mac80211: update to wireless-testing 2013-04-16 + backports

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36448

67 files changed, 3703 insertions, 3750 deletions

diff --git a/package/mac80211/Makefile b/package/mac80211/Makefile
index 6d5ca07745..f950862e7e 100644
--- a/package/mac80211/Makefile
+++ b/package/mac80211/Makefile
@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2013-02-22
+PKG_VERSION:=2013-04-16
 PKG_RELEASE:=1
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
-PKG_MD5SUM:=de1a03ca1f72748d4523672c8facbf7e
+PKG_MD5SUM:=ec4cd40f0a8838aeea2ccff3ec5deb1a
 
 PKG_SOURCE:=compat-wireless-$(PKG_VERSION).tar.bz2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
@@ -212,7 +212,7 @@ $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-lib-crc-itu-t
   TITLE+= (LIB)
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00lib.ko
-  AUTOLOAD:=$(call AutoLoad,25,rt2x00lib)
+  AUTOLOAD:=$(call AutoLoad,24,rt2x00lib)
   MENU:=1
 endef
 
@@ -239,8 +239,10 @@ define KernelPackage/rt2x00-pci
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
   TITLE+= (PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.ko
-  AUTOLOAD:=$(call AutoLoad,26,rt2x00pci)
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00mmio.ko
+  AUTOLOAD:=$(call AutoLoad,25,rt2x00mmio rt2x00pci)
 endef
 
 define KernelPackage/rt2x00-usb
@@ -1269,6 +1271,7 @@ MAKE_OPTS:= \
 	CONFIG_P54_SPI_DEFAULT_EEPROM=n \
 	CONFIG_RT2X00=$(if $(CONFIG_PACKAGE_kmod-rt2x00-lib),m) \
 	CONFIG_RT2X00_LIB=$(if $(CONFIG_PACKAGE_kmod-rt2x00-lib),m) \
+	CONFIG_RT2X00_LIB_MMIO=$(if $(CONFIG_PACKAGE_kmod-rt2x00-pci),m) \
 	CONFIG_RT2X00_LIB_PCI=$(if $(CONFIG_PACKAGE_kmod-rt2x00-pci),m) \
 	CONFIG_RT2X00_LIB_USB=$(if $(CONFIG_PACKAGE_kmod-rt2x00-usb),m) \
 	CONFIG_RT2X00_LIB_SOC=$(if $(CONFIG_PACKAGE_kmod-rt2x00-soc),m) \
@@ -1290,7 +1293,7 @@ MAKE_OPTS:= \
 	CONFIG_RTL8187=$(if $(CONFIG_PACKAGE_kmod-rtl8187),m) \
 	CONFIG_RTL8192CE= \
 	CONFIG_RTLWIFI= \
-	CONFIG_MAC80211_HWSIM=$(if $(CONFIG_PACKAGE_kmod-mac80211-hwsim),m) \
+	CONFIG_COMPAT_MAC80211_HWSIM=$(if $(CONFIG_PACKAGE_kmod-mac80211-hwsim),m) \
 	CONFIG_PCMCIA= \
 	CONFIG_LIBIPW=$(if $(CONFIG_PACKAGE_kmod-net-libipw),m) \
 	CONFIG_LIBERTAS=$(if $(CONFIG_PACKAGE_kmod-libertas-sd)$(CONFIG_PACKAGE_kmod-libertas-usb),m) \
diff --git a/package/mac80211/patches/000-disable_drivers.patch b/package/mac80211/patches/000-disable_drivers.patch
new file mode 100644
index 0000000000..7c5944280c
--- /dev/null
+++ b/package/mac80211/patches/000-disable_drivers.patch
@@ -0,0 +1,37 @@
+--- a/config.mk
++++ b/config.mk
+@@ -724,34 +724,3 @@ endif #CONFIG_LEDS_TRIGGERS
+ # export CONFIG_RFKILL_BACKPORT_INPUT=y
+ endif #CONFIG_COMPAT_KERNEL_2_6_31
+ 
+-# compilation has been tested down to 3.0 but run time
+-# tests have only started on 3.2.
+-ifndef CONFIG_COMPAT_KERNEL_3_2
+-# Basic DRM support
+-export CONFIG_COMPAT_VIDEO_MODULES=y
+-export CONFIG_COMPAT_DRM=m
+-export CONFIG_COMPAT_DRM_TTM=m
+-export CONFIG_COMPAT_DRM_KMS_HELPER=m
+-export CONFIG_COMPAT_DRM_LOAD_EDID_FIRMWARE=y
+-# Intel i915
+-export CONFIG_COMPAT_DRM_I915=m
+-# ATI/AMD Radeon
+-export CONFIG_COMPAT_DRM_RADEON=m
+-export CONFIG_COMPAT_DRM_RADEON_KMS=y
+-export CONFIG_COMPAT_DRM_NOUVEAU=m
+-export CONFIG_COMPAT_DRM_NOUVEAU_BACKLIGHT=y
+-export CONFIG_COMPAT_NOUVEAU_DEBUG=5
+-export CONFIG_COMPAT_NOUVEAU_DEBUG_DEFAULT=3
+-ifdef CONFIG_MEDIA_CONTROLLER
+-export CONFIG_COMPAT_USB_VIDEO_CLASS=m
+-endif #CONFIG_MEDIA_CONTROLLER
+-export CONFIG_USB_VIDEO_CLASS=y
+-endif #CONFIG_COMPAT_KERNEL_3_2
+-
+-ifndef CONFIG_COMPAT_KERNEL_3_2
+-export CONFIG_COMPAT_MEDIA_MODULES=y
+-export CONFIG_COMPAT_VIDEO_V4L2=m
+-export CONFIG_COMPAT_VIDEOBUF2_CORE=m
+-export CONFIG_COMPAT_VIDEOBUF2_VMALLOC=m
+-export CONFIG_COMPAT_VIDEOBUF2_MEMOPS=m
+-endif #CONFIG_COMPAT_KERNEL_3_2
diff --git a/package/mac80211/patches/002-disable_ssb_build.patch b/package/mac80211/patches/002-disable_ssb_build.patch
index ef184c416a..d6a7099bfd 100644
--- a/package/mac80211/patches/002-disable_ssb_build.patch
+++ b/package/mac80211/patches/002-disable_ssb_build.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -364,7 +364,8 @@ export CONFIG_IPW2200_QOS=y
+@@ -371,7 +371,8 @@ export CONFIG_IPW2200_QOS=y
  # % echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface
  endif #CONFIG_WIRELESS_EXT
  
@@ -10,7 +10,7 @@
  # Sonics Silicon Backplane
  export CONFIG_SSB_SPROM=y
  
-@@ -377,7 +378,7 @@ endif #CONFIG_PCMCIA
+@@ -384,7 +385,7 @@ endif #CONFIG_PCMCIA
  # export CONFIG_SSB_DEBUG=y
  export CONFIG_SSB_DRIVER_PCICORE=y
  export CONFIG_B43_SSB=y
diff --git a/package/mac80211/patches/010-add_include_for_bcma.patch b/package/mac80211/patches/010-add_include_for_bcma.patch
index e2e856eb05..6c9b4967d6 100644
--- a/package/mac80211/patches/010-add_include_for_bcma.patch
+++ b/package/mac80211/patches/010-add_include_for_bcma.patch
@@ -1,6 +1,6 @@
 --- a/include/linux/compat-3.0.h
 +++ b/include/linux/compat-3.0.h
-@@ -36,6 +36,8 @@ static inline struct page *shmem_read_ma
+@@ -38,6 +38,8 @@ static inline struct page *shmem_read_ma
  #endif
  
  
diff --git a/package/mac80211/patches/030-wext.patch b/package/mac80211/patches/030-wext.patch
index cb52e7ccb3..dbd7a09202 100644
--- a/package/mac80211/patches/030-wext.patch
+++ b/package/mac80211/patches/030-wext.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -884,6 +884,15 @@ static int cfg80211_netdev_notifier_call
+@@ -951,6 +951,15 @@ static int cfg80211_netdev_notifier_call
  		wdev->sme_state = CFG80211_SME_IDLE;
  		mutex_unlock(&rdev->devlist_mtx);
  #ifdef CONFIG_CFG80211_WEXT
diff --git a/package/mac80211/patches/040-linux_3_9_compat.patch b/package/mac80211/patches/040-linux_3_9_compat.patch
deleted file mode 100644
index d83c39c06f..0000000000
--- a/package/mac80211/patches/040-linux_3_9_compat.patch
+++ /dev/null
@@ -1,153 +0,0 @@
---- a/include/linux/compat-2.6.h
-+++ b/include/linux/compat-2.6.h
-@@ -69,6 +69,7 @@ void compat_dependency_symbol(void);
- #include <linux/compat-3.6.h>
- #include <linux/compat-3.7.h>
- #include <linux/compat-3.8.h>
-+#include <linux/compat-3.9.h>
- 
- #endif /* __ASSEMBLY__ */
- 
---- /dev/null
-+++ b/include/linux/compat-3.9.h
-@@ -0,0 +1,140 @@
-+#ifndef LINUX_3_9_COMPAT_H
-+#define LINUX_3_9_COMPAT_H
-+
-+#include <linux/version.h>
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0))
-+
-+#include <linux/idr.h>
-+#include <linux/list.h>
-+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25))
-+#include <linux/rculist.h>
-+#endif
-+#include <net/sock.h>
-+#include <linux/tty.h>
-+#include <linux/tty_flip.h>
-+
-+/* include this before changing hlist_for_each_* to use the old versions. */
-+#include <net/sch_generic.h>
-+
-+
-+/**
-+ * backport of idr idr_alloc() usage
-+ * 
-+ * This backports a patch series send by Tejun Heo:
-+ * https://lkml.org/lkml/2013/2/2/159
-+ */
-+static inline void compat_idr_destroy(struct idr *idp)
-+{
-+	idr_remove_all(idp);
-+	idr_destroy(idp);
-+}
-+#define idr_destroy(idp) compat_idr_destroy(idp)
-+
-+static inline int idr_alloc(struct idr *idr, void *ptr, int start, int end,
-+			    gfp_t gfp_mask)
-+{
-+	int id, ret;
-+
-+	do {
-+		if (!idr_pre_get(idr, gfp_mask))
-+			return -ENOMEM;
-+		ret = idr_get_new_above(idr, ptr, start, &id);
-+		if (!ret && id > end) {
-+			idr_remove(idr, id);
-+			ret = -ENOSPC;
-+		}
-+	} while (ret == -EAGAIN);
-+
-+	return ret ? ret : id;
-+}
-+
-+static inline void idr_preload(gfp_t gfp_mask)
-+{
-+}
-+
-+static inline void idr_preload_end(void)
-+{
-+}
-+
-+
-+/**
-+ * backport:
-+ *
-+ * commit 0bbacca7c3911451cea923b0ad6389d58e3d9ce9
-+ * Author: Sasha Levin <sasha.levin@oracle.com>
-+ * Date:   Thu Feb 7 12:32:18 2013 +1100
-+ *
-+ *     hlist: drop the node parameter from iterators
-+ */
-+
-+#define hlist_entry_safe(ptr, type, member) \
-+	(ptr) ? hlist_entry(ptr, type, member) : NULL
-+
-+#undef hlist_for_each_entry
-+/**
-+ * hlist_for_each_entry	- iterate over list of given type
-+ * @pos:	the type * to use as a loop cursor.
-+ * @head:	the head for your list.
-+ * @member:	the name of the hlist_node within the struct.
-+ */
-+#define hlist_for_each_entry(pos, head, member)					\
-+	for (pos = hlist_entry_safe((head)->first, typeof(*(pos)), member);	\
-+	     pos;								\
-+	     pos = hlist_entry_safe((pos)->member.next, typeof(*(pos)), member))
-+
-+#undef hlist_for_each_entry_safe
-+/**
-+ * hlist_for_each_entry_safe - iterate over list of given type safe against removal of list entry
-+ * @pos:	the type * to use as a loop cursor.
-+ * @n:		another &struct hlist_node to use as temporary storage
-+ * @head:	the head for your list.
-+ * @member:	the name of the hlist_node within the struct.
-+ */
-+#define hlist_for_each_entry_safe(pos, n, head, member) 			\
-+	for (pos = hlist_entry_safe((head)->first, typeof(*pos), member);	\
-+	     pos && ({ n = pos->member.next; 1; });				\
-+	     pos = hlist_entry_safe(n, typeof(*pos), member))
-+
-+#undef hlist_for_each_entry_rcu
-+/**
-+ * hlist_for_each_entry_rcu - iterate over rcu list of given type
-+ * @pos:	the type * to use as a loop cursor.
-+ * @head:	the head for your list.
-+ * @member:	the name of the hlist_node within the struct.
-+ *
-+ * This list-traversal primitive may safely run concurrently with
-+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
-+ * as long as the traversal is guarded by rcu_read_lock().
-+ */
-+#define hlist_for_each_entry_rcu(pos, head, member)				\
-+	for (pos = hlist_entry_safe (rcu_dereference_raw(hlist_first_rcu(head)),\
-+			typeof(*(pos)), member);				\
-+		pos;								\
-+		pos = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(	\
-+			&(pos)->member)), typeof(*(pos)), member))
-+
-+#undef sk_for_each
-+#define sk_for_each(__sk, list) \
-+	hlist_for_each_entry(__sk, list, sk_node)
-+
-+#define tty_flip_buffer_push(port) tty_flip_buffer_push((port)->tty)
-+#define tty_insert_flip_string(port, chars, size) tty_insert_flip_string((port)->tty, chars, size)
-+
-+/**
-+ * backport of:
-+ *
-+ * commit 496ad9aa8ef448058e36ca7a787c61f2e63f0f54
-+ * Author: Al Viro <viro@zeniv.linux.org.uk>
-+ * Date:   Wed Jan 23 17:07:38 2013 -0500
-+ *
-+ *     new helper: file_inode(file)
-+ */
-+static inline struct inode *file_inode(struct file *f)
-+{
-+	return f->f_path.dentry->d_inode;
-+}
-+
-+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)) */
-+
-+#endif /* LINUX_3_9_COMPAT_H */
diff --git a/package/mac80211/patches/130-mesh_pathtbl_backport.patch b/package/mac80211/patches/130-mesh_pathtbl_backport.patch
deleted file mode 100644
index 13220997f2..0000000000
--- a/package/mac80211/patches/130-mesh_pathtbl_backport.patch
+++ /dev/null
@@ -1,212 +0,0 @@
---- a/net/mac80211/mesh_pathtbl.c
-+++ b/net/mac80211/mesh_pathtbl.c
-@@ -72,9 +72,9 @@ static inline struct mesh_table *resize_
-  * it's used twice. So it is illegal to do
-  *	for_each_mesh_entry(rcu_dereference(...), ...)
-  */
--#define for_each_mesh_entry(tbl, p, node, i) \
-+#define for_each_mesh_entry(tbl, node, i) \
- 	for (i = 0; i <= tbl->hash_mask; i++) \
--		hlist_for_each_entry_rcu(node, p, &tbl->hash_buckets[i], list)
-+		hlist_for_each_entry_rcu(node, &tbl->hash_buckets[i], list)
- 
- 
- static struct mesh_table *mesh_table_alloc(int size_order)
-@@ -139,7 +139,7 @@ static void mesh_table_free(struct mesh_
- 	}
- 	if (free_leafs) {
- 		spin_lock_bh(&tbl->gates_lock);
--		hlist_for_each_entry_safe(gate, p, q,
-+		hlist_for_each_entry_safe(gate, q,
- 					 tbl->known_gates, list) {
- 			hlist_del(&gate->list);
- 			kfree(gate);
-@@ -333,12 +333,11 @@ static struct mesh_path *mpath_lookup(st
- 				      struct ieee80211_sub_if_data *sdata)
- {
- 	struct mesh_path *mpath;
--	struct hlist_node *n;
- 	struct hlist_head *bucket;
- 	struct mpath_node *node;
- 
- 	bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
--	hlist_for_each_entry_rcu(node, n, bucket, list) {
-+	hlist_for_each_entry_rcu(node, bucket, list) {
- 		mpath = node->mpath;
- 		if (mpath->sdata == sdata &&
- 		    ether_addr_equal(dst, mpath->dst)) {
-@@ -389,11 +388,10 @@ mesh_path_lookup_by_idx(struct ieee80211
- {
- 	struct mesh_table *tbl = rcu_dereference(mesh_paths);
- 	struct mpath_node *node;
--	struct hlist_node *p;
- 	int i;
- 	int j = 0;
- 
--	for_each_mesh_entry(tbl, p, node, i) {
-+	for_each_mesh_entry(tbl, node, i) {
- 		if (sdata && node->mpath->sdata != sdata)
- 			continue;
- 		if (j++ == idx) {
-@@ -417,13 +415,12 @@ int mesh_path_add_gate(struct mesh_path
- {
- 	struct mesh_table *tbl;
- 	struct mpath_node *gate, *new_gate;
--	struct hlist_node *n;
- 	int err;
- 
- 	rcu_read_lock();
- 	tbl = rcu_dereference(mesh_paths);
- 
--	hlist_for_each_entry_rcu(gate, n, tbl->known_gates, list)
-+	hlist_for_each_entry_rcu(gate, tbl->known_gates, list)
- 		if (gate->mpath == mpath) {
- 			err = -EEXIST;
- 			goto err_rcu;
-@@ -460,9 +457,9 @@ err_rcu:
- static void mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
- {
- 	struct mpath_node *gate;
--	struct hlist_node *p, *q;
-+	struct hlist_node *q;
- 
--	hlist_for_each_entry_safe(gate, p, q, tbl->known_gates, list) {
-+	hlist_for_each_entry_safe(gate, q, tbl->known_gates, list) {
- 		if (gate->mpath != mpath)
- 			continue;
- 		spin_lock_bh(&tbl->gates_lock);
-@@ -504,7 +501,6 @@ int mesh_path_add(struct ieee80211_sub_i
- 	struct mesh_path *mpath, *new_mpath;
- 	struct mpath_node *node, *new_node;
- 	struct hlist_head *bucket;
--	struct hlist_node *n;
- 	int grow = 0;
- 	int err = 0;
- 	u32 hash_idx;
-@@ -550,7 +546,7 @@ int mesh_path_add(struct ieee80211_sub_i
- 	spin_lock(&tbl->hashwlock[hash_idx]);
- 
- 	err = -EEXIST;
--	hlist_for_each_entry(node, n, bucket, list) {
-+	hlist_for_each_entry(node, bucket, list) {
- 		mpath = node->mpath;
- 		if (mpath->sdata == sdata &&
- 		    ether_addr_equal(dst, mpath->dst))
-@@ -640,7 +636,6 @@ int mpp_path_add(struct ieee80211_sub_if
- 	struct mesh_path *mpath, *new_mpath;
- 	struct mpath_node *node, *new_node;
- 	struct hlist_head *bucket;
--	struct hlist_node *n;
- 	int grow = 0;
- 	int err = 0;
- 	u32 hash_idx;
-@@ -680,7 +675,7 @@ int mpp_path_add(struct ieee80211_sub_if
- 	spin_lock(&tbl->hashwlock[hash_idx]);
- 
- 	err = -EEXIST;
--	hlist_for_each_entry(node, n, bucket, list) {
-+	hlist_for_each_entry(node, bucket, list) {
- 		mpath = node->mpath;
- 		if (mpath->sdata == sdata &&
- 		    ether_addr_equal(dst, mpath->dst))
-@@ -725,14 +720,13 @@ void mesh_plink_broken(struct sta_info *
- 	static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
- 	struct mesh_path *mpath;
- 	struct mpath_node *node;
--	struct hlist_node *p;
- 	struct ieee80211_sub_if_data *sdata = sta->sdata;
- 	int i;
- 	__le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_DEST_UNREACHABLE);
- 
- 	rcu_read_lock();
- 	tbl = rcu_dereference(mesh_paths);
--	for_each_mesh_entry(tbl, p, node, i) {
-+	for_each_mesh_entry(tbl, node, i) {
- 		mpath = node->mpath;
- 		if (rcu_dereference(mpath->next_hop) == sta &&
- 		    mpath->flags & MESH_PATH_ACTIVE &&
-@@ -792,13 +786,12 @@ void mesh_path_flush_by_nexthop(struct s
- 	struct mesh_table *tbl;
- 	struct mesh_path *mpath;
- 	struct mpath_node *node;
--	struct hlist_node *p;
- 	int i;
- 
- 	rcu_read_lock();
- 	read_lock_bh(&pathtbl_resize_lock);
- 	tbl = resize_dereference_mesh_paths();
--	for_each_mesh_entry(tbl, p, node, i) {
-+	for_each_mesh_entry(tbl, node, i) {
- 		mpath = node->mpath;
- 		if (rcu_dereference(mpath->next_hop) == sta) {
- 			spin_lock(&tbl->hashwlock[i]);
-@@ -815,11 +808,9 @@ static void table_flush_by_iface(struct
- {
- 	struct mesh_path *mpath;
- 	struct mpath_node *node;
--	struct hlist_node *p;
- 	int i;
- 
--	WARN_ON(!rcu_read_lock_held());
--	for_each_mesh_entry(tbl, p, node, i) {
-+	for_each_mesh_entry(tbl, node, i) {
- 		mpath = node->mpath;
- 		if (mpath->sdata != sdata)
- 			continue;
-@@ -865,7 +856,6 @@ int mesh_path_del(struct ieee80211_sub_i
- 	struct mesh_path *mpath;
- 	struct mpath_node *node;
- 	struct hlist_head *bucket;
--	struct hlist_node *n;
- 	int hash_idx;
- 	int err = 0;
- 
-@@ -875,7 +865,7 @@ int mesh_path_del(struct ieee80211_sub_i
- 	bucket = &tbl->hash_buckets[hash_idx];
- 
- 	spin_lock(&tbl->hashwlock[hash_idx]);
--	hlist_for_each_entry(node, n, bucket, list) {
-+	hlist_for_each_entry(node, bucket, list) {
- 		mpath = node->mpath;
- 		if (mpath->sdata == sdata &&
- 		    ether_addr_equal(addr, mpath->dst)) {
-@@ -920,7 +910,6 @@ void mesh_path_tx_pending(struct mesh_pa
- int mesh_path_send_to_gates(struct mesh_path *mpath)
- {
- 	struct ieee80211_sub_if_data *sdata = mpath->sdata;
--	struct hlist_node *n;
- 	struct mesh_table *tbl;
- 	struct mesh_path *from_mpath = mpath;
- 	struct mpath_node *gate = NULL;
-@@ -935,7 +924,7 @@ int mesh_path_send_to_gates(struct mesh_
- 	if (!known_gates)
- 		return -EHOSTUNREACH;
- 
--	hlist_for_each_entry_rcu(gate, n, known_gates, list) {
-+	hlist_for_each_entry_rcu(gate, known_gates, list) {
- 		if (gate->mpath->sdata != sdata)
- 			continue;
- 
-@@ -951,7 +940,7 @@ int mesh_path_send_to_gates(struct mesh_
- 		}
- 	}
- 
--	hlist_for_each_entry_rcu(gate, n, known_gates, list)
-+	hlist_for_each_entry_rcu(gate, known_gates, list)
- 		if (gate->mpath->sdata == sdata) {
- 			mpath_dbg(sdata, "Sending to %pM\n", gate->mpath->dst);
- 			mesh_path_tx_pending(gate->mpath);
-@@ -1096,12 +1085,11 @@ void mesh_path_expire(struct ieee80211_s
- 	struct mesh_table *tbl;
- 	struct mesh_path *mpath;
- 	struct mpath_node *node;
--	struct hlist_node *p;
- 	int i;
- 
- 	rcu_read_lock();
- 	tbl = rcu_dereference(mesh_paths);
--	for_each_mesh_entry(tbl, p, node, i) {
-+	for_each_mesh_entry(tbl, node, i) {
- 		if (node->mpath->sdata != sdata)
- 			continue;
- 		mpath = node->mpath;
diff --git a/package/mac80211/patches/150-disable_addr_notifier.patch b/package/mac80211/patches/150-disable_addr_notifier.patch
index 9714696ecc..92c1909981 100644
--- a/package/mac80211/patches/150-disable_addr_notifier.patch
+++ b/package/mac80211/patches/150-disable_addr_notifier.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -313,7 +313,7 @@ void ieee80211_restart_hw(struct ieee802
+@@ -300,7 +300,7 @@ void ieee80211_restart_hw(struct ieee802
  }
  EXPORT_SYMBOL(ieee80211_restart_hw);
  
@@ -9,7 +9,7 @@
  static int ieee80211_ifa_changed(struct notifier_block *nb,
  				 unsigned long data, void *arg)
  {
-@@ -372,7 +372,7 @@ static int ieee80211_ifa_changed(struct
+@@ -359,7 +359,7 @@ static int ieee80211_ifa_changed(struct 
  }
  #endif
  
@@ -18,7 +18,7 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1015,14 +1015,14 @@ int ieee80211_register_hw(struct ieee802
+@@ -990,14 +990,14 @@ int ieee80211_register_hw(struct ieee802
  		goto fail_pm_qos;
  	}
  
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1034,13 +1034,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1006,13 +1006,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -52,7 +52,7 @@
   fail_ifa:
  	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
  			       &local->network_latency_notifier);
-@@ -1073,10 +1073,10 @@ void ieee80211_unregister_hw(struct ieee
+@@ -1045,10 +1045,10 @@ void ieee80211_unregister_hw(struct ieee
  
  	pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
  			       &local->network_latency_notifier);
diff --git a/package/mac80211/patches/300-pending_work.patch b/package/mac80211/patches/300-pending_work.patch
index 37f127ede3..d47c6261ef 100644
--- a/package/mac80211/patches/300-pending_work.patch
+++ b/package/mac80211/patches/300-pending_work.patch
@@ -1,113 +1,796 @@
---- a/drivers/net/wireless/ath/ath9k/common.h
-+++ b/drivers/net/wireless/ath/ath9k/common.h
-@@ -27,7 +27,7 @@
- #define WME_MAX_BA              WME_BA_BMP_SIZE
- #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
- 
--#define ATH_RSSI_DUMMY_MARKER   0x127
-+#define ATH_RSSI_DUMMY_MARKER   127
- #define ATH_RSSI_LPF_LEN 		10
- #define RSSI_LPF_THRESHOLD		-20
- #define ATH_RSSI_EP_MULTIPLIER     (1<<7)
---- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-@@ -1067,15 +1067,19 @@ static bool ath9k_rx_prepare(struct ath9
- 
- 	last_rssi = priv->rx.last_rssi;
- 
--	if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
--		rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
--						     ATH_RSSI_EP_MULTIPLIER);
-+	if (ieee80211_is_beacon(hdr->frame_control) &&
-+	    !is_zero_ether_addr(common->curbssid) &&
-+	    ether_addr_equal(hdr->addr3, common->curbssid)) {
-+		s8 rssi = rxbuf->rxstatus.rs_rssi;
- 
--	if (rxbuf->rxstatus.rs_rssi < 0)
--		rxbuf->rxstatus.rs_rssi = 0;
-+		if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-+			rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
- 
--	if (ieee80211_is_beacon(fc))
--		priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
-+		if (rssi < 0)
-+			rssi = 0;
-+
-+		priv->ah->stats.avgbrssi = rssi;
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -234,6 +234,7 @@ struct ath_buf {
+ 	dma_addr_t bf_daddr;		/* physical addr of desc */
+ 	dma_addr_t bf_buf_addr;	/* physical addr of data buffer, for DMA */
+ 	bool bf_stale;
++	struct ieee80211_tx_rate rates[4];
+ 	struct ath_buf_state bf_state;
+ };
+ 
+@@ -658,11 +659,10 @@ enum sc_op_flags {
+ struct ath_rate_table;
+ 
+ struct ath9k_vif_iter_data {
+-	const u8 *hw_macaddr; /* phy's hardware address, set
+-			       * before starting iteration for
+-			       * valid bssid mask.
+-			       */
++	u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
+ 	u8 mask[ETH_ALEN]; /* bssid mask */
++	bool has_hw_macaddr;
++
+ 	int naps;      /* number of AP vifs */
+ 	int nmeshes;   /* number of mesh vifs */
+ 	int nstations; /* number of station vifs */
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1698,12 +1698,11 @@ static void ath9k_hw_reset_opmode(struct
+ 
+ 	ENABLE_REGWRITE_BUFFER(ah);
+ 
+-	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
+-	REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
+-		  | macStaId1
++	REG_RMW(ah, AR_STA_ID1, macStaId1
+ 		  | AR_STA_ID1_RTS_USE_DEF
+ 		  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
+-		  | ah->sta_id1_defaults);
++		  | ah->sta_id1_defaults,
++		  ~AR_STA_ID1_SADH_MASK);
+ 	ath_hw_setbssidmask(common);
+ 	REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
+ 	ath9k_hw_write_associd(ah);
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -839,10 +839,14 @@ static void ath9k_vif_iter(void *data, u
+ 	struct ath9k_vif_iter_data *iter_data = data;
+ 	int i;
+ 
+-	if (iter_data->hw_macaddr)
++	if (iter_data->has_hw_macaddr) {
+ 		for (i = 0; i < ETH_ALEN; i++)
+ 			iter_data->mask[i] &=
+ 				~(iter_data->hw_macaddr[i] ^ mac[i]);
++	} else {
++		memcpy(iter_data->hw_macaddr, mac, ETH_ALEN);
++		iter_data->has_hw_macaddr = true;
 +	}
  
- 	rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
- 	rx_status->band = hw->conf.channel->band;
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_AP:
+@@ -891,7 +895,6 @@ void ath9k_calculate_iter_data(struct ie
+ 	 * together with the BSSID mask when matching addresses.
+ 	 */
+ 	memset(iter_data, 0, sizeof(*iter_data));
+-	iter_data->hw_macaddr = common->macaddr;
+ 	memset(&iter_data->mask, 0xff, ETH_ALEN);
+ 
+ 	if (vif)
+@@ -901,6 +904,8 @@ void ath9k_calculate_iter_data(struct ie
+ 	ieee80211_iterate_active_interfaces_atomic(
+ 		sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
+ 		ath9k_vif_iter, iter_data);
++
++	memcpy(common->macaddr, iter_data->hw_macaddr, ETH_ALEN);
+ }
+ 
+ /* Called with sc->mutex held. */
+--- a/drivers/net/wireless/ath/ath9k/reg.h
++++ b/drivers/net/wireless/ath/ath9k/reg.h
+@@ -1493,9 +1493,6 @@ enum {
+ #define AR9271_RADIO_RF_RST			0x20
+ #define AR9271_GATE_MAC_CTL			0x4000
+ 
+-#define AR_STA_ID0                 0x8000
+-#define AR_STA_ID1                 0x8004
+-#define AR_STA_ID1_SADH_MASK       0x0000FFFF
+ #define AR_STA_ID1_STA_AP          0x00010000
+ #define AR_STA_ID1_ADHOC           0x00020000
+ #define AR_STA_ID1_PWR_SAV         0x00040000
+--- a/drivers/net/wireless/ath/hw.c
++++ b/drivers/net/wireless/ath/hw.c
+@@ -118,6 +118,12 @@
+ void ath_hw_setbssidmask(struct ath_common *common)
+ {
+ 	void *ah = common->ah;
++	u32 id1;
++
++	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
++	id1 = REG_READ(ah, AR_STA_ID1) & ~AR_STA_ID1_SADH_MASK;
++	id1 |= get_unaligned_le16(common->macaddr + 4);
++	REG_WRITE(ah, AR_STA_ID1, id1);
+ 
+ 	REG_WRITE(ah, AR_BSSMSKL, get_unaligned_le32(common->bssidmask));
+ 	REG_WRITE(ah, AR_BSSMSKU, get_unaligned_le16(common->bssidmask + 4));
+--- a/drivers/net/wireless/ath/reg.h
++++ b/drivers/net/wireless/ath/reg.h
+@@ -23,6 +23,10 @@
+ #define AR_MIBC_CMC		0x00000004
+ #define AR_MIBC_MCS		0x00000008
+ 
++#define AR_STA_ID0		0x8000
++#define AR_STA_ID1		0x8004
++#define AR_STA_ID1_SADH_MASK	0x0000ffff
++
+ /*
+  * BSSID mask registers. See ath_hw_set_bssid_mask()
+  * for detailed documentation about these registers.
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -6059,7 +6059,7 @@ il4965_mac_channel_switch(struct ieee802
+ 	struct il_priv *il = hw->priv;
+ 	const struct il_channel_info *ch_info;
+ 	struct ieee80211_conf *conf = &hw->conf;
+-	struct ieee80211_channel *channel = ch_switch->channel;
++	struct ieee80211_channel *channel = ch_switch->chandef.chan;
+ 	struct il_ht_config *ht_conf = &il->current_ht_config;
+ 	u16 ch;
+ 
+@@ -6096,23 +6096,21 @@ il4965_mac_channel_switch(struct ieee802
+ 	il->current_ht_config.smps = conf->smps_mode;
+ 
+ 	/* Configure HT40 channels */
+-	il->ht.enabled = conf_is_ht(conf);
+-	if (il->ht.enabled) {
+-		if (conf_is_ht40_minus(conf)) {
+-			il->ht.extension_chan_offset =
+-			    IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+-			il->ht.is_40mhz = true;
+-		} else if (conf_is_ht40_plus(conf)) {
+-			il->ht.extension_chan_offset =
+-			    IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+-			il->ht.is_40mhz = true;
+-		} else {
+-			il->ht.extension_chan_offset =
+-			    IEEE80211_HT_PARAM_CHA_SEC_NONE;
+-			il->ht.is_40mhz = false;
+-		}
+-	} else
++	switch (cfg80211_get_chandef_type(&ch_switch->chandef)) {
++	case NL80211_CHAN_NO_HT:
++	case NL80211_CHAN_HT20:
+ 		il->ht.is_40mhz = false;
++		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++		break;
++	case NL80211_CHAN_HT40MINUS:
++		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
++		il->ht.is_40mhz = true;
++		break;
++	case NL80211_CHAN_HT40PLUS:
++		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
++		il->ht.is_40mhz = true;
++		break;
++	}
+ 
+ 	if ((le16_to_cpu(il->staging.channel) != ch))
+ 		il->staging.flags = 0;
+--- a/drivers/net/wireless/iwlegacy/4965.c
++++ b/drivers/net/wireless/iwlegacy/4965.c
+@@ -1493,7 +1493,7 @@ il4965_hw_channel_switch(struct il_priv 
+ 
+ 	cmd.band = band;
+ 	cmd.expect_beacon = 0;
+-	ch = ch_switch->channel->hw_value;
++	ch = ch_switch->chandef.chan->hw_value;
+ 	cmd.channel = cpu_to_le16(ch);
+ 	cmd.rxon_flags = il->staging.flags;
+ 	cmd.rxon_filter_flags = il->staging.filter_flags;
+--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
++++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
+@@ -379,7 +379,7 @@ static int iwl5000_hw_channel_switch(str
+ 	};
+ 
+ 	cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+-	ch = ch_switch->channel->hw_value;
++	ch = ch_switch->chandef.chan->hw_value;
+ 	IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+ 		      ctx->active.channel, ch);
+ 	cmd.channel = cpu_to_le16(ch);
+@@ -414,7 +414,8 @@ static int iwl5000_hw_channel_switch(str
+ 	}
+ 	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+ 		      cmd.switch_time);
+-	cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
++	cmd.expect_beacon =
++		ch_switch->chandef.chan->flags & IEEE80211_CHAN_RADAR;
+ 
+ 	return iwl_dvm_send_cmd(priv, &hcmd);
+ }
+@@ -540,7 +541,7 @@ static int iwl6000_hw_channel_switch(str
+ 	hcmd.data[0] = cmd;
+ 
+ 	cmd->band = priv->band == IEEE80211_BAND_2GHZ;
+-	ch = ch_switch->channel->hw_value;
++	ch = ch_switch->chandef.chan->hw_value;
+ 	IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+ 		      ctx->active.channel, ch);
+ 	cmd->channel = cpu_to_le16(ch);
+@@ -575,7 +576,8 @@ static int iwl6000_hw_channel_switch(str
+ 	}
+ 	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+ 		      cmd->switch_time);
+-	cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
++	cmd->expect_beacon =
++		ch_switch->chandef.chan->flags & IEEE80211_CHAN_RADAR;
+ 
+ 	err = iwl_dvm_send_cmd(priv, &hcmd);
+ 	kfree(cmd);
+--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+@@ -970,7 +970,7 @@ static void iwlagn_mac_channel_switch(st
+ {
+ 	struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+ 	struct ieee80211_conf *conf = &hw->conf;
+-	struct ieee80211_channel *channel = ch_switch->channel;
++	struct ieee80211_channel *channel = ch_switch->chandef.chan;
+ 	struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+ 	/*
+ 	 * MULTI-FIXME
+@@ -1008,11 +1008,21 @@ static void iwlagn_mac_channel_switch(st
+ 	priv->current_ht_config.smps = conf->smps_mode;
+ 
+ 	/* Configure HT40 channels */
+-	ctx->ht.enabled = conf_is_ht(conf);
+-	if (ctx->ht.enabled)
+-		iwlagn_config_ht40(conf, ctx);
+-	else
++	switch (cfg80211_get_chandef_type(&ch_switch->chandef)) {
++	case NL80211_CHAN_NO_HT:
++	case NL80211_CHAN_HT20:
+ 		ctx->ht.is_40mhz = false;
++		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++		break;
++	case NL80211_CHAN_HT40MINUS:
++		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
++		ctx->ht.is_40mhz = true;
++		break;
++	case NL80211_CHAN_HT40PLUS:
++		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
++		ctx->ht.is_40mhz = true;
++		break;
++	}
+ 
+ 	if ((le16_to_cpu(ctx->staging.channel) != ch))
+ 		ctx->staging.flags = 0;
+--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
+@@ -1160,7 +1160,7 @@ int iwlagn_commit_rxon(struct iwl_priv *
+ }
+ 
+ void iwlagn_config_ht40(struct ieee80211_conf *conf,
+-	struct iwl_rxon_context *ctx)
++			struct iwl_rxon_context *ctx)
+ {
+ 	if (conf_is_ht40_minus(conf)) {
+ 		ctx->ht.extension_chan_offset =
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -25,6 +25,7 @@
+ #include <linux/if_arp.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/etherdevice.h>
++#include <linux/platform_device.h>
+ #include <linux/debugfs.h>
+ #include <linux/module.h>
+ #include <linux/ktime.h>
+@@ -717,9 +718,17 @@ static bool mac80211_hwsim_tx_frame_no_n
+ 	rx_status.flag |= RX_FLAG_MACTIME_START;
+ 	rx_status.freq = chan->center_freq;
+ 	rx_status.band = chan->band;
+-	rx_status.rate_idx = info->control.rates[0].idx;
+-	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
+-		rx_status.flag |= RX_FLAG_HT;
++	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
++		rx_status.rate_idx =
++			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
++		rx_status.vht_nss =
++			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
++		rx_status.flag |= RX_FLAG_VHT;
++	} else {
++		rx_status.rate_idx = info->control.rates[0].idx;
++		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
++			rx_status.flag |= RX_FLAG_HT;
++	}
+ 	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+ 		rx_status.flag |= RX_FLAG_40MHZ;
+ 	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+@@ -1687,6 +1696,7 @@ static void mac80211_hwsim_free(void)
+ 		debugfs_remove(data->debugfs_ps);
+ 		debugfs_remove(data->debugfs);
+ 		ieee80211_unregister_hw(data->hw);
++		device_release_driver(data->dev);
+ 		device_unregister(data->dev);
+ 		ieee80211_free_hw(data->hw);
+ 	}
+@@ -1695,7 +1705,9 @@ static void mac80211_hwsim_free(void)
+ 
+ 
+ static struct device_driver mac80211_hwsim_driver = {
+-	.name = "mac80211_hwsim"
++	.name = "mac80211_hwsim",
++	.bus = &platform_bus_type,
++	.owner = THIS_MODULE,
+ };
+ 
+ static const struct net_device_ops hwsim_netdev_ops = {
+@@ -2187,9 +2199,15 @@ static int __init init_mac80211_hwsim(vo
+ 	spin_lock_init(&hwsim_radio_lock);
+ 	INIT_LIST_HEAD(&hwsim_radios);
+ 
++	err = driver_register(&mac80211_hwsim_driver);
++	if (err)
++		return err;
++
+ 	hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
+-	if (IS_ERR(hwsim_class))
+-		return PTR_ERR(hwsim_class);
++	if (IS_ERR(hwsim_class)) {
++		err = PTR_ERR(hwsim_class);
++		goto failed_unregister_driver;
++	}
+ 
+ 	memset(addr, 0, ETH_ALEN);
+ 	addr[0] = 0x02;
+@@ -2211,12 +2229,20 @@ static int __init init_mac80211_hwsim(vo
+ 					  "hwsim%d", i);
+ 		if (IS_ERR(data->dev)) {
+ 			printk(KERN_DEBUG
+-			       "mac80211_hwsim: device_create "
+-			       "failed (%ld)\n", PTR_ERR(data->dev));
++			       "mac80211_hwsim: device_create failed (%ld)\n",
++			       PTR_ERR(data->dev));
+ 			err = -ENOMEM;
+ 			goto failed_drvdata;
+ 		}
+ 		data->dev->driver = &mac80211_hwsim_driver;
++		err = device_bind_driver(data->dev);
++		if (err != 0) {
++			printk(KERN_DEBUG
++			       "mac80211_hwsim: device_bind_driver failed (%d)\n",
++			       err);
++			goto failed_hw;
++		}
++
+ 		skb_queue_head_init(&data->pending);
+ 
+ 		SET_IEEE80211_DEV(hw, data->dev);
+@@ -2515,6 +2541,8 @@ failed_drvdata:
+ 	ieee80211_free_hw(hw);
+ failed:
+ 	mac80211_hwsim_free();
++failed_unregister_driver:
++	driver_unregister(&mac80211_hwsim_driver);
+ 	return err;
+ }
+ module_init(init_mac80211_hwsim);
+@@ -2527,5 +2555,6 @@ static void __exit exit_mac80211_hwsim(v
+ 
+ 	mac80211_hwsim_free();
+ 	unregister_netdev(hwsim_mon);
++	driver_unregister(&mac80211_hwsim_driver);
+ }
+ module_exit(exit_mac80211_hwsim);
+--- a/drivers/net/wireless/ti/wl12xx/cmd.c
++++ b/drivers/net/wireless/ti/wl12xx/cmd.c
+@@ -301,7 +301,7 @@ int wl12xx_cmd_channel_switch(struct wl1
+ 	}
+ 
+ 	cmd->role_id = wlvif->role_id;
+-	cmd->channel = ch_switch->channel->hw_value;
++	cmd->channel = ch_switch->chandef.chan->hw_value;
+ 	cmd->switch_time = ch_switch->count;
+ 	cmd->stop_tx = ch_switch->block_tx;
+ 
+--- a/drivers/net/wireless/ti/wl18xx/cmd.c
++++ b/drivers/net/wireless/ti/wl18xx/cmd.c
+@@ -42,11 +42,11 @@ int wl18xx_cmd_channel_switch(struct wl1
+ 	}
+ 
+ 	cmd->role_id = wlvif->role_id;
+-	cmd->channel = ch_switch->channel->hw_value;
++	cmd->channel = ch_switch->chandef.chan->hw_value;
+ 	cmd->switch_time = ch_switch->count;
+ 	cmd->stop_tx = ch_switch->block_tx;
+ 
+-	switch (ch_switch->channel->band) {
++	switch (ch_switch->chandef.chan->band) {
+ 	case IEEE80211_BAND_2GHZ:
+ 		cmd->band = WLCORE_BAND_2_4GHZ;
+ 		break;
+@@ -55,7 +55,7 @@ int wl18xx_cmd_channel_switch(struct wl1
+ 		break;
+ 	default:
+ 		wl1271_error("invalid channel switch band: %d",
+-			     ch_switch->channel->band);
++			     ch_switch->chandef.chan->band);
+ 		ret = -EINVAL;
+ 		goto out_free;
+ 	}
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -185,7 +185,7 @@ struct ieee80211_hdr {
- 	u8 addr3[6];
- 	__le16 seq_ctrl;
- 	u8 addr4[6];
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_hdr_3addr {
- 	__le16 frame_control;
-@@ -194,7 +194,7 @@ struct ieee80211_hdr_3addr {
- 	u8 addr2[6];
- 	u8 addr3[6];
- 	__le16 seq_ctrl;
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_qos_hdr {
- 	__le16 frame_control;
-@@ -204,7 +204,7 @@ struct ieee80211_qos_hdr {
- 	u8 addr3[6];
- 	__le16 seq_ctrl;
- 	__le16 qos_ctrl;
--} __packed;
-+} __packed __aligned(2);
+@@ -673,6 +673,36 @@ struct ieee80211_channel_sw_ie {
+ } __packed;
+ 
+ /**
++ * struct ieee80211_ext_chansw_ie
++ *
++ * This structure represents the "Extended Channel Switch Announcement element"
++ */
++struct ieee80211_ext_chansw_ie {
++	u8 mode;
++	u8 new_operating_class;
++	u8 new_ch_num;
++	u8 count;
++} __packed;
++
++/**
++ * struct ieee80211_sec_chan_offs_ie - secondary channel offset IE
++ * @sec_chan_offs: secondary channel offset, uses IEEE80211_HT_PARAM_CHA_SEC_*
++ *	values here
++ * This structure represents the "Secondary Channel Offset element"
++ */
++struct ieee80211_sec_chan_offs_ie {
++	u8 sec_chan_offs;
++} __packed;
++
++/**
++ * struct ieee80211_wide_bw_chansw_ie - wide bandwidth channel switch IE
++ */
++struct ieee80211_wide_bw_chansw_ie {
++	u8 new_channel_width;
++	u8 new_center_freq_seg0, new_center_freq_seg1;
++} __packed;
++
++/**
+  * struct ieee80211_tim
+  *
+  * This structure refers to "Traffic Indication Map information element"
+@@ -840,12 +870,15 @@ struct ieee80211_mgmt {
+ 				} __packed wme_action;
+ 				struct{
+ 					u8 action_code;
+-					u8 element_id;
+-					u8 length;
+-					struct ieee80211_channel_sw_ie sw_elem;
++					u8 variable[0];
+ 				} __packed chan_switch;
+ 				struct{
+ 					u8 action_code;
++					struct ieee80211_ext_chansw_ie data;
++					u8 variable[0];
++				} __packed ext_chan_switch;
++				struct{
++					u8 action_code;
+ 					u8 dialog_token;
+ 					u8 element_id;
+ 					u8 length;
+@@ -1638,6 +1671,7 @@ enum ieee80211_eid {
+ 
+ 	WLAN_EID_HT_CAPABILITY = 45,
+ 	WLAN_EID_HT_OPERATION = 61,
++	WLAN_EID_SECONDARY_CHANNEL_OFFSET = 62,
+ 
+ 	WLAN_EID_RSN = 48,
+ 	WLAN_EID_MMIE = 76,
+@@ -1672,6 +1706,8 @@ enum ieee80211_eid {
+ 	WLAN_EID_VHT_CAPABILITY = 191,
+ 	WLAN_EID_VHT_OPERATION = 192,
+ 	WLAN_EID_OPMODE_NOTIF = 199,
++	WLAN_EID_WIDE_BW_CHANNEL_SWITCH = 194,
++	WLAN_EID_CHANNEL_SWITCH_WRAPPER = 196,
+ 
+ 	/* 802.11ad */
+ 	WLAN_EID_NON_TX_BSSID_CAP =  83,
+@@ -1795,6 +1831,7 @@ enum ieee80211_key_len {
+ 
+ /* Public action codes */
+ enum ieee80211_pub_actioncode {
++	WLAN_PUB_ACTION_EXT_CHANSW_ANN = 4,
+ 	WLAN_PUB_ACTION_TDLS_DISCOVER_RES = 14,
+ };
+ 
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -753,6 +753,8 @@ int cfg80211_check_station_change(struct
+  * @STATION_INFO_LOCAL_PM: @local_pm filled
+  * @STATION_INFO_PEER_PM: @peer_pm filled
+  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
++ * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
++ * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -781,6 +783,8 @@ enum station_info_flags {
+ 	STATION_INFO_NONPEER_PM		= 1<<23,
+ 	STATION_INFO_RX_BYTES64		= 1<<24,
+ 	STATION_INFO_TX_BYTES64		= 1<<25,
++	STATION_INFO_CHAIN_SIGNAL	= 1<<26,
++	STATION_INFO_CHAIN_SIGNAL_AVG	= 1<<27,
+ };
+ 
+ /**
+@@ -857,6 +861,8 @@ struct sta_bss_parameters {
+ 	u16 beacon_interval;
+ };
  
