entry {
-  #define RFCSR36_RF_BS			FIELD8(0x80)
-  
-@@ -198,9 +198,9 @@
-  
-  /*
-   * EEPROM frequency
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
--@@ -715,6 +715,8 @@ enum rt2x00_capability_flags {
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -717,6 +717,8 @@ enum rt2x00_capability_flags {
-  	CAPABILITY_DOUBLE_ANTENNA,
-  	CAPABILITY_BT_COEXIST,
-  	CAPABILITY_VCO_RECALIBRATION,
-diff --git a/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch b/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
-index 1dcca36..b44fe90 100644
---- a/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
-+++ b/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
-@@ -1,6 +1,6 @@
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -8209,6 +8209,27 @@ static const struct rf_channel rf_vals_5
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -8186,6 +8186,27 @@ static const struct rf_channel rf_vals_5
-  	{196, 83, 0, 12, 1},
-  };
-  
-@@ -28,7 +28,7 @@
-  static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
-  {
-  	struct hw_mode_spec *spec = &rt2x00dev->spec;
--@@ -8297,7 +8318,10 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8272,7 +8293,10 @@ static int rt2800_probe_hw_mode(struct r
-  	case RF5390:
-  	case RF5392:
-  		spec->num_channels = 14;
-@@ -40,7 +40,7 @@
-  		break;
-  
-  	case RF3052:
--@@ -8481,6 +8505,19 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -8456,6 +8480,19 @@ static int rt2800_probe_rt(struct rt2x00
-  	return 0;
-  }
-  
-@@ -60,7 +60,7 @@
-  int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
-  {
-  	struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
--@@ -8523,6 +8560,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-+@@ -8498,6 +8535,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
-  	rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
-  
-  	/*
-@@ -76,9 +76,9 @@
-  	 * Initialize hw specifications.
-  	 */
-  	retval = rt2800_probe_hw_mode(rt2x00dev);
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
--@@ -398,6 +398,7 @@ static inline struct rt2x00_intf* vif_to
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+@@ -400,6 +400,7 @@ static inline struct rt2x00_intf* vif_to
-   * @channels: Device/chipset specific channel values (See &struct rf_channel).
-   * @channels_info: Additional information for channels (See &struct channel_info).
-   * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
-@@ -86,7 +86,7 @@
-   */
-  struct hw_mode_spec {
-  	unsigned int supported_bands;
--@@ -414,6 +415,7 @@ struct hw_mode_spec {
-+@@ -416,6 +417,7 @@ struct hw_mode_spec {
-  	const struct channel_info *channels_info;
-  
-  	struct ieee80211_sta_ht_cap ht;
-diff --git a/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
-index 1970efc..e4b028b 100644
---- a/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
-+++ b/package/kernel/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
-@@ -8,11 +8,11 @@ devicetree.
- 
- Signed-off-by: John Crispin <blogic@openwrt.org>
- ---
-- drivers/net/wireless/rt2x00/rt2800pci.c |    7 +++++++
-+ drivers/net/wireless/ralink/rt2x00/rt2800pci.c |    7 +++++++
-  1 file changed, 7 insertions(+)
- 
----- a/drivers/net/wireless/rt2x00/rt2800soc.c
--+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
- @@ -237,10 +237,17 @@ static int rt2800soc_probe(struct platfo
-  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
-  }
-diff --git a/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch b/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
-index c779a17..8e3bd2a 100644
---- a/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
-+++ b/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -36,6 +36,7 @@
-  #include <linux/kernel.h>
-  #include <linux/module.h>
-@@ -8,7 +8,7 @@
-  
-  #include "rt2x00.h"
-  #include "rt2800lib.h"
--@@ -8507,13 +8508,14 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -8482,13 +8483,14 @@ static int rt2800_probe_rt(struct rt2x00
-  
-  int rt2800_probe_clk(struct rt2x00_dev *rt2x00dev)
-  {
-diff --git a/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch b/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
-index 840b3bc..faa5879 100644
---- a/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
-+++ b/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -74,6 +74,7 @@
-  #define RF3070				0x3070
-  #define RF3290				0x3290
-@@ -8,9 +8,9 @@
-  #define RF5360				0x5360
-  #define RF5362				0x5362
-  #define RF5370				0x5370
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -3038,6 +3038,13 @@ static void rt2800_config_channel_rf53xx
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -3015,6 +3015,13 @@ static void rt2800_config_channel_rf53xx
-  
-  				rt2800_rfcsr_write(rt2x00dev, 59,
-  						   r59_non_bt[idx]);
-@@ -24,7 +24,7 @@
-  			}
-  		}
-  	}
--@@ -3516,6 +3523,7 @@ static void rt2800_config_channel(struct
-+@@ -3493,6 +3500,7 @@ static void rt2800_config_channel(struct
-  		rt2800_config_channel_rf3853(rt2x00dev, conf, rf, info);
-  		break;
-  	case RF3070:
-@@ -32,7 +32,7 @@
-  	case RF5360:
-  	case RF5362:
-  	case RF5370:
--@@ -3534,6 +3542,7 @@ static void rt2800_config_channel(struct
-+@@ -3511,6 +3519,7 @@ static void rt2800_config_channel(struct
-  	if (rt2x00_rf(rt2x00dev, RF3070) ||
-  	    rt2x00_rf(rt2x00dev, RF3290) ||
-  	    rt2x00_rf(rt2x00dev, RF3322) ||
-@@ -40,7 +40,7 @@
-  	    rt2x00_rf(rt2x00dev, RF5360) ||
-  	    rt2x00_rf(rt2x00dev, RF5362) ||
-  	    rt2x00_rf(rt2x00dev, RF5370) ||
--@@ -3812,7 +3821,8 @@ static void rt2800_config_channel(struct
-+@@ -3789,7 +3798,8 @@ static void rt2800_config_channel(struct
-  	/*
-  	 * Clear update flag
-  	 */
-@@ -50,7 +50,7 @@
-  		rt2800_bbp_read(rt2x00dev, 49, &bbp);
-  		rt2x00_set_field8(&bbp, BBP49_UPDATE_FLAG, 0);
-  		rt2800_bbp_write(rt2x00dev, 49, bbp);
--@@ -4698,6 +4708,7 @@ void rt2800_vco_calibration(struct rt2x0
-+@@ -4675,6 +4685,7 @@ void rt2800_vco_calibration(struct rt2x0
-  	case RF3070:
-  	case RF3290:
-  	case RF3853:
-@@ -58,7 +58,7 @@
-  	case RF5360:
-  	case RF5362:
-  	case RF5370:
--@@ -5111,6 +5122,8 @@ static int rt2800_init_registers(struct
-+@@ -5088,6 +5099,8 @@ static int rt2800_init_registers(struct
-  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
-  		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
-  		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
-@@ -67,7 +67,7 @@
-  	} else {
-  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
-  		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
--@@ -5766,9 +5779,13 @@ static void rt2800_init_bbp_3352(struct
-+@@ -5743,9 +5756,13 @@ static void rt2800_init_bbp_3352(struct
-  
-  	rt2800_bbp_write(rt2x00dev, 82, 0x62);
-  
-@@ -84,7 +84,7 @@
-  
-  	rt2800_bbp_write(rt2x00dev, 86, 0x38);
-  
--@@ -5782,9 +5799,13 @@ static void rt2800_init_bbp_3352(struct
-+@@ -5759,9 +5776,13 @@ static void rt2800_init_bbp_3352(struct
-  
-  	rt2800_bbp_write(rt2x00dev, 104, 0x92);
-  
-@@ -101,7 +101,7 @@
-  
-  	rt2800_bbp_write(rt2x00dev, 120, 0x50);
-  
--@@ -5809,6 +5830,13 @@ static void rt2800_init_bbp_3352(struct
-+@@ -5786,6 +5807,13 @@ static void rt2800_init_bbp_3352(struct
-  	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
-  
-  	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
-@@ -115,7 +115,7 @@
-  }
-  
-  static void rt2800_init_bbp_3390(struct rt2x00_dev *rt2x00dev)
--@@ -6150,6 +6178,7 @@ static void rt2800_init_bbp(struct rt2x0
-+@@ -6127,6 +6155,7 @@ static void rt2800_init_bbp(struct rt2x0
-  		rt2800_init_bbp_3290(rt2x00dev);
-  		break;
-  	case RT3352:
-@@ -123,7 +123,7 @@
-  		rt2800_init_bbp_3352(rt2x00dev);
-  		break;
-  	case RT3390:
--@@ -7101,6 +7130,76 @@ static void rt2800_init_rfcsr_3883(struc
-+@@ -7078,6 +7107,76 @@ static void rt2800_init_rfcsr_3883(struc
-  	rt2800_rfcsr_write(rt2x00dev, 20, rfcsr);
-  }
-  
-@@ -200,7 +200,7 @@
-  static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
-  {
-  	rt2800_rf_init_calibration(rt2x00dev, 2);
--@@ -7341,6 +7440,9 @@ static void rt2800_init_rfcsr(struct rt2
-+@@ -7318,6 +7417,9 @@ static void rt2800_init_rfcsr(struct rt2
-  	case RT3593:
-  		rt2800_init_rfcsr_3593(rt2x00dev);
-  		break;
-@@ -210,7 +210,7 @@
-  	case RT5390:
-  		rt2800_init_rfcsr_5390(rt2x00dev);
-  		break;
--@@ -7600,6 +7702,12 @@ static int rt2800_validate_eeprom(struct
-+@@ -7577,6 +7679,12 @@ static int rt2800_validate_eeprom(struct
-  		rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RF_TYPE, RF2820);
-  		rt2800_eeprom_write(rt2x00dev, EEPROM_NIC_CONF0, word);
-  		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
-@@ -223,7 +223,7 @@
-  	} else if (rt2x00_rt(rt2x00dev, RT2860) ||
-  		   rt2x00_rt(rt2x00dev, RT2872)) {
-  		/*
--@@ -7738,6 +7846,8 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7715,6 +7823,8 @@ static int rt2800_init_eeprom(struct rt2
-  		rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
-  	else if (rt2x00_rt(rt2x00dev, RT3883))
-  		rf = RF3853;
-@@ -232,7 +232,7 @@
-  	else
-  		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
-  
--@@ -7757,6 +7867,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7734,6 +7844,7 @@ static int rt2800_init_eeprom(struct rt2
-  	case RF3320:
-  	case RF3322:
-  	case RF3853:
-@@ -240,7 +240,7 @@
-  	case RF5360:
-  	case RF5362:
-  	case RF5370:
--@@ -8312,6 +8423,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8287,6 +8398,7 @@ static int rt2800_probe_hw_mode(struct r
-  	case RF3290:
-  	case RF3320:
-  	case RF3322:
-@@ -248,7 +248,7 @@
-  	case RF5360:
-  	case RF5362:
-  	case RF5370:
--@@ -8451,6 +8563,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8426,6 +8538,7 @@ static int rt2800_probe_hw_mode(struct r
-  	case RF3070:
-  	case RF3290:
-  	case RF3853:
-@@ -256,7 +256,7 @@
-  	case RF5360:
-  	case RF5362:
-  	case RF5370:
--@@ -8491,6 +8604,7 @@ static int rt2800_probe_rt(struct rt2x00
-+@@ -8466,6 +8579,7 @@ static int rt2800_probe_rt(struct rt2x00
-  	case RT3572:
-  	case RT3593:
-  	case RT3883:
-@@ -264,8 +264,8 @@
-  	case RT5390:
-  	case RT5392:
-  	case RT5592:
----- a/drivers/net/wireless/rt2x00/rt2x00.h
--+++ b/drivers/net/wireless/rt2x00/rt2x00.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
- @@ -169,6 +169,7 @@ struct rt2x00_chip {
-  #define RT3572		0x3572
-  #define RT3593		0x3593
-diff --git a/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch
-index 13f2048..6094a61 100644
---- a/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch
-+++ b/package/kernel/mac80211/patches/619-rt2x00-change-led-polarity-from-OF.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -37,6 +37,7 @@
-  #include <linux/module.h>
-  #include <linux/slab.h>
-@@ -8,7 +8,7 @@
-  
-  #include "rt2x00.h"
-  #include "rt2800lib.h"
--@@ -7957,6 +7958,17 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7934,6 +7935,17 @@ static int rt2800_init_eeprom(struct rt2
-  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
-  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
-  
-@@ -26,8 +26,8 @@
-  	rt2x00dev->led_mcu_reg = eeprom;
-  #endif /* CPTCFG_RT2X00_LIB_LEDS */
-  
----- a/drivers/net/wireless/rt2x00/rt2x00leds.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00leds.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00leds.c
- @@ -109,6 +109,9 @@ static int rt2x00leds_register_led(struc
-  	led->led_dev.name = name;
-  	led->led_dev.brightness = LED_OFF;
-diff --git a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
-index 2dbfd10..55452b9 100644
---- a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
-+++ b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
-@@ -1,6 +1,6 @@
----- a/drivers/net/wireless/rt2x00/rt2x00dev.c
--+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
--@@ -1283,7 +1283,7 @@ static inline void rt2x00lib_set_if_comb
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+@@ -1284,7 +1284,7 @@ static inline void rt2x00lib_set_if_comb
-  	 */
-  	if_limit = &rt2x00dev->if_limits_ap;
-  	if_limit->max = rt2x00dev->ops->max_ap_intf;
-diff --git a/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch b/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch
-index aaa8367..8ddf425 100644
---- a/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch
-+++ b/package/kernel/mac80211/patches/620-rt2x00-rt3352-rf-id.patch
-@@ -1,6 +1,6 @@
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -7841,10 +7841,11 @@ static int rt2800_init_eeprom(struct rt2
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -7818,10 +7818,11 @@ static int rt2800_init_eeprom(struct rt2
-  	 * RT53xx: defined in "EEPROM_CHIP_ID" field
-  	 */
-  	if (rt2x00_rt(rt2x00dev, RT3290) ||
-diff --git a/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch b/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
-index bb2fc1c..e3e4c98 100644
---- a/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
-+++ b/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -2321,6 +2321,8 @@ struct mac_iveiv_entry {
-  #define RFCSR30_RX_H20M			FIELD8(0x04)
-  #define RFCSR30_RX_VCM			FIELD8(0x18)
-@@ -9,9 +9,9 @@
-  
-  /*
-   * RFCSR 31:
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
--@@ -3551,8 +3551,13 @@ static void rt2800_config_channel(struct
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+@@ -3528,8 +3528,13 @@ static void rt2800_config_channel(struct
-  	    rt2x00_rf(rt2x00dev, RF5390) ||
-  	    rt2x00_rf(rt2x00dev, RF5392)) {
-  		rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
-diff --git a/package/kernel/mac80211/patches/622-rt2x00-fix-beacon-bit-balance.patch b/package/kernel/mac80211/patches/622-rt2x00-fix-beacon-bit-balance.patch
-new file mode 100644
-index 0000000..3cf6268
---- /dev/null
-+++ b/package/kernel/mac80211/patches/622-rt2x00-fix-beacon-bit-balance.patch
-@@ -0,0 +1,47 @@
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-+@@ -627,12 +627,8 @@ void rt2x00mac_bss_info_changed(struct i
-+ 		} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
-+ 			rt2x00dev->intf_beaconing++;
-+ 			intf->enable_beacon = true;
-+-			/*
-+-			 * Upload beacon to the H/W. This is only required on
-+-			 * USB devices. PCI devices fetch beacons periodically.
-+-			 */
-+-			if (rt2x00_is_usb(rt2x00dev))
-+-				rt2x00queue_update_beacon(rt2x00dev, vif);
-++
-++			rt2x00queue_update_beacon(rt2x00dev, vif);
-+ 
-+ 			if (rt2x00dev->intf_beaconing == 1) {
-+ 				/*
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+@@ -144,7 +144,8 @@ static void rt2x00lib_intf_scheduled_ite
-+ 
-+ 	if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags)) {
-+ 		mutex_lock(&intf->beacon_skb_mutex);
-+-		rt2x00queue_update_beacon(rt2x00dev, vif);
-++		if (intf->enable_beacon)
-++			rt2x00queue_update_beacon(rt2x00dev, vif);
-+ 		mutex_unlock(&intf->beacon_skb_mutex);
-+ 	}
-+ }
-+@@ -207,6 +208,7 @@ static void rt2x00lib_beaconupdate_iter(
-+ 					struct ieee80211_vif *vif)
-+ {
-+ 	struct rt2x00_dev *rt2x00dev = data;
-++	struct rt2x00_intf *intf = vif_to_intf(vif);
-+ 
-+ 	if (vif->type != NL80211_IFTYPE_AP &&
-+ 	    vif->type != NL80211_IFTYPE_ADHOC &&
-+@@ -220,7 +222,8 @@ static void rt2x00lib_beaconupdate_iter(
-+ 	 * never be called for USB devices.
-+ 	 */
-+ 	WARN_ON(rt2x00_is_usb(rt2x00dev));
-+-	rt2x00queue_update_beacon(rt2x00dev, vif);
-++	if (intf->enable_beacon)
-++		rt2x00queue_update_beacon(rt2x00dev, vif);
-+ }
-+ 
-+ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
-diff --git a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
-index f2a7663..a901a44 100644
---- a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
-+++ b/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
-@@ -1,6 +1,6 @@
----- a/drivers/net/wireless/mwl8k.c
--+++ b/drivers/net/wireless/mwl8k.c
--@@ -5678,6 +5678,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
-+--- a/drivers/net/wireless/marvell/mwl8k.c
-++++ b/drivers/net/wireless/marvell/mwl8k.c
-+@@ -5681,6 +5681,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
-  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
-  
-  static const struct pci_device_id mwl8k_pci_id_table[] = {
-diff --git a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
-index 9e29034..fd885cc 100644
---- a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
-+++ b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/libertas/cfg.c
--+++ b/drivers/net/wireless/libertas/cfg.c
-+--- a/drivers/net/wireless/marvell/libertas/cfg.c
-++++ b/drivers/net/wireless/marvell/libertas/cfg.c
- @@ -2084,6 +2084,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
-  		goto err_wiphy_new;
-  	}
-@@ -9,8 +9,8 @@
-  	lbs_deb_leave(LBS_DEB_CFG80211);
-  	return wdev;
-  
----- a/drivers/net/wireless/libertas/main.c
--+++ b/drivers/net/wireless/libertas/main.c
-+--- a/drivers/net/wireless/marvell/libertas/main.c
-++++ b/drivers/net/wireless/marvell/libertas/main.c
- @@ -987,6 +987,7 @@ struct lbs_private *lbs_add_card(void *c
-  		goto err_adapter;
-  	}
-diff --git a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
-index 252fa81..b67a95f 100644
---- a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
-+++ b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/libertas/cfg.c
--+++ b/drivers/net/wireless/libertas/cfg.c
-+--- a/drivers/net/wireless/marvell/libertas/cfg.c
-++++ b/drivers/net/wireless/marvell/libertas/cfg.c
- @@ -2174,6 +2174,8 @@ int lbs_cfg_register(struct lbs_private
-  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
-  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
-diff --git a/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch b/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch
-new file mode 100644
-index 0000000..74cd448
---- /dev/null
-+++ b/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch
-@@ -0,0 +1,17 @@
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
-+@@ -1215,10 +1215,10 @@ void b43_wireless_core_phy_pll_reset(str
-+ 	case B43_BUS_BCMA:
-+ 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
-+ 
-+-		bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
-+-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
-+-		bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
-+-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
-++		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
-++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
-++		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
-++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
-+ 		break;
-+ #endif
-+ #ifdef CPTCFG_B43_SSB
-diff --git a/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch b/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
-index 95867ef..fd9e6fd 100644
---- a/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
-+++ b/package/kernel/mac80211/patches/805-b43-gpio-mask-module-option.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/b43/b43.h
--+++ b/drivers/net/wireless/b43/b43.h
-+--- a/drivers/net/wireless/broadcom/b43/b43.h
-++++ b/drivers/net/wireless/broadcom/b43/b43.h
- @@ -839,6 +839,7 @@ struct b43_wldev {
-  	bool qos_enabled;		/* TRUE, if QoS is used. */
-  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
-@@ -8,9 +8,9 @@
-  
-  	/* PHY/Radio device. */
-  	struct b43_phy phy;
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
--@@ -76,6 +76,11 @@ MODULE_FIRMWARE("b43/ucode16_mimo.fw");
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
-+@@ -75,6 +75,11 @@ MODULE_FIRMWARE("b43/ucode16_mimo.fw");
-  MODULE_FIRMWARE("b43/ucode5.fw");
-  MODULE_FIRMWARE("b43/ucode9.fw");
-  
-diff --git a/package/kernel/mac80211/patches/810-b43_no_pio.patch b/package/kernel/mac80211/patches/810-b43_no_pio.patch
-index 0979100..79428c2 100644
---- a/package/kernel/mac80211/patches/810-b43_no_pio.patch
-+++ b/package/kernel/mac80211/patches/810-b43_no_pio.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/b43/Makefile
--+++ b/drivers/net/wireless/b43/Makefile
-+--- a/drivers/net/wireless/broadcom/b43/Makefile
-++++ b/drivers/net/wireless/broadcom/b43/Makefile
- @@ -17,7 +17,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
-  b43-y				+= sysfs.o
-  b43-y				+= xmit.o
-@@ -9,8 +9,8 @@
-  b43-y				+= rfkill.o
-  b43-y				+= ppr.o
-  b43-$(CPTCFG_B43_LEDS)		+= leds.o
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
- @@ -2008,10 +2008,12 @@ static void b43_do_interrupt_thread(stru
-  			dma_reason[0], dma_reason[1],
-  			dma_reason[2], dma_reason[3],
-@@ -24,8 +24,8 @@
-  		b43_controller_restart(dev, "DMA error");
-  		return;
-  	}
----- a/drivers/net/wireless/b43/pio.h
--+++ b/drivers/net/wireless/b43/pio.h
-+--- a/drivers/net/wireless/broadcom/b43/pio.h
-++++ b/drivers/net/wireless/broadcom/b43/pio.h
- @@ -150,7 +150,7 @@ static inline void b43_piorx_write32(str
-  	b43_write32(q->dev, q->mmio_base + offset, value);
-  }
-@@ -73,9 +73,9 @@
- +#endif /* CPTCFG_B43_PIO */
-  
-  #endif /* B43_PIO_H_ */
----- a/drivers/net/wireless/b43/Kconfig
--+++ b/drivers/net/wireless/b43/Kconfig
--@@ -118,7 +118,7 @@ config B43_BCMA_PIO
-+--- a/drivers/net/wireless/broadcom/b43/Kconfig
-++++ b/drivers/net/wireless/broadcom/b43/Kconfig
-+@@ -98,7 +98,7 @@ config B43_BCMA_PIO
-  	default y
-  
-  config B43_PIO
-diff --git a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
-index ac58dba..06c731f 100644
---- a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
-+++ b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
- @@ -1648,7 +1648,7 @@ static void b43_write_beacon_template(st
-  				  len, ram_offset, shm_size_offset, rate);
-  
-@@ -9,7 +9,7 @@
-  	antenna = b43_antenna_to_phyctl(antenna);
-  	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
-  	/* We can't send beacons with short preamble. Would get PHY errors. */
--@@ -3302,8 +3302,8 @@ static int b43_chip_init(struct b43_wlde
-+@@ -3300,8 +3300,8 @@ static int b43_chip_init(struct b43_wlde
-  
-  	/* Select the antennae */
-  	if (phy->ops->set_rx_antenna)
-@@ -20,7 +20,7 @@
-  
-  	if (phy->type == B43_PHYTYPE_B) {
-  		value16 = b43_read16(dev, 0x005E);
--@@ -4003,7 +4003,6 @@ static int b43_op_config(struct ieee8021
-+@@ -4001,7 +4001,6 @@ static int b43_op_config(struct ieee8021
-  	struct b43_wldev *dev = wl->current_dev;
-  	struct b43_phy *phy = &dev->phy;
-  	struct ieee80211_conf *conf = &hw->conf;
-@@ -28,7 +28,7 @@
-  	int err = 0;
-  
-  	mutex_lock(&wl->mutex);
--@@ -4046,11 +4045,9 @@ static int b43_op_config(struct ieee8021
-+@@ -4044,11 +4043,9 @@ static int b43_op_config(struct ieee8021
-  	}
-  
-  	/* Antennas for RX and management frame TX. */
-@@ -42,7 +42,7 @@
-  
-  	if (wl->radio_enabled != phy->radio_on) {
-  		if (wl->radio_enabled) {
--@@ -5213,6 +5210,47 @@ static int b43_op_get_survey(struct ieee
-+@@ -5209,6 +5206,47 @@ static int b43_op_get_survey(struct ieee
-  	return 0;
-  }
-  
-@@ -90,7 +90,7 @@
-  static const struct ieee80211_ops b43_hw_ops = {
-  	.tx			= b43_op_tx,
-  	.conf_tx		= b43_op_conf_tx,
--@@ -5234,6 +5272,8 @@ static const struct ieee80211_ops b43_hw
-+@@ -5230,6 +5268,8 @@ static const struct ieee80211_ops b43_hw
-  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
-  	.get_survey		= b43_op_get_survey,
-  	.rfkill_poll		= b43_rfkill_poll,
-@@ -99,7 +99,7 @@
-  };
-  
-  /* Hard-reset the chip. Do not call this directly.
--@@ -5542,6 +5582,8 @@ static int b43_one_core_attach(struct b4
-+@@ -5538,6 +5578,8 @@ static int b43_one_core_attach(struct b4
-  	if (!wldev)
-  		goto out;
-  
-@@ -108,7 +108,7 @@
-  	wldev->use_pio = b43_modparam_pio;
-  	wldev->dev = dev;
-  	wldev->wl = wl;
--@@ -5632,6 +5674,9 @@ static struct b43_wl *b43_wireless_init(
-+@@ -5628,6 +5670,9 @@ static struct b43_wl *b43_wireless_init(
-  
-  	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
-  
-@@ -118,8 +118,8 @@
-  	wl->hw_registred = false;
-  	hw->max_rates = 2;
-  	SET_IEEE80211_DEV(hw, dev->dev);
----- a/drivers/net/wireless/b43/b43.h
--+++ b/drivers/net/wireless/b43/b43.h
-+--- a/drivers/net/wireless/broadcom/b43/b43.h
-++++ b/drivers/net/wireless/broadcom/b43/b43.h
- @@ -840,6 +840,8 @@ struct b43_wldev {
-  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
-  	bool use_pio;			/* TRUE if next init should use PIO */
-diff --git a/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch b/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch
-index 9c51ac6..5899706 100644
---- a/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch
-+++ b/package/kernel/mac80211/patches/841-b43-reduce-number-of-RX-slots.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/b43/dma.h
--+++ b/drivers/net/wireless/b43/dma.h
-+--- a/drivers/net/wireless/broadcom/b43/dma.h
-++++ b/drivers/net/wireless/broadcom/b43/dma.h
- @@ -169,7 +169,7 @@ struct b43_dmadesc_generic {
-  
-  /* DMA engine tuning knobs */
-diff --git a/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch b/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
-index d4f9a88..8d0c041 100644
---- a/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
-+++ b/package/kernel/mac80211/patches/845-b43-only-use-gpio-0-1-for-led.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
- @@ -2899,6 +2899,14 @@ static int b43_gpio_init(struct b43_wlde
-  	} else if (dev->dev->chip_id == 0x5354) {
-  		/* Don't allow overtaking buttons GPIOs */
-diff --git a/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch
-index 9d1d419..ef7f3c9 100644
---- a/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch
-+++ b/package/kernel/mac80211/patches/847-b43-always-take-overlapping-devs.patch
-@@ -1,6 +1,6 @@
----- a/drivers/net/wireless/b43/main.c
--+++ b/drivers/net/wireless/b43/main.c
--@@ -118,7 +118,7 @@ static int b43_modparam_pio = 0;
-+--- a/drivers/net/wireless/broadcom/b43/main.c
-++++ b/drivers/net/wireless/broadcom/b43/main.c
-+@@ -117,7 +117,7 @@ static int b43_modparam_pio = 0;
-  module_param_named(pio, b43_modparam_pio, int, 0644);
-  MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
-  
-diff --git a/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch b/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
-index 185c427..3c93386 100644
---- a/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
-+++ b/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
--+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/channel.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/channel.c
- @@ -58,19 +58,12 @@
-  				 (((c) < 149) ? 3 : 4))))
-  
