diff --git a/target/linux/ar71xx/patches-4.1/999-always-bitbang-spi.patch b/target/linux/ar71xx/patches-4.1/999-always-bitbang-spi.patch
new file mode 100644
index 0000000..1030c31
--- /dev/null
+++ b/target/linux/ar71xx/patches-4.1/999-always-bitbang-spi.patch
@@ -0,0 +1,231 @@
+Index: linux-4.1.11/drivers/spi/spi-ath79.c
+===================================================================
+--- linux-4.1.11.orig/drivers/spi/spi-ath79.c
++++ linux-4.1.11/drivers/spi/spi-ath79.c
+@@ -278,7 +278,11 @@ static int ath79_spi_do_read_flash_cmd(s
+ static bool ath79_spi_is_read_cmd(struct spi_device *spi,
+ 				 struct spi_transfer *t)
+ {
++#if 0
+ 	return t->type == SPI_TRANSFER_FLASH_READ_CMD;
++#else
++	return 1 == 0;
++#endif
+ }
+ 
+ static bool ath79_spi_is_data_read(struct spi_device *spi,
+Index: linux-4.1.11/drivers/mtd/devices/m25p80.c
+===================================================================
+--- linux-4.1.11.orig/drivers/mtd/devices/m25p80.c
++++ linux-4.1.11/drivers/mtd/devices/m25p80.c
+@@ -251,6 +251,23 @@ static int m25p_probe(struct spi_device
+ static int m25p_remove(struct spi_device *spi)
+ {
+ 	struct m25p	*flash = spi_get_drvdata(spi);
++	struct flash_platform_data	*data;
++	char *flash_name = NULL;
++	struct spi_nor *nor;
++
++	data = dev_get_platdata(&spi->dev);
++
++	if (data && data->type)
++		flash_name = data->type;
++	else if (!strcmp(spi->modalias, "spi-nor"))
++		flash_name = NULL; /* auto-detect */
++	else
++		flash_name = spi->modalias;
++
++	nor = &flash->spi_nor;
++
++	/* Set back to 3 byte mode */
++	spi_nor_reboot_hook(nor, flash_name);
+ 
+ 	/* Clean up MTD stuff. */
+ 	return mtd_device_unregister(&flash->mtd);
+Index: linux-4.1.11/drivers/mtd/spi-nor/spi-nor.c
+===================================================================
+--- linux-4.1.11.orig/drivers/mtd/spi-nor/spi-nor.c
++++ linux-4.1.11/drivers/mtd/spi-nor/spi-nor.c
+@@ -1212,6 +1212,25 @@ int spi_nor_scan(struct spi_nor *nor, co
+ }
+ EXPORT_SYMBOL_GPL(spi_nor_scan);
+ 
++void spi_nor_reboot_hook(struct spi_nor *nor, const char *name)
++{
++	const struct spi_device_id	*id = NULL;
++	struct flash_info		*info;
++
++	if (nor->addr_width != 4) return ;
++
++	if (!name)
++		id = spi_nor_read_id(nor);
++	else
++		id = spi_nor_match_id(name);
++
++	info = (void *)id->driver_data;
++
++	printk(KERN_ERR "Switching flash back into 3 byte mode for boot\n");
++	set_4byte(nor, info, 0);
++}
++EXPORT_SYMBOL_GPL(spi_nor_reboot_hook);
++
+ static const struct spi_device_id *spi_nor_match_id(const char *name)
+ {
+ 	const struct spi_device_id *id = spi_nor_ids;
+Index: linux-4.1.11/drivers/mtd/tplinkpart.c
+===================================================================
+--- linux-4.1.11.orig/drivers/mtd/tplinkpart.c
++++ linux-4.1.11/drivers/mtd/tplinkpart.c
+@@ -149,7 +149,7 @@ static int tplink_parse_partitions_offse
+ 	parts[0].name = "u-boot";
+ 	parts[0].offset = 0;
+ 	parts[0].size = offset;
+-	parts[0].mask_flags = MTD_WRITEABLE;
++	//parts[0].mask_flags = MTD_WRITEABLE;
+ 
+ 	parts[1].name = "kernel";
+ 	parts[1].offset = offset;
+@@ -162,7 +162,7 @@ static int tplink_parse_partitions_offse
+ 	parts[3].name = "art";
+ 	parts[3].offset = art_offset;
+ 	parts[3].size = TPLINK_ART_LEN;
+-	parts[3].mask_flags = MTD_WRITEABLE;
++	//parts[3].mask_flags = MTD_WRITEABLE;
+ 
+ 	parts[4].name = "firmware";
+ 	parts[4].offset = offset;
+Index: linux-4.1.11/include/linux/mtd/spi-nor.h