++#define IEEE80211_MAX_CHAINS	4
++
  /**
-  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
-@@ -581,7 +581,7 @@ struct ieee80211s_hdr {
- 	__le32 seqnum;
- 	u8 eaddr1[6];
- 	u8 eaddr2[6];
--} __packed;
-+} __packed __aligned(2);
- 
- /* Mesh flags */
- #define MESH_FLAGS_AE_A4 	0x1
-@@ -875,7 +875,7 @@ struct ieee80211_mgmt {
- 			} u;
- 		} __packed action;
- 	} u;
--} __packed;
-+} __packed __aligned(2);
- 
- /* Supported Rates value encodings in 802.11n-2009 7.3.2.2 */
- #define BSS_MEMBERSHIP_SELECTOR_HT_PHY	127
-@@ -906,20 +906,20 @@ struct ieee80211_rts {
- 	__le16 duration;
- 	u8 ra[6];
- 	u8 ta[6];
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_cts {
- 	__le16 frame_control;
- 	__le16 duration;
- 	u8 ra[6];
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_pspoll {
- 	__le16 frame_control;
- 	__le16 aid;
- 	u8 bssid[6];
- 	u8 ta[6];
--} __packed;
-+} __packed __aligned(2);
- 
- /* TDLS */
+  * struct station_info - station information
+  *
+@@ -874,6 +880,9 @@ struct sta_bss_parameters {
+  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+  * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
+  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
++ * @chains: bitmask for filled values in @chain_signal, @chain_signal_avg
++ * @chain_signal: per-chain signal strength of last received packet in dBm
++ * @chain_signal_avg: per-chain signal strength average in dBm
+  * @txrate: current unicast bitrate from this station
+  * @rxrate: current unicast bitrate to this station
+  * @rx_packets: packets received from this station
+@@ -909,6 +918,11 @@ struct station_info {
+ 	u8 plink_state;
+ 	s8 signal;
+ 	s8 signal_avg;
++
++	u8 chains;
++	s8 chain_signal[IEEE80211_MAX_CHAINS];
++	s8 chain_signal_avg[IEEE80211_MAX_CHAINS];
++
+ 	struct rate_info txrate;
+ 	struct rate_info rxrate;
+ 	u32 rx_packets;
+@@ -4027,6 +4041,17 @@ bool cfg80211_reg_can_beacon(struct wiph
+ void cfg80211_ch_switch_notify(struct net_device *dev,
+ 			       struct cfg80211_chan_def *chandef);
+ 
++/**
++ * ieee80211_operating_class_to_band - convert operating class to band
++ *
++ * @operating_class: the operating class to convert
++ * @band: band pointer to fill
++ *
++ * Returns %true if the conversion was successful, %false otherwise.
++ */
++bool ieee80211_operating_class_to_band(u8 operating_class,
++				       enum ieee80211_band *band);
++
+ /*
+  * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
+  * @dev: the device on which the operation is requested
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -210,7 +210,7 @@ struct ieee80211_chanctx_conf {
+  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
+  *	that it is only ever disabled for station mode.
+  * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
+- * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
++ * @BSS_CHANGED_SSID: SSID changed for this BSS (AP and IBSS mode)
+  * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
+  * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
+  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
+@@ -327,7 +327,7 @@ enum ieee80211_rssi_event {
+  *	your driver/device needs to do.
+  * @ps: power-save mode (STA only). This flag is NOT affected by
+  *	offchannel/dynamic_ps operations.
+- * @ssid: The SSID of the current vif. Only valid in AP-mode.
++ * @ssid: The SSID of the current vif. Valid in AP and IBSS mode.
+  * @ssid_len: Length of SSID given in @ssid.
+  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
+  * @txpower: TX power in dBm
+@@ -562,6 +562,9 @@ enum mac80211_rate_control_flags {
+ /* maximum number of rate stages */
+ #define IEEE80211_TX_MAX_RATES	4
+ 
++/* maximum number of rate table entries */
++#define IEEE80211_TX_RATE_TABLE_SIZE	4
++
+ /**
+  * struct ieee80211_tx_rate - rate selection/status
+  *
+@@ -602,8 +605,8 @@ static inline void ieee80211_rate_set_vh
+ 					  u8 mcs, u8 nss)
+ {
+ 	WARN_ON(mcs & ~0xF);
+-	WARN_ON(nss & ~0x7);
+-	rate->idx = (nss << 4) | mcs;
++	WARN_ON((nss - 1) & ~0x7);
++	rate->idx = ((nss - 1) << 4) | mcs;
+ }
+ 
+ static inline u8
+@@ -615,7 +618,7 @@ ieee80211_rate_get_vht_mcs(const struct 
+ static inline u8
+ ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
+ {
+-	return rate->idx >> 4;
++	return (rate->idx >> 4) + 1;
+ }
+ 
+ /**
+@@ -656,7 +659,11 @@ struct ieee80211_tx_info {
+ 					struct ieee80211_tx_rate rates[
+ 						IEEE80211_TX_MAX_RATES];
+ 					s8 rts_cts_rate_idx;
+-					/* 3 bytes free */
++					u8 use_rts:1;
++					u8 use_cts_prot:1;
++					u8 short_preamble:1;
++					u8 skip_table:1;
++					/* 2 bytes free */
+ 				};
+ 				/* only needed before rate control */
+ 				unsigned long jiffies;
+@@ -677,6 +684,8 @@ struct ieee80211_tx_info {
+ 		struct {
+ 			struct ieee80211_tx_rate driver_rates[
+ 				IEEE80211_TX_MAX_RATES];
++			u8 pad[4];
++
+ 			void *rate_driver_data[
+ 				IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE / sizeof(void *)];
+ 		};
+@@ -840,6 +849,9 @@ enum mac80211_rx_flags {
+  * @signal: signal strength when receiving this frame, either in dBm, in dB or
+  *	unspecified depending on the hardware capabilities flags
+  *	@IEEE80211_HW_SIGNAL_*
++ * @chains: bitmask of receive chains for which separate signal strength
++ *	values were filled.
++ * @chain_signal: per-chain signal strength, same format as @signal
+  * @antenna: antenna used
+  * @rate_idx: index of data rate into band's supported rates or MCS index if
+  *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
+@@ -871,6 +883,8 @@ struct ieee80211_rx_status {
+ 	u8 band;
+ 	u8 antenna;
+ 	s8 signal;
++	u8 chains;
++	s8 chain_signal[IEEE80211_MAX_CHAINS];
+ 	u8 ampdu_delimiter_crc;
+ 	u8 vendor_radiotap_align;
+ 	u8 vendor_radiotap_oui[3];
+@@ -1018,13 +1032,13 @@ struct ieee80211_conf {
+  *	the driver passed into mac80211.
+  * @block_tx: Indicates whether transmission must be blocked before the
+  *	scheduled channel switch, as indicated by the AP.
+- * @channel: the new channel to switch to
++ * @chandef: the new channel to switch to
+  * @count: the number of TBTT's until the channel switch event
+  */
+ struct ieee80211_channel_switch {
+ 	u64 timestamp;
+ 	bool block_tx;
+-	struct ieee80211_channel *channel;
++	struct cfg80211_chan_def chandef;
+ 	u8 count;
+ };
+ 
+@@ -1222,6 +1236,24 @@ enum ieee80211_sta_rx_bandwidth {
+ };
+ 
+ /**
++ * struct ieee80211_sta_rates - station rate selection table
++ *
++ * @rcu_head: RCU head used for freeing the table on update
++ * @rates: transmit rates/flags to be used by default.
++ *	Overriding entries per-packet is possible by using cb tx control.
++ */
++struct ieee80211_sta_rates {
++	struct rcu_head rcu_head;
++	struct {
++		s8 idx;
++		u8 count;
++		u8 count_cts;
++		u8 count_rts;
++		u16 flags;
++	} rate[IEEE80211_TX_RATE_TABLE_SIZE];
++};
++
++/**
+  * struct ieee80211_sta - station table entry
+  *
+  * A station table entry represents a station we are possibly
+@@ -1248,6 +1280,7 @@ enum ieee80211_sta_rx_bandwidth {
+  *	notifications and capabilities. The value is only valid after
+  *	the station moves to associated state.
+  * @smps_mode: current SMPS mode (off, static or dynamic)
++ * @tx_rates: rate control selection table
+  */
+ struct ieee80211_sta {
+ 	u32 supp_rates[IEEE80211_NUM_BANDS];
+@@ -1261,6 +1294,7 @@ struct ieee80211_sta {
+ 	u8 rx_nss;
+ 	enum ieee80211_sta_rx_bandwidth bandwidth;
+ 	enum ieee80211_smps_mode smps_mode;
++	struct ieee80211_sta_rates __rcu *rates;
+ 
+ 	/* must be last */
+ 	u8 drv_priv[0] __aligned(sizeof(void *));
+@@ -1416,6 +1450,9 @@ struct ieee80211_tx_control {
+  *	for different virtual interfaces. See the doc section on HW queue
+  *	control for more details.
+  *
++ * @IEEE80211_HW_SUPPORTS_RC_TABLE: The driver supports using a rate
++ *	selection table provided by the rate control algorithm.
++ *
+  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
+  *	P2P Interface. This will be honoured even if more than one interface
+  *	is supported.
+@@ -1448,6 +1485,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_PER_STA_GTK		= 1<<21,
+ 	IEEE80211_HW_AP_LINK_PS				= 1<<22,
+ 	IEEE80211_HW_TX_AMPDU_SETUP_IN_HW		= 1<<23,
++	IEEE80211_HW_SUPPORTS_RC_TABLE			= 1<<24,
+ 	IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF		= 1<<25,
+ 	IEEE80211_HW_TIMING_BEACON_ONLY			= 1<<26,
+ };
+@@ -3144,6 +3182,25 @@ void ieee80211_sta_set_buffered(struct i
+ 				u8 tid, bool buffered);
+ 
+ /**
++ * ieee80211_get_tx_rates - get the selected transmit rates for a packet
++ *
++ * Call this function in a driver with per-packet rate selection support
++ * to combine the rate info in the packet tx info with the most recent
++ * rate selection table for the station entry.
++ *
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @sta: the receiver station to which this packet is sent.
++ * @skb: the frame to be transmitted.
++ * @dest: buffer for extracted rate/retry information
++ * @max_rates: maximum number of rates to fetch
++ */
++void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
++			    struct ieee80211_sta *sta,
++			    struct sk_buff *skb,
++			    struct ieee80211_tx_rate *dest,
++			    int max_rates);
++
++/**
+  * ieee80211_tx_status - transmit status callback
+  *
+  * Call this function for all transmitted frames after they have been
+@@ -4118,7 +4175,7 @@ void ieee80211_send_bar(struct ieee80211
+  *	(deprecated; this will be removed once drivers get updated to use
+  *	rate_idx_mask)
+  * @rate_idx_mask: user-requested (legacy) rate mask
+- * @rate_idx_mcs_mask: user-requested MCS rate mask
++ * @rate_idx_mcs_mask: user-requested MCS rate mask (NULL if not in use)
+  * @bss: whether this frame is sent out in AP or IBSS mode
+  */
+ struct ieee80211_tx_rate_control {
+@@ -4130,7 +4187,7 @@ struct ieee80211_tx_rate_control {
+ 	bool rts, short_preamble;
+ 	u8 max_rate_idx;
+ 	u32 rate_idx_mask;
+-	u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
++	u8 *rate_idx_mcs_mask;
+ 	bool bss;
+ };
+ 
+@@ -4219,6 +4276,22 @@ bool rate_usable_index_exists(struct iee
+ 	return false;
+ }
+ 
++/**
++ * rate_control_set_rates - pass the sta rate selection to mac80211/driver
++ *
++ * When not doing a rate control probe to test rates, rate control should pass
++ * its rate selection to mac80211. If the driver supports receiving a station
++ * rate table, it will use it to ensure that frames are always sent based on
++ * the most recent rate control module decision.
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @pubsta: &struct ieee80211_sta pointer to the target destination.
++ * @rates: new tx rate set to be used for this station.
++ */
++int rate_control_set_rates(struct ieee80211_hw *hw,
++			   struct ieee80211_sta *pubsta,
++			   struct ieee80211_sta_rates *rates);
++
+ int ieee80211_rate_control_register(struct rate_control_ops *ops);
+ void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
  
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
@@ -140,9 +823,159 @@
  	    sdata->vif.type != NL80211_IFTYPE_ADHOC)
  		return -EINVAL;
  
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -444,7 +444,7 @@ static void sta_set_sinfo(struct sta_inf
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct timespec uptime;
+ 	u64 packets = 0;
+-	int ac;
++	int i, ac;
+ 
+ 	sinfo->generation = sdata->local->sta_generation;
+ 
+@@ -488,6 +488,17 @@ static void sta_set_sinfo(struct sta_inf
+ 			sinfo->signal = (s8)sta->last_signal;
+ 		sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
+ 	}
++	if (sta->chains) {
++		sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
++				 STATION_INFO_CHAIN_SIGNAL_AVG;
++
++		sinfo->chains = sta->chains;
++		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
++			sinfo->chain_signal[i] = sta->chain_signal_last[i];
++			sinfo->chain_signal_avg[i] =
++				(s8) -ewma_read(&sta->chain_signal_avg[i]);
++		}
++	}
+ 
+ 	sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
+ 	sta_set_rate_info_rx(sta, &sinfo->rxrate);
+@@ -1052,6 +1063,7 @@ static int ieee80211_stop_ap(struct wiph
+ 	ieee80211_free_keys(sdata);
+ 
+ 	sdata->vif.bss_conf.enable_beacon = false;
++	sdata->vif.bss_conf.ssid_len = 0;
+ 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+ 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+ 
+@@ -2416,9 +2428,22 @@ static int ieee80211_set_bitrate_mask(st
+ 	}
+ 
+ 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
++		struct ieee80211_supported_band *sband = wiphy->bands[i];
++		int j;
++
+ 		sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
+ 		memcpy(sdata->rc_rateidx_mcs_mask[i], mask->control[i].mcs,
+ 		       sizeof(mask->control[i].mcs));
++
++		sdata->rc_has_mcs_mask[i] = false;
++		if (!sband)
++			continue;
++
++		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++)
++			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
++				sdata->rc_has_mcs_mask[i] = true;
++				break;
++			}
+ 	}
+ 
+ 	return 0;
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -57,6 +57,22 @@ ieee80211_find_chanctx(struct ieee80211_
+ 	return NULL;
+ }
+ 
++static bool ieee80211_is_radar_required(struct ieee80211_local *local)
++{
++	struct ieee80211_sub_if_data *sdata;
++
++	rcu_read_lock();
++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++		if (sdata->radar_required) {
++			rcu_read_unlock();
++			return true;
++		}
++	}
++	rcu_read_unlock();
++
++	return false;
++}
++
+ static struct ieee80211_chanctx *
+ ieee80211_new_chanctx(struct ieee80211_local *local,
+ 		      const struct cfg80211_chan_def *chandef,
+@@ -76,6 +92,9 @@ ieee80211_new_chanctx(struct ieee80211_l
+ 	ctx->conf.rx_chains_static = 1;
+ 	ctx->conf.rx_chains_dynamic = 1;
+ 	ctx->mode = mode;
++	ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
++	if (!local->use_chanctx)
++		local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
+ 
+ 	/* acquire mutex to prevent idle from changing */
+ 	mutex_lock(&local->mtx);
+@@ -110,6 +129,7 @@ ieee80211_new_chanctx(struct ieee80211_l
+ static void ieee80211_free_chanctx(struct ieee80211_local *local,
+ 				   struct ieee80211_chanctx *ctx)
+ {
++	bool check_single_channel = false;
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
+ 	WARN_ON_ONCE(ctx->refcount != 0);
+@@ -119,6 +139,14 @@ static void ieee80211_free_chanctx(struc
+ 		chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+ 		chandef->center_freq1 = chandef->chan->center_freq;
+ 		chandef->center_freq2 = 0;
++
++		/* NOTE: Disabling radar is only valid here for
++		 * single channel context. To be sure, check it ...
++		 */
++		if (local->hw.conf.radar_enabled)
++			check_single_channel = true;
++		local->hw.conf.radar_enabled = false;
++
+ 		ieee80211_hw_config(local, 0);
+ 	} else {
+ 		drv_remove_chanctx(local, ctx);
+@@ -127,6 +155,9 @@ static void ieee80211_free_chanctx(struc
+ 	list_del_rcu(&ctx->list);
+ 	kfree_rcu(ctx, rcu_head);
+ 
++	/* throw a warning if this wasn't the only channel context. */
++	WARN_ON(check_single_channel && !list_empty(&local->chanctx_list));
++
+ 	mutex_lock(&local->mtx);
+ 	ieee80211_recalc_idle(local);
+ 	mutex_unlock(&local->mtx);
+@@ -238,19 +269,11 @@ static void __ieee80211_vif_release_chan
+ void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
+ 				    struct ieee80211_chanctx *chanctx)
+ {
+-	struct ieee80211_sub_if_data *sdata;
+-	bool radar_enabled = false;
++	bool radar_enabled;
+ 
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		if (sdata->radar_required) {
+-			radar_enabled = true;
+-			break;
+-		}
+-	}
+-	rcu_read_unlock();
++	radar_enabled = ieee80211_is_radar_required(local);
+ 
+ 	if (radar_enabled == chanctx->conf.radar_enabled)
+ 		return;
 --- a/net/mac80211/debugfs_sta.c
 +++ b/net/mac80211/debugfs_sta.c
-@@ -65,11 +65,11 @@ static ssize_t sta_flags_read(struct fil
+@@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
  	test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  
  	int res = scnprintf(buf, sizeof(buf),
@@ -156,27 +989,115 @@
  			    TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  			    TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  			    TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -78,7 +78,7 @@ void ieee80211_recalc_txpower(struct iee
- 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -209,6 +209,8 @@ static void __ieee80211_sta_join_ibss(st
+ 	sdata->vif.bss_conf.enable_beacon = true;
+ 	sdata->vif.bss_conf.beacon_int = beacon_int;
+ 	sdata->vif.bss_conf.basic_rates = basic_rates;
++	sdata->vif.bss_conf.ssid_len = ifibss->ssid_len;
++	memcpy(sdata->vif.bss_conf.ssid, ifibss->ssid, ifibss->ssid_len);
+ 	bss_change = BSS_CHANGED_BEACON_INT;
+ 	bss_change |= ieee80211_reset_erp_info(sdata);
+ 	bss_change |= BSS_CHANGED_BSSID;
+@@ -217,6 +219,7 @@ static void __ieee80211_sta_join_ibss(st
+ 	bss_change |= BSS_CHANGED_BASIC_RATES;
+ 	bss_change |= BSS_CHANGED_HT;
+ 	bss_change |= BSS_CHANGED_IBSS;
++	bss_change |= BSS_CHANGED_SSID;
+ 
+ 	/*
+ 	 * In 5 GHz/802.11a, we can always use short slot time.
+@@ -911,7 +914,7 @@ void ieee80211_rx_mgmt_probe_beacon(stru
+ 		return;
+ 
+ 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+-				&elems);
++			       false, &elems);
+ 
+ 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
  }
+@@ -1159,6 +1162,7 @@ int ieee80211_ibss_leave(struct ieee8021
+ 	sdata->vif.bss_conf.ibss_joined = false;
+ 	sdata->vif.bss_conf.ibss_creator = false;
+ 	sdata->vif.bss_conf.enable_beacon = false;
++	sdata->vif.bss_conf.ssid_len = 0;
+ 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+ 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+ 						BSS_CHANGED_IBSS);
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -156,6 +156,7 @@ struct ieee80211_tx_data {
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct sta_info *sta;
+ 	struct ieee80211_key *key;
++	struct ieee80211_tx_rate rate;
  
--static u32 ieee80211_idle_off(struct ieee80211_local *local)
-+u32 ieee80211_idle_off(struct ieee80211_local *local)
- {
- 	if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
- 		return 0;
-@@ -107,7 +107,7 @@ void ieee80211_recalc_idle(struct ieee80
+ 	unsigned int flags;
+ };
+@@ -740,6 +741,8 @@ struct ieee80211_sub_if_data {
  
- 	lockdep_assert_held(&local->mtx);
+ 	/* bitmap of allowed (non-MCS) rate indexes for rate control */
+ 	u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
++
++	bool rc_has_mcs_mask[IEEE80211_NUM_BANDS];
+ 	u8  rc_rateidx_mcs_mask[IEEE80211_NUM_BANDS][IEEE80211_HT_MCS_MASK_LEN];
+ 
+ 	union {
+@@ -1025,7 +1028,7 @@ struct ieee80211_local {
+ 	enum mac80211_scan_state next_scan_state;
+ 	struct delayed_work scan_work;
+ 	struct ieee80211_sub_if_data __rcu *scan_sdata;
+-	struct ieee80211_channel *csa_channel;
++	struct cfg80211_chan_def csa_chandef;
+ 	/* For backward compatibility only -- do not use */
+ 	struct cfg80211_chan_def _oper_chandef;
+ 
+@@ -1184,10 +1187,13 @@ struct ieee802_11_elems {
+ 	const u8 *perr;
+ 	const struct ieee80211_rann_ie *rann;
+ 	const struct ieee80211_channel_sw_ie *ch_switch_ie;
++	const struct ieee80211_ext_chansw_ie *ext_chansw_ie;
++	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
+ 	const u8 *country_elem;
+ 	const u8 *pwr_constr_elem;
+ 	const struct ieee80211_timeout_interval_ie *timeout_int;
+ 	const u8 *opmode_notif;
++	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
+ 
+ 	/* length of them, respectively */
+ 	u8 ssid_len;
+@@ -1258,10 +1264,6 @@ void ieee80211_recalc_ps_vif(struct ieee
+ int ieee80211_max_network_latency(struct notifier_block *nb,
+ 				  unsigned long data, void *dummy);
+ int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
+-void
+-ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+-				 const struct ieee80211_channel_sw_ie *sw_elem,
+-				 struct ieee80211_bss *bss, u64 timestamp);
+ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+ 				  struct sk_buff *skb);
+@@ -1499,13 +1501,13 @@ static inline void ieee80211_tx_skb(stru
+ 	ieee80211_tx_skb_tid(sdata, skb, 7);
+ }
  
--	active = !list_empty(&local->chanctx_list);
-+	active = !list_empty(&local->chanctx_list) || local->monitors;
+-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
++u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
+ 			       struct ieee802_11_elems *elems,
+ 			       u64 filter, u32 crc);
+-static inline void ieee802_11_parse_elems(u8 *start, size_t len,
++static inline void ieee802_11_parse_elems(u8 *start, size_t len, bool action,
+ 					  struct ieee802_11_elems *elems)
+ {
+-	ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
++	ieee802_11_parse_elems_crc(start, len, action, elems, 0, 0);
+ }
  
- 	if (!local->ops->remain_on_channel) {
- 		list_for_each_entry(roc, &local->roc_list, list) {
-@@ -436,7 +436,6 @@ int ieee80211_do_open(struct wireless_de
+ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -450,7 +450,6 @@ int ieee80211_do_open(struct wireless_de
  	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  	struct net_device *dev = wdev->netdev;
  	struct ieee80211_local *local = sdata->local;
@@ -184,17 +1105,7 @@
  	u32 changed = 0;
  	int res;
  	u32 hw_reconf_flags = 0;
-@@ -541,6 +540,9 @@ int ieee80211_do_open(struct wireless_de
- 
- 		ieee80211_adjust_monitor_flags(sdata, 1);
- 		ieee80211_configure_filter(local);
-+		mutex_lock(&local->mtx);
-+		ieee80211_recalc_idle(local);
-+		mutex_unlock(&local->mtx);
- 
- 		netif_carrier_on(dev);
- 		break;
-@@ -595,30 +597,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -609,30 +608,8 @@ int ieee80211_do_open(struct wireless_de
  
  	set_bit(SDATA_STATE_RUNNING, &sdata->state);
  
@@ -226,17 +1137,7 @@
  
  	/*
  	 * set_multicast_list will be invoked by the networking core
-@@ -817,6 +797,9 @@ static void ieee80211_do_stop(struct iee
- 
- 		ieee80211_adjust_monitor_flags(sdata, -1);
- 		ieee80211_configure_filter(local);
-+		mutex_lock(&local->mtx);
-+		ieee80211_recalc_idle(local);
-+		mutex_unlock(&local->mtx);
- 		break;
- 	case NL80211_IFTYPE_P2P_DEVICE:
- 		/* relies on synchronize_rcu() below */
-@@ -1022,6 +1005,72 @@ static void ieee80211_if_setup(struct ne
+@@ -1092,6 +1069,74 @@ static void ieee80211_if_setup(struct ne
  	dev->destructor = free_netdev;
  }
  
@@ -252,10 +1153,12 @@
 +	u32 rates = 0;
 +	u16 stype;
 +	bool new = false;
-+	enum ieee80211_band band = local->hw.conf.channel->band;
-+	struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
++	enum ieee80211_band band;
++	struct ieee80211_supported_band *sband;
 +
 +	rx_status = IEEE80211_SKB_RXCB(skb);
++	band = rx_status->band;
++	sband = local->hw.wiphy->bands[band];
 +	mgmt = (struct ieee80211_mgmt *) skb->data;
 +	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 +
@@ -267,7 +1170,7 @@
 +		return;
 +
 +	ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
-+			       skb->len - baselen, &elems);
++			       skb->len - baselen, false, &elems);
 +
 +	rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 +
@@ -286,7 +1189,7 @@
 +	}
 +
 +	sta->last_rx = jiffies;
-+	sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
++	sta->sta.supp_rates[band] = rates;
 +
 +	if (elems.ht_cap_elem)
 +		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
@@ -309,7 +1212,7 @@
  static void ieee80211_iface_work(struct work_struct *work)
  {
  	struct ieee80211_sub_if_data *sdata =
-@@ -1126,6 +1175,9 @@ static void ieee80211_iface_work(struct 
+@@ -1196,6 +1241,9 @@ static void ieee80211_iface_work(struct 
  				break;
  			ieee80211_mesh_rx_queued_mgmt(sdata, skb);
  			break;
@@ -319,1422 +1222,2538 @@
  		default:
  			WARN(1, "frame for unexpected interface type");
  			break;
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2365,6 +2365,7 @@ ieee80211_rx_h_action(struct ieee80211_r
- 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
- 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
- 		    sdata->vif.type != NL80211_IFTYPE_AP &&
-+		    sdata->vif.type != NL80211_IFTYPE_WDS &&
- 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
- 			break;
- 
-@@ -2692,14 +2693,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
- 
- 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
- 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
--	    sdata->vif.type != NL80211_IFTYPE_STATION)
-+	    sdata->vif.type != NL80211_IFTYPE_STATION &&
-+	    sdata->vif.type != NL80211_IFTYPE_WDS)
- 		return RX_DROP_MONITOR;
- 
- 	switch (stype) {
- 	case cpu_to_le16(IEEE80211_STYPE_AUTH):
- 	case cpu_to_le16(IEEE80211_STYPE_BEACON):
- 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
--		/* process for all: mesh, mlme, ibss */
-+		/* process for all: mesh, mlme, ibss, wds */
- 		break;
- 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
- 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-@@ -3028,10 +3030,16 @@ static int prepare_for_handlers(struct i
- 		}
- 		break;
- 	case NL80211_IFTYPE_WDS:
--		if (bssid || !ieee80211_is_data(hdr->frame_control))
--			return 0;
- 		if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
- 			return 0;
-+
-+		if (ieee80211_is_data(hdr->frame_control) ||
-+		    ieee80211_is_action(hdr->frame_control)) {
-+			if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
-+				return 0;
-+		} else if (!ieee80211_is_beacon(hdr->frame_control))
-+			return 0;
-+
- 		break;
- 	case NL80211_IFTYPE_P2P_DEVICE:
- 		if (!ieee80211_is_public_action(hdr, skb->len) &&
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -32,7 +32,6 @@
-  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
-  *	frames.
-  * @WLAN_STA_WME: Station is a QoS-STA.
-- * @WLAN_STA_WDS: Station is one of our WDS peers.
-  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
-  *	IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
-  *	frame to this station is transmitted.
-@@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
- 	WLAN_STA_AUTHORIZED,
- 	WLAN_STA_SHORT_PREAMBLE,
- 	WLAN_STA_WME,
--	WLAN_STA_WDS,
- 	WLAN_STA_CLEAR_PS_FILT,
- 	WLAN_STA_MFP,
- 	WLAN_STA_BLOCK_BA,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1231,34 +1231,40 @@ static bool ieee80211_tx_frags(struct ie
- 		if (local->queue_stop_reasons[q] ||
- 		    (!txpending && !skb_queue_empty(&local->pending[q]))) {
- 			if (unlikely(info->flags &
--					IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
--				     local->queue_stop_reasons[q] &
--					~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
-+				     IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
-+				if (local->queue_stop_reasons[q] &
-+				    ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
-+					/*
-+					 * Drop off-channel frames if queues
-+					 * are stopped for any reason other
-+					 * than off-channel operation. Never
-+					 * queue them.
-+					 */
-+					spin_unlock_irqrestore(
-+						&local->queue_stop_reason_lock,
-+						flags);
-+					ieee80211_purge_tx_queue(&local->hw,
-+								 skbs);
-+					return true;
-+				}
-+			} else {
-+
- 				/*
--				 * Drop off-channel frames if queues are stopped
--				 * for any reason other than off-channel
--				 * operation. Never queue them.
-+				 * Since queue is stopped, queue up frames for
-+				 * later transmission from the tx-pending
-+				 * tasklet when the queue is woken again.
- 				 */
--				spin_unlock_irqrestore(
--					&local->queue_stop_reason_lock, flags);
--				ieee80211_purge_tx_queue(&local->hw, skbs);
--				return true;
-+				if (txpending)
-+					skb_queue_splice_init(skbs,
-+							      &local->pending[q]);
-+				else
-+					skb_queue_splice_tail_init(skbs,
-+								   &local->pending[q]);
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -674,6 +674,7 @@ int ieee80211_register_hw(struct ieee802
+ 	int channels, max_bitrates;
+ 	bool supp_ht, supp_vht;
+ 	netdev_features_t feature_whitelist;
++	struct cfg80211_chan_def dflt_chandef = {};
+ 	static const u32 cipher_suites[] = {
+ 		/* keep WEP first, it may be removed below */
+ 		WLAN_CIPHER_SUITE_WEP40,
+@@ -751,19 +752,19 @@ int ieee80211_register_hw(struct ieee802
+ 		sband = local->hw.wiphy->bands[band];
+ 		if (!sband)
+ 			continue;
+-		if (!local->use_chanctx && !local->_oper_chandef.chan) {
 +
-+				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
-+						       flags);
-+				return false;
- 			}
--
--			/*
--			 * Since queue is stopped, queue up frames for later
--			 * transmission from the tx-pending tasklet when the
--			 * queue is woken again.
--			 */
--			if (txpending)
--				skb_queue_splice_init(skbs, &local->pending[q]);
--			else
--				skb_queue_splice_tail_init(skbs,
--							   &local->pending[q]);
--
--			spin_unlock_irqrestore(&local->queue_stop_reason_lock,
--					       flags);
--			return false;
++		if (!dflt_chandef.chan) {
++			cfg80211_chandef_create(&dflt_chandef,
++						&sband->channels[0],
++						NL80211_CHAN_NO_HT);
+ 			/* init channel we're on */
+-			struct cfg80211_chan_def chandef = {
+-				.chan = &sband->channels[0],
+-				.width = NL80211_CHAN_NO_HT,
+-				.center_freq1 = sband->channels[0].center_freq,
+-				.center_freq2 = 0
+-			};
+-			local->hw.conf.chandef = local->_oper_chandef = chandef;
++			if (!local->use_chanctx && !local->_oper_chandef.chan) {
++				local->hw.conf.chandef = dflt_chandef;
++				local->_oper_chandef = dflt_chandef;
++			}
++			local->monitor_chandef = dflt_chandef;
  		}
- 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+-		cfg80211_chandef_create(&local->monitor_chandef,
+-					&sband->channels[0],
+-					NL80211_CHAN_NO_HT);
++
+ 		channels += sband->n_channels;
  
-@@ -1848,9 +1854,24 @@ netdev_tx_t ieee80211_subif_start_xmit(s
- 		}
+ 		if (max_bitrates < sband->n_bitrates)
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -838,7 +838,7 @@ ieee80211_mesh_rx_probe_req(struct ieee8
+ 	if (baselen > len)
+ 		return;
  
- 		if (!is_multicast_ether_addr(skb->data)) {
-+			struct sta_info *next_hop;
-+			bool mpp_lookup = true;
-+
- 			mpath = mesh_path_lookup(sdata, skb->data);
--			if (!mpath)
-+			if (mpath) {
-+				mpp_lookup = false;
-+				next_hop = rcu_dereference(mpath->next_hop);
-+				if (!next_hop ||
-+				    !(mpath->flags & (MESH_PATH_ACTIVE |
-+						      MESH_PATH_RESOLVING)))
-+					mpp_lookup = true;
-+			}
-+
-+			if (mpp_lookup)
- 				mppath = mpp_path_lookup(sdata, skb->data);
-+
-+			if (mppath && mpath)
-+				mesh_path_del(mpath->sdata, mpath->dst);
- 		}
+-	ieee802_11_parse_elems(pos, len - baselen, &elems);
++	ieee802_11_parse_elems(pos, len - baselen, false, &elems);
  
- 		/*
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -554,16 +554,9 @@ static int nl80211_msg_put_channel(struc
- 	if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
- 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
- 		goto nla_put_failure;
--	if (chan->flags & IEEE80211_CHAN_RADAR) {
--		u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
--		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
--			goto nla_put_failure;
--		if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
--				chan->dfs_state))
--			goto nla_put_failure;
--		if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
--			goto nla_put_failure;
--	}
-+	if ((chan->flags & IEEE80211_CHAN_RADAR) &&
-+	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
-+		goto nla_put_failure;
- 	if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
- 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
- 		goto nla_put_failure;
-@@ -900,9 +893,6 @@ static int nl80211_put_iface_combination
- 		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
- 				c->max_interfaces))
- 			goto nla_put_failure;
--		if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
--				c->radar_detect_widths))
--			goto nla_put_failure;
- 
- 		nla_nest_end(msg, nl_combi);
+ 	/* 802.11-2012 10.1.4.3.2 */
+ 	if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+@@ -899,7 +899,7 @@ static void ieee80211_mesh_rx_bcn_presp(
+ 		return;
+ 
+ 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+-			       &elems);
++			       false, &elems);
+ 
+ 	/* ignore non-mesh or secure / unsecure mismatch */
+ 	if ((!elems.mesh_id || !elems.mesh_config) ||
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -880,7 +880,7 @@ void mesh_rx_path_sel_frame(struct ieee8
+ 
+ 	baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
+ 	ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
+-			len - baselen, &elems);
++			       len - baselen, false, &elems);
+ 
+ 	if (elems.preq) {
+ 		if (elems.preq_len != 37)
+--- a/net/mac80211/mesh_plink.c
++++ b/net/mac80211/mesh_plink.c
+@@ -544,8 +544,8 @@ static void mesh_plink_timer(unsigned lo
+ 		return;
  	}
-@@ -914,48 +904,6 @@ nla_put_failure:
- 	return -ENOBUFS;
- }
+ 	mpl_dbg(sta->sdata,
+-		"Mesh plink timer for %pM fired on state %d\n",
+-		sta->sta.addr, sta->plink_state);
++		"Mesh plink timer for %pM fired on state %s\n",
++		sta->sta.addr, mplstates[sta->plink_state]);
+ 	reason = 0;
+ 	llid = sta->llid;
+ 	plid = sta->plid;
+@@ -687,7 +687,7 @@ void mesh_rx_plink_frame(struct ieee8021
+ 		baseaddr += 4;
+ 		baselen += 4;
+ 	}
+-	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
++	ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
  