-diff --git a/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch b/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch
-deleted file mode 100644
-index 44bb779..0000000
---- a/package/kernel/mac80211/patches/860-brcmfmac-use-bcm47xx-platform-NVRAM-as-fallback.patch
-+++ /dev/null
-@@ -1,80 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Mon, 8 Jun 2015 16:59:31 +0200
--Subject: [PATCH] brcmfmac: use bcm47xx platform NVRAM as fallback
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-----
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -19,6 +19,9 @@
-- #include <linux/device.h>
-- #include <linux/firmware.h>
-- #include <linux/module.h>
--+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
--+#include <linux/bcm47xx_nvram.h>
--+#endif
-- 
-- #include "debug.h"
-- #include "firmware.h"
--@@ -424,17 +427,42 @@ struct brcmf_fw {
-- static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
-- {
-- 	struct brcmf_fw *fwctx = ctx;
--+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
--+	const u8 *bcm47xx_nvram = NULL;
--+	size_t bcm47xx_nvram_len;
--+#endif
--+	const u8 *data = NULL;
--+	size_t data_len;
-- 	u32 nvram_length = 0;
-- 	void *nvram = NULL;
-- 
-- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
---	if (!fw && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
--+	if (fw) {
--+		data = fw->data;
--+		data_len = fw->size;
--+	}
--+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
--+	else {
--+		bcm47xx_nvram = bcm47xx_nvram_get_contents(&bcm47xx_nvram_len);
--+		if (bcm47xx_nvram) {
--+			data = bcm47xx_nvram;
--+			data_len = bcm47xx_nvram_len;
--+			brcmf_err("Found platform NVRAM (%zu B)\n", data_len);
--+		}
--+	}
--+#endif
--+	if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-- 		goto fail;
-- 
---	if (fw) {
---		nvram = brcmf_fw_nvram_strip(fw->data, fw->size, &nvram_length,
--+	if (data) {
--+		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
-- 					     fwctx->domain_nr, fwctx->bus_nr);
---		release_firmware(fw);
--+		if (fw)
--+			release_firmware(fw);
--+#if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
--+		if (bcm47xx_nvram)
--+			bcm47xx_nvram_release_contents(bcm47xx_nvram);
--+#endif
-- 		if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-- 			goto fail;
-- 	}
----- a/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
--@@ -19,6 +19,8 @@
-- 
-- #include <linux/net.h>	/* net_ratelimit() */
-- 
--+#include <linux/net.h>
--+
-- /* message levels */
-- #define BRCMF_TRACE_VAL		0x00000002
-- #define BRCMF_INFO_VAL		0x00000004
-diff --git a/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch
-index 14f8a00..95d93ae 100644
---- a/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch
-+++ b/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch
-@@ -11,9 +11,9 @@ module loads successfully.
- Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
- ---
- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
--@@ -1226,6 +1226,7 @@ static int __init brcmfmac_module_init(v
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+@@ -1332,6 +1332,7 @@ static int __init brcmfmac_module_init(v
-  #endif
-  	if (!schedule_work(&brcmf_driver_work))
-  		return -EBUSY;
-@@ -21,9 +21,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  
-  	return 0;
-  }
----- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
--@@ -422,13 +422,14 @@ struct brcmf_fw {
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+@@ -418,6 +418,7 @@ struct brcmf_fw {
-  	u16 bus_nr;
-  	void (*done)(struct device *dev, const struct firmware *fw,
-  		     void *nvram_image, u32 nvram_len);
-@@ -31,16 +31,8 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  };
-  
-  static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
-- {
-- 	struct brcmf_fw *fwctx = ctx;
-- #if IS_ENABLED(CONFIG_BCM47XX_NVRAM)
---	const u8 *bcm47xx_nvram = NULL;
--+	u8 *bcm47xx_nvram = NULL;
-- 	size_t bcm47xx_nvram_len;
-- #endif
-- 	const u8 *data = NULL;
--@@ -468,6 +469,8 @@ static void brcmf_fw_request_nvram_done(
-- 	}
-+@@ -452,6 +453,8 @@ static void brcmf_fw_request_nvram_done(
-+ 		goto fail;
-  
-  	fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
- +	if (fwctx->completion)
-@@ -48,7 +40,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  	kfree(fwctx);
-  	return;
-  
--@@ -475,6 +478,8 @@ fail:
-+@@ -459,6 +462,8 @@ fail:
-  	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-  	release_firmware(fwctx->code);
-  	device_release_driver(fwctx->dev);
-@@ -57,7 +49,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  	kfree(fwctx);
-  }
-  
--@@ -490,6 +495,8 @@ static void brcmf_fw_request_code_done(c
-+@@ -474,6 +479,8 @@ static void brcmf_fw_request_code_done(c
-  	/* only requested code so done here */
-  	if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
-  		fwctx->done(fwctx->dev, fw, NULL, 0);
-@@ -66,16 +58,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  		kfree(fwctx);
-  		return;
-  	}
--@@ -504,6 +511,8 @@ static void brcmf_fw_request_code_done(c
-- 	/* when nvram is optional call .done() callback here */
-- 	if (fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL) {
-- 		fwctx->done(fwctx->dev, fw, NULL, 0);
--+		if (fwctx->completion)
--+			complete(fwctx->completion);
-- 		kfree(fwctx);
-- 		return;
-- 	}
--@@ -513,6 +522,8 @@ static void brcmf_fw_request_code_done(c
-+@@ -491,6 +498,8 @@ static void brcmf_fw_request_code_done(c
-  fail:
-  	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-  	device_release_driver(fwctx->dev);
-@@ -84,7 +67,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  	kfree(fwctx);
-  }
-  
--@@ -524,6 +535,8 @@ int brcmf_fw_get_firmwares_pcie(struct d
-+@@ -502,6 +511,8 @@ int brcmf_fw_get_firmwares_pcie(struct d
-  				u16 domain_nr, u16 bus_nr)
-  {
-  	struct brcmf_fw *fwctx;
-@@ -93,7 +76,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-  
-  	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
-  	if (!fw_cb || !code)
--@@ -544,9 +557,17 @@ int brcmf_fw_get_firmwares_pcie(struct d
-+@@ -522,9 +533,17 @@ int brcmf_fw_get_firmwares_pcie(struct d
-  	fwctx->domain_nr = domain_nr;
-  	fwctx->bus_nr = bus_nr;
-  
-diff --git a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
-index 32c4a6f..4295b4b 100644
---- a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
-+++ b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
-@@ -8,9 +8,9 @@ Content-Transfer-Encoding: 8bit
- Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
- ---
- 
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -608,9 +608,37 @@ static struct wireless_dev *brcmf_cfg802
-+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+@@ -615,9 +615,37 @@ static struct wireless_dev *brcmf_cfg802
-  						     u32 *flags,
-  						     struct vif_params *params)
-  {
-diff --git a/package/kernel/mac80211/patches/863-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch b/package/kernel/mac80211/patches/863-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
-deleted file mode 100644
-index d6b9e37..0000000
---- a/package/kernel/mac80211/patches/863-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
-+++ /dev/null
-@@ -1,65 +0,0 @@
--From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
--Date: Wed, 20 Jan 2016 16:35:12 +0100
--Subject: [PATCH] brcmfmac: fix setting primary channel for 80 MHz width
--MIME-Version: 1.0
--Content-Type: text/plain; charset=UTF-8
--Content-Transfer-Encoding: 8bit
--
--First of all it changes the way we calculate primary channel offset. If
--we use e.g. 80 MHz channel with primary frequency 5180 MHz (which means
--center frequency is 5210 MHz) it makes sense to calculate primary offset
--as -30 MHz.
--Then it fixes values we compare primary_offset with. We were comparing
--offset in MHz against -2 or 2 which was resulting in picking a wrong
--primary channel.
--
--Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-----
-- .../brcm80211/brcmfmac/cfg80211.c         | 23 ++++++++++------------
-- 1 file changed, 10 insertions(+), 13 deletions(-)
--
----- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--@@ -246,7 +246,7 @@ static u16 chandef_to_chanspec(struct br
-- 	brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
-- 		  ch->chan->center_freq, ch->center_freq1, ch->width);
-- 	ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
---	primary_offset = ch->center_freq1 - ch->chan->center_freq;
--+	primary_offset = ch->chan->center_freq - ch->center_freq1;
-- 	switch (ch->width) {
-- 	case NL80211_CHAN_WIDTH_20:
-- 	case NL80211_CHAN_WIDTH_20_NOHT:
--@@ -255,24 +255,21 @@ static u16 chandef_to_chanspec(struct br
-- 		break;
-- 	case NL80211_CHAN_WIDTH_40:
-- 		ch_inf.bw = BRCMU_CHAN_BW_40;
---		if (primary_offset < 0)
--+		if (primary_offset > 0)
-- 			ch_inf.sb = BRCMU_CHAN_SB_U;
-- 		else
-- 			ch_inf.sb = BRCMU_CHAN_SB_L;
-- 		break;
-- 	case NL80211_CHAN_WIDTH_80:
-- 		ch_inf.bw = BRCMU_CHAN_BW_80;
---		if (primary_offset < 0) {
---			if (primary_offset < -CH_10MHZ_APART)
---				ch_inf.sb = BRCMU_CHAN_SB_UU;
---			else
---				ch_inf.sb = BRCMU_CHAN_SB_UL;
---		} else {
---			if (primary_offset > CH_10MHZ_APART)
---				ch_inf.sb = BRCMU_CHAN_SB_LL;
---			else
---				ch_inf.sb = BRCMU_CHAN_SB_LU;
---		}
--+		if (primary_offset == -30)
--+			ch_inf.sb = BRCMU_CHAN_SB_LL;
--+		else if (primary_offset == -10)
--+			ch_inf.sb = BRCMU_CHAN_SB_LU;
--+		else if (primary_offset == 10)
--+			ch_inf.sb = BRCMU_CHAN_SB_UL;
--+		else
--+			ch_inf.sb = BRCMU_CHAN_SB_UU;
-- 		break;
-- 	case NL80211_CHAN_WIDTH_80P80:
-- 	case NL80211_CHAN_WIDTH_160:
-diff --git a/package/kernel/mac80211/patches/900-wlcore-Add-support-for-DT-platform-data.patch b/package/kernel/mac80211/patches/900-wlcore-Add-support-for-DT-platform-data.patch
-deleted file mode 100644
-index 856dea8..0000000
---- a/package/kernel/mac80211/patches/900-wlcore-Add-support-for-DT-platform-data.patch
-+++ /dev/null
-@@ -1,139 +0,0 @@
--When running with DT, we no longer have a board file that can set up the
--platform data for wlcore. Allow this data to be passed from DT.
--
--Since some platforms use a gpio-irq, add support for passing either the
--irq number or the gpio number. For the latter case, the driver will
--request the gpio and convert it to the irq number. If an irq is
--specified, it'll be used as is.
--
--[Arik - the pdev_data pointer does not belong to us and is freed when
--the device is released. Dereference to our private data first.]
--
--Signed-off-by: Ido Yariv <ido@wizery.com>
--Signed-off-by: Arik Nemtsov <arik@wizery.com>
-----
-- drivers/net/wireless/ti/wlcore/sdio.c | 71 ++++++++++++++++++++++++++++++++---
-- include/linux/wl12xx.h                |  3 +-
-- 2 files changed, 67 insertions(+), 7 deletions(-)
--
----- a/drivers/net/wireless/ti/wlcore/sdio.c
--+++ b/drivers/net/wireless/ti/wlcore/sdio.c
--@@ -34,6 +34,7 @@
-- #include <linux/wl12xx.h>
-- #include <linux/pm_runtime.h>
-- #include <linux/printk.h>
--+#include <linux/of.h>
-- 
-- #include "wlcore.h"
-- #include "wl12xx_80211.h"
--@@ -214,6 +215,61 @@ static struct wl1271_if_operations sdio_
-- 	.set_block_size = wl1271_sdio_set_block_size,
-- };
-- 
--+static const struct of_device_id wlcore_of_match[] = {
--+	{
--+		.compatible = "wlcore",
--+	},
--+	{}
--+};
--+MODULE_DEVICE_TABLE(of, wlcore_of_match);
--+
--+static struct wl12xx_platform_data *get_platform_data(struct device *dev)
--+{
--+	struct wl12xx_platform_data *pdata;
--+	struct device_node *np;
--+	u32 gpio;
--+
--+	pdata = wl12xx_get_platform_data();
--+	if (!IS_ERR(pdata))
--+		return kmemdup(pdata, sizeof(*pdata), GFP_KERNEL);
--+
--+	np = of_find_matching_node(NULL, wlcore_of_match);
--+	if (!np) {
--+		dev_err(dev, "No platform data set\n");
--+		return NULL;
--+	}
--+
--+	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
--+	if (!pdata) {
--+		dev_err(dev, "Can't allocate platform data\n");
--+		return NULL;
--+	}
--+
--+	if (of_property_read_u32(np, "irq", &pdata->irq)) {
--+		if (!of_property_read_u32(np, "gpio", &gpio) &&
--+		    !gpio_request_one(gpio, GPIOF_IN, "wlcore_irq")) {
--+			pdata->gpio = gpio;
--+			pdata->irq = gpio_to_irq(gpio);
--+		}
--+	}
--+
--+	/* Optional fields */
--+	pdata->use_eeprom = of_property_read_bool(np, "use-eeprom");
--+	of_property_read_u32(np, "board-ref-clock", &pdata->board_ref_clock);
--+	of_property_read_u32(np, "board-tcxo-clock", &pdata->board_tcxo_clock);
--+	of_property_read_u32(np, "platform-quirks", &pdata->platform_quirks);
--+
--+	return pdata;
--+}
--+
--+static void del_platform_data(struct wl12xx_platform_data *pdata)
--+{
--+	if (pdata->gpio)
--+		gpio_free(pdata->gpio);
--+
--+	kfree(pdata);
--+}
--+
-- static int wl1271_probe(struct sdio_func *func,
-- 				  const struct sdio_device_id *id)
-- {
--@@ -245,10 +301,10 @@ static int wl1271_probe(struct sdio_func
-- 	/* Use block mode for transferring over one block size of data */
-- 	func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
-- 
---	pdev_data.pdata = wl12xx_get_platform_data();
---	if (IS_ERR(pdev_data.pdata)) {
---		ret = PTR_ERR(pdev_data.pdata);
---		dev_err(glue->dev, "missing wlan platform data: %d\n", ret);
--+	pdev_data.pdata = get_platform_data(&func->dev);
--+	if (!pdev_data.pdata) {
--+		ret = -EINVAL;
--+		dev_err(glue->dev, "missing wlan platform data\n");
-- 		goto out_free_glue;
-- 	}
-- 
--@@ -279,7 +335,7 @@ static int wl1271_probe(struct sdio_func
-- 	if (!glue->core) {
-- 		dev_err(glue->dev, "can't allocate platform_device");
-- 		ret = -ENOMEM;
---		goto out_free_glue;
--+		goto out_free_pdata;
-- 	}
-- 
-- 	glue->core->dev.parent = &func->dev;
--@@ -313,6 +369,9 @@ static int wl1271_probe(struct sdio_func
-- out_dev_put:
-- 	platform_device_put(glue->core);
-- 
--+out_free_pdata:
--+	del_platform_data(pdev_data->pdata);
--+
-- out_free_glue:
-- 	kfree(glue);
-- 
--@@ -323,11 +382,14 @@ out:
-- static void wl1271_remove(struct sdio_func *func)
-- {
-- 	struct wl12xx_sdio_glue *glue = sdio_get_drvdata(func);
--+	struct wlcore_platdev_data *pdev_data = glue->core->dev.platform_data;
--+	struct wl12xx_platform_data *pdata = pdev_data->pdata;
-- 
-- 	/* Undo decrement done above in wl1271_probe */
-- 	pm_runtime_get_noresume(&func->dev);
-- 
-- 	platform_device_unregister(glue->core);
--+	del_platform_data(pdata);
-- 	kfree(glue);
-- }
-- 
-diff --git a/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch b/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch
-index e6b2d7b..bc9f799 100644
---- a/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch
-+++ b/package/kernel/mac80211/patches/910-00-rt2x00-enable-rt2800soc-for-mt7620.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/Kconfig
--+++ b/drivers/net/wireless/rt2x00/Kconfig
-+--- a/drivers/net/wireless/ralink/rt2x00/Kconfig
-++++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
- @@ -211,7 +211,7 @@ endif
-  config RT2800SOC
-  	tristate "Ralink WiSoC support"
-diff --git a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
-index 501910f..f2e21ea 100644
---- a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
-+++ b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
-@@ -1,5 +1,5 @@
----- a/drivers/net/wireless/rt2x00/rt2800.h
--+++ b/drivers/net/wireless/rt2x00/rt2800.h
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
- @@ -81,6 +81,7 @@
-  #define RF5372				0x5372
-  #define RF5390				0x5390
-@@ -62,8 +62,8 @@
-  /* TX_PWR_CFG_7 */
-  #define TX_PWR_CFG_7			0x13d4
-  #define TX_PWR_CFG_7_OFDM54_CH0		FIELD32(0x0000000f)
----- a/drivers/net/wireless/rt2x00/rt2800lib.c
--+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
- @@ -61,6 +61,8 @@
-  	rt2800_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
-  #define WAIT_FOR_RFCSR(__dev, __reg) \
-@@ -91,7 +91,8 @@
- +			rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM_MT7620, word);
- +			rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE_MT7620, 1);
- +			rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY_MT7620, 1);
--+
-+ 
-+-		rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
- +			rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
- +		}
- +		break;
-@@ -103,8 +104,7 @@
- +			rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
- +			rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 1);
- +			rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
-- 
---		rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
-++
- +			rt2800_register_write_lock(rt2x00dev, RF_CSR_CFG, reg);
- +		}
- +		break;
-@@ -210,7 +210,7 @@
-  	case RT5592:
-  		*txwi_size = TXWI_DESC_SIZE_5WORDS;
-  		*rxwi_size = RXWI_DESC_SIZE_6WORDS;
--@@ -3326,6 +3399,312 @@ static void rt2800_config_channel_rf55xx
-+@@ -3303,6 +3376,312 @@ static void rt2800_config_channel_rf55xx
-  	rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x19 : 0x7F);
-  }
-  
-@@ -258,6 +258,7 @@
- +	u32 mac_sys_ctrl, mac_status;
- +	u32 tx_pin = 0x00150F0F;
- +	struct hw_mode_spec *spec = &rt2x00dev->spec;
-++	struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
- +
- +	/* Frequeny plan setting */
- +	/*	
-@@ -383,7 +384,6 @@
- +		rfcsr &= (~0x4);
- +	rt2800_rfcsr_write(rt2x00dev, 28, rfcsr);
- +
--+	struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
- +	/*if (bScan == FALSE)*/
- +	if (conf_is_ht40(conf)) {
- +		txrx_agc_fc = rt2x00_get_field8(drv_data->calibration_bw40,
-@@ -523,7 +523,7 @@
-  static void rt2800_bbp_write_with_rx_chain(struct rt2x00_dev *rt2x00dev,
-  					   const unsigned int word,
-  					   const u8 value)
--@@ -3482,7 +3861,7 @@ static void rt2800_config_channel(struct
-+@@ -3459,7 +3838,7 @@ static void rt2800_config_channel(struct
-  				  struct channel_info *info)
-  {
-  	u32 reg;
-@@ -532,7 +532,7 @@
-  	u8 bbp, rfcsr;
-  
-  	info->default_power1 = rt2800_txpower_to_dev(rt2x00dev, rf->channel,
--@@ -3536,6 +3915,9 @@ static void rt2800_config_channel(struct
-+@@ -3513,6 +3892,9 @@ static void rt2800_config_channel(struct
-  	case RF5592:
-  		rt2800_config_channel_rf55xx(rt2x00dev, conf, rf, info);
-  		break;
-@@ -542,7 +542,7 @@
-  	default:
-  		rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
-  	}
--@@ -3638,7 +4020,7 @@ static void rt2800_config_channel(struct
-+@@ -3615,7 +3997,7 @@ static void rt2800_config_channel(struct
-  		else if (rt2x00_rt(rt2x00dev, RT3593) ||
-  			 rt2x00_rt(rt2x00dev, RT3883))
-  			rt2800_bbp_write(rt2x00dev, 82, 0x82);
-@@ -551,7 +551,7 @@
-  			rt2800_bbp_write(rt2x00dev, 82, 0xf2);
-  
-  		if (rt2x00_rt(rt2x00dev, RT3593) ||
--@@ -3660,7 +4042,7 @@ static void rt2800_config_channel(struct
-+@@ -3637,7 +4019,7 @@ static void rt2800_config_channel(struct
-  	if (rt2x00_rt(rt2x00dev, RT3572))
-  		rt2800_rfcsr_write(rt2x00dev, 8, 0);
-  
-@@ -560,7 +560,7 @@
-  
-  	switch (rt2x00dev->default_ant.tx_chain_num) {
-  	case 3:
--@@ -3709,6 +4091,7 @@ static void rt2800_config_channel(struct
-+@@ -3686,6 +4068,7 @@ static void rt2800_config_channel(struct
-  
-  	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
-  	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
-@@ -568,7 +568,7 @@
-  
-  	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
-  
--@@ -4725,6 +5108,14 @@ void rt2800_vco_calibration(struct rt2x0
-+@@ -4702,6 +5085,14 @@ void rt2800_vco_calibration(struct rt2x0
-  		rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
-  		rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
-  		break;
-@@ -583,7 +583,7 @@
-  	default:
-  		return;
-  	}
--@@ -5125,9 +5516,42 @@ static int rt2800_init_registers(struct
-+@@ -5102,9 +5493,42 @@ static int rt2800_init_registers(struct
-  	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
-  		   rt2x00_rt(rt2x00dev, RT5392) ||
-  		   rt2x00_rt(rt2x00dev, RT5592)) {
-@@ -629,7 +629,7 @@
-  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
-  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
-  	} else {
--@@ -6159,6 +6583,225 @@ static void rt2800_init_bbp_5592(struct
-+@@ -6136,6 +6560,225 @@ static void rt2800_init_bbp_5592(struct
-  		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
-  }
-  
-@@ -855,7 +855,7 @@
-  static void rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
-  {
-  	unsigned int i;
--@@ -6201,7 +6844,10 @@ static void rt2800_init_bbp(struct rt2x0
-+@@ -6178,7 +6821,10 @@ static void rt2800_init_bbp(struct rt2x0
-  		return;
-  	case RT5390:
-  	case RT5392:
-@@ -867,7 +867,7 @@
-  		break;
-  	case RT5592:
-  		rt2800_init_bbp_5592(rt2x00dev);
--@@ -7415,6 +8061,295 @@ static void rt2800_init_rfcsr_5592(struc
-+@@ -7392,6 +8038,296 @@ static void rt2800_init_rfcsr_5592(struc
-  	rt2800_led_open_drain_enable(rt2x00dev);
-  }
-  
-@@ -875,6 +875,8 @@
- +{
- +	u16 freq;
- +	u8 rfvalue;
-++	struct hw_mode_spec *spec = &rt2x00dev->spec;
-++
- +	/* Initialize RF central register to default value */
- +	rt2800_rfcsr_write(rt2x00dev, 0, 0x02);
- +	rt2800_rfcsr_write(rt2x00dev, 1, 0x03);
-@@ -921,7 +923,6 @@
- +	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
- +	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
- +
--+	struct hw_mode_spec *spec = &rt2x00dev->spec;
- +	rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
- +	if (spec->clk_is_20mhz)
- +		rt2800_rfcsr_write(rt2x00dev, 13, 0x03);
-@@ -1163,7 +1164,7 @@
-  static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
-  {
-  	if (rt2800_is_305x_soc(rt2x00dev)) {
--@@ -7450,7 +8385,10 @@ static void rt2800_init_rfcsr(struct rt2
-+@@ -7427,7 +8363,10 @@ static void rt2800_init_rfcsr(struct rt2
-  		rt2800_init_rfcsr_5350(rt2x00dev);
-  		break;
-  	case RT5390:
-@@ -1175,7 +1176,7 @@
-  		break;
-  	case RT5392:
-  		rt2800_init_rfcsr_5392(rt2x00dev);
--@@ -7882,6 +8820,7 @@ static int rt2800_init_eeprom(struct rt2
-+@@ -7859,6 +8798,7 @@ static int rt2800_init_eeprom(struct rt2
-  	case RF5390:
-  	case RF5392:
-  	case RF5592:
-@@ -1183,7 +1184,7 @@
-  		break;
-  	default:
-  		rt2x00_err(rt2x00dev, "Invalid RF chipset 0x%04x detected\n",
--@@ -8448,6 +9387,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8423,6 +9363,7 @@ static int rt2800_probe_hw_mode(struct r
-  	case RF5372:
-  	case RF5390:
-  	case RF5392:
-@@ -1191,7 +1192,7 @@
-  		spec->num_channels = 14;
-  		if (spec->clk_is_20mhz)
-  			spec->channels = rf_vals_xtal20mhz_3x;
--@@ -8588,6 +9528,7 @@ static int rt2800_probe_hw_mode(struct r
-+@@ -8563,6 +9504,7 @@ static int rt2800_probe_hw_mode(struct r
-  	case RF5372:
-  	case RF5390:
-  	case RF5392:
-diff --git a/package/kernel/mac80211/patches/920-ath10k_allow_fallback_to_board_bin_on_empty_otp_stream.patch b/package/kernel/mac80211/patches/920-ath10k_allow_fallback_to_board_bin_on_empty_otp_stream.patch
-deleted file mode 100644
-index 4c04d4f..0000000
---- a/package/kernel/mac80211/patches/920-ath10k_allow_fallback_to_board_bin_on_empty_otp_stream.patch
-+++ /dev/null
-@@ -1,20 +0,0 @@
----- a/drivers/net/wireless/ath/ath10k/core.c
--+++ b/drivers/net/wireless/ath/ath10k/core.c
--@@ -387,9 +387,14 @@ static int ath10k_download_and_run_otp(s
-- 
-- 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot otp execute result %d\n", result);
-- 
---	if (!skip_otp && result != 0) {
---		ath10k_err(ar, "otp calibration failed: %d", result);
---		return -EINVAL;
--+	if (!skip_otp) {
--+		if (result == 2) {
--+			ath10k_warn(ar, "otp stream is empty, using board.bin contents");
--+			return 0;
--+		} else if (result != 0) {
--+			ath10k_err(ar, "otp calibration failed: %d", result);
--+			return -EINVAL;
--+		}
-- 	}
-- 
-- 	return 0;
-diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
-index eed3814..8c6d720 100644
---- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
-+++ b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
-@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
- 
- --- a/drivers/net/wireless/ath/ath10k/core.c
- +++ b/drivers/net/wireless/ath/ath10k/core.c
--@@ -1323,6 +1323,16 @@ int ath10k_core_register(struct ath10k *
-+@@ -1914,6 +1914,16 @@ int ath10k_core_register(struct ath10k *
-  	ar->chip_id = chip_id;
-  	queue_work(ar->workqueue, &ar->register_work);
-  
-diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
-index 8003f86..281b447 100644
---- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
-+++ b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
-@@ -1,6 +1,6 @@
- --- a/drivers/net/wireless/ath/ath10k/mac.c
- +++ b/drivers/net/wireless/ath/ath10k/mac.c
--@@ -5416,6 +5416,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
-+@@ -7141,6 +7141,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
-  	return arvif_iter.arvif;
-  }
-  
-@@ -22,7 +22,7 @@
-  int ath10k_mac_register(struct ath10k *ar)
-  {
-  	static const u32 cipher_suites[] = {
--@@ -5590,6 +5605,12 @@ int ath10k_mac_register(struct ath10k *a
-+@@ -7357,6 +7372,12 @@ int ath10k_mac_register(struct ath10k *a
-  	ar->hw->wiphy->cipher_suites = cipher_suites;
-  	ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
-  
-diff --git a/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
-new file mode 100644
-index 0000000..357faee
---- /dev/null
-+++ b/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
-@@ -0,0 +1,20 @@
-+--- a/drivers/net/wireless/marvell/mwl8k.c
-++++ b/drivers/net/wireless/marvell/mwl8k.c
-+@@ -6264,6 +6264,8 @@ static int mwl8k_probe(struct pci_dev *p
-+ 
-+ 	priv->running_bsses = 0;
-+ 
-++	wait_for_completion(&priv->firmware_loading_complete);
-++
-+ 	return rc;
-+ 
-+ err_stop_firmware:
-+@@ -6297,8 +6299,6 @@ static void mwl8k_remove(struct pci_dev
-+ 		return;
-+ 	priv = hw->priv;
-+ 
-+-	wait_for_completion(&priv->firmware_loading_complete);
-+-
-+ 	if (priv->fw_state == FW_STATE_ERROR) {
-+ 		mwl8k_hw_reset(priv);
-+ 		goto unmap;
-diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
-index 5ede95a..c098832 100644
---- a/package/kernel/mt76/Makefile
-+++ b/package/kernel/mt76/Makefile
-@@ -1,7 +1,7 @@
- include $(TOPDIR)/rules.mk
- 
- PKG_NAME:=mt76
--PKG_VERSION:=2015-10-12
-+PKG_VERSION:=2016-02-08
- PKG_RELEASE=1
- 
- PKG_LICENSE:=GPLv2
-@@ -10,7 +10,7 @@ PKG_LICENSE_FILES:=
- PKG_SOURCE_URL:=https://github.com/openwrt/mt76
- PKG_SOURCE_PROTO:=git
- PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
--PKG_SOURCE_VERSION:=2f31d1e329dc43074a05782624195860c45b099a
-+PKG_SOURCE_VERSION:=84a312645c7b805255e6d7b6191e9f62142985d9
- PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
- 
- PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
-@@ -23,8 +23,10 @@ define KernelPackage/mt76
-   SUBMENU:=Wireless Drivers
