mac80211: rebase ontop of v4.18.5

Signed-off-by: John Crispin <john@phrozen.org>

22 files changed, 3195 insertions, 0 deletions

diff --git a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
new file mode 100644
index 0000000000..8d7a39a6df
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
@@ -0,0 +1,705 @@
+--- a/net/mac80211/Makefile
++++ b/net/mac80211/Makefile
+@@ -6,7 +6,6 @@ mac80211-y := \
+ 	driver-ops.o \
+ 	sta_info.o \
+ 	wep.o \
+-	aead_api.o \
+ 	wpa.o \
+ 	scan.o offchannel.o \
+ 	ht.o agg-tx.o agg-rx.o \
+@@ -16,8 +15,8 @@ mac80211-y := \
+ 	rate.o \
+ 	michael.o \
+ 	tkip.o \
++	aes_ccm.o \
+ 	aes_cmac.o \
+-	aes_gmac.o \
+ 	fils_aead.o \
+ 	cfg.o \
+ 	ethtool.o \
+--- a/net/mac80211/aead_api.c
++++ /dev/null
+@@ -1,115 +0,0 @@
+-/*
+- * Copyright 2003-2004, Instant802 Networks, Inc.
+- * Copyright 2005-2006, Devicescape Software, Inc.
+- * Copyright 2014-2015, Qualcomm Atheros, Inc.
+- *
+- * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-
+-#include <linux/kernel.h>
+-#include <linux/types.h>
+-#include <linux/err.h>
+-#include <linux/scatterlist.h>
+-#include <crypto/aead.h>
+-
+-#include "aead_api.h"
+-
+-int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
+-		 u8 *data, size_t data_len, u8 *mic)
+-{
+-	size_t mic_len = crypto_aead_authsize(tfm);
+-	struct scatterlist sg[3];
+-	struct aead_request *aead_req;
+-	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
+-	u8 *__aad;
+-
+-	aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
+-	if (!aead_req)
+-		return -ENOMEM;
+-
+-	__aad = (u8 *)aead_req + reqsize;
+-	memcpy(__aad, aad, aad_len);
+-
+-	sg_init_table(sg, 3);
+-	sg_set_buf(&sg[0], __aad, aad_len);
+-	sg_set_buf(&sg[1], data, data_len);
+-	sg_set_buf(&sg[2], mic, mic_len);
+-
+-	aead_request_set_tfm(aead_req, tfm);
+-	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
+-	aead_request_set_ad(aead_req, sg[0].length);
+-
+-	crypto_aead_encrypt(aead_req);
+-	kzfree(aead_req);
+-
+-	return 0;
+-}
+-
+-int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
+-		 u8 *data, size_t data_len, u8 *mic)
+-{
+-	size_t mic_len = crypto_aead_authsize(tfm);
+-	struct scatterlist sg[3];
+-	struct aead_request *aead_req;
+-	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
+-	u8 *__aad;
+-	int err;
+-
+-	if (data_len == 0)
+-		return -EINVAL;
+-
+-	aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
+-	if (!aead_req)
+-		return -ENOMEM;
+-
+-	__aad = (u8 *)aead_req + reqsize;
+-	memcpy(__aad, aad, aad_len);
+-
+-	sg_init_table(sg, 3);
+-	sg_set_buf(&sg[0], __aad, aad_len);
+-	sg_set_buf(&sg[1], data, data_len);
+-	sg_set_buf(&sg[2], mic, mic_len);
+-
+-	aead_request_set_tfm(aead_req, tfm);
+-	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
+-	aead_request_set_ad(aead_req, sg[0].length);
+-
+-	err = crypto_aead_decrypt(aead_req);
+-	kzfree(aead_req);
+-
+-	return err;
+-}
+-
+-struct crypto_aead *
+-aead_key_setup_encrypt(const char *alg, const u8 key[],
+-		       size_t key_len, size_t mic_len)
+-{
+-	struct crypto_aead *tfm;
+-	int err;
+-
+-	tfm = crypto_alloc_aead(alg, 0, CRYPTO_ALG_ASYNC);
+-	if (IS_ERR(tfm))
+-		return tfm;
+-
+-	err = crypto_aead_setkey(tfm, key, key_len);
+-	if (err)
+-		goto free_aead;
+-	err = crypto_aead_setauthsize(tfm, mic_len);
+-	if (err)
+-		goto free_aead;
+-
+-	return tfm;
+-
+-free_aead:
+-	crypto_free_aead(tfm);
+-	return ERR_PTR(err);
+-}
+-
+-void aead_key_free(struct crypto_aead *tfm)
+-{
+-	crypto_free_aead(tfm);
+-}
+--- a/net/mac80211/aead_api.h
++++ /dev/null
+@@ -1,27 +0,0 @@
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-
+-#ifndef _AEAD_API_H
+-#define _AEAD_API_H
+-
+-#include <crypto/aead.h>
+-#include <linux/crypto.h>
+-
+-struct crypto_aead *
+-aead_key_setup_encrypt(const char *alg, const u8 key[],
+-		       size_t key_len, size_t mic_len);
+-
+-int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
+-		 size_t aad_len, u8 *data,
+-		 size_t data_len, u8 *mic);
+-
+-int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
+-		 size_t aad_len, u8 *data,
+-		 size_t data_len, u8 *mic);
+-
+-void aead_key_free(struct crypto_aead *tfm);
+-
+-#endif /* _AEAD_API_H */
+--- a/net/mac80211/aes_ccm.h
++++ b/net/mac80211/aes_ccm.h
+@@ -10,39 +10,17 @@
+ #ifndef AES_CCM_H
+ #define AES_CCM_H
+ 
+-#include "aead_api.h"
++#include <linux/crypto.h>
+ 
+-#define CCM_AAD_LEN	32
+-
+-static inline struct crypto_aead *
+-ieee80211_aes_key_setup_encrypt(const u8 key[], size_t key_len, size_t mic_len)
+-{
+-	return aead_key_setup_encrypt("ccm(aes)", key, key_len, mic_len);
+-}
+-
+-static inline int
+-ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm,
+-			  u8 *b_0, u8 *aad, u8 *data,
+-			  size_t data_len, u8 *mic)
+-{
+-	return aead_encrypt(tfm, b_0, aad + 2,
+-			    be16_to_cpup((__be16 *)aad),
+-			    data, data_len, mic);
+-}
+-
+-static inline int
+-ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm,
+-			  u8 *b_0, u8 *aad, u8 *data,
+-			  size_t data_len, u8 *mic)
+-{
+-	return aead_decrypt(tfm, b_0, aad + 2,
+-			    be16_to_cpup((__be16 *)aad),
+-			    data, data_len, mic);
+-}
+-
+-static inline void ieee80211_aes_key_free(struct crypto_aead *tfm)
+-{
+-	return aead_key_free(tfm);
+-}
++struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
++						      size_t key_len,
++						      size_t mic_len);
++void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
++			       u8 *data, size_t data_len, u8 *mic,
++			       size_t mic_len);
++int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
++			      u8 *data, size_t data_len, u8 *mic,
++			      size_t mic_len);
++void ieee80211_aes_key_free(struct crypto_cipher *tfm);
+ 
+ #endif /* AES_CCM_H */
+--- /dev/null
++++ b/net/mac80211/aes_gcm.c
+@@ -0,0 +1,109 @@
++/*
++ * Copyright 2014-2015, Qualcomm Atheros, Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/kernel.h>
++#include <linux/types.h>
++#include <linux/err.h>
++#include <crypto/aead.h>
++
++#include <net/mac80211.h>
++#include "key.h"
++#include "aes_gcm.h"
++
++int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
++			      u8 *data, size_t data_len, u8 *mic)
++{
++	struct scatterlist sg[3];
++	struct aead_request *aead_req;
++	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
++	u8 *__aad;
++
++	aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
++	if (!aead_req)
++		return -ENOMEM;
++
++	__aad = (u8 *)aead_req + reqsize;
++	memcpy(__aad, aad, GCM_AAD_LEN);
++
++	sg_init_table(sg, 3);
++	sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
++	sg_set_buf(&sg[1], data, data_len);
++	sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
++
++	aead_request_set_tfm(aead_req, tfm);
++	aead_request_set_crypt(aead_req, sg, sg, data_len, j_0);
++	aead_request_set_ad(aead_req, sg[0].length);
++
++	crypto_aead_encrypt(aead_req);
++	kzfree(aead_req);
++	return 0;
++}
++
++int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
++			      u8 *data, size_t data_len, u8 *mic)
++{
++	struct scatterlist sg[3];
++	struct aead_request *aead_req;
++	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
++	u8 *__aad;
++	int err;
++
++	if (data_len == 0)
++		return -EINVAL;
++
++	aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
++	if (!aead_req)
++		return -ENOMEM;
++
++	__aad = (u8 *)aead_req + reqsize;
++	memcpy(__aad, aad, GCM_AAD_LEN);
++
++	sg_init_table(sg, 3);
++	sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
++	sg_set_buf(&sg[1], data, data_len);
++	sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
++
++	aead_request_set_tfm(aead_req, tfm);
++	aead_request_set_crypt(aead_req, sg, sg,
++			       data_len + IEEE80211_GCMP_MIC_LEN, j_0);
++	aead_request_set_ad(aead_req, sg[0].length);
++
++	err = crypto_aead_decrypt(aead_req);
++	kzfree(aead_req);
++
++	return err;
++}
++
++struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
++							size_t key_len)
++{
++	struct crypto_aead *tfm;
++	int err;
++
++	tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm))
++		return tfm;
++
++	err = crypto_aead_setkey(tfm, key, key_len);
++	if (err)
++		goto free_aead;
++	err = crypto_aead_setauthsize(tfm, IEEE80211_GCMP_MIC_LEN);
++	if (err)
++		goto free_aead;
++
++	return tfm;
++
++free_aead:
++	crypto_free_aead(tfm);
++	return ERR_PTR(err);
++}
++
++void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
++{
++	crypto_free_aead(tfm);
++}
+--- a/net/mac80211/aes_gcm.h
++++ b/net/mac80211/aes_gcm.h
+@@ -9,38 +9,30 @@
+ #ifndef AES_GCM_H
+ #define AES_GCM_H
+ 
+-#include "aead_api.h"
++#include <linux/crypto.h>
+ 
+-#define GCM_AAD_LEN	32
+-
+-static inline int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm,
+-					    u8 *j_0, u8 *aad,  u8 *data,
+-					    size_t data_len, u8 *mic)
++static inline void
++ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
++			  u8 *data, size_t data_len, u8 *mic)
+ {
+-	return aead_encrypt(tfm, j_0, aad + 2,
+-			    be16_to_cpup((__be16 *)aad),
+-			    data, data_len, mic);
+ }
+ 
+-static inline int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm,
+-					    u8 *j_0, u8 *aad, u8 *data,
+-					    size_t data_len, u8 *mic)
++static inline int
++ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
++			  u8 *data, size_t data_len, u8 *mic)
+ {
+-	return aead_decrypt(tfm, j_0, aad + 2,
+-			    be16_to_cpup((__be16 *)aad),
+-			    data, data_len, mic);
++    return -EOPNOTSUPP;
+ }
+ 
+ static inline struct crypto_aead *
+ ieee80211_aes_gcm_key_setup_encrypt(const u8 key[], size_t key_len)
+ {
+-	return aead_key_setup_encrypt("gcm(aes)", key,
+-				      key_len, IEEE80211_GCMP_MIC_LEN);
++    return NULL;
+ }
+ 
+-static inline void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
++static inline void
++ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
+ {
+-	return aead_key_free(tfm);
+ }
+ 
+ #endif /* AES_GCM_H */
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -306,7 +306,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
+ }
+ 
+ 
+-static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
++static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
++				u16 data_len)
+ {
+ 	__le16 mask_fc;
+ 	int a4_included, mgmt;
+@@ -336,14 +337,8 @@ static void ccmp_special_blocks(struct s
+ 	else
+ 		qos_tid = 0;
+ 
+-	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
+-	 * mode authentication are not allowed to collide, yet both are derived
+-	 * from this vector b_0. We only set L := 1 here to indicate that the
+-	 * data size can be represented in (L+1) bytes. The CCM layer will take
+-	 * care of storing the data length in the top (L+1) bytes and setting
+-	 * and clearing the other bits as is required to derive the two IVs.