--#ifdef CONFIG_PM
--static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
--					struct sk_buff *msg)
--{
--	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
--	struct nlattr *nl_tcp;
--
--	if (!tcp)
--		return 0;
--
--	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
--	if (!nl_tcp)
--		return -ENOBUFS;
--
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
--			tcp->data_payload_max))
--		return -ENOBUFS;
--
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
--			tcp->data_payload_max))
--		return -ENOBUFS;
+ 	if (!elems.peering) {
+ 		mpl_dbg(sdata,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -289,6 +289,8 @@ ieee80211_determine_chantype(struct ieee
+ 	} else {
+ 		/* 40 MHz (and 80 MHz) must be supported for VHT */
+ 		ret = IEEE80211_STA_DISABLE_VHT;
++		/* also mark 40 MHz disabled */
++		ret |= IEEE80211_STA_DISABLE_40MHZ;
+ 		goto out;
+ 	}
+ 
+@@ -303,12 +305,6 @@ ieee80211_determine_chantype(struct ieee
+ 					       channel->band);
+ 	vht_chandef.center_freq2 = 0;
+ 
+-	if (vht_oper->center_freq_seg2_idx)
+-		vht_chandef.center_freq2 =
+-			ieee80211_channel_to_frequency(
+-				vht_oper->center_freq_seg2_idx,
+-				channel->band);
 -
--	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
--		return -ENOBUFS;
+ 	switch (vht_oper->chan_width) {
+ 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
+ 		vht_chandef.width = chandef->width;
+@@ -321,6 +317,10 @@ ieee80211_determine_chantype(struct ieee
+ 		break;
+ 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+ 		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
++		vht_chandef.center_freq2 =
++			ieee80211_channel_to_frequency(
++				vht_oper->center_freq_seg2_idx,
++				channel->band);
+ 		break;
+ 	default:
+ 		if (verbose)
+@@ -604,7 +604,6 @@ static void ieee80211_add_vht_ie(struct 
+ 	u8 *pos;
+ 	u32 cap;
+ 	struct ieee80211_sta_vht_cap vht_cap;
+-	int i;
+ 
+ 	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
+ 
+@@ -632,37 +631,6 @@ static void ieee80211_add_vht_ie(struct 
+ 			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
+ 		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+ 
+-	if (!(ap_vht_cap->vht_cap_info &
+-			cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
+-		cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
+-			 IEEE80211_VHT_CAP_RXSTBC_3 |
+-			 IEEE80211_VHT_CAP_RXSTBC_4);
 -
--	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
--				sizeof(*tcp->tok), tcp->tok))
--		return -ENOBUFS;
+-	for (i = 0; i < 8; i++) {
+-		int shift = i * 2;
+-		u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
+-		u16 ap_mcs, our_mcs;
 -
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
--			tcp->data_interval_max))
--		return -ENOBUFS;
+-		ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
+-								mask) >> shift;
+-		our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
+-								mask) >> shift;
 -
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
--			tcp->wake_payload_max))
--		return -ENOBUFS;
+-		if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+-			continue;
 -
--	nla_nest_end(msg, nl_tcp);
--	return 0;
--}
--#endif
+-		switch (ap_mcs) {
+-		default:
+-			if (our_mcs <= ap_mcs)
+-				break;
+-			/* fall through */
+-		case IEEE80211_VHT_MCS_NOT_SUPPORTED:
+-			vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
+-			vht_cap.vht_mcs.rx_mcs_map |=
+-				cpu_to_le16(ap_mcs << shift);
+-		}
+-	}
 -
- static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
- 			      struct cfg80211_registered_device *dev)
+ 	/* reserve and fill IE */
+ 	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
+ 	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
+@@ -998,16 +966,7 @@ static void ieee80211_chswitch_work(stru
+ 	if (!ifmgd->associated)
+ 		goto out;
+ 
+-	/*
+-	 * FIXME: Here we are downgrading to NL80211_CHAN_WIDTH_20_NOHT
+-	 * and don't adjust our ht/vht settings
+-	 * This is wrong - we should behave according to the CSA params
+-	 */
+-	local->_oper_chandef.chan = local->csa_channel;
+-	local->_oper_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+-	local->_oper_chandef.center_freq1 =
+-		local->_oper_chandef.chan->center_freq;
+-	local->_oper_chandef.center_freq2 = 0;
++	local->_oper_chandef = local->csa_chandef;
+ 
+ 	if (!local->ops->channel_switch) {
+ 		/* call "hw_config" only if doing sw channel switch */
+@@ -1054,56 +1013,193 @@ static void ieee80211_chswitch_timer(uns
+ 	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
+ }
+ 
+-void
++static void
+ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+-				 const struct ieee80211_channel_sw_ie *sw_elem,
+-				 struct ieee80211_bss *bss, u64 timestamp)
++				 u64 timestamp, struct ieee802_11_elems *elems)
  {
-@@ -1330,9 +1278,6 @@ static int nl80211_send_wiphy(struct sk_
- 				goto nla_put_failure;
- 		}
+-	struct cfg80211_bss *cbss =
+-		container_of((void *)bss, struct cfg80211_bss, priv);
+-	struct ieee80211_channel *new_ch;
++	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+-	int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
+-						      cbss->channel->band);
++	struct cfg80211_bss *cbss = ifmgd->associated;
++	struct ieee80211_bss *bss;
+ 	struct ieee80211_chanctx *chanctx;
++	enum ieee80211_band new_band;
++	int new_freq;
++	u8 new_chan_no;
++	u8 count;
++	u8 mode;
++	struct ieee80211_channel *new_chan;
++	struct cfg80211_chan_def new_chandef = {};
++	struct cfg80211_chan_def new_vht_chandef = {};
++	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
++	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
++	int secondary_channel_offset = -1;
+ 
+ 	ASSERT_MGD_MTX(ifmgd);
+ 
+-	if (!ifmgd->associated)
++	if (!cbss)
+ 		return;
  
--		if (nl80211_send_wowlan_tcp_caps(dev, msg))
--			goto nla_put_failure;
+-	if (sdata->local->scanning)
++	if (local->scanning)
+ 		return;
+ 
+-	/* Disregard subsequent beacons if we are already running a timer
+-	   processing a CSA */
 -
- 		nla_nest_end(msg, nl_wowlan);
++	/* disregard subsequent announcements if we are already processing */
+ 	if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
+ 		return;
+ 
+-	new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+-	if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
++	sec_chan_offs = elems->sec_chan_offs;
++	wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
++
++	if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
++			    IEEE80211_STA_DISABLE_40MHZ)) {
++		sec_chan_offs = NULL;
++		wide_bw_chansw_ie = NULL;
++	}
++
++	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
++		wide_bw_chansw_ie = NULL;
++
++	if (elems->ext_chansw_ie) {
++		if (!ieee80211_operating_class_to_band(
++				elems->ext_chansw_ie->new_operating_class,
++				&new_band)) {
++			sdata_info(sdata,
++				   "cannot understand ECSA IE operating class %d, disconnecting\n",
++				   elems->ext_chansw_ie->new_operating_class);
++			ieee80211_queue_work(&local->hw,
++					     &ifmgd->csa_connection_drop_work);
++		}
++		new_chan_no = elems->ext_chansw_ie->new_ch_num;
++		count = elems->ext_chansw_ie->count;
++		mode = elems->ext_chansw_ie->mode;
++	} else if (elems->ch_switch_ie) {
++		new_band = cbss->channel->band;
++		new_chan_no = elems->ch_switch_ie->new_ch_num;
++		count = elems->ch_switch_ie->count;
++		mode = elems->ch_switch_ie->mode;
++	} else {
++		/* nothing here we understand */
++		return;
++	}
++
++	bss = (void *)cbss->priv;
++
++	new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
++	new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
++	if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
+ 		sdata_info(sdata,
+ 			   "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
+ 			   ifmgd->associated->bssid, new_freq);
+-		ieee80211_queue_work(&sdata->local->hw,
++		ieee80211_queue_work(&local->hw,
++				     &ifmgd->csa_connection_drop_work);
++		return;
++	}
++
++	if (sec_chan_offs) {
++		secondary_channel_offset = sec_chan_offs->sec_chan_offs;
++	} else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
++		/* if HT is enabled and the IE not present, it's still HT */
++		secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++	}
++
++	switch (secondary_channel_offset) {
++	default:
++		/* secondary_channel_offset was present but is invalid */
++	case IEEE80211_HT_PARAM_CHA_SEC_NONE:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_HT20);
++		break;
++	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_HT40PLUS);
++		break;
++	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_HT40MINUS);
++		break;
++	case -1:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_NO_HT);
++		break;
++	}
++
++	if (wide_bw_chansw_ie) {
++		new_vht_chandef.chan = new_chan;
++		new_vht_chandef.center_freq1 =
++			ieee80211_channel_to_frequency(
++				wide_bw_chansw_ie->new_center_freq_seg0,
++				new_band);
++
++		switch (wide_bw_chansw_ie->new_channel_width) {
++		default:
++			/* hmmm, ignore VHT and use HT if present */
++		case IEEE80211_VHT_CHANWIDTH_USE_HT:
++			new_vht_chandef.chan = NULL;
++			break;
++		case IEEE80211_VHT_CHANWIDTH_80MHZ:
++			new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
++			break;
++		case IEEE80211_VHT_CHANWIDTH_160MHZ:
++			new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
++			break;
++		case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
++			/* field is otherwise reserved */
++			new_vht_chandef.center_freq2 =
++				ieee80211_channel_to_frequency(
++					wide_bw_chansw_ie->new_center_freq_seg1,
++					new_band);
++			new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
++			break;
++		}
++		if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
++		    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
++			chandef_downgrade(&new_vht_chandef);
++		if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
++		    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
++			chandef_downgrade(&new_vht_chandef);
++		if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
++		    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
++			chandef_downgrade(&new_vht_chandef);
++	}
++
++	/* if VHT data is there validate & use it */
++	if (new_vht_chandef.chan) {
++		if (!cfg80211_chandef_compatible(&new_vht_chandef,
++						 &new_chandef)) {
++			sdata_info(sdata,
++				   "AP %pM CSA has inconsistent channel data, disconnecting\n",
++				   ifmgd->associated->bssid);
++			ieee80211_queue_work(&local->hw,
++					     &ifmgd->csa_connection_drop_work);
++			return;
++		}
++		new_chandef = new_vht_chandef;
++	}
++
++	if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
++				     IEEE80211_CHAN_DISABLED)) {
++		sdata_info(sdata,
++			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
++			   ifmgd->associated->bssid, new_freq,
++			   new_chandef.width, new_chandef.center_freq1,
++			   new_chandef.center_freq2);
++		ieee80211_queue_work(&local->hw,
+ 				     &ifmgd->csa_connection_drop_work);
+ 		return;
  	}
- #endif
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3285,13 +3285,19 @@ static int ieee80211_cfg_get_channel(str
- 				     struct cfg80211_chan_def *chandef)
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
- 	struct ieee80211_chanctx_conf *chanctx_conf;
- 	int ret = -ENODATA;
- 
- 	rcu_read_lock();
--	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
--	if (chanctx_conf) {
--		*chandef = chanctx_conf->def;
+ 
+ 	ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+ 
+-	if (sdata->local->use_chanctx) {
 +	if (local->use_chanctx) {
-+		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-+		if (chanctx_conf) {
-+			*chandef = chanctx_conf->def;
-+			ret = 0;
-+		}
-+	} else if (local->open_count == local->monitors) {
-+		*chandef = local->monitor_chandef;
- 		ret = 0;
+ 		sdata_info(sdata,
+ 			   "not handling channel switch with channel contexts\n");
+-		ieee80211_queue_work(&sdata->local->hw,
++		ieee80211_queue_work(&local->hw,
+ 				     &ifmgd->csa_connection_drop_work);
+ 		return;
  	}
- 	rcu_read_unlock();
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1463,7 +1463,9 @@ static bool ath9k_hw_chip_reset(struct a
- 			reset_type = ATH9K_RESET_POWER_ON;
- 		else
- 			reset_type = ATH9K_RESET_COLD;
--	}
-+	} else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
-+		   (REG_READ(ah, AR_CR) & AR_CR_RXE))
-+		reset_type = ATH9K_RESET_COLD;
  
- 	if (!ath9k_hw_set_reset_reg(ah, reset_type))
- 		return false;
-@@ -1876,13 +1878,12 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+-	mutex_lock(&sdata->local->chanctx_mtx);
++	mutex_lock(&local->chanctx_mtx);
+ 	if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
+-		mutex_unlock(&sdata->local->chanctx_mtx);
++		mutex_unlock(&local->chanctx_mtx);
+ 		return;
+ 	}
+ 	chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
+@@ -1111,40 +1207,39 @@ ieee80211_sta_process_chanswitch(struct 
+ 	if (chanctx->refcount > 1) {
+ 		sdata_info(sdata,
+ 			   "channel switch with multiple interfaces on the same channel, disconnecting\n");
+-		ieee80211_queue_work(&sdata->local->hw,
++		ieee80211_queue_work(&local->hw,
+ 				     &ifmgd->csa_connection_drop_work);
+-		mutex_unlock(&sdata->local->chanctx_mtx);
++		mutex_unlock(&local->chanctx_mtx);
+ 		return;
+ 	}
+-	mutex_unlock(&sdata->local->chanctx_mtx);
++	mutex_unlock(&local->chanctx_mtx);
+ 
+-	sdata->local->csa_channel = new_ch;
++	local->csa_chandef = new_chandef;
+ 
+-	if (sw_elem->mode)
+-		ieee80211_stop_queues_by_reason(&sdata->local->hw,
++	if (mode)
++		ieee80211_stop_queues_by_reason(&local->hw,
+ 				IEEE80211_MAX_QUEUE_MAP,
+ 				IEEE80211_QUEUE_STOP_REASON_CSA);
+ 
+-	if (sdata->local->ops->channel_switch) {
++	if (local->ops->channel_switch) {
+ 		/* use driver's channel switch callback */
+ 		struct ieee80211_channel_switch ch_switch = {
+ 			.timestamp = timestamp,
+-			.block_tx = sw_elem->mode,
+-			.channel = new_ch,
+-			.count = sw_elem->count,
++			.block_tx = mode,
++			.chandef = new_chandef,
++			.count = count,
+ 		};
+ 
+-		drv_channel_switch(sdata->local, &ch_switch);
++		drv_channel_switch(local, &ch_switch);
+ 		return;
+ 	}
  
- 	ENABLE_REGWRITE_BUFFER(ah);
+ 	/* channel switch handled in software */
+-	if (sw_elem->count <= 1)
+-		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
++	if (count <= 1)
++		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
+ 	else
+ 		mod_timer(&ifmgd->chswitch_timer,
+-			  TU_TO_EXP_TIME(sw_elem->count *
+-					 cbss->beacon_interval));
++			  TU_TO_EXP_TIME(count * cbss->beacon_interval));
+ }
  
--	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
--	REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
--		  | macStaId1
-+	REG_RMW(ah, AR_STA_ID1, macStaId1
- 		  | AR_STA_ID1_RTS_USE_DEF
- 		  | (ah->config.
- 		     ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
--		  | ah->sta_id1_defaults);
-+		  | ah->sta_id1_defaults,
-+		  ~AR_STA_ID1_SADH_MASK);
- 	ath_hw_setbssidmask(common);
- 	REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
- 	ath9k_hw_write_associd(ah);
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1236,8 +1236,10 @@ static inline void rt2x00lib_set_if_comb
- 	 */
- 	if_limit = &rt2x00dev->if_limits_ap;
- 	if_limit->max = rt2x00dev->ops->max_ap_intf;
--	if_limit->types = BIT(NL80211_IFTYPE_AP) |
--			BIT(NL80211_IFTYPE_MESH_POINT);
-+	if_limit->types = BIT(NL80211_IFTYPE_AP);
-+#ifdef CONFIG_MAC80211_MESH
-+	if_limit->types |= BIT(NL80211_IFTYPE_MESH_POINT);
-+#endif
+ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+@@ -2120,7 +2215,6 @@ void ieee80211_beacon_loss(struct ieee80
  
- 	/*
- 	 * Build up AP interface combinations structure.
-@@ -1309,7 +1311,9 @@ int rt2x00lib_probe_dev(struct rt2x00_de
- 		rt2x00dev->hw->wiphy->interface_modes |=
- 		    BIT(NL80211_IFTYPE_ADHOC) |
- 		    BIT(NL80211_IFTYPE_AP) |
-+#ifdef CONFIG_MAC80211_MESH
- 		    BIT(NL80211_IFTYPE_MESH_POINT) |
-+#endif
- 		    BIT(NL80211_IFTYPE_WDS);
- 
- 	rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -17,8 +17,6 @@
- #include "rc80211_minstrel_ht.h"
- 
- #define AVG_PKT_SIZE	1200
--#define SAMPLE_COLUMNS	10
--#define EWMA_LEVEL		75
- 
- /* Number of bits for an average sized packet */
- #define MCS_NBITS (AVG_PKT_SIZE << 3)
-@@ -26,11 +24,11 @@
- /* Number of symbols for a packet with (bps) bits per symbol */
- #define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
- 
--/* Transmission time for a packet containing (syms) symbols */
-+/* Transmission time (nanoseconds) for a packet containing (syms) symbols */
- #define MCS_SYMBOL_TIME(sgi, syms)					\
- 	(sgi ?								\
--	  ((syms) * 18 + 4) / 5 :	/* syms * 3.6 us */		\
--	  (syms) << 2			/* syms * 4 us */		\
-+	  ((syms) * 18000 + 4000) / 5 :	/* syms * 3.6 us */		\
-+	  ((syms) * 1000) << 2		/* syms * 4 us */		\
- 	)
+ 	trace_api_beacon_loss(sdata);
  
- /* Transmit duration for the raw data part of an average sized packet */
-@@ -64,9 +62,9 @@
+-	WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
+ 	sdata->u.mgd.connection_loss = false;
+ 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
  }
+@@ -2170,7 +2264,7 @@ static void ieee80211_auth_challenge(str
+ 	u32 tx_flags = 0;
  
- #define CCK_DURATION(_bitrate, _short, _len)		\
--	(10 /* SIFS */ +				\
-+	(1000 * (10 /* SIFS */ +			\
- 	 (_short ? 72 + 24 : 144 + 48 ) +		\
--	 (8 * (_len + 4) * 10) / (_bitrate))
-+	 (8 * (_len + 4) * 10) / (_bitrate)))
+ 	pos = mgmt->u.auth.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
+ 	if (!elems.challenge)
+ 		return;
+ 	auth_data->expected_transaction = 4;
+@@ -2435,7 +2529,7 @@ static bool ieee80211_assoc_success(stru
+ 	}
  
- #define CCK_ACK_DURATION(_bitrate, _short)			\
- 	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
-@@ -129,15 +127,6 @@ const struct mcs_group minstrel_mcs_grou
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+ 	pos = mgmt->u.assoc_resp.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
  
- /*
-- * Perform EWMA (Exponentially Weighted Moving Average) calculation
-- */
--static int
--minstrel_ewma(int old, int new, int weight)
--{
--	return (new * (100 - weight) + old * weight) / 100;
--}
--
--/*
-  * Look up an MCS group index based on mac80211 rate information
-  */
- static int
-@@ -211,20 +200,32 @@ static void
- minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
- {
- 	struct minstrel_rate_stats *mr;
--	unsigned int usecs = 0;
-+	unsigned int nsecs = 0;
-+	unsigned int tp;
-+	unsigned int prob;
+ 	if (!elems.supp_rates) {
+ 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
+@@ -2604,7 +2698,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
+ 		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
  
- 	mr = &mi->groups[group].rates[rate];
-+	prob = mr->probability;
+ 	pos = mgmt->u.assoc_resp.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
  
--	if (mr->probability < MINSTREL_FRAC(1, 10)) {
-+	if (prob < MINSTREL_FRAC(1, 10)) {
- 		mr->cur_tp = 0;
+ 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+ 	    elems.timeout_int &&
+@@ -2659,6 +2753,8 @@ static void ieee80211_rx_bss_info(struct
+ 	struct ieee80211_channel *channel;
+ 	bool need_ps = false;
+ 
++	lockdep_assert_held(&sdata->u.mgd.mtx);
++
+ 	if ((sdata->u.mgd.associated &&
+ 	     ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
+ 	    (sdata->u.mgd.assoc_data &&
+@@ -2689,7 +2785,8 @@ static void ieee80211_rx_bss_info(struct
+ 	if (bss)
+ 		ieee80211_rx_bss_put(local, bss);
+ 
+-	if (!sdata->u.mgd.associated)
++	if (!sdata->u.mgd.associated ||
++	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
  		return;
+ 
+ 	if (need_ps) {
+@@ -2698,10 +2795,8 @@ static void ieee80211_rx_bss_info(struct
+ 		mutex_unlock(&local->iflist_mtx);
  	}
  
-+	/*
-+	 * For the throughput calculation, limit the probability value to 90% to
-+	 * account for collision related packet error rate fluctuation
-+	 */
-+	if (prob > MINSTREL_FRAC(9, 10))
-+		prob = MINSTREL_FRAC(9, 10);
-+
- 	if (group != MINSTREL_CCK_GROUP)
--		usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
-+		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+-	if (elems->ch_switch_ie &&
+-	    memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
+-		ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
+-						 bss, rx_status->mactime);
++	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime, elems);
 +
-+	nsecs += minstrel_mcs_groups[group].duration[rate];
-+	tp = 1000000 * ((mr->probability * 1000) / nsecs);
- 
--	usecs += minstrel_mcs_groups[group].duration[rate];
--	mr->cur_tp = MINSTREL_TRUNC((1000000 / usecs) * mr->probability);
-+	mr->cur_tp = MINSTREL_TRUNC(tp);
  }
  
- /*
-@@ -308,8 +309,8 @@ minstrel_ht_update_stats(struct minstrel
+ 
+@@ -2726,7 +2821,7 @@ static void ieee80211_rx_mgmt_probe_resp
+ 		return;
+ 
+ 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+-				&elems);
++			       false, &elems);
+ 
+ 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+ 
+@@ -2809,7 +2904,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
+ 	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
+ 	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
+ 		ieee802_11_parse_elems(mgmt->u.beacon.variable,
+-				       len - baselen, &elems);
++				       len - baselen, false, &elems);
+ 
+ 		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+ 		ifmgd->assoc_data->have_beacon = true;
+@@ -2919,7 +3014,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
+ 
+ 	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+ 	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
+-					  len - baselen, &elems,
++					  len - baselen, false, &elems,
+ 					  care_about_ies, ncrc);
+ 
+ 	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
+@@ -3066,6 +3161,8 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 	enum rx_mgmt_action rma = RX_MGMT_NONE;
+ 	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
+ 	u16 fc;
++	struct ieee802_11_elems elems;
++	int ies_len;
+ 
+ 	rx_status = (struct ieee80211_rx_status *) skb->cb;
+ 	mgmt = (struct ieee80211_mgmt *) skb->data;
+@@ -3095,14 +3192,48 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 		rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
+ 		break;
+ 	case IEEE80211_STYPE_ACTION:
+-		switch (mgmt->u.action.category) {
+-		case WLAN_CATEGORY_SPECTRUM_MGMT:
++		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
++			ies_len = skb->len -
++				  offsetof(struct ieee80211_mgmt,
++					   u.action.u.chan_switch.variable);
++
++			if (ies_len < 0)
++				break;
++
++			ieee802_11_parse_elems(
++				mgmt->u.action.u.chan_switch.variable,
++				ies_len, true, &elems);
++
++			if (elems.parse_error)
++				break;
++
+ 			ieee80211_sta_process_chanswitch(sdata,
+-					&mgmt->u.action.u.chan_switch.sw_elem,
+-					(void *)ifmgd->associated->priv,
+-					rx_status->mactime);
+-			break;
++							 rx_status->mactime,
++							 &elems);
++		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
++			ies_len = skb->len -
++				  offsetof(struct ieee80211_mgmt,
++					   u.action.u.ext_chan_switch.variable);
++
++			if (ies_len < 0)
++				break;
++
++			ieee802_11_parse_elems(
++				mgmt->u.action.u.ext_chan_switch.variable,
++				ies_len, true, &elems);
++
++			if (elems.parse_error)
++				break;
++
++			/* for the handling code pretend this was also an IE */
++			elems.ext_chansw_ie =
++				&mgmt->u.action.u.ext_chan_switch.data;
++
++			ieee80211_sta_process_chanswitch(sdata,
++							 rx_status->mactime,
++							 &elems);
  		}
++		break;
  	}
+ 	mutex_unlock(&ifmgd->mtx);
  
--	/* try to sample up to half of the available rates during each interval */
--	mi->sample_count *= 4;
-+	/* try to sample all available rates during each interval */
-+	mi->sample_count *= 8;
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -38,8 +38,8 @@ int __ieee80211_suspend(struct ieee80211
+ 					IEEE80211_MAX_QUEUE_MAP,
+ 					IEEE80211_QUEUE_STOP_REASON_SUSPEND);
  
- 	cur_prob = 0;
- 	cur_prob_tp = 0;
-@@ -320,20 +321,13 @@ minstrel_ht_update_stats(struct minstrel
- 		if (!mg->supported)
- 			continue;
+-	/* flush out all packets */
+-	synchronize_net();
++	/* flush out all packets and station cleanup call_rcu()s */
++	rcu_barrier();
  
--		mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
--		if (cur_prob_tp < mr->cur_tp &&
--		    minstrel_mcs_groups[group].streams == 1) {
--			mi->max_prob_rate = mg->max_prob_rate;
--			cur_prob = mr->cur_prob;
--			cur_prob_tp = mr->cur_tp;
--		}
--
- 		mr = minstrel_get_ratestats(mi, mg->max_tp_rate);
- 		if (cur_tp < mr->cur_tp) {
- 			mi->max_tp_rate2 = mi->max_tp_rate;
- 			cur_tp2 = cur_tp;
- 			mi->max_tp_rate = mg->max_tp_rate;
- 			cur_tp = mr->cur_tp;
-+			mi->max_prob_streams = minstrel_mcs_groups[group].streams - 1;
- 		}
+ 	ieee80211_flush_queues(local, NULL);
+ 
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -252,6 +252,25 @@ rate_lowest_non_cck_index(struct ieee802
+ 	return 0;
+ }
  
- 		mr = minstrel_get_ratestats(mi, mg->max_tp_rate2);
-@@ -343,6 +337,23 @@ minstrel_ht_update_stats(struct minstrel
++static void __rate_control_send_low(struct ieee80211_hw *hw,
++				    struct ieee80211_supported_band *sband,
++				    struct ieee80211_sta *sta,
++				    struct ieee80211_tx_info *info)
++{
++	if ((sband->band != IEEE80211_BAND_2GHZ) ||
++	    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
++		info->control.rates[0].idx = rate_lowest_index(sband, sta);
++	else
++		info->control.rates[0].idx =
++			rate_lowest_non_cck_index(sband, sta);
++
++	info->control.rates[0].count =
++		(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
++		1 : hw->max_rate_tries;
++
++	info->control.skip_table = 1;
++}
++
+ 
+ bool rate_control_send_low(struct ieee80211_sta *sta,
+ 			   void *priv_sta,
+@@ -262,16 +281,8 @@ bool rate_control_send_low(struct ieee80
+ 	int mcast_rate;
+ 
+ 	if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
+-		if ((sband->band != IEEE80211_BAND_2GHZ) ||
+-		    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
+-			info->control.rates[0].idx =
+-				rate_lowest_index(txrc->sband, sta);
+-		else
+-			info->control.rates[0].idx =
+-				rate_lowest_non_cck_index(txrc->sband, sta);
+-		info->control.rates[0].count =
+-			(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+-			1 : txrc->hw->max_rate_tries;
++		__rate_control_send_low(txrc->hw, sband, sta, info);
++
+ 		if (!sta && txrc->bss) {
+ 			mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
+ 			if (mcast_rate > 0) {
+@@ -355,7 +366,8 @@ static bool rate_idx_match_mcs_mask(stru
+ 
+ 
+ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
+-				struct ieee80211_tx_rate_control *txrc,
++				struct ieee80211_supported_band *sband,
++				enum nl80211_chan_width chan_width,
+ 				u32 mask,
+ 				u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
+ {
+@@ -375,27 +387,17 @@ static void rate_idx_match_mask(struct i
+ 				  IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
+ 		alt_rate.count = rate->count;
+ 		if (rate_idx_match_legacy_mask(&alt_rate,
+-					       txrc->sband->n_bitrates,
+-					       mask)) {
++					       sband->n_bitrates, mask)) {
+ 			*rate = alt_rate;
+ 			return;
  		}
- 	}
+ 	} else {
+-		struct sk_buff *skb = txrc->skb;
+-		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+-		__le16 fc;
+-
+ 		/* handle legacy rates */
+-		if (rate_idx_match_legacy_mask(rate, txrc->sband->n_bitrates,
+-					       mask))
++		if (rate_idx_match_legacy_mask(rate, sband->n_bitrates, mask))
+ 			return;
+ 
+ 		/* if HT BSS, and we handle a data frame, also try HT rates */
+-		if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+-			return;
+-
+-		fc = hdr->frame_control;
+-		if (!ieee80211_is_data(fc))
++		if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
+ 			return;
+ 
+ 		alt_rate.idx = 0;
+@@ -408,7 +410,7 @@ static void rate_idx_match_mask(struct i
+ 
+ 		alt_rate.flags |= IEEE80211_TX_RC_MCS;
+ 
+-		if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_40)
++		if (chan_width == NL80211_CHAN_WIDTH_40)
+ 			alt_rate.flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
  
-+	if (mi->max_prob_streams < 1)
-+		mi->max_prob_streams = 1;
+ 		if (rate_idx_match_mcs_mask(&alt_rate, mcs_mask)) {
+@@ -426,6 +428,228 @@ static void rate_idx_match_mask(struct i
+ 	 */
+ }
+ 
++static void rate_fixup_ratelist(struct ieee80211_vif *vif,
++				struct ieee80211_supported_band *sband,
++				struct ieee80211_tx_info *info,
++				struct ieee80211_tx_rate *rates,
++				int max_rates)
++{
++	struct ieee80211_rate *rate;
++	bool inval = false;
++	int i;
 +
-+	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		mg = &mi->groups[group];
-+		if (!mg->supported)
++	/*
++	 * Set up the RTS/CTS rate as the fastest basic rate
++	 * that is not faster than the data rate unless there
++	 * is no basic rate slower than the data rate, in which
++	 * case we pick the slowest basic rate
++	 *
++	 * XXX: Should this check all retry rates?
++	 */
++	if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
++		u32 basic_rates = vif->bss_conf.basic_rates;
++		s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
++
++		rate = &sband->bitrates[rates[0].idx];
++
++		for (i = 0; i < sband->n_bitrates; i++) {
++			/* must be a basic rate */
++			if (!(basic_rates & BIT(i)))
++				continue;
++			/* must not be faster than the data rate */
++			if (sband->bitrates[i].bitrate > rate->bitrate)
++				continue;
++			/* maximum */
++			if (sband->bitrates[baserate].bitrate <
++			     sband->bitrates[i].bitrate)
++				baserate = i;
++		}
++
++		info->control.rts_cts_rate_idx = baserate;
++	}
++
++	for (i = 0; i < max_rates; i++) {
++		/*
++		 * make sure there's no valid rate following
++		 * an invalid one, just in case drivers don't
++		 * take the API seriously to stop at -1.
++		 */
++		if (inval) {
++			rates[i].idx = -1;
 +			continue;
-+		mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
-+		if (cur_prob_tp < mr->cur_tp &&
-+		    minstrel_mcs_groups[group].streams <= mi->max_prob_streams) {
-+			mi->max_prob_rate = mg->max_prob_rate;
-+			cur_prob = mr->cur_prob;
-+			cur_prob_tp = mr->cur_tp;
 +		}
++		if (rates[i].idx < 0) {
++			inval = true;
++			continue;
++		}
++
++		/*
++		 * For now assume MCS is already set up correctly, this
++		 * needs to be fixed.
++		 */
++		if (rates[i].flags & IEEE80211_TX_RC_MCS) {
++			WARN_ON(rates[i].idx > 76);
++
++			if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
++			    info->control.use_cts_prot)
++				rates[i].flags |=
++					IEEE80211_TX_RC_USE_CTS_PROTECT;
++			continue;
++		}
++
++		if (rates[i].flags & IEEE80211_TX_RC_VHT_MCS) {
++			WARN_ON(ieee80211_rate_get_vht_mcs(&rates[i]) > 9);
++			continue;
++		}
++
++		/* set up RTS protection if desired */
++		if (info->control.use_rts) {
++			rates[i].flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++			info->control.use_cts_prot = false;
++		}
++
++		/* RC is busted */
++		if (WARN_ON_ONCE(rates[i].idx >= sband->n_bitrates)) {
++			rates[i].idx = -1;
++			continue;
++		}
++
++		rate = &sband->bitrates[rates[i].idx];
++
++		/* set up short preamble */
++		if (info->control.short_preamble &&
++		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
++			rates[i].flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
++
++		/* set up G protection */
++		if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
++		    info->control.use_cts_prot &&
++		    rate->flags & IEEE80211_RATE_ERP_G)
++			rates[i].flags |= IEEE80211_TX_RC_USE_CTS_PROTECT;
++	}
++}
++
++
++static void rate_control_fill_sta_table(struct ieee80211_sta *sta,
++					struct ieee80211_tx_info *info,
++					struct ieee80211_tx_rate *rates,
++					int max_rates)
++{
++	struct ieee80211_sta_rates *ratetbl = NULL;
++	int i;
++
++	if (sta && !info->control.skip_table)
++		ratetbl = rcu_dereference(sta->rates);
++
++	/* Fill remaining rate slots with data from the sta rate table. */
++	max_rates = min_t(int, max_rates, IEEE80211_TX_RATE_TABLE_SIZE);
++	for (i = 0; i < max_rates; i++) {
++		if (i < ARRAY_SIZE(info->control.rates) &&
++		    info->control.rates[i].idx >= 0 &&
++		    info->control.rates[i].count) {
++			if (rates != info->control.rates)
++				rates[i] = info->control.rates[i];
++		} else if (ratetbl) {
++			rates[i].idx = ratetbl->rate[i].idx;
++			rates[i].flags = ratetbl->rate[i].flags;
++			if (info->control.use_rts)
++				rates[i].count = ratetbl->rate[i].count_rts;
++			else if (info->control.use_cts_prot)
++				rates[i].count = ratetbl->rate[i].count_cts;
++			else
++				rates[i].count = ratetbl->rate[i].count;
++		} else {
++			rates[i].idx = -1;
++			rates[i].count = 0;
++		}
++
++		if (rates[i].idx < 0 || !rates[i].count)
++			break;
++	}
++}
++
++static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
++				    struct ieee80211_sta *sta,
++				    struct ieee80211_supported_band *sband,
++				    struct ieee80211_tx_info *info,
++				    struct ieee80211_tx_rate *rates,
++				    int max_rates)
++{
++	enum nl80211_chan_width chan_width;
++	u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
++	bool has_mcs_mask;
++	u32 mask;
++	int i;
++
++	/*
++	 * Try to enforce the rateidx mask the user wanted. skip this if the
++	 * default mask (allow all rates) is used to save some processing for
++	 * the common case.
++	 */
++	mask = sdata->rc_rateidx_mask[info->band];
++	has_mcs_mask = sdata->rc_has_mcs_mask[info->band];
++	if (mask == (1 << sband->n_bitrates) - 1 && !has_mcs_mask)
++		return;
++
++	if (has_mcs_mask)
++		memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
++		       sizeof(mcs_mask));
++	else
++		memset(mcs_mask, 0xff, sizeof(mcs_mask));
++
++	if (sta) {
++		/* Filter out rates that the STA does not support */
++		mask &= sta->supp_rates[info->band];
++		for (i = 0; i < sizeof(mcs_mask); i++)
++			mcs_mask[i] &= sta->ht_cap.mcs.rx_mask[i];
++	}
++
++	/*
++	 * Make sure the rate index selected for each TX rate is
++	 * included in the configured mask and change the rate indexes
++	 * if needed.
++	 */
++	chan_width = sdata->vif.bss_conf.chandef.width;
++	for (i = 0; i < max_rates; i++) {
++		/* Skip invalid rates */
++		if (rates[i].idx < 0)
++			break;
++
++		rate_idx_match_mask(&rates[i], sband, mask, chan_width,
++				    mcs_mask);
++	}
++}
++
++void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
++			    struct ieee80211_sta *sta,
++			    struct sk_buff *skb,
++			    struct ieee80211_tx_rate *dest,
++			    int max_rates)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_supported_band *sband;
++
++	rate_control_fill_sta_table(sta, info, dest, max_rates);
++
++	if (!vif)
++		return;
++
++	sdata = vif_to_sdata(vif);
++	sband = sdata->local->hw.wiphy->bands[info->band];
++
++	if (ieee80211_is_data(hdr->frame_control))
++		rate_control_apply_mask(sdata, sta, sband, info, dest, max_rates);
++
++	if (dest[0].idx < 0)
++		__rate_control_send_low(&sdata->local->hw, sband, sta, info);
++
++	if (sta)
++		rate_fixup_ratelist(vif, sband, info, dest, max_rates);
++}
++EXPORT_SYMBOL(ieee80211_get_tx_rates);
++
+ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
+ 			   struct sta_info *sta,
+ 			   struct ieee80211_tx_rate_control *txrc)
+@@ -435,8 +659,6 @@ void rate_control_get_rate(struct ieee80
+ 	struct ieee80211_sta *ista = NULL;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+ 	int i;
+-	u32 mask;
+-	u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
+ 
+ 	if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
+ 		ista = &sta->sta;
+@@ -454,37 +676,27 @@ void rate_control_get_rate(struct ieee80
+ 
+ 	ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+ 
+-	/*
+-	 * Try to enforce the rateidx mask the user wanted. skip this if the
+-	 * default mask (allow all rates) is used to save some processing for
+-	 * the common case.
+-	 */
+-	mask = sdata->rc_rateidx_mask[info->band];
+-	memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
+-	       sizeof(mcs_mask));
+-	if (mask != (1 << txrc->sband->n_bitrates) - 1) {
+-		if (sta) {
+-			/* Filter out rates that the STA does not support */
+-			mask &= sta->sta.supp_rates[info->band];
+-			for (i = 0; i < sizeof(mcs_mask); i++)
+-				mcs_mask[i] &= sta->sta.ht_cap.mcs.rx_mask[i];
+-		}
+-		/*
+-		 * Make sure the rate index selected for each TX rate is
+-		 * included in the configured mask and change the rate indexes
+-		 * if needed.
+-		 */
+-		for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+-			/* Skip invalid rates */
+-			if (info->control.rates[i].idx < 0)
+-				break;
+-			rate_idx_match_mask(&info->control.rates[i], txrc,
+-					    mask, mcs_mask);
+-		}
+-	}
++	if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
++		return;
+ 
+-	BUG_ON(info->control.rates[0].idx < 0);
++	ieee80211_get_tx_rates(&sdata->vif, ista, txrc->skb,
++			       info->control.rates,
++			       ARRAY_SIZE(info->control.rates));
++}
++
++int rate_control_set_rates(struct ieee80211_hw *hw,
++			   struct ieee80211_sta *pubsta,
++			   struct ieee80211_sta_rates *rates)
++{
++	struct ieee80211_sta_rates *old = rcu_dereference(pubsta->rates);
++
++	rcu_assign_pointer(pubsta->rates, rates);
++	if (old)
++		kfree_rcu(old, rcu_head);
++
++	return 0;
+ }
++EXPORT_SYMBOL(rate_control_set_rates);
+ 
+ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
+ 				 const char *name)
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -84,6 +84,50 @@ minstrel_sort_best_tp_rates(struct minst
+ }
+ 
+ static void
++minstrel_set_rate(struct minstrel_sta_info *mi, struct ieee80211_sta_rates *ratetbl,
++		  int offset, int idx)
++{
++	struct minstrel_rate *r = &mi->r[idx];
++
++	ratetbl->rate[offset].idx = r->rix;
++	ratetbl->rate[offset].count = r->adjusted_retry_count;
++	ratetbl->rate[offset].count_cts = r->retry_count_cts;
++	ratetbl->rate[offset].count_rts = r->retry_count_rtscts;
++}
++
++static void
++minstrel_update_rates(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
++{
++	struct ieee80211_sta_rates *ratetbl;
++	int i = 0;
++
++	ratetbl = kzalloc(sizeof(*ratetbl), GFP_ATOMIC);
++	if (!ratetbl)
++		return;
++
++	/* Start with max_tp_rate */
++	minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[0]);
++
++	if (mp->hw->max_rates >= 3) {
++		/* At least 3 tx rates supported, use max_tp_rate2 next */
++		minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[1]);
++	}
++
++	if (mp->hw->max_rates >= 2) {
++		/* At least 2 tx rates supported, use max_prob_rate next */
++		minstrel_set_rate(mi, ratetbl, i++, mi->max_prob_rate);
 +	}
 +
++	/* Use lowest rate last */
++	ratetbl->rate[i].idx = mi->lowest_rix;
++	ratetbl->rate[i].count = mp->max_retry;
++	ratetbl->rate[i].count_cts = mp->max_retry;
++	ratetbl->rate[i].count_rts = mp->max_retry;
++
++	rate_control_set_rates(mp->hw, mi->sta, ratetbl);
++}
 +
++static void
+ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
+ {
+ 	u8 tmp_tp_rate[MAX_THR_RATES];
+@@ -161,6 +205,8 @@ minstrel_update_stats(struct minstrel_pr
+ 
+ 	/* Reset update timer */
  	mi->stats_update = jiffies;
++
++	minstrel_update_rates(mp, mi);
  }
  