-   TITLE:=MediaTek MT76x2 wireless driver
-   DEPENDS:=+kmod-mac80211 +@DRIVER_11N_SUPPORT @PCI_SUPPORT
--  FILES:=$(PKG_BUILD_DIR)/mt76pci.ko
--  AUTOLOAD:=$(call AutoLoad,50,mac80211 mt76pci)
-+  FILES:=\
-+	$(PKG_BUILD_DIR)/mt76.ko \
-+	$(PKG_BUILD_DIR)/mt76x2e.ko
-+  AUTOLOAD:=$(call AutoLoad,50,mac80211 mt76 mt76x2e)
- endef
- 
- NOSTDINC_FLAGS = \
-diff --git a/package/kernel/mt76/patches/001-backport_ieee80211_hw_set.patch b/package/kernel/mt76/patches/001-backport_ieee80211_hw_set.patch
-deleted file mode 100644
-index e94574d..0000000
---- a/package/kernel/mt76/patches/001-backport_ieee80211_hw_set.patch
-+++ /dev/null
-@@ -1,12 +0,0 @@
----- a/init.c
--+++ b/init.c
--@@ -16,6 +16,9 @@
-- #include "eeprom.h"
-- #include "mcu.h"
-- 
--+#define ieee80211_hw_set(hw, flag) \
--+	do { (hw)->flags |= IEEE80211_HW_##flag; } while(0)
--+
-- static bool
-- mt76_wait_for_mac(struct mt76_dev *dev)
-- {
-diff --git a/package/kernel/mt76/patches/002-disable_fast_xmit.patch b/package/kernel/mt76/patches/002-disable_fast_xmit.patch
-deleted file mode 100644
-index f7a011b..0000000
---- a/package/kernel/mt76/patches/002-disable_fast_xmit.patch
-+++ /dev/null
-@@ -1,10 +0,0 @@
----- a/init.c
--+++ b/init.c
--@@ -816,7 +816,6 @@ int mt76_register_device(struct mt76_dev
-- 	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
-- 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
-- 	ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
---	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
-- 
-- 	hw->sta_data_size = sizeof(struct mt76_sta);
-- 	hw->vif_data_size = sizeof(struct mt76_vif);
-diff --git a/package/kernel/mwlwifi/patches/100-drop_old_api.patch b/package/kernel/mwlwifi/patches/100-drop_old_api.patch
-new file mode 100644
-index 0000000..d2e149e
---- /dev/null
-+++ b/package/kernel/mwlwifi/patches/100-drop_old_api.patch
-@@ -0,0 +1,92 @@
-+--- a/main.c
-++++ b/main.c
-+@@ -418,11 +418,7 @@ static void mwl_set_ht_caps(struct mwl_p
-+ 	band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
-+ 	band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
-+ 
-+-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
-+-	hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
-+-#else
-+ 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
-+-#endif
-+ 	band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
-+ 	band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_4;
-+ 
-+@@ -524,29 +520,16 @@ static int mwl_wl_init(struct mwl_priv *
-+ 	hw->queues = SYSADPT_TX_WMM_QUEUES;
-+ 
-+ 	/* Set rssi values to dBm */
-+-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
-+-	hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_HAS_RATE_CONTROL;
-+-#else
-+ 	ieee80211_hw_set(hw, SIGNAL_DBM);
-+ 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
-+-#endif
-+ 
-+ 	/* Ask mac80211 not to trigger PS mode
-+ 	 * based on PM bit of incoming frames.
-+ 	 */
-+-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
-+-	hw->flags |= IEEE80211_HW_AP_LINK_PS;
-+-#else
-+ 	ieee80211_hw_set(hw, AP_LINK_PS);
-+-#endif
-+ 
-+-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0)
-+-	hw->flags |= IEEE80211_HW_SUPPORTS_PER_STA_GTK |
-+-		     IEEE80211_HW_MFP_CAPABLE;
-+-#else
-+ 	ieee80211_hw_set(hw, SUPPORTS_PER_STA_GTK);
-+ 	ieee80211_hw_set(hw, MFP_CAPABLE);
-+-#endif
-+ 
-+ 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
-+ 
-+--- a/dev.h
-++++ b/dev.h
-+@@ -484,10 +484,6 @@ static inline struct mwl_sta *mwl_dev_ge
-+ 	return (struct mwl_sta *)&sta->drv_priv;
-+ }
-+ 
-+-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)
-+-#define ether_addr_copy(dst, src) memcpy(dst, src, ETH_ALEN)
-+-#endif
-+-
-+ /* Defined in mac80211.c. */
-+ extern const struct ieee80211_ops mwl_mac80211_ops;
-+ 
-+--- a/mac80211.c
-++++ b/mac80211.c
-+@@ -572,19 +572,11 @@ static int mwl_mac80211_get_survey(struc
-+ 	return 0;
-+ }
-+ 
-+-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 3, 0)
-+-static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
-+-				     struct ieee80211_vif *vif,
-+-				     enum ieee80211_ampdu_mlme_action action,
-+-				     struct ieee80211_sta *sta,
-+-				     u16 tid, u16 *ssn, u8 buf_size)
-+-#else
-+ static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
-+ 				     struct ieee80211_vif *vif,
-+ 				     enum ieee80211_ampdu_mlme_action action,
-+ 				     struct ieee80211_sta *sta,
-+ 				     u16 tid, u16 *ssn, u8 buf_size, bool amsdu)
-+-#endif
-+ {
-+ 	int rc = 0;
-+ 	struct mwl_priv *priv = hw->priv;
-+--- a/rx.c
-++++ b/rx.c
-+@@ -232,10 +232,8 @@ static inline void mwl_rx_prepare_status
-+ 		status->flag |= RX_FLAG_VHT;
-+ 		if (bw == RX_RATE_INFO_HT40)
-+ 			status->flag |= RX_FLAG_40MHZ;
-+-#if LINUX_VERSION_CODE > KERNEL_VERSION(3, 18, 0)
-+ 		if (bw == RX_RATE_INFO_HT80)
-+ 			status->vht_flag |= RX_VHT_FLAG_80MHZ;
-+-#endif
-+ 		if (gi == RX_RATE_INFO_SHORT_INTERVAL)
-+ 			status->flag |= RX_FLAG_SHORT_GI;
-+ 		status->vht_nss = (nss + 1);
-diff --git a/package/kernel/mwlwifi/patches/110-api_sync.patch b/package/kernel/mwlwifi/patches/110-api_sync.patch
-new file mode 100644
-index 0000000..ed3e06a
---- /dev/null
-+++ b/package/kernel/mwlwifi/patches/110-api_sync.patch
-@@ -0,0 +1,19 @@
-+--- a/mac80211.c
-++++ b/mac80211.c
-+@@ -597,10 +597,13 @@ static int mwl_mac80211_get_survey(struc
-+ 
-+ static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
-+ 				     struct ieee80211_vif *vif,
-+-				     enum ieee80211_ampdu_mlme_action action,
-+-				     struct ieee80211_sta *sta,
-+-				     u16 tid, u16 *ssn, u8 buf_size, bool amsdu)
-++				     struct ieee80211_ampdu_params *params)
-+ {
-++	enum ieee80211_ampdu_mlme_action action = params->action;
-++	struct ieee80211_sta *sta = params->sta;
-++	u16 tid = params->tid;
-++	u16 *ssn = &params->ssn;
-++	u8 buf_size = params->buf_size;
-+ 	int rc = 0;
-+ 	struct mwl_priv *priv = hw->priv;
-+ 	struct mwl_ampdu_stream *stream;
-diff --git a/target/linux/generic/files/include/linux/ath9k_platform.h b/target/linux/generic/files/include/linux/ath9k_platform.h
-index 9fa7016..30ce216 100644
---- a/target/linux/generic/files/include/linux/ath9k_platform.h
-+++ b/target/linux/generic/files/include/linux/ath9k_platform.h
-@@ -36,6 +36,7 @@ struct ath9k_platform_data {
- 	bool tx_gain_buffalo;
- 	bool disable_2ghz;
- 	bool disable_5ghz;
-+	bool led_active_high;
- 
- 	int (*get_mac_revision)(void);
- 	int (*external_reset)(void);
-diff --git a/target/linux/generic/patches-3.18/030-backport_bcm47xx_nvram.patch b/target/linux/generic/patches-3.18/030-backport_bcm47xx_nvram.patch
-new file mode 100644
-index 0000000..7ae8b1d
---- /dev/null
-+++ b/target/linux/generic/patches-3.18/030-backport_bcm47xx_nvram.patch
-@@ -0,0 +1,52 @@
-+--- /dev/null
-++++ b/include/linux/bcm47xx_nvram.h
-+@@ -0,0 +1,49 @@
-++/*
-++ *  This program is free software; you can redistribute  it and/or modify it
-++ *  under  the terms of  the GNU General  Public License as published by the
-++ *  Free Software Foundation;  either version 2 of the  License, or (at your
-++ *  option) any later version.
-++ */
-++
-++#ifndef __BCM47XX_NVRAM_H
-++#define __BCM47XX_NVRAM_H
-++
-++#include <linux/types.h>
-++#include <linux/kernel.h>
-++#include <linux/vmalloc.h>
-++
-++#ifdef CONFIG_BCM47XX_NVRAM
-++int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
-++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
-++int bcm47xx_nvram_gpio_pin(const char *name);
-++char *bcm47xx_nvram_get_contents(size_t *val_len);
-++static inline void bcm47xx_nvram_release_contents(char *nvram)
-++{
-++	vfree(nvram);
-++};
-++#else
-++static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
-++{
-++	return -ENOTSUPP;
-++};
-++static inline int bcm47xx_nvram_getenv(const char *name, char *val,
-++				       size_t val_len)
-++{
-++	return -ENOTSUPP;
-++};
-++static inline int bcm47xx_nvram_gpio_pin(const char *name)
-++{
-++	return -ENOTSUPP;
-++};
-++
-++static inline char *bcm47xx_nvram_get_contents(size_t *val_len)
-++{
-++	return NULL;
-++};
-++
-++static inline void bcm47xx_nvram_release_contents(char *nvram)
-++{
-++};
-++#endif
-++
-++#endif /* __BCM47XX_NVRAM_H */
-diff --git a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
-index 8ec73d9..a74d9ee 100644
---- a/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
-+++ b/target/linux/generic/patches-3.18/032-bcma-from-4.6.patch
-@@ -1,6 +1,40 @@
- --- a/drivers/bcma/driver_chipcommon.c
- +++ b/drivers/bcma/driver_chipcommon.c
--@@ -190,6 +190,7 @@ u32 bcma_chipco_watchdog_timer_set(struc
-+@@ -15,6 +15,8 @@
-+ #include <linux/platform_device.h>
-+ #include <linux/bcma/bcma.h>
-+ 
-++static void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
-++
-+ static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
-+ 					 u32 mask, u32 value)
-+ {
-+@@ -115,6 +117,8 @@ int bcma_chipco_watchdog_register(struct
-+ 
-+ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
-+ {
-++	struct bcma_bus *bus = cc->core->bus;
-++
-+ 	if (cc->early_setup_done)
-+ 		return;
-+ 
-+@@ -129,6 +133,9 @@ void bcma_core_chipcommon_early_init(str
-+ 	if (cc->capabilities & BCMA_CC_CAP_PMU)
-+ 		bcma_pmu_early_init(cc);
-+ 
-++	if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
-++		bcma_chipco_serial_init(cc);
-++
-+ 	cc->early_setup_done = true;
-+ }
-+ 
-+@@ -185,11 +192,12 @@ u32 bcma_chipco_watchdog_timer_set(struc
-+ 			ticks = 2;
-+ 		else if (ticks > maxt)
-+ 			ticks = maxt;
-+-		bcma_cc_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
-+ 	} else {
-  		struct bcma_bus *bus = cc->core->bus;
-  
-  		if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4707 &&
-@@ -8,6 +42,232 @@
-  		    bus->chipinfo.id != BCMA_CHIP_ID_BCM53018)
-  			bcma_core_set_clockmode(cc->core,
-  						ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC);
-+@@ -314,9 +322,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcm
-+ 	return res;
-+ }
-+ 
-+-#ifdef CONFIG_BCMA_DRIVER_MIPS
-+-void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
-++static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
-+ {
-++#if IS_BUILTIN(CONFIG_BCM47XX)
-+ 	unsigned int irq;
-+ 	u32 baud_base;
-+ 	u32 i;
-+@@ -358,5 +366,5 @@ void bcma_chipco_serial_init(struct bcma
-+ 		ports[i].baud_base = baud_base;
-+ 		ports[i].reg_shift = 0;
-+ 	}
-++#endif /* CONFIG_BCM47XX */
-+ }
-+-#endif /* CONFIG_BCMA_DRIVER_MIPS */
-+--- a/drivers/bcma/driver_chipcommon_pmu.c
-++++ b/drivers/bcma/driver_chipcommon_pmu.c
-+@@ -15,44 +15,44 @@
-+ 
-+ u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset)
-+ {
-+-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
-+-	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
-+-	return bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
-++	bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_ADDR);
-++	return bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_DATA);
-+ }
-+ EXPORT_SYMBOL_GPL(bcma_chipco_pll_read);
-+ 
-+ void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset, u32 value)
-+ {
-+-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
-+-	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
-+-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
-++	bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_ADDR);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, value);
-+ }
-+ EXPORT_SYMBOL_GPL(bcma_chipco_pll_write);
-+ 
-+ void bcma_chipco_pll_maskset(struct bcma_drv_cc *cc, u32 offset, u32 mask,
-+ 			     u32 set)
-+ {
-+-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
-+-	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
-+-	bcma_cc_maskset32(cc, BCMA_CC_PLLCTL_DATA, mask, set);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
-++	bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_ADDR);
-++	bcma_pmu_maskset32(cc, BCMA_CC_PMU_PLLCTL_DATA, mask, set);
-+ }
-+ EXPORT_SYMBOL_GPL(bcma_chipco_pll_maskset);
-+ 
-+ void bcma_chipco_chipctl_maskset(struct bcma_drv_cc *cc,
-+ 				 u32 offset, u32 mask, u32 set)
-+ {
-+-	bcma_cc_write32(cc, BCMA_CC_CHIPCTL_ADDR, offset);
-+-	bcma_cc_read32(cc, BCMA_CC_CHIPCTL_ADDR);
-+-	bcma_cc_maskset32(cc, BCMA_CC_CHIPCTL_DATA, mask, set);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_CHIPCTL_ADDR, offset);
-++	bcma_pmu_read32(cc, BCMA_CC_PMU_CHIPCTL_ADDR);
-++	bcma_pmu_maskset32(cc, BCMA_CC_PMU_CHIPCTL_DATA, mask, set);
-+ }
-+ EXPORT_SYMBOL_GPL(bcma_chipco_chipctl_maskset);
-+ 
-+ void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc, u32 offset, u32 mask,
-+ 				u32 set)
-+ {
-+-	bcma_cc_write32(cc, BCMA_CC_REGCTL_ADDR, offset);
-+-	bcma_cc_read32(cc, BCMA_CC_REGCTL_ADDR);
-+-	bcma_cc_maskset32(cc, BCMA_CC_REGCTL_DATA, mask, set);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_REGCTL_ADDR, offset);
-++	bcma_pmu_read32(cc, BCMA_CC_PMU_REGCTL_ADDR);
-++	bcma_pmu_maskset32(cc, BCMA_CC_PMU_REGCTL_DATA, mask, set);
-+ }
-+ EXPORT_SYMBOL_GPL(bcma_chipco_regctl_maskset);
-+ 
-+@@ -60,18 +60,18 @@ static u32 bcma_pmu_xtalfreq(struct bcma
-+ {
-+ 	u32 ilp_ctl, alp_hz;
-+ 
-+-	if (!(bcma_cc_read32(cc, BCMA_CC_PMU_STAT) &
-++	if (!(bcma_pmu_read32(cc, BCMA_CC_PMU_STAT) &
-+ 	      BCMA_CC_PMU_STAT_EXT_LPO_AVAIL))
-+ 		return 0;
-+ 
-+-	bcma_cc_write32(cc, BCMA_CC_PMU_XTAL_FREQ,
-+-			BIT(BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT));
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_XTAL_FREQ,
-++			 BIT(BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT));
-+ 	usleep_range(1000, 2000);
-+ 
-+-	ilp_ctl = bcma_cc_read32(cc, BCMA_CC_PMU_XTAL_FREQ);
-++	ilp_ctl = bcma_pmu_read32(cc, BCMA_CC_PMU_XTAL_FREQ);
-+ 	ilp_ctl &= BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK;
-+ 
-+-	bcma_cc_write32(cc, BCMA_CC_PMU_XTAL_FREQ, 0);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_XTAL_FREQ, 0);
-+ 
-+ 	alp_hz = ilp_ctl * 32768 / 4;
-+ 	return (alp_hz + 50000) / 100000 * 100;
-+@@ -127,8 +127,8 @@ static void bcma_pmu2_pll_init0(struct b
-+ 		mask = (u32)~(BCMA_RES_4314_HT_AVAIL |
-+ 			      BCMA_RES_4314_MACPHY_CLK_AVAIL);
-+ 
-+-		bcma_cc_mask32(cc, BCMA_CC_PMU_MINRES_MSK, mask);
-+-		bcma_cc_mask32(cc, BCMA_CC_PMU_MAXRES_MSK, mask);
-++		bcma_pmu_mask32(cc, BCMA_CC_PMU_MINRES_MSK, mask);
-++		bcma_pmu_mask32(cc, BCMA_CC_PMU_MAXRES_MSK, mask);
-+ 		bcma_wait_value(cc->core, BCMA_CLKCTLST,
-+ 				BCMA_CLKCTLST_HAVEHT, 0, 20000);
-+ 		break;
-+@@ -140,7 +140,7 @@ static void bcma_pmu2_pll_init0(struct b
-+ 
-+ 	/* Flush */
-+ 	if (cc->pmu.rev >= 2)
-+-		bcma_cc_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);
-++		bcma_pmu_set32(cc, BCMA_CC_PMU_CTL, BCMA_CC_PMU_CTL_PLL_UPD);
-+ 
-+ 	/* TODO: Do we need to update OTP? */
-+ }
-+@@ -195,9 +195,9 @@ static void bcma_pmu_resources_init(stru
-+ 
-+ 	/* Set the resource masks. */
-+ 	if (min_msk)
-+-		bcma_cc_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
-+ 	if (max_msk)
-+-		bcma_cc_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
-+ 
-+ 	/*
-+ 	 * Add some delay; allow resources to come up and settle.
-+@@ -269,23 +269,33 @@ static void bcma_pmu_workarounds(struct
-+ 
-+ void bcma_pmu_early_init(struct bcma_drv_cc *cc)
-+ {
-++	struct bcma_bus *bus = cc->core->bus;
-+ 	u32 pmucap;
-+ 
-+-	pmucap = bcma_cc_read32(cc, BCMA_CC_PMU_CAP);
-++	if (cc->core->id.rev >= 35 &&
-++	    cc->capabilities_ext & BCMA_CC_CAP_EXT_AOB_PRESENT) {
-++		cc->pmu.core = bcma_find_core(bus, BCMA_CORE_PMU);
-++		if (!cc->pmu.core)
-++			bcma_warn(bus, "Couldn't find expected PMU core");
-++	}
-++	if (!cc->pmu.core)
-++		cc->pmu.core = cc->core;
-++
-++	pmucap = bcma_pmu_read32(cc, BCMA_CC_PMU_CAP);
-+ 	cc->pmu.rev = (pmucap & BCMA_CC_PMU_CAP_REVISION);
-+ 
-+-	bcma_debug(cc->core->bus, "Found rev %u PMU (capabilities 0x%08X)\n",
-+-		   cc->pmu.rev, pmucap);
-++	bcma_debug(bus, "Found rev %u PMU (capabilities 0x%08X)\n", cc->pmu.rev,
-++		   pmucap);
-+ }
-+ 
-+ void bcma_pmu_init(struct bcma_drv_cc *cc)
-+ {
-+ 	if (cc->pmu.rev == 1)
-+-		bcma_cc_mask32(cc, BCMA_CC_PMU_CTL,
-+-			      ~BCMA_CC_PMU_CTL_NOILPONW);
-++		bcma_pmu_mask32(cc, BCMA_CC_PMU_CTL,
-++				~BCMA_CC_PMU_CTL_NOILPONW);
-+ 	else
-+-		bcma_cc_set32(cc, BCMA_CC_PMU_CTL,
-+-			     BCMA_CC_PMU_CTL_NOILPONW);
-++		bcma_pmu_set32(cc, BCMA_CC_PMU_CTL,
-++			       BCMA_CC_PMU_CTL_NOILPONW);
-+ 
-+ 	bcma_pmu_pll_init(cc);
-+ 	bcma_pmu_resources_init(cc);
-+@@ -472,8 +482,8 @@ u32 bcma_pmu_get_cpu_clock(struct bcma_d
-+ static void bcma_pmu_spuravoid_pll_write(struct bcma_drv_cc *cc, u32 offset,
-+ 					 u32 value)
-+ {
-+-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
-+-	bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR, offset);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, value);
-+ }
-+ 
-+ void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
-+@@ -497,20 +507,20 @@ void bcma_pmu_spuravoid_pllupdate(struct
-+ 		       bus->chipinfo.id == BCMA_CHIP_ID_BCM53572) ? 6 : 0;
-+ 
-+ 		/* RMW only the P1 divider */
-+-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR,
-+ 				BCMA_CC_PMU_PLL_CTL0 + phypll_offset);
-+-		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
-++		tmp = bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_DATA);
-+ 		tmp &= (~(BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK));
-+ 		tmp |= (bcm5357_bcm43236_p1div[spuravoid] << BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT);
-+-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, tmp);
-+ 
-+ 		/* RMW only the int feedback divider */
-+-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_ADDR,
-+ 				BCMA_CC_PMU_PLL_CTL2 + phypll_offset);
-+-		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
-++		tmp = bcma_pmu_read32(cc, BCMA_CC_PMU_PLLCTL_DATA);
-+ 		tmp &= ~(BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK);
-+ 		tmp |= (bcm5357_bcm43236_ndiv[spuravoid]) << BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT;
-+-		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
-++		bcma_pmu_write32(cc, BCMA_CC_PMU_PLLCTL_DATA, tmp);
-+ 
-+ 		tmp = BCMA_CC_PMU_CTL_PLL_UPD;
-+ 		break;
-+@@ -646,7 +656,7 @@ void bcma_pmu_spuravoid_pllupdate(struct
-+ 		break;
-+ 	}
-+ 
-+-	tmp |= bcma_cc_read32(cc, BCMA_CC_PMU_CTL);
-+-	bcma_cc_write32(cc, BCMA_CC_PMU_CTL, tmp);
-++	tmp |= bcma_pmu_read32(cc, BCMA_CC_PMU_CTL);
-++	bcma_pmu_write32(cc, BCMA_CC_PMU_CTL, tmp);
-+ }
-+ EXPORT_SYMBOL_GPL(bcma_pmu_spuravoid_pllupdate);
- --- a/drivers/bcma/driver_chipcommon_sflash.c
- +++ b/drivers/bcma/driver_chipcommon_sflash.c
- @@ -38,6 +38,7 @@ static const struct bcma_sflash_tbl_e bc
-@@ -18,27 +278,6 @@
-  	{ NULL },
-  };
-  
----- a/drivers/bcma/driver_gpio.c
--+++ b/drivers/bcma/driver_gpio.c
--@@ -229,6 +229,7 @@ int bcma_gpio_init(struct bcma_drv_cc *c
-- 	case BCMA_CHIP_ID_BCM4707:
-- 	case BCMA_CHIP_ID_BCM5357:
-- 	case BCMA_CHIP_ID_BCM53572:
--+	case BCMA_CHIP_ID_BCM47094:
-- 		chip->ngpio	= 32;
-- 		break;
-- 	default:
----- a/drivers/bcma/host_pci.c
--+++ b/drivers/bcma/host_pci.c
--@@ -294,7 +294,7 @@ static const struct pci_device_id bcma_p
-- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
-- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
-- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) },
---	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4365) },
--+	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) },
-- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) },
-- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
-- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
- --- a/drivers/bcma/scan.c
- +++ b/drivers/bcma/scan.c
- @@ -98,6 +98,9 @@ static const struct bcma_device_id_name
-@@ -51,6 +290,32 @@
-  	{ BCMA_CORE_DEFAULT, "Default" },
-  };
-  
-+@@ -315,6 +318,8 @@ static int bcma_get_next_core(struct bcm
-+ 		switch (core->id.id) {
-+ 		case BCMA_CORE_4706_MAC_GBIT_COMMON:
-+ 		case BCMA_CORE_NS_CHIPCOMMON_B:
-++		case BCMA_CORE_PMU:
-++		case BCMA_CORE_GCI:
-+ 		/* Not used yet: case BCMA_CORE_OOB_ROUTER: */
-+ 			break;
-+ 		default:
-+--- a/drivers/net/wireless/b43/main.c
-++++ b/drivers/net/wireless/b43/main.c
-+@@ -1215,10 +1215,10 @@ void b43_wireless_core_phy_pll_reset(str
-+ 	case B43_BUS_BCMA:
-+ 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
-+ 
-+-		bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
-+-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
-+-		bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
-+-		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
-++		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
-++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
-++		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
-++		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
-+ 		break;
-+ #endif
-+ #ifdef CONFIG_B43_SSB
- --- a/include/linux/bcma/bcma.h
- +++ b/include/linux/bcma/bcma.h
- @@ -151,6 +151,8 @@ struct bcma_host_ops {
-@@ -70,3 +335,110 @@
-  #define BCMA_CHIP_ID_BCM53018	53018
-  
-  /* Board types (on PCI usually equals to the subsystem dev id) */
-+--- a/include/linux/bcma/bcma_driver_chipcommon.h
-++++ b/include/linux/bcma/bcma_driver_chipcommon.h
-+@@ -217,6 +217,11 @@
-+ #define	 BCMA_CC_CLKDIV_JTAG_SHIFT	8
-+ #define	 BCMA_CC_CLKDIV_UART		0x000000FF
-+ #define BCMA_CC_CAP_EXT			0x00AC		/* Capabilities */
-++#define  BCMA_CC_CAP_EXT_SECI_PRESENT	0x00000001
-++#define  BCMA_CC_CAP_EXT_GSIO_PRESENT	0x00000002
-++#define  BCMA_CC_CAP_EXT_GCI_PRESENT	0x00000004
-++#define  BCMA_CC_CAP_EXT_SECI_PUART_PRESENT		0x00000008    /* UART present */
-++#define  BCMA_CC_CAP_EXT_AOB_PRESENT	0x00000040
-+ #define BCMA_CC_PLLONDELAY		0x00B0		/* Rev >= 4 only */
-+ #define BCMA_CC_FREFSELDELAY		0x00B4		/* Rev >= 4 only */
-+ #define BCMA_CC_SLOWCLKCTL		0x00B8		/* 6 <= Rev <= 9 only */
-+@@ -351,12 +356,12 @@
-+ #define BCMA_CC_PMU_RES_REQTS		0x0640 /* PMU res req timer sel */
-+ #define BCMA_CC_PMU_RES_REQT		0x0644 /* PMU res req timer */
-+ #define BCMA_CC_PMU_RES_REQM		0x0648 /* PMU res req mask */
-+-#define BCMA_CC_CHIPCTL_ADDR		0x0650
-+-#define BCMA_CC_CHIPCTL_DATA		0x0654
-+-#define BCMA_CC_REGCTL_ADDR		0x0658
-+-#define BCMA_CC_REGCTL_DATA		0x065C
-+-#define BCMA_CC_PLLCTL_ADDR		0x0660
-+-#define BCMA_CC_PLLCTL_DATA		0x0664
-++#define BCMA_CC_PMU_CHIPCTL_ADDR	0x0650
-++#define BCMA_CC_PMU_CHIPCTL_DATA	0x0654
-++#define BCMA_CC_PMU_REGCTL_ADDR		0x0658
-++#define BCMA_CC_PMU_REGCTL_DATA		0x065C
-++#define BCMA_CC_PMU_PLLCTL_ADDR		0x0660
-++#define BCMA_CC_PMU_PLLCTL_DATA		0x0664
-+ #define BCMA_CC_PMU_STRAPOPT		0x0668 /* (corerev >= 28) */
-+ #define BCMA_CC_PMU_XTAL_FREQ		0x066C /* (pmurev >= 10) */
-+ #define  BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK	0x00001FFF
-+@@ -566,6 +571,7 @@
-+  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
-+  */
-+ struct bcma_chipcommon_pmu {
-++	struct bcma_device *core;	/* Can be separated core or just ChipCommon one */
-+ 	u8 rev;			/* PMU revision */
-+ 	u32 crystalfreq;	/* The active crystal frequency (in kHz) */
-+ };
-+@@ -663,6 +669,19 @@ struct bcma_drv_cc_b {
-+ #define bcma_cc_maskset32(cc, offset, mask, set) \
-+ 	bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
-+ 
-++/* PMU registers access */
-++#define bcma_pmu_read32(cc, offset) \
-++	bcma_read32((cc)->pmu.core, offset)
-++#define bcma_pmu_write32(cc, offset, val) \
-++	bcma_write32((cc)->pmu.core, offset, val)
-++
-++#define bcma_pmu_mask32(cc, offset, mask) \
-++	bcma_pmu_write32(cc, offset, bcma_pmu_read32(cc, offset) & (mask))
-++#define bcma_pmu_set32(cc, offset, set) \
-++	bcma_pmu_write32(cc, offset, bcma_pmu_read32(cc, offset) | (set))
-++#define bcma_pmu_maskset32(cc, offset, mask, set) \
-++	bcma_pmu_write32(cc, offset, (bcma_pmu_read32(cc, offset) & (mask)) | (set))
-++
-+ extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
-+ 
-+ extern u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc);
-+--- a/drivers/bcma/bcma_private.h
-++++ b/drivers/bcma/bcma_private.h
-+@@ -47,7 +47,6 @@ void bcma_core_chipcommon_early_init(str
-+ void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
-+ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
-+ #ifdef CONFIG_BCMA_DRIVER_MIPS
-+-void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
-+ extern struct platform_device bcma_pflash_dev;
-+ #endif /* CONFIG_BCMA_DRIVER_MIPS */
-+ 
-+--- a/drivers/bcma/driver_gpio.c
-++++ b/drivers/bcma/driver_gpio.c
-+@@ -229,6 +229,7 @@ int bcma_gpio_init(struct bcma_drv_cc *c
-+ 	case BCMA_CHIP_ID_BCM4707:
-+ 	case BCMA_CHIP_ID_BCM5357:
-+ 	case BCMA_CHIP_ID_BCM53572:
-++	case BCMA_CHIP_ID_BCM47094:
-+ 		chip->ngpio	= 32;
-+ 		break;
-+ 	default:
-+--- a/drivers/bcma/driver_mips.c
-++++ b/drivers/bcma/driver_mips.c
-+@@ -328,12 +328,9 @@ static void bcma_core_mips_flash_detect(
-+ 
-+ void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
-+ {
-+-	struct bcma_bus *bus = mcore->core->bus;
-+-
-+ 	if (mcore->early_setup_done)
-+ 		return;
-+ 
-+-	bcma_chipco_serial_init(&bus->drv_cc);
-+ 	bcma_core_mips_flash_detect(mcore);
-+ 
-+ 	mcore->early_setup_done = true;
-+--- a/drivers/bcma/host_pci.c
-++++ b/drivers/bcma/host_pci.c
-+@@ -294,7 +294,7 @@ static const struct pci_device_id bcma_p
-+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
-+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
-+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) },
-+-	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4365) },
-++	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) },
-+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) },
-+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
-+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
diff --git a/patches/openwrt/0010-iwinfo-update-NanoStation-Loco-txpower-offsets.patch b/patches/openwrt/0008-iwinfo-update-NanoStation-Loco-txpower-offsets.patch
similarity index 100%
rename from patches/openwrt/0010-iwinfo-update-NanoStation-Loco-txpower-offsets.patch
rename to patches/openwrt/0008-iwinfo-update-NanoStation-Loco-txpower-offsets.patch
diff --git a/patches/openwrt/0016-hostapd-prevent-channel-switch-for-5GHz.patch b/patches/openwrt/0009-hostapd-prevent-channel-switch-for-5GHz.patch
similarity index 100%
rename from patches/openwrt/0016-hostapd-prevent-channel-switch-for-5GHz.patch
rename to patches/openwrt/0009-hostapd-prevent-channel-switch-for-5GHz.patch
diff --git a/patches/openwrt/0023-ath9k-add-HSR-tuner-support-for-UniFi-Outdoor-Plus.patch b/patches/openwrt/0010-ath9k-add-HSR-tuner-support-for-UniFi-Outdoor-Plus.patch
similarity index 100%