+-	 */
+-	b_0[0] = 0x1;
++	/* First block, b_0 */
++	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
+ 
+ 	/* Nonce: Nonce Flags | A2 | PN
+ 	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
+@@ -351,6 +346,8 @@ static void ccmp_special_blocks(struct s
+ 	b_0[1] = qos_tid | (mgmt << 4);
+ 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
+ 	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
++	/* l(m) */
++	put_unaligned_be16(data_len, &b_0[14]);
+ 
+ 	/* AAD (extra authenticate-only data) / masked 802.11 header
+ 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
+@@ -407,7 +404,7 @@ static int ccmp_encrypt_skb(struct ieee8
+ 	u8 *pos;
+ 	u8 pn[6];
+ 	u64 pn64;
+-	u8 aad[CCM_AAD_LEN];
++	u8 aad[2 * AES_BLOCK_SIZE];
+ 	u8 b_0[AES_BLOCK_SIZE];
+ 
+ 	if (info->control.hw_key &&
+@@ -462,9 +459,11 @@ static int ccmp_encrypt_skb(struct ieee8
+ 		return 0;
+ 
+ 	pos += IEEE80211_CCMP_HDR_LEN;
+-	ccmp_special_blocks(skb, pn, b_0, aad);
+-	return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
+-					 skb_put(skb, mic_len));
++	ccmp_special_blocks(skb, pn, b_0, aad, len);
++	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
++				  skb_put(skb, mic_len), mic_len);
++
++	return 0;
+ }
+ 
+ 
+@@ -537,13 +536,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
+ 			u8 aad[2 * AES_BLOCK_SIZE];
+ 			u8 b_0[AES_BLOCK_SIZE];
+ 			/* hardware didn't decrypt/verify MIC */
+-			ccmp_special_blocks(skb, pn, b_0, aad);
++			ccmp_special_blocks(skb, pn, b_0, aad, data_len);
+ 
+ 			if (ieee80211_aes_ccm_decrypt(
+ 				    key->u.ccmp.tfm, b_0, aad,
+ 				    skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
+ 				    data_len,
+-				    skb->data + skb->len - mic_len))
++				    skb->data + skb->len - mic_len, mic_len))
+ 				return RX_DROP_UNUSABLE;
+ 		}
+ 
+@@ -639,7 +638,7 @@ static int gcmp_encrypt_skb(struct ieee8
+ 	u8 *pos;
+ 	u8 pn[6];
+ 	u64 pn64;
+-	u8 aad[GCM_AAD_LEN];
++	u8 aad[2 * AES_BLOCK_SIZE];
+ 	u8 j_0[AES_BLOCK_SIZE];
+ 
+ 	if (info->control.hw_key &&
+@@ -696,8 +695,10 @@ static int gcmp_encrypt_skb(struct ieee8
+ 
+ 	pos += IEEE80211_GCMP_HDR_LEN;
+ 	gcmp_special_blocks(skb, pn, j_0, aad);
+-	return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
+-					 skb_put(skb, IEEE80211_GCMP_MIC_LEN));
++	ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
++				  skb_put(skb, IEEE80211_GCMP_MIC_LEN));
++
++	return 0;
+ }
+ 
+ ieee80211_tx_result
+@@ -1121,9 +1122,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
+ 	struct ieee80211_key *key = tx->key;
+ 	struct ieee80211_mmie_16 *mmie;
+ 	struct ieee80211_hdr *hdr;
+-	u8 aad[GMAC_AAD_LEN];
++	u8 aad[20];
+ 	u64 pn64;
+-	u8 nonce[GMAC_NONCE_LEN];
++	u8 nonce[12];
+ 
+ 	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
+ 		return TX_DROP;
+@@ -1169,7 +1170,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct ieee80211_key *key = rx->key;
+ 	struct ieee80211_mmie_16 *mmie;
+-	u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN];
++	u8 aad[20], mic[16], ipn[6], nonce[12];
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 
+ 	if (!ieee80211_is_mgmt(hdr->frame_control))
+--- /dev/null
++++ b/net/mac80211/aes_ccm.c
+@@ -0,0 +1,144 @@
++/*
++ * Copyright 2003-2004, Instant802 Networks, Inc.
++ * Copyright 2005-2006, Devicescape Software, Inc.
++ *
++ * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/kernel.h>
++#include <linux/types.h>
++#include <linux/err.h>
++#include <crypto/aead.h>
++#include <crypto/aes.h>
++
++#include <net/mac80211.h>
++#include "key.h"
++#include "aes_ccm.h"
++
++static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad, u8 *s_0,
++			    u8 *a, u8 *b)
++{
++	int i;
++
++	crypto_cipher_encrypt_one(tfm, b, b_0);
++
++	/* Extra Authenticate-only data (always two AES blocks) */
++	for (i = 0; i < AES_BLOCK_SIZE; i++)
++		aad[i] ^= b[i];
++	crypto_cipher_encrypt_one(tfm, b, aad);
++
++	aad += AES_BLOCK_SIZE;
++
++	for (i = 0; i < AES_BLOCK_SIZE; i++)
++		aad[i] ^= b[i];
++	crypto_cipher_encrypt_one(tfm, a, aad);
++
++	/* Mask out bits from auth-only-b_0 */
++	b_0[0] &= 0x07;
++
++	/* S_0 is used to encrypt T (= MIC) */
++	b_0[14] = 0;
++	b_0[15] = 0;
++	crypto_cipher_encrypt_one(tfm, s_0, b_0);
++}
++
++
++void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
++			       u8 *data, size_t data_len, u8 *mic,
++			       size_t mic_len)
++{
++	int i, j, last_len, num_blocks;
++	u8 b[AES_BLOCK_SIZE];
++	u8 s_0[AES_BLOCK_SIZE];
++	u8 e[AES_BLOCK_SIZE];
++	u8 *pos, *cpos;
++
++	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
++	last_len = data_len % AES_BLOCK_SIZE;
++	aes_ccm_prepare(tfm, b_0, aad, s_0, b, b);
++
++	/* Process payload blocks */
++	pos = data;
++	cpos = data;
++	for (j = 1; j <= num_blocks; j++) {
++		int blen = (j == num_blocks && last_len) ?
++			last_len : AES_BLOCK_SIZE;
++
++		/* Authentication followed by encryption */
++		for (i = 0; i < blen; i++)
++			b[i] ^= pos[i];
++		crypto_cipher_encrypt_one(tfm, b, b);
++
++		b_0[14] = (j >> 8) & 0xff;
++		b_0[15] = j & 0xff;
++		crypto_cipher_encrypt_one(tfm, e, b_0);
++		for (i = 0; i < blen; i++)
++			*cpos++ = *pos++ ^ e[i];
++	}
++
++	for (i = 0; i < mic_len; i++)
++		mic[i] = b[i] ^ s_0[i];
++}
++
++int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
++			      u8 *data, size_t data_len, u8 *mic,
++			      size_t mic_len)
++{
++	int i, j, last_len, num_blocks;
++	u8 *pos, *cpos;
++	u8 a[AES_BLOCK_SIZE];
++	u8 b[AES_BLOCK_SIZE];
++	u8 s_0[AES_BLOCK_SIZE];
++
++	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
++	last_len = data_len % AES_BLOCK_SIZE;
++	aes_ccm_prepare(tfm, b_0, aad, s_0, a, b);
++
++	/* Process payload blocks */
++	cpos = data;
++	pos = data;
++	for (j = 1; j <= num_blocks; j++) {
++		int blen = (j == num_blocks && last_len) ?
++			last_len : AES_BLOCK_SIZE;
++
++		/* Decryption followed by authentication */
++		b_0[14] = (j >> 8) & 0xff;
++		b_0[15] = j & 0xff;
++		crypto_cipher_encrypt_one(tfm, b, b_0);
++		for (i = 0; i < blen; i++) {
++			*pos = *cpos++ ^ b[i];
++			a[i] ^= *pos++;
++		}
++		crypto_cipher_encrypt_one(tfm, a, a);
++	}
++
++	for (i = 0; i < mic_len; i++) {
++		if ((mic[i] ^ s_0[i]) != a[i])
++			return -1;
++	}
++
++	return 0;
++}
++
++struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
++						      size_t key_len,
++						      size_t mic_len)
++{
++	struct crypto_cipher *tfm;
++
++	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
++	if (!IS_ERR(tfm))
++		crypto_cipher_setkey(tfm, key, key_len);
++
++	return tfm;
++}
++
++
++void ieee80211_aes_key_free(struct crypto_cipher *tfm)
++{
++	crypto_free_cipher(tfm);
++}
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -5,8 +5,6 @@ config MAC80211
+ 	depends on CRYPTO
+ 	depends on CRYPTO_ARC4
+ 	depends on CRYPTO_AES
+-	depends on CRYPTO_CCM
+-	depends on CRYPTO_GCM
+ 	depends on CRYPTO_CMAC
+ 	depends on CRC32
+ 	---help---
+--- a/net/mac80211/aes_gmac.h
++++ b/net/mac80211/aes_gmac.h
+@@ -15,10 +15,22 @@
+ #define GMAC_MIC_LEN	16
+ #define GMAC_NONCE_LEN	12
+ 
+-struct crypto_aead *ieee80211_aes_gmac_key_setup(const u8 key[],
+-						 size_t key_len);
+-int ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
+-		       const u8 *data, size_t data_len, u8 *mic);
+-void ieee80211_aes_gmac_key_free(struct crypto_aead *tfm);
++static inline struct crypto_aead *
++ieee80211_aes_gmac_key_setup(const u8 key[], size_t key_len)
++{
++	return NULL;
++}
++
++static inline int
++ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
++		   const u8 *data, size_t data_len, u8 *mic)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void
++ieee80211_aes_gmac_key_free(struct crypto_aead *tfm)
++{
++}
+ 
+ #endif /* AES_GMAC_H */
+--- a/net/mac80211/key.h
++++ b/net/mac80211/key.h
+@@ -88,7 +88,7 @@ struct ieee80211_key {
+ 			 * Management frames.
+ 			 */
+ 			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
+-			struct crypto_aead *tfm;
++			struct crypto_cipher *tfm;
+ 			u32 replays; /* dot11RSNAStatsCCMPReplays */
+ 		} ccmp;
+ 		struct {
diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
new file mode 100644
index 0000000000..3b1fcdf9c8
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -0,0 +1,12 @@
+Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1058,7 +1058,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
+ 
+ 	__sta_info_flush(sdata, true);
+-	ieee80211_free_keys(sdata, true);
+ 
+ 	sdata->vif.bss_conf.enable_beacon = false;
+ 	sdata->vif.bss_conf.ssid_len = 0;
diff --git a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
new file mode 100644
index 0000000000..ffd8807ccc
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -0,0 +1,43 @@
+--- a/net/wireless/sysfs.c
++++ b/net/wireless/sysfs.c
+@@ -24,18 +24,35 @@ static inline struct cfg80211_registered
+ 	return container_of(dev, struct cfg80211_registered_device, wiphy.dev);
+ }
+ 
+-#define SHOW_FMT(name, fmt, member)					\
++#define SHOW_FMT(name, fmt, member, mode)				\
+ static ssize_t name ## _show(struct device *dev,			\
+ 			      struct device_attribute *attr,		\
+ 			      char *buf)				\
+ {									\
+ 	return sprintf(buf, fmt "\n", dev_to_rdev(dev)->member);	\
+ }									\
+-static DEVICE_ATTR_RO(name)
++static DEVICE_ATTR_##mode(name)
+ 
+-SHOW_FMT(index, "%d", wiphy_idx);
+-SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
+-SHOW_FMT(address_mask, "%pM", wiphy.addr_mask);
++static ssize_t macaddress_store(struct device *dev,
++				struct device_attribute *attr,
++				const char *buf, size_t len)
++{
++	u8 mac[ETH_ALEN];
++
++	if (!mac_pton(buf, mac))
++		return -EINVAL;
++
++	if (buf[3 * ETH_ALEN - 1] && buf[3 * ETH_ALEN - 1] != '\n')
++		return -EINVAL;
++
++	memcpy(dev_to_rdev(dev)->wiphy.perm_addr, mac, ETH_ALEN);
++
++	return strnlen(buf, len);
++}
++
++SHOW_FMT(index, "%d", wiphy_idx, RO);
++SHOW_FMT(macaddress, "%pM", wiphy.perm_addr, RW);
++SHOW_FMT(address_mask, "%pM", wiphy.addr_mask, RO);
+ 
+ static ssize_t name_show(struct device *dev,
+ 			 struct device_attribute *attr,
diff --git a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
new file mode 100644
index 0000000000..1f03589878
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
@@ -0,0 +1,32 @@
+Disable FILS support, since it pulls in crypto hash support
+
+--- a/net/mac80211/fils_aead.h
++++ b/net/mac80211/fils_aead.h
+@@ -10,7 +10,7 @@
+ #ifndef FILS_AEAD_H
+ #define FILS_AEAD_H
+ 
+-#if LINUX_VERSION_IS_GEQ(4,3,0)
++#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
+ int fils_encrypt_assoc_req(struct sk_buff *skb,
+ 			   struct ieee80211_mgd_assoc_data *assoc_data);
+ int fils_decrypt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/fils_aead.c
++++ b/net/mac80211/fils_aead.c
+@@ -1,4 +1,4 @@
+-#if LINUX_VERSION_IS_GEQ(4,3,0)
++#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
+ /*
+  * FILS AEAD for (Re)Association Request/Response frames
+  * Copyright 2016, Qualcomm Atheros, Inc.
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -550,7 +550,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 			   NL80211_FEATURE_MAC_ON_CREATE |
+ 			   NL80211_FEATURE_USERSPACE_MPM |
+ 			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
+-#if LINUX_VERSION_IS_GEQ(4,3,0)
++#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
+ #endif
+ 
diff --git a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch b/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
new file mode 100644
index 0000000000..d138b2c5ac
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
@@ -0,0 +1,199 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 7 Oct 2017 09:37:28 +0200
+Subject: [PATCH] Revert "mac80211: aes-cmac: switch to shash CMAC
+ driver"
+
+This reverts commit 26717828b75dd5c46e97f7f4a9b937d038bb2852.