-@@ -467,7 +478,7 @@ minstrel_ht_tx_status(void *priv, struct
+ static void
+@@ -209,9 +255,9 @@ minstrel_get_retry_count(struct minstrel
+ {
+ 	unsigned int retry = mr->adjusted_retry_count;
+ 
+-	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
++	if (info->control.use_rts)
+ 		retry = max(2U, min(mr->retry_count_rtscts, retry));
+-	else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
++	else if (info->control.use_cts_prot)
+ 		retry = max(2U, min(mr->retry_count_cts, retry));
+ 	return retry;
+ }
+@@ -240,13 +286,12 @@ minstrel_get_rate(void *priv, struct iee
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct minstrel_sta_info *mi = priv_sta;
+ 	struct minstrel_priv *mp = priv;
+-	struct ieee80211_tx_rate *ar = info->control.rates;
+-	unsigned int ndx, sample_ndx = 0;
++	struct ieee80211_tx_rate *rate = &info->control.rates[0];
++	struct minstrel_rate *msr, *mr;
++	unsigned int ndx;
+ 	bool mrr_capable;
+-	bool indirect_rate_sampling = false;
+-	bool rate_sampling = false;
+-	int i, delta;
+-	int mrr_ndx[3];
++	bool prev_sample = mi->prev_sample;
++	int delta;
+ 	int sampling_ratio;
+ 
+ 	/* management/no-ack frames do not use rate control */
+@@ -262,107 +307,75 @@ minstrel_get_rate(void *priv, struct iee
+ 	else
+ 		sampling_ratio = mp->lookaround_rate;
  
- 	if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
- 		mi->sample_wait = 16 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
--		mi->sample_tries = 2;
-+		mi->sample_tries = 1;
- 		mi->sample_count--;
+-	/* init rateindex [ndx] with max throughput rate */
+-	ndx = mi->max_tp_rate[0];
+-
+ 	/* increase sum packet counter */
+ 	mi->packet_count++;
+ 
+ 	delta = (mi->packet_count * sampling_ratio / 100) -
+ 			(mi->sample_count + mi->sample_deferred / 2);
+ 
+-	/* delta > 0: sampling required */
+-	if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
+-		struct minstrel_rate *msr;
+-		if (mi->packet_count >= 10000) {
+-			mi->sample_deferred = 0;
+-			mi->sample_count = 0;
+-			mi->packet_count = 0;
+-		} else if (delta > mi->n_rates * 2) {
+-			/* With multi-rate retry, not every planned sample
+-			 * attempt actually gets used, due to the way the retry
+-			 * chain is set up - [max_tp,sample,prob,lowest] for
+-			 * sample_rate < max_tp.
+-			 *
+-			 * If there's too much sampling backlog and the link
+-			 * starts getting worse, minstrel would start bursting
+-			 * out lots of sampling frames, which would result
+-			 * in a large throughput loss. */
+-			mi->sample_count += (delta - mi->n_rates * 2);
+-		}
++	/* delta < 0: no sampling required */
++	mi->prev_sample = false;
++	if (delta < 0 || (!mrr_capable && prev_sample))
++		return;
+ 
+-		/* get next random rate sample */
+-		sample_ndx = minstrel_get_next_sample(mi);
+-		msr = &mi->r[sample_ndx];
+-		rate_sampling = true;
+-
+-		/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
+-		 * rate sampling method should be used.
+-		 * Respect such rates that are not sampled for 20 interations.
+-		 */
+-		if (mrr_capable &&
+-		    msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
+-		    msr->sample_skipped < 20)
+-				indirect_rate_sampling = true;
+-
+-		if (!indirect_rate_sampling) {
+-			if (msr->sample_limit != 0) {
+-				ndx = sample_ndx;
+-				mi->sample_count++;
+-				if (msr->sample_limit > 0)
+-					msr->sample_limit--;
+-			} else
+-				rate_sampling = false;
+-		} else {
+-			/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
+-			 * packets that have the sampling rate deferred to the
+-			 * second MRR stage. Increase the sample counter only
+-			 * if the deferred sample rate was actually used.
+-			 * Use the sample_deferred counter to make sure that
+-			 * the sampling is not done in large bursts */
+-			info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+-			mi->sample_deferred++;
+-		}
++	if (mi->packet_count >= 10000) {
++		mi->sample_deferred = 0;
++		mi->sample_count = 0;
++		mi->packet_count = 0;
++	} else if (delta > mi->n_rates * 2) {
++		/* With multi-rate retry, not every planned sample
++		 * attempt actually gets used, due to the way the retry
++		 * chain is set up - [max_tp,sample,prob,lowest] for
++		 * sample_rate < max_tp.
++		 *
++		 * If there's too much sampling backlog and the link
++		 * starts getting worse, minstrel would start bursting
++		 * out lots of sampling frames, which would result
++		 * in a large throughput loss. */
++		mi->sample_count += (delta - mi->n_rates * 2);
++	}
++
++	/* get next random rate sample */
++	ndx = minstrel_get_next_sample(mi);
++	msr = &mi->r[ndx];
++	mr = &mi->r[mi->max_tp_rate[0]];
++
++	/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
++	 * rate sampling method should be used.
++	 * Respect such rates that are not sampled for 20 interations.
++	 */
++	if (mrr_capable &&
++	    msr->perfect_tx_time > mr->perfect_tx_time &&
++	    msr->sample_skipped < 20) {
++		/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
++		 * packets that have the sampling rate deferred to the
++		 * second MRR stage. Increase the sample counter only
++		 * if the deferred sample rate was actually used.
++		 * Use the sample_deferred counter to make sure that
++		 * the sampling is not done in large bursts */
++		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++		rate++;
++		mi->sample_deferred++;
++	} else {
++		if (!msr->sample_limit != 0)
++			return;
++
++		mi->sample_count++;
++		if (msr->sample_limit > 0)
++			msr->sample_limit--;
  	}
+-	mi->prev_sample = rate_sampling;
  
-@@ -536,7 +547,7 @@ minstrel_calc_retransmit(struct minstrel
- 	mr->retry_updated = true;
+ 	/* If we're not using MRR and the sampling rate already
+ 	 * has a probability of >95%, we shouldn't be attempting
+ 	 * to use it, as this only wastes precious airtime */
+-	if (!mrr_capable && rate_sampling &&
++	if (!mrr_capable &&
+ 	   (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
+-		ndx = mi->max_tp_rate[0];
+-
+-	/* mrr setup for 1st stage */
+-	ar[0].idx = mi->r[ndx].rix;
+-	ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
+-
+-	/* non mrr setup for 2nd stage */
+-	if (!mrr_capable) {
+-		if (!rate_sampling)
+-			ar[0].count = mp->max_retry;
+-		ar[1].idx = mi->lowest_rix;
+-		ar[1].count = mp->max_retry;
+ 		return;
+-	}
  
- 	group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
--	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len;
-+	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len / 1000;
+-	/* mrr setup for 2nd stage */
+-	if (rate_sampling) {
+-		if (indirect_rate_sampling)
+-			mrr_ndx[0] = sample_ndx;
+-		else
+-			mrr_ndx[0] = mi->max_tp_rate[0];
+-	} else {
+-		mrr_ndx[0] = mi->max_tp_rate[1];
+-	}
++	mi->prev_sample = true;
+ 
+-	/* mrr setup for 3rd & 4th stage */
+-	mrr_ndx[1] = mi->max_prob_rate;
+-	mrr_ndx[2] = 0;
+-	for (i = 1; i < 4; i++) {
+-		ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
+-		ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
+-	}
++	rate->idx = mi->r[ndx].rix;
++	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
+ }
  
- 	/* Contention time for first 2 tries */
- 	ctime = (t_slot * cw) >> 1;
-@@ -616,6 +627,7 @@ minstrel_get_sample_rate(struct minstrel
- {
- 	struct minstrel_rate_stats *mr;
- 	struct minstrel_mcs_group_data *mg;
-+	unsigned int sample_dur, sample_group;
- 	int sample_idx = 0;
- 
- 	if (mi->sample_wait > 0) {
-@@ -626,39 +638,46 @@ minstrel_get_sample_rate(struct minstrel
- 	if (!mi->sample_tries)
- 		return -1;
- 
--	mi->sample_tries--;
- 	mg = &mi->groups[mi->sample_group];
- 	sample_idx = sample_table[mg->column][mg->index];
- 	mr = &mg->rates[sample_idx];
--	sample_idx += mi->sample_group * MCS_GROUP_RATES;
-+	sample_group = mi->sample_group;
-+	sample_idx += sample_group * MCS_GROUP_RATES;
- 	minstrel_next_sample_idx(mi);
  
- 	/*
- 	 * Sampling might add some overhead (RTS, no aggregation)
- 	 * to the frame. Hence, don't use sampling for the currently
--	 * used max TP rate.
-+	 * used rates.
- 	 */
--	if (sample_idx == mi->max_tp_rate)
-+	if (sample_idx == mi->max_tp_rate ||
-+	    sample_idx == mi->max_tp_rate2 ||
-+	    sample_idx == mi->max_prob_rate)
- 		return -1;
-+
- 	/*
--	 * When not using MRR, do not sample if the probability is already
--	 * higher than 95% to avoid wasting airtime
-+	 * Do not sample if the probability is already higher than 95%
-+	 * to avoid wasting airtime.
- 	 */
--	if (!mp->has_mrr && (mr->probability > MINSTREL_FRAC(95, 100)))
-+	if (mr->probability > MINSTREL_FRAC(95, 100))
- 		return -1;
+@@ -412,12 +425,16 @@ minstrel_rate_init(void *priv, struct ie
+ 	unsigned int i, n = 0;
+ 	unsigned int t_slot = 9; /* FIXME: get real slot time */
  
- 	/*
- 	 * Make sure that lower rates get sampled only occasionally,
- 	 * if the link is working perfectly.
- 	 */
--	if (minstrel_get_duration(sample_idx) >
--	    minstrel_get_duration(mi->max_tp_rate)) {
-+	sample_dur = minstrel_get_duration(sample_idx);
-+	if (sample_dur >= minstrel_get_duration(mi->max_tp_rate2) &&
-+	    (mi->max_prob_streams <
-+	     minstrel_mcs_groups[sample_group].streams ||
-+	     sample_dur >= minstrel_get_duration(mi->max_prob_rate))) {
- 		if (mr->sample_skipped < 20)
- 			return -1;
- 
- 		if (mi->sample_slow++ > 2)
- 			return -1;
++	mi->sta = sta;
+ 	mi->lowest_rix = rate_lowest_index(sband, sta);
+ 	ctl_rate = &sband->bitrates[mi->lowest_rix];
+ 	mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
+ 				ctl_rate->bitrate,
+ 				!!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+ 
++	memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
++	mi->max_prob_rate = 0;
++
+ 	for (i = 0; i < sband->n_bitrates; i++) {
+ 		struct minstrel_rate *mr = &mi->r[n];
+ 		unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
+@@ -460,6 +477,8 @@ minstrel_rate_init(void *priv, struct ie
+ 		} while ((tx_time < mp->segment_size) &&
+ 				(++mr->retry_count < mp->max_retry));
+ 		mr->adjusted_retry_count = mr->retry_count;
++		if (!(sband->bitrates[i].flags & IEEE80211_RATE_ERP_G))
++			mr->retry_count_cts = mr->retry_count;
  	}
-+	mi->sample_tries--;
  
- 	return sample_idx;
+ 	for (i = n; i < sband->n_bitrates; i++) {
+@@ -471,6 +490,7 @@ minstrel_rate_init(void *priv, struct ie
+ 	mi->stats_update = jiffies;
+ 
+ 	init_sample_table(mi);
++	minstrel_update_rates(mp, mi);
  }
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -16,11 +16,6 @@
- #define MINSTREL_MAX_STREAMS	3
- #define MINSTREL_STREAM_GROUPS	4
- 
--/* scaled fraction values */
--#define MINSTREL_SCALE	16
--#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
--#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
--
- #define MCS_GROUP_RATES	8
  
- struct mcs_group {
-@@ -85,6 +80,7 @@ struct minstrel_ht_sta {
+ static void *
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -9,7 +9,8 @@
+ #ifndef __RC_MINSTREL_H
+ #define __RC_MINSTREL_H
  
- 	/* best probability rate */
- 	unsigned int max_prob_rate;
-+	unsigned int max_prob_streams;
+-#define EWMA_LEVEL	75	/* ewma weighting factor [%] */
++#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
++#define EWMA_DIV	128
+ #define SAMPLE_COLUMNS	10	/* number of columns in sample table */
  
- 	/* time of last status update */
- 	unsigned long stats_update;
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -1023,6 +1023,7 @@ static bool ar9003_hw_init_cal(struct at
- 					  AR_PHY_AGC_CONTROL_FLTR_CAL   |
- 					  AR_PHY_AGC_CONTROL_PKDET_CAL;
- 
-+	/* Use chip chainmask only for calibration */
- 	ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
- 
- 	if (rtt) {
-@@ -1150,6 +1151,9 @@ skip_tx_iqcal:
- 		ar9003_hw_rtt_disable(ah);
- 	}
  
-+	/* Revert chainmask to runtime parameters */
-+	ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+@@ -27,7 +28,7 @@
+ static inline int
+ minstrel_ewma(int old, int new, int weight)
+ {
+-	return (new * (100 - weight) + old * weight) / 100;
++	return (new * (EWMA_DIV - weight) + old * weight) / EWMA_DIV;
+ }
+ 
+ 
+@@ -62,6 +63,8 @@ struct minstrel_rate {
+ };
+ 
+ struct minstrel_sta_info {
++	struct ieee80211_sta *sta;
 +
- 	/* Initialize list pointers */
- 	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+ 	unsigned long stats_update;
+ 	unsigned int sp_ack_dur;
+ 	unsigned int rate_avg;
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -68,7 +68,7 @@ minstrel_stats_open(struct inode *inode,
  
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-@@ -3606,6 +3606,12 @@ static void ar9003_hw_ant_ctrl_apply(str
- 	value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
- 	REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
+ 	file->private_data = ms;
+ 	p = ms->buf;
+-	p += sprintf(p, "rate     throughput  ewma prob   this prob  "
++	p += sprintf(p, "rate      throughput  ewma prob  this prob  "
+ 			"this succ/attempt   success    attempts\n");
+ 	for (i = 0; i < mi->n_rates; i++) {
+ 		struct minstrel_rate *mr = &mi->r[i];
+@@ -86,7 +86,7 @@ minstrel_stats_open(struct inode *inode,
+ 		eprob = MINSTREL_TRUNC(mr->probability * 1000);
  
-+	if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
-+		value = ar9003_hw_ant_ctrl_chain_get(ah, 1, is2ghz);
-+		REG_RMW_FIELD(ah, switch_chain_reg[0],
-+			      AR_SWITCH_TABLE_ALL, value);
-+	}
+ 		p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
+-				"%3u(%3u)   %8llu    %8llu\n",
++				"   %3u(%3u)  %8llu    %8llu\n",
+ 				tp / 10, tp % 10,
+ 				eprob / 10, eprob % 10,
+ 				prob / 10, prob % 10,
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -126,6 +126,9 @@ const struct mcs_group minstrel_mcs_grou
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+ 
++static void
++minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
 +
- 	for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
- 		if ((ah->rxchainmask & BIT(chain)) ||
- 		    (ah->txchainmask & BIT(chain))) {
-@@ -3772,6 +3778,17 @@ static void ar9003_hw_atten_apply(struct
- 					  AR_PHY_EXT_ATTEN_CTL_2,
- 					 };
- 
-+	if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
-+		value = ar9003_hw_atten_chain_get(ah, 1, chan);
-+		REG_RMW_FIELD(ah, ext_atten_reg[0],
-+			      AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
-+
-+		value = ar9003_hw_atten_chain_get_margin(ah, 1, chan);
-+		REG_RMW_FIELD(ah, ext_atten_reg[0],
-+			      AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
-+			      value);
-+	}
+ /*
+  * Look up an MCS group index based on mac80211 rate information
+  */
+@@ -244,6 +247,7 @@ minstrel_ht_update_stats(struct minstrel
+ 	struct minstrel_rate_stats *mr;
+ 	int cur_prob, cur_prob_tp, cur_tp, cur_tp2;
+ 	int group, i, index;
++	bool mi_rates_valid = false;
+ 
+ 	if (mi->ampdu_packets > 0) {
+ 		mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
+@@ -254,11 +258,10 @@ minstrel_ht_update_stats(struct minstrel
+ 
+ 	mi->sample_slow = 0;
+ 	mi->sample_count = 0;
+-	mi->max_tp_rate = 0;
+-	mi->max_tp_rate2 = 0;
+-	mi->max_prob_rate = 0;
+ 
+ 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
++		bool mg_rates_valid = false;
 +
- 	/* Test value. if 0 then attenuation is unused. Don't load anything. */
- 	for (i = 0; i < 3; i++) {
- 		if (ah->txchainmask & BIT(i)) {
---- a/drivers/net/wireless/ath/ath9k/link.c
-+++ b/drivers/net/wireless/ath/ath9k/link.c
-@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct wo
+ 		cur_prob = 0;
+ 		cur_prob_tp = 0;
+ 		cur_tp = 0;
+@@ -268,15 +271,24 @@ minstrel_ht_update_stats(struct minstrel
+ 		if (!mg->supported)
+ 			continue;
+ 
+-		mg->max_tp_rate = 0;
+-		mg->max_tp_rate2 = 0;
+-		mg->max_prob_rate = 0;
+ 		mi->sample_count++;
+ 
+ 		for (i = 0; i < MCS_GROUP_RATES; i++) {
+ 			if (!(mg->supported & BIT(i)))
+ 				continue;
+ 
++			/* initialize rates selections starting indexes */
++			if (!mg_rates_valid) {
++				mg->max_tp_rate = mg->max_tp_rate2 =
++					mg->max_prob_rate = i;
++				if (!mi_rates_valid) {
++					mi->max_tp_rate = mi->max_tp_rate2 =
++						mi->max_prob_rate = i;
++					mi_rates_valid = true;
++				}
++				mg_rates_valid = true;
++			}
++
+ 			mr = &mg->rates[i];
+ 			mr->retry_updated = false;
+ 			index = MCS_GROUP_RATES * group + i;
+@@ -456,7 +468,7 @@ minstrel_ht_tx_status(void *priv, struct
+ 	struct ieee80211_tx_rate *ar = info->status.rates;
+ 	struct minstrel_rate_stats *rate, *rate2;
+ 	struct minstrel_priv *mp = priv;
+-	bool last;
++	bool last, update = false;
  	int i;
- 	bool needreset = false;
- 
--	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
--		if (ATH_TXQ_SETUP(sc, i)) {
--			txq = &sc->tx.txq[i];
--			ath_txq_lock(sc, txq);
--			if (txq->axq_depth) {
--				if (txq->axq_tx_inprogress) {
--					needreset = true;
--					ath_txq_unlock(sc, txq);
--					break;
--				} else {
--					txq->axq_tx_inprogress = true;
--				}
-+	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
-+		txq = sc->tx.txq_map[i];
-+
-+		ath_txq_lock(sc, txq);
-+		if (txq->axq_depth) {
-+			if (txq->axq_tx_inprogress) {
-+				needreset = true;
-+				ath_txq_unlock(sc, txq);
-+				break;
-+			} else {
-+				txq->axq_tx_inprogress = true;
- 			}
--			ath_txq_unlock_complete(sc, txq);
- 		}
-+		ath_txq_unlock_complete(sc, txq);
+ 
+ 	if (!msp->is_ht)
+@@ -505,21 +517,29 @@ minstrel_ht_tx_status(void *priv, struct
+ 	rate = minstrel_get_ratestats(mi, mi->max_tp_rate);
+ 	if (rate->attempts > 30 &&
+ 	    MINSTREL_FRAC(rate->success, rate->attempts) <
+-	    MINSTREL_FRAC(20, 100))
++	    MINSTREL_FRAC(20, 100)) {
+ 		minstrel_downgrade_rate(mi, &mi->max_tp_rate, true);
++		update = true;
 +	}
  
- 	if (needreset) {
- 		ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -766,6 +766,7 @@ int __must_check __sta_info_destroy(stru
- 	struct ieee80211_local *local;
- 	struct ieee80211_sub_if_data *sdata;
- 	int ret, i;
-+	bool have_key = false;
+ 	rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate2);
+ 	if (rate2->attempts > 30 &&
+ 	    MINSTREL_FRAC(rate2->success, rate2->attempts) <
+-	    MINSTREL_FRAC(20, 100))
++	    MINSTREL_FRAC(20, 100)) {
+ 		minstrel_downgrade_rate(mi, &mi->max_tp_rate2, false);
++		update = true;
++	}
  
- 	might_sleep();
+ 	if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
++		update = true;
+ 		minstrel_ht_update_stats(mp, mi);
+ 		if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
+ 		    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
+ 			minstrel_aggr_check(sta, skb);
+ 	}
++
++	if (update)
++		minstrel_ht_update_rates(mp, mi);
+ }
  
-@@ -793,12 +794,19 @@ int __must_check __sta_info_destroy(stru
- 	list_del_rcu(&sta->list);
+ static void
+@@ -580,39 +600,73 @@ minstrel_calc_retransmit(struct minstrel
+ 	         (++mr->retry_count < mp->max_retry));
+ }
  
- 	mutex_lock(&local->key_mtx);
--	for (i = 0; i < NUM_DEFAULT_KEYS; i++)
-+	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
- 		__ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
--	if (sta->ptk)
-+		have_key = true;
-+	}
-+	if (sta->ptk) {
- 		__ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
-+		have_key = true;
+-
+ static void
+ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+-                     struct ieee80211_tx_rate *rate, int index,
+-                     bool sample, bool rtscts)
++                     struct ieee80211_sta_rates *ratetbl, int offset, int index)
+ {
+ 	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+ 	struct minstrel_rate_stats *mr;
++	u8 idx;
++	u16 flags;
+ 
+ 	mr = minstrel_get_ratestats(mi, index);
+ 	if (!mr->retry_updated)
+ 		minstrel_calc_retransmit(mp, mi, index);
+ 
+-	if (sample)
+-		rate->count = 1;
+-	else if (mr->probability < MINSTREL_FRAC(20, 100))
+-		rate->count = 2;
+-	else if (rtscts)
+-		rate->count = mr->retry_count_rtscts;
+-	else
+-		rate->count = mr->retry_count;
+-
+-	rate->flags = 0;
+-	if (rtscts)
+-		rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++	if (mr->probability < MINSTREL_FRAC(20, 100) || !mr->retry_count) {
++		ratetbl->rate[offset].count = 2;
++		ratetbl->rate[offset].count_rts = 2;
++		ratetbl->rate[offset].count_cts = 2;
++	} else {
++		ratetbl->rate[offset].count = mr->retry_count;
++		ratetbl->rate[offset].count_cts = mr->retry_count;
++		ratetbl->rate[offset].count_rts = mr->retry_count_rtscts;
 +	}
- 	mutex_unlock(&local->key_mtx);
  
-+	if (!have_key)
-+		synchronize_net();
+ 	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+-		rate->idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
++		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
++		flags = 0;
++	} else {
++		idx = index % MCS_GROUP_RATES +
++		      (group->streams - 1) * MCS_GROUP_RATES;
++		flags = IEEE80211_TX_RC_MCS | group->flags;
++	}
++
++	if (offset > 0) {
++		ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
++		flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++	}
++
++	ratetbl->rate[offset].idx = idx;
++	ratetbl->rate[offset].flags = flags;
++}
++
++static void
++minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
++{
++	struct ieee80211_sta_rates *rates;
++	int i = 0;
++
++	rates = kzalloc(sizeof(*rates), GFP_ATOMIC);
++	if (!rates)
+ 		return;
 +
- 	sta->dead = true;
++	/* Start with max_tp_rate */
++	minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate);
++
++	if (mp->hw->max_rates >= 3) {
++		/* At least 3 tx rates supported, use max_tp_rate2 next */
++		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate2);
++	}
++
++	if (mp->hw->max_rates >= 2) {
++		/*
++		 * At least 2 tx rates supported, use max_prob_rate next */
++		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
+ 	}
  
- 	local->num_sta--;
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -63,6 +63,7 @@ ieee80211_new_chanctx(struct ieee80211_l
- 		      enum ieee80211_chanctx_mode mode)
+-	rate->flags |= IEEE80211_TX_RC_MCS | group->flags;
+-	rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
++	rates->rate[i].idx = -1;
++	rate_control_set_rates(mp->hw, mi->sta, rates);
+ }
+ 
+ static inline int
+@@ -702,13 +756,13 @@ static void
+ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+                      struct ieee80211_tx_rate_control *txrc)
  {
- 	struct ieee80211_chanctx *ctx;
-+	u32 changed;
- 	int err;
++	const struct mcs_group *sample_group;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+-	struct ieee80211_tx_rate *ar = info->status.rates;
++	struct ieee80211_tx_rate *rate = &info->status.rates[0];
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 	struct minstrel_ht_sta *mi = &msp->ht;
+ 	struct minstrel_priv *mp = priv;
+ 	int sample_idx;
+-	bool sample = false;
  
- 	lockdep_assert_held(&local->chanctx_mtx);
-@@ -76,6 +77,13 @@ ieee80211_new_chanctx(struct ieee80211_l
- 	ctx->conf.rx_chains_dynamic = 1;
- 	ctx->mode = mode;
+ 	if (rate_control_send_low(sta, priv_sta, txrc))
+ 		return;
+@@ -736,51 +790,6 @@ minstrel_ht_get_rate(void *priv, struct 
+ 	}
+ #endif
  
-+	/* acquire mutex to prevent idle from changing */
-+	mutex_lock(&local->mtx);
-+	/* turn idle off *before* setting channel -- some drivers need that */
-+	changed = ieee80211_idle_off(local);
-+	if (changed)
-+		ieee80211_hw_config(local, changed);
-+
- 	if (!local->use_chanctx) {
- 		local->_oper_channel_type =
- 			cfg80211_get_chandef_type(chandef);
-@@ -85,14 +93,17 @@ ieee80211_new_chanctx(struct ieee80211_l
- 		err = drv_add_chanctx(local, ctx);
- 		if (err) {
- 			kfree(ctx);
--			return ERR_PTR(err);
-+			ctx = ERR_PTR(err);
-+
-+			ieee80211_recalc_idle(local);
-+			goto out;
- 		}
+-	if (sample_idx >= 0) {
+-		sample = true;
+-		minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
+-			true, false);
+-		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+-	} else {
+-		minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
+-			false, false);
+-	}
+-
+-	if (mp->hw->max_rates >= 3) {
+-		/*
+-		 * At least 3 tx rates supported, use
+-		 * sample_rate -> max_tp_rate -> max_prob_rate for sampling and
+-		 * max_tp_rate -> max_tp_rate2 -> max_prob_rate by default.
+-		 */
+-		if (sample_idx >= 0)
+-			minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
+-				false, false);
+-		else
+-			minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
+-				false, true);
+-
+-		minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate,
+-				     false, !sample);
+-
+-		ar[3].count = 0;
+-		ar[3].idx = -1;
+-	} else if (mp->hw->max_rates == 2) {
+-		/*
+-		 * Only 2 tx rates supported, use
+-		 * sample_rate -> max_prob_rate for sampling and
+-		 * max_tp_rate -> max_prob_rate by default.
+-		 */
+-		minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_prob_rate,
+-				     false, !sample);
+-
+-		ar[2].count = 0;
+-		ar[2].idx = -1;
+-	} else {
+-		/* Not using MRR, only use the first rate */
+-		ar[1].count = 0;
+-		ar[1].idx = -1;
+-	}
+-
+ 	mi->total_packets++;
+ 
+ 	/* wraparound */
+@@ -788,6 +797,16 @@ minstrel_ht_get_rate(void *priv, struct 
+ 		mi->total_packets = 0;
+ 		mi->sample_packets = 0;
  	}
++
++	if (sample_idx < 0)
++		return;
++
++	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++	rate->idx = sample_idx % MCS_GROUP_RATES +
++		    (sample_group->streams - 1) * MCS_GROUP_RATES;
++	rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
++	rate->count = 1;
+ }
  
-+	/* and keep the mutex held until the new chanctx is on the list */
- 	list_add_rcu(&ctx->list, &local->chanctx_list);
+ static void
+@@ -837,6 +856,8 @@ minstrel_ht_update_caps(void *priv, stru
  
--	mutex_lock(&local->mtx);
--	ieee80211_recalc_idle(local);
-+ out:
- 	mutex_unlock(&local->mtx);
+ 	msp->is_ht = true;
+ 	memset(mi, 0, sizeof(*mi));
++
++	mi->sta = sta;
+ 	mi->stats_update = jiffies;
  
- 	return ctx;
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1366,6 +1366,7 @@ int ieee80211_if_change_type(struct ieee
- 			     enum nl80211_iftype type);
- void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
- void ieee80211_remove_interfaces(struct ieee80211_local *local);
-+u32 ieee80211_idle_off(struct ieee80211_local *local);
- void ieee80211_recalc_idle(struct ieee80211_local *local);
- void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
- 				    const int offset);
---- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
-@@ -799,7 +799,7 @@ static int ath9k_init_firmware_version(s
- 	 * required version.
- 	 */
- 	if (priv->fw_version_major != MAJOR_VERSION_REQ ||
--	    priv->fw_version_minor != MINOR_VERSION_REQ) {
-+	    priv->fw_version_minor < MINOR_VERSION_REQ) {
- 		dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
- 			MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
- 		return -EINVAL;
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -516,8 +516,7 @@ static void ath_tx_complete_aggr(struct 
- 		 * not a holding desc.
- 		 */
- 		INIT_LIST_HEAD(&bf_head);
--		if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) ||
--		    bf_next != NULL || !bf_last->bf_stale)
-+		if (bf_next != NULL || !bf_last->bf_stale)
- 			list_move_tail(&bf->list, &bf_head);
- 
- 		if (!txpending || (tid->state & AGGR_CLEANUP)) {
-@@ -537,8 +536,7 @@ static void ath_tx_complete_aggr(struct 
- 				!txfail);
- 		} else {
- 			/* retry the un-acked ones */
--			if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
--			    bf->bf_next == NULL && bf_last->bf_stale) {
-+			if (bf->bf_next == NULL && bf_last->bf_stale) {
- 				struct ath_buf *tbf;
- 
- 				tbf = ath_clone_txbuf(sc, bf_last);
-@@ -2264,6 +2262,7 @@ void ath_tx_edma_tasklet(struct ath_soft
- 	struct ath_txq *txq;
- 	struct ath_buf *bf, *lastbf;
- 	struct list_head bf_head;
-+	struct list_head *fifo_list;
- 	int status;
- 
- 	for (;;) {
-@@ -2291,20 +2290,24 @@ void ath_tx_edma_tasklet(struct ath_soft
- 
- 		TX_STAT_INC(txq->axq_qnum, txprocdesc);
- 
--		if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
-+		fifo_list = &txq->txq_fifo[txq->txq_tailidx];
-+		if (list_empty(fifo_list)) {
- 			ath_txq_unlock(sc, txq);
- 			return;
- 		}
+ 	ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
+@@ -898,6 +919,9 @@ minstrel_ht_update_caps(void *priv, stru
+ 	if (!n_supported)
+ 		goto use_legacy;
  
--		bf = list_first_entry(&txq->txq_fifo[txq->txq_tailidx],
--				      struct ath_buf, list);
-+		bf = list_first_entry(fifo_list, struct ath_buf, list);
-+		if (bf->bf_stale) {
-+			list_del(&bf->list);
-+			ath_tx_return_buffer(sc, bf);
-+			bf = list_first_entry(fifo_list, struct ath_buf, list);
-+		}
++	minstrel_ht_update_stats(mp, mi);
++	minstrel_ht_update_rates(mp, mi);
 +
- 		lastbf = bf->bf_lastbf;
+ 	return;
  
- 		INIT_LIST_HEAD(&bf_head);
--		list_cut_position(&bf_head, &txq->txq_fifo[txq->txq_tailidx],
--				  &lastbf->list);
--
--		if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
-+		if (list_is_last(&lastbf->list, fifo_list)) {
-+			list_splice_tail_init(fifo_list, &bf_head);
- 			INCR(txq->txq_tailidx, ATH_TXFIFO_DEPTH);
- 
- 			if (!list_empty(&txq->axq_q)) {
-@@ -2315,6 +2318,11 @@ void ath_tx_edma_tasklet(struct ath_soft
- 				list_splice_tail_init(&txq->axq_q, &bf_q);
- 				ath_tx_txqaddbuf(sc, txq, &bf_q, true);
- 			}
-+		} else {
-+			lastbf->bf_stale = true;
-+			if (bf != lastbf)
-+				list_cut_position(&bf_head, fifo_list,
-+						  lastbf->list.prev);
- 		}
+ use_legacy:
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -65,6 +65,8 @@ struct minstrel_mcs_group_data {
+ };
  
- 		ath_tx_process_buffer(sc, txq, &ts, bf, &bf_head);
---- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
-@@ -519,7 +519,7 @@ static const u32 ar9580_1p0_mac_core[][2
- 	{0x00008258, 0x00000000},
- 	{0x0000825c, 0x40000000},
- 	{0x00008260, 0x00080922},
--	{0x00008264, 0x9bc00010},
-+	{0x00008264, 0x9d400010},
- 	{0x00008268, 0xffffffff},
- 	{0x0000826c, 0x0000ffff},
- 	{0x00008270, 0x00000000},
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3955,8 +3955,16 @@ int ieee80211_mgd_auth(struct ieee80211_
- 	/* prep auth_data so we don't go into idle on disassoc */
- 	ifmgd->auth_data = auth_data;
+ struct minstrel_ht_sta {
++	struct ieee80211_sta *sta;
++
+ 	/* ampdu length (average, per sampling interval) */
+ 	unsigned int ampdu_len;
+ 	unsigned int ampdu_packets;
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1372,6 +1372,7 @@ ieee80211_rx_h_sta_process(struct ieee80
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	int i;
+ 
+ 	if (!sta)
+ 		return RX_CONTINUE;
+@@ -1422,6 +1423,19 @@ ieee80211_rx_h_sta_process(struct ieee80
+ 		ewma_add(&sta->avg_signal, -status->signal);
+ 	}
  
--	if (ifmgd->associated)
--		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
-+	if (ifmgd->associated) {
-+		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++	if (status->chains) {
++		sta->chains = status->chains;
++		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
++			int signal = status->chain_signal[i];
 +
-+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-+				       WLAN_REASON_UNSPECIFIED,
-+				       false, frame_buf);
++			if (!(status->chains & BIT(i)))
++				continue;
 +
-+		__cfg80211_send_deauth(sdata->dev, frame_buf,
-+				       sizeof(frame_buf));
++			sta->chain_signal_last[i] = signal;
++			ewma_add(&sta->chain_signal_avg[i], -signal);
++		}
 +	}
++
+ 	/*
+ 	 * Change STA power saving mode only at the end of a frame
+ 	 * exchange sequence.
+@@ -2085,6 +2099,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	}
  
- 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
+ 	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
++	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+ 	info = IEEE80211_SKB_CB(fwd_skb);
+ 	memset(info, 0, sizeof(*info));
+ 	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+@@ -2356,6 +2371,7 @@ ieee80211_rx_h_action(struct ieee80211_r
+ 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+ 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+ 		    sdata->vif.type != NL80211_IFTYPE_AP &&
++		    sdata->vif.type != NL80211_IFTYPE_WDS &&
+ 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+ 			break;
  
-@@ -4016,8 +4024,16 @@ int ieee80211_mgd_assoc(struct ieee80211
+@@ -2423,6 +2439,22 @@ ieee80211_rx_h_action(struct ieee80211_r
+ 		}
  
- 	mutex_lock(&ifmgd->mtx);
+ 		break;
++	case WLAN_CATEGORY_PUBLIC:
++		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
++			goto invalid;
++		if (sdata->vif.type != NL80211_IFTYPE_STATION)
++			break;
++		if (!rx->sta)
++			break;
++		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
++			break;
++		if (mgmt->u.action.u.ext_chan_switch.action_code !=
++				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
++			break;
++		if (len < offsetof(struct ieee80211_mgmt,
++				   u.action.u.ext_chan_switch.variable))
++			goto invalid;
++		goto queue;
+ 	case WLAN_CATEGORY_VHT:
+ 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+ 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+@@ -2506,10 +2538,6 @@ ieee80211_rx_h_action(struct ieee80211_r
+ 			ieee80211_process_measurement_req(sdata, mgmt, len);
+ 			goto handled;
+ 		case WLAN_ACTION_SPCT_CHL_SWITCH:
+-			if (len < (IEEE80211_MIN_ACTION_SIZE +
+-				   sizeof(mgmt->u.action.u.chan_switch)))
+-				break;
+-
+ 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
+ 				break;
  
--	if (ifmgd->associated)
--		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
-+	if (ifmgd->associated) {
-+		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+@@ -2695,14 +2723,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
+ 
+ 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
+ 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+-	    sdata->vif.type != NL80211_IFTYPE_STATION)
++	    sdata->vif.type != NL80211_IFTYPE_STATION &&
++	    sdata->vif.type != NL80211_IFTYPE_WDS)
+ 		return RX_DROP_MONITOR;
+ 
+ 	switch (stype) {
+ 	case cpu_to_le16(IEEE80211_STYPE_AUTH):
+ 	case cpu_to_le16(IEEE80211_STYPE_BEACON):
+ 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+-		/* process for all: mesh, mlme, ibss */
++		/* process for all: mesh, mlme, ibss, wds */
+ 		break;
+ 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+@@ -3031,10 +3060,16 @@ static int prepare_for_handlers(struct i
+ 		}
+ 		break;
+ 	case NL80211_IFTYPE_WDS:
+-		if (bssid || !ieee80211_is_data(hdr->frame_control))
+-			return 0;
+ 		if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
+ 			return 0;
 +
-+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-+				       WLAN_REASON_UNSPECIFIED,
-+				       false, frame_buf);
++		if (ieee80211_is_data(hdr->frame_control) ||
++		    ieee80211_is_action(hdr->frame_control)) {
++			if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
++				return 0;
++		} else if (!ieee80211_is_beacon(hdr->frame_control))
++			return 0;
 +
-+		__cfg80211_send_deauth(sdata->dev, frame_buf,
-+				       sizeof(frame_buf));
-+	}
+ 		break;
+ 	case NL80211_IFTYPE_P2P_DEVICE:
+ 		if (!ieee80211_is_public_action(hdr, skb->len) &&
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -181,7 +181,7 @@ void ieee80211_scan_rx(struct ieee80211_
+ 	if (baselen > skb->len)
+ 		return;
  
- 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
- 		err = -EBUSY;
---- a/net/mac80211/rc80211_minstrel.c
-+++ b/net/mac80211/rc80211_minstrel.c
-@@ -55,7 +55,6 @@
- #include "rate.h"
- #include "rc80211_minstrel.h"
+-	ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
++	ieee802_11_parse_elems(elements, skb->len - baselen, false, &elems);
  
--#define SAMPLE_COLUMNS	10
- #define SAMPLE_TBL(_mi, _idx, _col) \
- 		_mi->sample_table[(_idx * SAMPLE_COLUMNS) + _col]
+ 	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
  
-@@ -70,16 +69,31 @@ rix_to_ndx(struct minstrel_sta_info *mi,
- 	return i;
- }
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -32,7 +32,6 @@
+  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
+  *	frames.
+  * @WLAN_STA_WME: Station is a QoS-STA.
+- * @WLAN_STA_WDS: Station is one of our WDS peers.
+  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
+  *	IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
+  *	frame to this station is transmitted.
+@@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
+ 	WLAN_STA_AUTHORIZED,
+ 	WLAN_STA_SHORT_PREAMBLE,
+ 	WLAN_STA_WME,
+-	WLAN_STA_WDS,
+ 	WLAN_STA_CLEAR_PS_FILT,
+ 	WLAN_STA_MFP,
+ 	WLAN_STA_BLOCK_BA,
+@@ -344,6 +342,11 @@ struct sta_info {
+ 	int last_signal;
+ 	struct ewma avg_signal;
+ 	int last_ack_signal;
++
++	u8 chains;
++	s8 chain_signal_last[IEEE80211_MAX_CHAINS];
++	struct ewma chain_signal_avg[IEEE80211_MAX_CHAINS];
++
+ 	/* Plus 1 for non-QoS frames */
+ 	__le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
+ 
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -990,23 +990,23 @@ TRACE_EVENT(drv_channel_switch,
+ 
+ 	TP_STRUCT__entry(
+ 		LOCAL_ENTRY
++		CHANDEF_ENTRY
+ 		__field(u64, timestamp)
+ 		__field(bool, block_tx)
+-		__field(u16, freq)
+ 		__field(u8, count)
+ 	),
+ 
+ 	TP_fast_assign(
+ 		LOCAL_ASSIGN;
++		CHANDEF_ASSIGN(&ch_switch->chandef)
+ 		__entry->timestamp = ch_switch->timestamp;
+ 		__entry->block_tx = ch_switch->block_tx;
+-		__entry->freq = ch_switch->channel->center_freq;
+ 		__entry->count = ch_switch->count;
+ 	),
+ 
+ 	TP_printk(
+-		LOCAL_PR_FMT " new freq:%u count:%d",
+-		LOCAL_PR_ARG, __entry->freq, __entry->count
++		LOCAL_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
++		LOCAL_PR_ARG, CHANDEF_PR_ARG, __entry->count
+ 	)
+ );
  
-+/* find & sort topmost throughput rates */
-+static inline void
-+minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
-+{
-+	int j = MAX_THR_RATES;
-+
-+	while (j > 0 && mi->r[i].cur_tp > mi->r[tp_list[j - 1]].cur_tp)
-+		j--;
-+	if (j < MAX_THR_RATES - 1)
-+		memmove(&tp_list[j + 1], &tp_list[j], MAX_THR_RATES - (j + 1));
-+	if (j < MAX_THR_RATES)
-+		tp_list[j] = i;
-+}
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -48,15 +48,15 @@ static __le16 ieee80211_duration(struct 
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 
+ 	/* assume HW handles this */
+-	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
++	if (tx->rate.flags & IEEE80211_TX_RC_MCS)
+ 		return 0;
+ 
+ 	/* uh huh? */
+-	if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
++	if (WARN_ON_ONCE(tx->rate.idx < 0))
+ 		return 0;
+ 
+ 	sband = local->hw.wiphy->bands[info->band];
+-	txrate = &sband->bitrates[info->control.rates[0].idx];
++	txrate = &sband->bitrates[tx->rate.idx];
+ 
+ 	erp = txrate->flags & IEEE80211_RATE_ERP_G;
+ 
+@@ -617,11 +617,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ 	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
+ 	struct ieee80211_supported_band *sband;
+-	struct ieee80211_rate *rate;
+-	int i;
+ 	u32 len;
+-	bool inval = false, rts = false, short_preamble = false;
+ 	struct ieee80211_tx_rate_control txrc;
++	struct ieee80211_sta_rates *ratetbl = NULL;
+ 	bool assoc = false;
+ 
+ 	memset(&txrc, 0, sizeof(txrc));
+@@ -642,18 +640,23 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 		txrc.max_rate_idx = -1;
+ 	else
+ 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+-	memcpy(txrc.rate_idx_mcs_mask,
+-	       tx->sdata->rc_rateidx_mcs_mask[info->band],
+-	       sizeof(txrc.rate_idx_mcs_mask));
 +
- static void
- minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
- {
--	u32 max_tp = 0, index_max_tp = 0, index_max_tp2 = 0;
--	u32 max_prob = 0, index_max_prob = 0;
-+	u8 tmp_tp_rate[MAX_THR_RATES];
-+	u8 tmp_prob_rate = 0;
- 	u32 usecs;
--	u32 p;
- 	int i;
++	if (tx->sdata->rc_has_mcs_mask[info->band])
++		txrc.rate_idx_mcs_mask =
++			tx->sdata->rc_rateidx_mcs_mask[info->band];
++
+ 	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
+ 		    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
+ 		    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
+ 
+ 	/* set up RTS protection if desired */
+ 	if (len > tx->local->hw.wiphy->rts_threshold) {
+-		txrc.rts = rts = true;
++		txrc.rts = true;
+ 	}
  