rename from patches/openwrt/0023-ath9k-add-HSR-tuner-support-for-UniFi-Outdoor-Plus.patch
rename to patches/openwrt/0010-ath9k-add-HSR-tuner-support-for-UniFi-Outdoor-Plus.patch
diff --git a/patches/openwrt/0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch b/patches/openwrt/0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch
deleted file mode 100644
index 903e7e5f..00000000
--- a/patches/openwrt/0011-ar71xx-add-support-for-tp-link-wr740n-v5.0-EU.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 21 Jun 2015 22:50:48 +0200
-Subject: ar71xx: add support for tp-link wr740n v5.0 (EU)
-
-TP-Link ships wr740n v5.0 to Romania (so probably everywhere except
-China) with 4 MB flash and 32 MB memory (confirmed by their local
-support). This patch adds support for the v5.0 clone of v4, i just
-tested it on my own v5.0 router and it works.
-
-Signed-off-by: Daniel Petre <daniel.petre@posteo.net>
-
-diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
-index 4336697..1fe88d5 100644
---- a/target/linux/ar71xx/image/Makefile
-+++ b/target/linux/ar71xx/image/Makefile
-@@ -501,6 +501,14 @@ define Device/tl-wr740n-v4
-     CONSOLE := ttyATH0,115200
- endef
- 
-+define Device/tl-wr740n-v5
-+    $(Device/tplink-4mlzma)
-+    BOARDNAME := TL-WR741ND-v4
-+    DEVICE_PROFILE := TLWR740
-+    TPLINK_HWID := 0x07400005
-+    CONSOLE := ttyATH0,115200
-+endef
-+
- define Device/tl-wr741nd-v1
-     $(Device/tplink-4m)
-     BOARDNAME := TL-WR741ND
-@@ -530,7 +538,7 @@ define Device/tl-wr743nd-v2
-     TPLINK_HWID := 0x07430002
-     CONSOLE := ttyATH0,115200
- endef
--TARGET_DEVICES += tl-wr740n-v4 tl-wr741nd-v1 tl-wr741nd-v2 tl-wr741nd-v4 tl-wr743nd-v2
-+TARGET_DEVICES += tl-wr740n-v4 tl-wr740n-v5 tl-wr741nd-v1 tl-wr741nd-v2 tl-wr741nd-v4 tl-wr743nd-v2
- 
- define Device/tl-wr841n-v8
-     $(Device/tplink-4mlzma)
diff --git a/patches/openwrt/0029-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch b/patches/openwrt/0011-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch
similarity index 100%
rename from patches/openwrt/0029-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch
rename to patches/openwrt/0011-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch
diff --git a/patches/openwrt/0012-ar71xx-add-support-for-TL-WR741ND-v5.patch b/patches/openwrt/0012-ar71xx-add-support-for-TL-WR741ND-v5.patch
deleted file mode 100644
index 94af335c..00000000
--- a/patches/openwrt/0012-ar71xx-add-support-for-TL-WR741ND-v5.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 21 Jun 2015 22:48:04 +0200
-Subject: ar71xx: add support for TL-WR741ND v5
-
-This device is identical to the TL-WR740N v5, it even uses the same HWID (which
-wasn't the case for older TL-WR741ND revisions).
-
-diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
-index 1fe88d5..78d35e1 100644
---- a/target/linux/ar71xx/image/Makefile
-+++ b/target/linux/ar71xx/image/Makefile
-@@ -531,6 +531,14 @@ define Device/tl-wr741nd-v4
-     CONSOLE := ttyATH0,115200
- endef
- 
-+define Device/tl-wr741nd-v5
-+    $(Device/tplink-4mlzma)
-+    BOARDNAME := TL-WR741ND-v4
-+    DEVICE_PROFILE := TLWR741
-+    TPLINK_HWID := 0x07400005
-+    CONSOLE := ttyATH0,115200
-+endef
-+
- define Device/tl-wr743nd-v2
-     $(Device/tplink-4mlzma)
-     BOARDNAME := TL-WR741ND-v4
-@@ -538,7 +546,7 @@ define Device/tl-wr743nd-v2
-     TPLINK_HWID := 0x07430002
-     CONSOLE := ttyATH0,115200
- endef
--TARGET_DEVICES += tl-wr740n-v4 tl-wr740n-v5 tl-wr741nd-v1 tl-wr741nd-v2 tl-wr741nd-v4 tl-wr743nd-v2
-+TARGET_DEVICES += tl-wr740n-v4 tl-wr740n-v5 tl-wr741nd-v1 tl-wr741nd-v2 tl-wr741nd-v4 tl-wr741nd-v5 tl-wr743nd-v2
- 
- define Device/tl-wr841n-v8
-     $(Device/tplink-4mlzma)
diff --git a/patches/openwrt/0035-lua-fix-installation-of-headers-for-host-build.patch b/patches/openwrt/0012-lua-fix-installation-of-headers-for-host-build.patch
similarity index 100%
rename from patches/openwrt/0035-lua-fix-installation-of-headers-for-host-build.patch
rename to patches/openwrt/0012-lua-fix-installation-of-headers-for-host-build.patch
diff --git a/patches/openwrt/0036-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch b/patches/openwrt/0013-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch
similarity index 100%
rename from patches/openwrt/0036-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch
rename to patches/openwrt/0013-kernel-fs-seq_file-fallback-to-vmalloc-instead-of-oom-kill-processes.patch
diff --git a/patches/openwrt/0013-sunxi-fix-uboot-install-location.patch b/patches/openwrt/0013-sunxi-fix-uboot-install-location.patch
deleted file mode 100644
index 71824b76..00000000
--- a/patches/openwrt/0013-sunxi-fix-uboot-install-location.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 16 Jul 2015 22:01:02 +0200
-Subject: sunxi: fix uboot install location
-
-Install uboot files to KERNEL_BUILD_DIR instead of BIN_DIR to fix the
-ImageBuilder. Similar fixes are necessary for many (all?) other uboot
-targets.
-
-Also remove the DTS copy command, BIN_DIR was unnecessarily cluttered with
-DTS files unrelated to the chosen profile.
-
-diff --git a/package/boot/uboot-sunxi/Makefile b/package/boot/uboot-sunxi/Makefile
-index 14ba922..9032600 100644
---- a/package/boot/uboot-sunxi/Makefile
-+++ b/package/boot/uboot-sunxi/Makefile
-@@ -6,6 +6,7 @@
- #
- 
- include $(TOPDIR)/rules.mk
-+include $(INCLUDE_DIR)/kernel.mk
- 
- PKG_NAME:=u-boot
- PKG_VERSION:=2015.01
-@@ -16,7 +17,7 @@ PKG_SOURCE_URL:= \
- 
- PKG_MD5SUM:=7f08dc9e98a71652bd6968888ed6ec95
- 
--PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
-+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
- 
- PKG_LICENSE:=GPL-2.0 GPL-2.0+
- PKG_LICENSE_FILES:=Licenses/README
-@@ -136,16 +137,16 @@ define Build/Compile
- endef
- 
- define Package/uboot/install/default
--	$(INSTALL_DIR) $(BIN_DIR)/uboot-$(BOARD)-$(1)
- 	$(CP) $(PKG_BUILD_DIR)/u-boot.bin \
--		$(BIN_DIR)/uboot-$(BOARD)-$(1)/openwrt-$(BOARD)-$(1)-u-boot.bin
-+		$(KERNEL_BUILD_DIR)/uboot-$(BOARD)-$(1)-u-boot.bin
- 	$(CP) $(PKG_BUILD_DIR)/spl/sunxi-spl.bin \
--		$(BIN_DIR)/uboot-$(BOARD)-$(1)/openwrt-$(BOARD)-$(1)-spl.bin
-+		$(KERNEL_BUILD_DIR)/uboot-$(BOARD)-$(1)-spl.bin
- 	$(CP) $(PKG_BUILD_DIR)/u-boot-sunxi-with-spl.bin \
--		$(BIN_DIR)/uboot-$(BOARD)-$(1)/openwrt-$(BOARD)-$(1)-u-boot-with-spl.bin
-+		$(KERNEL_BUILD_DIR)/uboot-$(BOARD)-$(1)-u-boot-with-spl.bin
- 	$(CP) uEnv.txt \
--		$(BIN_DIR)/uboot-$(BOARD)-$(1)/openwrt-$(BOARD)-$(1)-uEnv.txt
--	mkimage -C none -A arm -T script -d $(BIN_DIR)/uboot-$(BOARD)-$(1)/openwrt-$(BOARD)-$(1)-uEnv.txt $(BIN_DIR)/uboot-$(BOARD)-$(1)/openwrt-$(BOARD)-$(1)-boot.scr
-+		$(KERNEL_BUILD_DIR)/uboot-$(BOARD)-$(1)-uEnv.txt
-+	mkimage -C none -A arm -T script -d $(KERNEL_BUILD_DIR)/uboot-$(BOARD)-$(1)-uEnv.txt \
-+		$(KERNEL_BUILD_DIR)/uboot-$(BOARD)-$(1)-boot.scr
- endef
- 
- define Package/uboot/install/template
-diff --git a/target/linux/sunxi/image/Makefile b/target/linux/sunxi/image/Makefile
-index 6fcd61f..19ab935 100644
---- a/target/linux/sunxi/image/Makefile
-+++ b/target/linux/sunxi/image/Makefile
-@@ -11,28 +11,12 @@ include $(INCLUDE_DIR)/host.mk
- FAT32_BLOCK_SIZE=1024
- FAT32_BLOCKS=$(shell echo $$(($(CONFIG_SUNXI_SD_BOOT_PARTSIZE)*1024*1024/$(FAT32_BLOCK_SIZE))))
- 
--BOARDS:= \
--	sun4i-a10-cubieboard \
--	sun4i-a10-olinuxino-lime \
--	sun4i-a10-pcduino \
--	sun5i-a13-olinuxino \
--	sun6i-a31-colombus \
--	sun6i-a31-m9 \
--	sun7i-a20-bananapi \
--	sun7i-a20-bananapro \
--	sun7i-a20-cubieboard2 \
--	sun7i-a20-cubietruck \
--	sun7i-a20-olinuxino-lime \
--	sun7i-a20-olinuxino-micro \
--	sun7i-a20-pcduino3 \
--	sun7i-a20-lamobo-r1
--
- define Image/BuildKernel
- 	mkimage -A arm -O linux -T kernel -C none \
- 		-a 0x40008000 -e 0x40008000 \
- 		-n 'ARM OpenWrt Linux-$(LINUX_VERSION)' \
- 		-d $(KDIR)/zImage $(BIN_DIR)/$(IMG_PREFIX)-uImage
--	
-+
-     ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
- 	$(CP) $(KDIR)/zImage-initramfs $(BIN_DIR)/$(IMG_PREFIX)-zImage-initramfs
- 	echo -ne '\x00\x00\x00\x00' >> $(BIN_DIR)/$(IMG_PREFIX)-zImage-initramfs
-@@ -42,27 +26,23 @@ define Image/BuildKernel
- 		$(BIN_DIR)/$(IMG_PREFIX)-uImage-initramfs \
- 	)
-     endif
--
--	$(foreach board,$(BOARDS),
--		$(CP) $(DTS_DIR)/$(board).dtb $(BIN_DIR)/
--	)
- endef
- 
- define Image/Build/SDCard
- 	rm -f $(KDIR)/boot.img
- 	mkdosfs $(KDIR)/boot.img -C $(FAT32_BLOCKS)
--	
--	mcopy -i $(KDIR)/boot.img $(BIN_DIR)/uboot-sunxi-$(PROFILE)/$(IMG_PREFIX)-$(PROFILE)-boot.scr ::boot.scr
--	mcopy -i $(KDIR)/boot.img $(BIN_DIR)/$(2).dtb ::dtb
-+
-+	mcopy -i $(KDIR)/boot.img $(KDIR)/uboot-sunxi-$(PROFILE)-boot.scr ::boot.scr
-+	mcopy -i $(KDIR)/boot.img $(DTS_DIR)/$(2).dtb ::dtb
- 	mcopy -i $(KDIR)/boot.img $(BIN_DIR)/$(IMG_PREFIX)-uImage ::uImage
--	
-+
- 	./gen_sunxi_sdcard_img.sh \
- 		$(BIN_DIR)/$(IMG_PREFIX)-$(PROFILE)-sdcard-vfat-$(1).img \
- 		$(KDIR)/boot.img \
- 		$(KDIR)/root.$(1) \
- 		$(CONFIG_SUNXI_SD_BOOT_PARTSIZE) \
- 		$(CONFIG_TARGET_ROOTFS_PARTSIZE) \
--		$(BIN_DIR)/uboot-sunxi-$(PROFILE)/$(IMG_PREFIX)-$(PROFILE)-u-boot-with-spl.bin
-+		$(KDIR)/uboot-sunxi-$(PROFILE)-u-boot-with-spl.bin
- endef
- 
- define Image/Build/Profile/A10-OLinuXino-Lime
-@@ -124,7 +104,7 @@ endef
- define Image/Build
- 	$(call Image/Build/$(1),$(1))
- 	$(call Image/Build/Profile/$(PROFILE),$(1))
--	
-+
- 	dd if=$(KDIR)/root.$(1) of=$(BIN_DIR)/$(IMG_PREFIX)-root.$(1) bs=128k conv=sync
- endef
- 
diff --git a/patches/openwrt/0039-fix-UBNT-XM-model-detection.patch b/patches/openwrt/0014-fix-UBNT-XM-model-detection.patch
similarity index 100%
rename from patches/openwrt/0039-fix-UBNT-XM-model-detection.patch
rename to patches/openwrt/0014-fix-UBNT-XM-model-detection.patch
diff --git a/patches/openwrt/0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch b/patches/openwrt/0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch
deleted file mode 100644
index d919e6e4..00000000
--- a/patches/openwrt/0014-sunxi-respect-CONFIG_TARGET_IMAGES_GZIP.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 16 Jul 2015 22:13:59 +0200
-Subject: sunxi: respect CONFIG_TARGET_IMAGES_GZIP
-
-The ext4 images are huge uncompressed.
-
-diff --git a/target/linux/sunxi/image/Makefile b/target/linux/sunxi/image/Makefile
-index 19ab935..d3f4409 100644
---- a/target/linux/sunxi/image/Makefile
-+++ b/target/linux/sunxi/image/Makefile
-@@ -43,6 +43,10 @@ define Image/Build/SDCard
- 		$(CONFIG_SUNXI_SD_BOOT_PARTSIZE) \
- 		$(CONFIG_TARGET_ROOTFS_PARTSIZE) \
- 		$(KDIR)/uboot-sunxi-$(PROFILE)-u-boot-with-spl.bin
-+
-+  ifneq ($(CONFIG_TARGET_IMAGES_GZIP),)
-+	gzip -f9n $(BIN_DIR)/$(IMG_PREFIX)-$(PROFILE)-sdcard-vfat-$(1).img
-+  endif
- endef
- 
- define Image/Build/Profile/A10-OLinuXino-Lime
diff --git a/patches/openwrt/0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch b/patches/openwrt/0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch
deleted file mode 100644
index 56d3d547..00000000
--- a/patches/openwrt/0015-odhcp6c-add-option-sourcefilter-to-disable-source-filter.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sat, 18 Jul 2015 17:13:23 +0200
-Subject: odhcp6c: add option "sourcefilter" to disable source filter
-
-Signed-off-by: Steven Barth <steven@midlink.org>
-
-diff --git a/package/network/ipv6/odhcp6c/Makefile b/package/network/ipv6/odhcp6c/Makefile
-index 5bf43bd..75de54c 100644
---- a/package/network/ipv6/odhcp6c/Makefile
-+++ b/package/network/ipv6/odhcp6c/Makefile
-@@ -8,7 +8,7 @@
- include $(TOPDIR)/rules.mk
- 
- PKG_NAME:=odhcp6c
--PKG_VERSION:=2015-07-13
-+PKG_VERSION:=2015-07-18
- PKG_RELEASE=$(PKG_SOURCE_VERSION)
- 
- PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-diff --git a/package/network/ipv6/odhcp6c/files/dhcpv6.script b/package/network/ipv6/odhcp6c/files/dhcpv6.script
-index b8cbddb..33f6d9b 100755
---- a/package/network/ipv6/odhcp6c/files/dhcpv6.script
-+++ b/package/network/ipv6/odhcp6c/files/dhcpv6.script
-@@ -76,7 +76,7 @@ setup_interface () {
- 	done
- 
- 	for entry in $RA_ROUTES; do
--		local duplicate=0
-+		local duplicate=$NOSOURCEFILTER
- 		local addr="${entry%%/*}"
- 		entry="${entry#*/}"
- 		local mask="${entry%%,*}"
-diff --git a/package/network/ipv6/odhcp6c/files/dhcpv6.sh b/package/network/ipv6/odhcp6c/files/dhcpv6.sh
-index adcb100..4a453fd 100755
---- a/package/network/ipv6/odhcp6c/files/dhcpv6.sh
-+++ b/package/network/ipv6/odhcp6c/files/dhcpv6.sh
-@@ -28,14 +28,15 @@ proto_dhcpv6_init_config() {
- 	proto_config_add_boolean delegate
- 	proto_config_add_int "soltimeout"
- 	proto_config_add_boolean fakeroutes
-+	proto_config_add_boolean sourcefilter
- }
- 
- proto_dhcpv6_setup() {
- 	local config="$1"
- 	local iface="$2"
- 
--	local reqaddress reqprefix clientid reqopts noslaaconly forceprefix norelease ip6prefix iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass delegate zone_dslite zone_map zone_464xlat zone soltimeout fakeroutes
--	json_get_vars reqaddress reqprefix clientid reqopts noslaaconly forceprefix norelease ip6prefix iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass delegate zone_dslite zone_map zone_464xlat zone soltimeout fakeroutes
-+	local reqaddress reqprefix clientid reqopts noslaaconly forceprefix norelease ip6prefix iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass delegate zone_dslite zone_map zone_464xlat zone soltimeout fakeroutes sourcefilter
-+	json_get_vars reqaddress reqprefix clientid reqopts noslaaconly forceprefix norelease ip6prefix iface_dslite iface_map iface_464xlat ifaceid userclass vendorclass delegate zone_dslite zone_map zone_464xlat zone soltimeout fakeroutes sourcefilter
- 
- 
- 	# Configure
-@@ -76,6 +77,7 @@ proto_dhcpv6_setup() {
- 	[ -n "$zone_464xlat" ] && proto_export "ZONE_464XLAT=$zone_464xlat"
- 	[ -n "$zone" ] && proto_export "ZONE=$zone"
- 	[ "$fakeroutes" != "0" ] && proto_export "FAKE_ROUTES=1"
-+	[ "$sourcefilter" = "0" ] && proto_export "NOSOURCEFILTER=1"
- 
- 	proto_export "INTERFACE=$config"
- 	proto_run_command "$config" odhcp6c \
diff --git a/patches/openwrt/0017-ar71xx-fix-ethernet-initialization-on-QCA953x-based-boards-TP-Link-TL-WR841N-ND-v9-Compex-WPJ531.patch b/patches/openwrt/0017-ar71xx-fix-ethernet-initialization-on-QCA953x-based-boards-TP-Link-TL-WR841N-ND-v9-Compex-WPJ531.patch
deleted file mode 100644
index f4413db2..00000000
--- a/patches/openwrt/0017-ar71xx-fix-ethernet-initialization-on-QCA953x-based-boards-TP-Link-TL-WR841N-ND-v9-Compex-WPJ531.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 6 Aug 2015 03:01:38 +0200
-Subject: ar71xx: fix ethernet initialization on QCA953x-based boards (TP-Link TL-WR841N/ND v9, Compex WPJ531)
-
-The initialization routines for these boards were relying on some (wrong)
-defaults for the QCA953x ethernet. Make these defaults explicit to prevent
-breaking them when the QCA953x defaults are fixed.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr841n-v9.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr841n-v9.c
-index c28afc6..3e5c2a2 100644
---- a/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr841n-v9.c
-+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr841n-v9.c
-@@ -109,12 +109,18 @@ static void __init tl_ap143_setup(void)
- 	ath79_register_mdio(0, 0x0);
- 
- 	/* LAN */
-+	ath79_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_GMII;
-+	ath79_eth1_data.duplex = DUPLEX_FULL;
-+	ath79_switch_data.phy_poll_mask |= BIT(4);
- 	ath79_init_mac(ath79_eth1_data.mac_addr, mac, 0);
- 	ath79_register_eth(1);
- 
- 	/* WAN */
- 	ath79_switch_data.phy4_mii_en = 1;
- 	ath79_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_MII;
-+	ath79_eth0_data.duplex = DUPLEX_FULL;
-+	ath79_eth0_data.speed = SPEED_100;
-+	ath79_eth0_data.phy_mask = BIT(4);
- 	ath79_init_mac(ath79_eth0_data.mac_addr, mac, 1);
- 	ath79_register_eth(0);
- 
-diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-wpj531.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-wpj531.c
-index bc13d70..e665a2e 100644
---- a/target/linux/ar71xx/files/arch/mips/ath79/mach-wpj531.c
-+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-wpj531.c
-@@ -105,12 +105,19 @@ static void __init common_setup(void)
- 	ath79_register_mdio(0, 0x0);
- 
- 	/* LAN */
-+	ath79_eth0_data.duplex = DUPLEX_FULL;
-+	ath79_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_MII;
-+	ath79_eth0_data.speed = SPEED_100;
-+	ath79_eth0_data.phy_mask = BIT(4);
- 	ath79_init_mac(ath79_eth0_data.mac_addr, mac, 0);
- 	ath79_register_eth(0);
- 
- 	/* WAN */
- 	ath79_switch_data.phy4_mii_en = 1;
-+	ath79_eth1_data.duplex = DUPLEX_FULL;
- 	ath79_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_MII;
-+	ath79_eth1_data.speed = SPEED_100;
-+	ath79_switch_data.phy_poll_mask |= BIT(4);
- 	ath79_init_mac(ath79_eth1_data.mac_addr, mac, 1);
- 	ath79_register_eth(1);
- 
diff --git a/patches/openwrt/0018-ar71xx-rework-patch-for-qca953x-956x.patch b/patches/openwrt/0018-ar71xx-rework-patch-for-qca953x-956x.patch
deleted file mode 100644
index 5b2b234f..00000000
--- a/patches/openwrt/0018-ar71xx-rework-patch-for-qca953x-956x.patch
+++ /dev/null
@@ -1,807 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 6 Aug 2015 03:01:47 +0200
-Subject: ar71xx: rework patch for qca953x/956x
-
-Patch cherry-picked from the following location:
-https://www.codeaurora.org/cgit/quic/qsdk/oss/system/openwrt/commit/?h=release/coconut_ioe4531_2.0&id=5c357bf6c763e4140dddcc9a3bc5f005525a9c0e
-
-Changelist,
-    - add more register defines
-    - add EHCI support
-    - fix GPIO pin count to 18
-    - fix chained irq disabled
-    - fix GMAC0/GMAC1 initial
-    - fix WMAC irq number to 47
-    - merge the changes of dev-eth.c from the patch to file.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/ar71xx/files/arch/mips/ath79/dev-eth.c b/target/linux/ar71xx/files/arch/mips/ath79/dev-eth.c
-index ae3db4c..ff94e2e 100644
---- a/target/linux/ar71xx/files/arch/mips/ath79/dev-eth.c
-+++ b/target/linux/ar71xx/files/arch/mips/ath79/dev-eth.c
-@@ -198,6 +198,8 @@ void __init ath79_register_mdio(unsigned int id, u32 phy_mask)
- 	case ATH79_SOC_AR9330:
- 	case ATH79_SOC_AR9331:
- 	case ATH79_SOC_QCA9533:
-+	case ATH79_SOC_QCA9561:
-+	case ATH79_SOC_TP9343:
- 		mdio_dev = &ath79_mdio1_device;
- 		mdio_data = &ath79_mdio1_data;
- 		break;
-@@ -256,6 +258,8 @@ void __init ath79_register_mdio(unsigned int id, u32 phy_mask)
- 		break;
- 
- 	case ATH79_SOC_QCA9533:
-+	case ATH79_SOC_QCA9561:
-+	case ATH79_SOC_TP9343:
- 		mdio_data->builtin_switch = 1;
- 		break;
- 
-@@ -571,6 +575,8 @@ static void __init ath79_init_eth_pll_data(unsigned int id)
- 	case ATH79_SOC_QCA9533:
- 	case ATH79_SOC_QCA9556:
- 	case ATH79_SOC_QCA9558:
-+	case ATH79_SOC_QCA9561:
-+	case ATH79_SOC_TP9343:
- 		pll_10 = AR934X_PLL_VAL_10;
- 		pll_100 = AR934X_PLL_VAL_100;
- 		pll_1000 = AR934X_PLL_VAL_1000;
-@@ -627,6 +633,8 @@ static int __init ath79_setup_phy_if_mode(unsigned int id,
- 		case ATH79_SOC_AR9330:
- 		case ATH79_SOC_AR9331:
- 		case ATH79_SOC_QCA9533:
-+		case ATH79_SOC_QCA9561:
-+		case ATH79_SOC_TP9343:
- 			pdata->phy_if_mode = PHY_INTERFACE_MODE_MII;
- 			break;
- 
-@@ -687,7 +695,8 @@ static int __init ath79_setup_phy_if_mode(unsigned int id,
- 		case ATH79_SOC_AR7241:
- 		case ATH79_SOC_AR9330:
- 		case ATH79_SOC_AR9331:
--		case ATH79_SOC_QCA9533:
-+		case ATH79_SOC_QCA9561:
-+		case ATH79_SOC_TP9343:
- 			pdata->phy_if_mode = PHY_INTERFACE_MODE_GMII;
- 			break;
- 
-@@ -697,6 +706,7 @@ static int __init ath79_setup_phy_if_mode(unsigned int id,
- 		case ATH79_SOC_AR9341:
- 		case ATH79_SOC_AR9342:
- 		case ATH79_SOC_AR9344:
-+		case ATH79_SOC_QCA9533:
- 			switch (pdata->phy_if_mode) {
- 			case PHY_INTERFACE_MODE_MII:
- 			case PHY_INTERFACE_MODE_GMII:
-@@ -986,6 +996,7 @@ void __init ath79_register_eth(unsigned int id)
- 	case ATH79_SOC_AR9341:
- 	case ATH79_SOC_AR9342:
- 	case ATH79_SOC_AR9344:
-+	case ATH79_SOC_QCA9533:
- 		if (id == 0) {
- 			pdata->reset_bit = AR934X_RESET_GE0_MAC |
- 					   AR934X_RESET_GE0_MDIO;
-@@ -1017,7 +1028,8 @@ void __init ath79_register_eth(unsigned int id)
- 			pdata->fifo_cfg3 = 0x01f00140;
- 		break;
- 
--	case ATH79_SOC_QCA9533:
-+	case ATH79_SOC_QCA9561:
-+	case ATH79_SOC_TP9343:
- 		if (id == 0) {
- 			pdata->reset_bit = AR933X_RESET_GE0_MAC |
- 					   AR933X_RESET_GE0_MDIO;
-@@ -1123,6 +1135,8 @@ void __init ath79_register_eth(unsigned int id)
- 		case ATH79_SOC_AR9330:
- 		case ATH79_SOC_AR9331:
- 		case ATH79_SOC_QCA9533:
-+		case ATH79_SOC_QCA9561:
-+		case ATH79_SOC_TP9343:
- 			pdata->mii_bus_dev = &ath79_mdio1_device.dev;
- 			break;
- 
-diff --git a/target/linux/ar71xx/patches-3.18/707-MIPS-ath79-add-support-for-QCA953x-SoC.patch b/target/linux/ar71xx/patches-3.18/707-MIPS-ath79-add-support-for-QCA953x-SoC.patch
-index f3b4446..cf10af3 100644
---- a/target/linux/ar71xx/patches-3.18/707-MIPS-ath79-add-support-for-QCA953x-SoC.patch
-+++ b/target/linux/ar71xx/patches-3.18/707-MIPS-ath79-add-support-for-QCA953x-SoC.patch
-@@ -175,6 +175,48 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  	    soc_is_qca955x()) {
-  		ath79_uart_data[0].uartclk = uart_clk_rate;
-  		platform_device_register(&ath79_uart_device);
-+--- a/arch/mips/ath79/dev-usb.c
-++++ b/arch/mips/ath79/dev-usb.c
-+@@ -236,6 +236,30 @@ static void __init ar934x_usb_setup(void
-+ 			   &ath79_ehci_pdata_v2, sizeof(ath79_ehci_pdata_v2));
-+ }
-+ 
-++static void __init qca953x_usb_setup(void)
-++{
-++	u32 bootstrap;
-++
-++	bootstrap = ath79_reset_rr(QCA953X_RESET_REG_BOOTSTRAP);
-++
-++	ath79_device_reset_set(QCA953X_RESET_USBSUS_OVERRIDE);
-++	udelay(1000);
-++
-++	ath79_device_reset_clear(QCA953X_RESET_USB_PHY);
-++	udelay(1000);
-++
-++	ath79_device_reset_clear(QCA953X_RESET_USB_PHY_ANALOG);
-++	udelay(1000);
-++
-++	ath79_device_reset_clear(QCA953X_RESET_USB_HOST);
-++	udelay(1000);
-++
-++	ath79_usb_register("ehci-platform", -1,
-++			   QCA953X_EHCI_BASE, QCA953X_EHCI_SIZE,
-++			   ATH79_CPU_IRQ(3),
-++			   &ath79_ehci_pdata_v2, sizeof(ath79_ehci_pdata_v2));
-++}
-++
-+ static void qca955x_usb_reset_notifier(struct platform_device *pdev)
-+ {
-+ 	u32 base;
-+@@ -286,6 +310,8 @@ void __init ath79_register_usb(void)
-+ 		ar933x_usb_setup();
-+ 	else if (soc_is_ar934x())
-+ 		ar934x_usb_setup();
-++	else if (soc_is_qca953x())
-++		qca953x_usb_setup();
-+ 	else if (soc_is_qca955x())
-+ 		qca955x_usb_setup();
-+ 	else
- --- a/arch/mips/ath79/dev-wmac.c
- +++ b/arch/mips/ath79/dev-wmac.c
- @@ -101,7 +101,7 @@ static int ar933x_wmac_reset(void)
-@@ -207,8 +249,8 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
- +
- +	ath79_wmac_resources[0].start = QCA953X_WMAC_BASE;
- +	ath79_wmac_resources[0].end = QCA953X_WMAC_BASE + QCA953X_WMAC_SIZE - 1;
--+	ath79_wmac_resources[1].start = ATH79_CPU_IRQ(2);
--+	ath79_wmac_resources[1].end = ATH79_CPU_IRQ(2);
-++	ath79_wmac_resources[1].start = ATH79_IP2_IRQ(1);
-++	ath79_wmac_resources[1].end = ATH79_IP2_IRQ(1);
- +
- +	t = ath79_reset_rr(QCA953X_RESET_REG_BOOTSTRAP);
- +	if (t & QCA953X_BOOTSTRAP_REF_CLK_40)
-@@ -244,6 +286,24 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  		_prom_putchar = prom_putchar_ar71xx;
- --- a/arch/mips/ath79/gpio.c
- +++ b/arch/mips/ath79/gpio.c
-+@@ -148,7 +148,7 @@ static void __iomem *ath79_gpio_get_func
-+ 	    soc_is_ar913x() ||
-+ 	    soc_is_ar933x())
-+ 		reg = AR71XX_GPIO_REG_FUNC;
-+-	else if (soc_is_ar934x())
-++	else if (soc_is_ar934x() || soc_is_qca953x())
-+ 		reg = AR934X_GPIO_REG_FUNC;
-+ 	else
-+ 		BUG();
-+@@ -187,7 +187,7 @@ void __init ath79_gpio_output_select(uns
-+ 	unsigned int reg;
-+ 	u32 t, s;
-+ 
-+-	BUG_ON(!soc_is_ar934x());
-++	BUG_ON(!soc_is_ar934x() && !soc_is_qca953x());
-+ 
-+ 	if (gpio >= AR934X_GPIO_COUNT)
-+ 		return;
- @@ -224,6 +224,8 @@ void __init ath79_gpio_init(void)
-  		ath79_gpio_count = AR933X_GPIO_COUNT;
-  	else if (soc_is_ar934x())
-@@ -272,16 +332,77 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  		 soc_is_qca955x())
-  		ath79_misc_irq_chip.irq_ack = ar724x_misc_irq_ack;
-  	else
--@@ -352,6 +353,9 @@ void __init arch_init_irq(void)
-+@@ -153,6 +154,38 @@ static void ar934x_ip2_irq_init(void)
-+ 	irq_set_chained_handler(ATH79_CPU_IRQ(2), ar934x_ip2_irq_dispatch);
-+ }
-+ 
-++static void qca953x_ip2_irq_dispatch(unsigned int irq, struct irq_desc *desc)
-++{
-++	u32 status;
-++
-++	disable_irq_nosync(irq);
-++
-++	status = ath79_reset_rr(QCA953X_RESET_REG_PCIE_WMAC_INT_STATUS);
-++
-++	if (status & QCA953X_PCIE_WMAC_INT_PCIE_ALL) {
-++		ath79_ddr_wb_flush(QCA953X_DDR_REG_FLUSH_PCIE);
-++		generic_handle_irq(ATH79_IP2_IRQ(0));
-++	} else if (status & QCA953X_PCIE_WMAC_INT_WMAC_ALL) {
-++		ath79_ddr_wb_flush(QCA953X_DDR_REG_FLUSH_WMAC);
-++		generic_handle_irq(ATH79_IP2_IRQ(1));
-++	} else {
-++		spurious_interrupt();
-++	}
-++
-++	enable_irq(irq);
-++}
-++
-++static void qca953x_irq_init(void)
-++{
-++	int i;
-++
-++	for (i = ATH79_IP2_IRQ_BASE;
-++	     i < ATH79_IP2_IRQ_BASE + ATH79_IP2_IRQ_COUNT; i++)
-++		irq_set_chip_and_handler(i, &dummy_irq_chip, handle_level_irq);
-++
-++	irq_set_chained_handler(ATH79_CPU_IRQ(2), qca953x_ip2_irq_dispatch);
-++}
-++
-+ static void qca955x_ip2_irq_dispatch(unsigned int irq, struct irq_desc *desc)
-+ {
-+ 	u32 status;
-+@@ -335,6 +368,12 @@ static void ar934x_ip3_handler(void)
-+ 	do_IRQ(ATH79_CPU_IRQ(3));
-+ }
-+ 
-++static void qca953x_ip3_handler(void)
-++{
-++	ath79_ddr_wb_flush(QCA953X_DDR_REG_FLUSH_USB);
-++	do_IRQ(ATH79_CPU_IRQ(3));
-++}
-++
-+ void __init arch_init_irq(void)
-+ {
-+ 	if (soc_is_ar71xx()) {
-+@@ -352,6 +391,9 @@ void __init arch_init_irq(void)
-  	} else if (soc_is_ar934x()) {
-  		ath79_ip2_handler = ath79_default_ip2_handler;
-  		ath79_ip3_handler = ar934x_ip3_handler;
- +	} else if (soc_is_qca953x()) {
- +		ath79_ip2_handler = ath79_default_ip2_handler;
--+		ath79_ip3_handler = ath79_default_ip3_handler;
-++		ath79_ip3_handler = qca953x_ip3_handler;
-  	} else if (soc_is_qca955x()) {
-  		ath79_ip2_handler = ath79_default_ip2_handler;
-  		ath79_ip3_handler = ath79_default_ip3_handler;
-+@@ -365,6 +407,8 @@ void __init arch_init_irq(void)
-+ 
-+ 	if (soc_is_ar934x())
-+ 		ar934x_ip2_irq_init();
-++	else if (soc_is_qca953x())
-++		qca953x_irq_init();
-+ 	else if (soc_is_qca955x())
-+ 		qca955x_irq_init();
-+ }
- --- a/arch/mips/ath79/setup.c
- +++ b/arch/mips/ath79/setup.c
- @@ -59,6 +59,7 @@ static void __init ath79_detect_sys_type
-@@ -329,23 +450,49 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  	pr_info("SoC: %s\n", ath79_sys_type);
- --- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
- +++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