+Reduces mac80211 dependencies for LEDE
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/aes_cmac.c
++++ b/net/mac80211/aes_cmac.c
+@@ -22,50 +22,126 @@
+ #define CMAC_TLEN_256 16 /* CMAC TLen = 128 bits (16 octets) */
+ #define AAD_LEN 20
+ 
+-static const u8 zero[CMAC_TLEN_256];
+ 
+-void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
+-			const u8 *data, size_t data_len, u8 *mic)
++void gf_mulx(u8 *pad)
++{
++	int i, carry;
++
++	carry = pad[0] & 0x80;
++	for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
++		pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
++	pad[AES_BLOCK_SIZE - 1] <<= 1;
++	if (carry)
++		pad[AES_BLOCK_SIZE - 1] ^= 0x87;
++}
++
++void aes_cmac_vector(struct crypto_cipher *tfm, size_t num_elem,
++		     const u8 *addr[], const size_t *len, u8 *mac,
++		     size_t mac_len)
+ {
+-	SHASH_DESC_ON_STACK(desc, tfm);
+-	u8 out[AES_BLOCK_SIZE];
++	u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
++	const u8 *pos, *end;
++	size_t i, e, left, total_len;
++
++	memset(cbc, 0, AES_BLOCK_SIZE);
++
++	total_len = 0;
++	for (e = 0; e < num_elem; e++)
++		total_len += len[e];
++	left = total_len;
++
++	e = 0;
++	pos = addr[0];
++	end = pos + len[0];
++
++	while (left >= AES_BLOCK_SIZE) {
++		for (i = 0; i < AES_BLOCK_SIZE; i++) {
++			cbc[i] ^= *pos++;
++			if (pos >= end) {
++				e++;
++				pos = addr[e];
++				end = pos + len[e];
++			}
++		}
++		if (left > AES_BLOCK_SIZE)
++			crypto_cipher_encrypt_one(tfm, cbc, cbc);
++		left -= AES_BLOCK_SIZE;
++	}
++
++	memset(pad, 0, AES_BLOCK_SIZE);
++	crypto_cipher_encrypt_one(tfm, pad, pad);
++	gf_mulx(pad);
++
++	if (left || total_len == 0) {
++		for (i = 0; i < left; i++) {
++			cbc[i] ^= *pos++;
++			if (pos >= end) {
++				e++;
++				pos = addr[e];
++				end = pos + len[e];
++			}
++		}
++		cbc[left] ^= 0x80;
++		gf_mulx(pad);
++	}
++
++	for (i = 0; i < AES_BLOCK_SIZE; i++)
++		pad[i] ^= cbc[i];
++	crypto_cipher_encrypt_one(tfm, pad, pad);
++	memcpy(mac, pad, mac_len);
++}
+ 
+-	desc->tfm = tfm;
+ 
+-	crypto_shash_init(desc);
+-	crypto_shash_update(desc, aad, AAD_LEN);
+-	crypto_shash_update(desc, data, data_len - CMAC_TLEN);
+-	crypto_shash_finup(desc, zero, CMAC_TLEN, out);
++void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
++			const u8 *data, size_t data_len, u8 *mic)
++{
++	const u8 *addr[3];
++	size_t len[3];
++	u8 zero[CMAC_TLEN];
++
++	memset(zero, 0, CMAC_TLEN);
++	addr[0] = aad;
++	len[0] = AAD_LEN;
++	addr[1] = data;
++	len[1] = data_len - CMAC_TLEN;
++	addr[2] = zero;
++	len[2] = CMAC_TLEN;
+ 
+-	memcpy(mic, out, CMAC_TLEN);
++	aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN);
+ }
+ 
+-void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
++void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
+ 			    const u8 *data, size_t data_len, u8 *mic)
+ {
+-	SHASH_DESC_ON_STACK(desc, tfm);
++	const u8 *addr[3];
++	size_t len[3];
++	u8 zero[CMAC_TLEN_256];
++
++	memset(zero, 0, CMAC_TLEN_256);
++	addr[0] = aad;
++	len[0] = AAD_LEN;
++	addr[1] = data;
++	len[1] = data_len - CMAC_TLEN_256;
++	addr[2] = zero;
++	len[2] = CMAC_TLEN_256;
+ 
+-	desc->tfm = tfm;
+-
+-	crypto_shash_init(desc);
+-	crypto_shash_update(desc, aad, AAD_LEN);
+-	crypto_shash_update(desc, data, data_len - CMAC_TLEN_256);
+-	crypto_shash_finup(desc, zero, CMAC_TLEN_256, mic);
++	aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN_256);
+ }
+ 
+-struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
+-						  size_t key_len)
++struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
++						   size_t key_len)
+ {
+-	struct crypto_shash *tfm;
++	struct crypto_cipher *tfm;
+ 
+-	tfm = crypto_alloc_shash("cmac(aes)", 0, 0);
++	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
+ 	if (!IS_ERR(tfm))
+-		crypto_shash_setkey(tfm, key, key_len);
++		crypto_cipher_setkey(tfm, key, key_len);
+ 
+ 	return tfm;
+ }
+ 
+-void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm)
++
++void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm)
+ {
+-	crypto_free_shash(tfm);
++	crypto_free_cipher(tfm);
+ }
+--- a/net/mac80211/aes_cmac.h
++++ b/net/mac80211/aes_cmac.h
+@@ -10,14 +10,13 @@
+ #define AES_CMAC_H
+ 
+ #include <linux/crypto.h>
+-#include <crypto/hash.h>
+ 
+-struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
+-						  size_t key_len);
+-void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
++struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
++						   size_t key_len);
++void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
+ 			const u8 *data, size_t data_len, u8 *mic);
+-void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
++void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
+ 			    const u8 *data, size_t data_len, u8 *mic);
+-void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm);
++void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm);
+ 
+ #endif /* AES_CMAC_H */
+--- a/net/mac80211/key.h
++++ b/net/mac80211/key.h
+@@ -93,7 +93,7 @@ struct ieee80211_key {
+ 		} ccmp;
+ 		struct {
+ 			u8 rx_pn[IEEE80211_CMAC_PN_LEN];
+-			struct crypto_shash *tfm;
++			struct crypto_cipher *tfm;
+ 			u32 replays; /* dot11RSNAStatsCMACReplays */
+ 			u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
+ 		} aes_cmac;
diff --git a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch b/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
new file mode 100644
index 0000000000..9d185e61e7
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
@@ -0,0 +1,10 @@
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -5,7 +5,6 @@ config MAC80211
+ 	depends on CRYPTO
+ 	depends on CRYPTO_ARC4
+ 	depends on CRYPTO_AES
+-	depends on CRYPTO_CMAC
+ 	depends on CRC32
+ 	---help---
+ 	  This option enables the hardware independent IEEE 802.11
diff --git a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
new file mode 100644
index 0000000000..6e9a07a927
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
@@ -0,0 +1,15 @@
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3750,6 +3750,12 @@ out:
+ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+ 				       struct net_device *dev)
+ {
++#if defined(sk_pacing_shift) || LINUX_VERSION_IS_GEQ(4,15,0)
++	if (skb->sk && sk_fullsock(skb->sk) &&
++	    skb->sk->sk_pacing_shift != 6)
++		skb->sk->sk_pacing_shift = 6;
++#endif
++
+ 	if (unlikely(ieee80211_multicast_to_unicast(skb, dev))) {
+ 		struct sk_buff_head queue;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
new file mode 100644
index 0000000000..781dd3c1bc
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
@@ -0,0 +1,67 @@
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -292,7 +292,7 @@ void ieee80211_restart_hw(struct ieee802
+ }
+ EXPORT_SYMBOL(ieee80211_restart_hw);
+ 
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ static int ieee80211_ifa_changed(struct notifier_block *nb,
+ 				 unsigned long data, void *arg)
+ {
+@@ -351,7 +351,7 @@ static int ieee80211_ifa_changed(struct
+ }
+ #endif
+ 
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ static int ieee80211_ifa6_changed(struct notifier_block *nb,
+ 				  unsigned long data, void *arg)
+ {
+@@ -1114,14 +1114,14 @@ int ieee80211_register_hw(struct ieee802
+ 	if (result)
+ 		goto fail_flows;
+ 
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ 	local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
+ 	result = register_inetaddr_notifier(&local->ifa_notifier);
+ 	if (result)
+ 		goto fail_ifa;
+ #endif
+ 
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ 	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
+ 	result = register_inet6addr_notifier(&local->ifa6_notifier);
+ 	if (result)
+@@ -1130,13 +1130,13 @@ int ieee80211_register_hw(struct ieee802
+ 
+ 	return 0;
+ 
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+  fail_ifa6:
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ 	unregister_inetaddr_notifier(&local->ifa_notifier);
+ #endif
+ #endif
+-#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
++#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
+  fail_ifa:
+ #endif
+ 	ieee80211_txq_teardown_flows(local);
+@@ -1166,10 +1166,10 @@ void ieee80211_unregister_hw(struct ieee
+ 	tasklet_kill(&local->tx_pending_tasklet);
+ 	tasklet_kill(&local->tasklet);
+ 
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ 	unregister_inetaddr_notifier(&local->ifa_notifier);
+ #endif
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ 	unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
+ 
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
new file mode 100644
index 0000000000..8ade963c9f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -0,0 +1,11 @@
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2215,7 +2215,7 @@ static int ieee80211_scan(struct wiphy *
+ 		 * the  frames sent while scanning on other channel will be
+ 		 * lost)
+ 		 */
+-		if (sdata->u.ap.beacon &&
++		if (0 && sdata->u.ap.beacon &&
+ 		    (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+ 		     !(req->flags & NL80211_SCAN_FLAG_AP)))
+ 			return -EOPNOTSUPP;
diff --git a/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
new file mode 100644
index 0000000000..83c613434d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
@@ -0,0 +1,219 @@
+From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+Date: Fri, 19 Feb 2016 11:01:49 +0100
+Subject: [PATCH] mac80211: add hdrlen to ieee80211_tx_data
+
+Add hdrlen to ieee80211_tx_data and use this
+when wep/ccmd/tkip. This is preparation for
+aligned4 code.
+
+Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -177,6 +177,7 @@ struct ieee80211_tx_data {
+ 	struct ieee80211_tx_rate rate;
+ 
+ 	unsigned int flags;
++	unsigned int hdrlen;
+ };
+ 
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -921,7 +921,7 @@ ieee80211_tx_h_fragment(struct ieee80211
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	int frag_threshold = tx->local->hw.wiphy->frag_threshold;
+-	int hdrlen;
++	int hdrlen = tx->hdrlen;
+ 	int fragnum;
+ 
+ 	/* no matter what happens, tx->skb moves to tx->skbs */
+@@ -942,8 +942,6 @@ ieee80211_tx_h_fragment(struct ieee80211
+ 	if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
+ 		return TX_DROP;
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+-
+ 	/* internal error, why isn't DONTFRAG set? */
+ 	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
+ 		return TX_DROP;
+@@ -1175,6 +1173,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 
++	tx->hdrlen = ieee80211_hdrlen(hdr->frame_control);
++
+ 	if (likely(sta)) {
+ 		if (!IS_ERR(sta))
+ 			tx->sta = sta;
+@@ -3468,6 +3468,7 @@ begin:
+ 	tx.local = local;
+ 	tx.skb = skb;
+ 	tx.sdata = vif_to_sdata(info->control.vif);
++	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
+ 
+ 	if (txq->sta)
+ 		tx.sta = container_of(txq->sta, struct sta_info, sta);
+@@ -3796,6 +3797,7 @@ ieee80211_build_data_template(struct iee
+ 	hdr = (void *)skb->data;
+ 	tx.sta = sta_info_get(sdata, hdr->addr1);
+ 	tx.skb = skb;
++	tx.hdrlen = ieee80211_padded_hdrlen(&tx.local->hw, hdr->frame_control);
+ 
+ 	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
+ 		rcu_read_unlock();
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1232,6 +1232,7 @@ void ieee80211_send_auth(struct ieee8021
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct sk_buff *skb;
+ 	struct ieee80211_mgmt *mgmt;
++	unsigned int hdrlen;
+ 	int err;
+ 
+ 	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
+@@ -1255,8 +1256,10 @@ void ieee80211_send_auth(struct ieee8021
+ 		skb_put_data(skb, extra, extra_len);
+ 
+ 	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
++		hdrlen = ieee80211_hdrlen(mgmt->frame_control);
+ 		mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+-		err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx);
++		err = ieee80211_wep_encrypt(local, skb, hdrlen, key,
++					    key_len, key_idx);
+ 		WARN_ON(err);
+ 	}
+ 
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -89,11 +89,11 @@ static void ieee80211_wep_get_iv(struct
+ 
+ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+ 				struct sk_buff *skb,
++				unsigned int hdrlen,
+ 				int keylen, int keyidx)
+ {
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+-	unsigned int hdrlen;
+ 	u8 *newhdr;
+ 
+ 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+@@ -101,7 +101,6 @@ static u8 *ieee80211_wep_add_iv(struct i
+ 	if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
+ 		return NULL;
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ 	newhdr = skb_push(skb, IEEE80211_WEP_IV_LEN);
+ 	memmove(newhdr, newhdr + IEEE80211_WEP_IV_LEN, hdrlen);
+ 
+@@ -160,6 +159,7 @@ int ieee80211_wep_encrypt_data(struct cr
+  */
+ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ 			  struct sk_buff *skb,
++			  unsigned int hdrlen,
+ 			  const u8 *key, int keylen, int keyidx)
+ {
+ 	u8 *iv;
+@@ -169,7 +169,7 @@ int ieee80211_wep_encrypt(struct ieee802
+ 	if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN))
+ 		return -1;
+ 
+-	iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
++	iv = ieee80211_wep_add_iv(local, skb, hdrlen, keylen, keyidx);
+ 	if (!iv)
+ 		return -1;
+ 
+@@ -307,13 +307,14 @@ static int wep_encrypt_skb(struct ieee80
+ 	struct ieee80211_key_conf *hw_key = info->control.hw_key;
+ 
+ 	if (!hw_key) {
+-		if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key,
++		if (ieee80211_wep_encrypt(tx->local, skb, tx->hdrlen,
++					  tx->key->conf.key,
+ 					  tx->key->conf.keylen,
+ 					  tx->key->conf.keyidx))
+ 			return -1;
+ 	} else if ((hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+ 		   (hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
+-		if (!ieee80211_wep_add_iv(tx->local, skb,
++		if (!ieee80211_wep_add_iv(tx->local, skb, tx->hdrlen,
+ 					  tx->key->conf.keylen,
+ 					  tx->key->conf.keyidx))
+ 			return -1;
+--- a/net/mac80211/wep.h
++++ b/net/mac80211/wep.h
+@@ -22,6 +22,7 @@ int ieee80211_wep_encrypt_data(struct cr
+ 				size_t klen, u8 *data, size_t data_len);
+ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ 			  struct sk_buff *skb,
++			  unsigned int hdrlen,
+ 			  const u8 *key, int keylen, int keyidx);
+ int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
+ 			       size_t klen, u8 *data, size_t data_len);
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -44,7 +44,7 @@ ieee80211_tx_h_michael_mic_add(struct ie
+ 	    skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
+ 		return TX_CONTINUE;
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = tx->hdrlen;
+ 	if (skb->len < hdrlen)
+ 		return TX_DROP;
+ 
+@@ -187,7 +187,6 @@ mic_fail_no_key:
+ 
+ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
+ {
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ 	struct ieee80211_key *key = tx->key;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	unsigned int hdrlen;
+@@ -202,7 +201,7 @@ static int tkip_encrypt_skb(struct ieee8
+ 		return 0;
+ 	}
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = tx->hdrlen;
+ 	len = skb->len - hdrlen;
+ 
+ 	if (info->control.hw_key)
+@@ -420,7 +419,7 @@ static int ccmp_encrypt_skb(struct ieee8
+ 		return 0;
+ 	}
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = tx->hdrlen;
+ 	len = skb->len - hdrlen;
+ 
+ 	if (info->control.hw_key)
+@@ -653,7 +652,7 @@ static int gcmp_encrypt_skb(struct ieee8
+ 		return 0;
+ 	}
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = tx->hdrlen;
+ 	len = skb->len - hdrlen;
+ 
+ 	if (info->control.hw_key)
+@@ -793,7 +792,6 @@ static ieee80211_tx_result
+ ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
+ 			    struct sk_buff *skb)
+ {
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	struct ieee80211_key *key = tx->key;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	int hdrlen;
+@@ -809,8 +807,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
+ 		     pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
+ 		return TX_DROP;
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+-
++	hdrlen = tx->hdrlen;
+ 	pos = skb_push(skb, iv_len);
+ 	memmove(pos, pos + iv_len, hdrlen);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
new file mode 100644
index 0000000000..417013890b
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
@@ -0,0 +1,249 @@
+From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+Date: Fri, 19 Feb 2016 11:01:50 +0100
+Subject: [PATCH] mac80211: add NEED_ALIGNED4_SKBS hw flag
+
+HW/driver should set NEED_ALIGNED4_SKBS flag in case
+require aligned skbs to four-byte boundaries.