--	mi->stats_update = jiffies;
-+	for (i=0; i < MAX_THR_RATES; i++)
-+	    tmp_tp_rate[i] = 0;
++	info->control.use_rts = txrc.rts;
++	info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
 +
- 	for (i = 0; i < mi->n_rates; i++) {
- 		struct minstrel_rate *mr = &mi->r[i];
+ 	/*
+ 	 * Use short preamble if the BSS can handle it, but not for
+ 	 * management frames unless we know the receiver can handle
+@@ -663,7 +666,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	if (tx->sdata->vif.bss_conf.use_short_preamble &&
+ 	    (ieee80211_is_data(hdr->frame_control) ||
+ 	     (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
+-		txrc.short_preamble = short_preamble = true;
++		txrc.short_preamble = true;
++
++	info->control.short_preamble = txrc.short_preamble;
  
-@@ -87,27 +101,32 @@ minstrel_update_stats(struct minstrel_pr
- 		if (!usecs)
- 			usecs = 1000000;
- 
--		/* To avoid rounding issues, probabilities scale from 0 (0%)
--		 * to 18000 (100%) */
--		if (mr->attempts) {
--			p = (mr->success * 18000) / mr->attempts;
-+		if (unlikely(mr->attempts > 0)) {
-+			mr->sample_skipped = 0;
-+			mr->cur_prob = MINSTREL_FRAC(mr->success, mr->attempts);
- 			mr->succ_hist += mr->success;
- 			mr->att_hist += mr->attempts;
--			mr->cur_prob = p;
--			p = ((p * (100 - mp->ewma_level)) + (mr->probability *
--				mp->ewma_level)) / 100;
--			mr->probability = p;
--			mr->cur_tp = p * (1000000 / usecs);
--		}
-+			mr->probability = minstrel_ewma(mr->probability,
-+							mr->cur_prob,
-+							EWMA_LEVEL);
-+		} else
-+			mr->sample_skipped++;
- 
- 		mr->last_success = mr->success;
- 		mr->last_attempts = mr->attempts;
- 		mr->success = 0;
- 		mr->attempts = 0;
- 
-+		/* Update throughput per rate, reset thr. below 10% success */
-+		if (mr->probability < MINSTREL_FRAC(10, 100))
-+			mr->cur_tp = 0;
-+		else
-+			mr->cur_tp = mr->probability * (1000000 / usecs);
-+
- 		/* Sample less often below the 10% chance of success.
- 		 * Sample less often above the 95% chance of success. */
--		if ((mr->probability > 17100) || (mr->probability < 1800)) {
-+		if (mr->probability > MINSTREL_FRAC(95, 100) ||
-+		    mr->probability < MINSTREL_FRAC(10, 100)) {
- 			mr->adjusted_retry_count = mr->retry_count >> 1;
- 			if (mr->adjusted_retry_count > 2)
- 				mr->adjusted_retry_count = 2;
-@@ -118,35 +137,30 @@ minstrel_update_stats(struct minstrel_pr
- 		}
- 		if (!mr->adjusted_retry_count)
- 			mr->adjusted_retry_count = 2;
--	}
+ 	if (tx->sta)
+ 		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
+@@ -687,16 +692,38 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	 */
+ 	rate_control_get_rate(tx->sdata, tx->sta, &txrc);
  
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		if (max_tp < mr->cur_tp) {
--			index_max_tp = i;
--			max_tp = mr->cur_tp;
--		}
--		if (max_prob < mr->probability) {
--			index_max_prob = i;
--			max_prob = mr->probability;
-+		minstrel_sort_best_tp_rates(mi, i, tmp_tp_rate);
-+
-+		/* To determine the most robust rate (max_prob_rate) used at
-+		 * 3rd mmr stage we distinct between two cases:
-+		 * (1) if any success probabilitiy >= 95%, out of those rates
-+		 * choose the maximum throughput rate as max_prob_rate
-+		 * (2) if all success probabilities < 95%, the rate with
-+		 * highest success probability is choosen as max_prob_rate */
-+		if (mr->probability >= MINSTREL_FRAC(95,100)) {
-+			if (mr->cur_tp >= mi->r[tmp_prob_rate].cur_tp)
-+				tmp_prob_rate = i;
+-	if (unlikely(info->control.rates[0].idx < 0))
+-		return TX_DROP;
++	if (tx->sta && !info->control.skip_table)
++		ratetbl = rcu_dereference(tx->sta->sta.rates);
++
++	if (unlikely(info->control.rates[0].idx < 0)) {
++		if (ratetbl) {
++			struct ieee80211_tx_rate rate = {
++				.idx = ratetbl->rate[0].idx,
++				.flags = ratetbl->rate[0].flags,
++				.count = ratetbl->rate[0].count
++			};
++
++			if (ratetbl->rate[0].idx < 0)
++				return TX_DROP;
++
++			tx->rate = rate;
 +		} else {
-+			if (mr->probability >= mi->r[tmp_prob_rate].probability)
-+				tmp_prob_rate = i;
- 		}
- 	}
++			return TX_DROP;
++		}
++	} else {
++		tx->rate = info->control.rates[0];
++	}
+ 
+ 	if (txrc.reported_rate.idx < 0) {
+-		txrc.reported_rate = info->control.rates[0];
++		txrc.reported_rate = tx->rate;
+ 		if (tx->sta && ieee80211_is_data(hdr->frame_control))
+ 			tx->sta->last_tx_rate = txrc.reported_rate;
+ 	} else if (tx->sta)
+ 		tx->sta->last_tx_rate = txrc.reported_rate;
  
--	max_tp = 0;
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
++	if (ratetbl)
++		return TX_CONTINUE;
++
+ 	if (unlikely(!info->control.rates[0].count))
+ 		info->control.rates[0].count = 1;
+ 
+@@ -704,91 +731,6 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 			 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
+ 		info->control.rates[0].count = 1;
+ 
+-	if (is_multicast_ether_addr(hdr->addr1)) {
+-		/*
+-		 * XXX: verify the rate is in the basic rateset
+-		 */
+-		return TX_CONTINUE;
+-	}
+-
+-	/*
+-	 * set up the RTS/CTS rate as the fastest basic rate
+-	 * that is not faster than the data rate
+-	 *
+-	 * XXX: Should this check all retry rates?
+-	 */
+-	if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+-		s8 baserate = 0;
+-
+-		rate = &sband->bitrates[info->control.rates[0].idx];
 -
--		if (i == index_max_tp)
+-		for (i = 0; i < sband->n_bitrates; i++) {
+-			/* must be a basic rate */
+-			if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
+-				continue;
+-			/* must not be faster than the data rate */
+-			if (sband->bitrates[i].bitrate > rate->bitrate)
+-				continue;
+-			/* maximum */
+-			if (sband->bitrates[baserate].bitrate <
+-			     sband->bitrates[i].bitrate)
+-				baserate = i;
+-		}
+-
+-		info->control.rts_cts_rate_idx = baserate;
+-	}
+-
+-	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+-		/*
+-		 * make sure there's no valid rate following
+-		 * an invalid one, just in case drivers don't
+-		 * take the API seriously to stop at -1.
+-		 */
+-		if (inval) {
+-			info->control.rates[i].idx = -1;
+-			continue;
+-		}
+-		if (info->control.rates[i].idx < 0) {
+-			inval = true;
 -			continue;
-+	/* Assign the new rate set */
-+	memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
-+	mi->max_prob_rate = tmp_prob_rate;
- 
--		if (max_tp < mr->cur_tp) {
--			index_max_tp2 = i;
--			max_tp = mr->cur_tp;
 -		}
+-
+-		/*
+-		 * For now assume MCS is already set up correctly, this
+-		 * needs to be fixed.
+-		 */
+-		if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
+-			WARN_ON(info->control.rates[i].idx > 76);
+-			continue;
+-		}
+-
+-		/* set up RTS protection if desired */
+-		if (rts)
+-			info->control.rates[i].flags |=
+-				IEEE80211_TX_RC_USE_RTS_CTS;
+-
+-		/* RC is busted */
+-		if (WARN_ON_ONCE(info->control.rates[i].idx >=
+-				 sband->n_bitrates)) {
+-			info->control.rates[i].idx = -1;
+-			continue;
+-		}
+-
+-		rate = &sband->bitrates[info->control.rates[i].idx];
+-
+-		/* set up short preamble */
+-		if (short_preamble &&
+-		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+-			info->control.rates[i].flags |=
+-				IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
+-
+-		/* set up G protection */
+-		if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
+-		    rate->flags & IEEE80211_RATE_ERP_G)
+-			info->control.rates[i].flags |=
+-				IEEE80211_TX_RC_USE_CTS_PROTECT;
 -	}
--	mi->max_tp_rate = index_max_tp;
--	mi->max_tp_rate2 = index_max_tp2;
--	mi->max_prob_rate = index_max_prob;
-+	/* Reset update timer */
-+	mi->stats_update = jiffies;
+-
+ 	return TX_CONTINUE;
  }
  
- static void
-@@ -207,10 +221,10 @@ static int
- minstrel_get_next_sample(struct minstrel_sta_info *mi)
+@@ -2508,8 +2450,6 @@ struct sk_buff *ieee80211_beacon_get_tim
+ 		txrc.max_rate_idx = -1;
+ 	else
+ 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+-	memcpy(txrc.rate_idx_mcs_mask, sdata->rc_rateidx_mcs_mask[band],
+-	       sizeof(txrc.rate_idx_mcs_mask));
+ 	txrc.bss = true;
+ 	rate_control_get_rate(sdata, NULL, &txrc);
+ 
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -485,7 +485,8 @@ int ieee80211_queue_stopped(struct ieee8
+ 		return true;
+ 
+ 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+-	ret = !!local->queue_stop_reasons[queue];
++	ret = test_bit(IEEE80211_QUEUE_STOP_REASON_DRIVER,
++		       &local->queue_stop_reasons[queue]);
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ 	return ret;
+ }
+@@ -660,7 +661,7 @@ void ieee80211_queue_delayed_work(struct
+ }
+ EXPORT_SYMBOL(ieee80211_queue_delayed_work);
+ 
+-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
++u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
+ 			       struct ieee802_11_elems *elems,
+ 			       u64 filter, u32 crc)
  {
- 	unsigned int sample_ndx;
--	sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
--	mi->sample_idx++;
--	if ((int) mi->sample_idx > (mi->n_rates - 2)) {
--		mi->sample_idx = 0;
-+	sample_ndx = SAMPLE_TBL(mi, mi->sample_row, mi->sample_column);
-+	mi->sample_row++;
-+	if ((int) mi->sample_row >= mi->n_rates) {
-+		mi->sample_row = 0;
- 		mi->sample_column++;
- 		if (mi->sample_column >= SAMPLE_COLUMNS)
- 			mi->sample_column = 0;
-@@ -228,31 +242,37 @@ minstrel_get_rate(void *priv, struct iee
- 	struct minstrel_priv *mp = priv;
- 	struct ieee80211_tx_rate *ar = info->control.rates;
- 	unsigned int ndx, sample_ndx = 0;
--	bool mrr;
--	bool sample_slower = false;
--	bool sample = false;
-+	bool mrr_capable;
-+	bool indirect_rate_sampling = false;
-+	bool rate_sampling = false;
- 	int i, delta;
- 	int mrr_ndx[3];
--	int sample_rate;
-+	int sampling_ratio;
- 
-+	/* management/no-ack frames do not use rate control */
- 	if (rate_control_send_low(sta, priv_sta, txrc))
+@@ -668,6 +669,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ 	u8 *pos = start;
+ 	bool calc_crc = filter != 0;
+ 	DECLARE_BITMAP(seen_elems, 256);
++	const u8 *ie;
+ 
+ 	bitmap_zero(seen_elems, 256);
+ 	memset(elems, 0, sizeof(*elems));
+@@ -715,6 +717,12 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ 		case WLAN_EID_COUNTRY:
+ 		case WLAN_EID_PWR_CONSTRAINT:
+ 		case WLAN_EID_TIMEOUT_INTERVAL:
++		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
++		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
++		/*
++		 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
++		 * that if the content gets bigger it might be needed more than once
++		 */
+ 			if (test_bit(id, seen_elems)) {
+ 				elems->parse_error = true;
+ 				left -= elen;
+@@ -862,6 +870,48 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ 			}
+ 			elems->ch_switch_ie = (void *)pos;
+ 			break;
++		case WLAN_EID_EXT_CHANSWITCH_ANN:
++			if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
++				elem_parse_failed = true;
++				break;
++			}
++			elems->ext_chansw_ie = (void *)pos;
++			break;
++		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
++			if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
++				elem_parse_failed = true;
++				break;
++			}
++			elems->sec_chan_offs = (void *)pos;
++			break;
++		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
++			if (!action ||
++			    elen != sizeof(*elems->wide_bw_chansw_ie)) {
++				elem_parse_failed = true;
++				break;
++			}
++			elems->wide_bw_chansw_ie = (void *)pos;
++			break;
++		case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
++			if (action) {
++				elem_parse_failed = true;
++				break;
++			}
++			/*
++			 * This is a bit tricky, but as we only care about
++			 * the wide bandwidth channel switch element, so
++			 * just parse it out manually.
++			 */
++			ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
++					      pos, elen);
++			if (ie) {
++				if (ie[1] == sizeof(*elems->wide_bw_chansw_ie))
++					elems->wide_bw_chansw_ie =
++						(void *)(ie + 2);
++				else
++					elem_parse_failed = true;
++			}
++			break;
+ 		case WLAN_EID_COUNTRY:
+ 			elems->country_elem = pos;
+ 			elems->country_elem_len = elen;
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -857,7 +857,7 @@ static void handle_channel(struct wiphy 
+ 			return;
+ 
+ 		REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
+-		chan->flags = IEEE80211_CHAN_DISABLED;
++		chan->flags |= IEEE80211_CHAN_DISABLED;
  		return;
+ 	}
  
--	mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
--
--	ndx = mi->max_tp_rate;
--
--	if (mrr)
--		sample_rate = mp->lookaround_rate_mrr;
-+	/* check multi-rate-retry capabilities & adjust lookaround_rate */
-+	mrr_capable = mp->has_mrr &&
-+		      !txrc->rts &&
-+		      !txrc->bss_conf->use_cts_prot;
-+	if (mrr_capable)
-+		sampling_ratio = mp->lookaround_rate_mrr;
- 	else
--		sample_rate = mp->lookaround_rate;
-+		sampling_ratio = mp->lookaround_rate;
-+
-+	/* init rateindex [ndx] with max throughput rate */
-+	ndx = mi->max_tp_rate[0];
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1156,6 +1156,26 @@ int cfg80211_get_p2p_attr(const u8 *ies,
+ }
+ EXPORT_SYMBOL(cfg80211_get_p2p_attr);
  
-+	/* increase sum packet counter */
- 	mi->packet_count++;
--	delta = (mi->packet_count * sample_rate / 100) -
++bool ieee80211_operating_class_to_band(u8 operating_class,
++				       enum ieee80211_band *band)
++{
++	switch (operating_class) {
++	case 112:
++	case 115 ... 127:
++		*band = IEEE80211_BAND_5GHZ;
++		return true;
++	case 81:
++	case 82:
++	case 83:
++	case 84:
++		*band = IEEE80211_BAND_2GHZ;
++		return true;
++	}
 +
-+	delta = (mi->packet_count * sampling_ratio / 100) -
- 			(mi->sample_count + mi->sample_deferred / 2);
++	return false;
++}
++EXPORT_SYMBOL(ieee80211_operating_class_to_band);
++
+ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
+ 				 u32 beacon_int)
+ {
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -1973,6 +1973,10 @@ enum nl80211_sta_bss_param {
+  * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
+  * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
+  *	non-peer STA
++ * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
++ *	Contains a nested array of signal strength attributes (u8, dBm)
++ * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
++ *	Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
+  * @__NL80211_STA_INFO_AFTER_LAST: internal
+  * @NL80211_STA_INFO_MAX: highest possible station info attribute
+  */
+@@ -2002,6 +2006,8 @@ enum nl80211_sta_info {
+ 	NL80211_STA_INFO_NONPEER_PM,
+ 	NL80211_STA_INFO_RX_BYTES64,
+ 	NL80211_STA_INFO_TX_BYTES64,
++	NL80211_STA_INFO_CHAIN_SIGNAL,
++	NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
+ 
+ 	/* keep last */
+ 	__NL80211_STA_INFO_AFTER_LAST,
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -358,6 +358,8 @@ struct sta_info *sta_info_alloc(struct i
+ 	do_posix_clock_monotonic_gettime(&uptime);
+ 	sta->last_connected = uptime.tv_sec;
+ 	ewma_init(&sta->avg_signal, 1024, 8);
++	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
++		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
+ 
+ 	if (sta_prepare_rate_control(local, sta, gfp)) {
+ 		kfree(sta);
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3367,6 +3367,32 @@ static bool nl80211_put_sta_rate(struct 
+ 	return true;
+ }
  
- 	/* delta > 0: sampling required */
--	if ((delta > 0) && (mrr || !mi->prev_sample)) {
-+	if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
- 		struct minstrel_rate *msr;
- 		if (mi->packet_count >= 10000) {
- 			mi->sample_deferred = 0;
-@@ -271,21 +291,28 @@ minstrel_get_rate(void *priv, struct iee
- 			mi->sample_count += (delta - mi->n_rates * 2);
- 		}
++static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
++			       int id)
++{
++	void *attr;
++	int i = 0;
++
++	if (!mask)
++		return true;
++
++	attr = nla_nest_start(msg, id);
++	if (!attr)
++		return false;
++
++	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
++		if (!(mask & BIT(i)))
++			continue;
++
++		if (nla_put_u8(msg, i, signal[i]))
++			return false;
++	}
++
++	nla_nest_end(msg, attr);
++
++	return true;
++}
++
+ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
+ 				int flags,
+ 				struct cfg80211_registered_device *rdev,
+@@ -3438,6 +3464,18 @@ static int nl80211_send_station(struct s
+ 	default:
+ 		break;
+ 	}
++	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
++		if (!nl80211_put_signal(msg, sinfo->chains,
++					sinfo->chain_signal,
++					NL80211_STA_INFO_CHAIN_SIGNAL))
++			goto nla_put_failure;
++	}
++	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
++		if (!nl80211_put_signal(msg, sinfo->chains,
++					sinfo->chain_signal_avg,
++					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
++			goto nla_put_failure;
++	}
+ 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
+ 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
+ 					  NL80211_STA_INFO_TX_BITRATE))
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -768,7 +768,8 @@ void ath9k_set_hw_capab(struct ath_softc
+ 		IEEE80211_HW_SUPPORTS_PS |
+ 		IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		IEEE80211_HW_SPECTRUM_MGMT |
+-		IEEE80211_HW_REPORTS_TX_ACK_STATUS;
++		IEEE80211_HW_REPORTS_TX_ACK_STATUS |
++		IEEE80211_HW_SUPPORTS_RC_TABLE;
+ 
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+ 		 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -157,6 +157,13 @@ static void ath_send_bar(struct ath_atx_
+ 			   seqno << IEEE80211_SEQ_SEQ_SHIFT);
+ }
  
-+		/* get next random rate sample */
- 		sample_ndx = minstrel_get_next_sample(mi);
- 		msr = &mi->r[sample_ndx];
--		sample = true;
--		sample_slower = mrr && (msr->perfect_tx_time >
--			mi->r[ndx].perfect_tx_time);
-+		rate_sampling = true;
- 
--		if (!sample_slower) {
-+		/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
-+		 * rate sampling method should be used.
-+		 * Respect such rates that are not sampled for 20 interations.
-+		 */
-+		if (mrr_capable &&
-+		    msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
-+		    msr->sample_skipped < 20)
-+				indirect_rate_sampling = true;
-+
-+		if (!indirect_rate_sampling) {
- 			if (msr->sample_limit != 0) {
- 				ndx = sample_ndx;
- 				mi->sample_count++;
- 				if (msr->sample_limit > 0)
- 					msr->sample_limit--;
--			} else {
--				sample = false;
--			}
-+			} else
-+				rate_sampling = false;
++static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
++			  struct ath_buf *bf)
++{
++	ieee80211_get_tx_rates(vif, sta, bf->bf_mpdu, bf->rates,
++			       ARRAY_SIZE(bf->rates));
++}
++
+ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
+ {
+ 	struct ath_txq *txq = tid->ac->txq;
+@@ -189,6 +196,7 @@ static void ath_tx_flush_tid(struct ath_
+ 			ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
+ 			sendbar = true;
  		} else {
- 			/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
- 			 * packets that have the sampling rate deferred to the
-@@ -297,34 +324,39 @@ minstrel_get_rate(void *priv, struct iee
- 			mi->sample_deferred++;
++			ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 			ath_tx_send_normal(sc, txq, NULL, skb);
  		}
  	}
--	mi->prev_sample = sample;
-+	mi->prev_sample = rate_sampling;
+@@ -407,7 +415,7 @@ static void ath_tx_complete_aggr(struct 
  
- 	/* If we're not using MRR and the sampling rate already
- 	 * has a probability of >95%, we shouldn't be attempting
- 	 * to use it, as this only wastes precious airtime */
--	if (!mrr && sample && (mi->r[ndx].probability > 17100))
--		ndx = mi->max_tp_rate;
-+	if (!mrr_capable && rate_sampling &&
-+	   (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
-+		ndx = mi->max_tp_rate[0];
- 
-+	/* mrr setup for 1st stage */
- 	ar[0].idx = mi->r[ndx].rix;
- 	ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
- 
--	if (!mrr) {
--		if (!sample)
-+	/* non mrr setup for 2nd stage */
-+	if (!mrr_capable) {
-+		if (!rate_sampling)
- 			ar[0].count = mp->max_retry;
- 		ar[1].idx = mi->lowest_rix;
- 		ar[1].count = mp->max_retry;
- 		return;
- 	}
+ 	tx_info = IEEE80211_SKB_CB(skb);
  
--	/* MRR setup */
--	if (sample) {
--		if (sample_slower)
-+	/* mrr setup for 2nd stage */
-+	if (rate_sampling) {
-+		if (indirect_rate_sampling)
- 			mrr_ndx[0] = sample_ndx;
- 		else
--			mrr_ndx[0] = mi->max_tp_rate;
-+			mrr_ndx[0] = mi->max_tp_rate[0];
- 	} else {
--		mrr_ndx[0] = mi->max_tp_rate2;
-+		mrr_ndx[0] = mi->max_tp_rate[1];
- 	}
-+
-+	/* mrr setup for 3rd & 4th stage */
- 	mrr_ndx[1] = mi->max_prob_rate;
- 	mrr_ndx[2] = 0;
- 	for (i = 1; i < 4; i++) {
-@@ -351,26 +383,21 @@ static void
- init_sample_table(struct minstrel_sta_info *mi)
+-	memcpy(rates, tx_info->control.rates, sizeof(rates));
++	memcpy(rates, bf->rates, sizeof(rates));
+ 
+ 	retries = ts->ts_longretry + 1;
+ 	for (i = 0; i < ts->ts_rateindex; i++)
+@@ -736,8 +744,6 @@ static int ath_compute_num_delims(struct
+ 				  bool first_subfrm)
  {
- 	unsigned int i, col, new_idx;
--	unsigned int n_srates = mi->n_rates - 1;
- 	u8 rnd[8];
- 
- 	mi->sample_column = 0;
--	mi->sample_idx = 0;
--	memset(mi->sample_table, 0, SAMPLE_COLUMNS * mi->n_rates);
-+	mi->sample_row = 0;
-+	memset(mi->sample_table, 0xff, SAMPLE_COLUMNS * mi->n_rates);
- 
- 	for (col = 0; col < SAMPLE_COLUMNS; col++) {
--		for (i = 0; i < n_srates; i++) {
-+		for (i = 0; i < mi->n_rates; i++) {
- 			get_random_bytes(rnd, sizeof(rnd));
--			new_idx = (i + rnd[i & 7]) % n_srates;
-+			new_idx = (i + rnd[i & 7]) % mi->n_rates;
- 
--			while (SAMPLE_TBL(mi, new_idx, col) != 0)
--				new_idx = (new_idx + 1) % n_srates;
-+			while (SAMPLE_TBL(mi, new_idx, col) != 0xff)
-+				new_idx = (new_idx + 1) % mi->n_rates;
- 
--			/* Don't sample the slowest rate (i.e. slowest base
--			 * rate). We must presume that the slowest rate works
--			 * fine, or else other management frames will also be
--			 * failing and the link will break */
--			SAMPLE_TBL(mi, new_idx, col) = i + 1;
-+			SAMPLE_TBL(mi, new_idx, col) = i;
+ #define FIRST_DESC_NDELIMS 60
+-	struct sk_buff *skb = bf->bf_mpdu;
+-	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+ 	u32 nsymbits, nsymbols;
+ 	u16 minlen;
+ 	u8 flags, rix;
+@@ -778,8 +784,8 @@ static int ath_compute_num_delims(struct
+ 	if (tid->an->mpdudensity == 0)
+ 		return ndelim;
+ 
+-	rix = tx_info->control.rates[0].idx;
+-	flags = tx_info->control.rates[0].flags;
++	rix = bf->rates[0].idx;
++	flags = bf->rates[0].flags;
+ 	width = (flags & IEEE80211_TX_RC_40_MHZ_WIDTH) ? 1 : 0;
+ 	half_gi = (flags & IEEE80211_TX_RC_SHORT_GI) ? 1 : 0;
+ 
+@@ -858,6 +864,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ 			bf_first = bf;
+ 
+ 		if (!rl) {
++			ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 			aggr_limit = ath_lookup_rate(sc, bf, tid);
+ 			rl = 1;
  		}
+@@ -998,14 +1005,14 @@ static void ath_buf_set_rate(struct ath_
+ 
+ 	skb = bf->bf_mpdu;
+ 	tx_info = IEEE80211_SKB_CB(skb);
+-	rates = tx_info->control.rates;
++	rates = bf->rates;
+ 	hdr = (struct ieee80211_hdr *)skb->data;
+ 
+ 	/* set dur_update_en for l-sig computation except for PS-Poll frames */
+ 	info->dur_update = !ieee80211_is_pspoll(hdr->frame_control);
+ 	info->rtscts_rate = fi->rtscts_rate;
+ 
+-	for (i = 0; i < 4; i++) {
++	for (i = 0; i < ARRAY_SIZE(bf->rates); i++) {
+ 		bool is_40, is_sgi, is_sp;
+ 		int phy;
+ 
+@@ -1743,6 +1750,7 @@ static void ath_tx_send_ampdu(struct ath
+ 		return;
  	}
+ 
++	ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 	bf->bf_state.bf_type = BUF_AMPDU;
+ 	INIT_LIST_HEAD(&bf_head);
+ 	list_add(&bf->list, &bf_head);
+@@ -1892,49 +1900,6 @@ static struct ath_buf *ath_tx_setup_buff
+ 	return bf;
  }
-@@ -542,9 +569,6 @@ minstrel_alloc(struct ieee80211_hw *hw, 
- 	mp->lookaround_rate = 5;
- 	mp->lookaround_rate_mrr = 10;
  
--	/* moving average weight for EWMA */
--	mp->ewma_level = 75;
+-/* FIXME: tx power */
+-static void ath_tx_start_dma(struct ath_softc *sc, struct sk_buff *skb,
+-			     struct ath_tx_control *txctl)
+-{
+-	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+-	struct ath_atx_tid *tid = NULL;
+-	struct ath_buf *bf;
+-	u8 tidno;
 -
- 	/* maximum time that the hw is allowed to stay in one MRR segment */
- 	mp->segment_size = 6000;
- 
---- a/net/mac80211/rc80211_minstrel.h
-+++ b/net/mac80211/rc80211_minstrel.h
-@@ -9,6 +9,28 @@
- #ifndef __RC_MINSTREL_H
- #define __RC_MINSTREL_H
+-	if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
+-		tidno = ieee80211_get_qos_ctl(hdr)[0] &
+-			IEEE80211_QOS_CTL_TID_MASK;
+-		tid = ATH_AN_2_TID(txctl->an, tidno);
+-
+-		WARN_ON(tid->ac->txq != txctl->txq);
+-	}
+-
+-	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
+-		/*
+-		 * Try aggregation if it's a unicast data frame
+-		 * and the destination is HT capable.
+-		 */
+-		ath_tx_send_ampdu(sc, tid, skb, txctl);
+-	} else {
+-		bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
+-		if (!bf) {
+-			if (txctl->paprd)
+-				dev_kfree_skb_any(skb);
+-			else
+-				ieee80211_free_txskb(sc->hw, skb);
+-			return;
+-		}
+-
+-		bf->bf_state.bfs_paprd = txctl->paprd;
+-
+-		if (txctl->paprd)
+-			bf->bf_state.bfs_paprd_timestamp = jiffies;
+-
+-		ath_tx_send_normal(sc, txctl->txq, tid, skb);
+-	}
+-}
+-
+ /* Upon failure caller should free skb */
+ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
+ 		 struct ath_tx_control *txctl)
+@@ -1945,8 +1910,11 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct ath_softc *sc = hw->priv;
+ 	struct ath_txq *txq = txctl->txq;
++	struct ath_atx_tid *tid = NULL;
++	struct ath_buf *bf;
+ 	int padpos, padsize;
+ 	int frmlen = skb->len + FCS_LEN;
++	u8 tidno;
+ 	int q;
+ 
+ 	/* NOTE:  sta can be NULL according to net/mac80211.h */
+@@ -2002,8 +1970,41 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 		txq->stopped = true;
+ 	}
  
-+#define EWMA_LEVEL	75	/* ewma weighting factor [%] */
-+#define SAMPLE_COLUMNS	10	/* number of columns in sample table */
+-	ath_tx_start_dma(sc, skb, txctl);
++	if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
++		tidno = ieee80211_get_qos_ctl(hdr)[0] &
++			IEEE80211_QOS_CTL_TID_MASK;
++		tid = ATH_AN_2_TID(txctl->an, tidno);
 +
++		WARN_ON(tid->ac->txq != txctl->txq);
++	}
 +
-+/* scaled fraction values */
-+#define MINSTREL_SCALE  16
-+#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
-+#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
++	if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
++		/*
++		 * Try aggregation if it's a unicast data frame
++		 * and the destination is HT capable.
++		 */
++		ath_tx_send_ampdu(sc, tid, skb, txctl);
++		goto out;
++	}
 +
-+/* number of highest throughput rates to consider*/
-+#define MAX_THR_RATES 4
++	bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++	if (!bf) {
++		if (txctl->paprd)
++			dev_kfree_skb_any(skb);
++		else
++			ieee80211_free_txskb(sc->hw, skb);
++		goto out;
++	}
 +
-+/*
-+ * Perform EWMA (Exponentially Weighted Moving Average) calculation
-+  */
-+static inline int
-+minstrel_ewma(int old, int new, int weight)
-+{
-+	return (new * (100 - weight) + old * weight) / 100;
-+}
++	bf->bf_state.bfs_paprd = txctl->paprd;
 +
++	if (txctl->paprd)
++		bf->bf_state.bfs_paprd_timestamp = jiffies;
 +
- struct minstrel_rate {
- 	int bitrate;
- 	int rix;
-@@ -26,6 +48,7 @@ struct minstrel_rate {
- 	u32 attempts;
- 	u32 last_attempts;
- 	u32 last_success;
-+	u8 sample_skipped;
- 
- 	/* parts per thousand */
- 	u32 cur_prob;
-@@ -45,14 +68,13 @@ struct minstrel_sta_info {
- 
- 	unsigned int lowest_rix;
- 
--	unsigned int max_tp_rate;
--	unsigned int max_tp_rate2;
--	unsigned int max_prob_rate;
-+	u8 max_tp_rate[MAX_THR_RATES];
-+	u8 max_prob_rate;
- 	unsigned int packet_count;
- 	unsigned int sample_count;
- 	int sample_deferred;
- 
--	unsigned int sample_idx;
-+	unsigned int sample_row;
- 	unsigned int sample_column;
- 
- 	int n_rates;
-@@ -73,7 +95,6 @@ struct minstrel_priv {
- 	unsigned int cw_min;
- 	unsigned int cw_max;
- 	unsigned int max_retry;
--	unsigned int ewma_level;
- 	unsigned int segment_size;
- 	unsigned int update_interval;
- 	unsigned int lookaround_rate;
---- a/net/mac80211/rc80211_minstrel_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_debugfs.c
-@@ -73,15 +73,17 @@ minstrel_stats_open(struct inode *inode,
- 	for (i = 0; i < mi->n_rates; i++) {
- 		struct minstrel_rate *mr = &mi->r[i];
++	ath_set_rates(vif, sta, bf);
++	ath_tx_send_normal(sc, txctl->txq, tid, skb);
  
--		*(p++) = (i == mi->max_tp_rate) ? 'T' : ' ';
--		*(p++) = (i == mi->max_tp_rate2) ? 't' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[0]) ? 'A' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[1]) ? 'B' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[2]) ? 'C' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[3]) ? 'D' : ' ';
- 		*(p++) = (i == mi->max_prob_rate) ? 'P' : ' ';
- 		p += sprintf(p, "%3u%s", mr->bitrate / 2,
- 				(mr->bitrate & 1 ? ".5" : "  "));
- 
--		tp = mr->cur_tp / ((18000 << 10) / 96);
--		prob = mr->cur_prob / 18;
--		eprob = mr->probability / 18;
-+		tp = MINSTREL_TRUNC(mr->cur_tp / 10);
-+		prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
-+		eprob = MINSTREL_TRUNC(mr->probability * 1000);
++out:
+ 	ath_txq_unlock(sc, txq);
  
- 		p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
- 				"%3u(%3u)   %8llu    %8llu\n",
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -657,11 +657,10 @@ enum sc_op_flags {
- struct ath_rate_table;
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -124,7 +124,7 @@ static bool ath_rx_edma_buf_link(struct 
  
- struct ath9k_vif_iter_data {
--	const u8 *hw_macaddr; /* phy's hardware address, set
--			       * before starting iteration for
--			       * valid bssid mask.
--			       */
-+	u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
- 	u8 mask[ETH_ALEN]; /* bssid mask */
-+	bool has_hw_macaddr;
-+
- 	int naps;      /* number of AP vifs */
- 	int nmeshes;   /* number of mesh vifs */
- 	int nstations; /* number of station vifs */
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -835,10 +835,14 @@ static void ath9k_vif_iter(void *data, u
- 	struct ath9k_vif_iter_data *iter_data = data;
- 	int i;
- 
--	if (iter_data->hw_macaddr)
-+	if (iter_data->has_hw_macaddr) {
- 		for (i = 0; i < ETH_ALEN; i++)
- 			iter_data->mask[i] &=
- 				~(iter_data->hw_macaddr[i] ^ mac[i]);
-+	} else {
-+		memcpy(iter_data->hw_macaddr, mac, ETH_ALEN);
-+		iter_data->has_hw_macaddr = true;
-+	}
+ 	SKB_CB_ATHBUF(skb) = bf;
+ 	ath9k_hw_addrxbuf_edma(ah, bf->bf_buf_addr, qtype);
+-	skb_queue_tail(&rx_edma->rx_fifo, skb);
++	__skb_queue_tail(&rx_edma->rx_fifo, skb);
  
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP:
-@@ -887,7 +891,6 @@ void ath9k_calculate_iter_data(struct ie
- 	 * together with the BSSID mask when matching addresses.
- 	 */
- 	memset(iter_data, 0, sizeof(*iter_data));
--	iter_data->hw_macaddr = common->macaddr;
- 	memset(&iter_data->mask, 0xff, ETH_ALEN);
- 
- 	if (vif)
-@@ -897,6 +900,8 @@ void ath9k_calculate_iter_data(struct ie
- 	ieee80211_iterate_active_interfaces_atomic(
- 		sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
- 		ath9k_vif_iter, iter_data);
-+
-+	memcpy(common->macaddr, iter_data->hw_macaddr, ETH_ALEN);
+ 	return true;
  }
+@@ -155,7 +155,7 @@ static void ath_rx_remove_buffer(struct 
  
- /* Called with sc->mutex held. */
---- a/drivers/net/wireless/ath/ath9k/reg.h
-+++ b/drivers/net/wireless/ath/ath9k/reg.h
-@@ -1493,9 +1493,6 @@ enum {
- #define AR9271_RADIO_RF_RST			0x20
- #define AR9271_GATE_MAC_CTL			0x4000
+ 	rx_edma = &sc->rx.rx_edma[qtype];
  
--#define AR_STA_ID0                 0x8000
--#define AR_STA_ID1                 0x8004
--#define AR_STA_ID1_SADH_MASK       0x0000FFFF
- #define AR_STA_ID1_STA_AP          0x00010000
- #define AR_STA_ID1_ADHOC           0x00020000
- #define AR_STA_ID1_PWR_SAV         0x00040000
---- a/drivers/net/wireless/ath/hw.c
-+++ b/drivers/net/wireless/ath/hw.c
-@@ -118,6 +118,12 @@
- void ath_hw_setbssidmask(struct ath_common *common)
- {
- 	void *ah = common->ah;
-+	u32 id1;
-+
-+	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
-+	id1 = REG_READ(ah, AR_STA_ID1) & ~AR_STA_ID1_SADH_MASK;
-+	id1 |= get_unaligned_le16(common->macaddr + 4);
-+	REG_WRITE(ah, AR_STA_ID1, id1);
+-	while ((skb = skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
++	while ((skb = __skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
+ 		bf = SKB_CB_ATHBUF(skb);
+ 		BUG_ON(!bf);
+ 		list_add_tail(&bf->list, &sc->rx.rxbuf);
+@@ -1287,13 +1287,13 @@ int ath_rx_tasklet(struct ath_softc *sc,
+ 			goto requeue_drop_frag;
+ 		}
  
- 	REG_WRITE(ah, AR_BSSMSKL, get_unaligned_le32(common->bssidmask));
- 	REG_WRITE(ah, AR_BSSMSKU, get_unaligned_le16(common->bssidmask + 4));
---- a/drivers/net/wireless/ath/reg.h
-+++ b/drivers/net/wireless/ath/reg.h
-@@ -23,6 +23,10 @@
- #define AR_MIBC_CMC		0x00000004
- #define AR_MIBC_MCS		0x00000008
+-		bf->bf_mpdu = requeue_skb;
+-		bf->bf_buf_addr = new_buf_addr;
+-
+ 		/* Unmap the frame */
+ 		dma_unmap_single(sc->dev, bf->bf_buf_addr,
+ 				 common->rx_bufsize, dma_type);
  
-+#define AR_STA_ID0		0x8000
-+#define AR_STA_ID1		0x8004
-+#define AR_STA_ID1_SADH_MASK	0x0000ffff
++		bf->bf_mpdu = requeue_skb;
++		bf->bf_buf_addr = new_buf_addr;
 +
- /*
-  * BSSID mask registers. See ath_hw_set_bssid_mask()
-  * for detailed documentation about these registers.
+ 		skb_put(skb, rs.rs_datalen + ah->caps.rx_status_len);
+ 		if (ah->caps.rx_status_len)
+ 			skb_pull(skb, ah->caps.rx_status_len);
diff --git a/package/mac80211/patches/310-ap_scan.patch b/package/mac80211/patches/310-ap_scan.patch
index b8f2671150..19c5dcf191 100644
--- a/package/mac80211/patches/310-ap_scan.patch
+++ b/package/mac80211/patches/310-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2009,7 +2009,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2078,7 +2078,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
index 7a07eb6e97..35363e7b01 100644
--- a/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,10 +1,10 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -727,6 +727,7 @@ static const struct ieee80211_iface_limi
+@@ -731,6 +731,7 @@ static const struct ieee80211_iface_limi
  #endif
  				 BIT(NL80211_IFTYPE_AP) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
 +	{ .max = 1,	.types = BIT(NL80211_IFTYPE_ADHOC) },
  };
  
- static const struct ieee80211_iface_combination if_comb = {
+ 
diff --git a/package/mac80211/patches/420-ath5k_disable_fast_cc.patch b/package/mac80211/patches/420-ath5k_disable_fast_cc.patch
index 48b8467144..bd661c6fbf 100644
--- a/package/mac80211/patches/420-ath5k_disable_fast_cc.patch
+++ b/package/mac80211/patches/420-ath5k_disable_fast_cc.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath5k/reset.c
 +++ b/drivers/net/wireless/ath/ath5k/reset.c
-@@ -1158,6 +1158,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
+@@ -1156,6 +1156,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
  	tsf_lo = 0;
  	mode = 0;
  
@@ -8,7 +8,7 @@
  	/*
  	 * Sanity check for fast flag
  	 * Fast channel change only available
-@@ -1165,6 +1166,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
+@@ -1163,6 +1164,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
  	 */
  	if (fast && (ah->ah_radio != AR5K_RF2413) &&
  	(ah->ah_radio != AR5K_RF5413))
diff --git a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
index 285fce2e36..25c0c2004f 100644
--- a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
+++ b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -2003,6 +2003,53 @@ void ath9k_get_et_stats(struct ieee80211
+@@ -2012,6 +2012,53 @@ void ath9k_get_et_stats(struct ieee80211
  	WARN_ON(i != ATH9K_SSTATS_LEN);
  }
  