--@@ -105,6 +105,9 @@
-+@@ -105,6 +105,21 @@
-  #define AR934X_SRIF_BASE	(AR71XX_APB_BASE + 0x00116000)
-  #define AR934X_SRIF_SIZE	0x1000
-  
-++#define QCA953X_GMAC_BASE	(AR71XX_APB_BASE + 0x00070000)
-++#define QCA953X_GMAC_SIZE	0x14
- +#define QCA953X_WMAC_BASE	(AR71XX_APB_BASE + 0x00100000)
- +#define QCA953X_WMAC_SIZE	0x20000
-++#define QCA953X_EHCI_BASE	0x1b000000
-++#define QCA953X_EHCI_SIZE	0x200
-++#define QCA953X_SRIF_BASE	(AR71XX_APB_BASE + 0x00116000)
-++#define QCA953X_SRIF_SIZE	0x1000
-++
-++#define QCA953X_PCI_CFG_BASE0	0x14000000
-++#define QCA953X_PCI_CTRL_BASE0	(AR71XX_APB_BASE + 0x000f0000)
-++#define QCA953X_PCI_CRP_BASE0	(AR71XX_APB_BASE + 0x000c0000)
-++#define QCA953X_PCI_MEM_BASE0	0x10000000
-++#define QCA953X_PCI_MEM_SIZE	0x02000000
- +
-  #define QCA955X_PCI_MEM_BASE0	0x10000000
-  #define QCA955X_PCI_MEM_BASE1	0x12000000
-  #define QCA955X_PCI_MEM_SIZE	0x02000000
--@@ -279,6 +282,43 @@
-+@@ -173,6 +188,12 @@
-+ #define AR934X_DDR_REG_FLUSH_PCIE	0xa8
-+ #define AR934X_DDR_REG_FLUSH_WMAC	0xac
-+ 
-++#define QCA953X_DDR_REG_FLUSH_GE0	0x9c
-++#define QCA953X_DDR_REG_FLUSH_GE1	0xa0
-++#define QCA953X_DDR_REG_FLUSH_USB	0xa4
-++#define QCA953X_DDR_REG_FLUSH_PCIE	0xa8
-++#define QCA953X_DDR_REG_FLUSH_WMAC	0xac
-++
-+ /*
-+  * PLL block
-+  */
-+@@ -279,6 +300,44 @@
-  
-  #define AR934X_PLL_SWITCH_CLOCK_CONTROL_MDIO_CLK_SEL	BIT(6)
-  
- +#define QCA953X_PLL_CPU_CONFIG_REG		0x00
- +#define QCA953X_PLL_DDR_CONFIG_REG		0x04
- +#define QCA953X_PLL_CLK_CTRL_REG		0x08
-++#define QCA953X_PLL_SWITCH_CLOCK_CONTROL_REG	0x24
- +#define QCA953X_PLL_ETH_XMII_CONTROL_REG	0x2c
- +#define QCA953X_PLL_ETH_SGMII_CONTROL_REG	0x48
- +
-@@ -356,7 +503,7 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
- +#define QCA953X_PLL_CPU_CONFIG_REFDIV_SHIFT	12
- +#define QCA953X_PLL_CPU_CONFIG_REFDIV_MASK	0x1f
- +#define QCA953X_PLL_CPU_CONFIG_OUTDIV_SHIFT	19
--+#define QCA953X_PLL_CPU_CONFIG_OUTDIV_MASK	0x3
-++#define QCA953X_PLL_CPU_CONFIG_OUTDIV_MASK	0x7
- +
- +#define QCA953X_PLL_DDR_CONFIG_NFRAC_SHIFT	0
- +#define QCA953X_PLL_DDR_CONFIG_NFRAC_MASK	0x3ff
-@@ -383,27 +530,85 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  #define QCA955X_PLL_CPU_CONFIG_REG		0x00
-  #define QCA955X_PLL_DDR_CONFIG_REG		0x04
-  #define QCA955X_PLL_CLK_CTRL_REG		0x08
--@@ -355,6 +395,10 @@
-+@@ -355,6 +414,10 @@
-  #define AR934X_RESET_REG_BOOTSTRAP		0xb0
-  #define AR934X_RESET_REG_PCIE_WMAC_INT_STATUS	0xac
-  
- +#define QCA953X_RESET_REG_RESET_MODULE		0x1c
- +#define QCA953X_RESET_REG_BOOTSTRAP		0xb0
--+#define QCA953X_RESET_REG_EXT_INT_STATUS	0xac
-++#define QCA953X_RESET_REG_PCIE_WMAC_INT_STATUS	0xac
- +
-  #define QCA955X_RESET_REG_RESET_MODULE		0x1c
-  #define QCA955X_RESET_REG_BOOTSTRAP		0xb0
-  #define QCA955X_RESET_REG_EXT_INT_STATUS	0xac
--@@ -503,6 +547,8 @@
-+@@ -450,6 +513,27 @@
-+ #define AR934X_RESET_MBOX		BIT(1)
-+ #define AR934X_RESET_I2S		BIT(0)
-+ 
-++#define QCA953X_RESET_USB_EXT_PWR	BIT(29)
-++#define QCA953X_RESET_EXTERNAL		BIT(28)
-++#define QCA953X_RESET_RTC		BIT(27)
-++#define QCA953X_RESET_FULL_CHIP		BIT(24)
-++#define QCA953X_RESET_GE1_MDIO		BIT(23)
-++#define QCA953X_RESET_GE0_MDIO		BIT(22)
-++#define QCA953X_RESET_CPU_NMI		BIT(21)
-++#define QCA953X_RESET_CPU_COLD		BIT(20)
-++#define QCA953X_RESET_DDR		BIT(16)
-++#define QCA953X_RESET_USB_PHY_PLL_PWD_EXT BIT(15)
-++#define QCA953X_RESET_GE1_MAC		BIT(13)
-++#define QCA953X_RESET_ETH_SWITCH_ANALOG	BIT(12)
-++#define QCA953X_RESET_USB_PHY_ANALOG	BIT(11)
-++#define QCA953X_RESET_GE0_MAC		BIT(9)
-++#define QCA953X_RESET_ETH_SWITCH	BIT(8)
-++#define QCA953X_RESET_PCIE_PHY		BIT(7)
-++#define QCA953X_RESET_PCIE		BIT(6)
-++#define QCA953X_RESET_USB_HOST		BIT(5)
-++#define QCA953X_RESET_USB_PHY		BIT(4)
-++#define QCA953X_RESET_USBSUS_OVERRIDE	BIT(3)
-++
-+ #define QCA955X_RESET_HOST		BIT(31)
-+ #define QCA955X_RESET_SLIC		BIT(30)
-+ #define QCA955X_RESET_HDMA		BIT(29)
-+@@ -503,6 +587,13 @@
-  #define AR934X_BOOTSTRAP_SDRAM_DISABLED BIT(1)
-  #define AR934X_BOOTSTRAP_DDR1		BIT(0)
-  
-++#define QCA953X_BOOTSTRAP_SW_OPTION2	BIT(12)
-++#define QCA953X_BOOTSTRAP_SW_OPTION1	BIT(11)
-++#define QCA953X_BOOTSTRAP_EJTAG_MODE	BIT(5)
- +#define QCA953X_BOOTSTRAP_REF_CLK_40	BIT(4)
-++#define QCA953X_BOOTSTRAP_SDRAM_DISABLED BIT(1)
-++#define QCA953X_BOOTSTRAP_DDR1		BIT(0)
- +
-  #define QCA955X_BOOTSTRAP_REF_CLK_40	BIT(4)
-  
-  #define AR934X_PCIE_WMAC_INT_WMAC_MISC		BIT(0)
--@@ -565,6 +611,8 @@
-+@@ -523,6 +614,24 @@
-+ 	 AR934X_PCIE_WMAC_INT_PCIE_RC1 | AR934X_PCIE_WMAC_INT_PCIE_RC2 | \
-+ 	 AR934X_PCIE_WMAC_INT_PCIE_RC3)
-+ 
-++#define QCA953X_PCIE_WMAC_INT_WMAC_MISC		BIT(0)
-++#define QCA953X_PCIE_WMAC_INT_WMAC_TX		BIT(1)
-++#define QCA953X_PCIE_WMAC_INT_WMAC_RXLP		BIT(2)
-++#define QCA953X_PCIE_WMAC_INT_WMAC_RXHP		BIT(3)
-++#define QCA953X_PCIE_WMAC_INT_PCIE_RC		BIT(4)
-++#define QCA953X_PCIE_WMAC_INT_PCIE_RC0		BIT(5)
-++#define QCA953X_PCIE_WMAC_INT_PCIE_RC1		BIT(6)
-++#define QCA953X_PCIE_WMAC_INT_PCIE_RC2		BIT(7)
-++#define QCA953X_PCIE_WMAC_INT_PCIE_RC3		BIT(8)
-++#define QCA953X_PCIE_WMAC_INT_WMAC_ALL \
-++	(QCA953X_PCIE_WMAC_INT_WMAC_MISC | QCA953X_PCIE_WMAC_INT_WMAC_TX | \
-++	 QCA953X_PCIE_WMAC_INT_WMAC_RXLP | QCA953X_PCIE_WMAC_INT_WMAC_RXHP)
-++
-++#define QCA953X_PCIE_WMAC_INT_PCIE_ALL \
-++	(QCA953X_PCIE_WMAC_INT_PCIE_RC | QCA953X_PCIE_WMAC_INT_PCIE_RC0 | \
-++	 QCA953X_PCIE_WMAC_INT_PCIE_RC1 | QCA953X_PCIE_WMAC_INT_PCIE_RC2 | \
-++	 QCA953X_PCIE_WMAC_INT_PCIE_RC3)
-++
-+ #define QCA955X_EXT_INT_WMAC_MISC		BIT(0)
-+ #define QCA955X_EXT_INT_WMAC_TX			BIT(1)
-+ #define QCA955X_EXT_INT_WMAC_RXLP		BIT(2)
-+@@ -565,6 +674,8 @@
-  #define REV_ID_MAJOR_AR9341		0x0120
-  #define REV_ID_MAJOR_AR9342		0x1120
-  #define REV_ID_MAJOR_AR9344		0x2120
-@@ -412,7 +617,7 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  #define REV_ID_MAJOR_QCA9556		0x0130
-  #define REV_ID_MAJOR_QCA9558		0x1130
-  
--@@ -587,6 +635,8 @@
-+@@ -587,6 +698,8 @@
-  
-  #define AR934X_REV_ID_REVISION_MASK	0xf
-  
-@@ -421,14 +626,81 @@ meaning of the bits CPUCLK_FROM_CPUPLL and DDRCLK_FROM_DDRPLL is reversed.
-  #define QCA955X_REV_ID_REVISION_MASK	0xf
-  
-  /*
--@@ -640,6 +690,7 @@
-+@@ -634,12 +747,32 @@
-+ #define AR934X_GPIO_REG_OUT_FUNC5	0x40
-+ #define AR934X_GPIO_REG_FUNC		0x6c
-+ 
-++#define QCA953X_GPIO_REG_OUT_FUNC0	0x2c
-++#define QCA953X_GPIO_REG_OUT_FUNC1	0x30
-++#define QCA953X_GPIO_REG_OUT_FUNC2	0x34
-++#define QCA953X_GPIO_REG_OUT_FUNC3	0x38
-++#define QCA953X_GPIO_REG_OUT_FUNC4	0x3c
-++#define QCA953X_GPIO_REG_IN_ENABLE0	0x44
-++#define QCA953X_GPIO_REG_FUNC		0x6c
-++
-++#define QCA953X_GPIO_OUT_MUX_SPI_CS1		10
-++#define QCA953X_GPIO_OUT_MUX_SPI_CS2		11
-++#define QCA953X_GPIO_OUT_MUX_SPI_CS0		9
-++#define QCA953X_GPIO_OUT_MUX_SPI_CLK		8
-++#define QCA953X_GPIO_OUT_MUX_SPI_MOSI		12
-++#define QCA953X_GPIO_OUT_MUX_LED_LINK1		41
-++#define QCA953X_GPIO_OUT_MUX_LED_LINK2		42
-++#define QCA953X_GPIO_OUT_MUX_LED_LINK3		43
-++#define QCA953X_GPIO_OUT_MUX_LED_LINK4		44
-++#define QCA953X_GPIO_OUT_MUX_LED_LINK5		45
-++
-+ #define AR71XX_GPIO_COUNT		16
-+ #define AR7240_GPIO_COUNT		18
-+ #define AR7241_GPIO_COUNT		20
-  #define AR913X_GPIO_COUNT		22
-  #define AR933X_GPIO_COUNT		30
-  #define AR934X_GPIO_COUNT		23
--+#define QCA953X_GPIO_COUNT		24
-++#define QCA953X_GPIO_COUNT		18
-  #define QCA955X_GPIO_COUNT		24
-  
-  /*
-+@@ -663,6 +796,24 @@
-+ #define AR934X_SRIF_DPLL2_OUTDIV_SHIFT	13
-+ #define AR934X_SRIF_DPLL2_OUTDIV_MASK	0x7
-+ 
-++#define QCA953X_SRIF_CPU_DPLL1_REG	0x1c0
-++#define QCA953X_SRIF_CPU_DPLL2_REG	0x1c4
-++#define QCA953X_SRIF_CPU_DPLL3_REG	0x1c8
-++
-++#define QCA953X_SRIF_DDR_DPLL1_REG	0x240
-++#define QCA953X_SRIF_DDR_DPLL2_REG	0x244
-++#define QCA953X_SRIF_DDR_DPLL3_REG	0x248
-++
-++#define QCA953X_SRIF_DPLL1_REFDIV_SHIFT	27
-++#define QCA953X_SRIF_DPLL1_REFDIV_MASK	0x1f
-++#define QCA953X_SRIF_DPLL1_NINT_SHIFT	18
-++#define QCA953X_SRIF_DPLL1_NINT_MASK	0x1ff
-++#define QCA953X_SRIF_DPLL1_NFRAC_MASK	0x0003ffff
-++
-++#define QCA953X_SRIF_DPLL2_LOCAL_PLL	BIT(30)
-++#define QCA953X_SRIF_DPLL2_OUTDIV_SHIFT	13
-++#define QCA953X_SRIF_DPLL2_OUTDIV_MASK	0x7
-++
-+ #define AR71XX_GPIO_FUNC_STEREO_EN		BIT(17)
-+ #define AR71XX_GPIO_FUNC_SLIC_EN		BIT(16)
-+ #define AR71XX_GPIO_FUNC_SPI_CS2_EN		BIT(13)
-+@@ -804,6 +955,16 @@
-+ #define AR934X_ETH_CFG_RDV_DELAY_SHIFT  16
-+ 
-+ /*
-++ * QCA953X GMAC Interface
-++ */
-++#define QCA953X_GMAC_REG_ETH_CFG		0x00
-++
-++#define QCA953X_ETH_CFG_SW_ONLY_MODE		BIT(6)
-++#define QCA953X_ETH_CFG_SW_PHY_SWAP		BIT(7)
-++#define QCA953X_ETH_CFG_SW_APB_ACCESS		BIT(9)
-++#define QCA953X_ETH_CFG_SW_ACC_MSB_FIRST	BIT(13)
-++
-++/*
-+  * QCA955X GMAC Interface
-+  */
-+ 
- --- a/arch/mips/include/asm/mach-ath79/ath79.h
- +++ b/arch/mips/include/asm/mach-ath79/ath79.h
- @@ -32,6 +32,7 @@ enum ath79_soc_type {
-diff --git a/target/linux/ar71xx/patches-3.18/735-MIPS-ath79-add-support-for-QCA956x-SoC.patch b/target/linux/ar71xx/patches-3.18/735-MIPS-ath79-add-support-for-QCA956x-SoC.patch
-index ab2bc38..eecccdc 100644
---- a/target/linux/ar71xx/patches-3.18/735-MIPS-ath79-add-support-for-QCA956x-SoC.patch
-+++ b/target/linux/ar71xx/patches-3.18/735-MIPS-ath79-add-support-for-QCA956x-SoC.patch
-@@ -142,74 +142,9 @@
-  		ath79_uart_data[0].uartclk = uart_clk_rate;
-  		platform_device_register(&ath79_uart_device);
-  	} else if (soc_is_ar933x()) {
----- a/arch/mips/ath79/dev-eth.c
--+++ b/arch/mips/ath79/dev-eth.c
--@@ -198,6 +198,8 @@ void __init ath79_register_mdio(unsigned
-- 	case ATH79_SOC_AR9330:
-- 	case ATH79_SOC_AR9331:
-- 	case ATH79_SOC_QCA9533:
--+	case ATH79_SOC_QCA9561:
--+	case ATH79_SOC_TP9343:
-- 		mdio_dev = &ath79_mdio1_device;
-- 		mdio_data = &ath79_mdio1_data;
-- 		break;
--@@ -256,6 +258,8 @@ void __init ath79_register_mdio(unsigned
-- 		break;
-- 
-- 	case ATH79_SOC_QCA9533:
--+	case ATH79_SOC_QCA9561:
--+	case ATH79_SOC_TP9343:
-- 		mdio_data->builtin_switch = 1;
-- 		break;
-- 
--@@ -571,6 +575,8 @@ static void __init ath79_init_eth_pll_da
-- 	case ATH79_SOC_QCA9533:
-- 	case ATH79_SOC_QCA9556:
-- 	case ATH79_SOC_QCA9558:
--+	case ATH79_SOC_QCA9561:
--+	case ATH79_SOC_TP9343:
-- 		pll_10 = AR934X_PLL_VAL_10;
-- 		pll_100 = AR934X_PLL_VAL_100;
-- 		pll_1000 = AR934X_PLL_VAL_1000;
--@@ -627,6 +633,8 @@ static int __init ath79_setup_phy_if_mod
-- 		case ATH79_SOC_AR9330:
-- 		case ATH79_SOC_AR9331:
-- 		case ATH79_SOC_QCA9533:
--+		case ATH79_SOC_QCA9561:
--+		case ATH79_SOC_TP9343:
-- 			pdata->phy_if_mode = PHY_INTERFACE_MODE_MII;
-- 			break;
-- 
--@@ -688,6 +696,8 @@ static int __init ath79_setup_phy_if_mod
-- 		case ATH79_SOC_AR9330:
-- 		case ATH79_SOC_AR9331:
-- 		case ATH79_SOC_QCA9533:
--+		case ATH79_SOC_QCA9561:
--+		case ATH79_SOC_TP9343:
-- 			pdata->phy_if_mode = PHY_INTERFACE_MODE_GMII;
-- 			break;
-- 
--@@ -1018,6 +1028,8 @@ void __init ath79_register_eth(unsigned
-- 		break;
-- 
-- 	case ATH79_SOC_QCA9533:
--+	case ATH79_SOC_QCA9561:
--+	case ATH79_SOC_TP9343:
-- 		if (id == 0) {
-- 			pdata->reset_bit = AR933X_RESET_GE0_MAC |
-- 					   AR933X_RESET_GE0_MDIO;
--@@ -1123,6 +1135,8 @@ void __init ath79_register_eth(unsigned
-- 		case ATH79_SOC_AR9330:
-- 		case ATH79_SOC_AR9331:
-- 		case ATH79_SOC_QCA9533:
--+		case ATH79_SOC_QCA9561:
--+		case ATH79_SOC_TP9343:
-- 			pdata->mii_bus_dev = &ath79_mdio1_device.dev;
-- 			break;
-- 
- --- a/arch/mips/ath79/dev-usb.c
- +++ b/arch/mips/ath79/dev-usb.c
--@@ -272,6 +272,19 @@ static void __init qca955x_usb_setup(voi
-+@@ -296,6 +296,19 @@ static void __init qca955x_usb_setup(voi
-  			   &ath79_ehci_pdata_v2, sizeof(ath79_ehci_pdata_v2));
-  }
-  
-@@ -229,8 +164,8 @@
-  void __init ath79_register_usb(void)
-  {
-  	if (soc_is_ar71xx())
--@@ -288,6 +301,8 @@ void __init ath79_register_usb(void)
-- 		ar934x_usb_setup();
-+@@ -314,6 +327,8 @@ void __init ath79_register_usb(void)
-+ 		qca953x_usb_setup();
-  	else if (soc_is_qca955x())
-  		qca955x_usb_setup();
- +	else if (soc_is_qca9561())
-@@ -291,9 +226,9 @@
-  	    soc_is_ar913x() ||
-  	    soc_is_ar933x())
-  		reg = AR71XX_GPIO_REG_FUNC;
---	else if (soc_is_ar934x())
-+-	else if (soc_is_ar934x() || soc_is_qca953x())
- +	else if (soc_is_ar934x() ||
--+		 soc_is_qca956x())
-++		 soc_is_qca953x() || soc_is_qca956x())
-  		reg = AR934X_GPIO_REG_FUNC;
-  	else
-  		BUG();
-@@ -326,7 +261,7 @@
-  		ath79_misc_irq_chip.irq_ack = ar724x_misc_irq_ack;
-  	else
-  		BUG();
--@@ -236,6 +237,99 @@ static void qca955x_irq_init(void)
-+@@ -268,6 +269,97 @@ static void qca955x_irq_init(void)
-  	irq_set_chained_handler(ATH79_CPU_IRQ(3), qca955x_ip3_irq_dispatch);
-  }
-  
-@@ -406,15 +341,13 @@
- +
- +	for (i = ATH79_IP2_IRQ_BASE;
- +	     i < ATH79_IP2_IRQ_BASE + ATH79_IP2_IRQ_COUNT; i++)
--+		irq_set_chip_and_handler(i, &dummy_irq_chip,
--+					 handle_level_irq);
-++		irq_set_chip_and_handler(i, &dummy_irq_chip, handle_level_irq);
- +
- +	irq_set_chained_handler(ATH79_CPU_IRQ(2), qca956x_ip2_irq_dispatch);
- +
- +	for (i = ATH79_IP3_IRQ_BASE;
- +	     i < ATH79_IP3_IRQ_BASE + ATH79_IP3_IRQ_COUNT; i++)
--+		irq_set_chip_and_handler(i, &dummy_irq_chip,
--+					 handle_level_irq);
-++		irq_set_chip_and_handler(i, &dummy_irq_chip, handle_level_irq);
- +
- +	irq_set_chained_handler(ATH79_CPU_IRQ(3), qca956x_ip3_irq_dispatch);
- +
-@@ -426,7 +359,7 @@
-  asmlinkage void plat_irq_dispatch(void)
-  {
-  	unsigned long pending;
--@@ -359,6 +453,9 @@ void __init arch_init_irq(void)
-+@@ -397,6 +489,9 @@ void __init arch_init_irq(void)
-  	} else if (soc_is_qca955x()) {
-  		ath79_ip2_handler = ath79_default_ip2_handler;
-  		ath79_ip3_handler = ath79_default_ip3_handler;
-@@ -436,8 +369,8 @@
-  	} else {
-  		BUG();
-  	}
--@@ -371,4 +468,6 @@ void __init arch_init_irq(void)
-- 		ar934x_ip2_irq_init();
-+@@ -411,4 +506,6 @@ void __init arch_init_irq(void)
-+ 		qca953x_irq_init();
-  	else if (soc_is_qca955x())
-  		qca955x_irq_init();
- +	else if (soc_is_qca956x())
-@@ -554,7 +487,7 @@
-  	pr_info("SoC: %s\n", ath79_sys_type);
- --- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
- +++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
--@@ -131,6 +131,23 @@
-+@@ -143,6 +143,23 @@
-  #define QCA955X_NFC_BASE	0x1b800200
-  #define QCA955X_NFC_SIZE	0xb8
-  
-@@ -578,7 +511,7 @@
-  #define AR9300_OTP_BASE		0x14000
-  #define AR9300_OTP_STATUS	0x15f18
-  #define AR9300_OTP_STATUS_TYPE		0x7
--@@ -356,6 +373,49 @@
-+@@ -375,6 +392,49 @@
-  #define QCA955X_PLL_CLK_CTRL_DDRCLK_FROM_DDRPLL		BIT(21)
-  #define QCA955X_PLL_CLK_CTRL_AHBCLK_FROM_DDRPLL		BIT(24)
-  
-@@ -628,7 +561,7 @@
-  /*
-   * USB_CONFIG block
-   */
--@@ -403,6 +463,11 @@
-+@@ -422,6 +482,11 @@
-  #define QCA955X_RESET_REG_BOOTSTRAP		0xb0
-  #define QCA955X_RESET_REG_EXT_INT_STATUS	0xac
-  
-@@ -640,7 +573,7 @@
-  #define MISC_INT_ETHSW			BIT(12)
-  #define MISC_INT_TIMER4			BIT(10)
-  #define MISC_INT_TIMER3			BIT(9)
--@@ -551,6 +616,8 @@
-+@@ -596,6 +661,8 @@
-  
-  #define QCA955X_BOOTSTRAP_REF_CLK_40	BIT(4)
-  
-@@ -649,7 +582,7 @@
-  #define AR934X_PCIE_WMAC_INT_WMAC_MISC		BIT(0)
-  #define AR934X_PCIE_WMAC_INT_WMAC_TX		BIT(1)
-  #define AR934X_PCIE_WMAC_INT_WMAC_RXLP		BIT(2)
--@@ -600,6 +667,37 @@
-+@@ -663,6 +730,37 @@
-  	 QCA955X_EXT_INT_PCIE_RC2_INT1 | QCA955X_EXT_INT_PCIE_RC2_INT2 | \
-  	 QCA955X_EXT_INT_PCIE_RC2_INT3)
-  
-@@ -687,7 +620,7 @@
-  #define REV_ID_MAJOR_MASK		0xfff0
-  #define REV_ID_MAJOR_AR71XX		0x00a0
-  #define REV_ID_MAJOR_AR913X		0x00b0
--@@ -615,6 +713,8 @@
-+@@ -678,6 +776,8 @@
-  #define REV_ID_MAJOR_QCA9533_V2		0x0160
-  #define REV_ID_MAJOR_QCA9556		0x0130
-  #define REV_ID_MAJOR_QCA9558		0x1130
-@@ -696,7 +629,7 @@
-  
-  #define AR71XX_REV_ID_MINOR_MASK	0x3
-  #define AR71XX_REV_ID_MINOR_AR7130	0x0
--@@ -639,6 +739,8 @@
-+@@ -702,6 +802,8 @@
-  
-  #define QCA955X_REV_ID_REVISION_MASK	0xf
-  
-@@ -705,9 +638,9 @@
-  /*
-   * SPI block
-   */
--@@ -684,6 +786,19 @@
-- #define AR934X_GPIO_REG_OUT_FUNC5	0x40
-- #define AR934X_GPIO_REG_FUNC		0x6c
-+@@ -766,6 +868,19 @@
-+ #define QCA953X_GPIO_OUT_MUX_LED_LINK4		44
-+ #define QCA953X_GPIO_OUT_MUX_LED_LINK5		45
-  
- +#define QCA956X_GPIO_REG_OUT_FUNC0	0x2c
- +#define QCA956X_GPIO_REG_OUT_FUNC1	0x30
-@@ -725,9 +658,9 @@
-  #define AR71XX_GPIO_COUNT		16
-  #define AR7240_GPIO_COUNT		18
-  #define AR7241_GPIO_COUNT		20
--@@ -692,6 +807,7 @@
-+@@ -774,6 +889,7 @@
-  #define AR934X_GPIO_COUNT		23
-- #define QCA953X_GPIO_COUNT		24
-+ #define QCA953X_GPIO_COUNT		18
-  #define QCA955X_GPIO_COUNT		24
- +#define QCA956X_GPIO_COUNT		23
-  
-diff --git a/target/linux/ar71xx/patches-3.18/736-MIPS-ath79-fix-chained-irq-disable.patch b/target/linux/ar71xx/patches-3.18/736-MIPS-ath79-fix-chained-irq-disable.patch
-index 8cb38d3..8c0cc95 100644
---- a/target/linux/ar71xx/patches-3.18/736-MIPS-ath79-fix-chained-irq-disable.patch
-+++ b/target/linux/ar71xx/patches-3.18/736-MIPS-ath79-fix-chained-irq-disable.patch
-@@ -19,7 +19,16 @@
-  
-  	irq_set_chained_handler(ATH79_CPU_IRQ(2), ar934x_ip2_irq_dispatch);
-  }
--@@ -224,15 +225,13 @@ static void qca955x_irq_init(void)
-+@@ -182,7 +183,7 @@ static void qca953x_irq_init(void)
-+ 
-+ 	for (i = ATH79_IP2_IRQ_BASE;
-+ 	     i < ATH79_IP2_IRQ_BASE + ATH79_IP2_IRQ_COUNT; i++)
-+-		irq_set_chip_and_handler(i, &dummy_irq_chip, handle_level_irq);
-++		irq_set_chip_and_handler(i, &ip2_chip, handle_level_irq);
-+ 
-+ 	irq_set_chained_handler(ATH79_CPU_IRQ(2), qca953x_ip2_irq_dispatch);
-+ }
-+@@ -256,15 +257,13 @@ static void qca955x_irq_init(void)
-  
-  	for (i = ATH79_IP2_IRQ_BASE;
-  	     i < ATH79_IP2_IRQ_BASE + ATH79_IP2_IRQ_COUNT; i++)
-@@ -37,25 +46,23 @@
-  
-  	irq_set_chained_handler(ATH79_CPU_IRQ(3), qca955x_ip3_irq_dispatch);
-  }
--@@ -313,15 +312,13 @@ static void qca956x_irq_init(void)
-+@@ -345,13 +344,13 @@ static void qca956x_irq_init(void)
-  
-  	for (i = ATH79_IP2_IRQ_BASE;
-  	     i < ATH79_IP2_IRQ_BASE + ATH79_IP2_IRQ_COUNT; i++)
---		irq_set_chip_and_handler(i, &dummy_irq_chip,
---					 handle_level_irq);
-+-		irq_set_chip_and_handler(i, &dummy_irq_chip, handle_level_irq);
- +		irq_set_chip_and_handler(i, &ip2_chip, handle_level_irq);
-  
-  	irq_set_chained_handler(ATH79_CPU_IRQ(2), qca956x_ip2_irq_dispatch);
-  
-  	for (i = ATH79_IP3_IRQ_BASE;
-  	     i < ATH79_IP3_IRQ_BASE + ATH79_IP3_IRQ_COUNT; i++)
---		irq_set_chip_and_handler(i, &dummy_irq_chip,
---					 handle_level_irq);
-+-		irq_set_chip_and_handler(i, &dummy_irq_chip, handle_level_irq);
- +		irq_set_chip_and_handler(i, &ip3_chip, handle_level_irq);
-  
-  	irq_set_chained_handler(ATH79_CPU_IRQ(3), qca956x_ip3_irq_dispatch);
-  
--@@ -430,8 +427,35 @@ static void ar934x_ip3_handler(void)
-+@@ -466,8 +465,35 @@ static void qca953x_ip3_handler(void)
-  	do_IRQ(ATH79_CPU_IRQ(3));
-  }
-  
diff --git a/patches/openwrt/0019-base-files-default_postinst-propagate-the-real-postinst-return-code.patch b/patches/openwrt/0019-base-files-default_postinst-propagate-the-real-postinst-return-code.patch
deleted file mode 100644
index 5aa64854..00000000
--- a/patches/openwrt/0019-base-files-default_postinst-propagate-the-real-postinst-return-code.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Fri, 7 Aug 2015 18:45:42 +0200
-Subject: base-files: default_postinst: propagate the real postinst return code
-
-Using the postinst script for sanity checks and expecting opkg to fail
-if the postinst didn't return 0 was possible in Barrier Breaker, propagate
-the real postinst return code through default_postinst to restore this
-behaviour.
-
-diff --git a/package/base-files/files/lib/functions.sh b/package/base-files/files/lib/functions.sh
-index 8d045fa..2f78d67 100755
---- a/package/base-files/files/lib/functions.sh
-+++ b/package/base-files/files/lib/functions.sh
-@@ -174,7 +174,8 @@ default_prerm() {
- }
- 
- default_postinst() {
--	local pkgname rusers
-+	local pkgname rusers ret
-+	ret=0
- 	pkgname=$(basename ${1%.*})
- 	rusers=$(grep "Require-User:" ${IPKG_INSTROOT}/usr/lib/opkg/info/${pkgname}.control)
- 	[ -n "$rusers" ] && {
-@@ -215,7 +216,10 @@ default_postinst() {
- 		done
- 	}
- 
--	[ -f ${IPKG_INSTROOT}/usr/lib/opkg/info/${pkgname}.postinst-pkg ] && ( . ${IPKG_INSTROOT}/usr/lib/opkg/info/${pkgname}.postinst-pkg )
-+	if [ -f ${IPKG_INSTROOT}/usr/lib/opkg/info/${pkgname}.postinst-pkg ]; then
-+		( . ${IPKG_INSTROOT}/usr/lib/opkg/info/${pkgname}.postinst-pkg )
-+		ret=$?
-+	fi
- 	[ -n "${IPKG_INSTROOT}" ] || rm -f /tmp/luci-indexcache 2>/dev/null
- 
- 	[ "$PKG_UPGRADE" = "1" ] || for i in `cat ${IPKG_INSTROOT}/usr/lib/opkg/info/${pkgname}.list | grep "^/etc/init.d/"`; do
-@@ -225,7 +229,7 @@ default_postinst() {
- 			$i start
- 		}
- 	done
--	return 0
-+	return $ret
- }
- 
- include() {
diff --git a/patches/openwrt/0020-opkg-work-around-unconditional-libopenssl-build-dependency.patch b/patches/openwrt/0020-opkg-work-around-unconditional-libopenssl-build-dependency.patch
deleted file mode 100644
index 77d8a05b..00000000
--- a/patches/openwrt/0020-opkg-work-around-unconditional-libopenssl-build-dependency.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Fri, 28 Aug 2015 10:43:55 +0200
-Subject: opkg: work around unconditional libopenssl build dependency
-
-As the OpenWrt build system only resolves build dependencies per directory,
-all opkg variants were causing libopenssl to be downloaded and built,
-not only opkg-smime. Fix this by applying the same workaround as in
-ustream-ssl.
-
-diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
-index 76688f5..3e39cf8 100644
---- a/package/system/opkg/Makefile
-+++ b/package/system/opkg/Makefile
-@@ -72,7 +72,7 @@ endef
- define Package/opkg-smime
-   $(call Package/opkg/Default)
-   TITLE+= (with S/MIME signature support)
--  DEPENDS+=+libopenssl
-+  DEPENDS+=+PACKAGE_opkg-smime:libopenssl
-   VARIANT:=smime
- endef
- 
diff --git a/patches/openwrt/0021-hostapd-work-around-unconditional-libopenssl-build-dependency.patch b/patches/openwrt/0021-hostapd-work-around-unconditional-libopenssl-build-dependency.patch
deleted file mode 100644
index 289a94a1..00000000
--- a/patches/openwrt/0021-hostapd-work-around-unconditional-libopenssl-build-dependency.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Fri, 28 Aug 2015 10:46:11 +0200
-Subject: hostapd: work around unconditional libopenssl build dependency
-
-As the OpenWrt build system only resolves build dependencies per directory,
-all hostapd variants were causing libopenssl to be downloaded and built,
-not only wpad-mesh. Fix this by applying the same workaround as in
-ustream-ssl.
-
-diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
-index c16cb11..c39b6b4 100644
---- a/package/network/services/hostapd/Makefile
-+++ b/package/network/services/hostapd/Makefile
-@@ -177,7 +177,7 @@ endef
- define Package/wpad-mesh
- $(call Package/wpad/Default)
-   TITLE+= (with 802.11s mesh and SAE support)
--  DEPENDS:=$(DRV_DEPENDS) +libubus +libopenssl +@CONFIG_WPA_SUPPLICANT_OPENSSL @(!TARGET_uml||BROKEN)
-+  DEPENDS:=$(DRV_DEPENDS) +libubus +PACKAGE_wpad-mesh:libopenssl +@CONFIG_WPA_SUPPLICANT_OPENSSL @(!TARGET_uml||BROKEN)
-   CONFLICTS:=@WPA_SUPPLICANT_INTERNAL
-   VARIANT:=wpad-mesh
- endef
diff --git a/patches/openwrt/0022-odhcp6c-minor-fixes.patch b/patches/openwrt/0022-odhcp6c-minor-fixes.patch
deleted file mode 100644
index 2b0a56b8..00000000
--- a/patches/openwrt/0022-odhcp6c-minor-fixes.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From: Nils Schneider <nils@nilsschneider.net>
-Date: Thu, 3 Sep 2015 18:07:17 +0200
-Subject: odhcp6c: minor fixes
-
-Better synchronize RA & DHCPv6 events
-Accumulate some events to avoid flooding
-Restart softwires for address and prefix changes
-
-Signed-off-by: Steven Barth <steven@midlink.org>
-
-diff --git a/package/network/ipv6/odhcp6c/Makefile b/package/network/ipv6/odhcp6c/Makefile
-index 75de54c..aa81e02 100644
---- a/package/network/ipv6/odhcp6c/Makefile
-+++ b/package/network/ipv6/odhcp6c/Makefile
-@@ -8,14 +8,14 @@
- include $(TOPDIR)/rules.mk
- 
- PKG_NAME:=odhcp6c
--PKG_VERSION:=2015-07-18
-+PKG_VERSION:=2015-07-29
- PKG_RELEASE=$(PKG_SOURCE_VERSION)
- 
- PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
- PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
- PKG_SOURCE_URL:=https://github.com/sbyx/odhcp6c.git
- PKG_SOURCE_PROTO:=git
--PKG_SOURCE_VERSION:=024525798c5f6aba3af9b2ef7b3af2f3c14f1db8
-+PKG_SOURCE_VERSION:=dc186d6d2b0dd4ad23ca5fc69c00e81f796ff6d9
- PKG_MAINTAINER:=Steven Barth <steven@midlink.org>
- PKG_LICENSE:=GPL-2.0
- 
-diff --git a/package/network/ipv6/odhcp6c/files/dhcpv6.script b/package/network/ipv6/odhcp6c/files/dhcpv6.script
-index 33f6d9b..677d35f 100755
---- a/package/network/ipv6/odhcp6c/files/dhcpv6.script
-+++ b/package/network/ipv6/odhcp6c/files/dhcpv6.script
-@@ -5,6 +5,8 @@
- 
- setup_interface () {
- 	local device="$1"
-+	local prefsig=""
-+	local addrsig=""
- 	proto_init_update "*" 1
- 
- 	# Merge RA-DNS
-@@ -34,6 +36,7 @@ setup_interface () {
- 
- 	for prefix in $PREFIXES; do
- 		proto_add_ipv6_prefix "$prefix"
-+		prefsig="$prefsig ${prefix%%,*}"
- 		local entry="${prefix#*/}"
- 		entry="${entry#*,}"
- 		entry="${entry#*,}"
-@@ -68,6 +71,7 @@ setup_interface () {
- 		local valid="${entry%%,*}"
- 
- 		proto_add_ipv6_address "$addr" "$mask" "$preferred" "$valid" 1
-+		addrsig="$addrsig $addr/$mask"
- 
- 		if [ -z "$RA_ADDRESSES" -a -z "$RA_ROUTES" -a \
- 				-z "$RA_DNS" -a "$FAKE_ROUTES" = 1 ]; then
-@@ -136,6 +140,8 @@ setup_interface () {
- 		json_add_string ifname "@$INTERFACE"
- 		json_add_string proto map
- 		json_add_string type "$MAPTYPE"
-+		json_add_string _prefsig "$prefsig"
-+		[ "$MAPTYPE" = lw4o6 ] && json_add_string _addrsig "$addrsig"
- 		json_add_string rule "$MAPRULE"
- 		json_add_string tunlink "$INTERFACE"
- 		[ -n "$ZONE_MAP" ] || ZONE_MAP=$ZONE
-@@ -163,6 +169,7 @@ setup_interface () {
- 		json_add_string ifname "@$INTERFACE"
- 		json_add_string proto "464xlat"
- 		json_add_string tunlink "$INTERFACE"
-+		json_add_string _addrsig "$addrsig"
- 		[ -n "$ZONE_464XLAT" ] || ZONE_464XLAT=$ZONE
- 		[ -n "$ZONE_464XLAT" ] && json_add_string zone "$ZONE_464XLAT"
- 		[ -n "$IFACE_464XLAT_DELEGATE" ] && json_add_boolean delegate "$IFACE_464XLAT_DELEGATE"
diff --git a/patches/openwrt/0024-base-files-add-etc-profile.d-support.patch b/patches/openwrt/0024-base-files-add-etc-profile.d-support.patch
deleted file mode 100644
index 0295626e..00000000
--- a/patches/openwrt/0024-base-files-add-etc-profile.d-support.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 11 Oct 2015 18:13:35 +0200
-Subject: base-files: add /etc/profile.d support
-