+This affect only TX direction.
+
+Padding is added after ieee80211_hdr, before IV/LLC.
+
+Before we have to do memmove(hdrlen) twice in the
+dirver. Once before we pass this to HW and next
+in tx completion (to be sure monitor will report
+this tx frame correctly).
+
+With this patch we can skip this memmove() and save CPU.
+
+Currently this was tested with ath9k, both hw/sw crypt for
+wep/tkip/ccmp.
+
+Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+---
+
+Index: backports-v4.18-rc7/include/net/mac80211.h
+===================================================================
+--- backports-v4.18-rc7.orig/include/net/mac80211.h
++++ backports-v4.18-rc7/include/net/mac80211.h
+@@ -2084,6 +2084,9 @@ struct ieee80211_txq {
+  * @IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP: The driver (or firmware) doesn't
+  *	support QoS NDP for AP probing - that's most likely a driver bug.
+  *
++ * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
++ *	Padding will be added after ieee80211_hdr, before IV/LLC.
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2129,6 +2132,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA,
+ 	IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP,
+ 	IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP,
++	IEEE80211_HW_NEEDS_ALIGNED4_SKBS,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+Index: backports-v4.18-rc7/net/mac80211/debugfs.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/debugfs.c
++++ backports-v4.18-rc7/net/mac80211/debugfs.c
+@@ -214,6 +214,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(SUPPORTS_TDLS_BUFFER_STA),
+ 	FLAG(DEAUTH_NEED_MGD_TX_PREP),
+ 	FLAG(DOESNT_SUPPORT_QOS_NDP),
++	FLAG(NEEDS_ALIGNED4_SKBS),
+ #undef FLAG
+ };
+ 
+Index: backports-v4.18-rc7/net/mac80211/ieee80211_i.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/ieee80211_i.h
++++ backports-v4.18-rc7/net/mac80211/ieee80211_i.h
+@@ -1550,6 +1550,29 @@ ieee80211_vif_get_num_mcast_if(struct ie
+ 	return -1;
+ }
+ 
++static inline unsigned int
++ieee80211_hdr_padsize(struct ieee80211_hw *hw, unsigned int hdrlen)
++{
++	/*
++	 * While hdrlen is already aligned to two-byte boundaries,
++	 * simple check with & 2 will return correct padsize.
++	 */
++	if (ieee80211_hw_check(hw, NEEDS_ALIGNED4_SKBS))
++		return hdrlen & 2;
++	return 0;
++}
++
++static inline unsigned int
++ieee80211_padded_hdrlen(struct ieee80211_hw *hw, __le16 fc)
++{
++	unsigned int hdrlen;
++
++	hdrlen = ieee80211_hdrlen(fc);
++	hdrlen += ieee80211_hdr_padsize(hw, hdrlen);
++
++	return hdrlen;
++}
++
+ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
+ 				     struct ieee80211_rx_status *status,
+ 				     unsigned int mpdu_len,
+Index: backports-v4.18-rc7/net/mac80211/sta_info.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/sta_info.h
++++ backports-v4.18-rc7/net/mac80211/sta_info.h
+@@ -301,7 +301,7 @@ struct ieee80211_fast_tx {
+ 	u8 hdr_len;
+ 	u8 sa_offs, da_offs, pn_offs;
+ 	u8 band;
+-	u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
++	u8 hdr[30 + 2 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
+ 	       sizeof(rfc1042_header)] __aligned(2);
+ 
+ 	struct rcu_head rcu_head;
+Index: backports-v4.18-rc7/net/mac80211/status.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/status.c
++++ backports-v4.18-rc7/net/mac80211/status.c
+@@ -653,9 +653,22 @@ void ieee80211_tx_monitor(struct ieee802
+ 	struct sk_buff *skb2;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct net_device *prev_dev = NULL;
++	unsigned int hdrlen, padsize;
+ 	int rtap_len;
+ 
++	/* Remove padding if was added */
++	if (ieee80211_hw_check(&local->hw, NEEDS_ALIGNED4_SKBS)) {
++		hdrlen = ieee80211_hdrlen(hdr->frame_control);
++		padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
++
++		if (padsize && skb->len > hdrlen + padsize) {
++			memmove(skb->data + padsize, skb->data, hdrlen);
++			skb_pull(skb, padsize);
++		}
++	}
++
+ 	/* send frame to monitor interfaces now */
+ 	rtap_len = ieee80211_tx_radiotap_len(info);
+ 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
+Index: backports-v4.18-rc7/net/mac80211/tkip.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/tkip.c
++++ backports-v4.18-rc7/net/mac80211/tkip.c
+@@ -201,10 +201,12 @@ void ieee80211_get_tkip_p2k(struct ieee8
+ {
+ 	struct ieee80211_key *key = (struct ieee80211_key *)
+ 			container_of(keyconf, struct ieee80211_key, conf);
++	struct ieee80211_hw *hw = &key->local->hw;
+ 	const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
+ 	struct tkip_ctx *ctx = &key->u.tkip.tx;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+-	const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
++	const u8 *data = (u8 *)hdr + ieee80211_padded_hdrlen(hw,
++							hdr->frame_control);
+ 	u32 iv32 = get_unaligned_le32(&data[4]);
+ 	u16 iv16 = data[2] | (data[0] << 8);
+ 
+Index: backports-v4.18-rc7/net/mac80211/tx.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/tx.c
++++ backports-v4.18-rc7/net/mac80211/tx.c
+@@ -1169,8 +1169,7 @@ ieee80211_tx_prepare(struct ieee80211_su
+ 	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+-
+-	tx->hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx->hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
+ 
+ 	if (likely(sta)) {
+ 		if (!IS_ERR(sta))
+@@ -2200,7 +2199,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
+ 		goto fail;
+ 
+ 	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
+ 
+ 	if (skb->len < len_rthdr + hdrlen)
+ 		goto fail;
+@@ -2418,7 +2417,7 @@ static struct sk_buff *ieee80211_build_h
+ 	struct ieee80211_chanctx_conf *chanctx_conf;
+ 	struct ieee80211_sub_if_data *ap_sdata;
+ 	enum nl80211_band band;
+-	int ret;
++	int padsize, ret;
+ 
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+@@ -2638,6 +2637,9 @@ static struct sk_buff *ieee80211_build_h
+ 		hdrlen += 2;
+ 	}
+ 
++	/* Check aligned4 skb required */
++	padsize = ieee80211_hdr_padsize(&sdata->local->hw, hdrlen);
++
+ 	/*
+ 	 * Drop unicast frames to unauthorised stations unless they are
+ 	 * EAPOL frames from the local station.
+@@ -2718,6 +2720,7 @@ static struct sk_buff *ieee80211_build_h
+ 
+ 	skb_pull(skb, skip_header_bytes);
+ 	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
++	head_need += padsize;
+ 
+ 	/*
+ 	 * So we need to modify the skb header and hence need a copy of
+@@ -2750,6 +2753,9 @@ static struct sk_buff *ieee80211_build_h
+ 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
+ #endif
+ 
++	if (padsize)
++		memset(skb_push(skb, padsize), 0, padsize);
++
+ 	if (ieee80211_is_data_qos(fc)) {
+ 		__le16 *qos_control;
+ 
+@@ -2925,6 +2931,9 @@ void ieee80211_check_fast_xmit(struct st
+ 		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+ 	}
+ 
++	/* Check aligned4 skb required */
++	build.hdr_len += ieee80211_hdr_padsize(&local->hw, build.hdr_len);
++
+ 	/* We store the key here so there's no point in using rcu_dereference()
+ 	 * but that's fine because the code that changes the pointers will call
+ 	 * this function after doing so. For a single CPU that would be enough,
+@@ -3513,7 +3522,7 @@ begin:
+ 
+ 		if (tx.key &&
+ 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
+-			pn_offs = ieee80211_hdrlen(hdr->frame_control);
++			pn_offs = tx.hdrlen;
+ 
+ 		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
+ 					   tx.key, skb);
+Index: backports-v4.18-rc7/net/mac80211/util.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/util.c
++++ backports-v4.18-rc7/net/mac80211/util.c
+@@ -1274,6 +1274,7 @@ void ieee80211_send_auth(struct ieee8021
+ 			 u32 tx_flags)
+ {
+ 	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_hw *hw = &local->hw;
+ 	struct sk_buff *skb;
+ 	struct ieee80211_mgmt *mgmt;
+ 	unsigned int hdrlen;
+@@ -1300,7 +1301,7 @@ void ieee80211_send_auth(struct ieee8021
+ 		skb_put_data(skb, extra, extra_len);
+ 
+ 	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
+-		hdrlen = ieee80211_hdrlen(mgmt->frame_control);
++		hdrlen = ieee80211_padded_hdrlen(hw, mgmt->frame_control);
+ 		mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+ 		err = ieee80211_wep_encrypt(local, skb, hdrlen, key,
+ 					    key_len, key_idx);
diff --git a/package/kernel/mac80211/patches/subsys/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch b/package/kernel/mac80211/patches/subsys/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
new file mode 100644
index 0000000000..609b15b832
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
@@ -0,0 +1,82 @@
+From: Chaitanya T K <chaitanya.mgit@gmail.com>
+Date: Mon, 27 Jun 2016 15:23:26 +0530
+Subject: [PATCH] mac80211: minstrel: Enable STBC and LDPC for VHT Rates
+
+If peer support reception of STBC and LDPC, enable them for better
+performance.