@@ -54,7 +54,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -2020,6 +2067,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -2029,6 +2076,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	ath9k_dfs_init_debug(sc);
  
diff --git a/package/mac80211/patches/501-ath9k-eeprom_endianess.patch b/package/mac80211/patches/501-ath9k-eeprom_endianess.patch
index bdd7e19fa1..fb3b38b142 100644
--- a/package/mac80211/patches/501-ath9k-eeprom_endianess.patch
+++ b/package/mac80211/patches/501-ath9k-eeprom_endianess.patch
@@ -71,7 +71,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -740,6 +740,7 @@ enum ath_cal_list {
+@@ -739,6 +739,7 @@ enum ath_cal_list {
  #define AH_USE_EEPROM   0x1
  #define AH_UNPLUGGED    0x2 /* The card has been physically removed. */
  #define AH_FASTCC       0x4
@@ -81,7 +81,7 @@
  	struct ath_ops reg_ops;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -587,6 +587,8 @@ static int ath9k_init_softc(u16 devid, s
+@@ -591,6 +591,8 @@ static int ath9k_init_softc(u16 devid, s
  		ah->is_clk_25mhz = pdata->is_clk_25mhz;
  		ah->get_mac_revision = pdata->get_mac_revision;
  		ah->external_reset = pdata->external_reset;
diff --git a/package/mac80211/patches/502-ath9k_ahb_init.patch b/package/mac80211/patches/502-ath9k_ahb_init.patch
index 88841632d9..809a284f66 100644
--- a/package/mac80211/patches/502-ath9k_ahb_init.patch
+++ b/package/mac80211/patches/502-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -965,23 +965,23 @@ static int __init ath9k_init(void)
+@@ -986,23 +986,23 @@ static int __init ath9k_init(void)
  		goto err_out;
  	}
  
diff --git a/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
index 855b3364cd..93b7889ee5 100644
--- a/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1946,8 +1946,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2001,8 +2001,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		REG_WRITE(ah, AR_OBS, 8);
  
  	if (ah->config.rx_intr_mitigation) {
diff --git a/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch b/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch
index 4156773228..bb4c6fea79 100644
--- a/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch
+++ b/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -689,6 +689,7 @@ struct ath_softc {
+@@ -691,6 +691,7 @@ struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
  
@@ -8,7 +8,7 @@
  	struct survey_info *cur_survey;
  	struct survey_info survey[ATH9K_NUM_CHANNELS];
  
-@@ -893,6 +894,7 @@ struct fft_sample_ht20 {
+@@ -895,6 +896,7 @@ struct fft_sample_ht20 {
  	u8 data[SPECTRAL_HT20_NUM_BINS];
  } __packed;
  
@@ -18,7 +18,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -2050,6 +2050,50 @@ static const struct file_operations fops
+@@ -2059,6 +2059,50 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -69,7 +69,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -2069,6 +2113,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -2078,6 +2122,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
@@ -80,7 +80,7 @@
  	debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1136,7 +1136,7 @@ int ath9k_spectral_scan_config(struct ie
+@@ -1140,7 +1140,7 @@ int ath9k_spectral_scan_config(struct ie
  	return 0;
  }
  
@@ -89,10 +89,10 @@
  {
  	struct ath_softc *sc = hw->priv;
  	struct ath_hw *ah = sc->sc_ah;
-@@ -1190,9 +1190,11 @@ static int ath9k_config(struct ieee80211
- 
- 	if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
- 		struct ieee80211_channel *curchan = hw->conf.channel;
+@@ -1196,9 +1196,11 @@ static int ath9k_config(struct ieee80211
+ 		struct ieee80211_channel *curchan = hw->conf.chandef.chan;
+ 		enum nl80211_channel_type channel_type =
+ 			cfg80211_get_chandef_type(&conf->chandef);
 +		struct ath9k_channel *hchan;
  		int pos = curchan->hw_value;
  		int old_pos = -1;
@@ -101,7 +101,7 @@
  
  		if (ah->curchan)
  			old_pos = ah->curchan - &ah->channels[0];
-@@ -1235,7 +1237,23 @@ static int ath9k_config(struct ieee80211
+@@ -1241,7 +1243,23 @@ static int ath9k_config(struct ieee80211
  			memset(&sc->survey[pos], 0, sizeof(struct survey_info));
  		}
  
diff --git a/package/mac80211/patches/520-mac80211_cur_txpower.patch b/package/mac80211/patches/520-mac80211_cur_txpower.patch
index f0ed3d944d..80d3c568e1 100644
--- a/package/mac80211/patches/520-mac80211_cur_txpower.patch
+++ b/package/mac80211/patches/520-mac80211_cur_txpower.patch
@@ -1,16 +1,16 @@
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1554,6 +1554,7 @@ struct ieee80211_hw {
+@@ -1605,6 +1605,7 @@ struct ieee80211_hw {
  	u8 max_tx_aggregation_subframes;
  	u8 offchannel_tx_hw_queue;
  	u8 radiotap_mcs_details;
 +	s8 cur_power_level;
  	u16 radiotap_vht_details;
  	netdev_features_t netdev_features;
- };
+ 	u8 uapsd_queues;
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2190,7 +2190,9 @@ static int ieee80211_get_tx_power(struct
+@@ -2259,7 +2259,9 @@ static int ieee80211_get_tx_power(struct
  	struct ieee80211_local *local = wiphy_priv(wiphy);
  	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  
@@ -23,7 +23,7 @@
  		*dbm = sdata->vif.bss_conf.txpower;
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -166,6 +166,7 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -167,6 +167,7 @@ static u32 ieee80211_hw_conf_chan(struct
  
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
diff --git a/package/mac80211/patches/521-ath9k_cur_txpower.patch b/package/mac80211/patches/521-ath9k_cur_txpower.patch
index f4c1f5d54f..134031219b 100644
--- a/package/mac80211/patches/521-ath9k_cur_txpower.patch
+++ b/package/mac80211/patches/521-ath9k_cur_txpower.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1260,6 +1260,8 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1266,6 +1266,8 @@ int ath9k_config(struct ieee80211_hw *hw
  			return -EINVAL;
  		}
  
@@ -9,7 +9,7 @@
  		/*
  		 * The most recent snapshot of channel->noisefloor for the old
  		 * channel is only available after the hardware reset. Copy it to
-@@ -1279,6 +1281,7 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1302,6 +1304,7 @@ int ath9k_config(struct ieee80211_hw *hw
  		sc->config.txpowlimit = 2 * conf->power_level;
  		ath9k_cmn_update_txpow(ah, sc->curtxpow,
  				       sc->config.txpowlimit, &sc->curtxpow);
diff --git a/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch b/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch
index 6808cc4df7..6aac4389f7 100644
--- a/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch
+++ b/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch
@@ -1,121 +1,3 @@
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -839,6 +839,9 @@ enum mac80211_rx_flags {
-  * @signal: signal strength when receiving this frame, either in dBm, in dB or
-  *	unspecified depending on the hardware capabilities flags
-  *	@IEEE80211_HW_SIGNAL_*
-+ * @chains: bitmask of receive chains for which separate signal strength
-+ *	values were filled.
-+ * @chain_signal: per-chain signal strength, same format as @signal
-  * @antenna: antenna used
-  * @rate_idx: index of data rate into band's supported rates or MCS index if
-  *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
-@@ -870,6 +873,8 @@ struct ieee80211_rx_status {
- 	u8 band;
- 	u8 antenna;
- 	s8 signal;
-+	u8 chains;
-+	s8 chain_signal[4];
- 	u8 ampdu_delimiter_crc;
- 	u8 vendor_radiotap_align;
- 	u8 vendor_radiotap_oui[3];
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -342,6 +342,11 @@ struct sta_info {
- 	int last_signal;
- 	struct ewma avg_signal;
- 	int last_ack_signal;
-+
-+	u8 chains;
-+	s8 chain_signal_last[4];
-+	struct ewma chain_signal_avg[4];
-+
- 	/* Plus 1 for non-QoS frames */
- 	__le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -1383,6 +1383,7 @@ ieee80211_rx_h_sta_process(struct ieee80
- 	struct sk_buff *skb = rx->skb;
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	int i;
- 
- 	if (!sta)
- 		return RX_CONTINUE;
-@@ -1433,6 +1434,19 @@ ieee80211_rx_h_sta_process(struct ieee80
- 		ewma_add(&sta->avg_signal, -status->signal);
- 	}
- 
-+	if (status->chains) {
-+		sta->chains = status->chains;
-+		for (i = 0; i < 4; i++) {
-+			int signal = status->chain_signal[i];
-+
-+			if (!(status->chains & BIT(i)))
-+				continue;
-+
-+			sta->chain_signal_last[i] = signal;
-+			ewma_add(&sta->chain_signal_avg[i], -signal);
-+		}
-+	}
-+
- 	/*
- 	 * Change STA power saving mode only at the end of a frame
- 	 * exchange sequence.
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -353,6 +353,8 @@ struct sta_info *sta_info_alloc(struct i
- 	do_posix_clock_monotonic_gettime(&uptime);
- 	sta->last_connected = uptime.tv_sec;
- 	ewma_init(&sta->avg_signal, 1024, 8);
-+	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
-+		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
- 
- 	if (sta_prepare_rate_control(local, sta, gfp)) {
- 		kfree(sta);
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -721,6 +721,8 @@ struct station_parameters {
-  * @STATION_INFO_LOCAL_PM: @local_pm filled
-  * @STATION_INFO_PEER_PM: @peer_pm filled
-  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
-+ * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
-+ * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
-  */
- enum station_info_flags {
- 	STATION_INFO_INACTIVE_TIME	= 1<<0,
-@@ -749,6 +751,8 @@ enum station_info_flags {
- 	STATION_INFO_NONPEER_PM		= 1<<23,
- 	STATION_INFO_RX_BYTES64		= 1<<24,
- 	STATION_INFO_TX_BYTES64		= 1<<25,
-+	STATION_INFO_CHAIN_SIGNAL	= 1<<26,
-+	STATION_INFO_CHAIN_SIGNAL_AVG	= 1<<27,
- };
- 
- /**
-@@ -842,6 +846,9 @@ struct sta_bss_parameters {
-  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
-  * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
-  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
-+ * @chains: bitmask for filled values in @chain_signal, @chain_signal_avg
-+ * @chain_signal: per-chain signal strength of last received packet in dBm
-+ * @chain_signal_avg: per-chain signal strength average in dBm
-  * @txrate: current unicast bitrate from this station
-  * @rxrate: current unicast bitrate to this station
-  * @rx_packets: packets received from this station
-@@ -877,6 +884,11 @@ struct station_info {
- 	u8 plink_state;
- 	s8 signal;
- 	s8 signal_avg;
-+
-+	u8 chains;
-+	s8 chain_signal[4];
-+	s8 chain_signal_avg[4];
-+
- 	struct rate_info txrate;
- 	struct rate_info rxrate;
- 	u32 rx_packets;
 --- a/drivers/net/wireless/ath/ath9k/mac.h
 +++ b/drivers/net/wireless/ath/ath9k/mac.h
 @@ -133,12 +133,8 @@ struct ath_rx_status {
@@ -135,15 +17,15 @@
  	u8 rs_num_delims;
 --- a/drivers/net/wireless/ath/ath9k/recv.c
 +++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -937,6 +937,7 @@ static int ath9k_rx_skb_preprocess(struc
- 				   bool *decrypt_error)
- {
- 	struct ath_hw *ah = common->ah;
+@@ -950,6 +950,7 @@ static int ath9k_rx_skb_preprocess(struc
+ 	struct ath_hw *ah = sc->sc_ah;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	bool discard_current = sc->rx.discard_next;
 +	int i, j;
  
- 	/*
- 	 * everything but the rate is checked here, the rate check is done
-@@ -962,6 +963,20 @@ static int ath9k_rx_skb_preprocess(struc
+ 	sc->rx.discard_next = rx_stats->rs_more;
+ 	if (discard_current)
+@@ -979,6 +980,21 @@ static int ath9k_rx_skb_preprocess(struc
  	if (rx_stats->rs_moreaggr)
  		rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
  
@@ -161,10 +43,11 @@
 +		j++;
 +	}
 +
++
+ 	sc->rx.discard_next = false;
  	return 0;
  }
- 
-@@ -1070,7 +1085,7 @@ static int ath_process_fft(struct ath_so
+@@ -1088,7 +1104,7 @@ static int ath_process_fft(struct ath_so
  	fft_sample.tlv.length = __cpu_to_be16(length);
  
  	fft_sample.freq = __cpu_to_be16(ah->curchan->chan->center_freq);
@@ -236,7 +119,7 @@
  	if (ads.ds_rxstatus8 & AR_RxKeyIdxValid)
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -940,12 +940,12 @@ void ath_debug_stat_rx(struct ath_softc 
+@@ -943,12 +943,12 @@ void ath_debug_stat_rx(struct ath_softc 
  #ifdef CONFIG_ATH9K_MAC_DEBUG
  	spin_lock(&sc->debug.samp_lock);
  	RX_SAMP_DBG(jiffies) = jiffies;
@@ -255,108 +138,6 @@
  	RX_SAMP_DBG(antenna) = rs->rs_antenna;
  	RX_SAMP_DBG(rssi) = rs->rs_rssi;
  	RX_SAMP_DBG(rate) = rs->rs_rate;
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -1918,6 +1918,8 @@ enum nl80211_sta_bss_param {
-  * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
-  * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
-  *	non-peer STA
-+ * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
-+ * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
-  * @__NL80211_STA_INFO_AFTER_LAST: internal
-  * @NL80211_STA_INFO_MAX: highest possible station info attribute
-  */
-@@ -1947,6 +1949,8 @@ enum nl80211_sta_info {
- 	NL80211_STA_INFO_NONPEER_PM,
- 	NL80211_STA_INFO_RX_BYTES64,
- 	NL80211_STA_INFO_TX_BYTES64,
-+	NL80211_STA_INFO_CHAIN_SIGNAL,
-+	NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
- 
- 	/* keep last */
- 	__NL80211_STA_INFO_AFTER_LAST,
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -3082,6 +3082,32 @@ static bool nl80211_put_sta_rate(struct 
- 	return true;
- }
- 
-+static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
-+			       int id)
-+{
-+	void *attr;
-+	int i = 0;
-+
-+	if (!mask)
-+		return true;
-+
-+	attr = nla_nest_start(msg, id);
-+	if (!attr)
-+		return false;
-+
-+	for (i = 0; i < 4; i++) {
-+		if (!(mask & BIT(i)))
-+			continue;
-+
-+		if (nla_put_u8(msg, i, signal[i]))
-+			return false;
-+	}
-+
-+	nla_nest_end(msg, attr);
-+
-+	return true;
-+}
-+
- static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
- 				int flags,
- 				struct cfg80211_registered_device *rdev,
-@@ -3153,6 +3179,18 @@ static int nl80211_send_station(struct s
- 	default:
- 		break;
- 	}
-+	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
-+		if (!nl80211_put_signal(msg, sinfo->chains,
-+					sinfo->chain_signal,
-+					NL80211_STA_INFO_CHAIN_SIGNAL))
-+			goto nla_put_failure;
-+	}
-+	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
-+		if (!nl80211_put_signal(msg, sinfo->chains,
-+					sinfo->chain_signal_avg,
-+					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
-+			goto nla_put_failure;
-+	}
- 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
- 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
- 					  NL80211_STA_INFO_TX_BITRATE))
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -445,6 +445,7 @@ static void sta_set_sinfo(struct sta_inf
- 	struct ieee80211_sub_if_data *sdata = sta->sdata;
- 	struct ieee80211_local *local = sdata->local;
- 	struct timespec uptime;
-+	int i;
- 
- 	sinfo->generation = sdata->local->sta_generation;
- 
-@@ -484,6 +485,17 @@ static void sta_set_sinfo(struct sta_inf
- 			sinfo->signal = (s8)sta->last_signal;
- 		sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
- 	}
-+	if (sta->chains) {
-+		sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
-+				 STATION_INFO_CHAIN_SIGNAL_AVG;
-+
-+		sinfo->chains = sta->chains;
-+		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
-+			sinfo->chain_signal[i] = sta->chain_signal_last[i];
-+			sinfo->chain_signal_avg[i] =
-+				(s8) -ewma_read(&sta->chain_signal_avg[i]);
-+		}
-+	}
- 
- 	sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
- 	sta_set_rate_info_rx(sta, &sinfo->rxrate);
 --- a/drivers/net/wireless/ath/ath9k/dfs.c
 +++ b/drivers/net/wireless/ath/ath9k/dfs.c
 @@ -164,8 +164,8 @@ void ath9k_dfs_process_phyerr(struct ath
diff --git a/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch b/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch
index 99bd2e3ba5..a3ba00dc46 100644
--- a/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch
+++ b/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch
@@ -1,14 +1,14 @@
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -978,6 +978,7 @@ enum ieee80211_smps_mode {
+@@ -988,6 +988,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
 + * @max_antenna_gain: maximum antenna gain adjusted by user config (in dBi)
   *
-  * @channel: the channel to tune to
-  * @channel_type: the channel (HT) type
-@@ -1000,6 +1001,7 @@ struct ieee80211_conf {
+  * @chandef: the channel definition to tune to
+  * @radar_enabled: whether radar detection is enabled
+@@ -1009,6 +1010,7 @@ struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
  	int max_sleep_period;
@@ -18,7 +18,7 @@
  	u8 ps_dtim_period;
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1116,6 +1116,7 @@ struct ieee80211_local {
+@@ -1110,6 +1110,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -28,9 +28,9 @@
  
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -1654,6 +1654,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_STA_CAPABILITY,
- 	NL80211_ATTR_STA_EXT_CAPABILITY,
+@@ -1709,6 +1709,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_MDID,
+ 	NL80211_ATTR_IE_RIC,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -39,15 +39,15 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -370,6 +370,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
- 	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
+@@ -378,6 +378,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
+ 	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
+ 				  .len = IEEE80211_MAX_DATA_LEN },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -1706,6 +1707,22 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -1990,6 +1991,22 @@ static int nl80211_set_wiphy(struct sk_b
  			goto bad_res;
  	}
  
@@ -72,7 +72,7 @@
  		u32 tx_ant, rx_ant;
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2212,6 +2212,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2269,6 +2269,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -92,7 +92,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3375,6 +3388,7 @@ struct cfg80211_ops mac80211_config_ops 
+@@ -3459,6 +3472,7 @@ struct cfg80211_ops mac80211_config_ops 
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -102,7 +102,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -1862,6 +1862,7 @@ struct cfg80211_gtk_rekey_data {
+@@ -1921,6 +1921,7 @@ struct cfg80211_update_ft_ies_params {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -110,7 +110,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -2071,6 +2072,7 @@ struct cfg80211_ops {
+@@ -2134,6 +2135,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -122,20 +122,20 @@
 +++ b/net/mac80211/main.c
 @@ -101,7 +101,7 @@ static u32 ieee80211_hw_conf_chan(struct
  	struct ieee80211_sub_if_data *sdata;
- 	struct ieee80211_channel *chan;
+ 	struct cfg80211_chan_def chandef = {};
  	u32 changed = 0;
 -	int power;
 +	int power, ant_gain, max_power;
- 	enum nl80211_channel_type channel_type;
  	u32 offchannel_flag;
- 	bool scanning = false;
-@@ -164,8 +164,21 @@ static u32 ieee80211_hw_conf_chan(struct
+ 
+ 	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+@@ -165,8 +165,21 @@ static u32 ieee80211_hw_conf_chan(struct
  	}
  	rcu_read_unlock();
  
 -	if (local->hw.conf.power_level != power) {
-+	max_power = chan->max_reg_power;
-+	ant_gain = chan->max_antenna_gain;
++	max_power = chandef.chan->max_reg_power;
++	ant_gain = chandef.chan->max_antenna_gain;
 +	if (local->user_antenna_gain > 0) {
 +		if (local->user_antenna_gain > ant_gain) {
 +			max_power -= local->user_antenna_gain - ant_gain;
@@ -152,11 +152,11 @@
  		local->hw.cur_power_level = power;
  		local->hw.conf.power_level = power;
  	}
-@@ -612,6 +625,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(
+@@ -597,6 +610,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
 +	local->user_antenna_gain = 0;
+ 	local->hw.uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+ 	local->hw.uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
- 	wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
- 
diff --git a/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch b/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch
index d249fd3780..bee6517602 100644
--- a/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch
+++ b/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch
@@ -10,7 +10,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2817,7 +2817,7 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2843,7 +2843,7 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
@@ -21,7 +21,7 @@
  	if (ant_gain > max_gain)
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1277,7 +1277,10 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1300,7 +1300,10 @@ int ath9k_config(struct ieee80211_hw *hw
  	}
  
  	if (changed & IEEE80211_CONF_CHANGE_POWER) {
diff --git a/package/mac80211/patches/530-ath9k_extra_leds.patch b/package/mac80211/patches/530-ath9k_extra_leds.patch
index fd7596f480..e457a34eb3 100644
--- a/package/mac80211/patches/530-ath9k_extra_leds.patch
+++ b/package/mac80211/patches/530-ath9k_extra_leds.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -551,6 +551,9 @@ struct ath9k_wow_pattern {
+@@ -553,6 +553,9 @@ struct ath9k_wow_pattern {
  void ath_init_leds(struct ath_softc *sc);
  void ath_deinit_leds(struct ath_softc *sc);
  void ath_fill_led_pin(struct ath_softc *sc);
@@ -10,7 +10,7 @@
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -685,6 +688,13 @@ enum spectral_mode {
+@@ -687,6 +690,13 @@ enum spectral_mode {
  	SPECTRAL_CHANSCAN,
  };
  
@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -726,9 +736,8 @@ struct ath_softc {
+@@ -728,9 +738,8 @@ struct ath_softc {
  	struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
  
  #ifdef CONFIG_MAC80211_LEDS
@@ -162,7 +162,7 @@
  void ath_fill_led_pin(struct ath_softc *sc)
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -870,7 +870,7 @@ int ath9k_init_device(u16 devid, struct 
+@@ -891,7 +891,7 @@ int ath9k_init_device(u16 devid, struct 
  
  #ifdef CONFIG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -173,7 +173,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1482,6 +1482,61 @@ static const struct file_operations fops
+@@ -1489,6 +1489,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -235,7 +235,7 @@
  #ifdef CONFIG_ATH9K_MAC_DEBUG
  
  void ath9k_debug_samp_bb_mac(struct ath_softc *sc)
-@@ -2115,6 +2170,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -2124,6 +2179,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);
diff --git a/package/mac80211/patches/540-mac80211_optimize_mcs_rate_mask.patch b/package/mac80211/patches/540-mac80211_optimize_mcs_rate_mask.patch
deleted file mode 100644
index 347c920135..0000000000
--- a/package/mac80211/patches/540-mac80211_optimize_mcs_rate_mask.patch
+++ /dev/null
@@ -1,98 +0,0 @@
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -739,6 +739,8 @@ struct ieee80211_sub_if_data {
- 
- 	/* bitmap of allowed (non-MCS) rate indexes for rate control */
- 	u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
-+
-+	bool rc_has_mcs_mask[IEEE80211_NUM_BANDS];
- 	u8  rc_rateidx_mcs_mask[IEEE80211_NUM_BANDS][IEEE80211_HT_MCS_MASK_LEN];
- 
- 	union {
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -2386,9 +2386,20 @@ static int ieee80211_set_bitrate_mask(st
- 	}
- 
- 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
-+		struct ieee80211_supported_band *sband = wiphy->bands[i];
-+
- 		sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
- 		memcpy(sdata->rc_rateidx_mcs_mask[i], mask->control[i].mcs,
- 		       sizeof(mask->control[i].mcs));
-+
-+		sdata->rc_has_mcs_mask[i] = false;
-+		if (!sband)
-+			continue;
-+
-+		if (memcmp(sdata->rc_rateidx_mcs_mask[i],
-+			   sband->ht_cap.mcs.rx_mask,
-+			   sizeof(sband->ht_cap.mcs.rx_mask)) != 0)
-+			sdata->rc_has_mcs_mask[i] = true;
- 	}
- 
- 	return 0;
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4091,7 +4091,7 @@ void ieee80211_send_bar(struct ieee80211
-  *	(deprecated; this will be removed once drivers get updated to use
-  *	rate_idx_mask)
-  * @rate_idx_mask: user-requested (legacy) rate mask
-- * @rate_idx_mcs_mask: user-requested MCS rate mask
-+ * @rate_idx_mcs_mask: user-requested MCS rate mask (NULL if not in use)
-  * @bss: whether this frame is sent out in AP or IBSS mode
-  */
- struct ieee80211_tx_rate_control {
-@@ -4103,7 +4103,7 @@ struct ieee80211_tx_rate_control {
- 	bool rts, short_preamble;
- 	u8 max_rate_idx;
- 	u32 rate_idx_mask;
--	u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
-+	u8 *rate_idx_mcs_mask;
- 	bool bss;
- };
- 
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -641,9 +641,11 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 		txrc.max_rate_idx = -1;
- 	else
- 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
--	memcpy(txrc.rate_idx_mcs_mask,
--	       tx->sdata->rc_rateidx_mcs_mask[info->band],
--	       sizeof(txrc.rate_idx_mcs_mask));
-+
-+	if (tx->sdata->rc_has_mcs_mask[info->band])
-+		txrc.rate_idx_mcs_mask =
-+			tx->sdata->rc_rateidx_mcs_mask[info->band];
-+
- 	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
- 		    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
- 		    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
-@@ -2511,8 +2513,6 @@ struct sk_buff *ieee80211_beacon_get_tim
- 		txrc.max_rate_idx = -1;
- 	else
- 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
--	memcpy(txrc.rate_idx_mcs_mask, sdata->rc_rateidx_mcs_mask[band],
--	       sizeof(txrc.rate_idx_mcs_mask));
- 	txrc.bss = true;
- 	rate_control_get_rate(sdata, NULL, &txrc);
- 
---- a/net/mac80211/rate.c
-+++ b/net/mac80211/rate.c
-@@ -460,9 +460,12 @@ void rate_control_get_rate(struct ieee80
- 	 * the common case.
- 	 */
- 	mask = sdata->rc_rateidx_mask[info->band];
--	memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
--	       sizeof(mcs_mask));
--	if (mask != (1 << txrc->sband->n_bitrates) - 1) {
-+	if (mask != (1 << txrc->sband->n_bitrates) - 1 || txrc->rate_idx_mcs_mask) {
-+		if (txrc->rate_idx_mcs_mask)
-+			memcpy(mcs_mask, txrc->rate_idx_mcs_mask, sizeof(mcs_mask));
-+		else
-+			memset(mcs_mask, 0xff, sizeof(mcs_mask));
-+
- 		if (sta) {
- 			/* Filter out rates that the STA does not support */
- 			mask &= sta->sta.supp_rates[info->band];
diff --git a/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch b/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch
index 606eb1c63d..4920ccbd71 100644
--- a/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch
+++ b/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/mac.c
 +++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -689,7 +689,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
+@@ -697,7 +697,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
  {
  #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
  	struct ath_common *common = ath9k_hw_common(ah);
@@ -9,7 +9,7 @@
  	int i;
  
  	/* Enable access to the DMA observation bus */
-@@ -719,6 +719,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
+@@ -727,6 +727,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
  	}
  
  	if (i == 0) {
diff --git a/package/mac80211/patches/553-ath9k_debugfs_diag.patch b/package/mac80211/patches/553-ath9k_debugfs_diag.patch
index 9618698f54..efbfadfbd3 100644
--- a/package/mac80211/patches/553-ath9k_debugfs_diag.patch
+++ b/package/mac80211/patches/553-ath9k_debugfs_diag.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -2149,6 +2149,50 @@ static const struct file_operations fops
+@@ -2158,6 +2158,50 @@ static const struct file_operations fops
  };
  
  
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -2174,6 +2218,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -2183,6 +2227,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -62,7 +62,7 @@
  	debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -500,6 +500,12 @@ enum {
+@@ -499,6 +499,12 @@ enum {
  	ATH9K_RESET_COLD,
  };
  
@@ -75,7 +75,7 @@
  struct ath9k_hw_version {
  	u32 magic;
  	u16 devid;
-@@ -778,6 +784,8 @@ struct ath_hw {
+@@ -777,6 +783,8 @@ struct ath_hw {
  	u32 rfkill_polarity;
  	u32 ah_flags;
  
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1041,6 +1049,7 @@ void ath9k_hw_set_sta_beacon_timers(stru
+@@ -1027,6 +1035,7 @@ void ath9k_hw_set_sta_beacon_timers(stru
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
@@ -94,7 +94,7 @@
  void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause);
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1747,6 +1747,20 @@ fail:
+@@ -1845,6 +1845,20 @@ fail:
  	return -EINVAL;
  }
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2023,6 +2037,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2046,6 +2060,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  	}
  
  	ath9k_hw_apply_gpio_override(ah);
@@ -125,7 +125,7 @@
  		REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV, AR_BTCOEX_WL_LNADIV_FORCE_ON);
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -459,6 +459,11 @@ irqreturn_t ath_isr(int irq, void *dev)
+@@ -463,6 +463,11 @@ irqreturn_t ath_isr(int irq, void *dev)
  	ath9k_hw_getisr(ah, &status);	/* NB: clears ISR too */
  	status &= ah->imask;	/* discard unasked-for bits */
  
diff --git a/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch b/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch
index 45b02ebe5c..c2fd8733b9 100644
--- a/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch
+++ b/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch
@@ -12,7 +12,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2413,17 +2413,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw
+@@ -2439,17 +2439,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw
  	}
  
  	eeval = ah->eep_ops->get_eeprom(ah, EEP_OP_MODE);
@@ -48,7 +48,7 @@
  	    AR_SREV_9285(ah) ||
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -961,6 +961,8 @@ struct ath_hw {
+@@ -947,6 +947,8 @@ struct ath_hw {
  	bool is_clk_25mhz;
  	int (*get_mac_revision)(void);
  	int (*external_reset)(void);
@@ -59,7 +59,7 @@
  };
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -587,6 +587,8 @@ static int ath9k_init_softc(u16 devid, s
+@@ -591,6 +591,8 @@ static int ath9k_init_softc(u16 devid, s
  		ah->is_clk_25mhz = pdata->is_clk_25mhz;
  		ah->get_mac_revision = pdata->get_mac_revision;
  		ah->external_reset = pdata->external_reset;
diff --git a/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch b/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch
deleted file mode 100644
index a7609ede47..0000000000
--- a/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- a/drivers/net/wireless/rt2x00/rt2x00pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
-@@ -208,6 +208,7 @@ void rt2x00pci_uninitialize(struct rt2x0
- }
- EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
- 
-+#ifdef CONFIG_PCI
- /*
-  * PCI driver handlers.
-  */
-@@ -392,6 +393,7 @@ int rt2x00pci_resume(struct pci_dev *pci
- }
- EXPORT_SYMBOL_GPL(rt2x00pci_resume);
- #endif /* CONFIG_PM */
-+#endif /* CONFIG_PCI */
- 
- /*
-  * rt2x00pci module information.
diff --git a/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch b/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch
index 9ff50b7bfe..225b6207eb 100644
--- a/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch
+++ b/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/rt2x00/rt2x00pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
-@@ -273,8 +273,10 @@ int rt2x00pci_probe(struct pci_dev *pci_
+@@ -96,8 +96,10 @@ int rt2x00pci_probe(struct pci_dev *pci_
  
  	pci_set_master(pci_dev);
  
diff --git a/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch b/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
index 07e72e39f4..0c9cf81ccf 100644
--- a/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
@@ -101,7 +101,7 @@
 +}
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -559,6 +559,7 @@ struct rt2x00lib_ops {
+@@ -560,6 +560,7 @@ struct rt2x00lib_ops {
  			       const u8 *data, const size_t len);
  	int (*load_firmware) (struct rt2x00_dev *rt2x00dev,
  			      const u8 *data, const size_t len);
@@ -109,7 +109,7 @@
  
  	/*
  	 * Device initialization/deinitialization handlers.
-@@ -719,6 +720,7 @@ enum rt2x00_capability_flags {
+@@ -720,6 +721,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_SW_SEQNO,
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
@@ -117,7 +117,7 @@
  
  	/*
  	 * Capabilities
-@@ -988,6 +990,11 @@ struct rt2x00_dev {
+@@ -989,6 +991,11 @@ struct rt2x00_dev {
  	const struct firmware *fw;
  
  	/*
@@ -156,15 +156,15 @@
  #ifdef CONFIG_RT2X00_LIB_DEBUGFS
 --- a/drivers/net/wireless/rt2x00/Kconfig
 +++ b/drivers/net/wireless/rt2x00/Kconfig
-@@ -60,6 +60,7 @@ config RT2800PCI
+@@ -64,6 +64,7 @@ config RT2800PCI
  	select RT2X00_LIB_PCI if PCI
- 	select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
+ 	select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
  	select RT2X00_LIB_FIRMWARE
 +	select RT2X00_LIB_EEPROM
  	select RT2X00_LIB_CRYPTO
  	select CRC_CCITT
  	select EEPROM_93CX6
-@@ -212,6 +213,9 @@ config RT2X00_LIB_FIRMWARE
+@@ -221,6 +222,9 @@ config RT2X00_LIB_FIRMWARE
  config RT2X00_LIB_CRYPTO
  	boolean
  
@@ -183,14 +183,14 @@
 +rt2x00lib-$(CONFIG_RT2X00_LIB_EEPROM)	+= rt2x00eeprom.o
  
  obj-$(CONFIG_RT2X00_LIB)		+= rt2x00lib.o
- obj-$(CONFIG_RT2X00_LIB_PCI)		+= rt2x00pci.o
+ obj-$(CONFIG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -89,25 +89,11 @@ static void rt2800pci_mcu_status(struct 
- 	rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+@@ -90,25 +90,11 @@ static void rt2800pci_mcu_status(struct 
+ 	rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
  }
  
--#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+-#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
  static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
  {
 -	void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
@@ -209,11 +209,11 @@
 -{
 -	return -ENOMEM;
 -}
--#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+-#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
  
  #ifdef CONFIG_PCI
  static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
-@@ -331,6 +317,20 @@ static int rt2800pci_write_firmware(stru
+@@ -332,6 +318,20 @@ static int rt2800pci_write_firmware(stru
  }
  
  /*
@@ -234,13 +234,13 @@
   * Initialization functions.
   */
  static bool rt2800pci_get_entry_state(struct queue_entry *entry)
-@@ -1046,6 +1046,7 @@ static const struct rt2x00lib_ops rt2800
+@@ -1162,6 +1162,7 @@ static const struct rt2x00lib_ops rt2800
  	.get_firmware_name	= rt2800pci_get_firmware_name,
  	.check_firmware		= rt2800_check_firmware,
  	.load_firmware		= rt2800_load_firmware,
-+	.get_eeprom_file_name   = rt2800pci_get_eeprom_file_name,
- 	.initialize		= rt2x00pci_initialize,
- 	.uninitialize		= rt2x00pci_uninitialize,
++	.get_eeprom_file_name	= rt2800pci_get_eeprom_file_name,
+ 	.initialize		= rt2x00mmio_initialize,
+ 	.uninitialize		= rt2x00mmio_uninitialize,
  	.get_entry_state	= rt2800pci_get_entry_state,
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
diff --git a/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch b/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
index d9f17646c7..31b58d93d2 100644
--- a/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
+++ b/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -640,6 +640,7 @@ export CONFIG_RT2X00=y
+@@ -647,6 +647,7 @@ export CONFIG_RT2X00=y
  export CONFIG_RT2X00_LIB=m
  export CONFIG_RT2800_LIB=m
  export CONFIG_RT2X00_LIB_FIRMWARE=y
diff --git a/package/mac80211/patches/605-rt2x00-pci-eeprom.patch b/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
index 33eb28f5f6..dd0596fd31 100644
--- a/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
+++ b/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
@@ -1,15 +1,15 @@
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -89,7 +89,7 @@ static void rt2800pci_mcu_status(struct 
- 	rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+@@ -90,7 +90,7 @@ static void rt2800pci_mcu_status(struct 
+ 	rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
  }
  
 -static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 +static int rt2800pci_read_eeprom_file(struct rt2x00_dev *rt2x00dev)
  {
  	memcpy(rt2x00dev->eeprom, rt2x00dev->eeprom_file->data, EEPROM_SIZE);
- 	return 0;
-@@ -983,8 +983,9 @@ static int rt2800pci_read_eeprom(struct 
+ 	return -ENOMEM;
+@@ -1099,8 +1099,9 @@ static int rt2800pci_read_eeprom(struct 
  {
  	int retval;
  
@@ -23,7 +23,7 @@
  	else
 --- a/drivers/net/wireless/rt2x00/rt2x00pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
-@@ -255,6 +255,7 @@ exit:
+@@ -78,6 +78,7 @@ exit:
  int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
  {
  	struct ieee80211_hw *hw;
@@ -31,7 +31,7 @@
  	struct rt2x00_dev *rt2x00dev;
  	int retval;
  	u16 chip;
-@@ -300,6 +301,12 @@ int rt2x00pci_probe(struct pci_dev *pci_
+@@ -123,6 +124,12 @@ int rt2x00pci_probe(struct pci_dev *pci_
  	rt2x00dev->irq = pci_dev->irq;
  	rt2x00dev->name = pci_name(pci_dev);
  
diff --git a/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
index 0b0c30ed0e..937f1c9cb2 100644
--- a/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -424,6 +424,7 @@ struct hw_mode_spec {
+@@ -425,6 +425,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/mac80211/patches/608-add_platform_data_mac_addr.patch b/package/mac80211/patches/608-add_platform_data_mac_addr.patch
index bb77df9e7d..97307f01a9 100644
--- a/package/mac80211/patches/608-add_platform_data_mac_addr.patch
+++ b/package/mac80211/patches/608-add_platform_data_mac_addr.patch
@@ -31,7 +31,7 @@
  {
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -1314,6 +1314,7 @@ static inline void rt2x00debug_dump_fram
+@@ -1337,6 +1337,7 @@ static inline void rt2x00debug_dump_fram
   */
  u32 rt2x00lib_get_bssidx(struct rt2x00_dev *rt2x00dev,
  			 struct ieee80211_vif *vif);
@@ -41,15 +41,15 @@
   * Interrupt context handlers.
 --- a/drivers/net/wireless/rt2x00/rt61pci.c
 +++ b/drivers/net/wireless/rt2x00/rt61pci.c
-@@ -2392,6 +2392,7 @@ static int rt61pci_validate_eeprom(struc
+@@ -2396,6 +2396,7 @@ static int rt61pci_validate_eeprom(struc
  	u32 reg;
  	u16 word;
  	u8 *mac;
 +	const u8 *pdata_mac;
  	s8 value;
  
- 	rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
-@@ -2412,7 +2413,11 @@ static int rt61pci_validate_eeprom(struc
+ 	rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
+@@ -2416,7 +2417,11 @@ static int rt61pci_validate_eeprom(struc
  	/*
  	 * Start validation of the data that has been read.
  	 */
diff --git a/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch b/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
index bf070e68f3..7c76b5a9fd 100644
--- a/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
+++ b/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -2249,15 +2249,18 @@ static void rt2800_config_channel(struct
+@@ -2622,15 +2622,18 @@ static void rt2800_config_channel(struct
  	/*
  	 * Change BBP settings
  	 */
@@ -22,7 +22,7 @@
  		rt2800_bbp_write(rt2x00dev, 86, 0);
  	}
  
-@@ -3670,6 +3673,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4203,6 +4206,7 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 120, 0x50);
  
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
@@ -30,7 +30,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 128, 0x12);
-@@ -3976,6 +3980,12 @@ static void rt2800_init_rfcsr_3290(struc
+@@ -4507,6 +4511,12 @@ static void rt2800_init_rfcsr_3290(struc
  
  static void rt2800_init_rfcsr_3352(struct rt2x00_dev *rt2x00dev)
  {
@@ -43,7 +43,7 @@
  	rt2800_rfcsr_write(rt2x00dev, 0, 0xf0);
  	rt2800_rfcsr_write(rt2x00dev, 1, 0x23);
  	rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
-@@ -4009,15 +4019,30 @@ static void rt2800_init_rfcsr_3352(struc
+@@ -4540,15 +4550,30 @@ static void rt2800_init_rfcsr_3352(struc
  	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
  	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
  	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
@@ -77,7 +77,7 @@
  	rt2800_rfcsr_write(rt2x00dev, 43, 0xdb);
  	rt2800_rfcsr_write(rt2x00dev, 44, 0xdb);
  	rt2800_rfcsr_write(rt2x00dev, 45, 0xdb);
-@@ -4025,15 +4050,20 @@ static void rt2800_init_rfcsr_3352(struc
+@@ -4556,15 +4581,20 @@ static void rt2800_init_rfcsr_3352(struc
  	rt2800_rfcsr_write(rt2x00dev, 47, 0x0d);
  	rt2800_rfcsr_write(rt2x00dev, 48, 0x14);
  	rt2800_rfcsr_write(rt2x00dev, 49, 0x00);
@@ -107,7 +107,7 @@
  	rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
  	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
  	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
-@@ -4949,7 +4979,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -5534,7 +5564,8 @@ static int rt2800_init_eeprom(struct rt2
  	/*
  	 * Detect if this device has Bluetooth co-existence.
  	 */
@@ -117,7 +117,7 @@
  		__set_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags);
  
  	/*
-@@ -4978,6 +5009,22 @@ static int rt2800_init_eeprom(struct rt2
+@@ -5563,6 +5594,22 @@ static int rt2800_init_eeprom(struct rt2
  					EIRP_MAX_TX_POWER_LIMIT)
  		__set_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags);
  
@@ -142,7 +142,7 @@
  
 --- a/drivers/net/wireless/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/rt2x00/rt2800.h
-@@ -2117,6 +2117,12 @@ struct mac_iveiv_entry {
+@@ -2153,6 +2153,12 @@ struct mac_iveiv_entry {
  #define RFCSR31_RX_CALIB		FIELD8(0x7f)
  