-OpenWrt should support an optional /etc/profile.d directory like
-most other Linux distributions. This allows packages to install
-their own scripts into /etc/profile.d/ directory.
-
-The file suffix should make clear, that these scripts
-are (sourced) shell-snippets. If the user needs e.g. php or lua,
-one must make sure that the interpreter is called.
-The reverse failsafe test makes sure, that the effective returncode is 0.
-
-A typcal usecase is the inclusion of private helpers,
-special variables or aliases, which at the moment needs
-patching the sourcecode and is not well maintainable.
-Now the builder can simply add there files.
-
-v1 initial work of Hendrik Lüth <hendrik@linux-nerds.de>
-v2 changes regarding RFC (e.g. thomas.langer@lantiq.com)
-v3 changes regarding RFC (e.g. mschiffer@universe-factory.net)
-v4 keep it simple and mimic OpenWrt style
-
-Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com>
-
-diff --git a/package/base-files/files/etc/profile b/package/base-files/files/etc/profile
-index 170f487..bd008a8 100644
---- a/package/base-files/files/etc/profile
-+++ b/package/base-files/files/etc/profile
-@@ -14,3 +14,10 @@ export PS1='\u@\h:\w\$ '
- 
- [ -x /usr/bin/arp ] || arp() { cat /proc/net/arp; }
- [ -x /usr/bin/ldd ] || ldd() { LD_TRACE_LOADED_OBJECTS=1 $*; }
-+
-+[ -n "$FAILSAFE" ] || {
-+	for FILE in /etc/profile.d/*.sh; do
-+		[ -e "$FILE" ] && . "$FILE"
-+	done
-+	unset FILE
-+}
diff --git a/patches/openwrt/0025-Kernel-Realtek-8150-and-Realtek-8152-based-USB-to-Ethernet-converters.patch b/patches/openwrt/0025-Kernel-Realtek-8150-and-Realtek-8152-based-USB-to-Ethernet-converters.patch
deleted file mode 100644
index b726c97b..00000000
--- a/patches/openwrt/0025-Kernel-Realtek-8150-and-Realtek-8152-based-USB-to-Ethernet-converters.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From: Andre Kasper <andre.kasper@gmx.de>
-Date: Mon, 12 Oct 2015 02:31:05 +0200
-Subject: Kernel: Realtek 8150 and Realtek 8152 based USB-to-Ethernet converters
-
-This patch adds the kernel modules to for the very common Realtek RTL8150 and Realtek 8152 based USB-to-Ethernet converters.
-After this patch the following packages can be added to targets (or site.mk):
-kmod-usb-net-rtl8150
-kmod-usb-net-rtl8152
-
-The modules are already available in openwrt trunk, but not in Chaos Calmer. This patch is just a temporary backport.
-The modules are needed for Futros with additional USB-Ethernet-Interface and VMs with dedicated USB-NIC
-
-diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
-index d1ff455..86f452e 100644
---- a/package/kernel/linux/modules/usb.mk
-+++ b/package/kernel/linux/modules/usb.mk
-@@ -1554,3 +1554,32 @@ define KernelPackage/usb3/description
- endef
- 
- $(eval $(call KernelPackage,usb3))
-+
-+define KernelPackage/usb-net-rtl8150
-+  TITLE:=Kernel module for USB-to-Ethernet Realtek convertors
-+  KCONFIG:=CONFIG_USB_RTL8150
-+  FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/rtl8150.ko
-+  AUTOLOAD:=$(call AutoProbe,rtl8150)
-+  $(call AddDepends/usb-net)
-+endef
-+
-+define KernelPackage/usb-net-rtl8150/description
-+ Kernel module for USB-to-Ethernet Realtek 8150 convertors
-+endef
-+
-+$(eval $(call KernelPackage,usb-net-rtl8150))
-+
-+
-+define KernelPackage/usb-net-rtl8152
-+  TITLE:=Kernel module for USB-to-Ethernet Realtek convertors
-+  KCONFIG:=CONFIG_USB_RTL8152
-+  FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/r8152.ko
-+  AUTOLOAD:=$(call AutoProbe,r8152)
-+  $(call AddDepends/usb-net)
-+endef
-+
-+define KernelPackage/usb-net-rtl8152/description
-+ Kernel module for USB-to-Ethernet Realtek 8152 USB2.0/3.0 convertors
-+endef
-+
-+$(eval $(call KernelPackage,usb-net-rtl8152))
diff --git a/patches/openwrt/0026-tools-firmware-utils-tplink-safeloader-clean-up-code.patch b/patches/openwrt/0026-tools-firmware-utils-tplink-safeloader-clean-up-code.patch
deleted file mode 100644
index 00d2a184..00000000
--- a/patches/openwrt/0026-tools-firmware-utils-tplink-safeloader-clean-up-code.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 15 Oct 2015 20:03:51 +0200
-Subject: tools/firmware-utils: tplink-safeloader: clean up code
-
-There is no reason for the internal functions not to be static.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
-index 9c5bb54..4607a1d 100644
---- a/tools/firmware-utils/src/tplink-safeloader.c
-+++ b/tools/firmware-utils/src/tplink-safeloader.c
-@@ -152,7 +152,7 @@ static const unsigned char cpe510_support_list[] =
- 
- 
- /** Allocates a new image partition */
--struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
-+static struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
- 	struct image_partition_entry entry = {name, len, malloc(len)};
- 	if (!entry.data)
- 		error(1, errno, "malloc");
-@@ -161,12 +161,12 @@ struct image_partition_entry alloc_image_partition(const char *name, size_t len)
- }
- 
- /** Frees an image partition */
--void free_image_partition(struct image_partition_entry entry) {
-+static void free_image_partition(struct image_partition_entry entry) {
- 	free(entry.data);
- }
- 
- /** Generates the partition-table partition */
--struct image_partition_entry make_partition_table(const struct flash_partition_entry *p) {
-+static struct image_partition_entry make_partition_table(const struct flash_partition_entry *p) {
- 	struct image_partition_entry entry = alloc_image_partition("partition-table", 0x800);
- 
- 	char *s = (char *)entry.data, *end = (char *)(s+entry.size);
-@@ -202,7 +202,7 @@ static inline uint8_t bcd(uint8_t v) {
- 
- 
- /** Generates the soft-version partition */
--struct image_partition_entry make_soft_version(uint32_t rev) {
-+static struct image_partition_entry make_soft_version(uint32_t rev) {
- 	struct image_partition_entry entry = alloc_image_partition("soft-version", sizeof(struct soft_version));
- 	struct soft_version *s = (struct soft_version *)entry.data;
- 
-@@ -233,14 +233,14 @@ struct image_partition_entry make_soft_version(uint32_t rev) {
- }
- 
- /** Generates the support-list partition */
--struct image_partition_entry make_support_list(const unsigned char *support_list, size_t len) {
-+static struct image_partition_entry make_support_list(const unsigned char *support_list, size_t len) {
- 	struct image_partition_entry entry = alloc_image_partition("support-list", len);
- 	memcpy(entry.data, support_list, len);
- 	return entry;
- }
- 
- /** Creates a new image partition with an arbitrary name from a file */
--struct image_partition_entry read_file(const char *part_name, const char *filename, bool add_jffs2_eof) {
-+static struct image_partition_entry read_file(const char *part_name, const char *filename, bool add_jffs2_eof) {
- 	struct stat statbuf;
- 
- 	if (stat(filename, &statbuf) < 0)
-@@ -300,7 +300,7 @@ struct image_partition_entry read_file(const char *part_name, const char *filena
- 
-    I think partition-table must be the first partition in the firmware image.
- */
--void put_partitions(uint8_t *buffer, const struct image_partition_entry *parts) {
-+static void put_partitions(uint8_t *buffer, const struct image_partition_entry *parts) {
- 	size_t i;
- 	char *image_pt = (char *)buffer, *end = image_pt + 0x800;
- 
-@@ -325,7 +325,7 @@ void put_partitions(uint8_t *buffer, const struct image_partition_entry *parts)
- }
- 
- /** Generates and writes the image MD5 checksum */
--void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
-+static void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
- 	MD5_CTX ctx;
- 
- 	MD5_Init(&ctx);
-@@ -349,7 +349,7 @@ void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
-      1014-1813    Image partition table (2048 bytes, padded with 0xff)
-      1814-xxxx    Firmware partitions
- */
--void * generate_factory_image(const unsigned char *vendor, size_t vendor_len, const struct image_partition_entry *parts, size_t *len) {
-+static void * generate_factory_image(const unsigned char *vendor, size_t vendor_len, const struct image_partition_entry *parts, size_t *len) {
- 	*len = 0x1814;
- 
- 	size_t i;
-@@ -381,7 +381,7 @@ void * generate_factory_image(const unsigned char *vendor, size_t vendor_len, co
-    should be generalized when TP-LINK starts building its safeloader into hardware with
-    different flash layouts.
- */
--void * generate_sysupgrade_image(const struct flash_partition_entry *flash_parts, const struct image_partition_entry *image_parts, size_t *len) {
-+static void * generate_sysupgrade_image(const struct flash_partition_entry *flash_parts, const struct image_partition_entry *image_parts, size_t *len) {
- 	const struct flash_partition_entry *flash_os_image = &flash_parts[5];
- 	const struct flash_partition_entry *flash_soft_version = &flash_parts[6];
- 	const struct flash_partition_entry *flash_support_list = &flash_parts[7];
-@@ -459,7 +459,7 @@ static void do_cpe510(const char *output, const char *kernel_image, const char *
- 
- 
- /** Usage output */
--void usage(const char *argv0) {
-+static void usage(const char *argv0) {
- 	fprintf(stderr,
- 		"Usage: %s [OPTIONS...]\n"
- 		"\n"
diff --git a/patches/openwrt/0027-tools-firmware-utils-tplink-safeloader-fix-support-list-format-clean-up-vendor-information.patch b/patches/openwrt/0027-tools-firmware-utils-tplink-safeloader-fix-support-list-format-clean-up-vendor-information.patch
deleted file mode 100644
index df0cf8c4..00000000
--- a/patches/openwrt/0027-tools-firmware-utils-tplink-safeloader-fix-support-list-format-clean-up-vendor-information.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 15 Oct 2015 21:01:25 +0200
-Subject: tools/firmware-utils: tplink-safeloader: fix support-list format, clean up vendor information
-
-The first 4 bytes of the support list and the vendor information are
-supposed to contain the length of these fields.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
-index 4607a1d..66658aa 100644
---- a/tools/firmware-utils/src/tplink-safeloader.c
-+++ b/tools/firmware-utils/src/tplink-safeloader.c
-@@ -103,7 +103,7 @@ static const uint8_t md5_salt[16] = {
- 
- 
- /** Vendor information for CPE210/220/510/520 */
--static const unsigned char cpe510_vendor[] = "\x00\x00\x00\x1f""CPE510(TP-LINK|UN|N300-5):1.0\r\n";
-+static const char cpe510_vendor[] = "CPE510(TP-LINK|UN|N300-5):1.0\r\n";
- 
- 
- /**
-@@ -133,14 +133,13 @@ static const struct flash_partition_entry cpe510_partitions[] = {
-    The stock images also contain strings for two more devices: BS510 and BS210.
-    At the moment, there exists no public information about these devices.
- */
--static const unsigned char cpe510_support_list[] =
--	"\x00\x00\x00\xc8\x00\x00\x00\x00"
-+static const char cpe510_support_list[] =
- 	"SupportList:\r\n"
- 	"CPE510(TP-LINK|UN|N300-5):1.0\r\n"
- 	"CPE520(TP-LINK|UN|N300-5):1.0\r\n"
- 	"CPE210(TP-LINK|UN|N300-2):1.0\r\n"
- 	"CPE220(TP-LINK|UN|N300-2):1.0\r\n"
--	"\r\n\xff";
-+	"\r\n";
- 
- #define error(_ret, _errno, _str, ...)				\
- 	do {							\
-@@ -151,6 +150,14 @@ static const unsigned char cpe510_support_list[] =
- 	} while (0)
- 
- 
-+/** Stores a uint32 as big endian */
-+static inline void put32(uint8_t *buf, uint32_t val) {
-+	buf[0] = val >> 24;
-+	buf[1] = val >> 16;
-+	buf[2] = val >> 8;
-+	buf[3] = val;
-+}
-+
- /** Allocates a new image partition */
- static struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
- 	struct image_partition_entry entry = {name, len, malloc(len)};
-@@ -233,9 +240,15 @@ static struct image_partition_entry make_soft_version(uint32_t rev) {
- }
- 
- /** Generates the support-list partition */
--static struct image_partition_entry make_support_list(const unsigned char *support_list, size_t len) {
--	struct image_partition_entry entry = alloc_image_partition("support-list", len);
--	memcpy(entry.data, support_list, len);
-+static struct image_partition_entry make_support_list(const char *support_list) {
-+	size_t len = strlen(support_list);
-+	struct image_partition_entry entry = alloc_image_partition("support-list", len + 9);
-+
-+	put32(entry.data, len);
-+	memset(entry.data+4, 0, 4);
-+	memcpy(entry.data+8, support_list, len);
-+	entry.data[len+8] = '\xff';
-+
- 	return entry;
- }
- 
-@@ -344,12 +357,13 @@ static void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
-      -----------  -----
-      0000-0003    Image size (4 bytes, big endian)
-      0004-0013    MD5 hash (hash of a 16 byte salt and the image data starting with byte 0x14)
--     0014-1013    Vendor information (4096 bytes, padded with 0xff; there seem to be older
-+     0014-0017    Vendor information length (without padding) (4 bytes, big endian)
-+     0018-1013    Vendor information (4092 bytes, padded with 0xff; there seem to be older
-                   (VxWorks-based) TP-LINK devices which use a smaller vendor information block)
-      1014-1813    Image partition table (2048 bytes, padded with 0xff)
-      1814-xxxx    Firmware partitions
- */
--static void * generate_factory_image(const unsigned char *vendor, size_t vendor_len, const struct image_partition_entry *parts, size_t *len) {
-+static void * generate_factory_image(const char *vendor, const struct image_partition_entry *parts, size_t *len) {
- 	*len = 0x1814;
- 
- 	size_t i;
-@@ -360,13 +374,12 @@ static void * generate_factory_image(const unsigned char *vendor, size_t vendor_
- 	if (!image)
- 		error(1, errno, "malloc");
- 
--	image[0] = *len >> 24;
--	image[1] = *len >> 16;
--	image[2] = *len >> 8;
--	image[3] = *len;
-+	put32(image, *len);
- 
--	memcpy(image+0x14, vendor, vendor_len);
--	memset(image+0x14+vendor_len, 0xff, 4096-vendor_len);
-+	size_t vendor_len = strlen(vendor);
-+	put32(image+0x14, vendor_len);
-+	memcpy(image+0x18, vendor, vendor_len);
-+	memset(image+0x18+vendor_len, 0xff, 4092-vendor_len);
- 
- 	put_partitions(image + 0x1014, parts);
- 	put_md5(image+0x04, image+0x14, *len-0x14);
-@@ -430,7 +443,7 @@ static void do_cpe510(const char *output, const char *kernel_image, const char *
- 
- 	parts[0] = make_partition_table(cpe510_partitions);
- 	parts[1] = make_soft_version(rev);
--	parts[2] = make_support_list(cpe510_support_list, sizeof(cpe510_support_list)-1);
-+	parts[2] = make_support_list(cpe510_support_list);
- 	parts[3] = read_file("os-image", kernel_image, false);
- 	parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof);
- 
-@@ -439,7 +452,7 @@ static void do_cpe510(const char *output, const char *kernel_image, const char *
- 	if (sysupgrade)
- 		image = generate_sysupgrade_image(cpe510_partitions, parts, &len);
- 	else
--		image = generate_factory_image(cpe510_vendor, sizeof(cpe510_vendor)-1, parts, &len);
-+		image = generate_factory_image(cpe510_vendor, parts, &len);
- 
- 	FILE *file = fopen(output, "wb");
- 	if (!file)
diff --git a/patches/openwrt/0028-tools-firmware-utils-tplink-safeloader-add-version-1.1-support-to-CPE210-220-510-520.patch b/patches/openwrt/0028-tools-firmware-utils-tplink-safeloader-add-version-1.1-support-to-CPE210-220-510-520.patch
deleted file mode 100644
index e35965c7..00000000
--- a/patches/openwrt/0028-tools-firmware-utils-tplink-safeloader-add-version-1.1-support-to-CPE210-220-510-520.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 15 Oct 2015 21:56:40 +0200
-Subject: tools/firmware-utils: tplink-safeloader: add version 1.1 support to CPE210/220/510/520
-
-The hardware is identical to version 1.0, add the new models to the support
-list.
-
-Also remove the empty line at the end of the support list, the current
-stock images don't have it either.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
-index 66658aa..77a894b 100644
---- a/tools/firmware-utils/src/tplink-safeloader.c
-+++ b/tools/firmware-utils/src/tplink-safeloader.c
-@@ -129,17 +129,17 @@ static const struct flash_partition_entry cpe510_partitions[] = {
- 
- /**
-    The support list for CPE210/220/510/520
--
--   The stock images also contain strings for two more devices: BS510 and BS210.
--   At the moment, there exists no public information about these devices.
- */
- static const char cpe510_support_list[] =
- 	"SupportList:\r\n"
- 	"CPE510(TP-LINK|UN|N300-5):1.0\r\n"
-+	"CPE510(TP-LINK|UN|N300-5):1.1\r\n"
- 	"CPE520(TP-LINK|UN|N300-5):1.0\r\n"
-+	"CPE520(TP-LINK|UN|N300-5):1.1\r\n"
- 	"CPE210(TP-LINK|UN|N300-2):1.0\r\n"
-+	"CPE210(TP-LINK|UN|N300-2):1.1\r\n"
- 	"CPE220(TP-LINK|UN|N300-2):1.0\r\n"
--	"\r\n";
-+	"CPE220(TP-LINK|UN|N300-2):1.1\r\n";
- 
- #define error(_ret, _errno, _str, ...)				\
- 	do {							\
diff --git a/patches/openwrt/0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch b/patches/openwrt/0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch
deleted file mode 100644
index f74c7922..00000000
--- a/patches/openwrt/0030-ar71xx-add-support-for-TP-LINK-TL-WR941ND-v6-international-version.patch
+++ /dev/null
@@ -1,330 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 2 Nov 2015 19:21:20 +0100
-Subject: ar71xx: add support for TP-LINK TL-WR941ND v6 (international version)
-
-diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
-index 89fe53c..3e80c32 100644
---- a/target/linux/ar71xx/base-files/etc/diag.sh
-+++ b/target/linux/ar71xx/base-files/etc/diag.sh
-@@ -279,7 +279,8 @@ get_status_led() {
- 	tl-wdr4300 | \
- 	tl-wr703n | \
- 	tl-wr710n | \
--	tl-wr720n-v3)
-+	tl-wr720n-v3 | \
-+	tl-wr941nd-v6)
- 		status_led="tp-link:blue:system"
- 		;;
- 	tl-wr841n-v9)
-diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds b/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds
-index 5241db2..11b3fa0 100644
---- a/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds
-+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/01_leds
-@@ -460,6 +460,15 @@ tl-wr941nd-v5)
- 	ucidef_set_led_wlan "wlan" "WLAN" "tp-link:green:wlan" "phy0tpt"
- 	;;
- 
-+tl-wr941nd-v6)
-+	ucidef_set_led_netdev "wan" "WAN" "tp-link:blue:wan" "eth0"
-+	ucidef_set_led_switch "lan1" "LAN1" "tp-link:blue:lan1" "switch0" "0x10"
-+	ucidef_set_led_switch "lan2" "LAN2" "tp-link:blue:lan2" "switch0" "0x08"
-+	ucidef_set_led_switch "lan3" "LAN3" "tp-link:blue:lan3" "switch0" "0x04"
-+	ucidef_set_led_switch "lan4" "LAN4" "tp-link:blue:lan4" "switch0" "0x02"
-+	ucidef_set_led_wlan "wlan" "WLAN" "tp-link:blue:wlan" "phy0tpt"
-+	;;
-+
- tl-wa830re-v2)
- 	ucidef_set_led_netdev "lan" "LAN" "tp-link:green:lan" "eth0"
- 	ucidef_set_led_wlan "wlan" "WLAN" "tp-link:green:wlan" "phy0tpt"
-diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/02_network b/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
-index 8143d2d..5a74461 100755
---- a/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
-+++ b/target/linux/ar71xx/base-files/etc/uci-defaults/02_network
-@@ -226,6 +226,7 @@ tl-mr3420-v2 |\
- tl-wr841n-v8 |\
- tl-wr842n-v2 |\
- tl-wr941nd-v5 |\
-+tl-wr941nd-v6 |\
- wnr2000-v3 |\
- wnr2000-v4 |\
- wnr2200 |\
-diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
-index 0b2857d..46af69a 100755
---- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
-+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
-@@ -800,6 +800,9 @@ ar71xx_board_detect() {
- 	*"TL-WR941N/ND v5")
- 		name="tl-wr941nd-v5"
- 		;;
-+	*"TL-WR941N/ND v6")
-+		name="tl-wr941nd-v6"
-+		;;
- 	*"TL-WR703N v1")
- 		name="tl-wr703n"
- 		;;
-diff --git a/target/linux/ar71xx/base-files/lib/preinit/05_set_preinit_iface_ar71xx b/target/linux/ar71xx/base-files/lib/preinit/05_set_preinit_iface_ar71xx
-index f11ea8c..fd337e1 100644
---- a/target/linux/ar71xx/base-files/lib/preinit/05_set_preinit_iface_ar71xx
-+++ b/target/linux/ar71xx/base-files/lib/preinit/05_set_preinit_iface_ar71xx
-@@ -35,6 +35,7 @@ set_preinit_iface() {
- 	tl-wr720n-v3 |\
- 	tl-wr841n-v8 |\
- 	tl-wr842n-v2 |\
-+	tl-wr941nd-v6 |\
- 	wnr2000-v3 |\
- 	wnr2200 |\
- 	wnr612-v2 |\
-diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
-index 8dea48f..2fc1d10 100755
---- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
-+++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
-@@ -354,6 +354,7 @@ platform_check_image() {
- 	tl-wr842n-v2 | \
- 	tl-wr941nd | \
- 	tl-wr941nd-v5 | \
-+	tl-wr941nd-v6 | \
- 	tl-wr1041n-v2 | \
- 	tl-wr1043nd | \
- 	tl-wr1043nd-v2 | \
-diff --git a/target/linux/ar71xx/config-3.18 b/target/linux/ar71xx/config-3.18
-index e9b3c7c..84b5844 100644
---- a/target/linux/ar71xx/config-3.18
-+++ b/target/linux/ar71xx/config-3.18
-@@ -132,6 +132,7 @@ CONFIG_ATH79_MACH_TL_WR841N_V1=y
- CONFIG_ATH79_MACH_TL_WR841N_V8=y
- CONFIG_ATH79_MACH_TL_WR841N_V9=y
- CONFIG_ATH79_MACH_TL_WR941ND=y
-+CONFIG_ATH79_MACH_TL_WR941ND_V6=y
- CONFIG_ATH79_MACH_TUBE2H=y
- CONFIG_ATH79_MACH_UBNT=y
- CONFIG_ATH79_MACH_UBNT_XM=y
-diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr941nd-v6.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr941nd-v6.c
-new file mode 100644
-index 0000000..8c788e2
---- /dev/null
-+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr941nd-v6.c
-@@ -0,0 +1,149 @@
-+/*
-+ *  TP-LINK TL-WR941N/ND v6 board support
-+ *
-+ *  Copyright (C) 2015 Matthias Schiffer <mschiffer@universe-factory.net>
-+ *
-+ *  This program is free software; you can redistribute it and/or modify it
-+ *  under the terms of the GNU General Public License version 2 as published
-+ *  by the Free Software Foundation.
-+ */
-+
-+#include <linux/gpio.h>
-+#include <linux/platform_device.h>
-+
-+#include <asm/mach-ath79/ath79.h>
-+#include <asm/mach-ath79/ar71xx_regs.h>
-+
-+#include "common.h"
-+#include "dev-eth.h"
-+#include "dev-gpio-buttons.h"
-+#include "dev-leds-gpio.h"
-+#include "dev-m25p80.h"
-+#include "dev-wmac.h"
-+#include "machtypes.h"
-+
-+
-+#define TL_WR941ND_V6_GPIO_LED_QSS		3
-+#define TL_WR941ND_V6_GPIO_LED_WAN		14
-+#define TL_WR941ND_V6_GPIO_LED_WAN_RED		15
-+#define TL_WR941ND_V6_GPIO_LED_LAN1		7
-+#define TL_WR941ND_V6_GPIO_LED_LAN2		6
-+#define TL_WR941ND_V6_GPIO_LED_LAN3		5
-+#define TL_WR941ND_V6_GPIO_LED_LAN4		4
-+#define TL_WR941ND_V6_GPIO_LED_WLAN		8
-+#define TL_WR941ND_V6_GPIO_LED_SYSTEM		18
-+
-+#define TL_WR941ND_V6_GPIO_BTN_RESET		1
-+#define TL_WR941ND_V6_GPIO_BTN_RFKILL		2
-+
-+#define TL_WR941ND_V6_KEYS_POLL_INTERVAL	20
-+#define TL_WR941ND_V6_KEYS_DEBOUNCE_INTERVAL	(3 * TL_WR941ND_V6_KEYS_POLL_INTERVAL)
-+
-+
-+static struct gpio_led tl_wr941nd_v6_leds_gpio[] __initdata = {
-+	{
-+		.name		= "tp-link:blue:qss",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_QSS,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:blue:wan",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_WAN,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:red:wan",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_WAN_RED,
-+		.active_low	= 0,
-+	},
-+	{
-+		.name		= "tp-link:blue:lan1",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_LAN1,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:blue:lan2",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_LAN2,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:blue:lan3",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_LAN3,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:blue:lan4",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_LAN4,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:blue:wlan",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_WLAN,
-+		.active_low	= 1,
-+	},
-+	{
-+		.name		= "tp-link:blue:system",
-+		.gpio		= TL_WR941ND_V6_GPIO_LED_SYSTEM,
-+		.active_low	= 1,
-+	},
-+};
-+
-+static struct gpio_keys_button tl_wr941nd_v6_gpio_keys[] __initdata = {
-+	{
-+		.desc		= "Reset button",
-+		.type		= EV_KEY,
-+		.code		= KEY_RESTART,
-+		.debounce_interval = TL_WR941ND_V6_KEYS_DEBOUNCE_INTERVAL,
-+		.gpio		= TL_WR941ND_V6_GPIO_BTN_RESET,
-+		.active_low	= 1,
-+	}, {
-+		.desc		= "RFKILL button",
-+		.type		= EV_KEY,
-+		.code		= KEY_RFKILL,
-+		.debounce_interval = TL_WR941ND_V6_KEYS_DEBOUNCE_INTERVAL,
-+		.gpio		= TL_WR941ND_V6_GPIO_BTN_RFKILL,
-+		.active_low	= 1,
-+	}
-+};
-+
-+
-+static const char *tl_wr941n_v6_part_probes[] = {
-+	"tp-link",
-+	NULL,
-+};
-+
-+static struct flash_platform_data tl_wr941n_v6_flash_data = {
-+	.part_probes	= tl_wr941n_v6_part_probes,
-+};
-+
-+
-+static void __init tl_wr941nd_v6_setup(void)
-+{
-+	u8 *mac = (u8 *) KSEG1ADDR(0x1f01fc00);
-+	u8 *ee = (u8 *) KSEG1ADDR(0x1fff1000);
-+
-+	ath79_register_m25p80(&tl_wr941n_v6_flash_data);
-+
-+	ath79_register_leds_gpio(-1, ARRAY_SIZE(tl_wr941nd_v6_leds_gpio),
-+				 tl_wr941nd_v6_leds_gpio);
-+
-+	ath79_register_gpio_keys_polled(-1, TL_WR941ND_V6_KEYS_POLL_INTERVAL,
-+					ARRAY_SIZE(tl_wr941nd_v6_gpio_keys),
-+					tl_wr941nd_v6_gpio_keys);
-+
-+	ath79_register_mdio(0, 0x0);
-+
-+	ath79_init_mac(ath79_eth0_data.mac_addr, mac, 1);
-+	ath79_init_mac(ath79_eth1_data.mac_addr, mac, -1);
-+
-+	ath79_switch_data.phy4_mii_en = 1;
-+
-+	ath79_register_eth(0);
-+	ath79_register_eth(1);
-+
-+	ath79_register_wmac(ee, mac);
-+
-+}
-+
-+MIPS_MACHINE(ATH79_MACH_TL_WR941ND_V6, "TL-WR941ND-v6", "TP-LINK TL-WR941N/ND v6",
-+	     tl_wr941nd_v6_setup);
-diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
-index 78d35e1..11fb568 100644
---- a/target/linux/ar71xx/image/Makefile
-+++ b/target/linux/ar71xx/image/Makefile
-@@ -600,7 +600,7 @@ endef
- 
- define Device/tl-wr941nd-v6
-     $(Device/tplink-4mlzma)
--    BOARDNAME := TL-WDR3500
-+    BOARDNAME := TL-WR941ND-v6
-     DEVICE_PROFILE := TLWR941
-     TPLINK_HWID := 0x09410006
- endef
-diff --git a/target/linux/ar71xx/patches-3.18/610-MIPS-ath79-openwrt-machines.patch b/target/linux/ar71xx/patches-3.18/610-MIPS-ath79-openwrt-machines.patch
-index 2fa041b..185cb9c 100644
---- a/target/linux/ar71xx/patches-3.18/610-MIPS-ath79-openwrt-machines.patch
-+++ b/target/linux/ar71xx/patches-3.18/610-MIPS-ath79-openwrt-machines.patch
-@@ -1,6 +1,6 @@
- --- a/arch/mips/ath79/machtypes.h
- +++ b/arch/mips/ath79/machtypes.h
--@@ -16,22 +16,197 @@
-+@@ -16,22 +16,198 @@
-  
-  enum ath79_mach_type {
-  	ATH79_MACH_GENERIC = 0,
-@@ -148,6 +148,7 @@
- +	ATH79_MACH_TL_WR842N_V2,	/* TP-LINK TL-WR842N/ND v2 */
- +	ATH79_MACH_TL_WR941ND,		/* TP-LINK TL-WR941ND */
- +	ATH79_MACH_TL_WR941ND_V5,	/* TP-LINK TL-WR941ND v5 */
-++	ATH79_MACH_TL_WR941ND_V6,	/* TP-LINK TL-WR941ND v6 */
- +	ATH79_MACH_TUBE2H,		/* Alfa Network Tube2H */
- +	ATH79_MACH_UBNT_AIRGW,		/* Ubiquiti AirGateway */
-  	ATH79_MACH_UBNT_AIRROUTER,	/* Ubiquiti AirRouter */
-@@ -271,7 +272,7 @@
-  config ATH79_MACH_AP121
-  	bool "Atheros AP121 reference board"
-  	select SOC_AR933X
--@@ -11,62 +75,1041 @@ config ATH79_MACH_AP121
-+@@ -11,62 +75,1050 @@ config ATH79_MACH_AP121
-  	select ATH79_DEV_M25P80
-  	select ATH79_DEV_USB
-  	select ATH79_DEV_WMAC
-@@ -1246,6 +1247,15 @@
- +	select ATH79_DEV_M25P80
- +	select ATH79_DEV_WMAC
- +
-++config ATH79_MACH_TL_WR941ND_V6
-++	bool "TP-LINK TL-WR941ND v6 support"
-++	select SOC_QCA956X
-++	select ATH79_DEV_ETH
-++	select ATH79_DEV_GPIO_BUTTONS
-++	select ATH79_DEV_LEDS_GPIO
-++	select ATH79_DEV_M25P80
-++	select ATH79_DEV_WMAC
-++
- +config ATH79_MACH_TL_WR1041N_V2
- +	bool "TP-LINK TL-WR1041N v2 support"
- +	select SOC_AR934X
-@@ -1474,7 +1484,7 @@
-  endif
- --- a/arch/mips/ath79/Makefile
- +++ b/arch/mips/ath79/Makefile
--@@ -38,9 +38,126 @@ obj-$(CONFIG_ATH79_ROUTERBOOT)		+= route
-+@@ -38,9 +38,127 @@ obj-$(CONFIG_ATH79_ROUTERBOOT)		+= route
-  #
-  # Machines
-  #
-@@ -1566,6 +1576,7 @@
- +obj-$(CONFIG_ATH79_MACH_TL_WR841N_V8)	+= mach-tl-wr841n-v8.o
- +obj-$(CONFIG_ATH79_MACH_TL_WR841N_V9)	+= mach-tl-wr841n-v9.o
- +obj-$(CONFIG_ATH79_MACH_TL_WR941ND)	+= mach-tl-wr941nd.o
-++obj-$(CONFIG_ATH79_MACH_TL_WR941ND_V6)	+= mach-tl-wr941nd-v6.o
- +obj-$(CONFIG_ATH79_MACH_TL_WR1041N_V2)	+= mach-tl-wr1041n-v2.o
- +obj-$(CONFIG_ATH79_MACH_TL_WR1043ND)	+= mach-tl-wr1043nd.o
- +obj-$(CONFIG_ATH79_MACH_TL_WR1043ND_V2)	+= mach-tl-wr1043nd-v2.o
diff --git a/patches/openwrt/0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch b/patches/openwrt/0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch
deleted file mode 100644
index 0518a00b..00000000
--- a/patches/openwrt/0031-ar71xx-add-support-for-TP-Link-TL-WR1043ND-v3.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Andreas Ziegler <github@andreas-ziegler.de>
-Date: Thu, 5 Nov 2015 15:48:09 +0100
-Subject: ar71xx: add support for TP-Link TL-WR1043ND v3
-
-diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
-index 11fb568..dd224d4 100644
---- a/target/linux/ar71xx/image/Makefile
-+++ b/target/linux/ar71xx/image/Makefile
-@@ -2023,6 +2023,7 @@ $(eval $(call SingleProfile,TPLINK,64kraw,TLWR941NV4,tl-wr941nd-v4,TL-WR741ND,tt
- $(eval $(call SingleProfile,TPLINK,64kraw,TLWR1043V1,tl-wr1043nd-v1,TL-WR1043ND,ttyS0,115200,0x10430001,1,8M))
- 
- $(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V2,tl-wr1043nd-v2,TL-WR1043ND-v2,ttyS0,115200,0x10430002,1,8M))
-+$(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR1043V3,tl-wr1043nd-v3,TL-WR1043ND-v2,ttyS0,115200,0x10430003,1,8M))
- $(eval $(call SingleProfile,TPLINK-LZMA,64kraw,TLWR2543,tl-wr2543-v1,TL-WR2543N,ttyS0,115200,0x25430001,1,8Mlzma,-v 3.13.99))
- 
- $(eval $(call SingleProfile,TPLINK-SAFELOADER,64kraw,CPE510,cpe210-220-510-520,CPE510,ttyS0,115200,$$(cpe510_mtdlayout),CPE510))
-@@ -2087,7 +2088,7 @@ $(eval $(call MultiProfile,TLWR743,TLWR743NV1))
- $(eval $(call MultiProfile,TLWR841,TLWR841NV15 TLWR841NV3 TLWR841NV5 TLWR841NV7))
- $(eval $(call MultiProfile,TLWR842,TLWR842V1))
- $(eval $(call MultiProfile,TLWR941,TLWR941NV2 TLWR941NV3 TLWR941NV4))
--$(eval $(call MultiProfile,TLWR1043,TLWR1043V1 TLWR1043V2))
-+$(eval $(call MultiProfile,TLWR1043,TLWR1043V1 TLWR1043V2 TLWR1043V3))
- $(eval $(call MultiProfile,TLWDR4300,TLWDR3500V1 TLWDR3600V1 TLWDR4300V1 TLWDR4300V1IL TLWDR4310V1 MW4530RV1))
- $(eval $(call MultiProfile,TUBE2H,TUBE2H8M TUBE2H16M))
- $(eval $(call MultiProfile,UBNT,UBNTAIRROUTER UBNTRS UBNTRSPRO UBNTLSSR71 UBNTBULLETM UBNTROCKETM UBNTROCKETMXW UBNTNANOM UBNTNANOMXW UBNTLOCOXW UBNTUNIFI UBNTUNIFIOUTDOOR UBNTUNIFIOUTDOORPLUS UAPPRO UBNTAIRGW))
diff --git a/patches/openwrt/0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch b/patches/openwrt/0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch
deleted file mode 100644
index 0c99ddc2..00000000
--- a/patches/openwrt/0032-ar71xx-backport-ath10k-calibration-data-load-changes.patch
+++ /dev/null
@@ -1,197 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Wed, 18 Nov 2015 02:01:55 +0100
-Subject: ar71xx: backport ath10k calibration data load changes
-
-The mac80211 update makes is necessary to backport this change as well for
-ath10k to load.
-
-diff --git a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
-index dd3f546..7111630 100644
---- a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
-+++ b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
-@@ -8,50 +8,83 @@ ath10kcal_die() {
- ath10kcal_from_file() {
- 	local source=$1
- 	local offset=$2
--	local target=$3
-+	local count=$3
- 
--	dd if=$source of=$target bs=1 skip=$offset count=2116 2>/dev/null || \
-+	dd if=$source of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
- 		ath10kcal_die "failed to extract calibration data from $source"
- }
- 
-+ath10kcal_extract() {
-+	local part=$1
-+	local offset=$2
-+	local count=$3
-+	local mtd
-+
-+	mtd=$(find_mtd_chardev $part)
-+	[ -n "$mtd" ] || \
-+		ath10kcal_die "no mtd device found for partition $part"
-+
-+	dd if=$mtd of=/lib/firmware/$FIRMWARE bs=1 skip=$offset count=$count 2>/dev/null || \
-+		ath10kcal_die "failed to extract calibration data from $mtd"
-+}
-+
-+ath10kcal_patch_mac() {
-+	local mac=$1
-+
-+	[ -z "$mac" ] && return
-+
-+	macaddr_2bin $mac | dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=6 count=6
-+}
-+
- [ -e /lib/firmware/$FIRMWARE ] && exit 0
- 
- . /lib/ar71xx.sh
- . /lib/functions.sh
- . /lib/functions/system.sh
- 
--ath10kcal_mac=""
--ath10kcal_tmp="/tmp/ath10k-caldata.bin"
--
- board=$(ar71xx_board_name)
- 
- case "$FIRMWARE" in
--"ath10k/cal-pci-0000:01:00.0.bin")
--	case $board in
--	rb-911g-5hpacd)
--		ath10kcal_from_file "/sys/firmware/routerboot/ext_wlan_data" 20480 $ath10kcal_tmp
--		;;
--	esac
--	;;
--
- "ath10k/cal-pci-0000:00:00.0.bin")
- 	case $board in
- 	dlan-pro-1200-ac)
--		ath10kcal_from_file $(find_mtd_part "art") 20480 $ath10kcal_tmp
-+		ath10kcal_extract "art" 20480 2116
-+		;;
-+	mc-mac1200r)
-+		ath10kcal_extract "art" 20480 2116
-+		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth1/address) -1)
-+		;;
-+	r6100)
-+		ath10kcal_extract "caldata" 20480 2116
-+		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth1/address) +2)
-+		;;
-+	qihoo-c301)
-+		ath10kcal_extract "radiocfg" 20480 2116
-+		ath10kcal_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
- 		;;
- 	esr1750 | \
- 	epg5000)
--		ath10kcal_from_file $(find_mtd_part "caldata") 20480 $ath10kcal_tmp
-+		ath10kcal_extract "caldata" 20480 2116
-+		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +1)
-+		;;
-+	esac
-+	;;
-+"ath10k/cal-pci-0000:01:00.0.bin")
-+	case $board in
-+	archer-c5 | \
-+	archer-c7)
-+		ath10kcal_extract "art" 20480 2116
-+		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth1/address) -2)
-+		;;
-+	nbg6716)
-+		ath10kcal_extract "RFdata" 20480 2116
-+		;;
-+	rb-911g-5hpacd)
-+		ath10kcal_from_file "/sys/firmware/routerboot/ext_wlan_data" 20480 2116
- 		;;
- 	esac
- 	;;
--
- *)
- 	exit 1
- 	;;
- esac
--
--[ -f $ath10kcal_tmp ] && {
--	cp $ath10kcal_tmp /lib/firmware/$FIRMWARE
--	rm -f $ath10kcal_tmp
--}
-diff --git a/target/linux/ar71xx/base-files/lib/preinit/81_load_ath10k_board_bin b/target/linux/ar71xx/base-files/lib/preinit/81_load_ath10k_board_bin
-deleted file mode 100644
-index 9a32dfc..0000000
---- a/target/linux/ar71xx/base-files/lib/preinit/81_load_ath10k_board_bin
-+++ /dev/null
-@@ -1,75 +0,0 @@
--#!/bin/sh
--
--. /lib/functions/system.sh
--. /lib/ar71xx.sh
--
--do_load_ath10k_board_bin() {
--	# load board.bin
--	case $(ar71xx_board_name) in
--		nbg6716)
--			dd if=/dev/mtdblock2 \
--				bs=1 skip=20480 count=2116 \
--				of=/tmp/ath10k-board.bin
--		;;
--		archer-c5 | \
--		archer-c7)
--			local mac
--			mac=$(macaddr_add $(cat /sys/class/net/eth1/address) -2)
--
--			dd if=/dev/mtdblock4 \
--				bs=1 skip=20480 count=6 \
--				of=/tmp/ath10k-board.bin
--			macaddr_2bin $mac >> /tmp/ath10k-board.bin
--			dd if=/dev/mtdblock4 \
--				bs=1 skip=20492 count=2104 >> /tmp/ath10k-board.bin
--		;;
--		mc-mac1200r)
--			local mac
--			mac=$(macaddr_add $(cat /sys/class/net/eth1/address) -1)
--
--			dd if=/dev/mtdblock4 \
--				bs=1 skip=20480 count=6 \
--				of=/tmp/ath10k-board.bin
--			macaddr_2bin $mac >> /tmp/ath10k-board.bin
--			dd if=/dev/mtdblock4 \
--				bs=1 skip=20492 count=2104 >> /tmp/ath10k-board.bin
--		;;
--		r6100)
--			local mac
--			mac=$(macaddr_add $(cat /sys/class/net/eth1/address) +2)
--
--			dd if=/dev/mtdblock2 \
--				bs=1 skip=20480 count=6 \
--				of=/tmp/ath10k-board.bin
--			macaddr_2bin $mac >> /tmp/ath10k-board.bin
--			dd if=/dev/mtdblock2 \
--				bs=1 skip=20492 count=2104 >> /tmp/ath10k-board.bin
--		;;
--		qihoo-c301)
--			local mac
--
--			mac=$(mtd_get_mac_ascii devdata wlan5mac)
--
--			if [ -z "$mac" ]; then
--				mac=$(macaddr_add $(cat /sys/class/net/eth0/address) -2)
--			fi
--
--			dd if=/dev/mtdblock10 \
--				bs=1 skip=20480 count=6 \
--				of=/tmp/ath10k-board.bin
--			macaddr_2bin $mac >> /tmp/ath10k-board.bin
--			dd if=/dev/mtdblock10 \
--				bs=1 skip=20492 count=2104 >> /tmp/ath10k-board.bin
--
--		;;
--	esac
--	[ -f /tmp/ath10k-board.bin ] || {
--		return
--	}
--	cmp -s /tmp/ath10k-board.bin /lib/firmware/ath10k/QCA988X/hw2.0/board.bin || {
--		cp /tmp/ath10k-board.bin /lib/firmware/ath10k/QCA988X/hw2.0/board.bin
--		rm /tmp/ath10k-board.bin
--	}
--}
--
--boot_hook_add preinit_main do_load_ath10k_board_bin
diff --git a/patches/openwrt/0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch b/patches/openwrt/0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch
deleted file mode 100644
index 9916aa81..00000000
--- a/patches/openwrt/0033-ar71xx-fix-AR71XX_MODEL-on-TP-Link-TL-WR703N.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 19 Nov 2015 23:29:17 +0100
-Subject: ar71xx: fix AR71XX_MODEL on TP-Link TL-WR703N
-
-The hwid check was wrong, causing the AR71XX_MODEL value to end with a
-space (as $hwver was unset).
-
-diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
-index 46af69a..d0abf42 100755
---- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
-+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
-@@ -123,7 +123,7 @@ tplink_board_detect() {
- 	"3C0002"*)
- 		model="MINIBOX_V1"
- 		;;
--	"070300"*)
-+	"070301"*)
- 		model="TP-Link TL-WR703N"
- 		;;
- 	"071000"*)
diff --git a/patches/openwrt/0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch b/patches/openwrt/0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch
deleted file mode 100644
index 4d18a727..00000000
--- a/patches/openwrt/0034-OpenSSL-Added-source-old-to-PKG_SOURCE_URL.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From: Ranlvor <ranlvor@starletp9.de>
-Date: Sun, 6 Dec 2015 16:12:55 +0100
-Subject: OpenSSL: Added source/old to PKG_SOURCE_URL
-
-OpenSSL moves old versions of the library from http://www.openssl.org/source/
-to http://www.openssl.org/source/old/1.0.2/ breaking the old links. That
-behavior breaks the OpenWRT-build every time OpenSSL releases a new version.
-
-This patch adds http://www.openssl.org/source/old/1.0.2/ to the PKG_SOURCE_URL
-of OpenSSL to avoid breaking the build whenever OpenSSL releases a new
-version.
-
-diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile
-index ad93678..9a16599 100644
---- a/package/libs/openssl/Makefile
-+++ b/package/libs/openssl/Makefile
-@@ -16,6 +16,7 @@ PKG_BUILD_PARALLEL:=1
- 
- PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
- PKG_SOURCE_URL:=http://www.openssl.org/source/ \
-+	http://www.openssl.org/source/old/1.0.2/ \
- 	ftp://ftp.funet.fi/pub/crypt/mirrors/ftp.openssl.org/source \
- 	ftp://ftp.sunet.se/pub/security/tools/net/openssl/source/
- PKG_MD5SUM:=b3bf73f507172be9292ea2a8c28b659d
diff --git a/patches/openwrt/0037-x86-generic-refresh-kernel-config.patch b/patches/openwrt/0037-x86-generic-refresh-kernel-config.patch
deleted file mode 100644
index a650e115..00000000
--- a/patches/openwrt/0037-x86-generic-refresh-kernel-config.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From: Felix Kaechele <felix@kaechele.ca>
-Date: Tue, 17 Nov 2015 05:00:02 +0100
-Subject: x86/generic: refresh kernel config
-
-Signed-off-by: Felix Kaechele <felix@kaechele.ca>
-
-diff --git a/target/linux/x86/generic/config-default b/target/linux/x86/generic/config-default
-index eb4b357..e077ebd 100644
---- a/target/linux/x86/generic/config-default
-+++ b/target/linux/x86/generic/config-default
-@@ -17,7 +17,6 @@ CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
- CONFIG_ACPI_PROCESSOR=y
- # CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
- # CONFIG_ACPI_PROCFS_POWER is not set
--# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
- # CONFIG_ACPI_SBS is not set
- CONFIG_ACPI_THERMAL=y
- CONFIG_ACPI_VIDEO=y
-@@ -46,7 +45,6 @@ CONFIG_BACKLIGHT_LCD_SUPPORT=y
- CONFIG_BLK_DEV_SR=y
- # CONFIG_BLK_DEV_SR_VENDOR is not set
- CONFIG_CPU_IDLE_GOV_MENU=y
--# CONFIG_DELL_SMO8800 is not set
- CONFIG_DMA_SHARED_BUFFER=y
- CONFIG_DMI=y
- # CONFIG_DMIID is not set
-@@ -120,7 +118,6 @@ CONFIG_INPUT_MOUSEDEV=y
- CONFIG_INPUT_MOUSEDEV_PSAUX=y
- CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
- CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
--# CONFIG_INT340X_THERMAL is not set
- CONFIG_INTEL_GTT=y
- CONFIG_INTEL_IDLE=y
- # CONFIG_INTEL_IPS is not set
-@@ -173,13 +170,10 @@ CONFIG_PNP_DEBUG_MESSAGES=y
- CONFIG_RAS=y
- # CONFIG_SAMSUNG_Q10 is not set
- CONFIG_SATA_AHCI=y
--# CONFIG_SCx200_ACB is not set
--# CONFIG_SERIAL_8250_FINTEK is not set
- CONFIG_SERIAL_8250_PNP=y
- # CONFIG_THINKPAD_ACPI is not set
- # CONFIG_TOPSTAR_LAPTOP is not set
- # CONFIG_TOSHIBA_BT_RFKILL is not set
--# CONFIG_TOSHIBA_HAPS is not set
- CONFIG_USB=y
- CONFIG_USB_COMMON=y
- CONFIG_USB_EHCI_HCD=y
diff --git a/patches/openwrt/0038-x86-generic-enable-pata_atiixp-driver.patch b/patches/openwrt/0038-x86-generic-enable-pata_atiixp-driver.patch
deleted file mode 100644
index 6a489761..00000000
--- a/patches/openwrt/0038-x86-generic-enable-pata_atiixp-driver.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Felix Kaechele <felix@kaechele.ca>
-Date: Tue, 17 Nov 2015 05:00:51 +0100
-Subject: x86/generic: enable pata_atiixp driver
-
-This enables booting from devices that use an ATI PATA controller for
-the boot device, such as the embedded CF cards in Fujitsu-Siemens Futro
-thin-clients.
-
-Signed-off-by: Felix Kaechele <felix@kaechele.ca>
-
-diff --git a/target/linux/x86/generic/config-default b/target/linux/x86/generic/config-default
-index e077ebd..666a985 100644
---- a/target/linux/x86/generic/config-default
-+++ b/target/linux/x86/generic/config-default
-@@ -150,6 +150,7 @@ CONFIG_NLS=y
- CONFIG_NO_HZ=y
- # CONFIG_PANASONIC_LAPTOP is not set
- CONFIG_PATA_AMD=y
-+CONFIG_PATA_ATIIXP=y
- CONFIG_PATA_LEGACY=y
- CONFIG_PATA_MPIIX=y
- CONFIG_PATA_OLDPIIX=y
diff --git a/patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch b/patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch
deleted file mode 100644
index 781fd5d4..00000000
--- a/patches/openwrt/0040-firmware-utils-mkfwimage-add-Wall-fix-obvious-bugs-causing-compile-warnings.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 25 Feb 2016 21:39:03 +0100
-Subject: firmware-utils: mkfwimage: add -Wall, fix obvious bugs causing compile warnings
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/tools/firmware-utils/Makefile b/tools/firmware-utils/Makefile
-index bd69cb4..6d88845 100644
---- a/tools/firmware-utils/Makefile
-+++ b/tools/firmware-utils/Makefile
-@@ -32,7 +32,7 @@ define Host/Compile
- 	$(call cc,mkzynfw)
- 	$(call cc,lzma2eva,-lz)
- 	$(call cc,mkcasfw)
--	$(call cc,mkfwimage,-lz)
-+	$(call cc,mkfwimage,-lz -Wall)
- 	$(call cc,mkfwimage2,-lz)
- 	$(call cc,imagetag imagetag_cmdline cyg_crc32)
- 	$(call cc,add_header)
-diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
-index e3a03c1..00bf439 100644
---- a/tools/firmware-utils/src/mkfwimage.c
-+++ b/tools/firmware-utils/src/mkfwimage.c
-@@ -104,8 +104,6 @@ typedef struct part_data {
- 
- #define OPTIONS "B:hv:m:o:r:k:"
- 
--static int debug = 0;
--
- typedef struct image_info {
- 	char magic[16];
- 	char version[256];
-@@ -236,9 +234,9 @@ static int create_image_layout(const char* kernelfile, const char* rootfsfile, c
- 	fw_layout_t* p;
- 
- 	p = &fw_layout_data[0];
--	while ((strlen(p->name) != 0) && (strncmp(p->name, board_name, sizeof(board_name)) != 0))
-+	while (*p->name && (strcmp(p->name, board_name) != 0))
- 		p++;
--	if (p->name == NULL) {
-+	if (!*p->name) {
- 		printf("BUG! Unable to find default fw layout!\n");
- 		exit(-1);
- 	}
-@@ -247,7 +245,7 @@ static int create_image_layout(const char* kernelfile, const char* rootfsfile, c
- 	strcpy(kernel->partition_name, "kernel");
- 	kernel->partition_index = 1;
- 	kernel->partition_baseaddr = p->kern_start;
--	if ( (kernel->partition_length = filelength(kernelfile)) < 0) return (-1);
-+	if ( (kernel->partition_length = filelength(kernelfile)) == (u_int32_t)-1) return (-1);
- 	kernel->partition_memaddr = p->kern_entry;
- 	kernel->partition_entryaddr = p->kern_entry;
- 	strncpy(kernel->filename, kernelfile, sizeof(kernel->filename));
-@@ -263,8 +261,8 @@ static int create_image_layout(const char* kernelfile, const char* rootfsfile, c
- 	rootfs->partition_entryaddr = 0x00000000;
- 	strncpy(rootfs->filename, rootfsfile, sizeof(rootfs->filename));
- 
--printf("kernel: %d 0x%08x\n", kernel->partition_length, kernel->partition_baseaddr);
--printf("root: %d 0x%08x\n", rootfs->partition_length, rootfs->partition_baseaddr);
-+	printf("kernel: %d 0x%08x\n", kernel->partition_length, kernel->partition_baseaddr);
-+	printf("root: %d 0x%08x\n", rootfs->partition_length, rootfs->partition_baseaddr);
- 	im->part_count = 2;
- 
- 	return 0;
diff --git a/patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch b/patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch
deleted file mode 100644
index aa94ff83..00000000
--- a/patches/openwrt/0041-ar71xx-firmware-utils-split-ubdev01-flash-layout-from-XM.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 25 Feb 2016 21:40:19 +0100
-Subject: ar71xx, firmware-utils: split ubdev01 flash layout from XM
-
-The ubdev01 profile defines its own MTDPARTS with smaller firmware
-partition, so give it its own UBNT_BOARD in mkfwimage.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
-index dd224d4..4aaa115 100644
---- a/target/linux/ar71xx/image/Makefile
-+++ b/target/linux/ar71xx/image/Makefile
-@@ -2031,7 +2031,7 @@ $(eval $(call SingleProfile,TPLINK-SAFELOADER,64kraw,CPE510,cpe210-220-510-520,C
- $(eval $(call SingleProfile,UAPPRO,64k,UAPPRO,ubnt-uap-pro,UAP-PRO,ttyS0,115200,BZ,BZ,ar934x))
- $(eval $(call SingleProfile,UAPPRO,64k,UBNTUNIFIOUTDOORPLUS,ubnt-unifi-outdoor-plus,UBNT-UOP,ttyS0,115200,BZ,BZ,ar7240))
- 
--$(eval $(call SingleProfile,UBDEV,64kraw,UBDEV01,ubdev01,UBNT-UF,ttyS0,115200,XM,XM,ar7240))
-+$(eval $(call SingleProfile,UBDEV,64kraw,UBDEV01,ubdev01,UBNT-UF,ttyS0,115200,UBDEV01,XM,ar7240))
- 
- $(eval $(call SingleProfile,UBNT,64k,UBNTRS,ubnt-rs,UBNT-RS,ttyS0,115200,RS,RSx,ar7100))
- $(eval $(call SingleProfile,UBNT,64k,UBNTRSPRO,ubnt-rspro,UBNT-RSPRO,ttyS0,115200,RSPRO,RSPRO,ar7100pro))
-diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
-index 00bf439..5dae284 100644
---- a/tools/firmware-utils/src/mkfwimage.c
-+++ b/tools/firmware-utils/src/mkfwimage.c
-@@ -81,6 +81,12 @@ fw_layout_t fw_layout_data[] = {
- 		.kern_entry	=	0x80002000,
- 		.firmware_max_length=	0x006A0000,
- 	},
-+	{
-+		.name		=	"UBDEV01",
-+		.kern_start	=	0x9f050000,
-+		.kern_entry	=	0x80002000,
-+		.firmware_max_length=	0x006A0000,
-+	},
- 	{	.name		=	"",
- 	},
- };
diff --git a/patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch b/patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch
deleted file mode 100644
index ab1c34db..00000000
--- a/patches/openwrt/0042-firmware-utils-mkfwimage-fix-firmware_max_length-for-XM-layout.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 25 Feb 2016 21:42:14 +0100
-Subject: firmware-utils: mkfwimage: fix firmware_max_length for XM layout
-
-The new u-boot version bundled with the 5.6.x firmwares from Ubiquiti gets
-confused by the smaller rootfs partition size; this can lead to various
-issues:
-
-1. We've gotten reports that flashing from the 5.6.x stock firmware to
-   OpenWrt will brick devices; I wasn't able to reproduce this myself
-2. Flashing from 5.5.x stock firmware to OpenWrt and back to stock (via
-   TFTP recovery), following by an update to 5.6.x via web interface can
-   yield a bricked device with the following properties:
-   - It can't be booted without entering commands over a serial console, as
-     u-boot supplies the wrong MTD layout
-   - The web interface won't accept any image with the original flash
-     layout, so stock firmware upgrades are impossible
-   - As the TFTP recovery doesn't update u-boot, returning to the old
-     u-boot from firmware 5.5.x is impossible
-
-To recover from 2., creating an OpenWrt image which doesn't set u-boot as
-read-only and flashing a backup of the old u-boot from there is the only
-way known to me. (Fixing the mtdparts variable in u-boot-env from OpenWrt
-might also work; settings this from u-boot over serial didn't have
-any permanent effect.)
-
-Fix all of this by setting the correct flash layout also used by the stock
-firmware. Flashing has been tested from both firmware 5.5.x and 5.6.x. The
-fixed layout also matches the mtdparts defined by OpenWrt.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
-index 5dae284..d8d5239 100644
---- a/tools/firmware-utils/src/mkfwimage.c
-+++ b/tools/firmware-utils/src/mkfwimage.c
-@@ -79,7 +79,7 @@ fw_layout_t fw_layout_data[] = {
- 		.name		=	"XM",
- 		.kern_start	=	0x9f050000,
- 		.kern_entry	=	0x80002000,
--		.firmware_max_length=	0x006A0000,
-+		.firmware_max_length=	0x00760000,
- 	},
- 	{
- 		.name		=	"UBDEV01",
diff --git a/patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch b/patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch
deleted file mode 100644
index 2b16474a..00000000
--- a/patches/openwrt/0043-kernel-disable-software-protection-bits-for-macronix-flash-chips-at-init.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Fri, 26 Feb 2016 04:24:06 +0100
-Subject: kernel: disable software protection bits for macronix flash chips at init
-
-Backport of r47626
-
-diff --git a/target/linux/generic/patches-3.18/465-m25p80-mx-disable-software-protection.patch b/target/linux/generic/patches-3.18/465-m25p80-mx-disable-software-protection.patch
-new file mode 100644
-index 0000000..d7d7eec
---- /dev/null
-+++ b/target/linux/generic/patches-3.18/465-m25p80-mx-disable-software-protection.patch
-@@ -0,0 +1,10 @@
-+--- a/drivers/mtd/spi-nor/spi-nor.c
-++++ b/drivers/mtd/spi-nor/spi-nor.c
-+@@ -962,6 +962,7 @@ int spi_nor_scan(struct spi_nor *nor, co
-+ 
-+ 	if (JEDEC_MFR(info->jedec_id) == CFI_MFR_ATMEL ||
-+ 	    JEDEC_MFR(info->jedec_id) == CFI_MFR_INTEL ||
-++	    JEDEC_MFR(info->jedec_id) == CFI_MFR_MACRONIX ||
-+ 	    JEDEC_MFR(info->jedec_id) == CFI_MFR_SST) {
-+ 		write_enable(nor);
-+ 		write_sr(nor, 0);
diff --git a/patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch b/patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch
deleted file mode 100644
index 1fab9e46..00000000
--- a/patches/openwrt/0044-brcm2708-gpu-fw-move-pkg-build-dir-to-kernel-build-dir-to-fix-rebuild-bugs-after-cleaning-the-kernel-tree.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 28 Feb 2016 02:29:56 +0100
-Subject: brcm2708-gpu-fw: move pkg build dir to kernel build dir to fix rebuild bugs after cleaning the kernel tree
-
-Backport of r48732
-
-diff --git a/package/kernel/brcm2708-gpu-fw/Makefile b/package/kernel/brcm2708-gpu-fw/Makefile
-index eee85e0..286984b 100644
---- a/package/kernel/brcm2708-gpu-fw/Makefile
-+++ b/package/kernel/brcm2708-gpu-fw/Makefile
-@@ -16,7 +16,7 @@ PKG_SOURCE:=$(PKG_REV).tar.gz
- PKG_SOURCE_URL:=https://github.com/Hexxeh/rpi-firmware/archive/
- PKG_MD5SUM:=f5683c1dcb255714942f7c9fd61b3a0a
- 
--PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)/rpi-firmware-$(PKG_REV)
-+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_NAME)/rpi-firmware-$(PKG_REV)
- 
- include $(INCLUDE_DIR)/package.mk
- 
diff --git a/patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch b/patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch
deleted file mode 100644
index cba048f6..00000000
--- a/patches/openwrt/0045-kernel-gpio_keys-load-module-on-pre-init.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 28 Feb 2016 03:42:29 +0100
-Subject: kernel/gpio_keys: load module on pre-init
-
-fix rescue mode on wdr4900
-
-Backport of r48793
-
-diff --git a/package/kernel/linux/modules/input.mk b/package/kernel/linux/modules/input.mk
-index 86ff33c..eed9aa2 100644
---- a/package/kernel/linux/modules/input.mk
-+++ b/package/kernel/linux/modules/input.mk
-@@ -75,7 +75,7 @@ define KernelPackage/input-gpio-keys
- 	CONFIG_KEYBOARD_GPIO \
- 	CONFIG_INPUT_KEYBOARD=y
-   FILES:=$(LINUX_DIR)/drivers/input/keyboard/gpio_keys.ko
--  AUTOLOAD:=$(call AutoProbe,gpio_keys)
-+  AUTOLOAD:=$(call AutoProbe,gpio_keys,1)
- endef
- 
- define KernelPackage/input-gpio-keys/description
diff --git a/patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch b/patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch
deleted file mode 100644
index 2d08f3b4..00000000
--- a/patches/openwrt/0046-ar71xx-lzma-loader-fix-O32-ABI-conformance.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sun, 28 Feb 2016 04:49:51 +0100
-Subject: ar71xx/lzma-loader: fix O32 ABI conformance
-
-According to the calling convention of the o32 ABI the caller
-function must reserve stack space for $a0-$a3 registers in case
-the callee needs to save its arguments.
-
-The assembly code of the loader does not reserve stack space for
-these registers thus when the 'loader_main' function needs to save
-its arguments, those will be stored in the 'workspace' area instead
-of the stack.
-
-Because the workspace area is also used by other part of the code, the
-saved register values gets overwritten and this often leads to failed
-kernel boots.
-
-Fix the code to reserve stack space for the registers to avoid this
-error.
-
-Backport of r48279
-
-diff --git a/target/linux/ar71xx/image/lzma-loader/src/head.S b/target/linux/ar71xx/image/lzma-loader/src/head.S
-index 543996a..47a7c9b 100644
---- a/target/linux/ar71xx/image/lzma-loader/src/head.S
-+++ b/target/linux/ar71xx/image/lzma-loader/src/head.S
-@@ -109,6 +109,9 @@ __bss_check:
- 	/* Setup new "C" stack */
- 	la	sp, _stack
- 
-+	/* reserve stack space for a0-a3 registers */
-+	subu	sp, 16
-+
- 	/* jump to the decompressor routine */
- 	la	t0, loader_main
- 	jr	t0