+
+Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
+---
+
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -1556,6 +1556,7 @@ struct ieee80211_vht_operation {
+ #define IEEE80211_VHT_CAP_RXSTBC_3				0x00000300
+ #define IEEE80211_VHT_CAP_RXSTBC_4				0x00000400
+ #define IEEE80211_VHT_CAP_RXSTBC_MASK				0x00000700
++#define IEEE80211_VHT_CAP_RXSTBC_SHIFT				8
+ #define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE			0x00000800
+ #define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE			0x00001000
+ #define IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT                  13
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1130,7 +1130,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 	struct minstrel_ht_sta *mi = &msp->ht;
+ 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+-	u16 sta_cap = sta->ht_cap.cap;
++	u16 ht_cap = sta->ht_cap.cap;
+ 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+ 	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
+ 	int use_vht;
+@@ -1138,6 +1138,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	int ack_dur;
+ 	int stbc;
+ 	int i;
++	bool ldpc = false;
+ 
+ 	/* fall back to the old minstrel for legacy stations */
+ 	if (!sta->ht_cap.ht_supported)
+@@ -1175,16 +1176,24 @@ minstrel_ht_update_caps(void *priv, stru
+ 	}
+ 	mi->sample_tries = 4;
+ 
+-	/* TODO tx_flags for vht - ATM the RC API is not fine-grained enough */
+ 	if (!use_vht) {
+-		stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
++		stbc = (ht_cap & IEEE80211_HT_CAP_RX_STBC) >>
+ 			IEEE80211_HT_CAP_RX_STBC_SHIFT;
+-		mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
+ 
+-		if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
+-			mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
++		if (ht_cap & IEEE80211_HT_CAP_LDPC_CODING)
++			ldpc = true;
++	} else {
++		stbc = (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK) >>
++			IEEE80211_VHT_CAP_RXSTBC_SHIFT;
++
++		if (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC)
++			ldpc = true;
+ 	}
+ 
++	mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
++	if (ldpc)
++		mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
++
+ 	for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
+ 		u32 gflags = minstrel_mcs_groups[i].flags;
+ 		int bw, nss;
+@@ -1197,10 +1206,10 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 		if (gflags & IEEE80211_TX_RC_SHORT_GI) {
+ 			if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+-				if (!(sta_cap & IEEE80211_HT_CAP_SGI_40))
++				if (!(ht_cap & IEEE80211_HT_CAP_SGI_40))
+ 					continue;
+ 			} else {
+-				if (!(sta_cap & IEEE80211_HT_CAP_SGI_20))
++				if (!(ht_cap & IEEE80211_HT_CAP_SGI_20))
+ 					continue;
+ 			}
+ 		}
diff --git a/package/kernel/mac80211/patches/subsys/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch b/package/kernel/mac80211/patches/subsys/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
new file mode 100644
index 0000000000..c871655a38
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
@@ -0,0 +1,162 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:41:51 +0100
+Subject: [PATCH] mac80211: minstrel: remove unnecessary debugfs cleanup
+ code
+
+debugfs entries are cleaned up by debugfs_remove_recursive already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel.c
+@@ -689,8 +689,8 @@ minstrel_alloc(struct ieee80211_hw *hw,
+ 
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	mp->fixed_rate_idx = (u32) -1;
+-	mp->dbg_fixed_rate = debugfs_create_u32("fixed_rate_idx",
+-			0666, debugfsdir, &mp->fixed_rate_idx);
++	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
++			   &mp->fixed_rate_idx);
+ #endif
+ 
+ 	minstrel_init_cck_rates(mp);
+@@ -701,9 +701,6 @@ minstrel_alloc(struct ieee80211_hw *hw,
+ static void
+ minstrel_free(void *priv)
+ {
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	debugfs_remove(((struct minstrel_priv *)priv)->dbg_fixed_rate);
+-#endif
+ 	kfree(priv);
+ }
+ 
+@@ -735,7 +732,6 @@ const struct rate_control_ops mac80211_m
+ 	.free_sta = minstrel_free_sta,
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	.add_sta_debugfs = minstrel_add_sta_debugfs,
+-	.remove_sta_debugfs = minstrel_remove_sta_debugfs,
+ #endif
+ 	.get_expected_throughput = minstrel_get_expected_throughput,
+ };
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel.h
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel.h
+@@ -109,11 +109,6 @@ struct minstrel_sta_info {
+ 
+ 	/* sampling table */
+ 	u8 *sample_table;
+-
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	struct dentry *dbg_stats;
+-	struct dentry *dbg_stats_csv;
+-#endif
+ };
+ 
+ struct minstrel_priv {
+@@ -137,7 +132,6 @@ struct minstrel_priv {
+ 	 *   - setting will be applied on next update
+ 	 */
+ 	u32 fixed_rate_idx;
+-	struct dentry *dbg_fixed_rate;
+ #endif
+ };
+ 
+@@ -156,7 +150,6 @@ minstrel_get_ewmsd10(struct minstrel_rat
+ 
+ extern const struct rate_control_ops mac80211_minstrel;
+ void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+-void minstrel_remove_sta_debugfs(void *priv, void *priv_sta);
+ 
+ /* Recalculate success probabilities and counters for a given rate using EWMA */
+ void minstrel_calc_rate_stats(struct minstrel_rate_stats *mrs);
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_debugfs.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_debugfs.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -214,19 +214,7 @@ minstrel_add_sta_debugfs(void *priv, voi
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+ 
+-	mi->dbg_stats = debugfs_create_file("rc_stats", 0444, dir, mi,
+-					    &minstrel_stat_fops);
+-
+-	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", 0444, dir, mi,
+-						&minstrel_stat_csv_fops);
+-}
+-
+-void
+-minstrel_remove_sta_debugfs(void *priv, void *priv_sta)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	debugfs_remove(mi->dbg_stats);
+-
+-	debugfs_remove(mi->dbg_stats_csv);
++	debugfs_create_file("rc_stats", S_IRUGO, dir, mi, &minstrel_stat_fops);
++	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, mi,
++			    &minstrel_stat_csv_fops);
+ }
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.c
+@@ -1393,7 +1393,6 @@ static const struct rate_control_ops mac
+ 	.free = minstrel_ht_free,
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	.add_sta_debugfs = minstrel_ht_add_sta_debugfs,
+-	.remove_sta_debugfs = minstrel_ht_remove_sta_debugfs,
+ #endif
+ 	.get_expected_throughput = minstrel_ht_get_expected_throughput,
+ };
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht.h
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.h
+@@ -110,17 +110,12 @@ struct minstrel_ht_sta_priv {
+ 		struct minstrel_ht_sta ht;
+ 		struct minstrel_sta_info legacy;
+ 	};
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	struct dentry *dbg_stats;
+-	struct dentry *dbg_stats_csv;
+-#endif
+ 	void *ratelist;
+ 	void *sample_table;
+ 	bool is_ht;
+ };
+ 
+ void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+-void minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta);
+ int minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
+ 			   int prob_ewma);
+ 
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht_debugfs.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -303,17 +303,8 @@ minstrel_ht_add_sta_debugfs(void *priv,
+ {
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 
+-	msp->dbg_stats = debugfs_create_file("rc_stats", 0444, dir, msp,
+-					     &minstrel_ht_stat_fops);
+-	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", 0444, dir, msp,
+-						 &minstrel_ht_stat_csv_fops);
+-}
+-
+-void
+-minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta)
+-{
+-	struct minstrel_ht_sta_priv *msp = priv_sta;
+-
+-	debugfs_remove(msp->dbg_stats);
+-	debugfs_remove(msp->dbg_stats_csv);
++	debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
++			    &minstrel_ht_stat_fops);
++	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, msp,
++			    &minstrel_ht_stat_csv_fops);
+ }
diff --git a/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
new file mode 100644
index 0000000000..1c36a070ca
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
@@ -0,0 +1,596 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:43:30 +0100
+Subject: [PATCH] mac80211: minstrel: merge with minstrel_ht, always enable
+ VHT support
+
+Legacy-only devices are not very common and the overhead of the extra
+code for HT and VHT rates is not big enough to justify all those extra
+lines of code to make it optional.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+Index: backports-v4.18-rc7/net/mac80211/Kconfig
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/Kconfig
++++ backports-v4.18-rc7/net/mac80211/Kconfig
+@@ -25,20 +25,6 @@ config MAC80211_RC_MINSTREL
+ 	---help---
+ 	  This option enables the 'minstrel' TX rate control algorithm
+ 
+-config MAC80211_RC_MINSTREL_HT
+-	bool "Minstrel 802.11n support" if EXPERT
+-	depends on MAC80211_RC_MINSTREL
+-	default y
+-	---help---
+-	  This option enables the 'minstrel_ht' TX rate control algorithm
+-
+-config MAC80211_RC_MINSTREL_VHT
+-	bool "Minstrel 802.11ac support" if EXPERT
+-	depends on MAC80211_RC_MINSTREL_HT
+-	default n
+-	---help---
+-	  This option enables VHT in the 'minstrel_ht' TX rate control algorithm
+-
+ choice
+ 	prompt "Default rate control algorithm"
+ 	depends on MAC80211_HAS_RC
+@@ -60,8 +46,7 @@ endchoice
+ 
+ config MAC80211_RC_DEFAULT
+ 	string
+-	default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL && MAC80211_RC_MINSTREL_HT
+-	default "minstrel" if MAC80211_RC_DEFAULT_MINSTREL
++	default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL
+ 	default ""
+ 
+ endif
+Index: backports-v4.18-rc7/net/mac80211/Makefile
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/Makefile
++++ backports-v4.18-rc7/net/mac80211/Makefile
+@@ -51,13 +51,14 @@ mac80211-$(CONFIG_PM) += pm.o
+ 
+ CFLAGS_trace.o := -I$(src)
+ 
+-rc80211_minstrel-y := rc80211_minstrel.o
+-rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += rc80211_minstrel_debugfs.o
++rc80211_minstrel-y := \
++	rc80211_minstrel.o \
++	rc80211_minstrel_ht.o
+ 
+-rc80211_minstrel_ht-y := rc80211_minstrel_ht.o
+-rc80211_minstrel_ht-$(CPTCFG_MAC80211_DEBUGFS) += rc80211_minstrel_ht_debugfs.o
++rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += \
++	rc80211_minstrel_debugfs.o \
++	rc80211_minstrel_ht_debugfs.o
+ 
+ mac80211-$(CPTCFG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
+-mac80211-$(CPTCFG_MAC80211_RC_MINSTREL_HT) += $(rc80211_minstrel_ht-y)
+ 
+ ccflags-y += -DDEBUG
+Index: backports-v4.18-rc7/net/mac80211/main.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/main.c
++++ backports-v4.18-rc7/net/mac80211/main.c
+@@ -1264,18 +1264,12 @@ static int __init ieee80211_init(void)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = rc80211_minstrel_ht_init();
+-	if (ret)
+-		goto err_minstrel;
+-
+ 	ret = ieee80211_iface_init();
+ 	if (ret)
+ 		goto err_netdev;
+ 
+ 	return 0;
+  err_netdev:
+-	rc80211_minstrel_ht_exit();
+- err_minstrel:
+ 	rc80211_minstrel_exit();
+ 
+ 	return ret;
+@@ -1283,7 +1277,6 @@ static int __init ieee80211_init(void)
+ 
+ static void __exit ieee80211_exit(void)
+ {
+-	rc80211_minstrel_ht_exit();
+ 	rc80211_minstrel_exit();
+ 
+ 	ieee80211s_stop();
+Index: backports-v4.18-rc7/net/mac80211/rate.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rate.h
++++ backports-v4.18-rc7/net/mac80211/rate.h
+@@ -95,18 +95,5 @@ static inline void rc80211_minstrel_exit
+ }
+ #endif
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_HT
+-int rc80211_minstrel_ht_init(void);
+-void rc80211_minstrel_ht_exit(void);
+-#else
+-static inline int rc80211_minstrel_ht_init(void)
+-{
+-	return 0;
+-}
+-static inline void rc80211_minstrel_ht_exit(void)
+-{
+-}
+-#endif
+-
+ 
+ #endif /* IEEE80211_RATE_H */
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel.c
+@@ -572,138 +572,6 @@ minstrel_rate_init(void *priv, struct ie
+ 	minstrel_update_rates(mp, mi);
+ }
+ 
+-static void *
+-minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
+-{
+-	struct ieee80211_supported_band *sband;
+-	struct minstrel_sta_info *mi;