+===================================================================
+--- linux-4.1.11.orig/include/linux/mtd/spi-nor.h
++++ linux-4.1.11/include/linux/mtd/spi-nor.h
+@@ -213,4 +213,6 @@ struct spi_nor {
+  */
+ int spi_nor_scan(struct spi_nor *nor, const char *name, enum read_mode mode);
+ 
++void spi_nor_reboot_hook(struct spi_nor *nor, const char *name);
++
+ #endif
+Index: linux-4.1.11/arch/mips/ath79/mach-tl-mr3x20.c
+===================================================================
+--- linux-4.1.11.orig/arch/mips/ath79/mach-tl-mr3x20.c
++++ linux-4.1.11/arch/mips/ath79/mach-tl-mr3x20.c
+@@ -11,6 +11,11 @@
+ #include <linux/gpio.h>
+ 
+ #include <asm/mach-ath79/ath79.h>
++#include <linux/mtd/mtd.h>
++#include <linux/ath9k_platform.h>
++#include <linux/pci.h>
++
++
+ 
+ #include "dev-eth.h"
+ #include "dev-ap9x-pci.h"
+@@ -75,28 +80,76 @@ static struct gpio_keys_button tl_mr3x20
+ 	}
+ };
+ 
++
++#define MAC_LEN 6
++#define ART_LEN (ATH9K_PLAT_EEP_MAX_WORDS << 1)
++
++#define CONFIG_OFFSET 0x1fc00
++#define ART_OFFSET 0x1000
++
++static u8 *mac, *art;
++
++static void notify_add(struct mtd_info *mtd)
++{
++	size_t len;
++
++	if (!strcmp(mtd->name, "u-boot") && !mac) {
++		mac = kmalloc(MAC_LEN, GFP_KERNEL);
++		if (!mac) return;
++
++		mtd_read(mtd, CONFIG_OFFSET, MAC_LEN, &len, mac);
++
++		ath79_init_mac(ath79_eth0_data.mac_addr, mac, 1);
++		ath79_init_mac(ath79_eth1_data.mac_addr, mac, -1);
++
++		ath79_register_mdio(0, 0x0);
++
++		/* LAN ports */
++		ath79_register_eth(1);
++		/* WAN port */
++		ath79_register_eth(0);
++	}
++
++	if (!strcmp(mtd->name, "art") && !art) {
++	       art = kmalloc(ART_LEN, GFP_KERNEL);
++	       if (!art) return;
++
++	       mtd_read(mtd, ART_OFFSET, ART_LEN, &len, art);
++	}
++
++
++	if (mac && art) {
++		ap91_pci_init(art, mac);
++
++		pci_fixup_irqs(pci_common_swizzle, pcibios_map_irq);
++
++		kfree(art);
++		art = NULL;
++
++		kfree(mac);
++		mac = NULL;
++	}
++}
++
++static void notify_remove(struct mtd_info *mtd)
++{
++}
++
++static struct mtd_notifier spi_notifier = {
++	.add    = notify_add,
++	.remove = notify_remove
++};
++
++
+ static void __init tl_ap99_setup(void)
+ {
+-	u8 *mac = (u8 *) KSEG1ADDR(0x1f01fc00);
+-	u8 *ee = (u8 *) KSEG1ADDR(0x1fff1000);
++	register_mtd_user(&spi_notifier);
+ 
+ 	ath79_register_m25p80(&tl_mr3x20_flash_data);
+ 
+ 	ath79_register_gpio_keys_polled(-1, TL_MR3X20_KEYS_POLL_INTERVAL,
+ 					 ARRAY_SIZE(tl_mr3x20_gpio_keys),
+ 					 tl_mr3x20_gpio_keys);
+-
+-	ath79_init_mac(ath79_eth0_data.mac_addr, mac, 1);
+-	ath79_init_mac(ath79_eth1_data.mac_addr, mac, -1);
+-
+-	ath79_register_mdio(0, 0x0);
+-
+-	/* LAN ports */
+-	ath79_register_eth(1);
+-	/* WAN port */
+-	ath79_register_eth(0);
+-
+-	ap91_pci_init(ee, mac);
+ }
+ 
+ static void __init tl_mr3x20_usb_setup(void)
+Index: linux-4.1.11/arch/mips/ath79/dev-ap9x-pci.c
+===================================================================
+--- linux-4.1.11.orig/arch/mips/ath79/dev-ap9x-pci.c
++++ linux-4.1.11/arch/mips/ath79/dev-ap9x-pci.c
+@@ -103,10 +103,10 @@ __init void ap91_pci_init(u8 *cal_data,
+ 		ap9x_wmac0_data.macaddr = ap9x_wmac0_mac;
+ 	}
+ 
++	pci_enable_ath9k_fixup(0, ap9x_wmac0_data.eeprom_data);
++
+ 	ath79_pci_set_plat_dev_init(ap91_pci_plat_dev_init);
+ 	ath79_register_pci();
+-
+-	pci_enable_ath9k_fixup(0, ap9x_wmac0_data.eeprom_data);
+ }
+ 
+ __init void ap91_pci_init_simple(void)