From 45e238aa05be02631de380813a577e191b8043e4 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Tue, 1 Mar 2016 17:07:18 +0100
Subject: [PATCH 22/35] Update OpenWrt base

---
 modules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules b/modules
index 418420e0..af734c2e 100644
--- a/modules
+++ b/modules
@@ -1,7 +1,7 @@
 GLUON_FEEDS='openwrt gluon routing luci'
 
 OPENWRT_REPO=git://git.openwrt.org/15.05/openwrt.git
-OPENWRT_COMMIT=8882c524d9b5e4c16ebfea10c0090f38b07c9da5
+OPENWRT_COMMIT=f4368a72353194fbe998a02baeb3690d3a83174b
 
 PACKAGES_OPENWRT_REPO=git://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_COMMIT=9622fe984bba3a4547f48bc507ebaba7637eb2b0

From 595cba1bfa9ba0627e310e613b5ea86c65889cb4 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Tue, 1 Mar 2016 23:33:00 +0100
Subject: [PATCH 23/35] Update OpenWrt base

---
 modules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules b/modules
index af734c2e..08733cba 100644
--- a/modules
+++ b/modules
@@ -1,7 +1,7 @@
 GLUON_FEEDS='openwrt gluon routing luci'
 
 OPENWRT_REPO=git://git.openwrt.org/15.05/openwrt.git
-OPENWRT_COMMIT=f4368a72353194fbe998a02baeb3690d3a83174b
+OPENWRT_COMMIT=e982dbdada8e73bac6b205c546e18ab89de29cf5
 
 PACKAGES_OPENWRT_REPO=git://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_COMMIT=9622fe984bba3a4547f48bc507ebaba7637eb2b0

From 6f4ca79d0143efa823ceb89298af9697e3a25cfb Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Wed, 2 Mar 2016 01:03:33 +0100
Subject: [PATCH 24/35] docs: update list of supported hardware

---
 docs/index.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/index.rst b/docs/index.rst
index feac0979..c099306a 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -106,12 +106,17 @@ ar71xx-generic
   - WNDR3800
   - WNDRMAC (v2)
 
+* Onion
+
+  - Omega
+
 * TP-Link
 
   - CPE210 (v1.0, v1.1)
   - CPE220 (v1.0, v1.1)
   - CPE510 (v1.0, v1.1)
   - CPE520 (v1.0, v1.1)
+  - TL-MR13U (v1)
   - TL-MR3020 (v1)
   - TL-MR3040 (v1, v2)
   - TL-MR3220 (v1, v2)

From 0320b4da0385523e63549eb4b2eeb75a118ac11c Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Wed, 2 Mar 2016 00:58:26 +0100
Subject: [PATCH 25/35] docs, README: add release notes for v2016.1.1, update
 version numbers

---
 README.md                     |  2 +-
 docs/index.rst                |  1 +
 docs/releases/v2016.1.1.rst   | 64 +++++++++++++++++++++++++++++++++++
 docs/user/getting_started.rst |  4 +--
 4 files changed, 68 insertions(+), 3 deletions(-)
 create mode 100644 docs/releases/v2016.1.1.rst

diff --git a/README.md b/README.md
index b20fe40f..cc8ce8f4 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ our mailinglist to discuss it first.
 
 Please refrain from using the `master` branch for anything else but development purposes!
 Use the most recent release instead. You can list all relaseses by running `git branch -a`
-and switch to one by running `git checkout v2016.1 && make update`.
+and switch to one by running `git checkout v2016.1.1 && make update`.
 
 If you're using the autoupdater, do not autoupdate nodes with anything but releases.
 If you upgrade using random master commits the nodes *will break* eventually.
diff --git a/docs/index.rst b/docs/index.rst
index c099306a..cbe1c5d4 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -60,6 +60,7 @@ Releases
 .. toctree::
    :maxdepth: 1
 
+   releases/v2016.1.1
    releases/v2016.1
    releases/v2015.1.2
    releases/v2015.1.1
diff --git a/docs/releases/v2016.1.1.rst b/docs/releases/v2016.1.1.rst
new file mode 100644
index 00000000..59ca2504
--- /dev/null
+++ b/docs/releases/v2016.1.1.rst
@@ -0,0 +1,64 @@
+Gluon 2016.1.1
+==============
+
+Added hardware support
+~~~~~~~~~~~~~~~~~~~~~~
+
+ar71xx-generic
+^^^^^^^^^^^^^^
+
+* Onion Omega
+* TP-Link TL-MR13U v1
+
+
+Bugfixes
+~~~~~~~~
+
+Build
+^^^^^
+
+Don't overwrite the opkg repository key on each build.
+
+AirOS 5.6.x compatiblity
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+Downgrading to AirOS 5.5.x before flashing Gluon on Airmax M XM/XW devices
+(NanoStation, Bullet, ...) is not necessary anymore.
+
+Status page
+^^^^^^^^^^^
+
+* Fix purging of disappered neighbours from the list
+* Don't clear the signal graphs when scrolling in mobile browsers
+* Improve browser compability (don't assume the Internationalization API is available,
+  fixes the display of numbers in Firefox for Android)
+
+Config mode
+^^^^^^^^^^^
+
+* Strip trailing whitespace from number input fields (LuCI's validator doesn't catch this)
+* Don't allow negative bandwidth limits
+
+Failsafe mode
+^^^^^^^^^^^^^
+
+* Fix entering the failsafe mode on the TL-WDR4900.
+
+Known Issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Expert Mode is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd/announced API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Nondeterministic production of broken images for some (very old) hardware (`#669 <https://github.com/freifunk-gluon/gluon/issues/669>`_)
+
+  At the moment it seems like only the TL-WR841N v5 is affected.
diff --git a/docs/user/getting_started.rst b/docs/user/getting_started.rst
index f10f9acf..a989344c 100644
--- a/docs/user/getting_started.rst
+++ b/docs/user/getting_started.rst
@@ -8,7 +8,7 @@ Gluon's releases are managed using `Git tags`_. If you are just getting
 started with Gluon we recommend to use the latest stable release of Gluon.
 
 Take a look at the `list of gluon releases`_ and notice the latest release,
-e.g. *v2016.1*. Always get Gluon using git and don't try to download it
+e.g. *v2016.1.1*. Always get Gluon using git and don't try to download it
 as a Zip archive as the archive will be missing version information.
 
 Please keep in mind that there is no "default Gluon" build; a site configuration
@@ -42,7 +42,7 @@ Building the images
 -------------------
 
 To build Gluon, first check out the repository. Replace *RELEASE* with the
-version you'd like to checkout, e.g. *v2016.1*.
+version you'd like to checkout, e.g. *v2016.1.1*.
 
 ::
 

From 8272a8f8071a01aa62a610af770d62373815d150 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Thu, 3 Mar 2016 23:49:58 +0100
Subject: [PATCH 26/35] Update OpenWrt base

---
 modules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules b/modules
index 08733cba..73c240c3 100644
--- a/modules
+++ b/modules
@@ -1,7 +1,7 @@
 GLUON_FEEDS='openwrt gluon routing luci'
 
 OPENWRT_REPO=git://git.openwrt.org/15.05/openwrt.git
-OPENWRT_COMMIT=e982dbdada8e73bac6b205c546e18ab89de29cf5
+OPENWRT_COMMIT=efc26cc8e0513b3ec703ba540a554fde2c717cf6
 
 PACKAGES_OPENWRT_REPO=git://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_COMMIT=9622fe984bba3a4547f48bc507ebaba7637eb2b0

From 3b61a768b90aa59365d8703724e2c25789f22b4e Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Fri, 4 Mar 2016 00:51:28 +0100
Subject: [PATCH 27/35] Update Gluon packages

---
 modules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules b/modules
index 73c240c3..40ce211c 100644
--- a/modules
+++ b/modules
@@ -8,7 +8,7 @@ PACKAGES_OPENWRT_COMMIT=9622fe984bba3a4547f48bc507ebaba7637eb2b0
 PACKAGES_OPENWRT_BRANCH=for-15.05
 
 PACKAGES_GLUON_REPO=git://github.com/freifunk-gluon/packages.git
-PACKAGES_GLUON_COMMIT=06f2a62b97a25ddd1b9919d084c626d42cef5489
+PACKAGES_GLUON_COMMIT=fea8f67d5d5cccac39b5020a69106f8665d41e58
 
 PACKAGES_ROUTING_REPO=git://github.com/openwrt-routing/packages.git
 PACKAGES_ROUTING_COMMIT=2a8338559de5c4b077cde7a83f43f4700a17d5cc

From 1f06d20705c55f8ff51e5ff01f199f02e756d5ff Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Fri, 4 Mar 2016 17:38:58 +0100
Subject: [PATCH 28/35] ath10k: remove hard dependency on
 ath10k-firmware-qca988x

We use our own firmware package.
---
 ...-Candela-Technologies-firmware-for-QCA988X.patch | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch b/patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
index 725d5995..5baf2712 100644
--- a/patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
+++ b/patches/openwrt/0006-ath10k-firmware-add-Candela-Technologies-firmware-for-QCA988X.patch
@@ -57,3 +57,16 @@ index b03d644..7d4d449 100644
 +$(eval $(call BuildPackage,ath10k-firmware-qca988x-ct))
  $(eval $(call BuildPackage,ath10k-firmware-qca99x0))
  $(eval $(call BuildPackage,ath10k-firmware-qca6174))
+diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
+index 30da1cf..cd8d670 100644
+--- a/package/kernel/mac80211/Makefile
++++ b/package/kernel/mac80211/Makefile
+@@ -247,7 +247,7 @@ define KernelPackage/ath10k
+   $(call KernelPackage/mac80211/Default)
+   TITLE:=Atheros 802.11ac wireless cards support
+   URL:=https://wireless.wiki.kernel.org/en/users/Drivers/ath10k
+-  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY +ath10k-firmware-qca988x
++  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +@KERNEL_RELAY
+   FILES:= \
+ 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
+ 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko

From 13658879e5e4bd9622196af88cc3f0d7e092f6a4 Mon Sep 17 00:00:00 2001
From: Johannes Rudolph <johannes.rudolph@gmx.com>
Date: Sun, 6 Mar 2016 03:09:09 +0100
Subject: [PATCH 29/35] git submodules

Possibility to work with git submodules
---
 scripts/update.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/update.sh b/scripts/update.sh
index 5f0e684e..fa5f4316 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -16,4 +16,5 @@ for module in $GLUON_MODULES; do
 
 	git checkout $commit 2>/dev/null || git fetch $repo $branch
 	git checkout -B base $commit
+	git submodule update --init --recursive
 done

From 01878f4bbc94622c91e8789e96ea73967fa45830 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Mon, 7 Mar 2016 06:08:32 +0100
Subject: [PATCH 30/35] Backport GPIO control support

Backport of rr46271 and r46922.

Based-on-patch-by: Julian Kornberger <jk+github@digineo.de>
---
 ...files-implemented-basic-GPIO-control.patch | 133 ++++++++++++++++++
 ...-pin-for-Ubiquiti-Nanostation-models.patch |  32 +++++
 2 files changed, 165 insertions(+)
 create mode 100644 patches/openwrt/0015-base-files-implemented-basic-GPIO-control.patch
 create mode 100644 patches/openwrt/0016-ar71xx-assign-proper-GPIO-pin-for-Ubiquiti-Nanostation-models.patch

diff --git a/patches/openwrt/0015-base-files-implemented-basic-GPIO-control.patch b/patches/openwrt/0015-base-files-implemented-basic-GPIO-control.patch
new file mode 100644
index 00000000..c3f6c8d5
--- /dev/null
+++ b/patches/openwrt/0015-base-files-implemented-basic-GPIO-control.patch
@@ -0,0 +1,133 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 7 Mar 2016 06:07:21 +0100
+Subject: base-files: implemented basic GPIO control
+
+Internal GPIO pins are used for PoE passthrough setups in multi-port
+routers. This patch implemnets control over this hardware feature for
+Ubiquiti Nanostations and TP-Link CPE510.
+
+Signed-off-by: Lars Kruse <lists@sumpfralle.de>
+
+Backport of r46271
+
+diff --git a/package/base-files/files/etc/init.d/gpio_switch b/package/base-files/files/etc/init.d/gpio_switch
+new file mode 100755
+index 0000000..1f1b44b
+--- /dev/null
++++ b/package/base-files/files/etc/init.d/gpio_switch
+@@ -0,0 +1,42 @@
++#!/bin/sh /etc/rc.common
++# Copyright (C) 2015 OpenWrt.org
++
++START=98
++STOP=10
++USE_PROCD=1
++
++
++load_gpio_switch()
++{
++	local name
++	local gpio_pin
++	local value
++
++	config_get gpio_pin "$1" gpio_pin
++	config_get name "$1" name
++	config_get value "$1" value 0
++
++	local gpio_path="/sys/class/gpio/gpio${gpio_pin}"
++	# export GPIO pin for access
++	[ -d "$gpio_path" ] || {
++		echo "$gpio_pin" >/sys/class/gpio/export
++		# we need to wait a bit until the GPIO appears
++		[ -d "$gpio_path" ] || sleep 1
++		echo out >"$gpio_path/direction"
++	}
++	# write 0 or 1 to the "value" field
++	{ [ "$value" = "0" ] && echo "0" || echo "1"; } >"$gpio_path/value"
++}
++
++service_triggers()
++{
++	procd_add_reload_trigger "system"
++}
++
++start_service()
++{
++	[ -e /sys/class/gpio/ ] && {
++		config_load system
++		config_foreach load_gpio_switch gpio_switch
++	}
++}
+diff --git a/package/base-files/files/lib/functions/uci-defaults.sh b/package/base-files/files/lib/functions/uci-defaults.sh
+index 5a8809d..6577ecd 100644
+--- a/package/base-files/files/lib/functions/uci-defaults.sh
++++ b/package/base-files/files/lib/functions/uci-defaults.sh
+@@ -2,6 +2,7 @@
+ # Copyright (C) 2011 OpenWrt.org
+ 
+ UCIDEF_LEDS_CHANGED=0
++UCIDEF_GPIO_SWITCHES_CHANGED=0
+ 
+ ucidef_set_led_netdev() {
+ 	local cfg="led_$1"
+@@ -180,6 +181,29 @@ ucidef_commit_leds()
+ 	[ "$UCIDEF_LEDS_CHANGED" = "1" ] && uci commit system
+ }
+ 
++ucidef_set_gpio_switch() {
++	local cfg="gpio_switch_$1"
++	local name="$2"
++	local gpio_pin="$3"
++	# use "0" as default value
++	local default="${4:-0}"
++
++	uci -q get "system.$cfg" && return 0
++
++	uci batch <<EOF
++set system.$cfg='gpio_switch'
++set system.$cfg.name='$name'
++set system.$cfg.gpio_pin='$gpio_pin'
++set system.$cfg.value='$default'
++EOF
++	UCIDEF_GPIO_SWITCHES_CHANGED=1
++}
++
++ucidef_commit_gpio_switches()
++{
++	[ "$UCIDEF_GPIO_SWITCHES_CHANGED" = "1" ] && uci commit system
++}
++
+ ucidef_set_interface_loopback() {
+ 	uci batch <<EOF
+ set network.loopback='interface'
+diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches b/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches
+new file mode 100644
+index 0000000..81d3982
+--- /dev/null
++++ b/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches
+@@ -0,0 +1,25 @@
++#!/bin/sh
++#
++# Copyright (C) 2015 OpenWrt.org
++#
++
++. /lib/functions/uci-defaults.sh
++. /lib/ar71xx.sh
++
++board=$(ar71xx_board_name)
++
++case "$board" in
++nanostation-m)
++	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "2"
++	;;
++nanostation-m-xw)
++	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "8"
++	;;
++cpe510)
++	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "20"
++	;;
++esac
++
++ucidef_commit_gpio_switches
++
++exit 0
diff --git a/patches/openwrt/0016-ar71xx-assign-proper-GPIO-pin-for-Ubiquiti-Nanostation-models.patch b/patches/openwrt/0016-ar71xx-assign-proper-GPIO-pin-for-Ubiquiti-Nanostation-models.patch
new file mode 100644
index 00000000..523d5b6d
--- /dev/null
+++ b/patches/openwrt/0016-ar71xx-assign-proper-GPIO-pin-for-Ubiquiti-Nanostation-models.patch
@@ -0,0 +1,32 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 7 Mar 2016 06:07:59 +0100
+Subject: ar71xx: assign proper GPIO pin for Ubiquiti Nanostation models
+
+The GPIO pins for "POE passthrough" of Ubiquiti Nanostation models are the
+following:
+* Ubiquiti Nanostation M XM: Pin 8
+* Ubiquiti Nanostation M XW: Pin 2
+
+The previous definition of the pins was mixed up between XM and XW model.
+
+Signed-off-by: Lars Kruse <lists@sumpfralle.de>
+
+Backport of r46922
+
+diff --git a/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches b/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches
+index 81d3982..b41f275 100644
+--- a/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches
++++ b/target/linux/ar71xx/base-files/etc/uci-defaults/01_gpio-switches
+@@ -10,10 +10,10 @@ board=$(ar71xx_board_name)
+ 
+ case "$board" in
+ nanostation-m)
+-	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "2"
++	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "8"
+ 	;;
+ nanostation-m-xw)
+-	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "8"
++	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "2"
+ 	;;
+ cpe510)
+ 	ucidef_set_gpio_switch "poe_passthrough" "PoE Passthrough" "20"

From fc6d4d6c9789b6600e6208b1dc14866e03ccdc15 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Tue, 8 Mar 2016 07:57:06 +0100
Subject: [PATCH 31/35] gluon-mesh-batman-adv-core: respondd: add uci.h include

This include wasn't actually missing, but well hidden behind the iwinfo.h
include. Make this more obvious.
---
 package/gluon-mesh-batman-adv-core/src/respondd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/gluon-mesh-batman-adv-core/src/respondd.c b/package/gluon-mesh-batman-adv-core/src/respondd.c
index 83f25e30..f0085457 100644
--- a/package/gluon-mesh-batman-adv-core/src/respondd.c
+++ b/package/gluon-mesh-batman-adv-core/src/respondd.c
@@ -29,6 +29,7 @@
 #include <iwinfo.h>
 #include <json-c/json.h>
 #include <libgluonutil.h>
+#include <uci.h>
 
 #include <alloca.h>
 #include <glob.h>

From e729d33bab0ad48a4d6b9397c05b1fe44a023429 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Wed, 9 Mar 2016 06:47:53 +0100
Subject: [PATCH 32/35] netifd: update to latest git master

---
 ...7-netifd-update-to-latest-git-master.patch | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 patches/openwrt/0017-netifd-update-to-latest-git-master.patch

diff --git a/patches/openwrt/0017-netifd-update-to-latest-git-master.patch b/patches/openwrt/0017-netifd-update-to-latest-git-master.patch
new file mode 100644
index 00000000..3a173661
--- /dev/null
+++ b/patches/openwrt/0017-netifd-update-to-latest-git-master.patch
@@ -0,0 +1,55 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Wed, 9 Mar 2016 06:46:44 +0100
+Subject: netifd: update to latest git master
+
+diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile
+index 619024b..f7563d5 100644
+--- a/package/network/config/netifd/Makefile
++++ b/package/network/config/netifd/Makefile
+@@ -1,13 +1,13 @@
+ include $(TOPDIR)/rules.mk
+ 
+ PKG_NAME:=netifd
+-PKG_VERSION:=2015-12-16
++PKG_VERSION:=2016-03-07
+ PKG_RELEASE=$(PKG_SOURCE_VERSION)
+ 
+ PKG_SOURCE_PROTO:=git
+-PKG_SOURCE_URL:=http://git.openwrt.org/project/netifd.git
++PKG_SOURCE_URL=$(OPENWRT_GIT)/project/netifd.git
+ PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
+-PKG_SOURCE_VERSION:=245527193e90906451be35c2b8e972b8712ea6ab
++PKG_SOURCE_VERSION:=bd1ee3efb46ae013d81b1aec51668e7595274e69
+ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
+ PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
+ # PKG_MIRROR_MD5SUM:=
+diff --git a/package/network/config/netifd/files/etc/init.d/network b/package/network/config/netifd/files/etc/init.d/network
+index 542fc08..bdadbbc 100755
+--- a/package/network/config/netifd/files/etc/init.d/network
++++ b/package/network/config/netifd/files/etc/init.d/network
+@@ -21,7 +21,6 @@ start_service() {
+ 	procd_set_param watch network.interface
+ 	[ -e /proc/sys/kernel/core_pattern ] && {
+ 		procd_set_param limits core="unlimited"
+-		echo '/tmp/%e.%p.%s.%t.core' > /proc/sys/kernel/core_pattern
+ 	}
+ 	procd_close_instance
+ }
+diff --git a/package/network/config/netifd/files/sbin/ifup b/package/network/config/netifd/files/sbin/ifup
+index af3aaa8..5515b91 100755
+--- a/package/network/config/netifd/files/sbin/ifup
++++ b/package/network/config/netifd/files/sbin/ifup
+@@ -67,12 +67,10 @@ if [ -n "$setup_wifi" ] && grep -sq config /etc/config/wireless; then
+ 		fi
+ 	}
+ 
+-	local radio_devs
+-	local network="$1"
++	network="$1"
+ 	config_load wireless
+ 	config_foreach find_related_radios wifi-iface
+ 
+-	local dev
+ 	for dev in $(echo "$radio_devs" | sort -u); do
+ 		/sbin/wifi up "$dev"
+ 	done

From 2ee35f310212816bfc61ca8c694b01fbe2d15f67 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Tue, 8 Mar 2016 06:51:47 +0100
Subject: [PATCH 33/35] docs, README: add release notes for v2016.1.2, update
 version numbers

---
 README.md                     |  2 +-
 docs/index.rst                |  1 +
 docs/releases/v2016.1.2.rst   | 29 +++++++++++++++++++++++++++++
 docs/user/getting_started.rst |  4 ++--
 4 files changed, 33 insertions(+), 3 deletions(-)
 create mode 100644 docs/releases/v2016.1.2.rst

diff --git a/README.md b/README.md
index cc8ce8f4..51dec098 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ our mailinglist to discuss it first.
 
 Please refrain from using the `master` branch for anything else but development purposes!
 Use the most recent release instead. You can list all relaseses by running `git branch -a`
-and switch to one by running `git checkout v2016.1.1 && make update`.
+and switch to one by running `git checkout v2016.1.2 && make update`.
 
 If you're using the autoupdater, do not autoupdate nodes with anything but releases.
 If you upgrade using random master commits the nodes *will break* eventually.
diff --git a/docs/index.rst b/docs/index.rst
index cbe1c5d4..6ebb2a10 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -60,6 +60,7 @@ Releases
 .. toctree::
    :maxdepth: 1
 
+   releases/v2016.1.2
    releases/v2016.1.1
    releases/v2016.1
    releases/v2015.1.2
diff --git a/docs/releases/v2016.1.2.rst b/docs/releases/v2016.1.2.rst
new file mode 100644
index 00000000..77f7efb8
--- /dev/null
+++ b/docs/releases/v2016.1.2.rst
@@ -0,0 +1,29 @@
+Gluon 2016.1.2
+==============
+
+Added hardware support
+~~~~~~~~~~~~~~~~~~~~~~
+
+The *x86-generic* images now contain the ATIIXP PATA driver, adding support for
+FUTRO Thin Clients.
+
+Bugfixes
+~~~~~~~~
+
+A nondeterministic boot hang (`#669 <https://github.com/freifunk-gluon/gluon/issues/669>`_) has been fixed.
+The TL-WR841N v5 seems to be affected in particular, but the kernel bug is not hardware-specific per se.
+
+Known Issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Expert Mode is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
diff --git a/docs/user/getting_started.rst b/docs/user/getting_started.rst
index a989344c..544ee2a3 100644
--- a/docs/user/getting_started.rst
+++ b/docs/user/getting_started.rst
@@ -8,7 +8,7 @@ Gluon's releases are managed using `Git tags`_. If you are just getting
 started with Gluon we recommend to use the latest stable release of Gluon.
 
 Take a look at the `list of gluon releases`_ and notice the latest release,
-e.g. *v2016.1.1*. Always get Gluon using git and don't try to download it
+e.g. *v2016.1.2*. Always get Gluon using git and don't try to download it
 as a Zip archive as the archive will be missing version information.
 
 Please keep in mind that there is no "default Gluon" build; a site configuration
@@ -42,7 +42,7 @@ Building the images
 -------------------
 
 To build Gluon, first check out the repository. Replace *RELEASE* with the
-version you'd like to checkout, e.g. *v2016.1.1*.
+version you'd like to checkout, e.g. *v2016.1.2*.
 
 ::
 

From ea90788315ac3dcb5ab211f4fb481081afa29a7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Steffen=20F=C3=B6rster?= <ambassador86@gmail.com>
Date: Wed, 9 Mar 2016 22:17:06 +0100
Subject: [PATCH 34/35] Add support for TP-Link TL-WA7510N

This CPE is supported by OpenWRT and already running in Chemnitz
---
 docs/index.rst                     | 1 +
 targets/ar71xx-generic/profiles.mk | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/docs/index.rst b/docs/index.rst
index 6ebb2a10..2c0a50e2 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -125,6 +125,7 @@ ar71xx-generic
   - TL-MR3420 (v1, v2)
   - TL-WA701N/ND (v1, v2)
   - TL-WA750RE (v1)
+  - TL-WA7510N (v1)
   - TL-WA801N/ND (v1, v2)
   - TL-WA830RE (v1, v2)
   - TL-WA850RE (v1)
diff --git a/targets/ar71xx-generic/profiles.mk b/targets/ar71xx-generic/profiles.mk
index 394722e8..916f7b4c 100644
--- a/targets/ar71xx-generic/profiles.mk
+++ b/targets/ar71xx-generic/profiles.mk
@@ -19,6 +19,10 @@ $(eval $(call GluonProfile,TLWA701))
 $(eval $(call GluonModel,TLWA701,tl-wa701n-v1,tp-link-tl-wa701n-nd-v1))
 $(eval $(call GluonModel,TLWA701,tl-wa701nd-v2,tp-link-tl-wa701n-nd-v2))
 
+# TL-WA7510 v1
+$(eval $(call GluonProfile,TLWA7510))
+$(eval $(call GluonModel,TLWA7510,tl-wa7510n,tp-link-tl-wa7510n-v1))
+
 # TL-WR703N v1
 $(eval $(call GluonProfile,TLWR703))
 $(eval $(call GluonModel,TLWR703,tl-wr703n-v1,tp-link-tl-wr703n-v1))

From 4511da0aee68a215b350f2035d198667703f2f4f Mon Sep 17 00:00:00 2001
From: kb-light <freifunk@kb-light.de>
Date: Thu, 10 Mar 2016 00:38:19 +0100
Subject: [PATCH 35/35] docs: fix typo in upgrade.rst

---
 docs/dev/upgrade.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/upgrade.rst b/docs/dev/upgrade.rst
index 3cd57950..28377235 100644
--- a/docs/dev/upgrade.rst
+++ b/docs/dev/upgrade.rst
@@ -23,7 +23,7 @@ Best practices
   This allows using the same code to create the initial configuration and upgrade configurations on upgrades.
 
 * If it is unavoidable to run different code during the initial installation, the ``sysconfig.gluon_version`` variable
-  can be checked. This variable in ``nil`` during the initial installation and contains the previously install Gluon
+  can be checked. This variable is ``nil`` during the initial installation and contains the previously install Gluon
   version otherwise. The package ``gluon-legacy`` (which is responsible for upgrades from the old firmwares of
   Hamburg/Kiel/Lübeck) uses the special value ``legacy``; other packages should handle this value just as any other
   string.