+-	struct minstrel_priv *mp = priv;
+-	struct ieee80211_hw *hw = mp->hw;
+-	int max_rates = 0;
+-	int i;
+-
+-	mi = kzalloc(sizeof(struct minstrel_sta_info), gfp);
+-	if (!mi)
+-		return NULL;
+-
+-	for (i = 0; i < NUM_NL80211_BANDS; i++) {
+-		sband = hw->wiphy->bands[i];
+-		if (sband && sband->n_bitrates > max_rates)
+-			max_rates = sband->n_bitrates;
+-	}
+-
+-	mi->r = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
+-	if (!mi->r)
+-		goto error;
+-
+-	mi->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
+-	if (!mi->sample_table)
+-		goto error1;
+-
+-	mi->last_stats_update = jiffies;
+-	return mi;
+-
+-error1:
+-	kfree(mi->r);
+-error:
+-	kfree(mi);
+-	return NULL;
+-}
+-
+-static void
+-minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	kfree(mi->sample_table);
+-	kfree(mi->r);
+-	kfree(mi);
+-}
+-
+-static void
+-minstrel_init_cck_rates(struct minstrel_priv *mp)
+-{
+-	static const int bitrates[4] = { 10, 20, 55, 110 };
+-	struct ieee80211_supported_band *sband;
+-	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
+-	int i, j;
+-
+-	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
+-	if (!sband)
+-		return;
+-
+-	for (i = 0, j = 0; i < sband->n_bitrates; i++) {
+-		struct ieee80211_rate *rate = &sband->bitrates[i];
+-
+-		if (rate->flags & IEEE80211_RATE_ERP_G)
+-			continue;
+-
+-		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+-			continue;
+-
+-		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
+-			if (rate->bitrate != bitrates[j])
+-				continue;
+-
+-			mp->cck_rates[j] = i;
+-			break;
+-		}
+-	}
+-}
+-
+-static void *
+-minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+-{
+-	struct minstrel_priv *mp;
+-
+-	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
+-	if (!mp)
+-		return NULL;
+-
+-	/* contention window settings
+-	 * Just an approximation. Using the per-queue values would complicate
+-	 * the calculations and is probably unnecessary */
+-	mp->cw_min = 15;
+-	mp->cw_max = 1023;
+-
+-	/* number of packets (in %) to use for sampling other rates
+-	 * sample less often for non-mrr packets, because the overhead
+-	 * is much higher than with mrr */
+-	mp->lookaround_rate = 5;
+-	mp->lookaround_rate_mrr = 10;
+-
+-	/* maximum time that the hw is allowed to stay in one MRR segment */
+-	mp->segment_size = 6000;
+-
+-	if (hw->max_rate_tries > 0)
+-		mp->max_retry = hw->max_rate_tries;
+-	else
+-		/* safe default, does not necessarily have to match hw properties */
+-		mp->max_retry = 7;
+-
+-	if (hw->max_rates >= 4)
+-		mp->has_mrr = true;
+-
+-	mp->hw = hw;
+-	mp->update_interval = 100;
+-
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	mp->fixed_rate_idx = (u32) -1;
+-	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
+-			   &mp->fixed_rate_idx);
+-#endif
+-
+-	minstrel_init_cck_rates(mp);
+-
+-	return mp;
+-}
+-
+-static void
+-minstrel_free(void *priv)
+-{
+-	kfree(priv);
+-}
+-
+ static u32 minstrel_get_expected_throughput(void *priv_sta)
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+@@ -722,29 +590,8 @@ static u32 minstrel_get_expected_through
+ }
+ 
+ const struct rate_control_ops mac80211_minstrel = {
+-	.name = "minstrel",
+ 	.tx_status_ext = minstrel_tx_status,
+ 	.get_rate = minstrel_get_rate,
+ 	.rate_init = minstrel_rate_init,
+-	.alloc = minstrel_alloc,
+-	.free = minstrel_free,
+-	.alloc_sta = minstrel_alloc_sta,
+-	.free_sta = minstrel_free_sta,
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	.add_sta_debugfs = minstrel_add_sta_debugfs,
+-#endif
+ 	.get_expected_throughput = minstrel_get_expected_throughput,
+ };
+-
+-int __init
+-rc80211_minstrel_init(void)
+-{
+-	return ieee80211_rate_control_register(&mac80211_minstrel);
+-}
+-
+-void
+-rc80211_minstrel_exit(void)
+-{
+-	ieee80211_rate_control_unregister(&mac80211_minstrel);
+-}
+-
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel.h
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel.h
+@@ -158,7 +158,5 @@ int minstrel_get_tp_avg(struct minstrel_
+ /* debugfs */
+ int minstrel_stats_open(struct inode *inode, struct file *file);
+ int minstrel_stats_csv_open(struct inode *inode, struct file *file);
+-ssize_t minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos);
+-int minstrel_stats_release(struct inode *inode, struct file *file);
+ 
+ #endif
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_debugfs.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_debugfs.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -54,22 +54,6 @@
+ #include <net/mac80211.h>
+ #include "rc80211_minstrel.h"
+ 
+-ssize_t
+-minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
+-{
+-	struct minstrel_debugfs_info *ms;
+-
+-	ms = file->private_data;
+-	return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
+-}
+-
+-int
+-minstrel_stats_release(struct inode *inode, struct file *file)
+-{
+-	kfree(file->private_data);
+-	return 0;
+-}
+-
+ int
+ minstrel_stats_open(struct inode *inode, struct file *file)
+ {
+@@ -135,14 +119,6 @@ minstrel_stats_open(struct inode *inode,
+ 	return 0;
+ }
+ 
+-static const struct file_operations minstrel_stat_fops = {
+-	.owner = THIS_MODULE,
+-	.open = minstrel_stats_open,
+-	.read = minstrel_stats_read,
+-	.release = minstrel_stats_release,
+-	.llseek = default_llseek,
+-};
+-
+ int
+ minstrel_stats_csv_open(struct inode *inode, struct file *file)
+ {
+@@ -200,21 +176,3 @@ minstrel_stats_csv_open(struct inode *in
+ 
+ 	return 0;
+ }
+-
+-static const struct file_operations minstrel_stat_csv_fops = {
+-	.owner = THIS_MODULE,
+-	.open = minstrel_stats_csv_open,
+-	.read = minstrel_stats_read,
+-	.release = minstrel_stats_release,
+-	.llseek = default_llseek,
+-};
+-
+-void
+-minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	debugfs_create_file("rc_stats", S_IRUGO, dir, mi, &minstrel_stat_fops);
+-	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, mi,
+-			    &minstrel_stat_csv_fops);
+-}
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.c
+@@ -137,12 +137,10 @@
+ 		}					\
+ 	}
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ static bool minstrel_vht_only = true;
+ module_param(minstrel_vht_only, bool, 0644);
+ MODULE_PARM_DESC(minstrel_vht_only,
+ 		 "Use only VHT rates when VHT is supported by sta.");
+-#endif
+ 
+ /*
+  * To enable sufficiently targeted rate sampling, MCS rates are divided into
+@@ -171,7 +169,6 @@ const struct mcs_group minstrel_mcs_grou
+ 
+ 	CCK_GROUP,
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 	VHT_GROUP(1, 0, BW_20),
+ 	VHT_GROUP(2, 0, BW_20),
+ 	VHT_GROUP(3, 0, BW_20),
+@@ -195,7 +192,6 @@ const struct mcs_group minstrel_mcs_grou
+ 	VHT_GROUP(1, 1, BW_80),
+ 	VHT_GROUP(2, 1, BW_80),
+ 	VHT_GROUP(3, 1, BW_80),
+-#endif
+ };
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
+@@ -1146,12 +1142,10 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 	BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 	if (vht_cap->vht_supported)
+ 		use_vht = vht_cap->vht_mcs.tx_mcs_map != cpu_to_le16(~0);
+ 	else
+-#endif
+-	use_vht = 0;
++		use_vht = 0;
+ 
+ 	msp->is_ht = true;
+ 	memset(mi, 0, sizeof(*mi));
+@@ -1226,10 +1220,9 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 		/* HT rate */
+ 		if (gflags & IEEE80211_TX_RC_MCS) {
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 			if (use_vht && minstrel_vht_only)
+ 				continue;
+-#endif
++
+ 			mi->supported[i] = mcs->rx_mask[nss - 1];
+ 			if (mi->supported[i])
+ 				n_supported++;
+@@ -1349,16 +1342,88 @@ minstrel_ht_free_sta(void *priv, struct
+ 	kfree(msp);
+ }
+ 
++static void
++minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
++{
++	static const int bitrates[4] = { 10, 20, 55, 110 };
++	struct ieee80211_supported_band *sband;
++	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
++	int i, j;
++
++	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
++	if (!sband)
++		return;
++
++	for (i = 0, j = 0; i < sband->n_bitrates; i++) {
++		struct ieee80211_rate *rate = &sband->bitrates[i];
++
++		if (rate->flags & IEEE80211_RATE_ERP_G)
++			continue;
++
++		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
++			continue;
++
++		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
++			if (rate->bitrate != bitrates[j])
++				continue;
++
++			mp->cck_rates[j] = i;
++			break;
++		}
++	}
++}
++
+ static void *
+ minstrel_ht_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+ {
+-	return mac80211_minstrel.alloc(hw, debugfsdir);
++	struct minstrel_priv *mp;
++
++	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
++	if (!mp)
++		return NULL;
++
++	/* contention window settings
++	 * Just an approximation. Using the per-queue values would complicate
++	 * the calculations and is probably unnecessary */
++	mp->cw_min = 15;
++	mp->cw_max = 1023;
++
++	/* number of packets (in %) to use for sampling other rates
++	 * sample less often for non-mrr packets, because the overhead
++	 * is much higher than with mrr */
++	mp->lookaround_rate = 5;
++	mp->lookaround_rate_mrr = 10;
++
++	/* maximum time that the hw is allowed to stay in one MRR segment */
++	mp->segment_size = 6000;
++
++	if (hw->max_rate_tries > 0)
++		mp->max_retry = hw->max_rate_tries;
++	else
++		/* safe default, does not necessarily have to match hw properties */
++		mp->max_retry = 7;
++
++	if (hw->max_rates >= 4)
++		mp->has_mrr = true;
++
++	mp->hw = hw;
++	mp->update_interval = 100;
++
++#ifdef CPTCFG_MAC80211_DEBUGFS
++	mp->fixed_rate_idx = (u32) -1;
++	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
++			   &mp->fixed_rate_idx);
++#endif
++
++	minstrel_ht_init_cck_rates(mp);
++
++	return mp;
+ }
+ 
+ static void
+ minstrel_ht_free(void *priv)
+ {
+-	mac80211_minstrel.free(priv);
++	kfree(priv);
+ }
+ 
+ static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
+@@ -1417,14 +1482,14 @@ static void __init init_sample_table(voi
+ }
+ 
+ int __init
+-rc80211_minstrel_ht_init(void)
++rc80211_minstrel_init(void)
+ {
+ 	init_sample_table();
+ 	return ieee80211_rate_control_register(&mac80211_minstrel_ht);
+ }
+ 
+ void
+-rc80211_minstrel_ht_exit(void)
++rc80211_minstrel_exit(void)
+ {
+ 	ieee80211_rate_control_unregister(&mac80211_minstrel_ht);
+ }
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht.h
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.h
+@@ -15,11 +15,7 @@
+  */
+ #define MINSTREL_MAX_STREAMS		3
+ #define MINSTREL_HT_STREAM_GROUPS	4 /* BW(=2) * SGI(=2) */
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ #define MINSTREL_VHT_STREAM_GROUPS	6 /* BW(=3) * SGI(=2) */
+-#else
+-#define MINSTREL_VHT_STREAM_GROUPS	0
+-#endif
+ 
+ #define MINSTREL_HT_GROUPS_NB	(MINSTREL_MAX_STREAMS *		\
+ 				 MINSTREL_HT_STREAM_GROUPS)
+@@ -34,11 +30,7 @@
+ #define MINSTREL_CCK_GROUP	(MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
+ #define MINSTREL_VHT_GROUP_0	(MINSTREL_CCK_GROUP + 1)
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ #define MCS_GROUP_RATES		10
+-#else
+-#define MCS_GROUP_RATES		8
+-#endif
+ 
+ struct mcs_group {
+ 	u32 flags;
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht_debugfs.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -15,6 +15,22 @@
+ #include "rc80211_minstrel.h"
+ #include "rc80211_minstrel_ht.h"
+ 
++static ssize_t
++minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
++{
++	struct minstrel_debugfs_info *ms;
++
++	ms = file->private_data;
++	return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
++}
++
++static int
++minstrel_stats_release(struct inode *inode, struct file *file)
++{
++	kfree(file->private_data);
++	return 0;
++}
++
+ static char *
+ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
+ {
diff --git a/package/kernel/mac80211/patches/subsys/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch b/package/kernel/mac80211/patches/subsys/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
new file mode 100644
index 0000000000..02a0ca0a52
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
@@ -0,0 +1,368 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:45:47 +0100
+Subject: [PATCH] mac80211: minstrel: reduce minstrel_mcs_groups size
+
+By storing a shift value for all duration values of a group, we can
+reduce precision by a neglegible amount to make it fit into a u16 value.