  /*
@@ -155,7 +155,7 @@
   * RFCSR 38:
   */
  #define RFCSR38_RX_LO1_EN		FIELD8(0x20)
-@@ -2127,6 +2133,18 @@ struct mac_iveiv_entry {
+@@ -2163,6 +2169,18 @@ struct mac_iveiv_entry {
  #define RFCSR39_RX_LO2_EN		FIELD8(0x80)
  
  /*
@@ -174,16 +174,16 @@
   * RFCSR 49:
   */
  #define RFCSR49_TX			FIELD8(0x3f)
-@@ -2135,6 +2153,8 @@ struct mac_iveiv_entry {
+@@ -2172,6 +2190,8 @@ struct mac_iveiv_entry {
   * RFCSR 50:
   */
  #define RFCSR50_TX			FIELD8(0x3f)
 +#define RFCSR50_TX0_EXT_PA		FIELD8(0x02)
 +#define RFCSR50_TX1_EXT_PA		FIELD8(0x10)
+ #define RFCSR50_EP			FIELD8(0xc0)
  
  /*
-  * RF registers
-@@ -2222,6 +2242,8 @@ struct mac_iveiv_entry {
+@@ -2260,6 +2280,8 @@ struct mac_iveiv_entry {
   * INTERNAL_TX_ALC: 0: disable, 1: enable
   * BT_COEXIST: 0: disable, 1: enable
   * DAC_TEST: 0: disable, 1: enable
@@ -192,7 +192,7 @@
   */
  #define	EEPROM_NIC_CONF1		0x001b
  #define EEPROM_NIC_CONF1_HW_RADIO		FIELD16(0x0001)
-@@ -2239,6 +2261,8 @@ struct mac_iveiv_entry {
+@@ -2277,6 +2299,8 @@ struct mac_iveiv_entry {
  #define EEPROM_NIC_CONF1_INTERNAL_TX_ALC		FIELD16(0x2000)
  #define EEPROM_NIC_CONF1_BT_COEXIST		FIELD16(0x4000)
  #define EEPROM_NIC_CONF1_DAC_TEST		FIELD16(0x8000)
@@ -203,7 +203,7 @@
   * EEPROM frequency
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -740,6 +740,8 @@ enum rt2x00_capability_flags {
+@@ -741,6 +741,8 @@ enum rt2x00_capability_flags {
  	CAPABILITY_DOUBLE_ANTENNA,
  	CAPABILITY_BT_COEXIST,
  	CAPABILITY_VCO_RECALIBRATION,
diff --git a/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch b/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
index 38b56b4e5b..4c81b5e220 100644
--- a/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
+++ b/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
@@ -1,7 +1,7 @@
 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -5169,6 +5169,27 @@ static const struct rf_channel rf_vals_3
- 	{173, 0x61, 0, 9},
+@@ -5886,6 +5886,27 @@ static const struct rf_channel rf_vals_5
+ 	{196, 83, 0, 12, 1},
  };
  
 +/*
@@ -28,7 +28,7 @@
  static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
  {
  	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -5246,7 +5267,6 @@ static int rt2800_probe_hw_mode(struct r
+@@ -5964,7 +5985,6 @@ static int rt2800_probe_hw_mode(struct r
  		   rt2x00_rf(rt2x00dev, RF3022) ||
  		   rt2x00_rf(rt2x00dev, RF3290) ||
  		   rt2x00_rf(rt2x00dev, RF3320) ||
@@ -36,7 +36,7 @@
  		   rt2x00_rf(rt2x00dev, RF5360) ||
  		   rt2x00_rf(rt2x00dev, RF5370) ||
  		   rt2x00_rf(rt2x00dev, RF5372) ||
-@@ -5254,6 +5274,12 @@ static int rt2800_probe_hw_mode(struct r
+@@ -5972,6 +5992,12 @@ static int rt2800_probe_hw_mode(struct r
  		   rt2x00_rf(rt2x00dev, RF5392)) {
  		spec->num_channels = 14;
  		spec->channels = rf_vals_3x;
@@ -49,7 +49,7 @@
  	} else if (rt2x00_rf(rt2x00dev, RF3052)) {
  		spec->supported_bands |= SUPPORT_BAND_5GHZ;
  		spec->num_channels = ARRAY_SIZE(rf_vals_3x);
-@@ -5347,6 +5373,19 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6120,6 +6146,19 @@ static int rt2800_probe_rt(struct rt2x00
  	return 0;
  }
  
@@ -69,7 +69,7 @@
  int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
  {
  	int retval;
-@@ -5372,6 +5411,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -6149,6 +6188,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
  
  	/*
@@ -87,7 +87,7 @@
  	retval = rt2800_probe_hw_mode(rt2x00dev);
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -419,6 +419,7 @@ static inline struct rt2x00_intf* vif_to
+@@ -420,6 +420,7 @@ static inline struct rt2x00_intf* vif_to
   * @channels: Device/chipset specific channel values (See &struct rf_channel).
   * @channels_info: Additional information for channels (See &struct channel_info).
   * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
@@ -95,7 +95,7 @@
   */
  struct hw_mode_spec {
  	unsigned int supported_bands;
-@@ -435,6 +436,7 @@ struct hw_mode_spec {
+@@ -436,6 +437,7 @@ struct hw_mode_spec {
  	const struct channel_info *channels_info;
  
  	struct ieee80211_sta_ht_cap ht;
diff --git a/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index bb682ff1fd..0ed680cf77 100644
--- a/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -1185,11 +1185,18 @@ static int rt2800soc_probe(struct platfo
+@@ -1301,11 +1301,18 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800pci_ops);
  }
  
diff --git a/package/mac80211/patches/613-rt2x00-fixup-symbols.patch b/package/mac80211/patches/613-rt2x00-fixup-symbols.patch
deleted file mode 100644
index 00bdbe16c7..0000000000
--- a/package/mac80211/patches/613-rt2x00-fixup-symbols.patch
+++ /dev/null
@@ -1,47 +0,0 @@
---- a/drivers/net/wireless/rt2x00/rt2800pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -1179,7 +1179,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_devic
- #endif /* CONFIG_PCI */
- MODULE_LICENSE("GPL");
- 
--#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
-+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
- static int rt2800soc_probe(struct platform_device *pdev)
- {
- 	return rt2x00soc_probe(pdev, &rt2800pci_ops);
-@@ -1203,7 +1203,7 @@ static struct platform_driver rt2800soc_
- 	.suspend	= rt2x00soc_suspend,
- 	.resume		= rt2x00soc_resume,
- };
--#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
-+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
- 
- #ifdef CONFIG_PCI
- static int rt2800pci_probe(struct pci_dev *pci_dev,
-@@ -1226,7 +1226,7 @@ static int __init rt2800pci_init(void)
- {
- 	int ret = 0;
- 
--#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
-+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
- 	ret = platform_driver_register(&rt2800soc_driver);
- 	if (ret)
- 		return ret;
-@@ -1234,7 +1234,7 @@ static int __init rt2800pci_init(void)
- #ifdef CONFIG_PCI
- 	ret = pci_register_driver(&rt2800pci_driver);
- 	if (ret) {
--#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
-+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
- 		platform_driver_unregister(&rt2800soc_driver);
- #endif
- 		return ret;
-@@ -1249,7 +1249,7 @@ static void __exit rt2800pci_exit(void)
- #ifdef CONFIG_PCI
- 	pci_unregister_driver(&rt2800pci_driver);
- #endif
--#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
-+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
- 	platform_driver_unregister(&rt2800soc_driver);
- #endif
- }
diff --git a/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch b/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch
index 2020178a69..55e40a2d86 100644
--- a/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch
+++ b/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -322,11 +322,17 @@ static int rt2800pci_write_firmware(stru
+@@ -323,11 +323,17 @@ static int rt2800pci_write_firmware(stru
  static char *rt2800pci_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2x00_platform_data *pdata;
diff --git a/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch b/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
index fa0ffa549c..59424e9e56 100644
--- a/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
+++ b/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -5375,13 +5376,14 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6148,13 +6149,14 @@ static int rt2800_probe_rt(struct rt2x00
  
  int rt2800_probe_clk(struct rt2x00_dev *rt2x00dev)
  {
diff --git a/package/mac80211/patches/616-rt2x00-support-rt5350.patch b/package/mac80211/patches/616-rt2x00-support-rt5350.patch
index d12b550486..93c1d615a2 100644
--- a/package/mac80211/patches/616-rt2x00-support-rt5350.patch
+++ b/package/mac80211/patches/616-rt2x00-support-rt5350.patch
@@ -1,8 +1,8 @@
 --- a/drivers/net/wireless/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/rt2x00/rt2800.h
-@@ -69,6 +69,7 @@
- #define RF3322				0x000c
+@@ -71,6 +71,7 @@
  #define RF3053				0x000d
+ #define RF5592				0x000f
  #define RF3290				0x3290
 +#define RF5350				0x5350
  #define RF5360				0x5360
@@ -10,7 +10,7 @@
  #define RF5372				0x5372
 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -2138,6 +2138,15 @@ static void rt2800_config_channel_rf53xx
+@@ -2132,6 +2132,15 @@ static void rt2800_config_channel_rf53xx
  	if (rf->channel <= 14) {
  		int idx = rf->channel-1;
  
@@ -26,7 +26,7 @@
  		if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
  			if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
  				/* r55/r59 value array of channel 1~14 */
-@@ -2219,6 +2228,7 @@ static void rt2800_config_channel(struct
+@@ -2589,6 +2598,7 @@ static void rt2800_config_channel(struct
  	case RF3322:
  		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
  		break;
@@ -34,7 +34,7 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -2232,6 +2242,7 @@ static void rt2800_config_channel(struct
+@@ -2605,6 +2615,7 @@ static void rt2800_config_channel(struct
  
  	if (rt2x00_rf(rt2x00dev, RF3290) ||
  	    rt2x00_rf(rt2x00dev, RF3322) ||
@@ -42,7 +42,7 @@
  	    rt2x00_rf(rt2x00dev, RF5360) ||
  	    rt2x00_rf(rt2x00dev, RF5370) ||
  	    rt2x00_rf(rt2x00dev, RF5372) ||
-@@ -2362,7 +2373,8 @@ static void rt2800_config_channel(struct
+@@ -2746,7 +2757,8 @@ static void rt2800_config_channel(struct
  	/*
  	 * Clear update flag
  	 */
@@ -52,7 +52,7 @@
  		rt2800_bbp_read(rt2x00dev, 49, &bbp);
  		rt2x00_set_field8(&bbp, BBP49_UPDATE_FLAG, 0);
  		rt2800_bbp_write(rt2x00dev, 49, bbp);
-@@ -2801,6 +2813,7 @@ void rt2800_vco_calibration(struct rt2x0
+@@ -3185,6 +3197,7 @@ void rt2800_vco_calibration(struct rt2x0
  		rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
  		break;
  	case RF3290:
@@ -60,17 +60,17 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -3125,7 +3138,8 @@ static int rt2800_init_registers(struct 
+@@ -3524,7 +3537,8 @@ static int rt2800_init_registers(struct 
  	} else if (rt2x00_rt(rt2x00dev, RT3572)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
  		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
 -	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
 +	} else if (rt2x00_rt(rt2x00dev, RT5350) ||
 +		   rt2x00_rt(rt2x00dev, RT5390) ||
- 		   rt2x00_rt(rt2x00dev, RT5392)) {
+ 		   rt2x00_rt(rt2x00dev, RT5392) ||
+ 		   rt2x00_rt(rt2x00dev, RT5592)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
- 		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
-@@ -3507,6 +3521,10 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4043,6 +4057,10 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 4, 0x50);
  	}
  
@@ -80,8 +80,8 @@
 +
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392)) {
-@@ -3519,11 +3537,13 @@ static int rt2800_init_bbp(struct rt2x00
+ 	    rt2x00_rt(rt2x00dev, RT5392))
+@@ -4052,11 +4070,13 @@ static int rt2800_init_bbp(struct rt2x00
  	    rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT3352) ||
  	    rt2x00_rt(rt2x00dev, RT3572) ||
@@ -96,7 +96,7 @@
  		rt2800_bbp_write(rt2x00dev, 47, 0x48);
  
  	rt2800_bbp_write(rt2x00dev, 65, 0x2c);
-@@ -3531,6 +3551,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4064,6 +4084,7 @@ static int rt2800_init_bbp(struct rt2x00
  
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT3352) ||
@@ -104,7 +104,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 68, 0x0b);
-@@ -3540,6 +3561,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4073,6 +4094,7 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 73, 0x12);
  	} else if (rt2x00_rt(rt2x00dev, RT3290) ||
  		   rt2x00_rt(rt2x00dev, RT3352) ||
@@ -112,7 +112,7 @@
  		   rt2x00_rt(rt2x00dev, RT5390) ||
  		   rt2x00_rt(rt2x00dev, RT5392)) {
  		rt2800_bbp_write(rt2x00dev, 69, 0x12);
-@@ -3576,7 +3598,8 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4109,7 +4131,8 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 79, 0x18);
  		rt2800_bbp_write(rt2x00dev, 80, 0x09);
  		rt2800_bbp_write(rt2x00dev, 81, 0x33);
@@ -122,7 +122,7 @@
  		rt2800_bbp_write(rt2x00dev, 78, 0x0e);
  		rt2800_bbp_write(rt2x00dev, 80, 0x08);
  		rt2800_bbp_write(rt2x00dev, 81, 0x37);
-@@ -3586,6 +3609,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4119,6 +4142,7 @@ static int rt2800_init_bbp(struct rt2x00
  
  	rt2800_bbp_write(rt2x00dev, 82, 0x62);
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
@@ -130,7 +130,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 83, 0x7a);
-@@ -3595,6 +3619,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4128,6 +4152,7 @@ static int rt2800_init_bbp(struct rt2x00
  	if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D))
  		rt2800_bbp_write(rt2x00dev, 84, 0x19);
  	else if (rt2x00_rt(rt2x00dev, RT3290) ||
@@ -138,7 +138,7 @@
  		 rt2x00_rt(rt2x00dev, RT5390) ||
  		 rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 84, 0x9a);
-@@ -3603,6 +3628,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4136,6 +4161,7 @@ static int rt2800_init_bbp(struct rt2x00
  
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT3352) ||
@@ -146,7 +146,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 86, 0x38);
-@@ -3617,6 +3643,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4150,6 +4176,7 @@ static int rt2800_init_bbp(struct rt2x00
  
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT3352) ||
@@ -154,7 +154,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 92, 0x02);
-@@ -3635,6 +3662,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4168,6 +4195,7 @@ static int rt2800_init_bbp(struct rt2x00
  	    rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT3352) ||
  	    rt2x00_rt(rt2x00dev, RT3572) ||
@@ -162,7 +162,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392) ||
  	    rt2800_is_305x_soc(rt2x00dev))
-@@ -3644,6 +3672,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4177,6 +4205,7 @@ static int rt2800_init_bbp(struct rt2x00
  
  	if (rt2x00_rt(rt2x00dev, RT3290) ||
  	    rt2x00_rt(rt2x00dev, RT3352) ||
@@ -170,7 +170,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 104, 0x92);
-@@ -3654,13 +3683,15 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4187,13 +4216,15 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 105, 0x1c);
  	else if (rt2x00_rt(rt2x00dev, RT3352))
  		rt2800_bbp_write(rt2x00dev, 105, 0x34);
@@ -187,7 +187,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390))
  		rt2800_bbp_write(rt2x00dev, 106, 0x03);
  	else if (rt2x00_rt(rt2x00dev, RT3352))
-@@ -3670,11 +3701,13 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4203,11 +4234,13 @@ static int rt2800_init_bbp(struct rt2x00
  	else
  		rt2800_bbp_write(rt2x00dev, 106, 0x35);
  
@@ -202,7 +202,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2800_bbp_write(rt2x00dev, 128, 0x12);
-@@ -3684,13 +3717,15 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4217,13 +4250,15 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 135, 0xf6);
  	}
  
@@ -219,7 +219,7 @@
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392)) {
  		rt2800_bbp_read(rt2x00dev, 138, &value);
-@@ -3727,7 +3762,8 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4260,7 +4295,8 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 3, value);
  	}
  
@@ -229,7 +229,7 @@
  		rt2800_bbp_write(rt2x00dev, 163, 0xbd);
  		/* Set ITxBF timeout to 0x9c40=1000msec */
  		rt2800_bbp_write(rt2x00dev, 179, 0x02);
-@@ -3749,6 +3785,14 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4282,6 +4318,14 @@ static int rt2800_init_bbp(struct rt2x00
  		rt2800_bbp_write(rt2x00dev, 148, 0xc8);
  	}
  
@@ -244,7 +244,7 @@
  	if (rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392)) {
  		int ant, div_mode;
-@@ -4143,6 +4187,76 @@ static void rt2800_init_rfcsr_3572(struc
+@@ -4674,6 +4718,76 @@ static void rt2800_init_rfcsr_3572(struc
  	rt2800_rfcsr_write(rt2x00dev, 31, 0x10);
  }
  
@@ -321,15 +321,15 @@
  static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
  {
  	rt2800_rfcsr_write(rt2x00dev, 1, 0x0f);
-@@ -4305,6 +4419,7 @@ static int rt2800_init_rfcsr(struct rt2x
+@@ -4899,6 +5013,7 @@ static int rt2800_init_rfcsr(struct rt2x
  	    !rt2x00_rt(rt2x00dev, RT3352) &&
  	    !rt2x00_rt(rt2x00dev, RT3390) &&
  	    !rt2x00_rt(rt2x00dev, RT3572) &&
 +	    !rt2x00_rt(rt2x00dev, RT5350) &&
  	    !rt2x00_rt(rt2x00dev, RT5390) &&
  	    !rt2x00_rt(rt2x00dev, RT5392) &&
- 	    !rt2800_is_305x_soc(rt2x00dev))
-@@ -4355,6 +4470,9 @@ static int rt2800_init_rfcsr(struct rt2x
+ 	    !rt2x00_rt(rt2x00dev, RT5392) &&
+@@ -4951,6 +5066,9 @@ static int rt2800_init_rfcsr(struct rt2x
  	case RT3572:
  		rt2800_init_rfcsr_3572(rt2x00dev);
  		break;
@@ -339,7 +339,7 @@
  	case RT5390:
  		rt2800_init_rfcsr_5390(rt2x00dev);
  		break;
-@@ -4751,6 +4869,12 @@ static int rt2800_validate_eeprom(struct
+@@ -5361,6 +5479,12 @@ static int rt2800_validate_eeprom(struct
  		if (rt2x00_get_field16(word, EEPROM_NIC_CONF0_RXPATH) > 2)
  			rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RXPATH, 2);
  		rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC_CONF0, word);
@@ -352,24 +352,16 @@
  	}
  
  	rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &word);
-@@ -4875,6 +4999,8 @@ static int rt2800_init_eeprom(struct rt2
- 	    rt2x00_get_field32(reg, MAC_CSR0_CHIPSET) == RT5390 ||
- 	    rt2x00_get_field32(reg, MAC_CSR0_CHIPSET) == RT5392)
- 		rt2x00_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &value);
-+	else if(rt2x00_get_field32(reg, MAC_CSR0_CHIPSET) == RT5350)
-+		value = RF5350;
+@@ -5480,6 +5604,8 @@ static int rt2800_init_eeprom(struct rt2
+ 	    rt2x00_rt(rt2x00dev, RT5390) ||
+ 	    rt2x00_rt(rt2x00dev, RT5392))
+ 		rt2x00_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
++	else if (rt2x00_rt(rt2x00dev, RT5350))
++		rf = RF5350;
  	else
- 		value = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
+ 		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
  
-@@ -4892,6 +5018,7 @@ static int rt2800_init_eeprom(struct rt2
- 	case RT3352:
- 	case RT3390:
- 	case RT3572:
-+	case RT5350:
- 	case RT5390:
- 	case RT5392:
- 		break;
-@@ -4913,6 +5040,7 @@ static int rt2800_init_eeprom(struct rt2
+@@ -5496,6 +5622,7 @@ static int rt2800_init_eeprom(struct rt2
  	case RF3290:
  	case RF3320:
  	case RF3322:
@@ -377,7 +369,7 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -5275,7 +5403,8 @@ static int rt2800_probe_hw_mode(struct r
+@@ -5993,7 +6120,8 @@ static int rt2800_probe_hw_mode(struct r
  		   rt2x00_rf(rt2x00dev, RF5392)) {
  		spec->num_channels = 14;
  		spec->channels = rf_vals_3x;
@@ -387,14 +379,22 @@
  		spec->num_channels = 14;
  		if (spec->clk_is_20mhz)
  			spec->channels = rf_vals_xtal20mhz_3x;
-@@ -5364,6 +5493,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6094,6 +6222,7 @@ static int rt2800_probe_hw_mode(struct r
+ 	case RF3320:
+ 	case RF3052:
  	case RF3290:
++	case RF5350:
  	case RF5360:
  	case RF5370:
-+	case RF5350:
  	case RF5372:
- 	case RF5390:
- 	case RF5392:
+@@ -6131,6 +6260,7 @@ static int rt2800_probe_rt(struct rt2x00
+ 	case RT3352:
+ 	case RT3390:
+ 	case RT3572:
++	case RT5350:
+ 	case RT5390:
+ 	case RT5392:
+ 	case RT5592:
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
 @@ -192,6 +192,7 @@ struct rt2x00_chip {
@@ -404,4 +404,4 @@
 +#define RT5350		0x5350  /* WSOC 2.4GHz */
  #define RT5390		0x5390  /* 2.4GHz */
  #define RT5392		0x5392  /* 2.4GHz */
- 
+ #define RT5592		0x5592
diff --git a/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
index c7d40ef7c6..dbfd80faba 100644
--- a/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+++ b/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
@@ -12,7 +12,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/rt2x00/Kconfig
 +++ b/drivers/net/wireless/rt2x00/Kconfig
-@@ -64,6 +64,7 @@ config RT2800PCI
+@@ -68,6 +68,7 @@ config RT2800PCI
  	select RT2X00_LIB_CRYPTO
  	select CRC_CCITT
  	select EEPROM_93CX6
diff --git a/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
index 80fde275cd..74122bceab 100644
--- a/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/mwl8k.c
 +++ b/drivers/net/wireless/mwl8k.c
-@@ -5497,6 +5497,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5525,6 +5525,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
diff --git a/package/mac80211/patches/701-mwl8k-don-t-overwrite-regulatory-settings.patch b/package/mac80211/patches/701-mwl8k-don-t-overwrite-regulatory-settings.patch
deleted file mode 100644
index 890debc47f..0000000000
--- a/package/mac80211/patches/701-mwl8k-don-t-overwrite-regulatory-settings.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From f340b99171e923eb6b54c1d0c22c15b45df40647 Mon Sep 17 00:00:00 2001
-From: Jonas Gorski <jogo@openwrt.org>
-Date: Mon, 11 Mar 2013 17:17:28 +0100
-Subject: [PATCH] mwl8k: don't overwrite regulatory settings
-
-Currently the caps are parsed on every firmware reload, causing any
-channel flags to be cleared.
-When there is a firmware to interface mode mismatch, the triggered
-firmware reload causes a reset of the regulatory settings, causing all
-channels to become available:
-
-root@openrouter:/# iw phy phy0 info
-Wiphy phy0
-        Band 1:
-		(...)
-                Frequencies:
-                        * 2412 MHz [1] (0.0 dBm)
-                        * 2417 MHz [2] (0.0 dBm)
-                        * 2422 MHz [3] (0.0 dBm)
-                        * 2427 MHz [4] (0.0 dBm)
-                        * 2432 MHz [5] (0.0 dBm)
-                        * 2437 MHz [6] (0.0 dBm)
-                        * 2442 MHz [7] (0.0 dBm)
-                        * 2447 MHz [8] (0.0 dBm)
-                        * 2452 MHz [9] (0.0 dBm)
-                        * 2457 MHz [10] (0.0 dBm)
-                        * 2462 MHz [11] (0.0 dBm)
-                        * 2467 MHz [12] (0.0 dBm)
-                        * 2472 MHz [13] (0.0 dBm)
-                        * 2484 MHz [14] (0.0 dBm)
-		(...)
-
-To prevent this, only parse the caps on the first firmware load during
-hardware probe, and store them locally to know we have already parsed
-them.
-
-Signed-off-by: Jonas Gorski <jogo@openwrt.org>
----
- drivers/net/wireless/mwl8k.c |    6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/drivers/net/wireless/mwl8k.c
-+++ b/drivers/net/wireless/mwl8k.c
-@@ -232,6 +232,7 @@ struct mwl8k_priv {
- 	u16 num_mcaddrs;
- 	u8 hw_rev;
- 	u32 fw_rev;
-+	u32 caps;
- 
- 	/*
- 	 * Running count of TX packets in flight, to avoid
-@@ -2401,6 +2402,9 @@ mwl8k_set_caps(struct ieee80211_hw *hw, 
- {
- 	struct mwl8k_priv *priv = hw->priv;
- 
-+	if (priv->caps)
-+		return;
-+
- 	if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
- 		mwl8k_setup_2ghz_band(hw);
- 		if (caps & MWL8K_CAP_MIMO)
-@@ -2412,6 +2416,8 @@ mwl8k_set_caps(struct ieee80211_hw *hw, 
- 		if (caps & MWL8K_CAP_MIMO)
- 			mwl8k_set_ht_caps(hw, &priv->band_50, caps);
- 	}
-+
-+	priv->caps = caps;
- }
- 
- static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
diff --git a/package/mac80211/patches/702-mwl8k-always-apply-configuration-even-when-device-is.patch b/package/mac80211/patches/702-mwl8k-always-apply-configuration-even-when-device-is.patch
deleted file mode 100644
index ff254790d7..0000000000
--- a/package/mac80211/patches/702-mwl8k-always-apply-configuration-even-when-device-is.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 5d1ed64614ccb21c26bc0ee321e9c51b6359ceb8 Mon Sep 17 00:00:00 2001
-From: Jonas Gorski <jogo@openwrt.org>
-Date: Mon, 25 Mar 2013 15:37:42 +0100
-Subject: [PATCH] mwl8k: always apply configuration even when device is idle
-
-Fix settings not being applied when the device is idle and the firmware
-gets reloaded (because of changing from STA to AP mode). This caused
-the device using the wrong channel (and likely band), e.g. a 5 GHz only
-card still defaulted to channel 6 in the 2.4 GHz band when left
-unconfigured.
-
-This issue was always present, but only made visible with "mwl8k: Do not
-call mwl8k_cmd_set_rf_channel unconditionally" (0f4316b9), since before
-that the channel was (re-)configured at the next _config call even when
-it did not change from the mac80211 perspective.
-
-Signed-off-by: Jonas Gorski <jogo@openwrt.org>
----
- drivers/net/wireless/mwl8k.c |   10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/mwl8k.c
-+++ b/drivers/net/wireless/mwl8k.c
-@@ -4818,16 +4818,14 @@ static int mwl8k_config(struct ieee80211
- 	struct mwl8k_priv *priv = hw->priv;
- 	int rc;
- 
--	if (conf->flags & IEEE80211_CONF_IDLE) {
--		mwl8k_cmd_radio_disable(hw);
--		return 0;
--	}
--
- 	rc = mwl8k_fw_lock(hw);
- 	if (rc)
- 		return rc;
- 
--	rc = mwl8k_cmd_radio_enable(hw);
-+	if (conf->flags & IEEE80211_CONF_IDLE)
-+		rc = mwl8k_cmd_radio_disable(hw);
-+	else
-+		rc = mwl8k_cmd_radio_enable(hw);
- 	if (rc)
- 		goto out;
- 
diff --git a/package/mac80211/patches/800-b43-gpio-mask-module-option.patch b/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
index d8fb06de57..fc874ad049 100644
--- a/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
+++ b/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/b43/b43.h
 +++ b/drivers/net/wireless/b43/b43.h
-@@ -812,6 +812,7 @@ struct b43_wldev {
+@@ -820,6 +820,7 @@ struct b43_wldev {
  	bool qos_enabled;		/* TRUE, if QoS is used. */
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
@@ -22,7 +22,7 @@
  static int modparam_bad_frames_preempt;
  module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  MODULE_PARM_DESC(bad_frames_preempt,
-@@ -2740,10 +2745,10 @@ static int b43_gpio_init(struct b43_wlde
+@@ -2747,10 +2752,10 @@ static int b43_gpio_init(struct b43_wlde
  	u32 mask, set;
  
  	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
diff --git a/package/mac80211/patches/810-b43_no_pio.patch b/package/mac80211/patches/810-b43_no_pio.patch
index 5b4c22e520..66c50ae3ea 100644
--- a/package/mac80211/patches/810-b43_no_pio.patch
+++ b/package/mac80211/patches/810-b43_no_pio.patch
@@ -11,7 +11,7 @@
  b43-$(CONFIG_B43_PCMCIA)	+= pcmcia.o
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -1909,10 +1909,12 @@ static void b43_do_interrupt_thread(stru
+@@ -1916,10 +1916,12 @@ static void b43_do_interrupt_thread(stru
  			       dma_reason[0], dma_reason[1],
  			       dma_reason[2], dma_reason[3],
  			       dma_reason[4], dma_reason[5]);
diff --git a/package/mac80211/patches/820-b43-add-antenna-control.patch b/package/mac80211/patches/820-b43-add-antenna-control.patch
index 8b6255f2c0..272eee4757 100644
--- a/package/mac80211/patches/820-b43-add-antenna-control.patch
+++ b/package/mac80211/patches/820-b43-add-antenna-control.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -1553,7 +1553,7 @@ static void b43_write_beacon_template(st
+@@ -1560,7 +1560,7 @@ static void b43_write_beacon_template(st
  				  len, ram_offset, shm_size_offset, rate);
  
  	/* Write the PHY TX control parameters. */
@@ -9,7 +9,7 @@
  	antenna = b43_antenna_to_phyctl(antenna);
  	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
  	/* We can't send beacons with short preamble. Would get PHY errors. */
-@@ -3101,8 +3101,8 @@ static int b43_chip_init(struct b43_wlde
+@@ -3105,8 +3105,8 @@ static int b43_chip_init(struct b43_wlde
  
  	/* Select the antennae */
  	if (phy->ops->set_rx_antenna)
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3846,7 +3846,6 @@ static int b43_op_config(struct ieee8021
+@@ -3850,7 +3850,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev;
  	struct b43_phy *phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  	bool reload_bss = false;
  
-@@ -3900,11 +3899,9 @@ static int b43_op_config(struct ieee8021
+@@ -3904,11 +3903,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5030,6 +5027,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5033,6 +5030,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -5051,6 +5089,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5054,6 +5092,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5297,6 +5337,8 @@ static int b43_one_core_attach(struct b4
+@@ -5300,6 +5340,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5387,6 +5429,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5390,6 +5432,9 @@ static struct b43_wl *b43_wireless_init(
  
  	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
  
@@ -120,7 +120,7 @@
  	SET_IEEE80211_DEV(hw, dev->dev);
 --- a/drivers/net/wireless/b43/b43.h
 +++ b/drivers/net/wireless/b43/b43.h
-@@ -813,6 +813,8 @@ struct b43_wldev {
+@@ -821,6 +821,8 @@ struct b43_wldev {
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
  	int gpiomask;			/* GPIO LED mask as a module parameter */
diff --git a/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch b/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
index bd10f996c2..66631218f5 100644
--- a/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
+++ b/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
@@ -19,7 +19,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 
 --- a/drivers/net/wireless/b43/b43.h
 +++ b/drivers/net/wireless/b43/b43.h
-@@ -1053,6 +1053,32 @@ static inline bool b43_using_pio_transfe
+@@ -1061,6 +1061,32 @@ static inline bool b43_using_pio_transfe
  	return dev->__using_pio_transfers;
  }
  
@@ -88,7 +88,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  		dev->phy.writes_counter = 0;
 --- a/drivers/net/wireless/b43/phy_n.c
 +++ b/drivers/net/wireless/b43/phy_n.c
-@@ -5423,14 +5423,14 @@ static inline void check_phyreg(struct b
+@@ -5368,14 +5368,14 @@ static inline void check_phyreg(struct b
  static u16 b43_nphy_op_read(struct b43_wldev *dev, u16 reg)
  {
  	check_phyreg(dev, reg);
@@ -105,7 +105,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	b43_write16(dev, B43_MMIO_PHY_DATA, value);
  }
  
-@@ -5438,7 +5438,7 @@ static void b43_nphy_op_maskset(struct b
+@@ -5383,7 +5383,7 @@ static void b43_nphy_op_maskset(struct b
  				 u16 set)
  {
  	check_phyreg(dev, reg);
@@ -114,7 +114,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	b43_maskset16(dev, B43_MMIO_PHY_DATA, mask, set);
  }
  
-@@ -5449,7 +5449,7 @@ static u16 b43_nphy_op_radio_read(struct
+@@ -5394,7 +5394,7 @@ static u16 b43_nphy_op_radio_read(struct
  	/* N-PHY needs 0x100 for read access */
  	reg |= 0x100;
  
@@ -123,7 +123,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	return b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
  }
  
-@@ -5458,7 +5458,7 @@ static void b43_nphy_op_radio_write(stru
+@@ -5403,7 +5403,7 @@ static void b43_nphy_op_radio_write(stru
  	/* Register 1 is a 32-bit register. */
  	B43_WARN_ON(reg == 1);
  
diff --git a/package/mac80211/patches/840-b43-increase_number_of_rx_dma_slots.patch b/package/mac80211/patches/840-b43-increase_number_of_rx_dma_slots.patch
deleted file mode 100644
index 94c6ff2dbb..0000000000
--- a/package/mac80211/patches/840-b43-increase_number_of_rx_dma_slots.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/b43/dma.h
-+++ b/drivers/net/wireless/b43/dma.h
-@@ -169,7 +169,7 @@ struct b43_dmadesc_generic {
- 
- /* DMA engine tuning knobs */
- #define B43_TXRING_SLOTS		256
--#define B43_RXRING_SLOTS		64
-+#define B43_RXRING_SLOTS		256
- #define B43_DMA0_RX_FW598_BUFSIZE	(B43_DMA0_RX_FW598_FO + IEEE80211_MAX_FRAME_LEN)
- #define B43_DMA0_RX_FW351_BUFSIZE	(B43_DMA0_RX_FW351_FO + IEEE80211_MAX_FRAME_LEN)
- 
diff --git a/package/mac80211/patches/850-brcmsmac-start-adding-support-for-core-rev-28.patch b/package/mac80211/patches/850-brcmsmac-start-adding-support-for-core-rev-28.patch
index a84107df7d..e181ac3870 100644
--- a/package/mac80211/patches/850-brcmsmac-start-adding-support-for-core-rev-28.patch
+++ b/package/mac80211/patches/850-brcmsmac-start-adding-support-for-core-rev-28.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
 +++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -99,6 +99,7 @@ static struct bcma_device_id brcms_corei
+@@ -101,6 +101,7 @@ static struct bcma_device_id brcms_corei
  	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 17, BCMA_ANY_CLASS),
  	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 23, BCMA_ANY_CLASS),
  	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 24, BCMA_ANY_CLASS),
@@ -10,7 +10,7 @@
  MODULE_DEVICE_TABLE(bcma, brcms_coreid_table);
 --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
 +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -717,7 +717,7 @@ static void brcms_c_ucode_bsinit(struct 
+@@ -722,7 +722,7 @@ static void brcms_c_ucode_bsinit(struct 
  	brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
  
  	/* do band-specific ucode IHR, SHM, and SCR inits */
@@ -19,7 +19,7 @@
  		if (BRCMS_ISNPHY(wlc_hw->band))
  			brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
  		else
-@@ -2257,7 +2257,7 @@ static void brcms_ucode_download(struct 
+@@ -2288,7 +2288,7 @@ static void brcms_ucode_download(struct 
  	if (wlc_hw->ucode_loaded)
  		return;
  
@@ -28,7 +28,7 @@
  		if (BRCMS_ISNPHY(wlc_hw->band)) {
  			brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
  					  ucode->bcm43xx_16_mimosz);
-@@ -3207,7 +3207,7 @@ static void brcms_b_coreinit(struct brcm
+@@ -3231,7 +3231,7 @@ static void brcms_b_coreinit(struct brcm
  
  	sflags = bcma_aread32(core, BCMA_IOST);
  
@@ -37,7 +37,7 @@
  		if (BRCMS_ISNPHY(wlc_hw->band))
  			brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
  		else
-@@ -5663,6 +5663,8 @@ static bool brcms_c_chipmatch_soc(struct
+@@ -5723,6 +5723,8 @@ static bool brcms_c_chipmatch_soc(struct
  
  	if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
  		return true;
diff --git a/package/mac80211/patches/875-brcmsmac-remove-extra-regulation-restriction.patch b/package/mac80211/patches/851-brcmsmac-remove-extra-regulation-restriction.patch
index dd1393ae5d..dd1393ae5d 100644
--- a/package/mac80211/patches/875-brcmsmac-remove-extra-regulation-restriction.patch
+++ b/package/mac80211/patches/851-brcmsmac-remove-extra-regulation-restriction.patch
diff --git a/package/mac80211/patches/860-brcmsmac-implement-ieee80211_ops-get_tsf-and-set_tsf.patch b/package/mac80211/patches/860-brcmsmac-implement-ieee80211_ops-get_tsf-and-set_tsf.patch
deleted file mode 100644
index 33991bcf62..0000000000
--- a/package/mac80211/patches/860-brcmsmac-implement-ieee80211_ops-get_tsf-and-set_tsf.patch
+++ /dev/null
@@ -1,121 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/d11.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/d11.h
-@@ -457,6 +457,7 @@ struct d11regs {
- /*== maccontrol register ==*/
- #define	MCTL_GMODE		(1U << 31)
- #define	MCTL_DISCARD_PMQ	(1 << 30)
-+#define	MCTL_TBTTHOLD		(1 << 28)
- #define	MCTL_WAKE		(1 << 26)
- #define	MCTL_HPS		(1 << 25)
- #define	MCTL_PROMISC		(1 << 24)
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -741,6 +741,28 @@ static void brcms_ops_flush(struct ieee8
- 			   "ret=%d\n", jiffies_to_msecs(ret));
- }
- 
-+static u64 brcms_ops_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
-+{
-+	struct brcms_info *wl = hw->priv;
-+	u64 tsf;
-+
-+	spin_lock_bh(&wl->lock);
-+	tsf = brcms_c_tsf_get(wl->wlc);
-+	spin_unlock_bh(&wl->lock);
-+
-+	return tsf;
-+}
-+
-+static void brcms_ops_set_tsf(struct ieee80211_hw *hw,
-+			   struct ieee80211_vif *vif, u64 tsf)
-+{
-+	struct brcms_info *wl = hw->priv;
-+
-+	spin_lock_bh(&wl->lock);
-+	brcms_c_tsf_set(wl->wlc, tsf);
-+	spin_unlock_bh(&wl->lock);
-+}
-+
- static const struct ieee80211_ops brcms_ops = {
- 	.tx = brcms_ops_tx,
- 	.start = brcms_ops_start,
-@@ -757,6 +779,8 @@ static const struct ieee80211_ops brcms_
- 	.ampdu_action = brcms_ops_ampdu_action,
- 	.rfkill_poll = brcms_ops_rfkill_poll,
- 	.flush = brcms_ops_flush,
-+	.get_tsf = brcms_ops_get_tsf,
-+	.set_tsf = brcms_ops_set_tsf,
- };
- 
- void brcms_dpc(unsigned long data)
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -5545,6 +5545,20 @@ int brcms_c_set_rateset(struct brcms_c_i
- 	return bcmerror;
- }
- 
-+static void brcms_c_time_lock(struct brcms_c_info *wlc)
-+{
-+	bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
-+	/* Commit the write */
-+	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
-+}
-+
-+static void brcms_c_time_unlock(struct brcms_c_info *wlc)
-+{
-+	bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
-+	/* Commit the write */
-+	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
-+}
-+
- int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
- {
- 	if (period == 0)
-@@ -7530,6 +7544,36 @@ void brcms_c_set_beacon_listen_interval(
- 		brcms_c_bcn_li_upd(wlc);
- }
- 
-+u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
-+{
-+	u32 tsf_h, tsf_l;
-+	u64 tsf;
-+
-+	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
-+
-+	tsf = tsf_h;
-+	tsf <<= 32;
-+	tsf |= tsf_l;
-+
-+	return tsf;
-+}
-+
-+void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
-+{
-+	u32 tsf_h, tsf_l;
-+
-+	brcms_c_time_lock(wlc);
-+
-+	tsf_l = tsf;
-+	tsf_h = (tsf >> 32);
-+
-+	/* read the tsf timer low, then high to get an atomic read */
-+	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
-+	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
-+
-+	brcms_c_time_unlock(wlc);
-+}
-+
- int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
- {
- 	uint qdbm;
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -326,6 +326,8 @@ extern void brcms_c_set_shortslot_overri
- 				    s8 sslot_override);
- extern void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc,
- 					u8 interval);
-+extern u64 brcms_c_tsf_get(struct brcms_c_info *wlc);
-+extern void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf);
- extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
- extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
- extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
diff --git a/package/mac80211/patches/861-brcmsmac-add-interface-type-to-brcms_bss_cfg.patch b/package/mac80211/patches/861-brcmsmac-add-interface-type-to-brcms_bss_cfg.patch
deleted file mode 100644
index 21b1e0e4d7..0000000000
--- a/package/mac80211/patches/861-brcmsmac-add-interface-type-to-brcms_bss_cfg.patch
+++ /dev/null
@@ -1,66 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -367,9 +367,10 @@ brcms_ops_add_interface(struct ieee80211
- 	}
- 
- 	spin_lock_bh(&wl->lock);
--	memcpy(wl->pub->cur_etheraddr, vif->addr, sizeof(vif->addr));
- 	wl->mute_tx = false;
- 	brcms_c_mute(wl->wlc, false);
-+	if (vif->type == NL80211_IFTYPE_STATION)
-+		brcms_c_start_station(wl->wlc, vif->addr);
- 	spin_unlock_bh(&wl->lock);
- 
- 	return 0;
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -2165,6 +2165,12 @@ void brcms_b_switch_macfreq(struct brcms
- 	}
- }
- 
-+void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
-+{
-+	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
-+	wlc->bsscfg->type = BRCMS_TYPE_STATION;
-+}
-+
- /* Initialize GPIOs that are controlled by D11 core */
- static void brcms_c_gpio_init(struct brcms_c_info *wlc)
- {
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -576,10 +576,17 @@ struct antsel_info {
- 	struct brcms_antselcfg antcfg_cur; /* current antenna config (auto) */
- };
- 
-+enum brcms_bss_type {
-+	BRCMS_TYPE_STATION,
-+	BRCMS_TYPE_AP,
-+	BRCMS_TYPE_ADHOC,
-+};
-+
- /*
-  * BSS configuration state
-  *
-  * wlc: wlc to which this bsscfg belongs to.
-+ * type: interface type
-  * up: is this configuration up operational
-  * enable: is this configuration enabled
-  * associated: is BSS in ASSOCIATED state
-@@ -599,6 +606,7 @@ struct antsel_info {
-  */
- struct brcms_bss_cfg {
- 	struct brcms_c_info *wlc;
-+	enum brcms_bss_type type;
- 	bool up;
- 	bool enable;
- 	bool associated;
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -333,5 +333,6 @@ extern int brcms_c_get_tx_power(struct b
- extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
- extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
- extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
-+extern void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
- 
- #endif				/* _BRCM_PUB_H_ */
diff --git a/package/mac80211/patches/862-brcmsmac-remove-brcms_bss_cfg-BSS.patch b/package/mac80211/patches/862-brcmsmac-remove-brcms_bss_cfg-BSS.patch
deleted file mode 100644
index 1fafd63a28..0000000000
--- a/package/mac80211/patches/862-brcmsmac-remove-brcms_bss_cfg-BSS.patch
+++ /dev/null
@@ -1,79 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -1071,7 +1071,7 @@ brcms_b_txstatus(struct brcms_hardware *
- 
- static void brcms_c_tbtt(struct brcms_c_info *wlc)
- {
--	if (!wlc->bsscfg->BSS)
-+	if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
- 		/*
- 		 * DirFrmQ is now valid...defer setting until end
- 		 * of ATIM window
-@@ -3061,16 +3061,8 @@ static bool brcms_c_ps_allowed(struct br
- 	if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
- 		return false;
- 
--	if (cfg->associated) {
--		/*
--		 * disallow PS when one of the following
--		 * bsscfg specific conditions meets
--		 */
--		if (!cfg->BSS)
--			return false;
--
-+	if (cfg->associated)
- 		return false;
--	}
- 
- 	return true;
- }
-@@ -5080,8 +5072,9 @@ int brcms_c_up(struct brcms_c_info *wlc)
- 				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 				mboolset(wlc->pub->radio_disabled,
- 					 WL_RADIO_HW_DISABLE);
--
--				if (bsscfg->enable && bsscfg->BSS)
-+				if (bsscfg->enable &&
-+				    (bsscfg->type == BRCMS_TYPE_STATION ||
-+				     bsscfg->type == BRCMS_TYPE_ADHOC))
- 					brcms_err(wlc->hw->d11core,
- 						  "wl%d: up: rfdisable -> "
- 						  "bsscfg_disable()\n",
-@@ -7390,7 +7383,8 @@ void brcms_c_update_beacon(struct brcms_
- {
- 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 
--	if (bsscfg->up && !bsscfg->BSS)
-+	if (bsscfg->up && (bsscfg->type == BRCMS_TYPE_AP ||
-+			   bsscfg->type == BRCMS_TYPE_ADHOC))
- 		/* Clear the soft intmask */
- 		wlc->defmacintmask &= ~MI_BCNTPL;
- }
-@@ -7465,7 +7459,8 @@ void brcms_c_update_probe_resp(struct br
- 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 
- 	/* update AP or IBSS probe responses */
--	if (bsscfg->up && !bsscfg->BSS)
-+	if (bsscfg->up && (bsscfg->type == BRCMS_TYPE_AP ||
-+			   bsscfg->type == BRCMS_TYPE_ADHOC))
- 		brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
- }
- 
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -590,7 +590,6 @@ enum brcms_bss_type {
-  * up: is this configuration up operational
-  * enable: is this configuration enabled
-  * associated: is BSS in ASSOCIATED state
-- * BSS: infraustructure or adhoc
-  * SSID_len: the length of SSID
-  * SSID: SSID string
-  *
-@@ -610,7 +609,6 @@ struct brcms_bss_cfg {
- 	bool up;
- 	bool enable;
- 	bool associated;
--	bool BSS;
- 	u8 SSID_len;
- 	u8 SSID[IEEE80211_MAX_SSID_LEN];
- 	u8 BSSID[ETH_ALEN];
diff --git a/package/mac80211/patches/863-brcmsmac-remove-brcms_bss_cfg-associated.patch b/package/mac80211/patches/863-brcmsmac-remove-brcms_bss_cfg-associated.patch
deleted file mode 100644
index 79a4b688d6..0000000000
--- a/package/mac80211/patches/863-brcmsmac-remove-brcms_bss_cfg-associated.patch
+++ /dev/null
@@ -1,74 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -3051,8 +3051,6 @@ static void brcms_b_antsel_set(struct br
-  */
- static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
- {
--	struct brcms_bss_cfg *cfg = wlc->bsscfg;
--
- 	/* disallow PS when one of the following global conditions meets */
- 	if (!wlc->pub->associated)
- 		return false;
-@@ -3061,9 +3059,6 @@ static bool brcms_c_ps_allowed(struct br
- 	if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
- 		return false;
- 
--	if (cfg->associated)
--		return false;
--
- 	return true;
- }
- 
-@@ -3821,7 +3816,7 @@ static void brcms_c_set_home_chanspec(st
- 	if (wlc->home_chanspec != chanspec) {
- 		wlc->home_chanspec = chanspec;
- 
--		if (wlc->bsscfg->associated)
-+		if (wlc->pub->associated)
- 			wlc->bsscfg->current_bss->chanspec = chanspec;
- 	}
- }
-@@ -5435,7 +5430,7 @@ static void brcms_c_ofdm_rateset_war(str
- 	u8 r;
- 	bool war = false;
- 
--	if (wlc->bsscfg->associated)
-+	if (wlc->pub->associated)
- 		r = wlc->bsscfg->current_bss->rateset.rates[0];
- 	else
- 		r = wlc->default_bss->rateset.rates[0];
-@@ -5529,7 +5524,7 @@ int brcms_c_set_rateset(struct brcms_c_i
- 	/* merge rateset coming in with the current mcsset */
- 	if (wlc->pub->_n_enab & SUPPORT_11N) {
- 		struct brcms_bss_info *mcsset_bss;
--		if (wlc->bsscfg->associated)
-+		if (wlc->pub->associated)
- 			mcsset_bss = wlc->bsscfg->current_bss;
- 		else
- 			mcsset_bss = wlc->default_bss;
-@@ -7500,7 +7495,6 @@ void brcms_c_scan_stop(struct brcms_c_in
- void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
- {
- 	wlc->pub->associated = state;
--	wlc->bsscfg->associated = state;
- }
- 
- /*
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -589,7 +589,6 @@ enum brcms_bss_type {
-  * type: interface type
-  * up: is this configuration up operational
-  * enable: is this configuration enabled
-- * associated: is BSS in ASSOCIATED state
-  * SSID_len: the length of SSID
-  * SSID: SSID string
-  *
-@@ -608,7 +607,6 @@ struct brcms_bss_cfg {
- 	enum brcms_bss_type type;
- 	bool up;
- 	bool enable;
--	bool associated;
- 	u8 SSID_len;
- 	u8 SSID[IEEE80211_MAX_SSID_LEN];
- 	u8 BSSID[ETH_ALEN];
diff --git a/package/mac80211/patches/864-brcmsmac-remove-brcms_bss_cfg-enable.patch b/package/mac80211/patches/864-brcmsmac-remove-brcms_bss_cfg-enable.patch
deleted file mode 100644
index 9f5c4da7fe..0000000000
--- a/package/mac80211/patches/864-brcmsmac-remove-brcms_bss_cfg-enable.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -5067,9 +5067,8 @@ int brcms_c_up(struct brcms_c_info *wlc)
- 				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 				mboolset(wlc->pub->radio_disabled,
- 					 WL_RADIO_HW_DISABLE);
--				if (bsscfg->enable &&
--				    (bsscfg->type == BRCMS_TYPE_STATION ||
--				     bsscfg->type == BRCMS_TYPE_ADHOC))
-+				if (bsscfg->type == BRCMS_TYPE_STATION ||
-+				    bsscfg->type == BRCMS_TYPE_ADHOC)
- 					brcms_err(wlc->hw->d11core,
- 						  "wl%d: up: rfdisable -> "
- 						  "bsscfg_disable()\n",
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -588,7 +588,6 @@ enum brcms_bss_type {
-  * wlc: wlc to which this bsscfg belongs to.
-  * type: interface type
-  * up: is this configuration up operational
-- * enable: is this configuration enabled
-  * SSID_len: the length of SSID
-  * SSID: SSID string
-  *
-@@ -606,7 +605,6 @@ struct brcms_bss_cfg {
- 	struct brcms_c_info *wlc;
- 	enum brcms_bss_type type;
- 	bool up;
--	bool enable;
- 	u8 SSID_len;
- 	u8 SSID[IEEE80211_MAX_SSID_LEN];
- 	u8 BSSID[ETH_ALEN];
diff --git a/package/mac80211/patches/865-brcmsmac-remove-brcms_bss_cfg-up.patch b/package/mac80211/patches/865-brcmsmac-remove-brcms_bss_cfg-up.patch
deleted file mode 100644
index b596d799f6..0000000000
--- a/package/mac80211/patches/865-brcmsmac-remove-brcms_bss_cfg-up.patch
+++ /dev/null
@@ -1,51 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -7377,8 +7377,8 @@ void brcms_c_update_beacon(struct brcms_
- {
- 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 
--	if (bsscfg->up && (bsscfg->type == BRCMS_TYPE_AP ||
--			   bsscfg->type == BRCMS_TYPE_ADHOC))
-+	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
-+			     bsscfg->type == BRCMS_TYPE_ADHOC))
- 		/* Clear the soft intmask */
- 		wlc->defmacintmask &= ~MI_BCNTPL;
- }
-@@ -7453,8 +7453,8 @@ void brcms_c_update_probe_resp(struct br
- 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 
- 	/* update AP or IBSS probe responses */
--	if (bsscfg->up && (bsscfg->type == BRCMS_TYPE_AP ||
--			   bsscfg->type == BRCMS_TYPE_ADHOC))
-+	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
-+			     bsscfg->type == BRCMS_TYPE_ADHOC))
- 		brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
- }
- 
-@@ -7807,7 +7807,7 @@ void brcms_c_init(struct brcms_c_info *w
- 	brcms_c_set_bssid(wlc->bsscfg);
- 
- 	/* Update tsf_cfprep if associated and up */
--	if (wlc->pub->associated && wlc->bsscfg->up) {
-+	if (wlc->pub->associated && wlc->pub->up) {
- 		u32 bi;
- 
- 		/* get beacon period and convert to uS */
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -587,7 +587,6 @@ enum brcms_bss_type {
-  *
-  * wlc: wlc to which this bsscfg belongs to.
-  * type: interface type
-- * up: is this configuration up operational
-  * SSID_len: the length of SSID
-  * SSID: SSID string
-  *
-@@ -604,7 +603,6 @@ enum brcms_bss_type {
- struct brcms_bss_cfg {
- 	struct brcms_c_info *wlc;
- 	enum brcms_bss_type type;
--	bool up;
- 	u8 SSID_len;
- 	u8 SSID[IEEE80211_MAX_SSID_LEN];
- 	u8 BSSID[ETH_ALEN];
diff --git a/package/mac80211/patches/866-brcmsmac-remove-brcms_bss_cfg-cur_etheraddr.patch b/package/mac80211/patches/866-brcmsmac-remove-brcms_bss_cfg-cur_etheraddr.patch
deleted file mode 100644
index 0571932e8c..0000000000
--- a/package/mac80211/patches/866-brcmsmac-remove-brcms_bss_cfg-cur_etheraddr.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -3766,7 +3766,7 @@ static int brcms_c_set_mac(struct brcms_
- 	struct brcms_c_info *wlc = bsscfg->wlc;
- 
- 	/* enter the MAC addr into the RXE match registers */
--	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, bsscfg->cur_etheraddr);
-+	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
- 
- 	brcms_c_ampdu_macaddr_upd(wlc);
- 
-@@ -7359,7 +7359,7 @@ brcms_c_bcn_prb_template(struct brcms_c_
- 	/* A1 filled in by MAC for prb resp, broadcast for bcn */
- 	if (type == IEEE80211_STYPE_BEACON)
- 		memcpy(&h->da, &ether_bcast, ETH_ALEN);
--	memcpy(&h->sa, &cfg->cur_etheraddr, ETH_ALEN);
-+	memcpy(&h->sa, &wlc->pub->cur_etheraddr, ETH_ALEN);
- 	memcpy(&h->bssid, &cfg->BSSID, ETH_ALEN);
- 
- 	/* SEQ filled in by MAC */
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -606,7 +606,6 @@ struct brcms_bss_cfg {
- 	u8 SSID_len;
- 	u8 SSID[IEEE80211_MAX_SSID_LEN];
- 	u8 BSSID[ETH_ALEN];
--	u8 cur_etheraddr[ETH_ALEN];
- 	struct brcms_bss_info *current_bss;
- };
- 
diff --git a/package/mac80211/patches/867-brcmsmac-remove-brcms_pub-bcmerr.patch b/package/mac80211/patches/867-brcmsmac-remove-brcms_pub-bcmerr.patch
deleted file mode 100644
index 2e7c166c36..0000000000
--- a/package/mac80211/patches/867-brcmsmac-remove-brcms_pub-bcmerr.patch
+++ /dev/null
@@ -1,21 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -4327,7 +4327,6 @@ static void brcms_c_info_init(struct brc
- 
- 	/* WME QoS mode is Auto by default */
- 	wlc->pub->_ampdu = AMPDU_AGG_HOST;
--	wlc->pub->bcmerror = 0;
- }
- 
- static uint brcms_c_attach_module(struct brcms_c_info *wlc)
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -164,8 +164,6 @@ struct brcms_pub {
- 
- 	u8 cur_etheraddr[ETH_ALEN];	/* our local ethernet address */
- 
--	int bcmerror;		/* last bcm error */
--
- 	u32 radio_disabled;	/* bit vector for radio disabled reasons */
- 
- 	u16 boardrev;	/* version # of particular board */
diff --git a/package/mac80211/patches/868-brcmsmac-write-beacon-period-to-hardware.patch b/package/mac80211/patches/868-brcmsmac-write-beacon-period-to-hardware.patch
deleted file mode 100644
index fb10e1ba6e..0000000000
--- a/package/mac80211/patches/868-brcmsmac-write-beacon-period-to-hardware.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -5553,10 +5553,20 @@ static void brcms_c_time_unlock(struct b
- 
- int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
- {
-+	u32 bcnint_us;
-+
- 	if (period == 0)
- 		return -EINVAL;
- 
- 	wlc->default_bss->beacon_period = period;
-+
-+	bcnint_us = period << 10;
-+	brcms_c_time_lock(wlc);
-+	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
-+		     (bcnint_us << CFPREP_CBI_SHIFT));
-+	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
-+	brcms_c_time_unlock(wlc);
-+
- 	return 0;
- }
- 
diff --git a/package/mac80211/patches/869-brcmsmac-add-beacon-template-support.patch b/package/mac80211/patches/869-brcmsmac-add-beacon-template-support.patch
deleted file mode 100644
index cbed0f1015..0000000000
--- a/package/mac80211/patches/869-brcmsmac-add-beacon-template-support.patch
+++ /dev/null
@@ -1,266 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -1,5 +1,6 @@
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-+ * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
-  *
-  * Permission to use, copy, modify, and/or distribute this software for any
-  * purpose with or without fee is hereby granted, provided that the above
-@@ -522,9 +523,17 @@ brcms_ops_bss_info_changed(struct ieee80
- 		brcms_c_set_addrmatch(wl->wlc, RCM_BSSID_OFFSET, info->bssid);
- 		spin_unlock_bh(&wl->lock);
- 	}
--	if (changed & BSS_CHANGED_BEACON)
-+	if (changed & BSS_CHANGED_BEACON) {
- 		/* Beacon data changed, retrieve new beacon (beaconing modes) */
--		brcms_err(core, "%s: beacon changed\n", __func__);
-+		struct sk_buff *beacon;
-+		u16 tim_offset = 0;
-+
-+		spin_lock_bh(&wl->lock);
-+		beacon = ieee80211_beacon_get_tim(hw, vif, &tim_offset, NULL);
-+		brcms_c_set_new_beacon(wl->wlc, beacon, tim_offset,
-+				       info->dtim_period);
-+		spin_unlock_bh(&wl->lock);
-+	}
- 
- 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
- 		/* Beaconing should be enabled/disabled (beaconing modes) */
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -1,5 +1,6 @@
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-+ * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
-  *
-  * Permission to use, copy, modify, and/or distribute this software for any
-  * purpose with or without fee is hereby granted, provided that the above
-@@ -450,6 +451,8 @@ static void brcms_c_detach_mfree(struct 
- 	kfree(wlc->corestate);
- 	kfree(wlc->hw->bandstate[0]);
- 	kfree(wlc->hw);
-+	if (wlc->beacon)
-+		dev_kfree_skb_any(wlc->beacon);
- 
- 	/* free the wlc */
- 	kfree(wlc);
-@@ -4086,10 +4089,14 @@ void brcms_c_wme_setparams(struct brcms_
- 					  *shm_entry++);
- 	}
- 
--	if (suspend) {
-+	if (suspend)
- 		brcms_c_suspend_mac_and_wait(wlc);
-+
-+	brcms_c_update_beacon(wlc);
-+	brcms_c_update_probe_resp(wlc, false);
-+
-+	if (suspend)
- 		brcms_c_enable_mac(wlc);
--	}
- }
- 
- static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
-@@ -7379,6 +7386,107 @@ int brcms_c_get_header_len(void)
- 	return TXOFF;
- }
- 
-+static void brcms_c_beacon_write(struct brcms_c_info *wlc,
-+				 struct sk_buff *beacon, u16 tim_offset,
-+				 u16 dtim_period, bool bcn0, bool bcn1)
-+{
-+	size_t len;
-+	struct ieee80211_tx_info *tx_info;
-+	struct brcms_hardware *wlc_hw = wlc->hw;
-+	struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
-+
-+	/* Get tx_info */
-+	tx_info = IEEE80211_SKB_CB(beacon);
-+
-+	len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
-+	wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
-+
-+	brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
-+			     len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
-+
-+	/* "Regular" and 16 MBSS but not for 4 MBSS */
-+	/* Update the phytxctl for the beacon based on the rspec */
-+	brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
-+
-+	if (bcn0) {
-+		/* write the probe response into the template region */
-+		brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
-+					    (len + 3) & ~3, beacon->data);
-+
-+		/* write beacon length to SCR */
-+		brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
-+	}
-+	if (bcn1) {
-+		/* write the probe response into the template region */
-+		brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
-+					    (len + 3) & ~3, beacon->data);
-+
-+		/* write beacon length to SCR */
-+		brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
-+	}
-+
-+	if (tim_offset != 0) {
-+		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
-+				  tim_offset + D11B_PHY_HDR_LEN);
-+		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
-+	} else {
-+		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
-+				  len + D11B_PHY_HDR_LEN);
-+		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
-+	}
-+}
-+
-+static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
-+				     struct sk_buff *beacon, u16 tim_offset,
-+				     u16 dtim_period)
-+{
-+	struct brcms_hardware *wlc_hw = wlc->hw;
-+	struct bcma_device *core = wlc_hw->d11core;
-+
-+	/* Hardware beaconing for this config */
-+	u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
-+
-+	/* Check if both templates are in use, if so sched. an interrupt
-+	 *      that will call back into this routine
-+	 */
-+	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
-+		/* clear any previous status */
-+		bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
-+
-+	if (wlc->beacon_template_virgin) {
-+		wlc->beacon_template_virgin = false;
-+		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
-+				     true);
-+		/* mark beacon0 valid */
-+		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
-+		return;
-+	}
-+
-+	/* Check that after scheduling the interrupt both of the
-+	 *      templates are still busy. if not clear the int. & remask
-+	 */
-+	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
-+		wlc->defmacintmask |= MI_BCNTPL;
-+		return;
-+	}
-+
-+	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
-+		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
-+				     false);
-+		/* mark beacon0 valid */
-+		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
-+		return;
-+	}
-+	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
-+		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
-+				     false, true);
-+		/* mark beacon0 valid */
-+		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
-+		return;
-+	}
-+	return;
-+}
-+
- /*
-  * Update all beacons for the system.
-  */
-@@ -7387,9 +7495,31 @@ void brcms_c_update_beacon(struct brcms_
- 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
- 
- 	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
--			     bsscfg->type == BRCMS_TYPE_ADHOC))
-+			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
- 		/* Clear the soft intmask */
- 		wlc->defmacintmask &= ~MI_BCNTPL;
-+		if (!wlc->beacon)
-+			return;
-+		brcms_c_update_beacon_hw(wlc, wlc->beacon,
-+					 wlc->beacon_tim_offset,
-+					 wlc->beacon_dtim_period);
-+	}
-+}
-+
-+void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
-+			    u16 tim_offset, u16 dtim_period)
-+{
-+	if (!beacon)
-+		return;
-+	if (wlc->beacon)
-+		dev_kfree_skb_any(wlc->beacon);
-+	wlc->beacon = beacon;
-+
-+	/* add PLCP */
-+	skb_push(wlc->beacon, D11_PHY_HDR_LEN);
-+	wlc->beacon_tim_offset = tim_offset;
-+	wlc->beacon_dtim_period = dtim_period;
-+	brcms_c_update_beacon(wlc);
- }
- 
- /* Write ssid into shared memory */
-@@ -7788,6 +7918,10 @@ bool brcms_c_dpc(struct brcms_c_info *wl
- 		brcms_rfkill_set_hw_state(wlc->wl);
- 	}
- 
-+	/* BCN template is available */
-+	if (macintstatus & MI_BCNTPL)
-+		brcms_c_update_beacon(wlc);
-+
- 	/* it isn't done and needs to be resched if macintstatus is non-zero */
- 	return wlc->macintstatus != 0;
- 
-@@ -7919,6 +8053,7 @@ brcms_c_attach(struct brcms_info *wl, st
- 	pub->unit = unit;
- 	pub->_piomode = piomode;
- 	wlc->bandinit_pending = false;
-+	wlc->beacon_template_virgin = true;
- 
- 	/* populate struct brcms_c_info with default values  */
- 	brcms_c_info_init(wlc, unit);
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -492,6 +492,8 @@ struct brcms_c_info {
- 	bool radio_monitor;
- 	bool going_down;
- 
-+	bool beacon_template_virgin;
-+
- 	struct brcms_timer *wdtimer;
- 	struct brcms_timer *radio_timer;
- 
-@@ -561,6 +563,10 @@ struct brcms_c_info {
- 
- 	struct wiphy *wiphy;
- 	struct scb pri_scb;
-+
-+	struct sk_buff *beacon;
-+	u16 beacon_tim_offset;
-+	u16 beacon_dtim_period;
- };
- 
- /* antsel module specific state */
-@@ -630,7 +636,6 @@ extern u16 brcms_c_compute_rtscts_dur(st
- extern void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
- 			       struct ieee80211_sta *sta,
- 			       void (*dma_callback_fn));
--extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
- extern void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend);
- extern int brcms_c_set_nmode(struct brcms_c_info *wlc);
- extern void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -332,5 +332,9 @@ extern bool brcms_c_check_radio_disabled
- extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
- extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
- extern void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
-+extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
-+extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
-+				   struct sk_buff *beacon, u16 tim_offset,
-+				   u16 dtim_period);
- 
- #endif				/* _BRCM_PUB_H_ */
diff --git a/package/mac80211/patches/870-brcmsmac-react-on-changing-SSID.patch b/package/mac80211/patches/870-brcmsmac-react-on-changing-SSID.patch
deleted file mode 100644
index 34969ad351..0000000000
--- a/package/mac80211/patches/870-brcmsmac-react-on-changing-SSID.patch
+++ /dev/null
@@ -1,43 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -523,6 +523,12 @@ brcms_ops_bss_info_changed(struct ieee80
- 		brcms_c_set_addrmatch(wl->wlc, RCM_BSSID_OFFSET, info->bssid);
- 		spin_unlock_bh(&wl->lock);
- 	}
-+	if (changed & BSS_CHANGED_SSID) {
-+		/* BSSID changed, for whatever reason (IBSS and managed mode) */
-+		spin_lock_bh(&wl->lock);
-+		brcms_c_set_ssid(wl->wlc, info->ssid, info->ssid_len);
-+		spin_unlock_bh(&wl->lock);
-+	}
- 	if (changed & BSS_CHANGED_BEACON) {
- 		/* Beacon data changed, retrieve new beacon (beaconing modes) */
- 		struct sk_buff *beacon;
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -3785,6 +3785,15 @@ static void brcms_c_set_bssid(struct brc
- 	brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
- }
- 
-+void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
-+{
-+	u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
-+	memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
-+
-+	memcpy(wlc->bsscfg->SSID, ssid, len);
-+	wlc->bsscfg->SSID_len = len;
-+}
-+
- static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
- {
- 	wlc_hw->shortslot = shortslot;
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -336,5 +336,7 @@ extern void brcms_c_update_beacon(struct
- extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
- 				   struct sk_buff *beacon, u16 tim_offset,
- 				   u16 dtim_period);
-+extern void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid,
-+			     size_t ssid_len);
- 
- #endif				/* _BRCM_PUB_H_ */
diff --git a/package/mac80211/patches/871-brcmsmac-add-support-for-probe-response-template.patch b/package/mac80211/patches/871-brcmsmac-add-support-for-probe-response-template.patch
deleted file mode 100644
index 27dbfeab2c..0000000000
--- a/package/mac80211/patches/871-brcmsmac-add-support-for-probe-response-template.patch
+++ /dev/null
@@ -1,216 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -541,6 +541,15 @@ brcms_ops_bss_info_changed(struct ieee80
- 		spin_unlock_bh(&wl->lock);
- 	}
- 
-+	if (changed & BSS_CHANGED_AP_PROBE_RESP) {
-+		struct sk_buff *probe_resp;
-+
-+		spin_lock_bh(&wl->lock);
-+		probe_resp = ieee80211_proberesp_get(hw, vif);
-+		brcms_c_set_new_probe_resp(wl->wlc, probe_resp);
-+		spin_unlock_bh(&wl->lock);
-+	}
-+
- 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
- 		/* Beaconing should be enabled/disabled (beaconing modes) */
- 		brcms_err(core, "%s: Beacon enabled: %s\n", __func__,
-@@ -1039,6 +1048,8 @@ static int ieee_hw_init(struct ieee80211
- 	hw->channel_change_time = 7 * 1000;
- 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
- 
-+	hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
-+
- 	hw->rate_control_algorithm = "minstrel_ht";
- 
- 	hw->sta_data_size = 0;
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -453,6 +453,8 @@ static void brcms_c_detach_mfree(struct 
- 	kfree(wlc->hw);
- 	if (wlc->beacon)
- 		dev_kfree_skb_any(wlc->beacon);
-+	if (wlc->probe_resp)
-+		dev_kfree_skb_any(wlc->probe_resp);
- 
- 	/* free the wlc */
- 	kfree(wlc);
-@@ -7327,69 +7329,6 @@ brcms_c_mod_prb_rsp_rate_table(struct br
- 	}
- }
- 
--/*	Max buffering needed for beacon template/prb resp template is 142 bytes.
-- *
-- *	PLCP header is 6 bytes.
-- *	802.11 A3 header is 24 bytes.
-- *	Max beacon frame body template length is 112 bytes.
-- *	Max probe resp frame body template length is 110 bytes.
-- *
-- *      *len on input contains the max length of the packet available.
-- *
-- *	The *len value is set to the number of bytes in buf used, and starts
-- *	with the PLCP and included up to, but not including, the 4 byte FCS.
-- */
--static void
--brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
--			 u32 bcn_rspec,
--			 struct brcms_bss_cfg *cfg, u16 *buf, int *len)
--{
--	static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
--	struct cck_phy_hdr *plcp;
--	struct ieee80211_mgmt *h;
--	int hdr_len, body_len;
--
--	hdr_len = D11_PHY_HDR_LEN + DOT11_MAC_HDR_LEN;
--
--	/* calc buffer size provided for frame body */
--	body_len = *len - hdr_len;
--	/* return actual size */
--	*len = hdr_len + body_len;
--
--	/* format PHY and MAC headers */
--	memset(buf, 0, hdr_len);
--
--	plcp = (struct cck_phy_hdr *) buf;
--
--	/*
--	 * PLCP for Probe Response frames are filled in from
--	 * core's rate table
--	 */
--	if (type == IEEE80211_STYPE_BEACON)
--		/* fill in PLCP */
--		brcms_c_compute_plcp(wlc, bcn_rspec,
--				 (DOT11_MAC_HDR_LEN + body_len + FCS_LEN),
--				 (u8 *) plcp);
--
--	/* "Regular" and 16 MBSS but not for 4 MBSS */
--	/* Update the phytxctl for the beacon based on the rspec */
--	brcms_c_beacon_phytxctl_txant_upd(wlc, bcn_rspec);
--
--	h = (struct ieee80211_mgmt *)&plcp[1];
--
--	/* fill in 802.11 header */
--	h->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | type);
--
--	/* DUR is 0 for multicast bcn, or filled in by MAC for prb resp */
--	/* A1 filled in by MAC for prb resp, broadcast for bcn */
--	if (type == IEEE80211_STYPE_BEACON)
--		memcpy(&h->da, &ether_bcast, ETH_ALEN);
--	memcpy(&h->sa, &wlc->pub->cur_etheraddr, ETH_ALEN);
--	memcpy(&h->bssid, &cfg->BSSID, ETH_ALEN);
--
--	/* SEQ filled in by MAC */
--}
--
- int brcms_c_get_header_len(void)
- {
- 	return TXOFF;
-@@ -7531,6 +7470,20 @@ void brcms_c_set_new_beacon(struct brcms
- 	brcms_c_update_beacon(wlc);
- }
- 
-+void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
-+				struct sk_buff *probe_resp)
-+{
-+	if (!probe_resp)
-+		return;
-+	if (wlc->probe_resp)
-+		dev_kfree_skb_any(wlc->probe_resp);
-+	wlc->probe_resp = probe_resp;
-+
-+	/* add PLCP */
-+	skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
-+	brcms_c_update_probe_resp(wlc, false);
-+}
-+
- /* Write ssid into shared memory */
- static void
- brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
-@@ -7550,30 +7503,19 @@ brcms_c_shm_ssid_upd(struct brcms_c_info
- static void
- brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
- 			      struct brcms_bss_cfg *cfg,
-+			      struct sk_buff *probe_resp,
- 			      bool suspend)
- {
--	u16 *prb_resp;
--	int len = BCN_TMPL_LEN;
-+	int len;
- 
--	prb_resp = kmalloc(BCN_TMPL_LEN, GFP_ATOMIC);
--	if (!prb_resp)
--		return;
--
--	/*
--	 * write the probe response to hardware, or save in
--	 * the config structure
--	 */
--
--	/* create the probe response template */
--	brcms_c_bcn_prb_template(wlc, IEEE80211_STYPE_PROBE_RESP, 0,
--				 cfg, prb_resp, &len);
-+	len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
- 
- 	if (suspend)
- 		brcms_c_suspend_mac_and_wait(wlc);
- 
- 	/* write the probe response into the template region */
- 	brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
--				    (len + 3) & ~3, prb_resp);
-+				    (len + 3) & ~3, probe_resp->data);
- 
- 	/* write the length of the probe response frame (+PLCP/-FCS) */
- 	brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
-@@ -7587,13 +7529,11 @@ brcms_c_bss_update_probe_resp(struct brc
- 	 * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
- 	 * by subtracting the PLCP len and adding the FCS.
- 	 */
--	len += (-D11_PHY_HDR_LEN + FCS_LEN);
--	brcms_c_mod_prb_rsp_rate_table(wlc, (u16) len);
-+	brcms_c_mod_prb_rsp_rate_table(wlc,
-+				      (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
- 
- 	if (suspend)
- 		brcms_c_enable_mac(wlc);
--
--	kfree(prb_resp);
- }
- 
- void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
-@@ -7602,8 +7542,12 @@ void brcms_c_update_probe_resp(struct br
- 
- 	/* update AP or IBSS probe responses */
- 	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
--			     bsscfg->type == BRCMS_TYPE_ADHOC))
--		brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
-+			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
-+		if (!wlc->probe_resp)
-+			return;
-+		brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
-+					      suspend);
-+	}
- }
- 
- int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h
-@@ -567,6 +567,7 @@ struct brcms_c_info {
- 	struct sk_buff *beacon;
- 	u16 beacon_tim_offset;
- 	u16 beacon_dtim_period;
-+	struct sk_buff *probe_resp;
- };
- 
- /* antsel module specific state */
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -336,6 +336,8 @@ extern void brcms_c_update_beacon(struct
- extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
- 				   struct sk_buff *beacon, u16 tim_offset,
- 				   u16 dtim_period);
-+extern void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
-+				       struct sk_buff *probe_resp);
- extern void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid,
- 			     size_t ssid_len);
- 
diff --git a/package/mac80211/patches/872-brcmsmac-deactivate-ucode-sending-probe-responses.patch b/package/mac80211/patches/872-brcmsmac-deactivate-ucode-sending-probe-responses.patch
deleted file mode 100644
index 9c150b1547..0000000000
--- a/package/mac80211/patches/872-brcmsmac-deactivate-ucode-sending-probe-responses.patch
+++ /dev/null
@@ -1,59 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -554,6 +554,12 @@ brcms_ops_bss_info_changed(struct ieee80
- 		/* Beaconing should be enabled/disabled (beaconing modes) */
- 		brcms_err(core, "%s: Beacon enabled: %s\n", __func__,
- 			  info->enable_beacon ? "true" : "false");
-+		if (info->enable_beacon &&
-+		    hw->wiphy->flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) {
-+			brcms_c_enable_probe_resp(wl->wlc, true);
-+		} else {
-+			brcms_c_enable_probe_resp(wl->wlc, false);
-+		}
- 	}
- 
- 	if (changed & BSS_CHANGED_CQM) {
-@@ -1048,7 +1054,12 @@ static int ieee_hw_init(struct ieee80211
- 	hw->channel_change_time = 7 * 1000;
- 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
- 
--	hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
-+	/*
-+	 * deactivate sending probe responses by ucude, because this will
-+	 * cause problems when WPS is used.
-+	 *
-+	 * hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
-+	 */
- 
- 	hw->rate_control_algorithm = "minstrel_ht";
- 
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -7484,6 +7484,17 @@ void brcms_c_set_new_probe_resp(struct b
- 	brcms_c_update_probe_resp(wlc, false);
- }
- 
-+void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable)
-+{
-+	/*
-+	 * prevent ucode from sending probe responses by setting the timeout
-+	 * to 1, it can not send it in that time frame.
-+	 */
-+	wlc->prb_resp_timeout = enable ? BRCMS_PRB_RESP_TIMEOUT : 1;
-+	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
-+	/* TODO: if (enable) => also deactivate receiving of probe request */
-+}
-+
- /* Write ssid into shared memory */
- static void
- brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -338,6 +338,7 @@ extern void brcms_c_set_new_beacon(struc
- 				   u16 dtim_period);
- extern void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
- 				       struct sk_buff *probe_resp);
-+extern void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable);
- extern void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid,
- 			     size_t ssid_len);
- 
diff --git a/package/mac80211/patches/873-brcmsmac-activate-AP-support.patch b/package/mac80211/patches/873-brcmsmac-activate-AP-support.patch
deleted file mode 100644
index 83b3aa808e..0000000000
--- a/package/mac80211/patches/873-brcmsmac-activate-AP-support.patch
+++ /dev/null
@@ -1,79 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -359,10 +359,11 @@ brcms_ops_add_interface(struct ieee80211
- {
- 	struct brcms_info *wl = hw->priv;
- 
--	/* Just STA for now */
--	if (vif->type != NL80211_IFTYPE_STATION) {
-+	/* Just STA and AP for now */
-+	if (vif->type != NL80211_IFTYPE_STATION &&
-+	    vif->type != NL80211_IFTYPE_AP) {
- 		brcms_err(wl->wlc->hw->d11core,
--			  "%s: Attempt to add type %d, only STA for now\n",
-+			  "%s: Attempt to add type %d, only STA and AP for now\n",
- 			  __func__, vif->type);
- 		return -EOPNOTSUPP;
- 	}
-@@ -372,6 +373,9 @@ brcms_ops_add_interface(struct ieee80211
- 	brcms_c_mute(wl->wlc, false);
- 	if (vif->type == NL80211_IFTYPE_STATION)
- 		brcms_c_start_station(wl->wlc, vif->addr);
-+	else if (vif->type == NL80211_IFTYPE_AP)
-+		brcms_c_start_ap(wl->wlc, vif->addr, vif->bss_conf.bssid,
-+				 vif->bss_conf.ssid, vif->bss_conf.ssid_len);
- 	spin_unlock_bh(&wl->lock);
- 
- 	return 0;
-@@ -1052,7 +1056,8 @@ static int ieee_hw_init(struct ieee80211
- 
- 	/* channel change time is dependent on chip and band  */
- 	hw->channel_change_time = 7 * 1000;
--	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
-+	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
-+				     BIT(NL80211_IFTYPE_AP);
- 
- 	/*
- 	 * deactivate sending probe responses by ucude, because this will
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -2176,6 +2176,18 @@ void brcms_c_start_station(struct brcms_
- 	wlc->bsscfg->type = BRCMS_TYPE_STATION;
- }
- 
-+void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
-+		      u8 *ssid, size_t ssid_len)
-+{
-+	brcms_c_set_ssid(wlc, ssid, ssid_len);
-+
-+	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
-+	memcpy(wlc->bsscfg->BSSID, bssid, sizeof(wlc->bsscfg->BSSID));
-+	wlc->bsscfg->type = BRCMS_TYPE_AP;
-+
-+	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
-+}
-+
- /* Initialize GPIOs that are controlled by D11 core */
- static void brcms_c_gpio_init(struct brcms_c_info *wlc)
- {
-@@ -3064,6 +3076,9 @@ static bool brcms_c_ps_allowed(struct br
- 	if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
- 		return false;
- 
-+	if (wlc->bsscfg->type == BRCMS_TYPE_AP)
-+		return false;
-+
- 	return true;
- }
- 
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -332,6 +332,8 @@ extern bool brcms_c_check_radio_disabled
- extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
- extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
- extern void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
-+extern void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr,
-+			     const u8 *bssid, u8 *ssid, size_t ssid_len);
- extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
- extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
- 				   struct sk_buff *beacon, u16 tim_offset,
diff --git a/package/mac80211/patches/874-brcmsmac-add-support-for-adhoc-mode.patch b/package/mac80211/patches/874-brcmsmac-add-support-for-adhoc-mode.patch
deleted file mode 100644
index d1c740793a..0000000000
--- a/package/mac80211/patches/874-brcmsmac-add-support-for-adhoc-mode.patch
+++ /dev/null
@@ -1,74 +0,0 @@
---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
-@@ -359,11 +359,12 @@ brcms_ops_add_interface(struct ieee80211
- {
- 	struct brcms_info *wl = hw->priv;
- 
--	/* Just STA and AP for now */
-+	/* Just STA, AP and ADHOC for now */
- 	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP) {
-+	    vif->type != NL80211_IFTYPE_AP &&
-+	    vif->type != NL80211_IFTYPE_ADHOC) {
- 		brcms_err(wl->wlc->hw->d11core,
--			  "%s: Attempt to add type %d, only STA and AP for now\n",
-+			  "%s: Attempt to add type %d, only STA, AP and AdHoc for now\n",
- 			  __func__, vif->type);
- 		return -EOPNOTSUPP;
- 	}
-@@ -376,6 +377,8 @@ brcms_ops_add_interface(struct ieee80211
- 	else if (vif->type == NL80211_IFTYPE_AP)
- 		brcms_c_start_ap(wl->wlc, vif->addr, vif->bss_conf.bssid,
- 				 vif->bss_conf.ssid, vif->bss_conf.ssid_len);
-+	else if (vif->type == NL80211_IFTYPE_ADHOC)
-+		brcms_c_start_adhoc(wl->wlc, vif->addr);
- 	spin_unlock_bh(&wl->lock);
- 
- 	return 0;
-@@ -1057,7 +1060,8 @@ static int ieee_hw_init(struct ieee80211
- 	/* channel change time is dependent on chip and band  */
- 	hw->channel_change_time = 7 * 1000;
- 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
--				     BIT(NL80211_IFTYPE_AP);
-+				     BIT(NL80211_IFTYPE_AP) |
-+				     BIT(NL80211_IFTYPE_ADHOC);
- 
- 	/*
- 	 * deactivate sending probe responses by ucude, because this will
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -2188,6 +2188,14 @@ void brcms_c_start_ap(struct brcms_c_inf
- 	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
- }
- 
-+void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr)
-+{
-+	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
-+	wlc->bsscfg->type = BRCMS_TYPE_ADHOC;
-+
-+	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, 0);
-+}
-+
- /* Initialize GPIOs that are controlled by D11 core */
- static void brcms_c_gpio_init(struct brcms_c_info *wlc)
- {
-@@ -3079,6 +3087,9 @@ static bool brcms_c_ps_allowed(struct br
- 	if (wlc->bsscfg->type == BRCMS_TYPE_AP)
- 		return false;
- 
-+	if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
-+		return false;
-+
- 	return true;
- }
- 
---- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
-@@ -334,6 +334,7 @@ extern bool brcms_c_tx_flush_completed(s
- extern void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr);
- extern void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr,
- 			     const u8 *bssid, u8 *ssid, size_t ssid_len);
-+extern void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr);
- extern void brcms_c_update_beacon(struct brcms_c_info *wlc);
- extern void brcms_c_set_new_beacon(struct brcms_c_info *wlc,
- 				   struct sk_buff *beacon, u16 tim_offset,