+This improves cache footprint and reduces size:
+
+Before:
+   text    data     bss     dec     hex filename
+  10024     116       0   10140    279c rc80211_minstrel_ht.o
+
+After:
+   text    data     bss     dec     hex filename
+   9368     116       0    9484    250c rc80211_minstrel_ht.o
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -52,22 +52,23 @@
+ 	_streams - 1
+ 
+ /* MCS rate information for an MCS group */
+-#define MCS_GROUP(_streams, _sgi, _ht40)				\
++#define MCS_GROUP(_streams, _sgi, _ht40, _s)				\
+ 	[GROUP_IDX(_streams, _sgi, _ht40)] = {				\
+ 	.streams = _streams,						\
++	.shift = _s,							\
+ 	.flags =							\
+ 		IEEE80211_TX_RC_MCS |					\
+ 		(_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |			\
+ 		(_ht40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),		\
+ 	.duration = {							\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260)		\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260) >> _s	\
+ 	}								\
+ }
+ 
+@@ -80,9 +81,10 @@
+ #define BW2VBPS(_bw, r3, r2, r1)					\
+ 	(_bw == BW_80 ? r3 : _bw == BW_40 ? r2 : r1)
+ 
+-#define VHT_GROUP(_streams, _sgi, _bw)					\
++#define VHT_GROUP(_streams, _sgi, _bw, _s)				\
+ 	[VHT_GROUP_IDX(_streams, _sgi, _bw)] = {			\
+ 	.streams = _streams,						\
++	.shift = _s,							\
+ 	.flags =							\
+ 		IEEE80211_TX_RC_VHT_MCS |				\
+ 		(_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |			\
+@@ -90,25 +92,25 @@
+ 		 _bw == BW_40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),	\
+ 	.duration = {							\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  117,  54,  26)),		\
++			     BW2VBPS(_bw,  117,  54,  26)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  234, 108,  52)),		\
++			     BW2VBPS(_bw,  234, 108,  52)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  351, 162,  78)),		\
++			     BW2VBPS(_bw,  351, 162,  78)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  468, 216, 104)),		\
++			     BW2VBPS(_bw,  468, 216, 104)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  702, 324, 156)),		\
++			     BW2VBPS(_bw,  702, 324, 156)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  936, 432, 208)),		\
++			     BW2VBPS(_bw,  936, 432, 208)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1053, 486, 234)),		\
++			     BW2VBPS(_bw, 1053, 486, 234)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1170, 540, 260)),		\
++			     BW2VBPS(_bw, 1170, 540, 260)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1404, 648, 312)),		\
++			     BW2VBPS(_bw, 1404, 648, 312)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1560, 720, 346))		\
++			     BW2VBPS(_bw, 1560, 720, 346)) >> _s	\
+ 	}								\
+ }
+ 
+@@ -121,19 +123,20 @@
+ 	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
+ 	 CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
+ 
+-#define CCK_DURATION_LIST(_short)			\
+-	CCK_ACK_DURATION(10, _short),			\
+-	CCK_ACK_DURATION(20, _short),			\
+-	CCK_ACK_DURATION(55, _short),			\
+-	CCK_ACK_DURATION(110, _short)
++#define CCK_DURATION_LIST(_short, _s)			\
++	CCK_ACK_DURATION(10, _short) >> _s,		\
++	CCK_ACK_DURATION(20, _short) >> _s,		\
++	CCK_ACK_DURATION(55, _short) >> _s,		\
++	CCK_ACK_DURATION(110, _short) >> _s
+ 
+-#define CCK_GROUP					\
++#define CCK_GROUP(_s)					\
+ 	[MINSTREL_CCK_GROUP] = {			\
+ 		.streams = 0,				\
+ 		.flags = 0,				\
++		.shift = _s,				\
+ 		.duration = {				\
+-			CCK_DURATION_LIST(false),	\
+-			CCK_DURATION_LIST(true)		\
++			CCK_DURATION_LIST(false, _s),	\
++			CCK_DURATION_LIST(true, _s)	\
+ 		}					\
+ 	}
+ 
+@@ -151,47 +154,47 @@ MODULE_PARM_DESC(minstrel_vht_only,
+  * BW -> SGI -> #streams
+  */
+ const struct mcs_group minstrel_mcs_groups[] = {
+-	MCS_GROUP(1, 0, BW_20),
+-	MCS_GROUP(2, 0, BW_20),
+-	MCS_GROUP(3, 0, BW_20),
+-
+-	MCS_GROUP(1, 1, BW_20),
+-	MCS_GROUP(2, 1, BW_20),
+-	MCS_GROUP(3, 1, BW_20),
+-
+-	MCS_GROUP(1, 0, BW_40),
+-	MCS_GROUP(2, 0, BW_40),
+-	MCS_GROUP(3, 0, BW_40),
+-
+-	MCS_GROUP(1, 1, BW_40),
+-	MCS_GROUP(2, 1, BW_40),
+-	MCS_GROUP(3, 1, BW_40),
+-
+-	CCK_GROUP,
+-
+-	VHT_GROUP(1, 0, BW_20),
+-	VHT_GROUP(2, 0, BW_20),
+-	VHT_GROUP(3, 0, BW_20),
+-
+-	VHT_GROUP(1, 1, BW_20),
+-	VHT_GROUP(2, 1, BW_20),
+-	VHT_GROUP(3, 1, BW_20),
+-
+-	VHT_GROUP(1, 0, BW_40),
+-	VHT_GROUP(2, 0, BW_40),
+-	VHT_GROUP(3, 0, BW_40),
+-
+-	VHT_GROUP(1, 1, BW_40),
+-	VHT_GROUP(2, 1, BW_40),
+-	VHT_GROUP(3, 1, BW_40),
+-
+-	VHT_GROUP(1, 0, BW_80),
+-	VHT_GROUP(2, 0, BW_80),
+-	VHT_GROUP(3, 0, BW_80),
+-
+-	VHT_GROUP(1, 1, BW_80),
+-	VHT_GROUP(2, 1, BW_80),
+-	VHT_GROUP(3, 1, BW_80),
++	MCS_GROUP(1, 0, BW_20, 5),
++	MCS_GROUP(2, 0, BW_20, 4),
++	MCS_GROUP(3, 0, BW_20, 4),
++
++	MCS_GROUP(1, 1, BW_20, 5),
++	MCS_GROUP(2, 1, BW_20, 4),
++	MCS_GROUP(3, 1, BW_20, 4),
++
++	MCS_GROUP(1, 0, BW_40, 4),
++	MCS_GROUP(2, 0, BW_40, 4),
++	MCS_GROUP(3, 0, BW_40, 4),
++
++	MCS_GROUP(1, 1, BW_40, 4),
++	MCS_GROUP(2, 1, BW_40, 4),
++	MCS_GROUP(3, 1, BW_40, 4),
++
++	CCK_GROUP(8),
++
++	VHT_GROUP(1, 0, BW_20, 5),
++	VHT_GROUP(2, 0, BW_20, 4),
++	VHT_GROUP(3, 0, BW_20, 4),
++
++	VHT_GROUP(1, 1, BW_20, 5),
++	VHT_GROUP(2, 1, BW_20, 4),
++	VHT_GROUP(3, 1, BW_20, 4),
++
++	VHT_GROUP(1, 0, BW_40, 4),
++	VHT_GROUP(2, 0, BW_40, 4),
++	VHT_GROUP(3, 0, BW_40, 4),
++
++	VHT_GROUP(1, 1, BW_40, 4),
++	VHT_GROUP(2, 1, BW_40, 4),
++	VHT_GROUP(3, 1, BW_40, 4),
++
++	VHT_GROUP(1, 0, BW_80, 4),
++	VHT_GROUP(2, 0, BW_80, 4),
++	VHT_GROUP(3, 0, BW_80, 4),
++
++	VHT_GROUP(1, 1, BW_80, 4),
++	VHT_GROUP(2, 1, BW_80, 4),
++	VHT_GROUP(3, 1, BW_80, 4),
+ };
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
+@@ -307,7 +310,8 @@ minstrel_ht_get_tp_avg(struct minstrel_h
+ 	if (group != MINSTREL_CCK_GROUP)
+ 		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+ 
+-	nsecs += minstrel_mcs_groups[group].duration[rate];
++	nsecs += minstrel_mcs_groups[group].duration[rate] <<
++		 minstrel_mcs_groups[group].shift;
+ 
+ 	/*
+ 	 * For the throughput calculation, limit the probability value to 90% to
+@@ -755,12 +759,19 @@ minstrel_ht_tx_status(void *priv, struct
+ 		minstrel_ht_update_rates(mp, mi);
+ }
+ 
++static inline int
++minstrel_get_duration(int index)
++{
++	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
++	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
++	return duration << group->shift;
++}
++
+ static void
+ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                          int index)
+ {
+ 	struct minstrel_rate_stats *mrs;
+-	const struct mcs_group *group;
+ 	unsigned int tx_time, tx_time_rtscts, tx_time_data;
+ 	unsigned int cw = mp->cw_min;
+ 	unsigned int ctime = 0;
+@@ -779,8 +790,7 @@ minstrel_calc_retransmit(struct minstrel
+ 	mrs->retry_count_rtscts = 2;
+ 	mrs->retry_updated = true;
+ 
+-	group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+-	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len / 1000;
++	tx_time_data = minstrel_get_duration(index) * ampdu_len / 1000;
+ 
+ 	/* Contention time for first 2 tries */
+ 	ctime = (t_slot * cw) >> 1;
+@@ -874,20 +884,24 @@ minstrel_ht_get_max_amsdu_len(struct min
+ 	int group = mi->max_prob_rate / MCS_GROUP_RATES;
+ 	const struct mcs_group *g = &minstrel_mcs_groups[group];
+ 	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
++	unsigned int duration;
+ 
+ 	/* Disable A-MSDU if max_prob_rate is bad */
+ 	if (mi->groups[group].rates[rate].prob_ewma < MINSTREL_FRAC(50, 100))
+ 		return 1;
+ 
++	duration = g->duration[rate];
++	duration <<= g->shift;
++
+ 	/* If the rate is slower than single-stream MCS1, make A-MSDU limit small */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 52))
++	if (duration > MCS_DURATION(1, 0, 52))
+ 		return 500;
+ 
+ 	/*
+ 	 * If the rate is slower than single-stream MCS4, limit A-MSDU to usual
+ 	 * data packet size
+ 	 */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 104))
++	if (duration > MCS_DURATION(1, 0, 104))
+ 		return 1600;
+ 
+ 	/*
+@@ -895,7 +909,7 @@ minstrel_ht_get_max_amsdu_len(struct min
+ 	 * rate success probability is less than 75%, limit A-MSDU to twice the usual
+ 	 * data packet size
+ 	 */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 260) ||
++	if (duration > MCS_DURATION(1, 0, 260) ||
+ 	    (minstrel_ht_get_prob_ewma(mi, mi->max_tp_rate[0]) <
+ 	     MINSTREL_FRAC(75, 100)))
+ 		return 3200;
+@@ -942,13 +956,6 @@ minstrel_ht_update_rates(struct minstrel
+ 	rate_control_set_rates(mp->hw, mi->sta, rates);
+ }
+ 
+-static inline int
+-minstrel_get_duration(int index)
+-{
+-	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+-	return group->duration[index % MCS_GROUP_RATES];
+-}
+-
+ static int
+ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+ {
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -33,9 +33,10 @@
+ #define MCS_GROUP_RATES		10
+ 
+ struct mcs_group {
+-	u32 flags;
+-	unsigned int streams;
+-	unsigned int duration[MCS_GROUP_RATES];
++	u16 flags;
++	u8 streams;
++	u8 shift;
++	u16 duration[MCS_GROUP_RATES];
+ };
+ 
+ extern const struct mcs_group minstrel_mcs_groups[];
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -58,6 +58,7 @@ minstrel_ht_stats_dump(struct minstrel_h
+ 		static const int bitrates[4] = { 10, 20, 55, 110 };
+ 		int idx = i * MCS_GROUP_RATES + j;
+ 		unsigned int prob_ewmsd;
++		unsigned int duration;
+ 
+ 		if (!(mi->supported[i] & BIT(j)))
+ 			continue;
+@@ -95,7 +96,9 @@ minstrel_ht_stats_dump(struct minstrel_h
+ 		p += sprintf(p, "  %3u  ", idx);
+ 
+ 		/* tx_time[rate(i)] in usec */
+-		tx_time = DIV_ROUND_CLOSEST(mg->duration[j], 1000);
++		duration = mg->duration[j];
++		duration <<= mg->shift;
++		tx_time = DIV_ROUND_CLOSEST(duration, 1000);
+ 		p += sprintf(p, "%6u  ", tx_time);
+ 
+ 		tp_max = minstrel_ht_get_tp_avg(mi, i, j, MINSTREL_FRAC(100, 100));
+@@ -204,6 +207,7 @@ minstrel_ht_stats_csv_dump(struct minstr
+ 		static const int bitrates[4] = { 10, 20, 55, 110 };
+ 		int idx = i * MCS_GROUP_RATES + j;
+ 		unsigned int prob_ewmsd;
++		unsigned int duration;
+ 
+ 		if (!(mi->supported[i] & BIT(j)))
+ 			continue;
+@@ -238,7 +242,10 @@ minstrel_ht_stats_csv_dump(struct minstr
+ 		}
+ 
+ 		p += sprintf(p, "%u,", idx);
+-		tx_time = DIV_ROUND_CLOSEST(mg->duration[j], 1000);
++
++		duration = mg->duration[j];
++		duration <<= mg->shift;
++		tx_time = DIV_ROUND_CLOSEST(duration, 1000);
+ 		p += sprintf(p, "%u,", tx_time);
+ 
+ 		tp_max = minstrel_ht_get_tp_avg(mi, i, j, MINSTREL_FRAC(100, 100));
diff --git a/package/kernel/mac80211/patches/subsys/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch b/package/kernel/mac80211/patches/subsys/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
new file mode 100644
index 0000000000..6478e9ec5a
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
@@ -0,0 +1,33 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 13:43:07 +0100
+Subject: [PATCH] mac80211: minstrel: fix using short preamble CCK rates on
+ HT clients
+
+mi->supported[MINSTREL_CCK_GROUP] needs to be updated
+
+Fixes: 782dda00ab8e ("mac80211: minstrel_ht: move short preamble check out of get_rate")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+Index: backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/rc80211_minstrel_ht.c
++++ backports-v4.18-rc7/net/mac80211/rc80211_minstrel_ht.c
+@@ -1135,7 +1135,6 @@ minstrel_ht_update_caps(void *priv, stru
+ 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+ 	u16 ht_cap = sta->ht_cap.cap;
+ 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+-	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
+ 	int use_vht;
+ 	int n_supported = 0;
+ 	int ack_dur;
+@@ -1267,8 +1266,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	if (!n_supported)
+ 		goto use_legacy;
+ 
+-	if (test_sta_flag(sinfo, WLAN_STA_SHORT_PREAMBLE))
+-		mi->cck_supported_short |= mi->cck_supported_short << 4;
++	mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
+ 
+ 	/* create an initial rate table with the lowest supported rates */
+ 	minstrel_ht_update_stats(mp, mi);
diff --git a/package/kernel/mac80211/patches/subsys/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch b/package/kernel/mac80211/patches/subsys/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
new file mode 100644
index 0000000000..f0ffcd9655
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Mar 2018 13:27:54 +0100
+Subject: [PATCH] mac80211: minstrel: fix CCK rate group streams value
+
+Fixes a harmless underflow issue when CCK rates are actively being used
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -131,7 +131,7 @@
+ 
+ #define CCK_GROUP(_s)					\
+ 	[MINSTREL_CCK_GROUP] = {			\
+-		.streams = 0,				\
++		.streams = 1,				\
+ 		.flags = 0,				\
+ 		.shift = _s,				\
+ 		.duration = {				\
diff --git a/package/kernel/mac80211/patches/subsys/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch b/package/kernel/mac80211/patches/subsys/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
new file mode 100644
index 0000000000..e0049c36eb
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Mar 2018 13:28:48 +0100
+Subject: [PATCH] mac80211: minstrel: fix sampling/reporting of CCK rates
+ in HT mode
+
+Long/short preamble selection cannot be sampled separately, since it
+depends on the BSS state. Because of that, sampling attempts to
+currently not used preamble modes are not counted in the statistics,
+which leads to CCK rates being sampled too often.
+
+Fix statistics accounting for long/short preamble by increasing the
+index where necessary.
+Fix excessive CCK rate sampling by dropping unsupported sample attempts.
+
+This improves throughput on 2.4 GHz channels
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -281,7 +281,8 @@ minstrel_ht_get_stats(struct minstrel_pr
+ 				break;
+ 
+ 		/* short preamble */
+-		if (!(mi->supported[group] & BIT(idx)))
++		if ((mi->supported[group] & BIT(idx + 4)) &&
++		    (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
+ 			idx += 4;
+ 	}
+ 	return &mi->groups[group].rates[idx];
+@@ -1080,18 +1081,23 @@ minstrel_ht_get_rate(void *priv, struct
+ 		return;
+ 
+ 	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++	sample_idx %= MCS_GROUP_RATES;
++
++	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
++	    (sample_idx >= 4) != txrc->short_preamble)
++		return;
++
+ 	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ 	rate->count = 1;
+ 
+-	if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
++	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
+ 		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+ 		rate->idx = mp->cck_rates[idx];
+ 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
+ 		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
+ 				       sample_group->streams);
+ 	} else {
+-		rate->idx = sample_idx % MCS_GROUP_RATES +
+-			    (sample_group->streams - 1) * 8;
++		rate->idx = sample_idx + (sample_group->streams - 1) * 8;
+ 	}
+ 
+ 	rate->flags = sample_group->flags;
diff --git a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
new file mode 100644
index 0000000000..414cb137de
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
@@ -0,0 +1,40 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 3 Mar 2018 18:48:58 +0100
+Subject: [PATCH] mac80211: minstrel: do not sample rates 3 times slower than
+ max_prob_rate
+
+These rates are highly unlikely to be used quickly, even if the link
+deteriorates rapidly. This improves throughput in cases where CCK rates
+are not reliable enough to be skipped entirely during sampling.
+Sampling these rates regularly can cost a lot of airtime.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1004,10 +1004,13 @@ minstrel_get_sample_rate(struct minstrel
+ 		return -1;
+ 
+ 	/*
+-	 * Do not sample if the probability is already higher than 95%
+-	 * to avoid wasting airtime.
++	 * Do not sample if the probability is already higher than 95%,
++	 * or if the rate is 3 times slower than the current max probability
++	 * rate, to avoid wasting airtime.
+ 	 */
+-	if (mrs->prob_ewma > MINSTREL_FRAC(95, 100))
++	sample_dur = minstrel_get_duration(sample_idx);
++	if (mrs->prob_ewma > MINSTREL_FRAC(95, 100) ||
++	    minstrel_get_duration(mi->max_prob_rate) * 3 < sample_dur)
+ 		return -1;
+ 
+ 	/*
+@@ -1017,7 +1020,6 @@ minstrel_get_sample_rate(struct minstrel
+ 
+ 	cur_max_tp_streams = minstrel_mcs_groups[tp_rate1 /
+ 		MCS_GROUP_RATES].streams;
+-	sample_dur = minstrel_get_duration(sample_idx);
+ 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
+ 	    (cur_max_tp_streams - 1 <
+ 	     minstrel_mcs_groups[sample_group].streams ||
diff --git a/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
new file mode 100644
index 0000000000..c64457a17f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Mar 2018 21:00:56 +0100
+Subject: [PATCH] mac80211: fix memory accounting with A-MSDU aggregation
+
+fq uses skb->truesize for memory usage tracking. Increments/decrements
+are done on enqueue/dequeue.
+When A-MSDU aggregation is performed on tx side, the packet is
+aggregated with the last packet in the queue belonging to the same flow.
+There are multiple bugs here:
+- The truesize field of the aggregated packet isn't updated, so memory
+usage is underestimated
+- fq->memory_usage isn't adjusted.
+
+Because of the combination of both bugs, this only causes tx issues in
+rare cases, mainly when the A-MSDU head needs to be reallocated.
+
+Fix this by adjusting both truesize of the A-MSDU head and adding the
+truesize delta to fq->memory_usage.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3171,6 +3171,7 @@ static bool ieee80211_amsdu_aggregate(st
+ 	u8 max_subframes = sta->sta.max_amsdu_subframes;
+ 	int max_frags = local->hw.max_tx_fragments;
+ 	int max_amsdu_len = sta->sta.max_amsdu_len;
++	int orig_truesize;
+ 	__be16 len;
+ 	void *data;
+ 	bool ret = false;
+@@ -3201,12 +3202,13 @@ static bool ieee80211_amsdu_aggregate(st
+ 	flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
+ 	head = skb_peek_tail(&flow->queue);
+ 	if (!head)
+-		goto out;
++		goto unlock;
+ 
++	orig_truesize = head->truesize;
+ 	orig_len = head->len;
+ 
+ 	if (skb->len + head->len > max_amsdu_len)
+-		goto out;
++		goto unlock;
+ 
+ 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+ 		goto out;
+@@ -3249,6 +3251,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	fq_recalc_backlog(fq, tin, flow);
+ 
+ out:
++	fq->memory_usage += head->truesize - orig_truesize;
++
++unlock:
+ 	spin_unlock_bh(&fq->lock);
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/subsys/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch b/package/kernel/mac80211/patches/subsys/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
new file mode 100644
index 0000000000..37323c1f7d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
@@ -0,0 +1,42 @@
+From 4f717a2589be649afddbbd3ac58b67ebfa7426f7 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Wed, 6 Jun 2018 10:18:31 +0200
+Subject: [PATCH v2] cfg80211: initialize sinfo in cfg80211_get_station
+
+Most of the implementations behind cfg80211_get_station will not initialize
+sinfo to zero before manipulating it. For example, the member "filled",
+which indicates the filled in parts of this struct, is often only modified
+by enabling certain bits in the bitfield while keeping the remaining bits
+in their original state. A caller without a preinitialized sinfo.filled can
+then no longer decide which parts of sinfo were filled in by
+cfg80211_get_station (or actually the underlying implementations).
+
+cfg80211_get_station must therefore take care that sinfo is initialized to
+zero. Otherwise, the caller may tries to read information which was not
+filled in and which must therefore also be considered uninitialized. In
+batadv_v_elp_get_throughput's case, an invalid "random" expected throughput
+may be stored for this neighbor and thus the B.A.T.M.A.N V algorithm may
+switch to non-optimal neighbors for certain destinations.
+
+Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
+Reported-by: Thomas Lauer <holminateur@gmail.com>
+Reported-by: Marcel Schmidt <ff.z-casparistrasse@mailbox.org>
+Cc: b.a.t.m.a.n@lists.open-mesh.org
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+
+Forwarded: https://patchwork.kernel.org/patch/10449857/
+---
+ net/wireless/util.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1749,6 +1749,8 @@ int cfg80211_get_station(struct net_devi
+ 	if (!rdev->ops->get_station)
+ 		return -EOPNOTSUPP;
+ 
++	memset(sinfo, 0, sizeof(*sinfo));
++
+ 	return rdev_get_station(rdev, dev, mac_addr, sinfo);
+ }
+ EXPORT_SYMBOL(cfg80211_get_station);
diff --git a/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
new file mode 100644
index 0000000000..3546b1d439
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
@@ -0,0 +1,174 @@
+Index: backports-v4.18-rc7/include/net/cfg80211.h
+===================================================================
+--- backports-v4.18-rc7.orig/include/net/cfg80211.h
++++ backports-v4.18-rc7/include/net/cfg80211.h
+@@ -2857,6 +2857,7 @@ struct cfg80211_external_auth_params {
+  *	(as advertised by the nl80211 feature flag.)
+  * @get_tx_power: store the current TX power into the dbm variable;
+  *	return 0 if successful
++ * @set_antenna_gain: set antenna gain to reduce maximum tx power if necessary
+  *
+  * @set_wds_peer: set the WDS peer for a WDS interface
+  *
+@@ -3157,6 +3158,7 @@ struct cfg80211_ops {
+ 				enum nl80211_tx_power_setting type, int mbm);
+ 	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 				int *dbm);
++	int	(*set_antenna_gain)(struct wiphy *wiphy, int dbi);
+ 
+ 	int	(*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
+ 				const u8 *addr);
+Index: backports-v4.18-rc7/include/net/mac80211.h
+===================================================================
+--- backports-v4.18-rc7.orig/include/net/mac80211.h
++++ backports-v4.18-rc7/include/net/mac80211.h
+@@ -1348,6 +1348,7 @@ enum ieee80211_smps_mode {
+  *
+  * @power_level: requested transmit power (in dBm), backward compatibility
+  *	value only that is set to the minimum of all interfaces
++ * @max_antenna_gain: maximum antenna gain adjusted by user config (in dBi)
+  *
+  * @chandef: the channel definition to tune to
+  * @radar_enabled: whether radar detection is enabled
+@@ -1368,6 +1369,7 @@ enum ieee80211_smps_mode {
+ struct ieee80211_conf {
+ 	u32 flags;
+ 	int power_level, dynamic_ps_timeout;
++	int max_antenna_gain;
+ 
+ 	u16 listen_interval;
+ 	u8 ps_dtim_period;
+Index: backports-v4.18-rc7/include/uapi/linux/nl80211.h
+===================================================================
+--- backports-v4.18-rc7.orig/include/uapi/linux/nl80211.h
++++ backports-v4.18-rc7/include/uapi/linux/nl80211.h
+@@ -2238,6 +2238,9 @@ enum nl80211_commands {
+  * @NL80211_ATTR_TXQ_QUANTUM: TXQ scheduler quantum (bytes). Number of bytes
+  *      a flow is assigned on each round of the DRR scheduler.
+  *
++ * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
++ *	transmit power to stay within regulatory limits. u32, dBi.
++ *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -2677,6 +2680,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_TXQ_MEMORY_LIMIT,
+ 	NL80211_ATTR_TXQ_QUANTUM,
+ 
++	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+Index: backports-v4.18-rc7/net/mac80211/cfg.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/cfg.c
++++ backports-v4.18-rc7/net/mac80211/cfg.c
+@@ -2489,6 +2489,19 @@ static int ieee80211_get_tx_power(struct
+ 	return 0;
+ }
+ 
++static int ieee80211_set_antenna_gain(struct wiphy *wiphy, int dbi)
++{
++	struct ieee80211_local *local = wiphy_priv(wiphy);
++
++	if (dbi < 0)
++		return -EINVAL;
++
++	local->user_antenna_gain = dbi;
++	ieee80211_hw_config(local, 0);
++
++	return 0;
++}
++
+ static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
+ 				  const u8 *addr)
+ {
+@@ -3856,6 +3869,7 @@ const struct cfg80211_ops mac80211_confi
+ 	.set_wiphy_params = ieee80211_set_wiphy_params,
+ 	.set_tx_power = ieee80211_set_tx_power,
+ 	.get_tx_power = ieee80211_get_tx_power,
++	.set_antenna_gain = ieee80211_set_antenna_gain,
+ 	.set_wds_peer = ieee80211_set_wds_peer,
+ 	.rfkill_poll = ieee80211_rfkill_poll,
+ 	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+Index: backports-v4.18-rc7/net/mac80211/ieee80211_i.h
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/ieee80211_i.h
++++ backports-v4.18-rc7/net/mac80211/ieee80211_i.h
+@@ -1350,6 +1350,7 @@ struct ieee80211_local {
+ 	int dynamic_ps_forced_timeout;
+ 
+ 	int user_power_level; /* in dBm, for all interfaces */
++	int user_antenna_gain; /* in dBi */
+ 
+ 	enum ieee80211_smps_mode smps_mode;
+ 
+Index: backports-v4.18-rc7/net/mac80211/main.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/mac80211/main.c
++++ backports-v4.18-rc7/net/mac80211/main.c
+@@ -93,7 +93,7 @@ static u32 ieee80211_hw_conf_chan(struct
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct cfg80211_chan_def chandef = {};
+ 	u32 changed = 0;
+-	int power;
++	int power, max_power;
+ 	u32 offchannel_flag;
+ 
+ 	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+@@ -150,6 +150,12 @@ static u32 ieee80211_hw_conf_chan(struct
+ 	}
+ 	rcu_read_unlock();
+ 
++	max_power = chandef.chan->max_reg_power;
++	if (local->user_antenna_gain > 0) {
++		max_power -= local->user_antenna_gain;
++		power = min(power, max_power);
++	}
++
+ 	if (local->hw.conf.power_level != power) {
+ 		changed |= IEEE80211_CONF_CHANGE_POWER;
+ 		local->hw.conf.power_level = power;
+@@ -611,6 +617,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
+ 	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+ 					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
++	local->user_antenna_gain = 0;
+ 	local->hw.uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+ 	local->hw.uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
+ 	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
+Index: backports-v4.18-rc7/net/wireless/nl80211.c
+===================================================================
+--- backports-v4.18-rc7.orig/net/wireless/nl80211.c
++++ backports-v4.18-rc7/net/wireless/nl80211.c
+@@ -428,6 +428,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
++	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
+ };
+ 
+ /* policy for the key attributes */
+@@ -2531,6 +2532,20 @@ static int nl80211_set_wiphy(struct sk_b
+ 		if (result)
+ 			return result;
+ 	}
++
++	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_GAIN]) {
++		int idx, dbi = 0;
++
++		if (!rdev->ops->set_antenna_gain)
++			return -EOPNOTSUPP;
++
++		idx = NL80211_ATTR_WIPHY_ANTENNA_GAIN;
++		dbi = nla_get_u32(info->attrs[idx]);
++
++		result = rdev->ops->set_antenna_gain(&rdev->wiphy, dbi);
++		if (result)
++			return result;
++	}
+ 
+ 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
+ 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {