mac80211: update to wireless-testing 2016-05-12

Signed-off-by: Felix Fietkau <nbd@nbd.name>

146 files changed, 1190 insertions, 9915 deletions

diff --git a/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch b/package/kernel/acx-mac80211/patches/300-api_sync.patch
index ee92b943e5..94d61351aa 100644
--- a/package/kernel/acx-mac80211/patches/300-kernel_4_2.patch
+++ b/package/kernel/acx-mac80211/patches/300-api_sync.patch
@@ -1,8 +1,6 @@
-diff --git a/main.c b/main.c
-index bfec856..3c482d9 100644
 --- a/main.c
 +++ b/main.c
-@@ -497,7 +497,7 @@ int acx_free_mechanics(acx_device_t *adev)
+@@ -497,7 +497,7 @@ int acx_free_mechanics(acx_device_t *ade
  
  int acx_init_ieee80211(acx_device_t *adev, struct ieee80211_hw *hw)
  {
@@ -11,7 +9,7 @@ index bfec856..3c482d9 100644
  	hw->queues = 1;
  	hw->wiphy->max_scan_ssids = 1;
  
-@@ -525,7 +525,7 @@ int acx_init_ieee80211(acx_device_t *adev, struct ieee80211_hw *hw)
+@@ -525,14 +525,14 @@ int acx_init_ieee80211(acx_device_t *ade
  	/* We base signal quality on winlevel approach of previous driver
  	 * TODO OW 20100615 This should into a common init code
  	 */
@@ -20,7 +18,16 @@ index bfec856..3c482d9 100644
  	hw->max_signal = 100;
  
  	if (IS_ACX100(adev)) {
-@@ -945,8 +945,8 @@ void acx_op_configure_filter(struct ieee80211_hw *hw,
+-		adev->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
++		adev->hw->wiphy->bands[NL80211_BAND_2GHZ] =
+ 			&acx100_band_2GHz;
+ 	} else if (IS_ACX111(adev))
+-		adev->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
++		adev->hw->wiphy->bands[NL80211_BAND_2GHZ] =
+ 			&acx111_band_2GHz;
+ 	else {
+ 		log(L_ANY, "Error: Unknown device");
+@@ -945,8 +945,8 @@ void acx_op_configure_filter(struct ieee
  		changed_flags, *total_flags);
  
  	/* OWI TODO: Set also FIF_PROBE_REQ ? */
@@ -31,7 +38,7 @@ index bfec856..3c482d9 100644
  
  	logf1(L_DEBUG, "2: *total_flags=0x%08x\n", *total_flags);
  
-@@ -1045,9 +1045,10 @@ void acx_op_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+@@ -1045,9 +1045,10 @@ void acx_op_tx(struct ieee80211_hw *hw,
  }
  
  int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -43,7 +50,7 @@ index bfec856..3c482d9 100644
  	struct sk_buff *skb;
  	size_t ssid_len = 0;
  	u8 *ssid = NULL;
-@@ -1082,7 +1083,7 @@ int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1082,7 +1083,7 @@ int acx_op_hw_scan(struct ieee80211_hw *
  		goto out;
  	}
  #else
@@ -52,11 +59,9 @@ index bfec856..3c482d9 100644
  		req->ie_len);
  	if (!skb) {
  		ret = -ENOMEM;
-diff --git a/main.h b/main.h
-index 293f5c8..84ecb9a 100644
 --- a/main.h
 +++ b/main.h
-@@ -62,7 +62,7 @@ void acx_op_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+@@ -62,7 +62,7 @@ void acx_op_tx(struct ieee80211_hw *hw,
  #endif
  
  int acx_op_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -65,3 +70,14 @@ index 293f5c8..84ecb9a 100644
  
  int acx_recover_hw(acx_device_t *adev);
  
+--- a/cardsetting.c
++++ b/cardsetting.c
+@@ -159,7 +159,7 @@ int acx_set_channel(acx_device_t *adev,
+ 	int res = 0;
+ 
+ 	adev->rx_status.freq = freq;
+-	adev->rx_status.band = IEEE80211_BAND_2GHZ;
++	adev->rx_status.band = NL80211_BAND_2GHZ;
+ 
+ 	adev->channel = channel;
+ 
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 4ab3899133..5bbb7da5ff 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,11 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2016-01-10
+PKG_VERSION:=2016-05-12
 PKG_RELEASE:=1
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 PKG_BACKPORT_VERSION:=
-PKG_MD5SUM:=be5fae2e8d6f7490f9b073374fb895ba
+PKG_MD5SUM:=2142cf38509896dca108624e7c193611
 
 PKG_SOURCE:=compat-wireless-$(PKG_VERSION)$(PKG_BACKPORT_VERSION).tar.bz2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
@@ -884,7 +884,7 @@ endef
 define KernelPackage/lib80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=802.11 Networking stack
-  DEPENDS:=+kmod-cfg80211
+  DEPENDS:=+kmod-cfg80211 +kmod-crypto-hash
   FILES:= \
 	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
 	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
diff --git a/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch b/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch
deleted file mode 100644
index 9adfd8f719..0000000000
--- a/package/kernel/mac80211/patches/004-backports-add-skb_free_frag.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 28 Jan 2016 15:16:35 +0100
-Subject: [PATCH] backports: add skb_free_frag()
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/backport-include/linux/skbuff.h
-+++ b/backport-include/linux/skbuff.h
-@@ -300,4 +300,11 @@ int skb_ensure_writable(struct sk_buff *
- 
- #endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0) */
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,2,0)
-+static inline void skb_free_frag(void *data)
-+{
-+	put_page(virt_to_head_page(data));
-+}
-+#endif
-+
- #endif /* __BACKPORT_SKBUFF_H */
diff --git a/package/kernel/mac80211/patches/004-header-backport-GENL_UNS_ADMIN_PERM.patch b/package/kernel/mac80211/patches/004-header-backport-GENL_UNS_ADMIN_PERM.patch
new file mode 100644
index 0000000000..38d655fe05
--- /dev/null
+++ b/package/kernel/mac80211/patches/004-header-backport-GENL_UNS_ADMIN_PERM.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 14 May 2016 16:39:35 +0200
+Subject: [PATCH] header: backport GENL_UNS_ADMIN_PERM
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ create mode 100644 backport-include/uapi/linux/genetlink.h
+
+--- /dev/null
++++ b/backport-include/uapi/linux/genetlink.h
+@@ -0,0 +1,10 @@
++#ifndef __COMPAT_UAPI_LINUX_GENETLINK_H
++#define __COMPAT_UAPI_LINUX_GENETLINK_H
++
++#include_next <uapi/linux/genetlink.h>
++
++#ifndef GENL_UNS_ADMIN_PERM
++#define GENL_UNS_ADMIN_PERM GENL_ADMIN_PERM
++#endif
++
++#endif
diff --git a/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch b/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch
deleted file mode 100644
index 9b672a8d14..0000000000
--- a/package/kernel/mac80211/patches/005-backports-add-napi_alloc_frag.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 28 Jan 2016 15:19:22 +0100
-Subject: [PATCH] backports: add napi_alloc_frag
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/backport-include/linux/netdevice.h
-+++ b/backport-include/linux/netdevice.h
-@@ -232,6 +232,10 @@ static inline void backport_unregister_n
- #define unregister_netdevice_many LINUX_BACKPORT(unregister_netdevice_many)
- #endif
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,19,0)
-+#define napi_alloc_frag netdev_alloc_frag
-+#endif
-+
- /*
-  * Complicated way of saying: We only backport netdev_rss_key stuff on kernels
-  * that either already have net_get_random_once() (>= 3.13) or where we've been
diff --git a/package/kernel/mac80211/patches/005-header-backport-nla_put_u64_64bit-and-nla_put_64bit.patch b/package/kernel/mac80211/patches/005-header-backport-nla_put_u64_64bit-and-nla_put_64bit.patch
new file mode 100644
index 0000000000..e20d87a7fd
--- /dev/null
+++ b/package/kernel/mac80211/patches/005-header-backport-nla_put_u64_64bit-and-nla_put_64bit.patch
@@ -0,0 +1,158 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 14 May 2016 16:40:16 +0200
+Subject: [PATCH] header: backport nla_put_u64_64bit and nla_put_64bit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/backport-include/net/netlink.h
++++ b/backport-include/net/netlink.h
+@@ -189,4 +189,148 @@ static inline __le64 nla_get_le64(const
+ }
+ #endif /* < 4.4 */
+ 
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(4,7,0)
++
++/**
++ * nla_need_padding_for_64bit - test 64-bit alignment of the next attribute
++ * @skb: socket buffer the message is stored in
++ *
++ * Return true if padding is needed to align the next attribute (nla_data()) to
++ * a 64-bit aligned area.
++ */
++static inline bool nla_need_padding_for_64bit(struct sk_buff *skb)
++{
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
++	/* The nlattr header is 4 bytes in size, that's why we test
++	 * if the skb->data _is_ aligned.  A NOP attribute, plus
++	 * nlattr header for next attribute, will make nla_data()
++	 * 8-byte aligned.
++	 */
++	if (IS_ALIGNED((unsigned long)skb_tail_pointer(skb), 8))
++		return true;
++#endif
++	return false;
++}
++
++/**
++ * nla_align_64bit - 64-bit align the nla_data() of next attribute
++ * @skb: socket buffer the message is stored in
++ * @padattr: attribute type for the padding
++ *
++ * Conditionally emit a padding netlink attribute in order to make
++ * the next attribute we emit have a 64-bit aligned nla_data() area.
++ * This will only be done in architectures which do not have
++ * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS defined.
++ *
++ * Returns zero on success or a negative error code.
++ */
++static inline int nla_align_64bit(struct sk_buff *skb, int padattr)
++{
++	if (nla_need_padding_for_64bit(skb) &&
++	    !nla_reserve(skb, padattr, 0))
++		return -EMSGSIZE;
++
++	return 0;
++}
++
++/**
++ * __nla_reserve_64bit - reserve room for attribute on the skb and align it
++ * @skb: socket buffer to reserve room on
++ * @attrtype: attribute type
++ * @attrlen: length of attribute payload
++ * @padattr: attribute type for the padding
++ *
++ * Adds a netlink attribute header to a socket buffer and reserves
++ * room for the payload but does not copy it. It also ensure that this
++ * attribute will have a 64-bit aligned nla_data() area.
++ *
++ * The caller is responsible to ensure that the skb provides enough
++ * tailroom for the attribute header and payload.
++ */
++static inline struct nlattr *__nla_reserve_64bit(struct sk_buff *skb, int attrtype,
++						 int attrlen, int padattr)
++{
++	if (nla_need_padding_for_64bit(skb))
++		nla_align_64bit(skb, padattr);
++
++	return __nla_reserve(skb, attrtype, attrlen);
++}
++
++/**
++ * __nla_put_64bit - Add a netlink attribute to a socket buffer and align it
++ * @skb: socket buffer to add attribute to
++ * @attrtype: attribute type
++ * @attrlen: length of attribute payload
++ * @data: head of attribute payload
++ * @padattr: attribute type for the padding
++ *
++ * The caller is responsible to ensure that the skb provides enough
++ * tailroom for the attribute header and payload.
++ */
++static inline void __nla_put_64bit(struct sk_buff *skb, int attrtype, int attrlen,
++				   const void *data, int padattr)
++{
++	struct nlattr *nla;
++
++	nla = __nla_reserve_64bit(skb, attrtype, attrlen, padattr);
++	memcpy(nla_data(nla), data, attrlen);
++}
++
++/**
++ * nla_total_size_64bit - total length of attribute including padding
++ * @payload: length of payload
++ */
++static inline int nla_total_size_64bit(int payload)
++{
++	return NLA_ALIGN(nla_attr_size(payload))
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
++		+ NLA_ALIGN(nla_attr_size(0))
++#endif
++		;
++}
++
++/**
++ * nla_put_64bit - Add a netlink attribute to a socket buffer and align it
++ * @skb: socket buffer to add attribute to
++ * @attrtype: attribute type
++ * @attrlen: length of attribute payload
++ * @data: head of attribute payload
++ * @padattr: attribute type for the padding
++ *
++ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
++ * the attribute header and payload.
++ */
++static inline int nla_put_64bit(struct sk_buff *skb, int attrtype, int attrlen,
++				const void *data, int padattr)
++{
++	size_t len;
++
++	if (nla_need_padding_for_64bit(skb))
++		len = nla_total_size_64bit(attrlen);
++	else
++		len = nla_total_size(attrlen);
++	if (unlikely(skb_tailroom(skb) < len))
++		return -EMSGSIZE;
++
++	__nla_put_64bit(skb, attrtype, attrlen, data, padattr);
++	return 0;
++}
++
++/**
++ * nla_put_u64_64bit - Add a u64 netlink attribute to a skb and align it
++ * @skb: socket buffer to add attribute to
++ * @attrtype: attribute type
++ * @value: numeric value
++ * @padattr: attribute type for the padding
++ */
++static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype,
++				    u64 value, int padattr)
++{
++	return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr);
++}
++
++
++#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4,7,0) */
++
+ #endif /* __BACKPORT_NET_NETLINK_H */
diff --git a/package/kernel/mac80211/patches/006-compat-bump-rhashtable-backport-version-due-to-API-c.patch b/package/kernel/mac80211/patches/006-compat-bump-rhashtable-backport-version-due-to-API-c.patch
new file mode 100644
index 0000000000..1fdad3c633
--- /dev/null
+++ b/package/kernel/mac80211/patches/006-compat-bump-rhashtable-backport-version-due-to-API-c.patch
@@ -0,0 +1,18 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 14 May 2016 16:44:57 +0200
+Subject: [PATCH] compat: bump rhashtable backport version due to API changes
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/compat/Kconfig
++++ b/compat/Kconfig
+@@ -139,7 +139,7 @@ config BPAUTO_BUILD_WANT_DEV_COREDUMP
+ config BPAUTO_RHASHTABLE
+ 	bool
+ 	# current API of rhashtable was introduced in version 4.1
+-	depends on KERNEL_4_1
++	depends on KERNEL_4_7
+ 	# not very nice - but better than always having it
+ 	default y if MAC80211
+ 	#h-file linux/rhashtable.h
diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
index fd1e1cff30..e9a140c26f 100644
--- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
+++ b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
@@ -1,6 +1,6 @@
 --- a/.local-symbols
 +++ b/.local-symbols
-@@ -476,44 +476,6 @@ USB_IPHETH=
+@@ -481,45 +481,6 @@ USB_IPHETH=
  USB_SIERRA_NET=
  USB_VL600=
  USB_NET_CH9200=
@@ -37,6 +37,7 @@
 -BCMA_DRIVER_PCI=
 -BCMA_DRIVER_PCI_HOSTMODE=
 -BCMA_DRIVER_MIPS=
+-BCMA_PFLASH=
 -BCMA_SFLASH=
 -BCMA_NFLASH=
 -BCMA_DRIVER_GMAC_CMN=
@@ -56,7 +57,7 @@
  	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
  #else
  	return bus->chipco.dev;
-@@ -4903,7 +4903,7 @@ static int b43_wireless_core_init(struct
+@@ -4901,7 +4901,7 @@ static int b43_wireless_core_init(struct
  	}
  	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
  		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
diff --git a/package/kernel/mac80211/patches/080-disable_clk_backport.patch b/package/kernel/mac80211/patches/080-disable_clk_backport.patch
deleted file mode 100644
index 3765591ebb..0000000000
--- a/package/kernel/mac80211/patches/080-disable_clk_backport.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/compat/compat-3.6.c
-+++ b/compat/compat-3.6.c
-@@ -147,17 +147,3 @@ int sg_alloc_table_from_pages(struct sg_
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(sg_alloc_table_from_pages);
--
--/* whoopsie ! */
--#ifndef CONFIG_COMMON_CLK
--int clk_enable(struct clk *clk)
--{
--	return 0;
--}
--EXPORT_SYMBOL_GPL(clk_enable);
--
--void clk_disable(struct clk *clk)
--{
--}
--EXPORT_SYMBOL_GPL(clk_disable);
--#endif
diff --git a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
index 02f46c778d..b65b0bd00e 100644
--- a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
+++ b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
@@ -34,12 +34,9 @@
  #include "aes_ccm.h"
  
 -void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
--			       u8 *data, size_t data_len, u8 *mic,
--			       size_t mic_len)
 +static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad, u8 *s_0,
 +			    u8 *a, u8 *b)
- {
--	struct scatterlist sg[3];
++{
 +	int i;
 +
 +	crypto_cipher_encrypt_one(tfm, b, b_0);
@@ -54,55 +51,56 @@
 +	for (i = 0; i < AES_BLOCK_SIZE; i++)
 +		aad[i] ^= b[i];
 +	crypto_cipher_encrypt_one(tfm, a, aad);
- 
--	char aead_req_data[sizeof(struct aead_request) +
--			   crypto_aead_reqsize(tfm)]
--		__aligned(__alignof__(struct aead_request));
--	struct aead_request *aead_req = (void *) aead_req_data;
++
 +	/* Mask out bits from auth-only-b_0 */
 +	b_0[0] &= 0x07;
- 
--	memset(aead_req, 0, sizeof(aead_req_data));
++
 +	/* S_0 is used to encrypt T (= MIC) */
 +	b_0[14] = 0;
 +	b_0[15] = 0;
 +	crypto_cipher_encrypt_one(tfm, s_0, b_0);
 +}
- 
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
- 
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
++
++
 +void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			       u8 *data, size_t data_len, u8 *mic,
-+			       size_t mic_len)
-+{
+ 			       u8 *data, size_t data_len, u8 *mic,
+ 			       size_t mic_len)
+ {
+-	struct scatterlist sg[3];
 +	int i, j, last_len, num_blocks;
 +	u8 b[AES_BLOCK_SIZE];
 +	u8 s_0[AES_BLOCK_SIZE];
 +	u8 e[AES_BLOCK_SIZE];
 +	u8 *pos, *cpos;
-+
+ 
+-	char aead_req_data[sizeof(struct aead_request) +
+-			   crypto_aead_reqsize(tfm)]
+-		__aligned(__alignof__(struct aead_request));
+-	struct aead_request *aead_req = (void *) aead_req_data;
 +	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 +	last_len = data_len % AES_BLOCK_SIZE;
 +	aes_ccm_prepare(tfm, b_0, aad, s_0, b, b);
-+
+ 
+-	memset(aead_req, 0, sizeof(aead_req_data));
 +	/* Process payload blocks */
 +	pos = data;
 +	cpos = data;
 +	for (j = 1; j <= num_blocks; j++) {
 +		int blen = (j == num_blocks && last_len) ?
 +			last_len : AES_BLOCK_SIZE;
-+
+ 
+-	sg_init_table(sg, 3);
+-	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
+-	sg_set_buf(&sg[1], data, data_len);
+-	sg_set_buf(&sg[2], mic, mic_len);
 +		/* Authentication followed by encryption */
 +		for (i = 0; i < blen; i++)
 +			b[i] ^= pos[i];
 +		crypto_cipher_encrypt_one(tfm, b, b);
-+
+ 
+-	aead_request_set_tfm(aead_req, tfm);
+-	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
+-	aead_request_set_ad(aead_req, sg[0].length);
 +		b_0[14] = (j >> 8) & 0xff;
 +		b_0[15] = j & 0xff;
 +		crypto_cipher_encrypt_one(tfm, e, b_0);
@@ -125,37 +123,30 @@
 -			   crypto_aead_reqsize(tfm)]
 -		__aligned(__alignof__(struct aead_request));
 -	struct aead_request *aead_req = (void *) aead_req_data;
--
--	if (data_len == 0)
--		return -EINVAL;
--
--	memset(aead_req, 0, sizeof(aead_req_data));
--
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
--
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
 +	int i, j, last_len, num_blocks;
 +	u8 *pos, *cpos;
 +	u8 a[AES_BLOCK_SIZE];
 +	u8 b[AES_BLOCK_SIZE];
 +	u8 s_0[AES_BLOCK_SIZE];
-+
+ 
+-	if (data_len == 0)
+-		return -EINVAL;
 +	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 +	last_len = data_len % AES_BLOCK_SIZE;
 +	aes_ccm_prepare(tfm, b_0, aad, s_0, a, b);
-+
+ 
+-	memset(aead_req, 0, sizeof(aead_req_data));
 +	/* Process payload blocks */
 +	cpos = data;
 +	pos = data;
 +	for (j = 1; j <= num_blocks; j++) {
 +		int blen = (j == num_blocks && last_len) ?
 +			last_len : AES_BLOCK_SIZE;
-+
+ 
+-	sg_init_table(sg, 3);
+-	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
+-	sg_set_buf(&sg[1], data, data_len);
+-	sg_set_buf(&sg[2], mic, mic_len);
 +		/* Decryption followed by authentication */
 +		b_0[14] = (j >> 8) & 0xff;
 +		b_0[15] = j & 0xff;
@@ -166,7 +157,10 @@
 +		}
 +		crypto_cipher_encrypt_one(tfm, a, a);
 +	}
-+
+ 
+-	aead_request_set_tfm(aead_req, tfm);
+-	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
+-	aead_request_set_ad(aead_req, sg[0].length);
 +	for (i = 0; i < mic_len; i++) {
 +		if ((mic[i] ^ s_0[i]) != a[i])
 +			return -1;
@@ -185,12 +179,12 @@
  {
 -	struct crypto_aead *tfm;
 -	int err;
-+	struct crypto_cipher *tfm;
- 
+-
 -	tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
 -	if (IS_ERR(tfm))
 -		return tfm;
--
++	struct crypto_cipher *tfm;
+ 
 -	err = crypto_aead_setkey(tfm, key, key_len);
 -	if (err)
 -		goto free_aead;
@@ -309,7 +303,7 @@
  #endif /* AES_GMAC_H */
 --- a/net/mac80211/key.h
 +++ b/net/mac80211/key.h
-@@ -84,7 +84,7 @@ struct ieee80211_key {
+@@ -88,7 +88,7 @@ struct ieee80211_key {
  			 * Management frames.
  			 */
  			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
@@ -320,7 +314,7 @@
  		struct {
 --- a/net/mac80211/wpa.c
 +++ b/net/mac80211/wpa.c
-@@ -307,7 +307,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
+@@ -304,7 +304,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
  }
  
  
@@ -330,7 +324,7 @@
  {
  	__le16 mask_fc;
  	int a4_included, mgmt;
-@@ -337,14 +338,8 @@ static void ccmp_special_blocks(struct s
+@@ -334,14 +335,8 @@ static void ccmp_special_blocks(struct s
  	else
  		qos_tid = 0;
  
@@ -347,7 +341,7 @@
  
  	/* Nonce: Nonce Flags | A2 | PN
  	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-@@ -352,6 +347,8 @@ static void ccmp_special_blocks(struct s
+@@ -349,6 +344,8 @@ static void ccmp_special_blocks(struct s
  	b_0[1] = qos_tid | (mgmt << 4);
  	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
  	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
@@ -356,7 +350,7 @@
  
  	/* AAD (extra authenticate-only data) / masked 802.11 header
  	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-@@ -463,7 +460,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -460,7 +457,7 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  
  	pos += IEEE80211_CCMP_HDR_LEN;
@@ -365,7 +359,7 @@
  	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
  				  skb_put(skb, mic_len), mic_len);
  
-@@ -534,7 +531,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
+@@ -537,7 +534,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
  			u8 aad[2 * AES_BLOCK_SIZE];
  			u8 b_0[AES_BLOCK_SIZE];
  			/* hardware didn't decrypt/verify MIC */
diff --git a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
index d1d9fbd9b1..3ca166ff45 100644
--- a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -846,7 +846,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -850,7 +850,6 @@ static int ieee80211_stop_ap(struct wiph
  	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
  
  	__sta_info_flush(sdata, true);
diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
index 2855a88af7..3029598437 100644
--- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
+++ b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
@@ -18,7 +18,7 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1087,14 +1087,14 @@ int ieee80211_register_hw(struct ieee802
+@@ -1089,14 +1089,14 @@ int ieee80211_register_hw(struct ieee802
  
  	rtnl_unlock();
  
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1103,13 +1103,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1105,13 +1105,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -52,7 +52,7 @@
   fail_ifa:
  #endif
  	rtnl_lock();
-@@ -1137,10 +1137,10 @@ void ieee80211_unregister_hw(struct ieee
+@@ -1139,10 +1139,10 @@ void ieee80211_unregister_hw(struct ieee
  	tasklet_kill(&local->tx_pending_tasklet);
  	tasklet_kill(&local->tasklet);
  
diff --git a/package/kernel/mac80211/patches/210-ap_scan.patch b/package/kernel/mac80211/patches/210-ap_scan.patch
index a99cbd2bee..29f05c44d6 100644
--- a/package/kernel/mac80211/patches/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1999,7 +1999,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2008,7 +2008,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
new file mode 100644
index 0000000000..7caa9be5a8
--- /dev/null
+++ b/package/kernel/mac80211/patches/302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 14 May 2016 14:51:02 +0200
+Subject: [PATCH] Revert "ath9k: interpret requested txpower in EIRP
+ domain"
+
+This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
+---
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -2914,7 +2914,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+ {
+ 	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
+ 	struct ieee80211_channel *channel;
+-	int chan_pwr, new_pwr;
++	int chan_pwr, new_pwr, max_gain;
++	int ant_gain, ant_reduction = 0;
+ 
+ 	if (!chan)
+ 		return;
+@@ -2922,10 +2923,15 @@ void ath9k_hw_apply_txpower(struct ath_h
+ 	channel = chan->chan;
+ 	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
+ 	new_pwr = min_t(int, chan_pwr, reg->power_limit);
++	max_gain = chan_pwr - new_pwr + channel->max_antenna_gain * 2;
++
++	ant_gain = get_antenna_gain(ah, chan);
++	if (ant_gain > max_gain)
++		ant_reduction = ant_gain - max_gain;
+ 
+ 	ah->eep_ops->set_txpower(ah, chan,
+ 				 ath9k_regd_get_ctl(reg, chan),
+-				 get_antenna_gain(ah, chan), new_pwr, test);
++				 ant_reduction, new_pwr, test);
+ }
+ 
+ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
diff --git a/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch b/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch
deleted file mode 100644
index 22b987aa7a..0000000000
--- a/package/kernel/mac80211/patches/302-ath9k_hw-add-low-power-tx-gain-table-for-AR953x.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 14 Jan 2016 03:14:03 +0100
-Subject: [PATCH] ath9k_hw: add low power tx gain table for AR953x
-
-Used in some newer TP-Link AR9533 devices.
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
-@@ -698,6 +698,9 @@ static void ar9003_tx_gain_table_mode2(s
- 	else if (AR_SREV_9340(ah))
- 		INIT_INI_ARRAY(&ah->iniModesTxGain,
- 			ar9340Modes_low_ob_db_tx_gain_table_1p0);
-+	else if (AR_SREV_9531_11(ah))
-+		INIT_INI_ARRAY(&ah->iniModesTxGain,
-+			       qca953x_1p1_modes_no_xpa_low_power_tx_gain_table);
- 	else if (AR_SREV_9485_11_OR_LATER(ah))
- 		INIT_INI_ARRAY(&ah->iniModesTxGain,
- 			ar9485Modes_low_ob_db_tx_gain_1_1);
---- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
-+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
-@@ -757,6 +757,71 @@ static const u32 qca953x_1p1_modes_xpa_t
- 	{0x00016448, 0x6c927a70},
- };
- 
-+static const u32 qca953x_1p1_modes_no_xpa_low_power_tx_gain_table[][2] = {
-+	/* Addr      allmodes  */
-+	{0x0000a2dc, 0xfff55592},
-+	{0x0000a2e0, 0xfff99924},
-+	{0x0000a2e4, 0xfffe1e00},
-+	{0x0000a2e8, 0xffffe000},
-+	{0x0000a410, 0x000050d6},
-+	{0x0000a500, 0x00000069},
-+	{0x0000a504, 0x0400006b},
-+	{0x0000a508, 0x0800006d},
-+	{0x0000a50c, 0x0c000269},
-+	{0x0000a510, 0x1000026b},
-+	{0x0000a514, 0x1400026d},
-+	{0x0000a518, 0x18000669},
-+	{0x0000a51c, 0x1c00066b},
-+	{0x0000a520, 0x1d000a68},
-+	{0x0000a524, 0x21000a6a},
-+	{0x0000a528, 0x25000a6c},
-+	{0x0000a52c, 0x29000a6e},
-+	{0x0000a530, 0x2d0012a9},
-+	{0x0000a534, 0x310012ab},
-+	{0x0000a538, 0x350012ad},
-+	{0x0000a53c, 0x39001b0a},
-+	{0x0000a540, 0x3d001b0c},
-+	{0x0000a544, 0x41001b0e},
-+	{0x0000a548, 0x43001bae},
-+	{0x0000a54c, 0x45001914},
-+	{0x0000a550, 0x47001916},
-+	{0x0000a554, 0x49001b96},
-+	{0x0000a558, 0x49001b96},
-+	{0x0000a55c, 0x49001b96},
-+	{0x0000a560, 0x49001b96},
-+	{0x0000a564, 0x49001b96},
-+	{0x0000a568, 0x49001b96},
-+	{0x0000a56c, 0x49001b96},
-+	{0x0000a570, 0x49001b96},
-+	{0x0000a574, 0x49001b96},
-+	{0x0000a578, 0x49001b96},
-+	{0x0000a57c, 0x49001b96},
-+	{0x0000a600, 0x00000000},
-+	{0x0000a604, 0x00000000},
-+	{0x0000a608, 0x00000000},
-+	{0x0000a60c, 0x00000000},
-+	{0x0000a610, 0x00000000},
-+	{0x0000a614, 0x00000000},
-+	{0x0000a618, 0x00804201},
-+	{0x0000a61c, 0x01408201},
-+	{0x0000a620, 0x01408502},
-+	{0x0000a624, 0x01408502},
-+	{0x0000a628, 0x01408502},
-+	{0x0000a62c, 0x01408502},
-+	{0x0000a630, 0x01408502},
-+	{0x0000a634, 0x01408502},
-+	{0x0000a638, 0x01408502},
-+	{0x0000a63c, 0x01408502},
-+	{0x0000b2dc, 0xfff55592},
-+	{0x0000b2e0, 0xfff99924},
-+	{0x0000b2e4, 0xfffe1e00},
-+	{0x0000b2e8, 0xffffe000},
-+	{0x00016044, 0x044922db},
-+	{0x00016048, 0x6c927a70},
-+	{0x00016444, 0x044922db},
-+	{0x00016448, 0x6c927a70},
-+};
-+
- static const u32 qca953x_2p0_baseband_core[][2] = {
- 	/* Addr      allmodes  */
- 	{0x00009800, 0xafe68e30},
diff --git a/package/kernel/mac80211/patches/303-mac80211-mesh-flush-mesh-paths-unconditionally.patch b/package/kernel/mac80211/patches/303-mac80211-mesh-flush-mesh-paths-unconditionally.patch
new file mode 100644
index 0000000000..518d0a31da
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-mac80211-mesh-flush-mesh-paths-unconditionally.patch
@@ -0,0 +1,146 @@
+From: Bob Copeland <me@bobcopeland.com>
+Date: Sun, 15 May 2016 13:19:16 -0400
+Subject: [PATCH] mac80211: mesh: flush mesh paths unconditionally
+
+Currently, the mesh paths associated with a nexthop station are cleaned
+up in the following code path:
+
+    __sta_info_destroy_part1
+    synchronize_net()
+    __sta_info_destroy_part2
+     -> cleanup_single_sta
+       -> mesh_sta_cleanup
+         -> mesh_plink_deactivate
+           -> mesh_path_flush_by_nexthop
+
+However, there are a couple of problems here:
+
+1) the paths aren't flushed at all if the MPM is running in userspace
+   (e.g. when using wpa_supplicant or authsae)
+
+2) there is no synchronize_rcu between removing the path and readers
+   accessing the nexthop, which means the following race is possible:
+
+CPU0                            CPU1
+~~~~                            ~~~~
+                                sta_info_destroy_part1()
+                                synchronize_net()
+rcu_read_lock()
+mesh_nexthop_resolve()
+  mpath = mesh_path_lookup()
+                                [...] -> mesh_path_flush_by_nexthop()
+  sta = rcu_dereference(
+    mpath->next_hop)
+                                kfree(sta)
+  access sta <-- CRASH
+
+Fix both of these by unconditionally flushing paths before destroying
+the sta, and by adding a synchronize_net() after path flush to ensure
+no active readers can still dereference the sta.
+
+Fixes this crash:
+
+[  348.529295] BUG: unable to handle kernel paging request at 00020040
+[  348.530014] IP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
+[  348.530014] *pde = 00000000
+[  348.530014] Oops: 0000 [#1] PREEMPT
+[  348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ]
+[  348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G           O 4.6.0-rc5-wt=V1 #1
+[  348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016  11/07/2014
+[  348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000
+[  348.530014] EIP: 0060:[<f929245d>] EFLAGS: 00010246 CPU: 0
+[  348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
+[  348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008
+[  348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40
+[  348.530014]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
+[  348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690
+[  348.530014] Stack:
+[  348.530014]  00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0
+[  348.530014]  f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320
+[  348.530014]  f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1
+[  348.530014] Call Trace:
+[  348.530014]  [<f9291d80>] mesh_nexthop_lookup+0xbb/0xc8 [mac80211]
+[  348.530014]  [<f9291dc1>] mesh_nexthop_resolve+0x34/0xd8 [mac80211]
+[  348.530014]  [<f9277f6f>] ieee80211_xmit+0x92/0xc1 [mac80211]
+[  348.530014]  [<f9278dd1>] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211]
+[  348.530014]  [<c04df012>] ? sch_direct_xmit+0xd7/0x1b3
+[  348.530014]  [<c022a8c6>] ? __local_bh_enable_ip+0x5d/0x7b
+[  348.530014]  [<f956870c>] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4]
+[  348.530014]  [<f957e036>] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat]
+[  348.530014]  [<c04c6f45>] ? netif_skb_features+0x14d/0x30a
+[  348.530014]  [<f9278e10>] ieee80211_subif_start_xmit+0xa/0xe [mac80211]
+[  348.530014]  [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267
+[  348.530014]  [<c04c7261>] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
+[  348.530014]  [<c04defc6>] sch_direct_xmit+0x8b/0x1b3
+[  348.530014]  [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513
+[  348.530014]  [<c04c7cfb>] dev_queue_xmit+0xa/0xc
+[  348.530014]  [<f91bfc7a>] batadv_send_skb_packet+0xd6/0xec [batman_adv]
+[  348.530014]  [<f91bfdc4>] batadv_send_unicast_skb+0x15/0x4a [batman_adv]
+[  348.530014]  [<f91b5938>] batadv_dat_send_data+0x27e/0x310 [batman_adv]
+[  348.530014]  [<f91c30b5>] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv]
+[  348.530014]  [<f91b63f3>] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv]
+[  348.530014]  [<f91c0cd9>] batadv_interface_tx+0x206/0x385 [batman_adv]
+[  348.530014]  [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267
+[  348.530014]  [<c04c7261>] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
+[  348.530014]  [<c04defc6>] sch_direct_xmit+0x8b/0x1b3
+[  348.530014]  [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513
+[  348.530014]  [<f80cbd2a>] ? igb_xmit_frame+0x57/0x72 [igb]
+[  348.530014]  [<c04c7cfb>] dev_queue_xmit+0xa/0xc
+[  348.530014]  [<f843a326>] br_dev_queue_push_xmit+0xeb/0xfb [bridge]
+[  348.530014]  [<f843a35f>] br_forward_finish+0x29/0x74 [bridge]
+[  348.530014]  [<f843a23b>] ? deliver_clone+0x3b/0x3b [bridge]
+[  348.530014]  [<f843a714>] __br_forward+0x89/0xe7 [bridge]
+[  348.530014]  [<f843a336>] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge]
+[  348.530014]  [<f843a234>] deliver_clone+0x34/0x3b [bridge]
+[  348.530014]  [<f843a68b>] ? br_flood+0x95/0x95 [bridge]
+[  348.530014]  [<f843a66d>] br_flood+0x77/0x95 [bridge]
+[  348.530014]  [<f843a809>] br_flood_forward+0x13/0x1a [bridge]
+[  348.530014]  [<f843a68b>] ? br_flood+0x95/0x95 [bridge]
+[  348.530014]  [<f843b877>] br_handle_frame_finish+0x392/0x3db [bridge]
+[  348.530014]  [<c04e9b2b>] ? nf_iterate+0x2b/0x6b
+[  348.530014]  [<f843baa6>] br_handle_frame+0x1e6/0x240 [bridge]
+[  348.530014]  [<f843b4e5>] ? br_handle_local_finish+0x6a/0x6a [bridge]
+[  348.530014]  [<c04c4ba0>] __netif_receive_skb_core+0x43a/0x66b
+[  348.530014]  [<f843b8c0>] ? br_handle_frame_finish+0x3db/0x3db [bridge]
+[  348.530014]  [<c023cea4>] ? resched_curr+0x19/0x37
+[  348.530014]  [<c0240707>] ? check_preempt_wakeup+0xbf/0xfe
+[  348.530014]  [<c0255dec>] ? ktime_get_with_offset+0x5c/0xfc
+[  348.530014]  [<c04c4fc1>] __netif_receive_skb+0x47/0x55
+[  348.530014]  [<c04c57ba>] netif_receive_skb_internal+0x40/0x5a
+[  348.530014]  [<c04c61ef>] napi_gro_receive+0x3a/0x94
+[  348.530014]  [<f80ce8d5>] igb_poll+0x6fd/0x9ad [igb]
+[  348.530014]  [<c0242bd8>] ? swake_up_locked+0x14/0x26
+[  348.530014]  [<c04c5d29>] net_rx_action+0xde/0x250
+[  348.530014]  [<c022a743>] __do_softirq+0x8a/0x163
+[  348.530014]  [<c022a6b9>] ? __hrtimer_tasklet_trampoline+0x19/0x19
+[  348.530014]  [<c021100f>] do_softirq_own_stack+0x26/0x2c
+[  348.530014]  <IRQ>
+[  348.530014]  [<c022a957>] irq_exit+0x31/0x6f
+[  348.530014]  [<c0210eb2>] do_IRQ+0x8d/0xa0
+[  348.530014]  [<c058152c>] common_interrupt+0x2c/0x40
+[  348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005
+[  348.530014] EIP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40
+[  348.530014] CR2: 0000000000020040
+[  348.530014] ---[ end trace 48556ac26779732e ]---
+[  348.530014] Kernel panic - not syncing: Fatal exception in interrupt
+[  348.530014] Kernel Offset: disabled
+
+Cc: stable@vger.kernel.org
+Reported-by: Fred Veldini <fred.veldini@gmail.com>
+Tested-by: Fred Veldini <fred.veldini@gmail.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+---
+
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -161,6 +161,10 @@ void mesh_sta_cleanup(struct sta_info *s
+ 		del_timer_sync(&sta->mesh->plink_timer);
+ 	}
+ 
++	/* make sure no readers can access nexthop sta from here on */
++	mesh_path_flush_by_nexthop(sta);
++	synchronize_net();
++
+ 	if (changed)
+ 		ieee80211_mbss_info_change_notify(sdata, changed);
+ }
diff --git a/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch b/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch
deleted file mode 100644
index 7bb74353eb..0000000000
--- a/package/kernel/mac80211/patches/303-rt2x00-fix-monitor-mode-regression.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From: Eli Cooper <elicooper@gmx.com>
-Date: Thu, 14 Jan 2016 00:07:12 +0800
-Subject: [PATCH] rt2x00: fix monitor mode regression
-
-Since commit df1404650ccbfeb76a84f301f22316be0d00a864 monitor mode for rt2x00
-has been made effectively useless because the hardware filter is configured to
-drop packets whose intended recipient is not the device, regardless of the
-presence of monitor mode interfaces.
-
-This patch fixes this regression by adding explicit monitor mode support, and
-configuring the hardware filter accordingly.
-
-Signed-off-by: Eli Cooper <elicooper@gmx.com>
----
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
-@@ -273,8 +273,10 @@ static void rt2400pci_config_filter(stru
- 			   !(filter_flags & FIF_PLCPFAIL));
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_CONTROL,
- 			   !(filter_flags & FIF_CONTROL));
--	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME, 1);
-+	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME,
-+			   !rt2x00dev->is_monitoring);
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_TODS,
-+			   !rt2x00dev->is_monitoring &&
- 			   !rt2x00dev->intf_ap_count);
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
- 	rt2x00mmio_register_write(rt2x00dev, RXCSR0, reg);
---- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
-@@ -274,8 +274,10 @@ static void rt2500pci_config_filter(stru
- 			   !(filter_flags & FIF_PLCPFAIL));
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_CONTROL,
- 			   !(filter_flags & FIF_CONTROL));
--	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME, 1);
-+	rt2x00_set_field32(&reg, RXCSR0_DROP_NOT_TO_ME,
-+			   !rt2x00dev->is_monitoring);
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_TODS,
-+			   !rt2x00dev->is_monitoring &&
- 			   !rt2x00dev->intf_ap_count);
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_VERSION_ERROR, 1);
- 	rt2x00_set_field32(&reg, RXCSR0_DROP_MCAST,
---- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
-@@ -437,8 +437,10 @@ static void rt2500usb_config_filter(stru
- 			   !(filter_flags & FIF_PLCPFAIL));
- 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_CONTROL,
- 			   !(filter_flags & FIF_CONTROL));
--	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME, 1);
-+	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_NOT_TO_ME,
-+			   !rt2x00dev->is_monitoring);
- 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_TODS,
-+			   !rt2x00dev->is_monitoring &&
- 			   !rt2x00dev->intf_ap_count);
- 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_VERSION_ERROR, 1);
- 	rt2x00_set_field16(&reg, TXRX_CSR2_DROP_MULTICAST,
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -1490,7 +1490,8 @@ void rt2800_config_filter(struct rt2x00_
- 			   !(filter_flags & FIF_FCSFAIL));
- 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
- 			   !(filter_flags & FIF_PLCPFAIL));
--	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME, 1);
-+	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
-+			   !rt2x00dev->is_monitoring);
- 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
- 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
- 	rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -844,11 +844,13 @@ struct rt2x00_dev {
- 	 *  - Open sta interface count.
- 	 *  - Association count.
- 	 *  - Beaconing enabled count.
-+	 *  - Whether the device is monitoring.
- 	 */
- 	unsigned int intf_ap_count;
- 	unsigned int intf_sta_count;
- 	unsigned int intf_associated;
- 	unsigned int intf_beaconing;
-+	bool is_monitoring;
- 
- 	/*
- 	 * Interface combinations
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00config.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00config.c
-@@ -244,6 +244,16 @@ void rt2x00lib_config(struct rt2x00_dev
- 	    (ieee80211_flags & IEEE80211_CONF_CHANGE_PS))
- 		cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
- 
-+	if (ieee80211_flags & IEEE80211_CONF_CHANGE_MONITOR) {
-+		if (conf->flags & IEEE80211_CONF_MONITOR) {
-+			rt2x00_dbg(rt2x00dev, "Monitor mode is enabled\n");
-+			rt2x00dev->is_monitoring = true;
-+		} else {
-+			rt2x00_dbg(rt2x00dev, "Monitor mode is disabled\n");
-+			rt2x00dev->is_monitoring = false;
-+		}
-+	}
-+
- 	/*
- 	 * Start configuration.
- 	 */
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1204,6 +1204,7 @@ int rt2x00lib_start(struct rt2x00_dev *r
- 	rt2x00dev->intf_ap_count = 0;
- 	rt2x00dev->intf_sta_count = 0;
- 	rt2x00dev->intf_associated = 0;
-+	rt2x00dev->is_monitoring = false;
- 
- 	/* Enable the radio */
- 	retval = rt2x00lib_enable_radio(rt2x00dev);
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-@@ -385,11 +385,6 @@ void rt2x00mac_configure_filter(struct i
- 			*total_flags |= FIF_PSPOLL;
- 	}
- 
--	/*
--	 * Check if there is any work left for us.
--	 */
--	if (rt2x00dev->packet_filter == *total_flags)
--		return;
- 	rt2x00dev->packet_filter = *total_flags;
- 
- 	rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
---- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
-@@ -530,8 +530,10 @@ static void rt61pci_config_filter(struct
- 			   !(filter_flags & FIF_PLCPFAIL));
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
- 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
--	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME, 1);
-+	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
-+			   !rt2x00dev->is_monitoring);
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
-+			   !rt2x00dev->is_monitoring &&
- 			   !rt2x00dev->intf_ap_count);
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
---- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c
-@@ -480,8 +480,10 @@ static void rt73usb_config_filter(struct
- 			   !(filter_flags & FIF_PLCPFAIL));
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
- 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
--	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME, 1);
-+	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
-+			   !rt2x00dev->is_monitoring);
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
-+			   !rt2x00dev->is_monitoring &&
- 			   !rt2x00dev->intf_ap_count);
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
- 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
diff --git a/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch b/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch
deleted file mode 100644
index 049059aa24..0000000000
--- a/package/kernel/mac80211/patches/304-ath9k-avoid-ANI-restart-if-no-trigger.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From: Miaoqing Pan <miaoqing@codeaurora.org>
-Date: Fri, 15 Jan 2016 18:17:17 +0800
-Subject: [PATCH] ath9k: avoid ANI restart if no trigger
-
-Fixes commit 54da20d83f0e ("ath9k_hw: improve ANI processing and rx desensitizing parameters")
-
-Call ath9k_ani_restart() only when the phy error rate reach the
-ANI immunity threshold. Sync the logic with internal code base.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/ani.c
-+++ b/drivers/net/wireless/ath/ath9k/ani.c
-@@ -444,14 +444,16 @@ void ath9k_hw_ani_monitor(struct ath_hw
- 		    ofdmPhyErrRate < ah->config.ofdm_trig_low) {
- 			ath9k_hw_ani_lower_immunity(ah);
- 			aniState->ofdmsTurn = !aniState->ofdmsTurn;
-+			ath9k_ani_restart(ah);
- 		} else if (ofdmPhyErrRate > ah->config.ofdm_trig_high) {
- 			ath9k_hw_ani_ofdm_err_trigger(ah);
- 			aniState->ofdmsTurn = false;
-+			ath9k_ani_restart(ah);
- 		} else if (cckPhyErrRate > ah->config.cck_trig_high) {
- 			ath9k_hw_ani_cck_err_trigger(ah);
- 			aniState->ofdmsTurn = true;
-+			ath9k_ani_restart(ah);
- 		}
--		ath9k_ani_restart(ah);
- 	}
- }
- EXPORT_SYMBOL(ath9k_hw_ani_monitor);
diff --git a/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch b/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch
deleted file mode 100644
index a1ac67c828..0000000000
--- a/package/kernel/mac80211/patches/305-ath9k-clean-up-ANI-per-channel-pointer-checking.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From: Miaoqing Pan <miaoqing@codeaurora.org>
-Date: Fri, 15 Jan 2016 18:17:18 +0800
-Subject: [PATCH] ath9k: clean up ANI per-channel pointer checking
-
-commit c24bd3620c50 ("ath9k: Do not maintain ANI state per-channel")
-removed per-channel handling, the code to check 'curchan' also
-should be removed as never used.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/ani.c
-+++ b/drivers/net/wireless/ath/ath9k/ani.c
-@@ -126,12 +126,8 @@ static void ath9k_hw_update_mibstats(str
- 
- static void ath9k_ani_restart(struct ath_hw *ah)
- {
--	struct ar5416AniState *aniState;
--
--	if (!ah->curchan)
--		return;
-+	struct ar5416AniState *aniState = &ah->ani;
- 
--	aniState = &ah->ani;
- 	aniState->listenTime = 0;
- 
- 	ENABLE_REGWRITE_BUFFER(ah);
-@@ -221,12 +217,7 @@ static void ath9k_hw_set_ofdm_nil(struct
- 
- static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
- {
--	struct ar5416AniState *aniState;
--
--	if (!ah->curchan)
--		return;
--
--	aniState = &ah->ani;
-+	struct ar5416AniState *aniState = &ah->ani;
- 
- 	if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
- 		ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1, false);
-@@ -281,12 +272,7 @@ static void ath9k_hw_set_cck_nil(struct
- 
- static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
- {
--	struct ar5416AniState *aniState;
--
--	if (!ah->curchan)
--		return;
--
--	aniState = &ah->ani;
-+	struct ar5416AniState *aniState = &ah->ani;
- 
- 	if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
- 		ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1,
-@@ -299,9 +285,7 @@ static void ath9k_hw_ani_cck_err_trigger
-  */
- static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
- {
--	struct ar5416AniState *aniState;
--
--	aniState = &ah->ani;
-+	struct ar5416AniState *aniState = &ah->ani;
- 
- 	/* lower OFDM noise immunity */
- 	if (aniState->ofdmNoiseImmunityLevel > 0 &&
-@@ -329,7 +313,7 @@ void ath9k_ani_reset(struct ath_hw *ah,
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	int ofdm_nil, cck_nil;
- 
--	if (!ah->curchan)
-+	if (!chan)
- 		return;
- 
- 	BUG_ON(aniState == NULL);
-@@ -416,14 +400,10 @@ static bool ath9k_hw_ani_read_counters(s
- 
- void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
- {
--	struct ar5416AniState *aniState;
-+	struct ar5416AniState *aniState = &ah->ani;
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	u32 ofdmPhyErrRate, cckPhyErrRate;
- 
--	if (!ah->curchan)
--		return;
--
--	aniState = &ah->ani;
- 	if (!ath9k_hw_ani_read_counters(ah))
- 		return;
- 
diff --git a/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch b/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch
deleted file mode 100644
index cf8194aa33..0000000000
--- a/package/kernel/mac80211/patches/306-ath9k-do-not-reset-while-BB-panic-0x4000409-on-ar956.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Miaoqing Pan <miaoqing@codeaurora.org>
-Date: Fri, 15 Jan 2016 18:17:19 +0800
-Subject: [PATCH] ath9k: do not reset while BB panic(0x4000409) on ar9561
-
-BB panic(0x4000409) observed while AP enabling/disabling
-bursting.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -2071,7 +2071,8 @@ void ar9003_hw_attach_phy_ops(struct ath
-  *             to be disabled.
-  *
-  * 0x04000409: Packet stuck on receive.
-- *             Full chip reset is required for all chips except AR9340.
-+ *             Full chip reset is required for all chips except
-+ *	       AR9340, AR9531 and AR9561.
-  */
- 
- /*
-@@ -2100,7 +2101,7 @@ bool ar9003_hw_bb_watchdog_check(struct
- 	case 0x04000b09:
- 		return true;
- 	case 0x04000409:
--		if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
-+		if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah))
- 			return false;
- 		else
- 			return true;
diff --git a/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch b/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch
deleted file mode 100644
index 80b781ca54..0000000000
--- a/package/kernel/mac80211/patches/307-ath9k-fix-inconsistent-use-of-tab-and-space-in-inden.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Miaoqing Pan <miaoqing@codeaurora.org>
-Date: Fri, 15 Jan 2016 18:17:20 +0800
-Subject: [PATCH] ath9k: fix inconsistent use of tab and space in
- indentation
-
-Minor changes for indenting.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-@@ -5485,11 +5485,11 @@ unsigned int ar9003_get_paprd_scale_fact
- 			  AR9300_PAPRD_SCALE_1);
- 	else {
- 		if (chan->channel >= 5700)
--		return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
--			  AR9300_PAPRD_SCALE_1);
-+			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
-+				  AR9300_PAPRD_SCALE_1);
- 		else if (chan->channel >= 5400)
- 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
--				   AR9300_PAPRD_SCALE_2);
-+				  AR9300_PAPRD_SCALE_2);
- 		else
- 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
- 				  AR9300_PAPRD_SCALE_1);
diff --git a/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch b/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch
deleted file mode 100644
index d4088664bf..0000000000
--- a/package/kernel/mac80211/patches/308-ath9k-fix-data-bus-error-on-ar9300-and-ar9580.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From: Miaoqing Pan <miaoqing@codeaurora.org>
-Date: Fri, 15 Jan 2016 18:17:21 +0800
-Subject: [PATCH] ath9k: fix data bus error on ar9300 and ar9580
-
-One crash issue be found on ar9300: RTC_RC reg read leads crash, leading
-the data bus error, due to RTC_RC reg write not happen properly.
-
-Warm Reset trigger in continuous beacon stuck for one of the customer for
-other chip, noticed the MAC was stuck in RTC reset. After analysis noticed
-DMA did not complete when RTC was put in reset.
-
-So, before resetting the MAC need to make sure there are no pending DMA
-transactions because this reset does not reset all parts of the chip.
-
-The 12th and 11th bit of MAC _DMA_CFG register used to do that.
-	12 cfg_halt_ack 0x0
-		0 DMA has not yet halted
-		1 DMA has halted
-	11 cfg_halt_req 0x0
-		0 DMA logic operates normally
-		1 Request DMA logic to stop so software can reset the MAC
-
-The Bit [12] of this register indicates when the halt has taken effect or
-not. the DMA halt IS NOT recoverable; once software sets bit [11] to
-request a DMA halt, software must wait for bit [12] to be set and reset
-the MAC.
-
-So, the same thing we implemented for ar9580 chip.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1368,6 +1368,16 @@ static bool ath9k_hw_set_reset(struct at
- 	if (ath9k_hw_mci_is_enabled(ah))
- 		ar9003_mci_check_gpm_offset(ah);
- 
-+	/* DMA HALT added to resolve ar9300 and ar9580 bus error during
-+	 * RTC_RC reg read
-+	 */
-+	if (AR_SREV_9300(ah) || AR_SREV_9580(ah)) {
-+		REG_SET_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
-+		ath9k_hw_wait(ah, AR_CFG, AR_CFG_HALT_ACK, AR_CFG_HALT_ACK,
-+			      20 * AH_WAIT_TIMEOUT);
-+		REG_CLR_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
-+	}
-+
- 	REG_WRITE(ah, AR_RTC_RC, rst_flags);
- 
- 	REGWRITE_BUFFER_FLUSH(ah);
---- a/drivers/net/wireless/ath/ath9k/reg.h
-+++ b/drivers/net/wireless/ath/ath9k/reg.h
-@@ -34,8 +34,10 @@
- #define AR_CFG_SWRG          0x00000010
- #define AR_CFG_AP_ADHOC_INDICATION 0x00000020
- #define AR_CFG_PHOK          0x00000100
--#define AR_CFG_CLK_GATE_DIS  0x00000400
- #define AR_CFG_EEBS          0x00000200
-+#define AR_CFG_CLK_GATE_DIS  0x00000400
-+#define AR_CFG_HALT_REQ	     0x00000800
-+#define AR_CFG_HALT_ACK	     0x00001000
- #define AR_CFG_PCI_MASTER_REQ_Q_THRESH         0x00060000
- #define AR_CFG_PCI_MASTER_REQ_Q_THRESH_S       17
- 
diff --git a/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
deleted file mode 100644
index d9511c8d5f..0000000000
--- a/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Fri, 15 Jan 2016 15:59:45 +0100
-Subject: [PATCH] brcmfmac: add missing include
-
-linux/module.h is required for defining module parameters
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -17,6 +17,7 @@
- #include <linux/kernel.h>
- #include <linux/string.h>
- #include <linux/netdevice.h>
-+#include <linux/module.h>
- #include <brcmu_wifi.h>
- #include <brcmu_utils.h>
- #include "core.h"
diff --git a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
deleted file mode 100644
index 711e019e2b..0000000000
--- a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Tue, 19 Jan 2016 12:39:24 +0100
-Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash
-
-With commit 7d34b0560567 ("brcmfmac: Move all module parameters to
-one place") a bug was introduced causing a null pointer exception.
-This patch fixes the bug by initializing the sg table till after
-the settings have been initialized.
-
-Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place")
-Reported-by: Marc Zyngier <marc.zyngier@arm.com>
-Tested-by: Marc Zyngier <marc.zyngier@arm.com>
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
- 	return 0;
- }
- 
--static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
-+void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
- {
-+	struct sdio_func *func;
-+	struct mmc_host *host;
-+	uint max_blocks;
- 	uint nents;
- 	int err;
- 
-+	func = sdiodev->func[2];
-+	host = func->card->host;
-+	sdiodev->sg_support = host->max_segs > 1;
-+	max_blocks = min_t(uint, host->max_blk_count, 511u);
-+	sdiodev->max_request_size = min_t(uint, host->max_req_size,
-+					  max_blocks * func->cur_blksize);
-+	sdiodev->max_segment_count = min_t(uint, host->max_segs,
-+					   SG_MAX_SINGLE_ALLOC);
-+	sdiodev->max_segment_size = host->max_seg_size;
-+
- 	if (!sdiodev->sg_support)
- 		return;
- 
-@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc
- 
- static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
- {
--	struct sdio_func *func;
--	struct mmc_host *host;
--	uint max_blocks;
- 	int ret = 0;
- 
- 	sdiodev->num_funcs = 2;
-@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm
- 		goto out;
- 	}
- 
--	/*
--	 * determine host related variables after brcmf_sdiod_probe()
--	 * as func->cur_blksize is properly set and F2 init has been
--	 * completed successfully.
--	 */
--	func = sdiodev->func[2];
--	host = func->card->host;
--	sdiodev->sg_support = host->max_segs > 1;
--	max_blocks = min_t(uint, host->max_blk_count, 511u);
--	sdiodev->max_request_size = min_t(uint, host->max_req_size,
--					  max_blocks * func->cur_blksize);
--	sdiodev->max_segment_count = min_t(uint, host->max_segs,
--					   SG_MAX_SINGLE_ALLOC);
--	sdiodev->max_segment_size = host->max_seg_size;
--
--	/* allocate scatter-gather table. sg support
--	 * will be disabled upon allocation failure.
--	 */
--	brcmf_sdiod_sgtable_alloc(sdiodev);
--
- 	ret = brcmf_sdiod_freezer_attach(sdiodev);
- 	if (ret)
- 		goto out;
-@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm
- 		ret = -ENODEV;
- 		goto out;
- 	}
--	brcmf_sdiod_host_fixup(host);
-+	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
- out:
- 	if (ret)
- 		brcmf_sdiod_remove(sdiodev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 		goto fail;
- 	}
- 
-+	/* allocate scatter-gather table. sg support
-+	 * will be disabled upon allocation failure.
-+	 */
-+	brcmf_sdiod_sgtable_alloc(bus->sdiodev);
-+
- 	/* Query the F2 block size, set roundup accordingly */
- 	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
- 
- /* Issue an abort to the specified function */
- int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
-+void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
- 			      enum brcmf_sdiod_state state);
- #ifdef CONFIG_PM_SLEEP
diff --git a/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch b/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
deleted file mode 100644
index 287d6e13bd..0000000000
--- a/package/kernel/mac80211/patches/310-ath9k_hw-ignore-eeprom-magic-mismatch-on-flash-based.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 21 Jan 2016 16:28:44 +0100
-Subject: [PATCH] ath9k_hw: ignore eeprom magic mismatch on flash based devices
-
-Many AR913x based devices (maybe others too) do not have a valid EEPROM
-magic in their calibration data partition.
-
-Fixes: 6fa658fd5ab2 ("ath9k: Simplify and fix eeprom endianness swapping")
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
-@@ -150,18 +150,18 @@ int ath9k_hw_nvram_swap_data(struct ath_
- 		return -EIO;
- 	}
- 
--	if (magic == AR5416_EEPROM_MAGIC) {
--		*swap_needed = false;
--	} else if (swab16(magic) == AR5416_EEPROM_MAGIC) {
-+	*swap_needed = false;
-+	if (swab16(magic) == AR5416_EEPROM_MAGIC) {
- 		if (ah->ah_flags & AH_NO_EEP_SWAP) {
- 			ath_info(common,
- 				 "Ignoring endianness difference in EEPROM magic bytes.\n");
--
--			*swap_needed = false;
- 		} else {
- 			*swap_needed = true;
- 		}
--	} else {
-+	} else if (magic != AR5416_EEPROM_MAGIC) {
-+		if (ath9k_hw_use_flash(ah))
-+			return 0;
-+
- 		ath_err(common,
- 			"Invalid EEPROM Magic (0x%04x).\n", magic);
- 		return -EINVAL;
diff --git a/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch b/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch
deleted file mode 100644
index 070efa98e8..0000000000
--- a/package/kernel/mac80211/patches/311-ath9k-do-not-limit-the-number-of-DFS-interfaces-to-1.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Fri, 22 Jan 2016 01:05:56 +0100
-Subject: [PATCH] ath9k: do not limit the number of DFS interfaces to 1
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -751,14 +751,6 @@ static const struct ieee80211_iface_comb
- 
- #endif /* CPTCFG_ATH9K_CHANNEL_CONTEXT */
- 
--static const struct ieee80211_iface_limit if_dfs_limits[] = {
--	{ .max = 1,	.types = BIT(NL80211_IFTYPE_AP) |
--#ifdef CPTCFG_MAC80211_MESH
--				 BIT(NL80211_IFTYPE_MESH_POINT) |
--#endif
--				 BIT(NL80211_IFTYPE_ADHOC) },
--};
--
- static const struct ieee80211_iface_combination if_comb[] = {
- 	{
- 		.limits = if_limits,
-@@ -766,6 +758,11 @@ static const struct ieee80211_iface_comb
- 		.max_interfaces = 2048,
- 		.num_different_channels = 1,
- 		.beacon_int_infra_match = true,
-+#ifdef CPTCFG_ATH9K_DFS_CERTIFIED
-+		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
-+					BIT(NL80211_CHAN_WIDTH_20) |
-+					BIT(NL80211_CHAN_WIDTH_40),
-+#endif
- 	},
- 	{
- 		.limits = wds_limits,
-@@ -774,18 +771,6 @@ static const struct ieee80211_iface_comb
- 		.num_different_channels = 1,
- 		.beacon_int_infra_match = true,
- 	},
--#ifdef CPTCFG_ATH9K_DFS_CERTIFIED
--	{
--		.limits = if_dfs_limits,
--		.n_limits = ARRAY_SIZE(if_dfs_limits),
--		.max_interfaces = 1,
--		.num_different_channels = 1,
--		.beacon_int_infra_match = true,
--		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
--					BIT(NL80211_CHAN_WIDTH_20) |
--					BIT(NL80211_CHAN_WIDTH_40),
--	}
--#endif
- };
- 
- #ifdef CPTCFG_ATH9K_CHANNEL_CONTEXT
diff --git a/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch
deleted file mode 100644
index 61cafc7625..0000000000
--- a/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Michal Kazior <michal.kazior@tieto.com>
-Date: Thu, 21 Jan 2016 14:23:07 +0100
-Subject: [PATCH] mac80211: fix txq queue related crashes
-
-The driver can access the queue simultanously
-while mac80211 tears down the interface. Without
-spinlock protection this could lead to corrupting
-sk_buff_head and subsequently to an invalid
-pointer dereference.
-
-Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation")
-Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
----
-
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct iee
- 	if (sdata->vif.txq) {
- 		struct txq_info *txqi = to_txq_info(sdata->vif.txq);
- 
-+		spin_lock_bh(&txqi->queue.lock);
- 		ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
-+		spin_unlock_bh(&txqi->queue.lock);
-+
- 		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
- 	}
- 
diff --git a/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch
deleted file mode 100644
index 844d43bfc7..0000000000
--- a/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From: Michal Kazior <michal.kazior@tieto.com>
-Date: Mon, 25 Jan 2016 14:43:24 +0100
-Subject: [PATCH] mac80211: fix unnecessary frame drops in mesh fwding
-
-The ieee80211_queue_stopped() expects hw queue
-number but it was given raw WMM AC number instead.
-
-This could cause frame drops and problems with
-traffic in some cases - most notably if driver
-doesn't map AC numbers to queue numbers 1:1 and
-uses ieee80211_stop_queues() and
-ieee80211_wake_queue() only without ever calling
-ieee80211_wake_queues().
-
-On ath10k it was possible to hit this problem in
-the following case:
-
-  1. wlan0 uses queue 0
-     (ath10k maps queues per vif)
-  2. offchannel uses queue 15
-  3. queues 1-14 are unused
-  4. ieee80211_stop_queues()
-  5. ieee80211_wake_queue(q=0)
-  6. ieee80211_wake_queue(q=15)
-     (other queues are not woken up because both
-      driver and mac80211 know other queues are
-      unused)
-  7. ieee80211_rx_h_mesh_fwding()
-  8. ieee80211_select_queue_80211() returns 2
-  9. ieee80211_queue_stopped(q=2) returns true
- 10. frame is dropped (oops!)
-
-Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
-Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2235,7 +2235,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	struct ieee80211_local *local = rx->local;
- 	struct ieee80211_sub_if_data *sdata = rx->sdata;
- 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
--	u16 q, hdrlen;
-+	u16 ac, q, hdrlen;
- 
- 	hdr = (struct ieee80211_hdr *) skb->data;
- 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-@@ -2304,7 +2304,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
- 		return RX_CONTINUE;
- 
--	q = ieee80211_select_queue_80211(sdata, skb, hdr);
-+	ac = ieee80211_select_queue_80211(sdata, skb, hdr);
-+	q = sdata->vif.hw_queue[ac];
- 	if (ieee80211_queue_stopped(&local->hw, q)) {
- 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
- 		return RX_DROP_MONITOR;
diff --git a/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch
deleted file mode 100644
index 5b3efbdc5a..0000000000
--- a/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From: Sachin Kulkarni <Sachin.Kulkarni@imgtec.com>
-Date: Tue, 12 Jan 2016 14:30:19 +0530
-Subject: [PATCH] mac80211: Requeue work after scan complete for all VIF
- types.
-
-During a sw scan ieee80211_iface_work ignores work items for all vifs.
-However after the scan complete work is requeued only for STA, ADHOC
-and MESH iftypes.
-
-This occasionally results in event processing getting delayed/not
-processed for iftype AP when it coexists with a STA. This can result
-in data halt and eventually disconnection on the AP interface.
-
-Signed-off-by: Sachin Kulkarni <Sachin.Kulkarni@imgtec.com>
-Cc: linux-wireless@vger.kernel.org
-Cc: johannes@sipsolutions.net
----
-
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -1731,7 +1731,6 @@ void ieee80211_ibss_notify_scan_complete
- 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
- 			continue;
- 		sdata->u.ibss.last_scan_completed = jiffies;
--		ieee80211_queue_work(&local->hw, &sdata->work);
- 	}
- 	mutex_unlock(&local->iflist_mtx);
- }
---- a/net/mac80211/mesh.c
-+++ b/net/mac80211/mesh.c
-@@ -1369,17 +1369,6 @@ out:
- 	sdata_unlock(sdata);
- }
- 
--void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
--{
--	struct ieee80211_sub_if_data *sdata;
--
--	rcu_read_lock();
--	list_for_each_entry_rcu(sdata, &local->interfaces, list)
--		if (ieee80211_vif_is_mesh(&sdata->vif) &&
--		    ieee80211_sdata_running(sdata))
--			ieee80211_queue_work(&local->hw, &sdata->work);
--	rcu_read_unlock();
--}
- 
- void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
- {
---- a/net/mac80211/mesh.h
-+++ b/net/mac80211/mesh.h
-@@ -362,14 +362,10 @@ static inline bool mesh_path_sel_is_hwmp
- 	return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
- }
- 
--void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
--
- void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
- void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
- void ieee80211s_stop(void);
- #else
--static inline void
--ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
- static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
- { return false; }
- static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3978,8 +3978,6 @@ static void ieee80211_restart_sta_timer(
- 		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
- 			ieee80211_queue_work(&sdata->local->hw,
- 					     &sdata->u.mgd.monitor_work);
--		/* and do all the other regular work too */
--		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
- 	}
- }
- 
---- a/net/mac80211/scan.c
-+++ b/net/mac80211/scan.c
-@@ -314,6 +314,7 @@ static void __ieee80211_scan_completed(s
- 	bool was_scanning = local->scanning;
- 	struct cfg80211_scan_request *scan_req;
- 	struct ieee80211_sub_if_data *scan_sdata;
-+	struct ieee80211_sub_if_data *sdata;
- 
- 	lockdep_assert_held(&local->mtx);
- 
-@@ -373,7 +374,15 @@ static void __ieee80211_scan_completed(s
- 
- 	ieee80211_mlme_notify_scan_completed(local);
- 	ieee80211_ibss_notify_scan_completed(local);
--	ieee80211_mesh_notify_scan_completed(local);
-+
-+	/* Requeue all the work that might have been ignored while
-+	 * the scan was in progress
-+	 */
-+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-+		if (ieee80211_sdata_running(sdata))
-+			ieee80211_queue_work(&sdata->local->hw, &sdata->work);
-+	}
-+
- 	if (was_scanning)
- 		ieee80211_start_next_roc(local);
- }
diff --git a/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch
deleted file mode 100644
index 52fecb96b0..0000000000
--- a/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From: Sara Sharon <sara.sharon@intel.com>
-Date: Mon, 25 Jan 2016 15:46:35 +0200
-Subject: [PATCH] mac80211: fix ibss scan parameters
-
-When joining IBSS a full scan should be initiated in order to search
-for existing cell, unless the fixed_channel parameter was set.
-A default channel to create the IBSS on if no cell was found is
-provided as well.
-However - a scan is initiated only on the default channel provided
-regardless of whether ifibss->fixed_channel is set or not, with the
-obvious result of the cell not joining existing IBSS cell that is
-on another channel.
-
-Fixes: 76bed0f43b27 ("mac80211: IBSS fix scan request")
-Signed-off-by: Sara Sharon <sara.sharon@intel.com>
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
----
-
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -7,6 +7,7 @@
-  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
-  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
-  * Copyright 2013-2014  Intel Mobile Communications GmbH
-+ * Copyright(c) 2016 Intel Deutschland GmbH
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of the GNU General Public License version 2 as
-@@ -1483,14 +1484,21 @@ static void ieee80211_sta_find_ibss(stru
- 
- 		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
- 
--		num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
--							 &ifibss->chandef,
--							 channels,
--							 ARRAY_SIZE(channels));
- 		scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
--		ieee80211_request_ibss_scan(sdata, ifibss->ssid,
--					    ifibss->ssid_len, channels, num,
--					    scan_width);
-+
-+		if (ifibss->fixed_channel) {
-+			num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
-+								 &ifibss->chandef,
-+								 channels,
-+								 ARRAY_SIZE(channels));
-+			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-+						    ifibss->ssid_len, channels,
-+						    num, scan_width);
-+		} else {
-+			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-+						    ifibss->ssid_len, NULL,
-+						    0, scan_width);
-+		}
- 	} else {
- 		int interval = IEEE80211_SCAN_INTERVAL;
- 
diff --git a/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch
deleted file mode 100644
index e78df36600..0000000000
--- a/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From: Chris Bainbridge <chris.bainbridge@gmail.com>
-Date: Wed, 27 Jan 2016 15:46:18 +0000
-Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values
-
-Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes:
-
-[    7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
-[    7.976608] load of value 2 is not a valid value for type '_Bool'
-[    7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
-[    7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015
-[    7.976616] Workqueue: phy0 rt2x00usb_work_rxdone
-[    7.976619]  0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
-[    7.976622]  ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
-[    7.976626]  ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
-[    7.976629] Call Trace:
-[    7.976633]  [<ffffffff8181d866>] dump_stack+0x45/0x5f
-[    7.976637]  [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
-[    7.976642]  [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
-[    7.976646]  [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
-[    7.976650]  [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
-[    7.976654]  [<ffffffff81cb27ce>] ? usb_hcd_map_urb_for_dma+0x65e/0x960
-[    7.976659]  [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
-[    7.976663]  [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990
-[    7.976667]  [<ffffffff81c5fb85>] rt2x00lib_rxdone+0x305/0xbd0
-[    7.976670]  [<ffffffff811ac23f>] ? dequeue_task_fair+0x64f/0x1de0
-[    7.976674]  [<ffffffff811a1516>] ? sched_clock_cpu+0xe6/0x150
-[    7.976678]  [<ffffffff81c6c45c>] rt2x00usb_work_rxdone+0x7c/0x140
-[    7.976682]  [<ffffffff8117aef6>] process_one_work+0x226/0x860
-[    7.976686]  [<ffffffff8117b58c>] worker_thread+0x5c/0x680
-[    7.976690]  [<ffffffff8117b530>] ? process_one_work+0x860/0x860
-[    7.976693]  [<ffffffff81184f86>] kthread+0xf6/0x150
-[    7.976697]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
-[    7.976700]  [<ffffffff822a94df>] ret_from_fork+0x3f/0x70
-[    7.976703]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
-
-Link: https://lkml.org/lkml/2016/1/26/230
-Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
----
-
---- a/net/mac80211/agg-rx.c
-+++ b/net/mac80211/agg-rx.c
-@@ -327,7 +327,7 @@ void __ieee80211_start_rx_ba_session(str
- 	}
- 
- 	/* prepare A-MPDU MLME for Rx aggregation */
--	tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
-+	tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
- 	if (!tid_agg_rx)
- 		goto end;
- 
diff --git a/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch b/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch
deleted file mode 100644
index 5bf53b918c..0000000000
--- a/package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Konstantin Khlebnikov <koct9i@gmail.com>
-Date: Fri, 29 Jan 2016 11:35:12 +0300
-Subject: [PATCH] mac80211: minstrel_ht: fix out-of-bound in
- minstrel_ht_set_best_prob_rate
-
-Patch fixes this splat
-
-BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
-[mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
-
-Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
-Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	    (max_tp_group != MINSTREL_CCK_GROUP))
- 		return;
- 
-+	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
-+	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-+	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
-+
- 	if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
- 		cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
- 						    mrs->prob_ewma);
- 		if (cur_tp_avg > tmp_tp_avg)
- 			mi->max_prob_rate = index;
- 
--		max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
--		max_gpr_idx = mg->max_group_prob_rate %	MCS_GROUP_RATES;
--		max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
- 		max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
- 							max_gpr_idx,
- 							max_gpr_prob);
-@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	} else {
- 		if (mrs->prob_ewma > tmp_prob)
- 			mi->max_prob_rate = index;
--		if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
-+		if (mrs->prob_ewma > max_gpr_prob)
- 			mg->max_group_prob_rate = index;
- 	}
- }
diff --git a/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch b/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch
deleted file mode 100644
index 655dc4bfa9..0000000000
--- a/package/kernel/mac80211/patches/318-mac80211-move-A-MSDU-skb_linearize-call-to-ieee80211.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Tue, 2 Feb 2016 14:39:08 +0100
-Subject: [PATCH] mac80211: move A-MSDU skb_linearize call to
- ieee80211_amsdu_to_8023s
-
-Prepararation for zero-copy A-MSDU support with page fragment SKBs
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2203,9 +2203,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
- 	skb->dev = dev;
- 	__skb_queue_head_init(&frame_list);
- 
--	if (skb_linearize(skb))
--		return RX_DROP_UNUSABLE;
--
- 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
- 				 rx->sdata->vif.type,
- 				 rx->local->hw.extra_tx_headroom, true);
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -657,6 +657,9 @@ void ieee80211_amsdu_to_8023s(struct sk_
- 	int remaining, err;
- 	u8 dst[ETH_ALEN], src[ETH_ALEN];
- 
-+	if (skb_linearize(skb))
-+		goto out;
-+
- 	if (has_80211_header) {
- 		err = ieee80211_data_to_8023(skb, addr, iftype);
- 		if (err)
diff --git a/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch b/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch
deleted file mode 100644
index b646ab36dd..0000000000
--- a/package/kernel/mac80211/patches/319-cfg80211-add-function-for-802.3-conversion-with-sepa.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Tue, 2 Feb 2016 14:39:09 +0100
-Subject: [PATCH] cfg80211: add function for 802.3 conversion with separate
- output buffer
-
-Use skb_copy_bits in preparation for allowing fragmented skbs
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -393,9 +393,9 @@ unsigned int ieee80211_get_hdrlen_from_s
- }
- EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
- 
--unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
-+static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
- {
--	int ae = meshhdr->flags & MESH_FLAGS_AE;
-+	int ae = flags & MESH_FLAGS_AE;
- 	/* 802.11-2012, 8.2.4.7.3 */
- 	switch (ae) {
- 	default:
-@@ -407,21 +407,31 @@ unsigned int ieee80211_get_mesh_hdrlen(s
- 		return 18;
- 	}
- }
-+
-+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
-+{
-+	return __ieee80211_get_mesh_hdrlen(meshhdr->flags);
-+}
- EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
- 
--int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
--			   enum nl80211_iftype iftype)
-+static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr,
-+				    const u8 *addr, enum nl80211_iftype iftype)
- {
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
--	u16 hdrlen, ethertype;
--	u8 *payload;
--	u8 dst[ETH_ALEN];
--	u8 src[ETH_ALEN] __aligned(2);
-+	struct {
-+		u8 hdr[ETH_ALEN] __aligned(2);
-+		__be16 proto;
-+	} payload;
-+	struct ethhdr tmp;
-+	u16 hdrlen;
-+	u8 mesh_flags = 0;
- 
- 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
- 		return -1;
- 
- 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	if (skb->len < hdrlen + 8)
-+		return -1;
- 
- 	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
- 	 * header
-@@ -432,8 +442,11 @@ int ieee80211_data_to_8023(struct sk_buf
- 	 *   1     0   BSSID SA    DA    n/a
- 	 *   1     1   RA    TA    DA    SA
- 	 */
--	memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
--	memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
-+	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
-+	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
-+
-+	if (iftype == NL80211_IFTYPE_MESH_POINT)
-+		skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
- 
- 	switch (hdr->frame_control &
- 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-@@ -450,44 +463,31 @@ int ieee80211_data_to_8023(struct sk_buf
- 			     iftype != NL80211_IFTYPE_STATION))
- 			return -1;
- 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
--			struct ieee80211s_hdr *meshdr =
--				(struct ieee80211s_hdr *) (skb->data + hdrlen);
--			/* make sure meshdr->flags is on the linear part */
--			if (!pskb_may_pull(skb, hdrlen + 1))
--				return -1;
--			if (meshdr->flags & MESH_FLAGS_AE_A4)
-+			if (mesh_flags & MESH_FLAGS_AE_A4)
- 				return -1;
--			if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
-+			if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
- 				skb_copy_bits(skb, hdrlen +
- 					offsetof(struct ieee80211s_hdr, eaddr1),
--				       	dst, ETH_ALEN);
--				skb_copy_bits(skb, hdrlen +
--					offsetof(struct ieee80211s_hdr, eaddr2),
--				        src, ETH_ALEN);
-+					tmp.h_dest, 2 * ETH_ALEN);
- 			}
--			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
-+			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
- 		}
- 		break;
- 	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
- 		if ((iftype != NL80211_IFTYPE_STATION &&
- 		     iftype != NL80211_IFTYPE_P2P_CLIENT &&
- 		     iftype != NL80211_IFTYPE_MESH_POINT) ||
--		    (is_multicast_ether_addr(dst) &&
--		     ether_addr_equal(src, addr)))
-+		    (is_multicast_ether_addr(tmp.h_dest) &&
-+		     ether_addr_equal(tmp.h_source, addr)))
- 			return -1;
- 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
--			struct ieee80211s_hdr *meshdr =
--				(struct ieee80211s_hdr *) (skb->data + hdrlen);
--			/* make sure meshdr->flags is on the linear part */
--			if (!pskb_may_pull(skb, hdrlen + 1))
--				return -1;
--			if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
-+			if (mesh_flags & MESH_FLAGS_AE_A5_A6)
- 				return -1;
--			if (meshdr->flags & MESH_FLAGS_AE_A4)
-+			if (mesh_flags & MESH_FLAGS_AE_A4)
- 				skb_copy_bits(skb, hdrlen +
- 					offsetof(struct ieee80211s_hdr, eaddr1),
--					src, ETH_ALEN);
--			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
-+					tmp.h_source, ETH_ALEN);
-+			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
- 		}
- 		break;
- 	case cpu_to_le16(0):
-@@ -498,33 +498,33 @@ int ieee80211_data_to_8023(struct sk_buf
- 		break;
- 	}
- 
--	if (!pskb_may_pull(skb, hdrlen + 8))
--		return -1;
--
--	payload = skb->data + hdrlen;
--	ethertype = (payload[6] << 8) | payload[7];
-+	skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
-+	tmp.h_proto = payload.proto;
- 
--	if (likely((ether_addr_equal(payload, rfc1042_header) &&
--		    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
--		   ether_addr_equal(payload, bridge_tunnel_header))) {
-+	if (likely((ether_addr_equal(payload.hdr, rfc1042_header) &&
-+		    tmp.h_proto != htons(ETH_P_AARP) &&
-+		    tmp.h_proto != htons(ETH_P_IPX)) ||
-+		   ether_addr_equal(payload.hdr, bridge_tunnel_header)))
- 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
- 		 * replace EtherType */
--		skb_pull(skb, hdrlen + 6);
--		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
--		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
--	} else {
--		struct ethhdr *ehdr;
--		__be16 len;
-+		hdrlen += ETH_ALEN + 2;
-+	else
-+		tmp.h_proto = htons(skb->len);
- 
--		skb_pull(skb, hdrlen);
--		len = htons(skb->len);
-+	pskb_pull(skb, hdrlen);
-+
-+	if (!ehdr)
- 		ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
--		memcpy(ehdr->h_dest, dst, ETH_ALEN);
--		memcpy(ehdr->h_source, src, ETH_ALEN);
--		ehdr->h_proto = len;
--	}
-+	memcpy(ehdr, &tmp, sizeof(tmp));
-+
- 	return 0;
- }
-+
-+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
-+			   enum nl80211_iftype iftype)
-+{
-+	return __ieee80211_data_to_8023(skb, NULL, addr, iftype);
-+}
- EXPORT_SYMBOL(ieee80211_data_to_8023);
- 
- int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
diff --git a/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch b/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch
deleted file mode 100644
index 2eeed22af0..0000000000
--- a/package/kernel/mac80211/patches/320-cfg80211-add-support-for-non-linear-skbs-in-ieee8021.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Tue, 2 Feb 2016 14:39:10 +0100
-Subject: [PATCH] cfg80211: add support for non-linear skbs in
- ieee80211_amsdu_to_8023s
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -644,73 +644,75 @@ int ieee80211_data_from_8023(struct sk_b
- }
- EXPORT_SYMBOL(ieee80211_data_from_8023);
- 
-+static struct sk_buff *
-+__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
-+		       int offset, int len)
-+{
-+	struct sk_buff *frame;
-+
-+	if (skb->len - offset < len)
-+		return NULL;
-+
-+	/*
-+	 * Allocate and reserve two bytes more for payload
-+	 * alignment since sizeof(struct ethhdr) is 14.
-+	 */
-+	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + len);
-+
-+	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
-+	skb_copy_bits(skb, offset, skb_put(frame, len), len);
-+
-+	return frame;
-+}
- 
- void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
- 			      const u8 *addr, enum nl80211_iftype iftype,
- 			      const unsigned int extra_headroom,
- 			      bool has_80211_header)
- {
-+	unsigned int hlen = ALIGN(extra_headroom, 4);
- 	struct sk_buff *frame = NULL;
- 	u16 ethertype;
- 	u8 *payload;
--	const struct ethhdr *eth;
--	int remaining, err;
--	u8 dst[ETH_ALEN], src[ETH_ALEN];
--
--	if (skb_linearize(skb))
--		goto out;
-+	int offset = 0, remaining, err;
-+	struct ethhdr eth;
-+	bool reuse_skb = true;
-+	bool last = false;
- 
- 	if (has_80211_header) {
--		err = ieee80211_data_to_8023(skb, addr, iftype);
-+		err = __ieee80211_data_to_8023(skb, &eth, addr, iftype);
- 		if (err)
- 			goto out;
--
--		/* skip the wrapping header */
--		eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
--		if (!eth)
--			goto out;
--	} else {
--		eth = (struct ethhdr *) skb->data;
- 	}
- 
--	while (skb != frame) {
-+	while (!last) {
-+		unsigned int subframe_len;
-+		int len;
- 		u8 padding;
--		__be16 len = eth->h_proto;
--		unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
--
--		remaining = skb->len;
--		memcpy(dst, eth->h_dest, ETH_ALEN);
--		memcpy(src, eth->h_source, ETH_ALEN);
- 
-+		skb_copy_bits(skb, offset, &eth, sizeof(eth));
-+		len = ntohs(eth.h_proto);
-+		subframe_len = sizeof(struct ethhdr) + len;
- 		padding = (4 - subframe_len) & 0x3;
-+
- 		/* the last MSDU has no padding */
-+		remaining = skb->len - offset;
- 		if (subframe_len > remaining)
- 			goto purge;
- 
--		skb_pull(skb, sizeof(struct ethhdr));
-+		offset += sizeof(struct ethhdr);
- 		/* reuse skb for the last subframe */
--		if (remaining <= subframe_len + padding)
-+		last = remaining <= subframe_len + padding;
-+		if (!skb_is_nonlinear(skb) && last) {
-+			skb_pull(skb, offset);
- 			frame = skb;
--		else {
--			unsigned int hlen = ALIGN(extra_headroom, 4);
--			/*
--			 * Allocate and reserve two bytes more for payload
--			 * alignment since sizeof(struct ethhdr) is 14.
--			 */
--			frame = dev_alloc_skb(hlen + subframe_len + 2);
-+			reuse_skb = true;
-+		} else {
-+			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len);
- 			if (!frame)
- 				goto purge;
- 
--			skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
--			memcpy(skb_put(frame, ntohs(len)), skb->data,
--				ntohs(len));
--
--			eth = (struct ethhdr *)skb_pull(skb, ntohs(len) +
--							padding);
--			if (!eth) {
--				dev_kfree_skb(frame);
--				goto purge;
--			}
-+			offset += len + padding;
- 		}
- 
- 		skb_reset_network_header(frame);
-@@ -719,24 +721,20 @@ void ieee80211_amsdu_to_8023s(struct sk_
- 
- 		payload = frame->data;
- 		ethertype = (payload[6] << 8) | payload[7];
--
- 		if (likely((ether_addr_equal(payload, rfc1042_header) &&
- 			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
- 			   ether_addr_equal(payload, bridge_tunnel_header))) {
--			/* remove RFC1042 or Bridge-Tunnel
--			 * encapsulation and replace EtherType */
--			skb_pull(frame, 6);
--			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
--			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
--		} else {
--			memcpy(skb_push(frame, sizeof(__be16)), &len,
--				sizeof(__be16));
--			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
--			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-+			eth.h_proto = htons(ethertype);
-+			skb_pull(frame, ETH_ALEN + 2);
- 		}
-+
-+		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
- 		__skb_queue_tail(list, frame);
- 	}
- 
-+	if (!reuse_skb)
-+		dev_kfree_skb(skb);
-+
- 	return;
- 
-  purge:
diff --git a/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch b/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch
deleted file mode 100644
index c4155a1181..0000000000
--- a/package/kernel/mac80211/patches/321-mac80211-Parse-legacy-and-HT-rate-in-injected-frames.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-From: Sven Eckelmann <sven@narfation.org>
-Date: Tue, 26 Jan 2016 17:11:13 +0100
-Subject: [PATCH] mac80211: Parse legacy and HT rate in injected frames
-
-Drivers/devices without their own rate control algorithm can get the
-information what rates they should use from either the radiotap header of
-injected frames or from the rate control algorithm. But the parsing of the
-legacy rate information from the radiotap header was removed in commit
-e6a9854b05c1 ("mac80211/drivers: rewrite the rate control API").
-
-The removal of this feature heavily reduced the usefulness of frame
-injection when wanting to simulate specific transmission behavior. Having
-rate parsing together with MCS rates and retry support allows a fine
-grained selection of the tx behavior of injected frames for these kind of
-tests.
-
-Signed-off-by: Sven Eckelmann <sven@narfation.org>
-Cc: Simon Wunderlich <sw@simonwunderlich.de>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -708,12 +708,14 @@ enum mac80211_tx_info_flags {
-  *	protocol frame (e.g. EAP)
-  * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
-  *	frame (PS-Poll or uAPSD).
-+ * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
-  *
-  * These flags are used in tx_info->control.flags.
-  */
- enum mac80211_tx_control_flags {
- 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
- 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
-+	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
- };
- 
- /*
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -710,6 +710,10 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 
- 	info->control.short_preamble = txrc.short_preamble;
- 
-+	/* don't ask rate control when rate already injected via radiotap */
-+	if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
-+		return TX_CONTINUE;
-+
- 	if (tx->sta)
- 		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
- 
-@@ -1665,15 +1669,24 @@ void ieee80211_xmit(struct ieee80211_sub
- 	ieee80211_tx(sdata, sta, skb, false);
- }
- 
--static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
-+static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
-+					struct sk_buff *skb)
- {
- 	struct ieee80211_radiotap_iterator iterator;
- 	struct ieee80211_radiotap_header *rthdr =
- 		(struct ieee80211_radiotap_header *) skb->data;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_supported_band *sband =
-+		local->hw.wiphy->bands[info->band];
- 	int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
- 						   NULL);
- 	u16 txflags;
-+	u16 rate = 0;
-+	bool rate_found = false;
-+	u8 rate_retries = 0;
-+	u16 rate_flags = 0;
-+	u8 mcs_known, mcs_flags;
-+	int i;
- 
- 	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
- 		       IEEE80211_TX_CTL_DONTFRAG;
-@@ -1724,6 +1737,35 @@ static bool ieee80211_parse_tx_radiotap(
- 				info->flags |= IEEE80211_TX_CTL_NO_ACK;
- 			break;
- 
-+		case IEEE80211_RADIOTAP_RATE:
-+			rate = *iterator.this_arg;
-+			rate_flags = 0;
-+			rate_found = true;
-+			break;
-+
-+		case IEEE80211_RADIOTAP_DATA_RETRIES:
-+			rate_retries = *iterator.this_arg;
-+			break;
-+
-+		case IEEE80211_RADIOTAP_MCS:
-+			mcs_known = iterator.this_arg[0];
-+			mcs_flags = iterator.this_arg[1];
-+			if (!(mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_MCS))
-+				break;
-+
-+			rate_found = true;
-+			rate = iterator.this_arg[2];
-+			rate_flags = IEEE80211_TX_RC_MCS;
-+
-+			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_GI &&
-+			    mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
-+				rate_flags |= IEEE80211_TX_RC_SHORT_GI;
-+
-+			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
-+			    mcs_flags & IEEE80211_RADIOTAP_MCS_BW_40)
-+				rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
-+			break;
-+
- 		/*
- 		 * Please update the file
- 		 * Documentation/networking/mac80211-injection.txt
-@@ -1738,6 +1780,32 @@ static bool ieee80211_parse_tx_radiotap(
- 	if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
- 		return false;
- 
-+	if (rate_found) {
-+		info->control.flags |= IEEE80211_TX_CTRL_RATE_INJECT;
-+
-+		for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-+			info->control.rates[i].idx = -1;
-+			info->control.rates[i].flags = 0;
-+			info->control.rates[i].count = 0;
-+		}
-+
-+		if (rate_flags & IEEE80211_TX_RC_MCS) {
-+			info->control.rates[0].idx = rate;
-+		} else {
-+			for (i = 0; i < sband->n_bitrates; i++) {
-+				if (rate * 5 != sband->bitrates[i].bitrate)
-+					continue;
-+
-+				info->control.rates[0].idx = i;
-+				break;
-+			}
-+		}
-+
-+		info->control.rates[0].flags = rate_flags;
-+		info->control.rates[0].count = min_t(u8, rate_retries + 1,
-+						     local->hw.max_rate_tries);
-+	}
-+
- 	/*
- 	 * remove the radiotap header
- 	 * iterator->_max_length was sanity-checked against
-@@ -1819,7 +1887,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
- 		      IEEE80211_TX_CTL_INJECTED;
- 
- 	/* process and remove the injection radiotap header */
--	if (!ieee80211_parse_tx_radiotap(skb))
-+	if (!ieee80211_parse_tx_radiotap(local, skb))
- 		goto fail;
- 
- 	rcu_read_lock();
diff --git a/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch b/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
deleted file mode 100644
index e7bfb9c83d..0000000000
--- a/package/kernel/mac80211/patches/322-mac80211-add-A-MSDU-tx-support.patch
+++ /dev/null
@@ -1,317 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Fri, 5 Feb 2016 01:38:51 +0100
-Subject: [PATCH] mac80211: add A-MSDU tx support
-
-Requires software tx queueing support. frag_list support (for zero-copy)
-is optional.
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -709,6 +709,7 @@ enum mac80211_tx_info_flags {
-  * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
-  *	frame (PS-Poll or uAPSD).
-  * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
-+ * @IEEE80211_TX_CTRL_AMSDU: This frame is an A-MSDU frame
-  *
-  * These flags are used in tx_info->control.flags.
-  */
-@@ -716,6 +717,7 @@ enum mac80211_tx_control_flags {
- 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
- 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
- 	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
-+	IEEE80211_TX_CTRL_AMSDU			= BIT(3),
- };
- 
- /*
-@@ -1728,6 +1730,7 @@ struct ieee80211_sta_rates {
-  *		  size is min(max_amsdu_len, 7935) bytes.
-  *	Both additional HT limits must be enforced by the low level driver.
-  *	This is defined by the spec (IEEE 802.11-2012 section 8.3.2.2 NOTE 2).
-+ * @max_rc_amsdu_len: Maximum A-MSDU size in bytes recommended by rate control.
-  * @txq: per-TID data TX queues (if driver uses the TXQ abstraction)
-  */
- struct ieee80211_sta {
-@@ -1748,6 +1751,7 @@ struct ieee80211_sta {
- 	bool mfp;
- 	u8 max_amsdu_subframes;
- 	u16 max_amsdu_len;
-+	u16 max_rc_amsdu_len;
- 
- 	struct ieee80211_txq *txq[IEEE80211_NUM_TIDS];
- 
-@@ -1961,6 +1965,15 @@ struct ieee80211_txq {
-  *	order and does not need to manage its own reorder buffer or BA session
-  *	timeout.
-  *
-+ * @IEEE80211_HW_TX_AMSDU: Hardware (or driver) supports software aggregated
-+ *	A-MSDU frames. Requires software tx queueing and fast-xmit support.
-+ *	When not using minstrel/minstrel_ht rate control, the driver should
-+ *	limit the maximum A-MSDU size based on the current tx rate by setting
-+ *	max_rc_amsdu_len in struct ieee80211_sta.
-+ *
-+ * @IEEE80211_HW_TX_FRAG_LIST: Hardware (or driver) supports sending frag_list
-+ *	skbs, needed for zero-copy software A-MSDU.
-+ *
-  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-  */
- enum ieee80211_hw_flags {
-@@ -1998,6 +2011,8 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_BEACON_TX_STATUS,
- 	IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR,
- 	IEEE80211_HW_SUPPORTS_REORDERING_BUFFER,
-+	IEEE80211_HW_TX_AMSDU,
-+	IEEE80211_HW_TX_FRAG_LIST,
- 
- 	/* keep last, obviously */
- 	NUM_IEEE80211_HW_FLAGS
-@@ -2070,6 +2085,9 @@ enum ieee80211_hw_flags {
-  *	size is smaller (an example is LinkSys WRT120N with FW v1.0.07
-  *	build 002 Jun 18 2012).
-  *
-+ * @max_tx_fragments: maximum number of tx buffers per (A)-MSDU, sum
-+ *	of 1 + skb_shinfo(skb)->nr_frags for each skb in the frag_list.
-+ *
-  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
-  *	(if %IEEE80211_HW_QUEUE_CONTROL is set)
-  *
-@@ -2124,6 +2142,7 @@ struct ieee80211_hw {
- 	u8 max_rate_tries;
- 	u8 max_rx_aggregation_subframes;
- 	u8 max_tx_aggregation_subframes;
-+	u8 max_tx_fragments;
- 	u8 offchannel_tx_hw_queue;
- 	u8 radiotap_mcs_details;
- 	u16 radiotap_vht_details;
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -935,6 +935,7 @@ void ieee80211_process_addba_resp(struct
- 				  size_t len)
- {
- 	struct tid_ampdu_tx *tid_tx;
-+	struct ieee80211_txq *txq;
- 	u16 capab, tid;
- 	u8 buf_size;
- 	bool amsdu;
-@@ -945,6 +946,10 @@ void ieee80211_process_addba_resp(struct
- 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
- 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
- 
-+	txq = sta->sta.txq[tid];
-+	if (!amsdu && txq)
-+		set_bit(IEEE80211_TXQ_NO_AMSDU, &to_txq_info(txq)->flags);
-+
- 	mutex_lock(&sta->ampdu_mlme.mtx);
- 
- 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -127,6 +127,8 @@ static const char *hw_flag_names[NUM_IEE
- 	FLAG(BEACON_TX_STATUS),
- 	FLAG(NEEDS_UNIQUE_STA_ADDR),
- 	FLAG(SUPPORTS_REORDERING_BUFFER),
-+	FLAG(TX_AMSDU),
-+	FLAG(TX_FRAG_LIST),
- 
- 	/* keep last for the build bug below */
- 	(void *)0x1
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -799,6 +799,7 @@ struct mac80211_qos_map {
- enum txq_info_flags {
- 	IEEE80211_TXQ_STOP,
- 	IEEE80211_TXQ_AMPDU,
-+	IEEE80211_TXQ_NO_AMSDU,
- };
- 
- struct txq_info {
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1318,6 +1318,10 @@ struct sk_buff *ieee80211_tx_dequeue(str
- out:
- 	spin_unlock_bh(&txqi->queue.lock);
- 
-+	if (skb && skb_has_frag_list(skb) &&
-+	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
-+		skb_linearize(skb);
-+
- 	return skb;
- }
- EXPORT_SYMBOL(ieee80211_tx_dequeue);
-@@ -2757,6 +2761,163 @@ void ieee80211_clear_fast_xmit(struct st
- 		kfree_rcu(fast_tx, rcu_head);
- }
- 
-+static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
-+					struct sk_buff *skb, int headroom,
-+					int *subframe_len)
-+{
-+	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
-+	int padding = (4 - amsdu_len) & 3;
-+
-+	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
-+		I802_DEBUG_INC(local->tx_expand_skb_head);
-+
-+		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
-+			wiphy_debug(local->hw.wiphy,
-+				    "failed to reallocate TX buffer\n");
-+			return false;
-+		}
-+	}
-+
-+	if (padding) {
-+		*subframe_len += padding;
-+		memset(skb_put(skb, padding), 0, padding);
-+	}
-+
-+	return true;
-+}
-+
-+static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
-+					 struct ieee80211_fast_tx *fast_tx,
-+					 struct sk_buff *skb)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_hdr *hdr;
-+	struct ethhdr amsdu_hdr;
-+	int hdr_len = fast_tx->hdr_len - sizeof(rfc1042_header);
-+	int subframe_len = skb->len - hdr_len;
-+	void *data;
-+	u8 *qc;
-+
-+	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
-+		return false;
-+
-+	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
-+		return true;
-+
-+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(amsdu_hdr),
-+					 &subframe_len))
-+		return false;
-+
-+	amsdu_hdr.h_proto = cpu_to_be16(subframe_len);
-+	memcpy(amsdu_hdr.h_source, skb->data + fast_tx->sa_offs, ETH_ALEN);
-+	memcpy(amsdu_hdr.h_dest, skb->data + fast_tx->da_offs, ETH_ALEN);
-+
-+	data = skb_push(skb, sizeof(amsdu_hdr));
-+	memmove(data, data + sizeof(amsdu_hdr), hdr_len);
-+	memcpy(data + hdr_len, &amsdu_hdr, sizeof(amsdu_hdr));
-+
-+	hdr = data;
-+	qc = ieee80211_get_qos_ctl(hdr);
-+	*qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
-+
-+	info->control.flags |= IEEE80211_TX_CTRL_AMSDU;
-+
-+	return true;
-+}
-+
-+static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
-+				      struct sta_info *sta,
-+				      struct ieee80211_fast_tx *fast_tx,
-+				      struct sk_buff *skb)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-+	struct ieee80211_txq *txq = sta->sta.txq[tid];
-+	struct txq_info *txqi;
-+	struct sk_buff **frag_tail, *head;
-+	int subframe_len = skb->len - ETH_ALEN;
-+	u8 max_subframes = sta->sta.max_amsdu_subframes;
-+	int max_frags = local->hw.max_tx_fragments;
-+	int max_amsdu_len = sta->sta.max_amsdu_len;
-+	__be16 len;
-+	void *data;
-+	bool ret = false;
-+	int n = 1, nfrags;
-+
-+	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
-+		return false;
-+
-+	if (!txq)
-+		return false;
-+
-+	txqi = to_txq_info(txq);
-+	if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
-+		return false;
-+
-+	if (sta->sta.max_rc_amsdu_len)
-+		max_amsdu_len = min_t(int, max_amsdu_len,
-+				      sta->sta.max_rc_amsdu_len);
-+
-+	spin_lock_bh(&txqi->queue.lock);
-+
-+	head = skb_peek_tail(&txqi->queue);
-+	if (!head)
-+		goto out;
-+
-+	if (skb->len + head->len > max_amsdu_len)
-+		goto out;
-+
-+	/*
-+	 * HT A-MPDU limits maximum MPDU size to 4095 bytes. Since aggregation
-+	 * sessions are started/stopped without txq flush, use the limit here
-+	 * to avoid having to de-aggregate later.
-+	 */
-+	if (skb->len + head->len > 4095 &&
-+	    !sta->sta.vht_cap.vht_supported)
-+		goto out;
-+
-+	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-+		goto out;
-+
-+	nfrags = 1 + skb_shinfo(skb)->nr_frags;
-+	nfrags += 1 + skb_shinfo(head)->nr_frags;
-+	frag_tail = &skb_shinfo(head)->frag_list;
-+	while (*frag_tail) {
-+		nfrags += 1 + skb_shinfo(*frag_tail)->nr_frags;
-+		frag_tail = &(*frag_tail)->next;
-+		n++;
-+	}
-+
-+	if (max_subframes && n > max_subframes)
-+		goto out;
-+
-+	if (max_frags && nfrags > max_frags)
-+		goto out;
-+
-+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
-+					 &subframe_len))
-+		return false;
-+
-+	ret = true;
-+	data = skb_push(skb, ETH_ALEN + 2);
-+	memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
-+
-+	data += 2 * ETH_ALEN;
-+	len = cpu_to_be16(subframe_len);
-+	memcpy(data, &len, 2);
-+	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
-+
-+	head->len += skb->len;
-+	head->data_len += skb->len;
-+	*frag_tail = skb;
-+
-+out:
-+	spin_unlock_bh(&txqi->queue.lock);
-+
-+	return ret;
-+}
-+
- static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
- 				struct net_device *dev, struct sta_info *sta,
- 				struct ieee80211_fast_tx *fast_tx,
-@@ -2811,6 +2972,10 @@ static bool ieee80211_xmit_fast(struct i
- 
- 	ieee80211_tx_stats(dev, skb->len + extra_head);
- 
-+	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
-+	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
-+		return true;
-+
- 	/* will not be crypto-handled beyond what we do here, so use false
- 	 * as the may-encrypt argument for the resize to not account for
- 	 * more room than we already have in 'extra_head'
diff --git a/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch b/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
deleted file mode 100644
index 9277b2cabc..0000000000
--- a/package/kernel/mac80211/patches/323-0000-brcmfmac-fix-setting-primary-channel-for-80-MHz-widt.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Wed, 20 Jan 2016 16:46:04 +0100
-Subject: [PATCH] brcmfmac: fix setting primary channel for 80 MHz width
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-First of all it changes the way we calculate primary channel offset. If
-we use e.g. 80 MHz channel with primary frequency 5180 MHz (which means
-center frequency is 5210 MHz) it makes sense to calculate primary offset
-as -30 MHz.
-Then it fixes values we compare primary_offset with. We were comparing
-offset in MHz against -2 or 2 which was resulting in picking a wrong
-primary channel.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -247,7 +247,7 @@ static u16 chandef_to_chanspec(struct br
- 	brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
- 		  ch->chan->center_freq, ch->center_freq1, ch->width);
- 	ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
--	primary_offset = ch->center_freq1 - ch->chan->center_freq;
-+	primary_offset = ch->chan->center_freq - ch->center_freq1;
- 	switch (ch->width) {
- 	case NL80211_CHAN_WIDTH_20:
- 	case NL80211_CHAN_WIDTH_20_NOHT:
-@@ -256,24 +256,21 @@ static u16 chandef_to_chanspec(struct br
- 		break;
- 	case NL80211_CHAN_WIDTH_40:
- 		ch_inf.bw = BRCMU_CHAN_BW_40;
--		if (primary_offset < 0)
-+		if (primary_offset > 0)
- 			ch_inf.sb = BRCMU_CHAN_SB_U;
- 		else
- 			ch_inf.sb = BRCMU_CHAN_SB_L;
- 		break;
- 	case NL80211_CHAN_WIDTH_80:
- 		ch_inf.bw = BRCMU_CHAN_BW_80;
--		if (primary_offset < 0) {
--			if (primary_offset < -CH_10MHZ_APART)
--				ch_inf.sb = BRCMU_CHAN_SB_UU;
--			else
--				ch_inf.sb = BRCMU_CHAN_SB_UL;
--		} else {
--			if (primary_offset > CH_10MHZ_APART)
--				ch_inf.sb = BRCMU_CHAN_SB_LL;
--			else
--				ch_inf.sb = BRCMU_CHAN_SB_LU;
--		}
-+		if (primary_offset == -30)
-+			ch_inf.sb = BRCMU_CHAN_SB_LL;
-+		else if (primary_offset == -10)
-+			ch_inf.sb = BRCMU_CHAN_SB_LU;
-+		else if (primary_offset == 10)
-+			ch_inf.sb = BRCMU_CHAN_SB_UL;
-+		else
-+			ch_inf.sb = BRCMU_CHAN_SB_UU;
- 		break;
- 	case NL80211_CHAN_WIDTH_80P80:
- 	case NL80211_CHAN_WIDTH_160:
diff --git a/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch b/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
deleted file mode 100644
index d7018dab3d..0000000000
--- a/package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Tue, 26 Jan 2016 17:57:01 +0100
-Subject: [PATCH] brcmfmac: analyze descriptors of current component only
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-So far we were looking for address descriptors without a check for
-crossing current component border. In case of dealing with unsupported
-descriptor or descriptor missing at all the code would incorrectly get
-data from another component.
-
-Consider this binary-described component from BCM4366 EROM:
-4bf83b01	TAG==CI		CID==0x83b
-20080201	TAG==CI		PORTS==0+1	WRAPPERS==0+1
-18400035	TAG==ADDR	SZ_SZD		TYPE_SLAVE
-00050000
-18107085	TAG==ADDR	SZ_4K		TYPE_SWRAP
-
-Driver was assigning invalid base address to this core:
-brcmfmac:  [6 ] core 0x83b:32 base 0x18109000 wrap 0x18107000
-which came from totally different component defined in EROM:
-43b36701	TAG==CI		CID==0x367
-00000201	TAG==CI		PORTS==0+1	WRAPPERS==0+0
-18109005	TAG==ADDR	SZ_4K		TYPE_SLAVE
-
-This change will also allow us to support components without wrapper
-address in the future.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -803,7 +803,14 @@ static int brcmf_chip_dmp_get_regaddr(st
- 				*eromaddr -= 4;
- 				return -EFAULT;
- 			}
--		} while (desc != DMP_DESC_ADDRESS);
-+		} while (desc != DMP_DESC_ADDRESS &&
-+			 desc != DMP_DESC_COMPONENT);
-+
-+		/* stop if we crossed current component border */
-+		if (desc == DMP_DESC_COMPONENT) {
-+			*eromaddr -= 4;
-+			return 0;
-+		}
- 
- 		/* skip upper 32-bit address descriptor */
- 		if (val & DMP_DESC_ADDRSIZE_GT32)
diff --git a/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch b/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch
deleted file mode 100644
index 045ab4953b..0000000000
--- a/package/kernel/mac80211/patches/323-0002-brcmfmac-allow-storing-PMU-core-without-wrapper-addr.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Tue, 26 Jan 2016 17:57:02 +0100
-Subject: [PATCH] brcmfmac: allow storing PMU core without wrapper address
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Separated PMU core can be found in new devices and should be used for
-accessing PMU registers (which were routed through ChipCommon so far).
-This core is one of exceptions that doesn't have or need wrapper address
-to be still safely accessible.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -883,7 +883,8 @@ int brcmf_chip_dmp_erom_scan(struct brcm
- 		rev = (val & DMP_COMP_REVISION) >> DMP_COMP_REVISION_S;
- 
- 		/* need core with ports */
--		if (nmw + nsw == 0)
-+		if (nmw + nsw == 0 &&
-+		    id != BCMA_CORE_PMU)
- 			continue;
- 
- 		/* try to obtain register address info */
diff --git a/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch b/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch
deleted file mode 100644
index 7b7ba4f743..0000000000
--- a/package/kernel/mac80211/patches/323-0003-brcmfmac-read-extended-capabilities-of-ChipCommon-co.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Tue, 26 Jan 2016 17:57:03 +0100
-Subject: [PATCH] brcmfmac: read extended capabilities of ChipCommon core
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is an extra bitfield with info about some present hardware.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -1025,6 +1025,9 @@ static int brcmf_chip_setup(struct brcmf
- 	/* get chipcommon capabilites */
- 	pub->cc_caps = chip->ops->read32(chip->ctx,
- 					 CORE_CC_REG(base, capabilities));
-+	pub->cc_caps_ext = chip->ops->read32(chip->ctx,
-+					     CORE_CC_REG(base,
-+							 capabilities_ext));
- 
- 	/* get pmu caps & rev */
- 	if (pub->cc_caps & CC_CAP_PMU) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-@@ -27,6 +27,7 @@
-  * @chip: chip identifier.
-  * @chiprev: chip revision.
-  * @cc_caps: chipcommon core capabilities.
-+ * @cc_caps_ext: chipcommon core extended capabilities.
-  * @pmucaps: PMU capabilities.
-  * @pmurev: PMU revision.
-  * @rambase: RAM base address (only applicable for ARM CR4 chips).
-@@ -38,6 +39,7 @@ struct brcmf_chip {
- 	u32 chip;
- 	u32 chiprev;
- 	u32 cc_caps;
-+	u32 cc_caps_ext;
- 	u32 pmucaps;
- 	u32 pmurev;
- 	u32 rambase;
diff --git a/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch b/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch
deleted file mode 100644
index 2af6fd93bc..0000000000
--- a/package/kernel/mac80211/patches/323-0004-brcmfmac-access-PMU-registers-using-standalone-PMU-c.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Tue, 26 Jan 2016 17:57:04 +0100
-Subject: [PATCH] brcmfmac: access PMU registers using standalone PMU core if
- available
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On recent Broadcom chipsets PMU is present as separated core and it
-can't be accessed using ChipCommon anymore as it fails with e.g.:
-[   18.198412] Unhandled fault: imprecise external abort (0x1406) at 0xb6da200f
-
-Add a new helper function that will return a proper core that should be
-used for accessing PMU registers.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -1014,6 +1014,7 @@ static int brcmf_chip_setup(struct brcmf
- {
- 	struct brcmf_chip *pub;
- 	struct brcmf_core_priv *cc;
-+	struct brcmf_core *pmu;
- 	u32 base;
- 	u32 val;
- 	int ret = 0;
-@@ -1030,9 +1031,10 @@ static int brcmf_chip_setup(struct brcmf
- 							 capabilities_ext));
- 
- 	/* get pmu caps & rev */
-+	pmu = brcmf_chip_get_pmu(pub); /* after reading cc_caps_ext */
- 	if (pub->cc_caps & CC_CAP_PMU) {
- 		val = chip->ops->read32(chip->ctx,
--					CORE_CC_REG(base, pmucapabilities));
-+					CORE_CC_REG(pmu->base, pmucapabilities));
- 		pub->pmurev = val & PCAP_REV_MASK;
- 		pub->pmucaps = val;
- 	}
-@@ -1131,6 +1133,23 @@ struct brcmf_core *brcmf_chip_get_chipco
- 	return &cc->pub;
- }
- 
-+struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub)
-+{
-+	struct brcmf_core *cc = brcmf_chip_get_chipcommon(pub);
-+	struct brcmf_core *pmu;
-+
-+	/* See if there is separated PMU core available */
-+	if (cc->rev >= 35 &&
-+	    pub->cc_caps_ext & BCMA_CC_CAP_EXT_AOB_PRESENT) {
-+		pmu = brcmf_chip_get_core(pub, BCMA_CORE_PMU);
-+		if (pmu)
-+			return pmu;
-+	}
-+
-+	/* Fallback to ChipCommon core for older hardware */
-+	return cc;
-+}
-+
- bool brcmf_chip_iscoreup(struct brcmf_core *pub)
- {
- 	struct brcmf_core_priv *core;
-@@ -1301,6 +1320,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
- {
- 	u32 base, addr, reg, pmu_cc3_mask = ~0;
- 	struct brcmf_chip_priv *chip;
-+	struct brcmf_core *pmu = brcmf_chip_get_pmu(pub);
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
-@@ -1320,9 +1340,9 @@ bool brcmf_chip_sr_capable(struct brcmf_
- 	case BRCM_CC_4335_CHIP_ID:
- 	case BRCM_CC_4339_CHIP_ID:
- 		/* read PMU chipcontrol register 3 */
--		addr = CORE_CC_REG(base, chipcontrol_addr);
-+		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
- 		chip->ops->write32(chip->ctx, addr, 3);
--		addr = CORE_CC_REG(base, chipcontrol_data);
-+		addr = CORE_CC_REG(pmu->base, chipcontrol_data);
- 		reg = chip->ops->read32(chip->ctx, addr);
- 		return (reg & pmu_cc3_mask) != 0;
- 	case BRCM_CC_43430_CHIP_ID:
-@@ -1330,12 +1350,12 @@ bool brcmf_chip_sr_capable(struct brcmf_
- 		reg = chip->ops->read32(chip->ctx, addr);
- 		return reg != 0;
- 	default:
--		addr = CORE_CC_REG(base, pmucapabilities_ext);
-+		addr = CORE_CC_REG(pmu->base, pmucapabilities_ext);
- 		reg = chip->ops->read32(chip->ctx, addr);
- 		if ((reg & PCAPEXT_SR_SUPPORTED_MASK) == 0)
- 			return false;
- 
--		addr = CORE_CC_REG(base, retention_ctl);
-+		addr = CORE_CC_REG(pmu->base, retention_ctl);
- 		reg = chip->ops->read32(chip->ctx, addr);
- 		return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
- 			       PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-@@ -85,6 +85,7 @@ struct brcmf_chip *brcmf_chip_attach(voi
- void brcmf_chip_detach(struct brcmf_chip *chip);
- struct brcmf_core *brcmf_chip_get_core(struct brcmf_chip *chip, u16 coreid);
- struct brcmf_core *brcmf_chip_get_chipcommon(struct brcmf_chip *chip);
-+struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub);
- bool brcmf_chip_iscoreup(struct brcmf_core *core);
- void brcmf_chip_coredisable(struct brcmf_core *core, u32 prereset, u32 reset);
- void brcmf_chip_resetcore(struct brcmf_core *core, u32 prereset, u32 reset,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3615,7 +3615,6 @@ brcmf_sdio_drivestrengthinit(struct brcm
- 	const struct sdiod_drive_str *str_tab = NULL;
- 	u32 str_mask;
- 	u32 str_shift;
--	u32 base;
- 	u32 i;
- 	u32 drivestrength_sel = 0;
- 	u32 cc_data_temp;
-@@ -3658,14 +3657,15 @@ brcmf_sdio_drivestrengthinit(struct brcm
- 	}
- 
- 	if (str_tab != NULL) {
-+		struct brcmf_core *pmu = brcmf_chip_get_pmu(ci);
-+
- 		for (i = 0; str_tab[i].strength != 0; i++) {
- 			if (drivestrength >= str_tab[i].strength) {
- 				drivestrength_sel = str_tab[i].sel;
- 				break;
- 			}
- 		}
--		base = brcmf_chip_get_chipcommon(ci)->base;
--		addr = CORE_CC_REG(base, chipcontrol_addr);
-+		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
- 		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
- 		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
- 		cc_data_temp &= ~str_mask;
-@@ -3835,8 +3835,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 		goto fail;
- 
- 	/* set PMUControl so a backplane reset does PMU state reload */
--	reg_addr = CORE_CC_REG(brcmf_chip_get_chipcommon(bus->ci)->base,
--			       pmucontrol);
-+	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
- 	reg_val = brcmf_sdiod_regrl(bus->sdiodev, reg_addr, &err);
- 	if (err)
- 		goto fail;
diff --git a/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch b/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch
deleted file mode 100644
index 35887fcb59..0000000000
--- a/package/kernel/mac80211/patches/323-0005-brcmfmac-add-support-for-14e4-4365-PCI-ID-with-BCM43.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Tue, 26 Jan 2016 17:57:05 +0100
-Subject: [PATCH] brcmfmac: add support for 14e4:4365 PCI ID with BCM4366
- chipset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On Broadcom ARM routers BCM4366 cards are available with 14e4:4365 ID.
-Unfortunately this ID was already used by Broadcom for cards with
-BCM43142, a totally different chipset requiring SoftMAC driver. To avoid
-a conflict between brcmfmac and bcma use more specific ID entry with
-subvendor and subdevice specified.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1951,6 +1951,9 @@ static const struct dev_pm_ops brcmf_pci
- 
- #define BRCMF_PCIE_DEVICE(dev_id)	{ BRCM_PCIE_VENDOR_ID_BROADCOM, dev_id,\
- 	PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
-+#define BRCMF_PCIE_DEVICE_SUB(dev_id, subvend, subdev)	{ \
-+	BRCM_PCIE_VENDOR_ID_BROADCOM, dev_id,\
-+	subvend, subdev, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0 }
- 
- static struct pci_device_id brcmf_pcie_devid_table[] = {
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
-@@ -1966,6 +1969,7 @@ static struct pci_device_id brcmf_pcie_d
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID),
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID),
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID),
-+	BRCMF_PCIE_DEVICE_SUB(0x4365, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4365),
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_DEVICE_ID),
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID),
- 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID),
diff --git a/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch b/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch
deleted file mode 100644
index 6ce60f1960..0000000000
--- a/package/kernel/mac80211/patches/324-brcmfmac-treat-NULL-character-in-NVRAM-as-separator.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Sun, 31 Jan 2016 12:14:34 +0100
-Subject: [PATCH] brcmfmac: treat NULL character in NVRAM as separator
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Platform NVRAM (stored on a flash partition) has entries separated by a
-NULL (\0) char. Our parsing code switches from VALUE state to IDLE
-whenever it meets a NULL (\0). When that happens our IDLE handler should
-simply consume it and analyze whatever is placed ahead.
-
-This fixes harmless warnings spamming debugging output:
-[  155.165624] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=20: ignoring invalid character
-[  155.180806] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=44: ignoring invalid character
-[  155.195971] brcmfmac: brcmf_nvram_handle_idle warning: ln=1:col=63: ignoring invalid character
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -93,7 +93,7 @@ static enum nvram_parser_state brcmf_nvr
- 	c = nvp->data[nvp->pos];
- 	if (c == '\n')
- 		return COMMENT;
--	if (is_whitespace(c))
-+	if (is_whitespace(c) || c == '\0')
- 		goto proceed;
- 	if (c == '#')
- 		return COMMENT;
diff --git a/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch b/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch
deleted file mode 100644
index 012dea1e3a..0000000000
--- a/package/kernel/mac80211/patches/325-brcmfmac-sdio-Increase-the-default-timeouts-a-bit.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
-Date: Mon, 25 Jan 2016 11:47:29 +0100
-Subject: [PATCH] brcmfmac: sdio: Increase the default timeouts a bit
-
-On a Radxa Rock2 board with a Ampak AP6335 (Broadcom 4339 core) it seems
-the card responds very quickly most of the time, unfortunately during
-initialisation it sometimes seems to take just a bit over 2 seconds to
-respond.
-
-This results intialization failing with message like:
-  brcmf_c_preinit_dcmds: Retreiving cur_etheraddr failed, -52
-  brcmf_bus_start: failed: -52
-  brcmf_sdio_firmware_callback: dongle is not responding
-
-Increasing the timeout to allow for a bit more headroom allows the
-card to initialize reliably.
-
-A quick search online after diagnosing/fixing this showed that Google
-has a similar patch in their ChromeOS tree, so this doesn't seem
-specific to the board I'm using.
-
-Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
-Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
-Acked-by: Arend van Spriel <arend@broadcom.com>
-Reviewed-by: Douglas Anderson <dianders@chromium.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -45,8 +45,8 @@
- #include "chip.h"
- #include "firmware.h"
- 
--#define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2000)
--#define CTL_DONE_TIMEOUT	msecs_to_jiffies(2000)
-+#define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
-+#define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
- 
- #ifdef DEBUG
- 
diff --git a/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch b/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch
deleted file mode 100644
index 71f7a40433..0000000000
--- a/package/kernel/mac80211/patches/326-ath9k-make-NF-load-complete-quickly-and-reliably.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From: Miaoqing Pan <miaoqing@codeaurora.org>
-Date: Fri, 5 Feb 2016 09:45:50 +0800
-Subject: [PATCH] ath9k: make NF load complete quickly and reliably
-
-Make NF load complete quickly and reliably. NF load execution
-is delayed by HW to end of frame if frame Rx or Tx is ongoing.
-Increasing timeout to max frame duration. If NF cal is ongoing
-before NF load, stop it before load, and restart it afterwards.
-
-Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
----
-
---- a/drivers/net/wireless/ath/ath9k/calib.c
-+++ b/drivers/net/wireless/ath/ath9k/calib.c
-@@ -241,6 +241,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
- 	u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
-+	u32 bb_agc_ctl = REG_READ(ah, AR_PHY_AGC_CONTROL);
- 
- 	if (ah->caldata)
- 		h = ah->caldata->nfCalHist;
-@@ -264,6 +265,16 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
- 	}
- 
- 	/*
-+	 * stop NF cal if ongoing to ensure NF load completes immediately
-+	 * (or after end rx/tx frame if ongoing)
-+	 */
-+	if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
-+		REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
-+		REG_RMW_BUFFER_FLUSH(ah);
-+		ENABLE_REG_RMW_BUFFER(ah);
-+	}
-+
-+	/*
- 	 * Load software filtered NF value into baseband internal minCCApwr
- 	 * variable.
- 	 */
-@@ -276,18 +287,33 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
- 
- 	/*
- 	 * Wait for load to complete, should be fast, a few 10s of us.
--	 * The max delay was changed from an original 250us to 10000us
--	 * since 250us often results in NF load timeout and causes deaf
--	 * condition during stress testing 12/12/2009
-+	 * The max delay was changed from an original 250us to 22.2 msec.
-+	 * This would increase timeout to the longest possible frame
-+	 * (11n max length 22.1 msec)
- 	 */
--	for (j = 0; j < 10000; j++) {
-+	for (j = 0; j < 22200; j++) {
- 		if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
--		     AR_PHY_AGC_CONTROL_NF) == 0)
-+			      AR_PHY_AGC_CONTROL_NF) == 0)
- 			break;
- 		udelay(10);
- 	}
- 
- 	/*
-+	 * Restart NF so it can continue.
-+	 */
-+	if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NF) {
-+		ENABLE_REG_RMW_BUFFER(ah);
-+		if (bb_agc_ctl & AR_PHY_AGC_CONTROL_ENABLE_NF)
-+			REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
-+				    AR_PHY_AGC_CONTROL_ENABLE_NF);
-+		if (bb_agc_ctl & AR_PHY_AGC_CONTROL_NO_UPDATE_NF)
-+			REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
-+				    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
-+		REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
-+		REG_RMW_BUFFER_FLUSH(ah);
-+	}
-+
-+	/*
- 	 * We timed out waiting for the noisefloor to load, probably due to an
- 	 * in-progress rx. Simply return here and allow the load plenty of time
- 	 * to complete before the next calibration interval.  We need to avoid
-@@ -296,7 +322,7 @@ int ath9k_hw_loadnf(struct ath_hw *ah, s
- 	 * here, the baseband nf cal will just be capped by our present
- 	 * noisefloor until the next calibration timer.
- 	 */
--	if (j == 10000) {
-+	if (j == 22200) {
- 		ath_dbg(common, ANY,
- 			"Timeout while waiting for nf to load: AR_PHY_AGC_CONTROL=0x%x\n",
- 			REG_READ(ah, AR_PHY_AGC_CONTROL));
diff --git a/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch b/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch
deleted file mode 100644
index f7f9df946a..0000000000
--- a/package/kernel/mac80211/patches/327-mac80211-Remove-MPP-table-entries-with-MPath.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Henning Rogge <hrogge@gmail.com>
-Date: Wed, 3 Feb 2016 13:58:36 +0100
-Subject: [PATCH] mac80211: Remove MPP table entries with MPath
-
-Make the mesh_path_del() function remove all mpp table entries
-that are proxied by the removed mesh path.
-
-Acked-by: Bob Copeland <me@bobcopeland.com>
-Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mesh_pathtbl.c
-+++ b/net/mac80211/mesh_pathtbl.c
-@@ -835,6 +835,29 @@ void mesh_path_flush_by_nexthop(struct s
- 	rcu_read_unlock();
- }
- 
-+static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
-+			       const u8 *proxy)
-+{
-+	struct mesh_table *tbl;
-+	struct mesh_path *mpp;
-+	struct mpath_node *node;
-+	int i;
-+
-+	rcu_read_lock();
-+	read_lock_bh(&pathtbl_resize_lock);
-+	tbl = resize_dereference_mpp_paths();
-+	for_each_mesh_entry(tbl, node, i) {
-+		mpp = node->mpath;
-+		if (ether_addr_equal(mpp->mpp, proxy)) {
-+			spin_lock(&tbl->hashwlock[i]);
-+			__mesh_path_del(tbl, node);
-+			spin_unlock(&tbl->hashwlock[i]);
-+		}
-+	}
-+	read_unlock_bh(&pathtbl_resize_lock);
-+	rcu_read_unlock();
-+}
-+
- static void table_flush_by_iface(struct mesh_table *tbl,
- 				 struct ieee80211_sub_if_data *sdata)
- {
-@@ -892,6 +915,9 @@ int mesh_path_del(struct ieee80211_sub_i
- 	int hash_idx;
- 	int err = 0;
- 
-+	/* flush relevant mpp entries first */
-+	mpp_flush_by_proxy(sdata, addr);
-+
- 	read_lock_bh(&pathtbl_resize_lock);
- 	tbl = resize_dereference_mesh_paths();
- 	hash_idx = mesh_table_hash(addr, sdata, tbl);
diff --git a/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch b/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch
deleted file mode 100644
index 740993c9e0..0000000000
--- a/package/kernel/mac80211/patches/328-mac80211-let-unused-MPP-table-entries-timeout.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From: Henning Rogge <hrogge@gmail.com>
-Date: Wed, 3 Feb 2016 13:58:37 +0100
-Subject: [PATCH] mac80211: let unused MPP table entries timeout
-
-Remember the last time when a mpp table entry is used for
-rx or tx and remove them after MESH_PATH_EXPIRE time.
-
-Acked-by: Bob Copeland <me@bobcopeland.com>
-Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mesh_pathtbl.c
-+++ b/net/mac80211/mesh_pathtbl.c
-@@ -942,6 +942,46 @@ enddel:
- }
- 
- /**
-+ * mpp_path_del - delete a mesh proxy path from the table
-+ *
-+ * @addr: addr address (ETH_ALEN length)
-+ * @sdata: local subif
-+ *
-+ * Returns: 0 if successful
-+ */
-+static int mpp_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-+{
-+	struct mesh_table *tbl;
-+	struct mesh_path *mpath;
-+	struct mpath_node *node;
-+	struct hlist_head *bucket;
-+	int hash_idx;
-+	int err = 0;
-+
-+	read_lock_bh(&pathtbl_resize_lock);
-+	tbl = resize_dereference_mpp_paths();
-+	hash_idx = mesh_table_hash(addr, sdata, tbl);
-+	bucket = &tbl->hash_buckets[hash_idx];
-+
-+	spin_lock(&tbl->hashwlock[hash_idx]);
-+	hlist_for_each_entry(node, bucket, list) {
-+		mpath = node->mpath;
-+		if (mpath->sdata == sdata &&
-+		    ether_addr_equal(addr, mpath->dst)) {
-+			__mesh_path_del(tbl, node);
-+			goto enddel;
-+		}
-+	}
-+
-+	err = -ENXIO;
-+enddel:
-+	mesh_paths_generation++;
-+	spin_unlock(&tbl->hashwlock[hash_idx]);
-+	read_unlock_bh(&pathtbl_resize_lock);
-+	return err;
-+}
-+
-+/**
-  * mesh_path_tx_pending - sends pending frames in a mesh path queue
-  *
-  * @mpath: mesh path to activate
-@@ -1157,6 +1197,17 @@ void mesh_path_expire(struct ieee80211_s
- 		     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
- 			mesh_path_del(mpath->sdata, mpath->dst);
- 	}
-+
-+	tbl = rcu_dereference(mpp_paths);
-+	for_each_mesh_entry(tbl, node, i) {
-+		if (node->mpath->sdata != sdata)
-+			continue;
-+		mpath = node->mpath;
-+		if ((!(mpath->flags & MESH_PATH_FIXED)) &&
-+		    time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
-+			mpp_path_del(mpath->sdata, mpath->dst);
-+	}
-+
- 	rcu_read_unlock();
- }
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2291,6 +2291,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 			spin_lock_bh(&mppath->state_lock);
- 			if (!ether_addr_equal(mppath->mpp, mpp_addr))
- 				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
-+			mppath->exp_time = jiffies;
- 			spin_unlock_bh(&mppath->state_lock);
- 		}
- 		rcu_read_unlock();
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -2171,8 +2171,11 @@ static struct sk_buff *ieee80211_build_h
- 					mpp_lookup = true;
- 			}
- 
--			if (mpp_lookup)
-+			if (mpp_lookup) {
- 				mppath = mpp_path_lookup(sdata, skb->data);
-+				if (mppath)
-+					mppath->exp_time = jiffies;
-+			}
- 
- 			if (mppath && mpath)
- 				mesh_path_del(mpath->sdata, mpath->dst);
diff --git a/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch b/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch
deleted file mode 100644
index 0c36b1d568..0000000000
--- a/package/kernel/mac80211/patches/329-mac80211-Unify-mesh-and-mpp-path-removal-function.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From: Henning Rogge <hrogge@gmail.com>
-Date: Wed, 3 Feb 2016 13:58:38 +0100
-Subject: [PATCH] mac80211: Unify mesh and mpp path removal function
-
-mpp_path_del() and mesh_path_del() are mostly the same function.
-Move common code into a new static function.
-
-Acked-by: Bob Copeland <me@bobcopeland.com>
-Signed-off-by: Henning Rogge <henning.rogge@fkie.fraunhofer.de>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mesh_pathtbl.c
-+++ b/net/mac80211/mesh_pathtbl.c
-@@ -55,16 +55,21 @@ int mpp_paths_generation;
- static DEFINE_RWLOCK(pathtbl_resize_lock);
- 
- 
-+static inline struct mesh_table *resize_dereference_paths(
-+	struct mesh_table __rcu *table)
-+{
-+	return rcu_dereference_protected(table,
-+					lockdep_is_held(&pathtbl_resize_lock));
-+}
-+
- static inline struct mesh_table *resize_dereference_mesh_paths(void)
- {
--	return rcu_dereference_protected(mesh_paths,
--		lockdep_is_held(&pathtbl_resize_lock));
-+	return resize_dereference_paths(mesh_paths);
- }
- 
- static inline struct mesh_table *resize_dereference_mpp_paths(void)
- {
--	return rcu_dereference_protected(mpp_paths,
--		lockdep_is_held(&pathtbl_resize_lock));
-+	return resize_dereference_paths(mpp_paths);
- }
- 
- /*
-@@ -899,14 +904,17 @@ void mesh_path_flush_by_iface(struct iee
- }
- 
- /**
-- * mesh_path_del - delete a mesh path from the table
-+ * table_path_del - delete a path from the mesh or mpp table
-  *
-- * @addr: dst address (ETH_ALEN length)
-+ * @tbl: mesh or mpp path table
-  * @sdata: local subif
-+ * @addr: dst address (ETH_ALEN length)
-  *
-  * Returns: 0 if successful
-  */
--int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-+static int table_path_del(struct mesh_table __rcu *rcu_tbl,
-+			  struct ieee80211_sub_if_data *sdata,
-+			  const u8 *addr)
- {
- 	struct mesh_table *tbl;
- 	struct mesh_path *mpath;
-@@ -915,11 +923,7 @@ int mesh_path_del(struct ieee80211_sub_i
- 	int hash_idx;
- 	int err = 0;
- 
--	/* flush relevant mpp entries first */
--	mpp_flush_by_proxy(sdata, addr);
--
--	read_lock_bh(&pathtbl_resize_lock);
--	tbl = resize_dereference_mesh_paths();
-+	tbl = resize_dereference_paths(rcu_tbl);
- 	hash_idx = mesh_table_hash(addr, sdata, tbl);
- 	bucket = &tbl->hash_buckets[hash_idx];
- 
-@@ -935,9 +939,30 @@ int mesh_path_del(struct ieee80211_sub_i
- 
- 	err = -ENXIO;
- enddel:
--	mesh_paths_generation++;
- 	spin_unlock(&tbl->hashwlock[hash_idx]);
-+	return err;
-+}
-+
-+/**
-+ * mesh_path_del - delete a mesh path from the table
-+ *
-+ * @addr: dst address (ETH_ALEN length)
-+ * @sdata: local subif
-+ *
-+ * Returns: 0 if successful
-+ */
-+int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
-+{
-+	int err = 0;
-+
-+	/* flush relevant mpp entries first */
-+	mpp_flush_by_proxy(sdata, addr);
-+
-+	read_lock_bh(&pathtbl_resize_lock);
-+	err = table_path_del(mesh_paths, sdata, addr);
-+	mesh_paths_generation++;
- 	read_unlock_bh(&pathtbl_resize_lock);
-+
- 	return err;
- }
- 
-@@ -951,33 +976,13 @@ enddel:
-  */
- static int mpp_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
- {
--	struct mesh_table *tbl;
--	struct mesh_path *mpath;
--	struct mpath_node *node;
--	struct hlist_head *bucket;
--	int hash_idx;
- 	int err = 0;
- 
- 	read_lock_bh(&pathtbl_resize_lock);
--	tbl = resize_dereference_mpp_paths();
--	hash_idx = mesh_table_hash(addr, sdata, tbl);
--	bucket = &tbl->hash_buckets[hash_idx];
--
--	spin_lock(&tbl->hashwlock[hash_idx]);
--	hlist_for_each_entry(node, bucket, list) {
--		mpath = node->mpath;
--		if (mpath->sdata == sdata &&
--		    ether_addr_equal(addr, mpath->dst)) {
--			__mesh_path_del(tbl, node);
--			goto enddel;
--		}
--	}
--
--	err = -ENXIO;
--enddel:
--	mesh_paths_generation++;
--	spin_unlock(&tbl->hashwlock[hash_idx]);
-+	err = table_path_del(mpp_paths, sdata, addr);
-+	mpp_paths_generation++;
- 	read_unlock_bh(&pathtbl_resize_lock);
-+
- 	return err;
- }
- 
diff --git a/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch b/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch
deleted file mode 100644
index 4dc6d663ed..0000000000
--- a/package/kernel/mac80211/patches/330-mac80211-minstrel-Change-expected-throughput-unit-ba.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Sven Eckelmann <sven.eckelmann@open-mesh.com>
-Date: Tue, 2 Feb 2016 08:12:26 +0100
-Subject: [PATCH] mac80211: minstrel: Change expected throughput unit back to
- Kbps
-
-The change from cur_tp to the function
-minstrel_get_tp_avg/minstrel_ht_get_tp_avg changed the unit used for the
-current throughput. For example in minstrel_ht the correct
-conversion between them would be:
-
-    mrs->cur_tp / 10 == minstrel_ht_get_tp_avg(..).
-
-This factor 10 must also be included in the calculation of
-minstrel_get_expected_throughput and minstrel_ht_get_expected_throughput to
-return values with the unit [Kbps] instead of [10Kbps]. Otherwise routing
-algorithms like B.A.T.M.A.N. V will make incorrect decision based on these
-values. Its kernel based implementation expects expected_throughput always
-to have the unit [Kbps] and not sometimes [10Kbps] and sometimes [Kbps].
-
-The same requirement has iw or olsrdv2's nl80211 based statistics module
-which retrieve the same data via NL80211_STA_INFO_TX_BITRATE.
-
-Cc: stable@vger.kernel.org
-Fixes: 6a27b2c40b48 ("mac80211: restructure per-rate throughput calculation into function")
-Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/rc80211_minstrel.c
-+++ b/net/mac80211/rc80211_minstrel.c
-@@ -711,7 +711,7 @@ static u32 minstrel_get_expected_through
- 	 * computing cur_tp
- 	 */
- 	tmp_mrs = &mi->r[idx].stats;
--	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma);
-+	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma) * 10;
- 	tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024;
- 
- 	return tmp_cur_tp;
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1335,7 +1335,8 @@ static u32 minstrel_ht_get_expected_thro
- 	prob = mi->groups[i].rates[j].prob_ewma;
- 
- 	/* convert tp_avg from pkt per second in kbps */
--	tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * AVG_PKT_SIZE * 8 / 1024;
-+	tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * 10;
-+	tp_avg = tp_avg * AVG_PKT_SIZE * 8 / 1024;
- 
- 	return tp_avg;
- }
diff --git a/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch b/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch
deleted file mode 100644
index 1fd016f7f6..0000000000
--- a/package/kernel/mac80211/patches/331-brcmfmac-Increase-nr-of-supported-flowrings.patch
+++ /dev/null
@@ -1,307 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Sun, 7 Feb 2016 18:08:24 +0100
-Subject: [PATCH] brcmfmac: Increase nr of supported flowrings.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-New generation devices have firmware which has more than 256 flowrings.
-E.g. following debugging message comes from 14e4:4365 BCM4366:
-[  194.606245] brcmfmac: brcmf_pcie_init_ringbuffers Nr of flowrings is 264
-
-At various code places (related to flowrings) we were using u8 which
-could lead to storing wrong number or infinite loops when indexing with
-this type. This issue was quite easy to spot in brcmf_flowring_detach
-where it led to infinite loop e.g. on failed initialization.
-
-This patch switches code to proper types and increases the maximum
-number of supported flowrings to 512.
-
-Originally this change was sent in September 2015, but back it was
-causing a regression on BCM43602 resulting in:
-Unable to handle kernel NULL pointer dereference at virtual address ...
-
-The reason for this regression was missing update (s/u8/u16) of struct
-brcmf_flowring_ring. This problem was handled in 9f64df9 ("brcmfmac: Fix
-bug in flowring management."). Starting with that it's safe to apply
-this original patch as it doesn't cause a regression anymore.
-
-This patch fixes an infinite loop on BCM4366 which is supported since
-4.4 so it makes sense to apply it to stable 4.4+.
-
-Cc: <stable@vger.kernel.org> # 4.4+
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -32,7 +32,7 @@
- #define BRCMF_FLOWRING_LOW		(BRCMF_FLOWRING_HIGH - 256)
- #define BRCMF_FLOWRING_INVALID_IFIDX	0xff
- 
--#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
-+#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16)
- #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
- 
- static const u8 brcmf_flowring_prio2fifo[] = {
-@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
- 			  u8 prio, u8 ifidx)
- {
- 	struct brcmf_flowring_hash *hash;
--	u8 hash_idx;
-+	u16 hash_idx;
- 	u32 i;
- 	bool found;
- 	bool sta;
-@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
- 	}
- 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
- 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
-+	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
- 	found = false;
- 	hash = flow->hash;
- 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
-@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_f
- 			break;
- 		}
- 		hash_idx++;
-+		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
- 	}
- 	if (found)
- 		return hash[hash_idx].flowid;
-@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_f
- {
- 	struct brcmf_flowring_ring *ring;
- 	struct brcmf_flowring_hash *hash;
--	u8 hash_idx;
-+	u16 hash_idx;
- 	u32 i;
- 	bool found;
- 	u8 fifo;
-@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_f
- 	}
- 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
- 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
-+	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
- 	found = false;
- 	hash = flow->hash;
- 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
-@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_f
- 			break;
- 		}
- 		hash_idx++;
-+		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
- 	}
- 	if (found) {
- 		for (i = 0; i < flow->nrofrings; i++) {
-@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_f
- }
- 
- 
--u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
-+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid)
- {
- 	struct brcmf_flowring_ring *ring;
- 
-@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowr
- }
- 
- 
--static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
-+static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
- 				 bool blocked)
- {
- 	struct brcmf_flowring_ring *ring;
-@@ -228,10 +232,10 @@ static void brcmf_flowring_block(struct
- }
- 
- 
--void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
-+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
- {
- 	struct brcmf_flowring_ring *ring;
--	u8 hash_idx;
-+	u16 hash_idx;
- 	struct sk_buff *skb;
- 
- 	ring = flow->rings[flowid];
-@@ -253,7 +257,7 @@ void brcmf_flowring_delete(struct brcmf_
- }
- 
- 
--u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
-+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
- 			   struct sk_buff *skb)
- {
- 	struct brcmf_flowring_ring *ring;
-@@ -279,7 +283,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_
- }
- 
- 
--struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
-+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid)
- {
- 	struct brcmf_flowring_ring *ring;
- 	struct sk_buff *skb;
-@@ -300,7 +304,7 @@ struct sk_buff *brcmf_flowring_dequeue(s
- }
- 
- 
--void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
-+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
- 			     struct sk_buff *skb)
- {
- 	struct brcmf_flowring_ring *ring;
-@@ -311,7 +315,7 @@ void brcmf_flowring_reinsert(struct brcm
- }
- 
- 
--u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
-+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid)
- {
- 	struct brcmf_flowring_ring *ring;
- 
-@@ -326,7 +330,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flo
- }
- 
- 
--void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
-+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid)
- {
- 	struct brcmf_flowring_ring *ring;
- 
-@@ -340,10 +344,10 @@ void brcmf_flowring_open(struct brcmf_fl
- }
- 
- 
--u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid)
-+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid)
- {
- 	struct brcmf_flowring_ring *ring;
--	u8 hash_idx;
-+	u16 hash_idx;
- 
- 	ring = flow->rings[flowid];
- 	hash_idx = ring->hash_id;
-@@ -384,7 +388,7 @@ void brcmf_flowring_detach(struct brcmf_
- 	struct brcmf_pub *drvr = bus_if->drvr;
- 	struct brcmf_flowring_tdls_entry *search;
- 	struct brcmf_flowring_tdls_entry *remove;
--	u8 flowid;
-+	u16 flowid;
- 
- 	for (flowid = 0; flowid < flow->nrofrings; flowid++) {
- 		if (flow->rings[flowid])
-@@ -408,7 +412,7 @@ void brcmf_flowring_configure_addr_mode(
- 	struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
- 	struct brcmf_pub *drvr = bus_if->drvr;
- 	u32 i;
--	u8 flowid;
-+	u16 flowid;
- 
- 	if (flow->addr_mode[ifidx] != addr_mode) {
- 		for (i = 0; i < ARRAY_SIZE(flow->hash); i++) {
-@@ -434,7 +438,7 @@ void brcmf_flowring_delete_peer(struct b
- 	struct brcmf_flowring_tdls_entry *prev;
- 	struct brcmf_flowring_tdls_entry *search;
- 	u32 i;
--	u8 flowid;
-+	u16 flowid;
- 	bool sta;
- 
- 	sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
-@@ -16,7 +16,7 @@
- #define BRCMFMAC_FLOWRING_H
- 
- 
--#define BRCMF_FLOWRING_HASHSIZE		256
-+#define BRCMF_FLOWRING_HASHSIZE		512		/* has to be 2^x */
- #define BRCMF_FLOWRING_INVALID_ID	0xFFFFFFFF
- 
- 
-@@ -24,7 +24,7 @@ struct brcmf_flowring_hash {
- 	u8 mac[ETH_ALEN];
- 	u8 fifo;
- 	u8 ifidx;
--	u8 flowid;
-+	u16 flowid;
- };
- 
- enum ring_status {
-@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_f
- 			  u8 prio, u8 ifidx);
- u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
- 			  u8 prio, u8 ifidx);
--void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid);
--void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid);
--u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid);
--u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
-+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid);
-+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid);
-+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid);
-+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
- 			   struct sk_buff *skb);
--struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid);
--void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
-+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid);
-+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
- 			     struct sk_buff *skb);
--u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid);
--u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid);
-+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid);
-+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid);
- struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings);
- void brcmf_flowring_detach(struct brcmf_flowring *flow);
- void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -677,7 +677,7 @@ static u32 brcmf_msgbuf_flowring_create(
- }
- 
- 
--static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
-+static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
- {
- 	struct brcmf_flowring *flow = msgbuf->flow;
- 	struct brcmf_commonring *commonring;
-@@ -1310,7 +1310,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct
- }
- 
- 
--void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
-+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
- {
- 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
- 	struct msgbuf_tx_flowring_delete_req *delete;
-@@ -1415,6 +1415,13 @@ int brcmf_proto_msgbuf_attach(struct brc
- 	u32 count;
- 
- 	if_msgbuf = drvr->bus_if->msgbuf;
-+
-+	if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
-+		brcmf_err("driver not configured for this many flowrings %d\n",
-+			  if_msgbuf->nrof_flowrings);
-+		if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
-+	}
-+
- 	msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
- 	if (!msgbuf)
- 		goto fail;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-@@ -33,7 +33,7 @@
- 
- 
- int brcmf_proto_msgbuf_rx_trigger(struct device *dev);
--void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid);
-+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid);
- int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr);
- void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr);
- #else
diff --git a/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch b/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch
deleted file mode 100644
index e414f23784..0000000000
--- a/package/kernel/mac80211/patches/332-cfg80211-fix-faulty-variable-initialization-in-ieee8.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Mon, 8 Feb 2016 14:24:36 +0100
-Subject: [PATCH] cfg80211: fix faulty variable initialization in
- ieee80211_amsdu_to_8023s
-
-reuse_skb is set to true if the code decides to use the last segment.
-Fixes a memory leak
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -676,7 +676,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
- 	u8 *payload;
- 	int offset = 0, remaining, err;
- 	struct ethhdr eth;
--	bool reuse_skb = true;
-+	bool reuse_skb = false;
- 	bool last = false;
- 
- 	if (has_80211_header) {
diff --git a/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch b/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch
deleted file mode 100644
index 6e2d0cf5b0..0000000000
--- a/package/kernel/mac80211/patches/333-cfg80211-reuse-existing-page-fragments-in-A-MSDU-rx.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Mon, 8 Feb 2016 14:33:19 +0100
-Subject: [PATCH] cfg80211: reuse existing page fragments in A-MSDU rx
-
-This massively reduces data copying and thus improves rx performance
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -644,23 +644,93 @@ int ieee80211_data_from_8023(struct sk_b
- }
- EXPORT_SYMBOL(ieee80211_data_from_8023);
- 
-+static void
-+__frame_add_frag(struct sk_buff *skb, struct page *page,
-+		 void *ptr, int len, int size)
-+{
-+	struct skb_shared_info *sh = skb_shinfo(skb);
-+	int page_offset;
-+
-+	atomic_inc(&page->_count);
-+	page_offset = ptr - page_address(page);
-+	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
-+}
-+
-+static void
-+__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
-+			    int offset, int len)
-+{
-+	struct skb_shared_info *sh = skb_shinfo(skb);
-+	const skb_frag_t *frag = &sh->frags[-1];
-+	struct page *frag_page;
-+	void *frag_ptr;
-+	int frag_len, frag_size;
-+	int head_size = skb->len - skb->data_len;
-+	int cur_len;
-+
-+	frag_page = virt_to_head_page(skb->head);
-+	frag_ptr = skb->data;
-+	frag_size = head_size;
-+
-+	while (offset >= frag_size) {
-+		offset -= frag_size;
-+		frag++;
-+		frag_page = skb_frag_page(frag);
-+		frag_ptr = skb_frag_address(frag);
-+		frag_size = skb_frag_size(frag);
-+	}
-+
-+	frag_ptr += offset;
-+	frag_len = frag_size - offset;
-+
-+	cur_len = min(len, frag_len);
-+
-+	__frame_add_frag(frame, frag_page, frag_ptr, cur_len, frag_size);
-+	len -= cur_len;
-+
-+	while (len > 0) {
-+		frag++;
-+		frag_len = skb_frag_size(frag);
-+		cur_len = min(len, frag_len);
-+		__frame_add_frag(frame, skb_frag_page(frag),
-+				 skb_frag_address(frag), cur_len, frag_len);
-+		len -= cur_len;
-+	}
-+}
-+
- static struct sk_buff *
- __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
--		       int offset, int len)
-+		       int offset, int len, bool reuse_frag)
- {
- 	struct sk_buff *frame;
-+	int cur_len = len;
- 
- 	if (skb->len - offset < len)
- 		return NULL;
- 
- 	/*
-+	 * When reusing framents, copy some data to the head to simplify
-+	 * ethernet header handling and speed up protocol header processing
-+	 * in the stack later.
-+	 */
-+	if (reuse_frag)
-+		cur_len = min_t(int, len, 32);
-+
-+	/*
- 	 * Allocate and reserve two bytes more for payload
- 	 * alignment since sizeof(struct ethhdr) is 14.
- 	 */
--	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + len);
-+	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
- 
- 	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
--	skb_copy_bits(skb, offset, skb_put(frame, len), len);
-+	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
-+
-+	len -= cur_len;
-+	if (!len)
-+		return frame;
-+
-+	offset += cur_len;
-+	__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
- 
- 	return frame;
- }
-@@ -676,6 +746,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
- 	u8 *payload;
- 	int offset = 0, remaining, err;
- 	struct ethhdr eth;
-+	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
- 	bool reuse_skb = false;
- 	bool last = false;
- 
-@@ -703,12 +774,13 @@ void ieee80211_amsdu_to_8023s(struct sk_
- 		offset += sizeof(struct ethhdr);
- 		/* reuse skb for the last subframe */
- 		last = remaining <= subframe_len + padding;
--		if (!skb_is_nonlinear(skb) && last) {
-+		if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
- 			skb_pull(skb, offset);
- 			frame = skb;
- 			reuse_skb = true;
- 		} else {
--			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len);
-+			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
-+						       reuse_frag);
- 			if (!frame)
- 				goto purge;
- 
diff --git a/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch b/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
deleted file mode 100644
index f8f4f0999d..0000000000
--- a/package/kernel/mac80211/patches/334-mac80211-fix-wiphy-supported_band-access.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
-Date: Wed, 10 Feb 2016 16:08:17 +0100
-Subject: [PATCH] mac80211: fix wiphy supported_band access
-
-Fix wiphy supported_band access in tx radiotap parsing. In particular,
-info->band is always set to 0 (IEEE80211_BAND_2GHZ) since it has not
-assigned yet. This cause a kernel crash on 5GHz only devices.
-Move ieee80211_parse_tx_radiotap() after info->band assignment
-
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1890,10 +1890,6 @@ netdev_tx_t ieee80211_monitor_start_xmit
- 	info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
- 		      IEEE80211_TX_CTL_INJECTED;
- 
--	/* process and remove the injection radiotap header */
--	if (!ieee80211_parse_tx_radiotap(local, skb))
--		goto fail;
--
- 	rcu_read_lock();
- 
- 	/*
-@@ -1955,6 +1951,10 @@ netdev_tx_t ieee80211_monitor_start_xmit
- 		goto fail_rcu;
- 
- 	info->band = chandef->chan->band;
-+	/* process and remove the injection radiotap header */
-+	if (!ieee80211_parse_tx_radiotap(local, skb))
-+		goto fail_rcu;
-+
- 	ieee80211_xmit(sdata, NULL, skb);
- 	rcu_read_unlock();
- 
diff --git a/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch b/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch
deleted file mode 100644
index acaacf7cac..0000000000
--- a/package/kernel/mac80211/patches/335-mac80211-minstrel_ht-set-A-MSDU-tx-limits-based-on-s.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 18 Feb 2016 19:30:05 +0100
-Subject: [PATCH] mac80211: minstrel_ht: set A-MSDU tx limits based on selected
- max_prob_rate
-
-Prevents excessive A-MSDU aggregation at low data rates or bad
-conditions.
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -883,6 +883,39 @@ minstrel_ht_set_rate(struct minstrel_pri
- 	ratetbl->rate[offset].flags = flags;
- }
- 
-+static int
-+minstrel_ht_get_max_amsdu_len(struct minstrel_ht_sta *mi)
-+{
-+	int group = mi->max_prob_rate / MCS_GROUP_RATES;
-+	const struct mcs_group *g = &minstrel_mcs_groups[group];
-+	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
-+
-+	/* Disable A-MSDU if max_prob_rate is bad */
-+	if (mi->groups[group].rates[rate].prob_ewma < MINSTREL_FRAC(50, 100))
-+		return 1;
-+
-+	/* If the rate is slower than single-stream MCS1, make A-MSDU limit small */
-+	if (g->duration[rate] > MCS_DURATION(1, 0, 52))
-+		return 500;
-+
-+	/*
-+	 * If the rate is slower than single-stream MCS4, limit A-MSDU to usual
-+	 * data packet size
-+	 */
-+	if (g->duration[rate] > MCS_DURATION(1, 0, 104))
-+		return 1500;
-+
-+	/*
-+	 * If the rate is slower than single-stream MCS7, limit A-MSDU to twice
-+	 * the usual data packet size
-+	 */
-+	if (g->duration[rate] > MCS_DURATION(1, 0, 260))
-+		return 3000;
-+
-+	/* unlimited */
-+	return 0;
-+}
-+
- static void
- minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
-@@ -907,6 +940,7 @@ minstrel_ht_update_rates(struct minstrel
- 		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
- 	}
- 
-+	mi->sta->max_rc_amsdu_len = minstrel_ht_get_max_amsdu_len(mi);
- 	rates->rate[i].idx = -1;
- 	rate_control_set_rates(mp->hw, mi->sta, rates);
- }
diff --git a/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch b/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch
deleted file mode 100644
index 32a2ad6f0b..0000000000
--- a/package/kernel/mac80211/patches/336-mac80211-minstrel_ht-set-default-tx-aggregation-time.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 18 Feb 2016 19:45:33 +0100
-Subject: [PATCH] mac80211: minstrel_ht: set default tx aggregation timeout to
- 0
-
-The value 5000 was put here with the addition of the timeout field to
-ieee80211_start_tx_ba_session. It was originally added in mac80211 to
-save resources for drivers like iwlwifi, which only supports a limited
-number of concurrent aggregation sessions.
-
-Since iwlwifi does not use minstrel_ht and other drivers don't need
-this, 0 is a better default - especially since there have been
-recent reports of aggregation setup related issues reproduced with
-ath9k. This should improve stability without causing any adverse
-effects.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -692,7 +692,7 @@ minstrel_aggr_check(struct ieee80211_sta
- 	if (likely(sta->ampdu_mlme.tid_tx[tid]))
- 		return;
- 
--	ieee80211_start_tx_ba_session(pubsta, tid, 5000);
-+	ieee80211_start_tx_ba_session(pubsta, tid, 0);
- }
- 
- static void
diff --git a/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch b/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch
deleted file mode 100644
index 229351ba56..0000000000
--- a/package/kernel/mac80211/patches/337-mac80211-minstrel_ht-fix-a-logic-error-in-RTS-CTS-ha.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Wed, 24 Feb 2016 12:03:13 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix a logic error in RTS/CTS handling
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RTS/CTS needs to be enabled if the rate is a fallback rate *or* if it's
-a dual-stream rate and the sta is in dynamic SMPS mode.
-
-Fixes: a3ebb4e1b763 ("mac80211: minstrel_ht: handle peers in dynamic SMPS")
-Reported-by: Matías Richart <mrichart@fing.edu.uy>
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -872,7 +872,7 @@ minstrel_ht_set_rate(struct minstrel_pri
- 	 *  - if station is in dynamic SMPS (and streams > 1)
- 	 *  - for fallback rates, to increase chances of getting through
- 	 */
--	if (offset > 0 &&
-+	if (offset > 0 ||
- 	    (mi->sta->smps_mode == IEEE80211_SMPS_DYNAMIC &&
- 	     group->streams > 1)) {
- 		ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
diff --git a/package/kernel/mac80211/patches/338-mac80211-Fix-Public-Action-frame-RX-in-AP-mode.patch b/package/kernel/mac80211/patches/338-mac80211-Fix-Public-Action-frame-RX-in-AP-mode.patch
deleted file mode 100644
index 56cd94aa15..0000000000
--- a/package/kernel/mac80211/patches/338-mac80211-Fix-Public-Action-frame-RX-in-AP-mode.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Jouni Malinen <jouni@qca.qualcomm.com>
-Date: Tue, 1 Mar 2016 00:29:00 +0200
-Subject: [PATCH] mac80211: Fix Public Action frame RX in AP mode
-
-Public Action frames use special rules for how the BSSID field (Address
-3) is set. A wildcard BSSID is used in cases where the transmitter and
-recipient are not members of the same BSS. As such, we need to accept
-Public Action frames with wildcard BSSID.
-
-Commit db8e17324553 ("mac80211: ignore frames between TDLS peers when
-operating as AP") added a rule that drops Action frames to TDLS-peers
-based on an Action frame having different DA (Address 1) and BSSID
-(Address 3) values. This is not correct since it misses the possibility
-of BSSID being a wildcard BSSID in which case the Address 1 would not
-necessarily match.
-
-Fix this by allowing mac80211 to accept wildcard BSSID in an Action
-frame when in AP mode.
-
-Fixes: db8e17324553 ("mac80211: ignore frames between TDLS peers when operating as AP")
-Cc: stable@vger.kernel.org
-Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3374,6 +3374,7 @@ static bool ieee80211_accept_frame(struc
- 				return false;
- 			/* ignore action frames to TDLS-peers */
- 			if (ieee80211_is_action(hdr->frame_control) &&
-+			    !is_broadcast_ether_addr(bssid) &&
- 			    !ether_addr_equal(bssid, hdr->addr1))
- 				return false;
- 		}
diff --git a/package/kernel/mac80211/patches/339-cfg80211-add-radiotap-VHT-info-to-rtap_namespace_siz.patch b/package/kernel/mac80211/patches/339-cfg80211-add-radiotap-VHT-info-to-rtap_namespace_siz.patch
deleted file mode 100644
index 15d6cd03ea..0000000000
--- a/package/kernel/mac80211/patches/339-cfg80211-add-radiotap-VHT-info-to-rtap_namespace_siz.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
-Date: Fri, 19 Feb 2016 11:43:04 +0100
-Subject: [PATCH] cfg80211: add radiotap VHT info to rtap_namespace_sizes
-
-Add IEEE80211_RADIOTAP_VHT entry to rtap_namespace_sizes array in order to
-define alignment and size of VHT info in tx radiotap
-
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/radiotap.c
-+++ b/net/wireless/radiotap.c
-@@ -43,6 +43,7 @@ static const struct radiotap_align_size
- 	[IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
- 	[IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
- 	[IEEE80211_RADIOTAP_AMPDU_STATUS] = { .align = 4, .size = 8, },
-+	[IEEE80211_RADIOTAP_VHT] = { .align = 2, .size = 12, },
- 	/*
- 	 * add more here as they are defined in radiotap.h
- 	 */
diff --git a/package/kernel/mac80211/patches/340-mac80211-fix-parsing-of-40Mhz-in-injected-radiotap-h.patch b/package/kernel/mac80211/patches/340-mac80211-fix-parsing-of-40Mhz-in-injected-radiotap-h.patch
deleted file mode 100644
index de1b38625c..0000000000
--- a/package/kernel/mac80211/patches/340-mac80211-fix-parsing-of-40Mhz-in-injected-radiotap-h.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Sven Eckelmann <sven@narfation.org>
-Date: Wed, 24 Feb 2016 16:25:49 +0100
-Subject: [PATCH] mac80211: fix parsing of 40Mhz in injected radiotap
- header
-
-The MCS bandwidth part of the radiotap header is 2 bits wide. The full 2
-bit have to compared against IEEE80211_RADIOTAP_MCS_BW_40 and not only if
-the first bit is set. Otherwise IEEE80211_RADIOTAP_MCS_BW_40 can be
-confused with IEEE80211_RADIOTAP_MCS_BW_20U.
-
-Fixes: 5ec3aed9ba4c ("mac80211: Parse legacy and HT rate in injected frames")
-Signed-off-by: Sven Eckelmann <sven@narfation.org>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1689,7 +1689,7 @@ static bool ieee80211_parse_tx_radiotap(
- 	bool rate_found = false;
- 	u8 rate_retries = 0;
- 	u16 rate_flags = 0;
--	u8 mcs_known, mcs_flags;
-+	u8 mcs_known, mcs_flags, mcs_bw;
- 	int i;
- 
- 	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-@@ -1765,8 +1765,9 @@ static bool ieee80211_parse_tx_radiotap(
- 			    mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
- 				rate_flags |= IEEE80211_TX_RC_SHORT_GI;
- 
-+			mcs_bw = mcs_flags & IEEE80211_RADIOTAP_MCS_BW_MASK;
- 			if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
--			    mcs_flags & IEEE80211_RADIOTAP_MCS_BW_40)
-+			    mcs_bw == IEEE80211_RADIOTAP_MCS_BW_40)
- 				rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
- 			break;
- 
diff --git a/package/kernel/mac80211/patches/341-mac80211-parse-VHT-info-in-injected-frames.patch b/package/kernel/mac80211/patches/341-mac80211-parse-VHT-info-in-injected-frames.patch
deleted file mode 100644
index ac1f2517f2..0000000000
--- a/package/kernel/mac80211/patches/341-mac80211-parse-VHT-info-in-injected-frames.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
-Date: Tue, 23 Feb 2016 15:43:35 +0100
-Subject: [PATCH] mac80211: parse VHT info in injected frames
-
-Add VHT radiotap parsing support to ieee80211_parse_tx_radiotap().
-That capability has been tested using a d-link dir-860l rev b1 running
-OpenWrt trunk and mt76 driver
-
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1690,6 +1690,8 @@ static bool ieee80211_parse_tx_radiotap(
- 	u8 rate_retries = 0;
- 	u16 rate_flags = 0;
- 	u8 mcs_known, mcs_flags, mcs_bw;
-+	u16 vht_known;
-+	u8 vht_mcs = 0, vht_nss = 0;
- 	int i;
- 
- 	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-@@ -1771,6 +1773,32 @@ static bool ieee80211_parse_tx_radiotap(
- 				rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
- 			break;
- 
-+		case IEEE80211_RADIOTAP_VHT:
-+			vht_known = get_unaligned_le16(iterator.this_arg);
-+			rate_found = true;
-+
-+			rate_flags = IEEE80211_TX_RC_VHT_MCS;
-+			if ((vht_known & IEEE80211_RADIOTAP_VHT_KNOWN_GI) &&
-+			    (iterator.this_arg[2] &
-+			     IEEE80211_RADIOTAP_VHT_FLAG_SGI))
-+				rate_flags |= IEEE80211_TX_RC_SHORT_GI;
-+			if (vht_known &
-+			    IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH) {
-+				if (iterator.this_arg[3] == 1)
-+					rate_flags |=
-+						IEEE80211_TX_RC_40_MHZ_WIDTH;
-+				else if (iterator.this_arg[3] == 4)
-+					rate_flags |=
-+						IEEE80211_TX_RC_80_MHZ_WIDTH;
-+				else if (iterator.this_arg[3] == 11)
-+					rate_flags |=
-+						IEEE80211_TX_RC_160_MHZ_WIDTH;
-+			}
-+
-+			vht_mcs = iterator.this_arg[4] >> 4;
-+			vht_nss = iterator.this_arg[4] & 0xF;
-+			break;
-+
- 		/*
- 		 * Please update the file
- 		 * Documentation/networking/mac80211-injection.txt
-@@ -1796,6 +1824,9 @@ static bool ieee80211_parse_tx_radiotap(
- 
- 		if (rate_flags & IEEE80211_TX_RC_MCS) {
- 			info->control.rates[0].idx = rate;
-+		} else if (rate_flags & IEEE80211_TX_RC_VHT_MCS) {
-+			ieee80211_rate_set_vht(info->control.rates, vht_mcs,
-+					       vht_nss);
- 		} else {
- 			for (i = 0; i < sband->n_bitrates; i++) {
- 				if (rate * 5 != sband->bitrates[i].bitrate)
diff --git a/package/kernel/mac80211/patches/342-mac80211-do-not-pass-injected-frames-without-a-valid.patch b/package/kernel/mac80211/patches/342-mac80211-do-not-pass-injected-frames-without-a-valid.patch
deleted file mode 100644
index d7452c29c1..0000000000
--- a/package/kernel/mac80211/patches/342-mac80211-do-not-pass-injected-frames-without-a-valid.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Wed, 2 Mar 2016 15:51:40 +0100
-Subject: [PATCH] mac80211: do not pass injected frames without a valid rate to
- the driver
-
-Fall back to rate control if the requested bitrate was not found.
-
-Fixes: dfdfc2beb0dd ("mac80211: Parse legacy and HT rate in injected frames")
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1837,6 +1837,9 @@ static bool ieee80211_parse_tx_radiotap(
- 			}
- 		}
- 
-+		if (info->control.rates[0].idx < 0)
-+			info->control.flags &= ~IEEE80211_TX_CTRL_RATE_INJECT;
-+
- 		info->control.rates[0].flags = rate_flags;
- 		info->control.rates[0].count = min_t(u8, rate_retries + 1,
- 						     local->hw.max_rate_tries);
diff --git a/package/kernel/mac80211/patches/343-mac80211-minstrel_ht-improve-sample-rate-skip-logic.patch b/package/kernel/mac80211/patches/343-mac80211-minstrel_ht-improve-sample-rate-skip-logic.patch
deleted file mode 100644
index 55ff817009..0000000000
--- a/package/kernel/mac80211/patches/343-mac80211-minstrel_ht-improve-sample-rate-skip-logic.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From: Felix Fietkau <nbd@openwrt.org>
-Date: Thu, 3 Mar 2016 23:20:06 +0100
-Subject: [PATCH] mac80211: minstrel_ht: improve sample rate skip logic
-
-There were a few issues that were slowing down the process of finding
-the optimal rate, especially on devices with multi-rate retry
-limitations:
-
-When max_tp_rate[0] was slower than max_tp_rate[1], the code did not
-sample max_tp_rate[1], which would often allow it to switch places with
-max_tp_rate[0] (e.g. if only the first sampling attempts were bad, but the
-rate is otherwise good).
-
-Also, sample attempts of rates between max_tp_rate[0] and [1] were being
-ignored in this case, because the code only checked if the rate was
-slower than [1].
-
-Fix this by checking against the fastest / second fastest max_tp_rate
-instead of assuming a specific order between the two.
-
-In my tests this patch significantly reduces the time until minstrel_ht
-finds the optimal rate right after assoc
-
-Signed-off-by: Felix Fietkau <nbd@openwrt.org>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -958,6 +958,7 @@ minstrel_get_sample_rate(struct minstrel
- 	struct minstrel_rate_stats *mrs;
- 	struct minstrel_mcs_group_data *mg;
- 	unsigned int sample_dur, sample_group, cur_max_tp_streams;
-+	int tp_rate1, tp_rate2;
- 	int sample_idx = 0;
- 
- 	if (mi->sample_wait > 0) {
-@@ -979,14 +980,22 @@ minstrel_get_sample_rate(struct minstrel
- 	mrs = &mg->rates[sample_idx];
- 	sample_idx += sample_group * MCS_GROUP_RATES;
- 
-+	/* Set tp_rate1, tp_rate2 to the highest / second highest max_tp_rate */
-+	if (minstrel_get_duration(mi->max_tp_rate[0]) >
-+	    minstrel_get_duration(mi->max_tp_rate[1])) {
-+		tp_rate1 = mi->max_tp_rate[1];
-+		tp_rate2 = mi->max_tp_rate[0];
-+	} else {
-+		tp_rate1 = mi->max_tp_rate[0];
-+		tp_rate2 = mi->max_tp_rate[1];
-+	}
-+
- 	/*
- 	 * Sampling might add some overhead (RTS, no aggregation)
--	 * to the frame. Hence, don't use sampling for the currently
--	 * used rates.
-+	 * to the frame. Hence, don't use sampling for the highest currently
-+	 * used highest throughput or probability rate.
- 	 */
--	if (sample_idx == mi->max_tp_rate[0] ||
--	    sample_idx == mi->max_tp_rate[1] ||
--	    sample_idx == mi->max_prob_rate)
-+	if (sample_idx == mi->max_tp_rate[0] || sample_idx == mi->max_prob_rate)
- 		return -1;
- 
- 	/*
-@@ -1001,10 +1010,10 @@ minstrel_get_sample_rate(struct minstrel
- 	 * if the link is working perfectly.
- 	 */
- 
--	cur_max_tp_streams = minstrel_mcs_groups[mi->max_tp_rate[0] /
-+	cur_max_tp_streams = minstrel_mcs_groups[tp_rate1 /
- 		MCS_GROUP_RATES].streams;
- 	sample_dur = minstrel_get_duration(sample_idx);
--	if (sample_dur >= minstrel_get_duration(mi->max_tp_rate[1]) &&
-+	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
- 	    (cur_max_tp_streams - 1 <
- 	     minstrel_mcs_groups[sample_group].streams ||
- 	     sample_dur >= minstrel_get_duration(mi->max_prob_rate))) {
diff --git a/package/kernel/mac80211/patches/344-0001-brcmfmac-change-function-name-for-brcmf_cfg80211_wai.patch b/package/kernel/mac80211/patches/344-0001-brcmfmac-change-function-name-for-brcmf_cfg80211_wai.patch
deleted file mode 100644
index e3427de732..0000000000
--- a/package/kernel/mac80211/patches/344-0001-brcmfmac-change-function-name-for-brcmf_cfg80211_wai.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From: Arend van Spriel <arend@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:50 +0100
-Subject: [PATCH] brcmfmac: change function name for
- brcmf_cfg80211_wait_vif_event_timeout()
-
-Dropping the '_timeout' from the function name as the fact that a timeout
-value is passed makes it obvious a timeout is used. Also helps to keep code
-lines a bit shorter and easier to stick to 80 char boundary.
-
-Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -564,8 +564,8 @@ struct wireless_dev *brcmf_ap_add_vif(st
- 	}
- 
- 	/* wait for firmware event */
--	err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
--						    BRCMF_VIF_EVENT_TIMEOUT);
-+	err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
-+					    BRCMF_VIF_EVENT_TIMEOUT);
- 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
- 	if (!err) {
- 		brcmf_err("timeout occurred\n");
-@@ -6395,8 +6395,9 @@ bool brcmf_cfg80211_vif_event_armed(stru
- 
- 	return armed;
- }
--int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
--					  u8 action, ulong timeout)
-+
-+int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
-+				  u8 action, ulong timeout)
- {
- 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -402,8 +402,8 @@ bool brcmf_get_vif_state_any(struct brcm
- void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
- 				  struct brcmf_cfg80211_vif *vif);
- bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg);
--int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
--					  u8 action, ulong timeout);
-+int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
-+				  u8 action, ulong timeout);
- s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
- 				struct brcmf_if *ifp, bool aborted,
- 				bool fw_abort);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -1988,8 +1988,8 @@ int brcmf_p2p_ifchange(struct brcmf_cfg8
- 		brcmf_cfg80211_arm_vif_event(cfg, NULL);
- 		return err;
- 	}
--	err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_CHANGE,
--						    BRCMF_VIF_EVENT_TIMEOUT);
-+	err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_CHANGE,
-+					    BRCMF_VIF_EVENT_TIMEOUT);
- 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
- 	if (!err)  {
- 		brcmf_err("No BRCMF_E_IF_CHANGE event received\n");
-@@ -2090,8 +2090,8 @@ static struct wireless_dev *brcmf_p2p_cr
- 	}
- 
- 	/* wait for firmware event */
--	err = brcmf_cfg80211_wait_vif_event_timeout(p2p->cfg, BRCMF_E_IF_ADD,
--						    BRCMF_VIF_EVENT_TIMEOUT);
-+	err = brcmf_cfg80211_wait_vif_event(p2p->cfg, BRCMF_E_IF_ADD,
-+					    BRCMF_VIF_EVENT_TIMEOUT);
- 	brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
- 	brcmf_fweh_p2pdev_setup(pri_ifp, false);
- 	if (!err) {
-@@ -2180,8 +2180,8 @@ struct wireless_dev *brcmf_p2p_add_vif(s
- 	}
- 
- 	/* wait for firmware event */
--	err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
--						    BRCMF_VIF_EVENT_TIMEOUT);
-+	err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
-+					    BRCMF_VIF_EVENT_TIMEOUT);
- 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
- 	if (!err) {
- 		brcmf_err("timeout occurred\n");
-@@ -2274,8 +2274,8 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
- 	}
- 	if (!err) {
- 		/* wait for firmware event */
--		err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_DEL,
--							BRCMF_VIF_EVENT_TIMEOUT);
-+		err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
-+						    BRCMF_VIF_EVENT_TIMEOUT);
- 		if (!err)
- 			err = -EIO;
- 		else
diff --git a/package/kernel/mac80211/patches/344-0002-brcmfmac-Limit-memory-allocs-to-64K.patch b/package/kernel/mac80211/patches/344-0002-brcmfmac-Limit-memory-allocs-to-64K.patch
deleted file mode 100644
index 9c336f774f..0000000000
--- a/package/kernel/mac80211/patches/344-0002-brcmfmac-Limit-memory-allocs-to-64K.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:51 +0100
-Subject: [PATCH] brcmfmac: Limit memory allocs to <64K
-
-Some systems have problems with allocating memory allocation larger
-then 64K. Often on unload/load or suspend/resume a failure is
-reported: Could not allocate wiphy device. This patch makes the
-escan intermediate storage buf dynamically allocated, and smaller
-than 64K.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1125,7 +1125,7 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 
- 	/* Arm scan timeout timer */
- 	mod_timer(&cfg->escan_timeout, jiffies +
--			WL_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
-+			BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
- 
- 	return 0;
- 
-@@ -3020,7 +3020,7 @@ brcmf_cfg80211_escan_handler(struct brcm
- 
- 		list = (struct brcmf_scan_results *)
- 				cfg->escan_info.escan_buf;
--		if (bi_length > WL_ESCAN_BUF_SIZE - list->buflen) {
-+		if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
- 			brcmf_err("Buffer is too small: ignoring\n");
- 			goto exit;
- 		}
-@@ -3033,8 +3033,8 @@ brcmf_cfg80211_escan_handler(struct brcm
- 							  bss_info_le))
- 				goto exit;
- 		}
--		memcpy(&(cfg->escan_info.escan_buf[list->buflen]),
--			bss_info_le, bi_length);
-+		memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
-+		       bi_length);
- 		list->version = le32_to_cpu(bss_info_le->version);
- 		list->buflen += bi_length;
- 		list->count++;
-@@ -5402,14 +5402,14 @@ static void brcmf_deinit_priv_mem(struct
- {
- 	kfree(cfg->conf);
- 	cfg->conf = NULL;
--	kfree(cfg->escan_ioctl_buf);
--	cfg->escan_ioctl_buf = NULL;
- 	kfree(cfg->extra_buf);
- 	cfg->extra_buf = NULL;
- 	kfree(cfg->wowl.nd);
- 	cfg->wowl.nd = NULL;
- 	kfree(cfg->wowl.nd_info);
- 	cfg->wowl.nd_info = NULL;
-+	kfree(cfg->escan_info.escan_buf);
-+	cfg->escan_info.escan_buf = NULL;
- }
- 
- static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
-@@ -5417,9 +5417,6 @@ static s32 brcmf_init_priv_mem(struct br
- 	cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
- 	if (!cfg->conf)
- 		goto init_priv_mem_out;
--	cfg->escan_ioctl_buf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
--	if (!cfg->escan_ioctl_buf)
--		goto init_priv_mem_out;
- 	cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
- 	if (!cfg->extra_buf)
- 		goto init_priv_mem_out;
-@@ -5431,6 +5428,9 @@ static s32 brcmf_init_priv_mem(struct br
- 				    GFP_KERNEL);
- 	if (!cfg->wowl.nd_info)
- 		goto init_priv_mem_out;
-+	cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
-+	if (!cfg->escan_info.escan_buf)
-+		goto init_priv_mem_out;
- 
- 	return 0;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -28,8 +28,11 @@
- #define WL_ROAM_TRIGGER_LEVEL		-75
- #define WL_ROAM_DELTA			20
- 
--#define WL_ESCAN_BUF_SIZE		(1024 * 64)
--#define WL_ESCAN_TIMER_INTERVAL_MS	10000 /* E-Scan timeout */
-+/* Keep BRCMF_ESCAN_BUF_SIZE below 64K (65536). Allocing over 64K can be
-+ * problematic on some systems and should be avoided.
-+ */
-+#define BRCMF_ESCAN_BUF_SIZE		65000
-+#define BRCMF_ESCAN_TIMER_INTERVAL_MS	10000	/* E-Scan timeout */
- 
- #define WL_ESCAN_ACTION_START		1
- #define WL_ESCAN_ACTION_CONTINUE	2
-@@ -205,7 +208,7 @@ enum wl_escan_state {
- 
- struct escan_info {
- 	u32 escan_state;
--	u8 escan_buf[WL_ESCAN_BUF_SIZE];
-+	u8 *escan_buf;
- 	struct wiphy *wiphy;
- 	struct brcmf_if *ifp;
- 	s32 (*run)(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
-@@ -278,7 +281,6 @@ struct brcmf_cfg80211_wowl {
-  * @escan_info: escan information.
-  * @escan_timeout: Timer for catch scan timeout.
-  * @escan_timeout_work: scan timeout worker.
-- * @escan_ioctl_buf: dongle command buffer for escan commands.
-  * @vif_list: linked list of vif instances.
-  * @vif_cnt: number of vif instances.
-  * @vif_event: vif event signalling.
-@@ -309,7 +311,6 @@ struct brcmf_cfg80211_info {
- 	struct escan_info escan_info;
- 	struct timer_list escan_timeout;
- 	struct work_struct escan_timeout_work;
--	u8 *escan_ioctl_buf;
- 	struct list_head vif_list;
- 	struct brcmf_cfg80211_vif_event vif_event;
- 	struct completion vif_disabled;
diff --git a/package/kernel/mac80211/patches/344-0003-brcmfmac-check-for-wowl-support-before-enumerating-f.patch b/package/kernel/mac80211/patches/344-0003-brcmfmac-check-for-wowl-support-before-enumerating-f.patch
deleted file mode 100644
index ee3d9f37a8..0000000000
--- a/package/kernel/mac80211/patches/344-0003-brcmfmac-check-for-wowl-support-before-enumerating-f.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From: Franky Lin <frankyl@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:52 +0100
-Subject: [PATCH] brcmfmac: check for wowl support before enumerating feature
- flag
-
-In some cases wiphy->wowlan could be NULL if firmware doesn't have the
-support. Driver should check for support before walking down the feature
-flags.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Franky Lin <frankyl@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6594,7 +6594,8 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
- 		wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
- #ifdef CONFIG_PM
--		if (wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
-+		if (wiphy->wowlan &&
-+		    wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
- 			wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
- #endif
- 	}
diff --git a/package/kernel/mac80211/patches/344-0004-brcmfmac-Configure-country-code-using-device-specifi.patch b/package/kernel/mac80211/patches/344-0004-brcmfmac-Configure-country-code-using-device-specifi.patch
deleted file mode 100644
index c52cac87b9..0000000000
--- a/package/kernel/mac80211/patches/344-0004-brcmfmac-Configure-country-code-using-device-specifi.patch
+++ /dev/null
@@ -1,214 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:53 +0100
-Subject: [PATCH] brcmfmac: Configure country code using device specific
- settings
-
-Country code configuration in a device is a device specific
-operation. For this the country code as specified by reg notifier
-(iso3166 alpha2) needs to be translated to a device specific
-country locale and revision number. This patch adds this
-translation and puts a placeholder in the device specific settings
-where the translation table can be stored. Additional patches will
-be needed to read these tables from for example device platform
-data.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6405,28 +6405,85 @@ int brcmf_cfg80211_wait_vif_event(struct
- 				  vif_event_equals(event, action), timeout);
- }
- 
-+static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
-+					struct brcmf_fil_country_le *ccreq)
-+{
-+	struct cc_translate *country_codes;
-+	struct cc_entry *cc;
-+	s32 found_index;
-+	int i;
-+
-+	country_codes = drvr->settings->country_codes;
-+	if (!country_codes) {
-+		brcmf_dbg(TRACE, "No country codes configured for device\n");
-+		return -EINVAL;
-+	}
-+
-+	if ((alpha2[0] == ccreq->country_abbrev[0]) &&
-+	    (alpha2[1] == ccreq->country_abbrev[1])) {
-+		brcmf_dbg(TRACE, "Country code already set\n");
-+		return -EAGAIN;
-+	}
-+
-+	found_index = -1;
-+	for (i = 0; i < country_codes->table_size; i++) {
-+		cc = &country_codes->table[i];
-+		if ((cc->iso3166[0] == '\0') && (found_index == -1))
-+			found_index = i;
-+		if ((cc->iso3166[0] == alpha2[0]) &&
-+		    (cc->iso3166[1] == alpha2[1])) {
-+			found_index = i;
-+			break;
-+		}
-+	}
-+	if (found_index == -1) {
-+		brcmf_dbg(TRACE, "No country code match found\n");
-+		return -EINVAL;
-+	}
-+	memset(ccreq, 0, sizeof(*ccreq));
-+	ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
-+	memcpy(ccreq->ccode, country_codes->table[found_index].cc,
-+	       BRCMF_COUNTRY_BUF_SZ);
-+	ccreq->country_abbrev[0] = alpha2[0];
-+	ccreq->country_abbrev[1] = alpha2[1];
-+	ccreq->country_abbrev[2] = 0;
-+
-+	return 0;
-+}
-+
- static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
- 					struct regulatory_request *req)
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
- 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
- 	struct brcmf_fil_country_le ccreq;
-+	s32 err;
- 	int i;
- 
--	brcmf_dbg(TRACE, "enter: initiator=%d, alpha=%c%c\n", req->initiator,
--		  req->alpha2[0], req->alpha2[1]);
--
- 	/* ignore non-ISO3166 country codes */
- 	for (i = 0; i < sizeof(req->alpha2); i++)
- 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
--			brcmf_err("not a ISO3166 code\n");
-+			brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
-+				  req->alpha2[0], req->alpha2[1]);
- 			return;
- 		}
--	memset(&ccreq, 0, sizeof(ccreq));
--	ccreq.rev = cpu_to_le32(-1);
--	memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
--	if (brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq))) {
--		brcmf_err("firmware rejected country setting\n");
-+
-+	brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
-+		  req->alpha2[0], req->alpha2[1]);
-+
-+	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
-+	if (err) {
-+		brcmf_err("Country code iovar returned err = %d\n", err);
-+		return;
-+	}
-+
-+	err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
-+	if (err)
-+		return;
-+
-+	err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
-+	if (err) {
-+		brcmf_err("Firmware rejected country setting\n");
- 		return;
- 	}
- 	brcmf_setup_wiphybands(wiphy);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -230,10 +230,8 @@ void brcmf_mp_attach(void)
- int brcmf_mp_device_attach(struct brcmf_pub *drvr)
- {
- 	drvr->settings = kzalloc(sizeof(*drvr->settings), GFP_ATOMIC);
--	if (!drvr->settings) {
--		brcmf_err("Failed to alloca storage space for settings\n");
-+	if (!drvr->settings)
- 		return -ENOMEM;
--	}
- 
- 	drvr->settings->sdiod_txglomsz = brcmf_sdiod_txglomsz;
- 	drvr->settings->p2p_enable = !!brcmf_p2p_enable;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -15,6 +15,8 @@
- #ifndef BRCMFMAC_COMMON_H
- #define BRCMFMAC_COMMON_H
- 
-+#include "fwil_types.h"
-+
- extern const u8 ALLFFMAC[ETH_ALEN];
- 
- #define BRCMF_FW_ALTPATH_LEN			256
-@@ -39,6 +41,33 @@ struct brcmf_mp_global_t {
- extern struct brcmf_mp_global_t brcmf_mp_global;
- 
- /**
-+ * struct cc_entry - Struct for translating user space country code (iso3166) to
-+ *		     firmware country code and revision.
-+ *
-+ * @iso3166: iso3166 alpha 2 country code string.
-+ * @cc: firmware country code string.
-+ * @rev: firmware country code revision.
-+ */
-+struct cc_entry {
-+	char	iso3166[BRCMF_COUNTRY_BUF_SZ];
-+	char	cc[BRCMF_COUNTRY_BUF_SZ];
-+	s32	rev;
-+};
-+
-+/**
-+ * struct cc_translate - Struct for translating country codes as set by user
-+ *			 space to a country code and rev which can be used by
-+ *			 firmware.
-+ *
-+ * @table_size: number of entries in table (> 0)
-+ * @table: dynamic array of 1 or more elements with translation information.
-+ */
-+struct cc_translate {
-+	int	table_size;
-+	struct cc_entry table[0];
-+};
-+
-+/**
-  * struct brcmf_mp_device - Device module paramaters.
-  *
-  * @sdiod_txglomsz: SDIO txglom size.
-@@ -47,6 +76,7 @@ extern struct brcmf_mp_global_t brcmf_mp
-  * @feature_disable: Feature_disable bitmask.
-  * @fcmode: FWS flow control.
-  * @roamoff: Firmware roaming off?
-+ * @country_codes: If available, pointer to struct for translating country codes
-  */
- struct brcmf_mp_device {
- 	int	sdiod_txglomsz;
-@@ -56,6 +86,7 @@ struct brcmf_mp_device {
- 	int	fcmode;
- 	bool	roamoff;
- 	bool	ignore_probe_fail;
-+	struct cc_translate *country_codes;
- };
- 
- void brcmf_mp_attach(void);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -134,6 +134,8 @@
- #define BRCMF_PFN_MAC_OUI_ONLY		BIT(0)
- #define BRCMF_PFN_SET_MAC_UNASSOC	BIT(1)
- 
-+#define BRCMF_MCSSET_LEN		16
-+
- /* join preference types for join_pref iovar */
- enum brcmf_join_pref_types {
- 	BRCMF_JOIN_PREF_RSSI = 1,
-@@ -279,7 +281,7 @@ struct brcmf_bss_info_le {
- 	__le32 reserved32[1];	/* Reserved for expansion of BSS properties */
- 	u8 flags;		/* flags */
- 	u8 reserved[3];	/* Reserved for expansion of BSS properties */
--	u8 basic_mcs[MCSSET_LEN];	/* 802.11N BSS required MCS set */
-+	u8 basic_mcs[BRCMF_MCSSET_LEN];	/* 802.11N BSS required MCS set */
- 
- 	__le16 ie_offset;	/* offset at which IEs start, from beginning */
- 	__le32 ie_length;	/* byte length of Information Elements */
diff --git a/package/kernel/mac80211/patches/344-0005-brcmfmac-Add-length-checks-on-firmware-events.patch b/package/kernel/mac80211/patches/344-0005-brcmfmac-Add-length-checks-on-firmware-events.patch
deleted file mode 100644
index 3e2e3503b6..0000000000
--- a/package/kernel/mac80211/patches/344-0005-brcmfmac-Add-length-checks-on-firmware-events.patch
+++ /dev/null
@@ -1,283 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:54 +0100
-Subject: [PATCH] brcmfmac: Add length checks on firmware events
-
-Add additional length checks on firmware events to create more
-robust code.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Reviewed-by: Lei Zhang <leizh@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3092,6 +3092,11 @@ brcmf_notify_sched_scan_results(struct b
- 
- 	brcmf_dbg(SCAN, "Enter\n");
- 
-+	if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
-+		brcmf_dbg(SCAN, "Event data to small. Ignore\n");
-+		return 0;
-+	}
-+
- 	if (e->event_code == BRCMF_E_PFN_NET_LOST) {
- 		brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
- 		return 0;
-@@ -3415,6 +3420,11 @@ brcmf_wowl_nd_results(struct brcmf_if *i
- 
- 	brcmf_dbg(SCAN, "Enter\n");
- 
-+	if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
-+		brcmf_dbg(SCAN, "Event data to small. Ignore\n");
-+		return 0;
-+	}
-+
- 	pfn_result = (struct brcmf_pno_scanresults_le *)data;
- 
- 	if (e->event_code == BRCMF_E_PFN_NET_LOST) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -26,50 +26,6 @@
- #include "fwil.h"
- 
- /**
-- * struct brcm_ethhdr - broadcom specific ether header.
-- *
-- * @subtype: subtype for this packet.
-- * @length: TODO: length of appended data.
-- * @version: version indication.
-- * @oui: OUI of this packet.
-- * @usr_subtype: subtype for this OUI.
-- */
--struct brcm_ethhdr {
--	__be16 subtype;
--	__be16 length;
--	u8 version;
--	u8 oui[3];
--	__be16 usr_subtype;
--} __packed;
--
--struct brcmf_event_msg_be {
--	__be16 version;
--	__be16 flags;
--	__be32 event_type;
--	__be32 status;
--	__be32 reason;
--	__be32 auth_type;
--	__be32 datalen;
--	u8 addr[ETH_ALEN];
--	char ifname[IFNAMSIZ];
--	u8 ifidx;
--	u8 bsscfgidx;
--} __packed;
--
--/**
-- * struct brcmf_event - contents of broadcom event packet.
-- *
-- * @eth: standard ether header.
-- * @hdr: broadcom specific ether header.
-- * @msg: common part of the actual event message.
-- */
--struct brcmf_event {
--	struct ethhdr eth;
--	struct brcm_ethhdr hdr;
--	struct brcmf_event_msg_be msg;
--} __packed;
--
--/**
-  * struct brcmf_fweh_queue_item - event item on event queue.
-  *
-  * @q: list element for queuing.
-@@ -85,6 +41,7 @@ struct brcmf_fweh_queue_item {
- 	u8 ifidx;
- 	u8 ifaddr[ETH_ALEN];
- 	struct brcmf_event_msg_be emsg;
-+	u32 datalen;
- 	u8 data[0];
- };
- 
-@@ -294,6 +251,11 @@ static void brcmf_fweh_event_worker(stru
- 		brcmf_dbg_hex_dump(BRCMF_EVENT_ON(), event->data,
- 				   min_t(u32, emsg.datalen, 64),
- 				   "event payload, len=%d\n", emsg.datalen);
-+		if (emsg.datalen > event->datalen) {
-+			brcmf_err("event invalid length header=%d, msg=%d\n",
-+				  event->datalen, emsg.datalen);
-+			goto event_free;
-+		}
- 
- 		/* special handling of interface event */
- 		if (event->code == BRCMF_E_IF) {
-@@ -439,7 +401,8 @@ int brcmf_fweh_activate_events(struct br
-  * dispatch the event to a registered handler (using worker).
-  */
- void brcmf_fweh_process_event(struct brcmf_pub *drvr,
--			      struct brcmf_event *event_packet)
-+			      struct brcmf_event *event_packet,
-+			      u32 packet_len)
- {
- 	enum brcmf_fweh_event_code code;
- 	struct brcmf_fweh_info *fweh = &drvr->fweh;
-@@ -459,6 +422,9 @@ void brcmf_fweh_process_event(struct brc
- 	if (code != BRCMF_E_IF && !fweh->evt_handler[code])
- 		return;
- 
-+	if (datalen > BRCMF_DCMD_MAXLEN)
-+		return;
-+
- 	if (in_interrupt())
- 		alloc_flag = GFP_ATOMIC;
- 
-@@ -472,6 +438,7 @@ void brcmf_fweh_process_event(struct brc
- 	/* use memcpy to get aligned event message */
- 	memcpy(&event->emsg, &event_packet->msg, sizeof(event->emsg));
- 	memcpy(event->data, data, datalen);
-+	event->datalen = datalen;
- 	memcpy(event->ifaddr, event_packet->eth.h_dest, ETH_ALEN);
- 
- 	brcmf_fweh_queue_event(fweh, event);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
-@@ -27,7 +27,6 @@
- struct brcmf_pub;
- struct brcmf_if;
- struct brcmf_cfg80211_info;
--struct brcmf_event;
- 
- /* list of firmware events */
- #define BRCMF_FWEH_EVENT_ENUM_DEFLIST \
-@@ -180,13 +179,55 @@ enum brcmf_fweh_event_code {
- /**
-  * definitions for event packet validation.
-  */
--#define BRCMF_EVENT_OUI_OFFSET		19
--#define BRCM_OUI			"\x00\x10\x18"
--#define DOT11_OUI_LEN			3
--#define BCMILCP_BCM_SUBTYPE_EVENT	1
-+#define BRCM_OUI				"\x00\x10\x18"
-+#define BCMILCP_BCM_SUBTYPE_EVENT		1
- 
- 
- /**
-+ * struct brcm_ethhdr - broadcom specific ether header.
-+ *
-+ * @subtype: subtype for this packet.
-+ * @length: TODO: length of appended data.
-+ * @version: version indication.
-+ * @oui: OUI of this packet.
-+ * @usr_subtype: subtype for this OUI.
-+ */
-+struct brcm_ethhdr {
-+	__be16 subtype;
-+	__be16 length;
-+	u8 version;
-+	u8 oui[3];
-+	__be16 usr_subtype;
-+} __packed;
-+
-+struct brcmf_event_msg_be {
-+	__be16 version;
-+	__be16 flags;
-+	__be32 event_type;
-+	__be32 status;
-+	__be32 reason;
-+	__be32 auth_type;
-+	__be32 datalen;
-+	u8 addr[ETH_ALEN];
-+	char ifname[IFNAMSIZ];
-+	u8 ifidx;
-+	u8 bsscfgidx;
-+} __packed;
-+
-+/**
-+ * struct brcmf_event - contents of broadcom event packet.
-+ *
-+ * @eth: standard ether header.
-+ * @hdr: broadcom specific ether header.
-+ * @msg: common part of the actual event message.
-+ */
-+struct brcmf_event {
-+	struct ethhdr eth;
-+	struct brcm_ethhdr hdr;
-+	struct brcmf_event_msg_be msg;
-+} __packed;
-+
-+/**
-  * struct brcmf_event_msg - firmware event message.
-  *
-  * @version: version information.
-@@ -256,34 +297,35 @@ void brcmf_fweh_unregister(struct brcmf_
- 			   enum brcmf_fweh_event_code code);
- int brcmf_fweh_activate_events(struct brcmf_if *ifp);
- void brcmf_fweh_process_event(struct brcmf_pub *drvr,
--			      struct brcmf_event *event_packet);
-+			      struct brcmf_event *event_packet,
-+			      u32 packet_len);
- void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing);
- 
- static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
- 					  struct sk_buff *skb)
- {
- 	struct brcmf_event *event_packet;
--	u8 *data;
- 	u16 usr_stype;
- 
- 	/* only process events when protocol matches */
- 	if (skb->protocol != cpu_to_be16(ETH_P_LINK_CTL))
- 		return;
- 
-+	if ((skb->len + ETH_HLEN) < sizeof(*event_packet))
-+		return;
-+
- 	/* check for BRCM oui match */
- 	event_packet = (struct brcmf_event *)skb_mac_header(skb);
--	data = (u8 *)event_packet;
--	data += BRCMF_EVENT_OUI_OFFSET;
--	if (memcmp(BRCM_OUI, data, DOT11_OUI_LEN))
-+	if (memcmp(BRCM_OUI, &event_packet->hdr.oui[0],
-+		   sizeof(event_packet->hdr.oui)))
- 		return;
- 
- 	/* final match on usr_subtype */
--	data += DOT11_OUI_LEN;
--	usr_stype = get_unaligned_be16(data);
-+	usr_stype = get_unaligned_be16(&event_packet->hdr.usr_subtype);
- 	if (usr_stype != BCMILCP_BCM_SUBTYPE_EVENT)
- 		return;
- 
--	brcmf_fweh_process_event(drvr, event_packet);
-+	brcmf_fweh_process_event(drvr, event_packet, skb->len + ETH_HLEN);
- }
- 
- #endif /* FWEH_H_ */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -1361,6 +1361,11 @@ int brcmf_p2p_notify_action_frame_rx(str
- 	u16 mgmt_type;
- 	u8 action;
- 
-+	if (e->datalen < sizeof(*rxframe)) {
-+		brcmf_dbg(SCAN, "Event data to small. Ignore\n");
-+		return 0;
-+	}
-+
- 	ch.chspec = be16_to_cpu(rxframe->chanspec);
- 	cfg->d11inf.decchspec(&ch);
- 	/* Check if wpa_supplicant has registered for this frame */
-@@ -1858,6 +1863,11 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probere
- 	brcmf_dbg(INFO, "Enter: event %d reason %d\n", e->event_code,
- 		  e->reason);
- 
-+	if (e->datalen < sizeof(*rxframe)) {
-+		brcmf_dbg(SCAN, "Event data to small. Ignore\n");
-+		return 0;
-+	}
-+
- 	ch.chspec = be16_to_cpu(rxframe->chanspec);
- 	cfg->d11inf.decchspec(&ch);
- 
diff --git a/package/kernel/mac80211/patches/344-0006-brcmfmac-add-neighbor-discovery-offload-ip-address-t.patch b/package/kernel/mac80211/patches/344-0006-brcmfmac-add-neighbor-discovery-offload-ip-address-t.patch
deleted file mode 100644
index 888ad5b050..0000000000
--- a/package/kernel/mac80211/patches/344-0006-brcmfmac-add-neighbor-discovery-offload-ip-address-t.patch
+++ /dev/null
@@ -1,333 +0,0 @@
-From: Franky Lin <frankyl@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:55 +0100
-Subject: [PATCH] brcmfmac: add neighbor discovery offload ip address table
- configuration
-
-Configure ipv6 address for neighbor discovery offload ip table in
-firmware obtained through ipv6 address notification callback.
-
-Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Franky Lin <frankyl@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -456,7 +456,7 @@ send_key_to_dongle(struct brcmf_if *ifp,
- }
- 
- static s32
--brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
-+brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
- {
- 	s32 err;
- 	u32 mode;
-@@ -484,6 +484,15 @@ brcmf_configure_arp_offload(struct brcmf
- 				  enable, mode);
- 	}
- 
-+	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
-+	if (err) {
-+		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
-+			  enable, err);
-+		err = 0;
-+	} else
-+		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
-+			  enable, mode);
-+
- 	return err;
- }
- 
-@@ -3543,7 +3552,7 @@ static s32 brcmf_cfg80211_resume(struct
- 		brcmf_report_wowl_wakeind(wiphy, ifp);
- 		brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
- 		brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
--		brcmf_configure_arp_offload(ifp, true);
-+		brcmf_configure_arp_nd_offload(ifp, true);
- 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
- 				      cfg->wowl.pre_pmmode);
- 		cfg->wowl.active = false;
-@@ -3567,7 +3576,7 @@ static void brcmf_configure_wowl(struct
- 
- 	brcmf_dbg(TRACE, "Suspend, wowl config.\n");
- 
--	brcmf_configure_arp_offload(ifp, false);
-+	brcmf_configure_arp_nd_offload(ifp, false);
- 	brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
- 	brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
- 
-@@ -4336,7 +4345,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 
- 	if (!mbss) {
- 		brcmf_set_mpc(ifp, 0);
--		brcmf_configure_arp_offload(ifp, false);
-+		brcmf_configure_arp_nd_offload(ifp, false);
- 	}
- 
- 	/* find the RSN_IE */
-@@ -4482,7 +4491,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- exit:
- 	if ((err) && (!mbss)) {
- 		brcmf_set_mpc(ifp, 1);
--		brcmf_configure_arp_offload(ifp, true);
-+		brcmf_configure_arp_nd_offload(ifp, true);
- 	}
- 	return err;
- }
-@@ -4540,7 +4549,7 @@ static int brcmf_cfg80211_stop_ap(struct
- 			brcmf_err("bss_enable config failed %d\n", err);
- 	}
- 	brcmf_set_mpc(ifp, 1);
--	brcmf_configure_arp_offload(ifp, true);
-+	brcmf_configure_arp_nd_offload(ifp, true);
- 	clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
- 	brcmf_net_setcarrier(ifp, false);
- 
-@@ -6287,7 +6296,7 @@ static s32 brcmf_config_dongle(struct br
- 	if (err)
- 		goto default_conf_out;
- 
--	brcmf_configure_arp_offload(ifp, true);
-+	brcmf_configure_arp_nd_offload(ifp, true);
- 
- 	cfg->dongle_up = true;
- default_conf_out:
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -20,6 +20,8 @@
- #include <linux/inetdevice.h>
- #include <net/cfg80211.h>
- #include <net/rtnetlink.h>
-+#include <net/addrconf.h>
-+#include <net/ipv6.h>
- #include <brcmu_utils.h>
- #include <brcmu_wifi.h>
- 
-@@ -172,6 +174,35 @@ _brcmf_set_mac_address(struct work_struc
- 	}
- }
- 
-+#if IS_ENABLED(CONFIG_IPV6)
-+static void _brcmf_update_ndtable(struct work_struct *work)
-+{
-+	struct brcmf_if *ifp;
-+	int i, ret;
-+
-+	ifp = container_of(work, struct brcmf_if, ndoffload_work);
-+
-+	/* clear the table in firmware */
-+	ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip_clear", NULL, 0);
-+	if (ret) {
-+		brcmf_dbg(TRACE, "fail to clear nd ip table err:%d\n", ret);
-+		return;
-+	}
-+
-+	for (i = 0; i < ifp->ipv6addr_idx; i++) {
-+		ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip",
-+					       &ifp->ipv6_addr_tbl[i],
-+					       sizeof(struct in6_addr));
-+		if (ret)
-+			brcmf_err("add nd ip err %d\n", ret);
-+	}
-+}
-+#else
-+static void _brcmf_update_ndtable(struct work_struct *work)
-+{
-+}
-+#endif
-+
- static int brcmf_netdev_set_mac_address(struct net_device *ndev, void *addr)
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
-@@ -685,6 +716,7 @@ int brcmf_net_attach(struct brcmf_if *if
- 
- 	INIT_WORK(&ifp->setmacaddr_work, _brcmf_set_mac_address);
- 	INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
-+	INIT_WORK(&ifp->ndoffload_work, _brcmf_update_ndtable);
- 
- 	if (rtnl_locked)
- 		err = register_netdevice(ndev);
-@@ -884,6 +916,7 @@ static void brcmf_del_if(struct brcmf_pu
- 		if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
- 			cancel_work_sync(&ifp->setmacaddr_work);
- 			cancel_work_sync(&ifp->multicast_work);
-+			cancel_work_sync(&ifp->ndoffload_work);
- 		}
- 		brcmf_net_detach(ifp->ndev);
- 	} else {
-@@ -1025,6 +1058,56 @@ static int brcmf_inetaddr_changed(struct
- }
- #endif
- 
-+#if IS_ENABLED(CONFIG_IPV6)
-+static int brcmf_inet6addr_changed(struct notifier_block *nb,
-+				   unsigned long action, void *data)
-+{
-+	struct brcmf_pub *drvr = container_of(nb, struct brcmf_pub,
-+					      inet6addr_notifier);
-+	struct inet6_ifaddr *ifa = data;
-+	struct brcmf_if *ifp;
-+	int i;
-+	struct in6_addr *table;
-+
-+	/* Only handle primary interface */
-+	ifp = drvr->iflist[0];
-+	if (!ifp)
-+		return NOTIFY_DONE;
-+	if (ifp->ndev != ifa->idev->dev)
-+		return NOTIFY_DONE;
-+
-+	table = ifp->ipv6_addr_tbl;
-+	for (i = 0; i < NDOL_MAX_ENTRIES; i++)
-+		if (ipv6_addr_equal(&ifa->addr, &table[i]))
-+			break;
-+
-+	switch (action) {
-+	case NETDEV_UP:
-+		if (i == NDOL_MAX_ENTRIES) {
-+			if (ifp->ipv6addr_idx < NDOL_MAX_ENTRIES) {
-+				table[ifp->ipv6addr_idx++] = ifa->addr;
-+			} else {
-+				for (i = 0; i < NDOL_MAX_ENTRIES - 1; i++)
-+					table[i] = table[i + 1];
-+				table[NDOL_MAX_ENTRIES - 1] = ifa->addr;
-+			}
-+		}
-+		break;
-+	case NETDEV_DOWN:
-+		if (i < NDOL_MAX_ENTRIES)
-+			for (; i < ifp->ipv6addr_idx; i++)
-+				table[i] = table[i + 1];
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	schedule_work(&ifp->ndoffload_work);
-+
-+	return NOTIFY_OK;
-+}
-+#endif
-+
- int brcmf_attach(struct device *dev)
- {
- 	struct brcmf_pub *drvr = NULL;
-@@ -1164,30 +1247,41 @@ int brcmf_bus_start(struct device *dev)
- #ifdef CONFIG_INET
- 	drvr->inetaddr_notifier.notifier_call = brcmf_inetaddr_changed;
- 	ret = register_inetaddr_notifier(&drvr->inetaddr_notifier);
-+	if (ret)
-+		goto fail;
-+
-+#if IS_ENABLED(CONFIG_IPV6)
-+	drvr->inet6addr_notifier.notifier_call = brcmf_inet6addr_changed;
-+	ret = register_inet6addr_notifier(&drvr->inet6addr_notifier);
-+	if (ret) {
-+		unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
-+		goto fail;
-+	}
- #endif
-+#endif /* CONFIG_INET */
-+
-+	return 0;
- 
- fail:
--	if (ret < 0) {
--		brcmf_err("failed: %d\n", ret);
--		if (drvr->config) {
--			brcmf_cfg80211_detach(drvr->config);
--			drvr->config = NULL;
--		}
--		if (drvr->fws) {
--			brcmf_fws_del_interface(ifp);
--			brcmf_fws_deinit(drvr);
--		}
--		if (ifp)
--			brcmf_net_detach(ifp->ndev);
--		if (p2p_ifp)
--			brcmf_net_detach(p2p_ifp->ndev);
--		drvr->iflist[0] = NULL;
--		drvr->iflist[1] = NULL;
--		if (brcmf_ignoring_probe_fail(drvr))
--			ret = 0;
--		return ret;
-+	brcmf_err("failed: %d\n", ret);
-+	if (drvr->config) {
-+		brcmf_cfg80211_detach(drvr->config);
-+		drvr->config = NULL;
-+	}
-+	if (drvr->fws) {
-+		brcmf_fws_del_interface(ifp);
-+		brcmf_fws_deinit(drvr);
- 	}
--	return 0;
-+	if (ifp)
-+		brcmf_net_detach(ifp->ndev);
-+	if (p2p_ifp)
-+		brcmf_net_detach(p2p_ifp->ndev);
-+	drvr->iflist[0] = NULL;
-+	drvr->iflist[1] = NULL;
-+	if (brcmf_ignoring_probe_fail(drvr))
-+		ret = 0;
-+
-+	return ret;
- }
- 
- void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
-@@ -1237,6 +1331,10 @@ void brcmf_detach(struct device *dev)
- 	unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
- #endif
- 
-+#if IS_ENABLED(CONFIG_IPV6)
-+	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
-+#endif
-+
- 	/* stop firmware event handling */
- 	brcmf_fweh_detach(drvr);
- 	if (drvr->config)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -48,6 +48,8 @@
-  */
- #define BRCMF_DRIVER_FIRMWARE_VERSION_LEN	32
- 
-+#define NDOL_MAX_ENTRIES	8
-+
- /**
-  * struct brcmf_ampdu_rx_reorder - AMPDU receive reorder info
-  *
-@@ -143,6 +145,7 @@ struct brcmf_pub {
- #endif
- 
- 	struct notifier_block inetaddr_notifier;
-+	struct notifier_block inet6addr_notifier;
- 	struct brcmf_mp_device *settings;
- };
- 
-@@ -175,6 +178,7 @@ enum brcmf_netif_stop_reason {
-  * @stats: interface specific network statistics.
-  * @setmacaddr_work: worker object for setting mac address.
-  * @multicast_work: worker object for multicast provisioning.
-+ * @ndoffload_work: worker object for neighbor discovery offload configuration.
-  * @fws_desc: interface specific firmware-signalling descriptor.
-  * @ifidx: interface index in device firmware.
-  * @bsscfgidx: index of bss associated with this interface.
-@@ -191,6 +195,7 @@ struct brcmf_if {
- 	struct net_device_stats stats;
- 	struct work_struct setmacaddr_work;
- 	struct work_struct multicast_work;
-+	struct work_struct ndoffload_work;
- 	struct brcmf_fws_mac_descriptor *fws_desc;
- 	int ifidx;
- 	s32 bsscfgidx;
-@@ -199,6 +204,8 @@ struct brcmf_if {
- 	spinlock_t netif_stop_lock;
- 	atomic_t pend_8021x_cnt;
- 	wait_queue_head_t pend_8021x_wait;
-+	struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
-+	u8 ipv6addr_idx;
- };
- 
- struct brcmf_skb_reorder_data {
diff --git a/package/kernel/mac80211/patches/344-0007-brcmfmac-check-return-for-ARP-ip-setting-iovar.patch b/package/kernel/mac80211/patches/344-0007-brcmfmac-check-return-for-ARP-ip-setting-iovar.patch
deleted file mode 100644
index 68de8ed2a2..0000000000
--- a/package/kernel/mac80211/patches/344-0007-brcmfmac-check-return-for-ARP-ip-setting-iovar.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Franky Lin <frankyl@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:56 +0100
-Subject: [PATCH] brcmfmac: check return for ARP ip setting iovar
-
-The return value of iovar set function should be saved and checked.
-
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Franky Lin <frankyl@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1039,14 +1039,14 @@ static int brcmf_inetaddr_changed(struct
- 				return NOTIFY_OK;
- 			}
- 			for (i = 0; i < ARPOL_MAX_ENTRIES; i++) {
--				if (addr_table[i] != 0) {
--					brcmf_fil_iovar_data_set(ifp,
--						"arp_hostip", &addr_table[i],
--						sizeof(addr_table[i]));
--					if (ret)
--						brcmf_err("add arp ip err %d\n",
--							  ret);
--				}
-+				if (addr_table[i] == 0)
-+					continue;
-+				ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
-+							       &addr_table[i],
-+							       sizeof(addr_table[i]));
-+				if (ret)
-+					brcmf_err("add arp ip err %d\n",
-+						  ret);
- 			}
- 		}
- 		break;
diff --git a/package/kernel/mac80211/patches/344-0008-brcmfmac-use-device-memsize-config-from-fw-if-define.patch b/package/kernel/mac80211/patches/344-0008-brcmfmac-use-device-memsize-config-from-fw-if-define.patch
deleted file mode 100644
index 3de0f64d56..0000000000
--- a/package/kernel/mac80211/patches/344-0008-brcmfmac-use-device-memsize-config-from-fw-if-define.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:57 +0100
-Subject: [PATCH] brcmfmac: use device memsize config from fw if defined
-
-Newer type pcie devices have memory which get shared between fw and
-hw. The division of this memory is done firmware compile time. As a
-result the ramsize as used by driver needs to be adjusted for this.
-This is done by reading the memory size from the firmware.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -207,6 +207,10 @@ static struct brcmf_firmware_mapping brc
- #define BRCMF_PCIE_CFGREG_REG_BAR3_CONFIG	0x4F4
- #define BRCMF_PCIE_LINK_STATUS_CTRL_ASPM_ENAB	3
- 
-+/* Magic number at a magic location to find RAM size */
-+#define BRCMF_RAMSIZE_MAGIC			0x534d4152	/* SMAR */
-+#define BRCMF_RAMSIZE_OFFSET			0x6c
-+
- 
- struct brcmf_pcie_console {
- 	u32 base_addr;
-@@ -1412,6 +1416,28 @@ static const struct brcmf_bus_ops brcmf_
- };
- 
- 
-+static void
-+brcmf_pcie_adjust_ramsize(struct brcmf_pciedev_info *devinfo, u8 *data,
-+			  u32 data_len)
-+{
-+	__le32 *field;
-+	u32 newsize;
-+
-+	if (data_len < BRCMF_RAMSIZE_OFFSET + 8)
-+		return;
-+
-+	field = (__le32 *)&data[BRCMF_RAMSIZE_OFFSET];
-+	if (le32_to_cpup(field) != BRCMF_RAMSIZE_MAGIC)
-+		return;
-+	field++;
-+	newsize = le32_to_cpup(field);
-+
-+	brcmf_dbg(PCIE, "Found ramsize info in FW, adjusting to 0x%x\n",
-+		  newsize);
-+	devinfo->ci->ramsize = newsize;
-+}
-+
-+
- static int
- brcmf_pcie_init_share_ram_info(struct brcmf_pciedev_info *devinfo,
- 			       u32 sharedram_addr)
-@@ -1694,6 +1720,13 @@ static void brcmf_pcie_setup(struct devi
- 
- 	brcmf_pcie_attach(devinfo);
- 
-+	/* Some of the firmwares have the size of the memory of the device
-+	 * defined inside the firmware. This is because part of the memory in
-+	 * the device is shared and the devision is determined by FW. Parse
-+	 * the firmware and adjust the chip memory size now.
-+	 */
-+	brcmf_pcie_adjust_ramsize(devinfo, (u8 *)fw->data, fw->size);
-+
- 	ret = brcmf_pcie_download_fw_nvram(devinfo, fw, nvram, nvram_len);
- 	if (ret)
- 		goto fail;
diff --git a/package/kernel/mac80211/patches/344-0009-brcmfmac-use-bar1-window-size-as-provided-by-pci-sub.patch b/package/kernel/mac80211/patches/344-0009-brcmfmac-use-bar1-window-size-as-provided-by-pci-sub.patch
deleted file mode 100644
index ca03ffe4b0..0000000000
--- a/package/kernel/mac80211/patches/344-0009-brcmfmac-use-bar1-window-size-as-provided-by-pci-sub.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:58 +0100
-Subject: [PATCH] brcmfmac: use bar1 window size as provided by pci subsystem
-
-The PCIE bar1 window size is specified by chip. Currently the
-ioremap of bar1 was using a define which always matched the size
-of bar1, but newer chips can have a different bar1 sizes. With
-this patch the ioremap will be called with the by chip provided
-window size.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -72,7 +72,6 @@ static struct brcmf_firmware_mapping brc
- 
- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
- 
--#define BRCMF_PCIE_TCM_MAP_SIZE			(4096 * 1024)
- #define BRCMF_PCIE_REG_MAP_SIZE			(32 * 1024)
- 
- /* backplane addres space accessed by BAR0 */
-@@ -252,7 +251,6 @@ struct brcmf_pciedev_info {
- 	char nvram_name[BRCMF_FW_NAME_LEN];
- 	void __iomem *regs;
- 	void __iomem *tcm;
--	u32 tcm_size;
- 	u32 ram_base;
- 	u32 ram_size;
- 	struct brcmf_chip *ci;
-@@ -1592,8 +1590,7 @@ static int brcmf_pcie_get_resource(struc
- 	}
- 
- 	devinfo->regs = ioremap_nocache(bar0_addr, BRCMF_PCIE_REG_MAP_SIZE);
--	devinfo->tcm = ioremap_nocache(bar1_addr, BRCMF_PCIE_TCM_MAP_SIZE);
--	devinfo->tcm_size = BRCMF_PCIE_TCM_MAP_SIZE;
-+	devinfo->tcm = ioremap_nocache(bar1_addr, bar1_size);
- 
- 	if (!devinfo->regs || !devinfo->tcm) {
- 		brcmf_err("ioremap() failed (%p,%p)\n", devinfo->regs,
-@@ -1602,8 +1599,9 @@ static int brcmf_pcie_get_resource(struc
- 	}
- 	brcmf_dbg(PCIE, "Phys addr : reg space = %p base addr %#016llx\n",
- 		  devinfo->regs, (unsigned long long)bar0_addr);
--	brcmf_dbg(PCIE, "Phys addr : mem space = %p base addr %#016llx\n",
--		  devinfo->tcm, (unsigned long long)bar1_addr);
-+	brcmf_dbg(PCIE, "Phys addr : mem space = %p base addr %#016llx size 0x%x\n",
-+		  devinfo->tcm, (unsigned long long)bar1_addr,
-+		  (unsigned int)bar1_size);
- 
- 	return 0;
- }
diff --git a/package/kernel/mac80211/patches/344-0010-brcmfmac-add-support-for-the-PCIE-4366c0-chip.patch b/package/kernel/mac80211/patches/344-0010-brcmfmac-add-support-for-the-PCIE-4366c0-chip.patch
deleted file mode 100644
index e4a8f305cf..0000000000
--- a/package/kernel/mac80211/patches/344-0010-brcmfmac-add-support-for-the-PCIE-4366c0-chip.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:26:59 +0100
-Subject: [PATCH] brcmfmac: add support for the PCIE 4366c0 chip
-
-A newer version of the 4366 PCIE chip has been released. Add
-support for this version of the chip.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -53,6 +53,7 @@ BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-p
- BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
- BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
- BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
-+BRCMF_FW_NVRAM_DEF(4366C, "brcmfmac4366c-pcie.bin", "brcmfmac4366c-pcie.txt");
- BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
- 
- static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
-@@ -66,7 +67,8 @@ static struct brcmf_firmware_mapping brc
- 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
- 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
- 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFFF, 4365B),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFFF, 4366B),
-+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
-+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
- 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
- };
- 
diff --git a/package/kernel/mac80211/patches/344-0011-brcmfmac-remove-pcie-gen1-support.patch b/package/kernel/mac80211/patches/344-0011-brcmfmac-remove-pcie-gen1-support.patch
deleted file mode 100644
index f99f6dbf07..0000000000
--- a/package/kernel/mac80211/patches/344-0011-brcmfmac-remove-pcie-gen1-support.patch
+++ /dev/null
@@ -1,221 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:00 +0100
-Subject: [PATCH] brcmfmac: remove pcie gen1 support
-
-The PCIE bus driver supports older gen1 (v1) chips, but there is no
-actual device which is using this older pcie core which is supported
-by brcmfmac. Remove all gen1 related code.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -100,9 +100,6 @@ static struct brcmf_firmware_mapping brc
- #define BRCMF_PCIE_PCIE2REG_CONFIGDATA		0x124
- #define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX		0x140
- 
--#define BRCMF_PCIE_GENREV1			1
--#define BRCMF_PCIE_GENREV2			2
--
- #define BRCMF_PCIE2_INTA			0x01
- #define BRCMF_PCIE2_INTB			0x02
- 
-@@ -257,9 +254,7 @@ struct brcmf_pciedev_info {
- 	u32 ram_size;
- 	struct brcmf_chip *ci;
- 	u32 coreid;
--	u32 generic_corerev;
- 	struct brcmf_pcie_shared_info shared;
--	void (*ringbell)(struct brcmf_pciedev_info *devinfo);
- 	wait_queue_head_t mbdata_resp_wait;
- 	bool mbdata_completed;
- 	bool irq_allocated;
-@@ -746,68 +741,22 @@ static void brcmf_pcie_bus_console_read(
- }
- 
- 
--static __used void brcmf_pcie_ringbell_v1(struct brcmf_pciedev_info *devinfo)
--{
--	u32 reg_value;
--
--	brcmf_dbg(PCIE, "RING !\n");
--	reg_value = brcmf_pcie_read_reg32(devinfo,
--					  BRCMF_PCIE_PCIE2REG_MAILBOXINT);
--	reg_value |= BRCMF_PCIE2_INTB;
--	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT,
--			       reg_value);
--}
--
--
--static void brcmf_pcie_ringbell_v2(struct brcmf_pciedev_info *devinfo)
--{
--	brcmf_dbg(PCIE, "RING !\n");
--	/* Any arbitrary value will do, lets use 1 */
--	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
--}
--
--
- static void brcmf_pcie_intr_disable(struct brcmf_pciedev_info *devinfo)
- {
--	if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1)
--		pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_INTMASK,
--				       0);
--	else
--		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK,
--				       0);
-+	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK, 0);
- }
- 
- 
- static void brcmf_pcie_intr_enable(struct brcmf_pciedev_info *devinfo)
- {
--	if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1)
--		pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_INTMASK,
--				       BRCMF_PCIE_INT_DEF);
--	else
--		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK,
--				       BRCMF_PCIE_MB_INT_D2H_DB |
--				       BRCMF_PCIE_MB_INT_FN0_0 |
--				       BRCMF_PCIE_MB_INT_FN0_1);
-+	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXMASK,
-+			       BRCMF_PCIE_MB_INT_D2H_DB |
-+			       BRCMF_PCIE_MB_INT_FN0_0 |
-+			       BRCMF_PCIE_MB_INT_FN0_1);
- }
- 
- 
--static irqreturn_t brcmf_pcie_quick_check_isr_v1(int irq, void *arg)
--{
--	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
--	u32 status;
--
--	status = 0;
--	pci_read_config_dword(devinfo->pdev, BRCMF_PCIE_REG_INTSTATUS, &status);
--	if (status) {
--		brcmf_pcie_intr_disable(devinfo);
--		brcmf_dbg(PCIE, "Enter\n");
--		return IRQ_WAKE_THREAD;
--	}
--	return IRQ_NONE;
--}
--
--
--static irqreturn_t brcmf_pcie_quick_check_isr_v2(int irq, void *arg)
-+static irqreturn_t brcmf_pcie_quick_check_isr(int irq, void *arg)
- {
- 	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
- 
-@@ -820,29 +769,7 @@ static irqreturn_t brcmf_pcie_quick_chec
- }
- 
- 
--static irqreturn_t brcmf_pcie_isr_thread_v1(int irq, void *arg)
--{
--	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
--	const struct pci_dev *pdev = devinfo->pdev;
--	u32 status;
--
--	devinfo->in_irq = true;
--	status = 0;
--	pci_read_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, &status);
--	brcmf_dbg(PCIE, "Enter %x\n", status);
--	if (status) {
--		pci_write_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, status);
--		if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
--			brcmf_proto_msgbuf_rx_trigger(&devinfo->pdev->dev);
--	}
--	if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
--		brcmf_pcie_intr_enable(devinfo);
--	devinfo->in_irq = false;
--	return IRQ_HANDLED;
--}
--
--
--static irqreturn_t brcmf_pcie_isr_thread_v2(int irq, void *arg)
-+static irqreturn_t brcmf_pcie_isr_thread(int irq, void *arg)
- {
- 	struct brcmf_pciedev_info *devinfo = (struct brcmf_pciedev_info *)arg;
- 	u32 status;
-@@ -879,28 +806,14 @@ static int brcmf_pcie_request_irq(struct
- 	brcmf_pcie_intr_disable(devinfo);
- 
- 	brcmf_dbg(PCIE, "Enter\n");
--	/* is it a v1 or v2 implementation */
-+
- 	pci_enable_msi(pdev);
--	if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1) {
--		if (request_threaded_irq(pdev->irq,
--					 brcmf_pcie_quick_check_isr_v1,
--					 brcmf_pcie_isr_thread_v1,
--					 IRQF_SHARED, "brcmf_pcie_intr",
--					 devinfo)) {
--			pci_disable_msi(pdev);
--			brcmf_err("Failed to request IRQ %d\n", pdev->irq);
--			return -EIO;
--		}
--	} else {
--		if (request_threaded_irq(pdev->irq,
--					 brcmf_pcie_quick_check_isr_v2,
--					 brcmf_pcie_isr_thread_v2,
--					 IRQF_SHARED, "brcmf_pcie_intr",
--					 devinfo)) {
--			pci_disable_msi(pdev);
--			brcmf_err("Failed to request IRQ %d\n", pdev->irq);
--			return -EIO;
--		}
-+	if (request_threaded_irq(pdev->irq, brcmf_pcie_quick_check_isr,
-+				 brcmf_pcie_isr_thread, IRQF_SHARED,
-+				 "brcmf_pcie_intr", devinfo)) {
-+		pci_disable_msi(pdev);
-+		brcmf_err("Failed to request IRQ %d\n", pdev->irq);
-+		return -EIO;
- 	}
- 	devinfo->irq_allocated = true;
- 	return 0;
-@@ -931,16 +844,9 @@ static void brcmf_pcie_release_irq(struc
- 	if (devinfo->in_irq)
- 		brcmf_err("Still in IRQ (processing) !!!\n");
- 
--	if (devinfo->generic_corerev == BRCMF_PCIE_GENREV1) {
--		status = 0;
--		pci_read_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, &status);
--		pci_write_config_dword(pdev, BRCMF_PCIE_REG_INTSTATUS, status);
--	} else {
--		status = brcmf_pcie_read_reg32(devinfo,
--					       BRCMF_PCIE_PCIE2REG_MAILBOXINT);
--		brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT,
--				       status);
--	}
-+	status = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT);
-+	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT, status);
-+
- 	devinfo->irq_allocated = false;
- }
- 
-@@ -989,7 +895,9 @@ static int brcmf_pcie_ring_mb_ring_bell(
- 	if (devinfo->state != BRCMFMAC_PCIE_STATE_UP)
- 		return -EIO;
- 
--	devinfo->ringbell(devinfo);
-+	brcmf_dbg(PCIE, "RING !\n");
-+	/* Any arbitrary value will do, lets use 1 */
-+	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
- 
- 	return 0;
- }
-@@ -1503,9 +1411,6 @@ static int brcmf_pcie_download_fw_nvram(
- 	u32 address;
- 	u32 resetintr;
- 
--	devinfo->ringbell = brcmf_pcie_ringbell_v2;
--	devinfo->generic_corerev = BRCMF_PCIE_GENREV2;
--
- 	brcmf_dbg(PCIE, "Halt ARM.\n");
- 	err = brcmf_pcie_enter_download_state(devinfo);
- 	if (err)
diff --git a/package/kernel/mac80211/patches/344-0012-brcmfmac-increase-timeout-for-tx-eapol.patch b/package/kernel/mac80211/patches/344-0012-brcmfmac-increase-timeout-for-tx-eapol.patch
deleted file mode 100644
index 4adfc2dc64..0000000000
--- a/package/kernel/mac80211/patches/344-0012-brcmfmac-increase-timeout-for-tx-eapol.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:01 +0100
-Subject: [PATCH] brcmfmac: increase timeout for tx eapol
-
-When keys get set and updated this has to happen after eapol got
-transmitted (without key or old key) before the key can be updated.
-To make sure the order of sending eapol and configuring key is done
-correctly a timeout for tx of eapol is applied. This timeout is set
-to 50 msec, which is not always enough. Especially in AP mode and
-key updates the timeout may need to be much longer because client(s)
-can be in powersave. Increase the timeout from 50 to 950 msec.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -42,7 +42,7 @@ MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
- MODULE_LICENSE("Dual BSD/GPL");
- 
--#define MAX_WAIT_FOR_8021X_TX			msecs_to_jiffies(50)
-+#define MAX_WAIT_FOR_8021X_TX			msecs_to_jiffies(950)
- 
- /* AMPDU rx reordering definitions */
- #define BRCMF_RXREORDER_FLOWID_OFFSET		0
diff --git a/package/kernel/mac80211/patches/344-0013-brcmfmac-move-module-init-and-exit-to-common.patch b/package/kernel/mac80211/patches/344-0013-brcmfmac-move-module-init-and-exit-to-common.patch
deleted file mode 100644
index bd62781188..0000000000
--- a/package/kernel/mac80211/patches/344-0013-brcmfmac-move-module-init-and-exit-to-common.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:02 +0100
-Subject: [PATCH] brcmfmac: move module init and exit to common
-
-In preparation of module parameters for all devices the module init
-and exit routines are moved to the common file.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -28,6 +28,10 @@
- #include "tracepoint.h"
- #include "common.h"
- 
-+MODULE_AUTHOR("Broadcom Corporation");
-+MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-+MODULE_LICENSE("Dual BSD/GPL");
-+
- const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
- 
- #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME	40
-@@ -221,7 +225,7 @@ void __brcmf_dbg(u32 level, const char *
- }
- #endif
- 
--void brcmf_mp_attach(void)
-+static void brcmf_mp_attach(void)
- {
- 	strlcpy(brcmf_mp_global.firmware_path, brcmf_firmware_path,
- 		BRCMF_FW_ALTPATH_LEN);
-@@ -249,3 +253,33 @@ void brcmf_mp_device_detach(struct brcmf
- 	kfree(drvr->settings);
- }
- 
-+static int __init brcmfmac_module_init(void)
-+{
-+	int err;
-+
-+	/* Initialize debug system first */
-+	brcmf_debugfs_init();
-+
-+#ifdef CPTCFG_BRCMFMAC_SDIO
-+	brcmf_sdio_init();
-+#endif
-+	/* Initialize global module paramaters */
-+	brcmf_mp_attach();
-+
-+	/* Continue the initialization by registering the different busses */
-+	err = brcmf_core_init();
-+	if (err)
-+		brcmf_debugfs_exit();
-+
-+	return err;
-+}
-+
-+static void __exit brcmfmac_module_exit(void)
-+{
-+	brcmf_core_exit();
-+	brcmf_debugfs_exit();
-+}
-+
-+module_init(brcmfmac_module_init);
-+module_exit(brcmfmac_module_exit);
-+
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -89,7 +89,6 @@ struct brcmf_mp_device {
- 	struct cc_translate *country_codes;
- };
- 
--void brcmf_mp_attach(void);
- int brcmf_mp_device_attach(struct brcmf_pub *drvr);
- void brcmf_mp_device_detach(struct brcmf_pub *drvr);
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -38,10 +38,6 @@
- #include "pcie.h"
- #include "common.h"
- 
--MODULE_AUTHOR("Broadcom Corporation");
--MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
--MODULE_LICENSE("Dual BSD/GPL");
--
- #define MAX_WAIT_FOR_8021X_TX			msecs_to_jiffies(950)
- 
- /* AMPDU rx reordering definitions */
-@@ -1422,19 +1418,15 @@ static void brcmf_driver_register(struct
- }
- static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register);
- 
--static int __init brcmfmac_module_init(void)
-+int __init brcmf_core_init(void)
- {
--	brcmf_debugfs_init();
--#ifdef CPTCFG_BRCMFMAC_SDIO
--	brcmf_sdio_init();
--#endif
- 	if (!schedule_work(&brcmf_driver_work))
- 		return -EBUSY;
- 
- 	return 0;
- }
- 
--static void __exit brcmfmac_module_exit(void)
-+void __exit brcmf_core_exit(void)
- {
- 	cancel_work_sync(&brcmf_driver_work);
- 
-@@ -1447,8 +1439,5 @@ static void __exit brcmfmac_module_exit(
- #ifdef CPTCFG_BRCMFMAC_PCIE
- 	brcmf_pcie_exit();
- #endif
--	brcmf_debugfs_exit();
- }
- 
--module_init(brcmfmac_module_init);
--module_exit(brcmfmac_module_exit);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -227,5 +227,7 @@ void brcmf_txflowblock_if(struct brcmf_i
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
- void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
-+int __init brcmf_core_init(void);
-+void __exit brcmf_core_exit(void);
- 
- #endif /* BRCMFMAC_CORE_H */
diff --git a/package/kernel/mac80211/patches/344-0014-brcmfmac-add-wowl-gtk-rekeying-offload-support.patch b/package/kernel/mac80211/patches/344-0014-brcmfmac-add-wowl-gtk-rekeying-offload-support.patch
deleted file mode 100644
index 577ca8ed28..0000000000
--- a/package/kernel/mac80211/patches/344-0014-brcmfmac-add-wowl-gtk-rekeying-offload-support.patch
+++ /dev/null
@@ -1,260 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:03 +0100
-Subject: [PATCH] brcmfmac: add wowl gtk rekeying offload support
-
-This patch adds support for gtk rekeying offload and for gtk
-rekeying failure during wowl mode.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3526,6 +3526,10 @@ static void brcmf_report_wowl_wakeind(st
- 			else
- 				wakeup_data.net_detect = cfg->wowl.nd_info;
- 		}
-+		if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
-+			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
-+			wakeup_data.gtk_rekey_failure = true;
-+		}
- 	} else {
- 		wakeup = NULL;
- 	}
-@@ -3607,6 +3611,8 @@ static void brcmf_configure_wowl(struct
- 		brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
- 				    brcmf_wowl_nd_results);
- 	}
-+	if (wowl->gtk_rekey_failure)
-+		wowl_config |= BRCMF_WOWL_GTK_FAILURE;
- 	if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
- 		wowl_config |= BRCMF_WOWL_UNASSOC;
- 
-@@ -4874,7 +4880,32 @@ static int brcmf_cfg80211_tdls_oper(stru
- 	return ret;
- }
- 
--static struct cfg80211_ops wl_cfg80211_ops = {
-+#ifdef CONFIG_PM
-+static int
-+brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
-+			      struct cfg80211_gtk_rekey_data *gtk)
-+{
-+	struct brcmf_if *ifp = netdev_priv(ndev);
-+	struct brcmf_gtk_keyinfo_le gtk_le;
-+	int ret;
-+
-+	brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
-+
-+	memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
-+	memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
-+	memcpy(gtk_le.replay_counter, gtk->replay_ctr,
-+	       sizeof(gtk_le.replay_counter));
-+
-+	ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
-+				       sizeof(gtk_le));
-+	if (ret < 0)
-+		brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
-+
-+	return ret;
-+}
-+#endif
-+
-+static struct cfg80211_ops brcmf_cfg80211_ops = {
- 	.add_virtual_intf = brcmf_cfg80211_add_iface,
- 	.del_virtual_intf = brcmf_cfg80211_del_iface,
- 	.change_virtual_intf = brcmf_cfg80211_change_iface,
-@@ -6139,19 +6170,18 @@ static void brcmf_wiphy_wowl_params(stru
- {
- #ifdef CONFIG_PM
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	s32 err;
--	u32 wowl_cap;
- 
- 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
--		err = brcmf_fil_iovar_int_get(ifp, "wowl_cap", &wowl_cap);
--		if (!err) {
--			if (wowl_cap & BRCMF_WOWL_PFN_FOUND) {
--				brcmf_wowlan_support.flags |=
--							WIPHY_WOWLAN_NET_DETECT;
--				init_waitqueue_head(&cfg->wowl.nd_data_wait);
--			}
-+		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
-+			brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
-+			init_waitqueue_head(&cfg->wowl.nd_data_wait);
- 		}
- 	}
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
-+		brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
-+		brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
-+	}
-+
- 	wiphy->wowlan = &brcmf_wowlan_support;
- #endif
- }
-@@ -6538,6 +6568,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
- 	struct brcmf_cfg80211_info *cfg;
- 	struct wiphy *wiphy;
-+	struct cfg80211_ops *ops;
- 	struct brcmf_cfg80211_vif *vif;
- 	struct brcmf_if *ifp;
- 	s32 err = 0;
-@@ -6549,8 +6580,17 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		return NULL;
- 	}
- 
-+	ops = kzalloc(sizeof(*ops), GFP_KERNEL);
-+	if (!ops)
-+		return NULL;
-+
-+	memcpy(ops, &brcmf_cfg80211_ops, sizeof(*ops));
- 	ifp = netdev_priv(ndev);
--	wiphy = wiphy_new(&wl_cfg80211_ops, sizeof(struct brcmf_cfg80211_info));
-+#ifdef CONFIG_PM
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
-+		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
-+#endif
-+	wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
- 	if (!wiphy) {
- 		brcmf_err("Could not allocate wiphy device\n");
- 		return NULL;
-@@ -6560,6 +6600,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 
- 	cfg = wiphy_priv(wiphy);
- 	cfg->wiphy = wiphy;
-+	cfg->ops = ops;
- 	cfg->pub = drvr;
- 	init_vif_event(&cfg->vif_event);
- 	INIT_LIST_HEAD(&cfg->vif_list);
-@@ -6686,6 +6727,7 @@ priv_out:
- 	ifp->vif = NULL;
- wiphy_out:
- 	brcmf_free_wiphy(wiphy);
-+	kfree(ops);
- 	return NULL;
- }
- 
-@@ -6696,6 +6738,7 @@ void brcmf_cfg80211_detach(struct brcmf_
- 
- 	brcmf_btcoex_detach(cfg);
- 	wiphy_unregister(cfg->wiphy);
-+	kfree(cfg->ops);
- 	wl_deinit_priv(cfg);
- 	brcmf_free_wiphy(cfg->wiphy);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -256,6 +256,7 @@ struct brcmf_cfg80211_wowl {
-  * struct brcmf_cfg80211_info - dongle private data of cfg80211 interface
-  *
-  * @wiphy: wiphy object for cfg80211 interface.
-+ * @ops: pointer to copy of ops as registered with wiphy object.
-  * @conf: dongle configuration.
-  * @p2p: peer-to-peer specific information.
-  * @btcoex: Bluetooth coexistence information.
-@@ -288,6 +289,7 @@ struct brcmf_cfg80211_wowl {
-  */
- struct brcmf_cfg80211_info {
- 	struct wiphy *wiphy;
-+	struct cfg80211_ops *ops;
- 	struct brcmf_cfg80211_conf *conf;
- 	struct brcmf_p2p_info p2p;
- 	struct brcmf_btcoex_info *btcoex;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -136,6 +136,7 @@ void brcmf_feat_attach(struct brcmf_pub
- {
- 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
- 	struct brcmf_pno_macaddr_le pfn_mac;
-+	u32 wowl_cap;
- 	s32 err;
- 
- 	brcmf_feat_firmware_capabilities(ifp);
-@@ -143,6 +144,17 @@ void brcmf_feat_attach(struct brcmf_pub
- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
- 	if (drvr->bus_if->wowl_supported)
- 		brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL)) {
-+		err = brcmf_fil_iovar_int_get(ifp, "wowl_cap", &wowl_cap);
-+		if (!err) {
-+			if (wowl_cap & BRCMF_WOWL_PFN_FOUND)
-+				ifp->drvr->feat_flags |=
-+					BIT(BRCMF_FEAT_WOWL_ND);
-+			if (wowl_cap & BRCMF_WOWL_GTK_FAILURE)
-+				ifp->drvr->feat_flags |=
-+					BIT(BRCMF_FEAT_WOWL_GTK);
-+		}
-+	}
- 	/* MBSS does not work for 43362 */
- 	if (drvr->bus_if->chip == BRCM_CC_43362_CHIP_ID)
- 		ifp->drvr->feat_flags &= ~BIT(BRCMF_FEAT_MBSS);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -27,6 +27,8 @@
-  * RSDB: Real Simultaneous Dual Band
-  * TDLS: Tunneled Direct Link Setup
-  * SCAN_RANDOM_MAC: Random MAC during (net detect) scheduled scan.
-+ * WOWL_ND: WOWL net detect (PNO)
-+ * WOWL_GTK: (WOWL) GTK rekeying offload
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -36,7 +38,9 @@
- 	BRCMF_FEAT_DEF(P2P) \
- 	BRCMF_FEAT_DEF(RSDB) \
- 	BRCMF_FEAT_DEF(TDLS) \
--	BRCMF_FEAT_DEF(SCAN_RANDOM_MAC)
-+	BRCMF_FEAT_DEF(SCAN_RANDOM_MAC) \
-+	BRCMF_FEAT_DEF(WOWL_ND) \
-+	BRCMF_FEAT_DEF(WOWL_GTK)
- 
- /*
-  * Quirks:
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -111,7 +111,9 @@
- /* Wakeup if received matched secured pattern: */
- #define BRCMF_WOWL_SECURE		(1 << 25)
- /* Wakeup on finding preferred network */
--#define BRCMF_WOWL_PFN_FOUND		(1 << 26)
-+#define BRCMF_WOWL_PFN_FOUND		(1 << 27)
-+/* Wakeup on receiving pairwise key EAP packets: */
-+#define WIPHY_WOWL_EAP_PK		(1 << 28)
- /* Link Down indication in WoWL mode: */
- #define BRCMF_WOWL_LINKDOWN		(1 << 31)
- 
-@@ -136,6 +138,10 @@
- 
- #define BRCMF_MCSSET_LEN		16
- 
-+#define BRCMF_RSN_KCK_LENGTH		16
-+#define BRCMF_RSN_KEK_LENGTH		16
-+#define BRCMF_RSN_REPLAY_LEN		8
-+
- /* join preference types for join_pref iovar */
- enum brcmf_join_pref_types {
- 	BRCMF_JOIN_PREF_RSSI = 1,
-@@ -789,4 +795,17 @@ struct brcmf_pktcnt_le {
- 	__le32 rx_ocast_good_pkt;
- };
- 
-+/**
-+ * struct brcmf_gtk_keyinfo_le - GTP rekey data
-+ *
-+ * @kck: key confirmation key.
-+ * @kek: key encryption key.
-+ * @replay_counter: replay counter.
-+ */
-+struct brcmf_gtk_keyinfo_le {
-+	u8 kck[BRCMF_RSN_KCK_LENGTH];
-+	u8 kek[BRCMF_RSN_KEK_LENGTH];
-+	u8 replay_counter[BRCMF_RSN_REPLAY_LEN];
-+};
-+
- #endif /* FWIL_TYPES_H_ */
diff --git a/package/kernel/mac80211/patches/344-0015-brcmfmac-move-platform-data-retrieval-code-to-common.patch b/package/kernel/mac80211/patches/344-0015-brcmfmac-move-platform-data-retrieval-code-to-common.patch
deleted file mode 100644
index 2685238925..0000000000
--- a/package/kernel/mac80211/patches/344-0015-brcmfmac-move-platform-data-retrieval-code-to-common.patch
+++ /dev/null
@@ -1,385 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:04 +0100
-Subject: [PATCH] brcmfmac: move platform data retrieval code to common
-
-In preparation of module parameters for all devices the module
-platform data retrieval is moved from sdio to common. It is still
-only used for sdio devices.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -27,8 +27,6 @@
- #include <linux/mmc/sdio_func.h>
- #include <linux/mmc/card.h>
- #include <linux/mmc/host.h>
--#include <linux/platform_device.h>
--#include <linux/platform_data/brcmfmac-sdio.h>
- #include <linux/pm_runtime.h>
- #include <linux/suspend.h>
- #include <linux/errno.h>
-@@ -46,7 +44,6 @@
- #include "bus.h"
- #include "debug.h"
- #include "sdio.h"
--#include "of.h"
- #include "core.h"
- #include "common.h"
- 
-@@ -106,18 +103,18 @@ static void brcmf_sdiod_dummy_irqhandler
- 
- int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
- {
-+	struct brcmfmac_sdio_platform_data *pdata;
- 	int ret = 0;
- 	u8 data;
- 	u32 addr, gpiocontrol;
- 	unsigned long flags;
- 
--	if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
-+	pdata = sdiodev->pdata;
-+	if ((pdata) && (pdata->oob_irq_supported)) {
- 		brcmf_dbg(SDIO, "Enter, register OOB IRQ %d\n",
--			  sdiodev->pdata->oob_irq_nr);
--		ret = request_irq(sdiodev->pdata->oob_irq_nr,
--				  brcmf_sdiod_oob_irqhandler,
--				  sdiodev->pdata->oob_irq_flags,
--				  "brcmf_oob_intr",
-+			  pdata->oob_irq_nr);
-+		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
-+				  pdata->oob_irq_flags, "brcmf_oob_intr",
- 				  &sdiodev->func[1]->dev);
- 		if (ret != 0) {
- 			brcmf_err("request_irq failed %d\n", ret);
-@@ -129,7 +126,7 @@ int brcmf_sdiod_intr_register(struct brc
- 		sdiodev->irq_en = true;
- 		spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
- 
--		ret = enable_irq_wake(sdiodev->pdata->oob_irq_nr);
-+		ret = enable_irq_wake(pdata->oob_irq_nr);
- 		if (ret != 0) {
- 			brcmf_err("enable_irq_wake failed %d\n", ret);
- 			return ret;
-@@ -158,7 +155,7 @@ int brcmf_sdiod_intr_register(struct brc
- 
- 		/* redirect, configure and enable io for interrupt signal */
- 		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
--		if (sdiodev->pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
-+		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
- 			data |= SDIO_SEPINT_ACT_HI;
- 		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
- 
-@@ -176,9 +173,12 @@ int brcmf_sdiod_intr_register(struct brc
- 
- int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev)
- {
-+	struct brcmfmac_sdio_platform_data *pdata;
-+
- 	brcmf_dbg(SDIO, "Entering\n");
- 
--	if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
-+	pdata = sdiodev->pdata;
-+	if ((pdata) && (pdata->oob_irq_supported)) {
- 		sdio_claim_host(sdiodev->func[1]);
- 		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
- 		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
-@@ -187,11 +187,10 @@ int brcmf_sdiod_intr_unregister(struct b
- 		if (sdiodev->oob_irq_requested) {
- 			sdiodev->oob_irq_requested = false;
- 			if (sdiodev->irq_wake) {
--				disable_irq_wake(sdiodev->pdata->oob_irq_nr);
-+				disable_irq_wake(pdata->oob_irq_nr);
- 				sdiodev->irq_wake = false;
- 			}
--			free_irq(sdiodev->pdata->oob_irq_nr,
--				 &sdiodev->func[1]->dev);
-+			free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
- 			sdiodev->irq_en = false;
- 		}
- 	} else {
-@@ -1103,8 +1102,6 @@ static const struct sdio_device_id brcmf
- };
- MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
- 
--static struct brcmfmac_sdio_platform_data *brcmfmac_sdio_pdata;
--
- 
- static void brcmf_sdiod_acpi_set_power_manageable(struct device *dev,
- 						  int val)
-@@ -1167,10 +1164,7 @@ static int brcmf_ops_sdio_probe(struct s
- 	dev_set_drvdata(&func->dev, bus_if);
- 	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
- 	sdiodev->dev = &sdiodev->func[1]->dev;
--	sdiodev->pdata = brcmfmac_sdio_pdata;
--
--	if (!sdiodev->pdata)
--		brcmf_of_probe(sdiodev);
-+	sdiodev->pdata = brcmf_get_module_param(sdiodev->dev);
- 
- #ifdef CONFIG_PM_SLEEP
- 	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
-@@ -1296,7 +1290,7 @@ static const struct dev_pm_ops brcmf_sdi
- static struct sdio_driver brcmf_sdmmc_driver = {
- 	.probe = brcmf_ops_sdio_probe,
- 	.remove = brcmf_ops_sdio_remove,
--	.name = BRCMFMAC_SDIO_PDATA_NAME,
-+	.name = KBUILD_MODNAME,
- 	.id_table = brcmf_sdmmc_ids,
- 	.drv = {
- 		.owner = THIS_MODULE,
-@@ -1306,37 +1300,6 @@ static struct sdio_driver brcmf_sdmmc_dr
- 	},
- };
- 
--static int __init brcmf_sdio_pd_probe(struct platform_device *pdev)
--{
--	brcmf_dbg(SDIO, "Enter\n");
--
--	brcmfmac_sdio_pdata = dev_get_platdata(&pdev->dev);
--
--	if (brcmfmac_sdio_pdata->power_on)
--		brcmfmac_sdio_pdata->power_on();
--
--	return 0;
--}
--
--static int brcmf_sdio_pd_remove(struct platform_device *pdev)
--{
--	brcmf_dbg(SDIO, "Enter\n");
--
--	if (brcmfmac_sdio_pdata->power_off)
--		brcmfmac_sdio_pdata->power_off();
--
--	sdio_unregister_driver(&brcmf_sdmmc_driver);
--
--	return 0;
--}
--
--static struct platform_driver brcmf_sdio_pd = {
--	.remove		= brcmf_sdio_pd_remove,
--	.driver		= {
--		.name	= BRCMFMAC_SDIO_PDATA_NAME,
--	}
--};
--
- void brcmf_sdio_register(void)
- {
- 	int ret;
-@@ -1350,19 +1313,6 @@ void brcmf_sdio_exit(void)
- {
- 	brcmf_dbg(SDIO, "Enter\n");
- 
--	if (brcmfmac_sdio_pdata)
--		platform_driver_unregister(&brcmf_sdio_pd);
--	else
--		sdio_unregister_driver(&brcmf_sdmmc_driver);
-+	sdio_unregister_driver(&brcmf_sdmmc_driver);
- }
- 
--void __init brcmf_sdio_init(void)
--{
--	int ret;
--
--	brcmf_dbg(SDIO, "Enter\n");
--
--	ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
--	if (ret == -ENODEV)
--		brcmf_dbg(SDIO, "No platform data available.\n");
--}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -27,6 +27,7 @@
- #include "fwil_types.h"
- #include "tracepoint.h"
- #include "common.h"
-+#include "of.h"
- 
- MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-@@ -79,6 +80,7 @@ module_param_named(ignore_probe_fail, br
- MODULE_PARM_DESC(ignore_probe_fail, "always succeed probe for debugging");
- #endif
- 
-+static struct brcmfmac_sdio_platform_data *brcmfmac_pdata;
- struct brcmf_mp_global_t brcmf_mp_global;
- 
- int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
-@@ -231,6 +233,13 @@ static void brcmf_mp_attach(void)
- 		BRCMF_FW_ALTPATH_LEN);
- }
- 
-+struct brcmfmac_sdio_platform_data *brcmf_get_module_param(struct device *dev)
-+{
-+	if (!brcmfmac_pdata)
-+		brcmf_of_probe(dev, &brcmfmac_pdata);
-+	return brcmfmac_pdata;
-+}
-+
- int brcmf_mp_device_attach(struct brcmf_pub *drvr)
- {
- 	drvr->settings = kzalloc(sizeof(*drvr->settings), GFP_ATOMIC);
-@@ -253,6 +262,35 @@ void brcmf_mp_device_detach(struct brcmf
- 	kfree(drvr->settings);
- }
- 
-+static int __init brcmf_common_pd_probe(struct platform_device *pdev)
-+{
-+	brcmf_dbg(INFO, "Enter\n");
-+
-+	brcmfmac_pdata = dev_get_platdata(&pdev->dev);
-+
-+	if (brcmfmac_pdata->power_on)
-+		brcmfmac_pdata->power_on();
-+
-+	return 0;
-+}
-+
-+static int brcmf_common_pd_remove(struct platform_device *pdev)
-+{
-+	brcmf_dbg(INFO, "Enter\n");
-+
-+	if (brcmfmac_pdata->power_off)
-+		brcmfmac_pdata->power_off();
-+
-+	return 0;
-+}
-+
-+static struct platform_driver brcmf_pd = {
-+	.remove		= brcmf_common_pd_remove,
-+	.driver		= {
-+		.name	= BRCMFMAC_SDIO_PDATA_NAME,
-+	}
-+};
-+
- static int __init brcmfmac_module_init(void)
- {
- 	int err;
-@@ -260,16 +298,21 @@ static int __init brcmfmac_module_init(v
- 	/* Initialize debug system first */
- 	brcmf_debugfs_init();
- 
--#ifdef CPTCFG_BRCMFMAC_SDIO
--	brcmf_sdio_init();
--#endif
-+	/* Get the platform data (if available) for our devices */
-+	err = platform_driver_probe(&brcmf_pd, brcmf_common_pd_probe);
-+	if (err == -ENODEV)
-+		brcmf_dbg(INFO, "No platform data available.\n");
-+
- 	/* Initialize global module paramaters */
- 	brcmf_mp_attach();
- 
- 	/* Continue the initialization by registering the different busses */
- 	err = brcmf_core_init();
--	if (err)
-+	if (err) {
- 		brcmf_debugfs_exit();
-+		if (brcmfmac_pdata)
-+			platform_driver_unregister(&brcmf_pd);
-+	}
- 
- 	return err;
- }
-@@ -277,6 +320,8 @@ static int __init brcmfmac_module_init(v
- static void __exit brcmfmac_module_exit(void)
- {
- 	brcmf_core_exit();
-+	if (brcmfmac_pdata)
-+		platform_driver_unregister(&brcmf_pd);
- 	brcmf_debugfs_exit();
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -15,6 +15,8 @@
- #ifndef BRCMFMAC_COMMON_H
- #define BRCMFMAC_COMMON_H
- 
-+#include <linux/platform_device.h>
-+#include <linux/platform_data/brcmfmac-sdio.h>
- #include "fwil_types.h"
- 
- extern const u8 ALLFFMAC[ETH_ALEN];
-@@ -89,6 +91,7 @@ struct brcmf_mp_device {
- 	struct cc_translate *country_codes;
- };
- 
-+struct brcmfmac_sdio_platform_data *brcmf_get_module_param(struct device *dev);
- int brcmf_mp_device_attach(struct brcmf_pub *drvr);
- void brcmf_mp_device_detach(struct brcmf_pub *drvr);
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -16,17 +16,16 @@
- #include <linux/init.h>
- #include <linux/of.h>
- #include <linux/of_irq.h>
--#include <linux/mmc/card.h>
--#include <linux/platform_data/brcmfmac-sdio.h>
--#include <linux/mmc/sdio_func.h>
- 
- #include <defs.h>
- #include "debug.h"
--#include "sdio.h"
-+#include "core.h"
-+#include "common.h"
-+#include "of.h"
- 
--void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
-+void
-+brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_platform_data **sdio)
- {
--	struct device *dev = sdiodev->dev;
- 	struct device_node *np = dev->of_node;
- 	int irq;
- 	u32 irqf;
-@@ -35,12 +34,12 @@ void brcmf_of_probe(struct brcmf_sdio_de
- 	if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
- 		return;
- 
--	sdiodev->pdata = devm_kzalloc(dev, sizeof(*sdiodev->pdata), GFP_KERNEL);
--	if (!sdiodev->pdata)
-+	*sdio = devm_kzalloc(dev, sizeof(*sdio), GFP_KERNEL);
-+	if (!(*sdio))
- 		return;
- 
- 	if (of_property_read_u32(np, "brcm,drive-strength", &val) == 0)
--		sdiodev->pdata->drive_strength = val;
-+		(*sdio)->drive_strength = val;
- 
- 	/* make sure there are interrupts defined in the node */
- 	if (!of_find_property(np, "interrupts", NULL))
-@@ -53,7 +52,7 @@ void brcmf_of_probe(struct brcmf_sdio_de
- 	}
- 	irqf = irqd_get_trigger_type(irq_get_irq_data(irq));
- 
--	sdiodev->pdata->oob_irq_supported = true;
--	sdiodev->pdata->oob_irq_nr = irq;
--	sdiodev->pdata->oob_irq_flags = irqf;
-+	(*sdio)->oob_irq_supported = true;
-+	(*sdio)->oob_irq_nr = irq;
-+	(*sdio)->oob_irq_flags = irqf;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-@@ -14,9 +14,11 @@
-  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifdef CONFIG_OF
--void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev);
-+void
-+brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_platform_data **sdio);
- #else
--static void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
-+static void brcmf_of_probe(struct device *dev,
-+			   struct brcmfmac_sdio_platform_data **sdio)
- {
- }
- #endif /* CONFIG_OF */
diff --git a/package/kernel/mac80211/patches/344-0016-brcmfmac-keep-ARP-and-ND-offload-enabled-during-WOWL.patch b/package/kernel/mac80211/patches/344-0016-brcmfmac-keep-ARP-and-ND-offload-enabled-during-WOWL.patch
deleted file mode 100644
index 4e789cfc5a..0000000000
--- a/package/kernel/mac80211/patches/344-0016-brcmfmac-keep-ARP-and-ND-offload-enabled-during-WOWL.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:05 +0100
-Subject: [PATCH] brcmfmac: keep ARP and ND offload enabled during WOWL
-
-Currently ARP and ND (IPv6 Neigbor Discovery) offload get disabled
-on entering suspend. However when firmwares support the wowl_cap
-iovar then these offload routines can be kept enabled as they
-will work during WOWL as well.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3556,7 +3556,8 @@ static s32 brcmf_cfg80211_resume(struct
- 		brcmf_report_wowl_wakeind(wiphy, ifp);
- 		brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
- 		brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
--		brcmf_configure_arp_nd_offload(ifp, true);
-+		if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
-+			brcmf_configure_arp_nd_offload(ifp, true);
- 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
- 				      cfg->wowl.pre_pmmode);
- 		cfg->wowl.active = false;
-@@ -3580,7 +3581,8 @@ static void brcmf_configure_wowl(struct
- 
- 	brcmf_dbg(TRACE, "Suspend, wowl config.\n");
- 
--	brcmf_configure_arp_nd_offload(ifp, false);
-+	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
-+		brcmf_configure_arp_nd_offload(ifp, false);
- 	brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
- 	brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -147,6 +147,7 @@ void brcmf_feat_attach(struct brcmf_pub
- 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL)) {
- 		err = brcmf_fil_iovar_int_get(ifp, "wowl_cap", &wowl_cap);
- 		if (!err) {
-+			ifp->drvr->feat_flags |= BIT(BRCMF_FEAT_WOWL_ARP_ND);
- 			if (wowl_cap & BRCMF_WOWL_PFN_FOUND)
- 				ifp->drvr->feat_flags |=
- 					BIT(BRCMF_FEAT_WOWL_ND);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -29,6 +29,7 @@
-  * SCAN_RANDOM_MAC: Random MAC during (net detect) scheduled scan.
-  * WOWL_ND: WOWL net detect (PNO)
-  * WOWL_GTK: (WOWL) GTK rekeying offload
-+ * WOWL_ARP_ND: ARP and Neighbor Discovery offload support during WOWL.
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -40,7 +41,8 @@
- 	BRCMF_FEAT_DEF(TDLS) \
- 	BRCMF_FEAT_DEF(SCAN_RANDOM_MAC) \
- 	BRCMF_FEAT_DEF(WOWL_ND) \
--	BRCMF_FEAT_DEF(WOWL_GTK)
-+	BRCMF_FEAT_DEF(WOWL_GTK) \
-+	BRCMF_FEAT_DEF(WOWL_ARP_ND)
- 
- /*
-  * Quirks:
diff --git a/package/kernel/mac80211/patches/344-0017-brcmfmac-switch-to-new-platform-data.patch b/package/kernel/mac80211/patches/344-0017-brcmfmac-switch-to-new-platform-data.patch
deleted file mode 100644
index 37b68552cc..0000000000
--- a/package/kernel/mac80211/patches/344-0017-brcmfmac-switch-to-new-platform-data.patch
+++ /dev/null
@@ -1,734 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:07 +0100
-Subject: [PATCH] brcmfmac: switch to new platform data
-
-Platform data is only available for sdio. With this patch a new
-platform data structure is being used which allows for platform
-data for any device and configurable per device. This patch only
-switches to the new structure and adds support for SDIO devices.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -103,7 +103,7 @@ static void brcmf_sdiod_dummy_irqhandler
- 
- int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
- {
--	struct brcmfmac_sdio_platform_data *pdata;
-+	struct brcmfmac_sdio_pd *pdata;
- 	int ret = 0;
- 	u8 data;
- 	u32 addr, gpiocontrol;
-@@ -173,7 +173,7 @@ int brcmf_sdiod_intr_register(struct brc
- 
- int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev)
- {
--	struct brcmfmac_sdio_platform_data *pdata;
-+	struct brcmfmac_sdio_pd *pdata;
- 
- 	brcmf_dbg(SDIO, "Entering\n");
- 
-@@ -1164,17 +1164,6 @@ static int brcmf_ops_sdio_probe(struct s
- 	dev_set_drvdata(&func->dev, bus_if);
- 	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
- 	sdiodev->dev = &sdiodev->func[1]->dev;
--	sdiodev->pdata = brcmf_get_module_param(sdiodev->dev);
--
--#ifdef CONFIG_PM_SLEEP
--	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
--	 * is true or when platform data OOB irq is true).
--	 */
--	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
--	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
--	     (sdiodev->pdata && sdiodev->pdata->oob_irq_supported)))
--		bus_if->wowl_supported = true;
--#endif
- 
- 	brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6459,8 +6459,8 @@ int brcmf_cfg80211_wait_vif_event(struct
- static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
- 					struct brcmf_fil_country_le *ccreq)
- {
--	struct cc_translate *country_codes;
--	struct cc_entry *cc;
-+	struct brcmfmac_pd_cc *country_codes;
-+	struct brcmfmac_pd_cc_entry *cc;
- 	s32 found_index;
- 	int i;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -80,7 +80,7 @@ module_param_named(ignore_probe_fail, br
- MODULE_PARM_DESC(ignore_probe_fail, "always succeed probe for debugging");
- #endif
- 
--static struct brcmfmac_sdio_platform_data *brcmfmac_pdata;
-+static struct brcmfmac_platform_data *brcmfmac_pdata;
- struct brcmf_mp_global_t brcmf_mp_global;
- 
- int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
-@@ -229,15 +229,46 @@ void __brcmf_dbg(u32 level, const char *
- 
- static void brcmf_mp_attach(void)
- {
-+	/* If module param firmware path is set then this will always be used,
-+	 * if not set then if available use the platform data version. To make
-+	 * sure it gets initialized at all, always copy the module param version
-+	 */
- 	strlcpy(brcmf_mp_global.firmware_path, brcmf_firmware_path,
- 		BRCMF_FW_ALTPATH_LEN);
-+	if ((brcmfmac_pdata) && (brcmfmac_pdata->fw_alternative_path) &&
-+	    (brcmf_mp_global.firmware_path[0] == '\0')) {
-+		strlcpy(brcmf_mp_global.firmware_path,
-+			brcmfmac_pdata->fw_alternative_path,
-+			BRCMF_FW_ALTPATH_LEN);
-+	}
- }
- 
--struct brcmfmac_sdio_platform_data *brcmf_get_module_param(struct device *dev)
--{
--	if (!brcmfmac_pdata)
--		brcmf_of_probe(dev, &brcmfmac_pdata);
--	return brcmfmac_pdata;
-+struct brcmfmac_sdio_pd *brcmf_get_module_param(struct device *dev,
-+						enum brcmf_bus_type bus_type,
-+						u32 chip, u32 chiprev)
-+{
-+	struct brcmfmac_sdio_pd *pdata;
-+	struct brcmfmac_pd_device *device_pd;
-+	int i;
-+
-+	if (brcmfmac_pdata) {
-+		for (i = 0; i < brcmfmac_pdata->device_count; i++) {
-+			device_pd = &brcmfmac_pdata->devices[i];
-+			if ((device_pd->bus_type == bus_type) &&
-+			    (device_pd->id == chip) &&
-+			    ((device_pd->rev == chiprev) ||
-+			     (device_pd->rev == -1))) {
-+				brcmf_dbg(INFO, "Platform data for device found\n");
-+				if (device_pd->bus_type == BRCMF_BUSTYPE_SDIO)
-+					return &device_pd->bus.sdio;
-+				break;
-+			}
-+		}
-+	}
-+	pdata = NULL;
-+	brcmf_of_probe(dev, &pdata);
-+
-+	return pdata;
- }
- 
- int brcmf_mp_device_attach(struct brcmf_pub *drvr)
-@@ -287,7 +318,7 @@ static int brcmf_common_pd_remove(struct
- static struct platform_driver brcmf_pd = {
- 	.remove		= brcmf_common_pd_remove,
- 	.driver		= {
--		.name	= BRCMFMAC_SDIO_PDATA_NAME,
-+		.name	= BRCMFMAC_PDATA_NAME,
- 	}
- };
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -16,7 +16,7 @@
- #define BRCMFMAC_COMMON_H
- 
- #include <linux/platform_device.h>
--#include <linux/platform_data/brcmfmac-sdio.h>
-+#include <linux/platform_data/brcmfmac.h>
- #include "fwil_types.h"
- 
- extern const u8 ALLFFMAC[ETH_ALEN];
-@@ -43,33 +43,6 @@ struct brcmf_mp_global_t {
- extern struct brcmf_mp_global_t brcmf_mp_global;
- 
- /**
-- * struct cc_entry - Struct for translating user space country code (iso3166) to
-- *		     firmware country code and revision.
-- *
-- * @iso3166: iso3166 alpha 2 country code string.
-- * @cc: firmware country code string.
-- * @rev: firmware country code revision.
-- */
--struct cc_entry {
--	char	iso3166[BRCMF_COUNTRY_BUF_SZ];
--	char	cc[BRCMF_COUNTRY_BUF_SZ];
--	s32	rev;
--};
--
--/**
-- * struct cc_translate - Struct for translating country codes as set by user
-- *			 space to a country code and rev which can be used by
-- *			 firmware.
-- *
-- * @table_size: number of entries in table (> 0)
-- * @table: dynamic array of 1 or more elements with translation information.
-- */
--struct cc_translate {
--	int	table_size;
--	struct cc_entry table[0];
--};
--
--/**
-  * struct brcmf_mp_device - Device module paramaters.
-  *
-  * @sdiod_txglomsz: SDIO txglom size.
-@@ -88,10 +61,12 @@ struct brcmf_mp_device {
- 	int	fcmode;
- 	bool	roamoff;
- 	bool	ignore_probe_fail;
--	struct cc_translate *country_codes;
-+	struct brcmfmac_pd_cc *country_codes;
- };
- 
--struct brcmfmac_sdio_platform_data *brcmf_get_module_param(struct device *dev);
-+struct brcmfmac_sdio_pd *brcmf_get_module_param(struct device *dev,
-+						enum brcmf_bus_type bus_type,
-+						u32 chip, u32 chiprev);
- int brcmf_mp_device_attach(struct brcmf_pub *drvr);
- void brcmf_mp_device_detach(struct brcmf_pub *drvr);
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -23,8 +23,7 @@
- #include "common.h"
- #include "of.h"
- 
--void
--brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_platform_data **sdio)
-+void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd **sdio)
- {
- 	struct device_node *np = dev->of_node;
- 	int irq;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-@@ -15,10 +15,9 @@
-  */
- #ifdef CONFIG_OF
- void
--brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_platform_data **sdio);
-+brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd **sdio);
- #else
--static void brcmf_of_probe(struct device *dev,
--			   struct brcmfmac_sdio_platform_data **sdio)
-+static void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd **sdio)
- {
- }
- #endif /* CONFIG_OF */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -33,8 +33,6 @@
- #include <linux/bcma/bcma.h>
- #include <linux/debugfs.h>
- #include <linux/vmalloc.h>
--#include <linux/platform_data/brcmfmac-sdio.h>
--#include <linux/moduleparam.h>
- #include <asm/unaligned.h>
- #include <defs.h>
- #include <brcmu_wifi.h>
-@@ -44,6 +42,8 @@
- #include "sdio.h"
- #include "chip.h"
- #include "firmware.h"
-+#include "core.h"
-+#include "common.h"
- 
- #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
- #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
-@@ -3775,26 +3775,28 @@ static const struct brcmf_buscore_ops br
- static bool
- brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
- {
-+	struct brcmf_sdio_dev *sdiodev;
- 	u8 clkctl = 0;
- 	int err = 0;
- 	int reg_addr;
- 	u32 reg_val;
- 	u32 drivestrength;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdiodev = bus->sdiodev;
-+	sdio_claim_host(sdiodev->func[1]);
- 
- 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
--		 brcmf_sdiod_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
-+		 brcmf_sdiod_regrl(sdiodev, SI_ENUM_BASE, NULL));
- 
- 	/*
- 	 * Force PLL off until brcmf_chip_attach()
- 	 * programs PLL control regs
- 	 */
- 
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
- 			  BRCMF_INIT_CLKCTL1, &err);
- 	if (!err)
--		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+		clkctl = brcmf_sdiod_regrb(sdiodev,
- 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 
- 	if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
-@@ -3803,50 +3805,77 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 		goto fail;
- 	}
- 
--	bus->ci = brcmf_chip_attach(bus->sdiodev, &brcmf_sdio_buscore_ops);
-+	bus->ci = brcmf_chip_attach(sdiodev, &brcmf_sdio_buscore_ops);
- 	if (IS_ERR(bus->ci)) {
- 		brcmf_err("brcmf_chip_attach failed!\n");
- 		bus->ci = NULL;
- 		goto fail;
- 	}
-+	sdiodev->pdata = brcmf_get_module_param(sdiodev->dev,
-+						   BRCMF_BUSTYPE_SDIO,
-+						   bus->ci->chip,
-+						   bus->ci->chiprev);
-+	/* platform specific configuration:
-+	 *   alignments must be at least 4 bytes for ADMA
-+	 */
-+	bus->head_align = ALIGNMENT;
-+	bus->sgentry_align = ALIGNMENT;
-+	if (sdiodev->pdata) {
-+		if (sdiodev->pdata->sd_head_align > ALIGNMENT)
-+			bus->head_align = sdiodev->pdata->sd_head_align;
-+		if (sdiodev->pdata->sd_sgentry_align > ALIGNMENT)
-+			bus->sgentry_align = sdiodev->pdata->sd_sgentry_align;
-+	}
-+	/* allocate scatter-gather table. sg support
-+	 * will be disabled upon allocation failure.
-+	 */
-+	brcmf_sdiod_sgtable_alloc(sdiodev);
-+
-+#ifdef CONFIG_PM_SLEEP
-+	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
-+	 * is true or when platform data OOB irq is true).
-+	 */
-+	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
-+	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
-+	     (sdiodev->pdata && sdiodev->pdata->oob_irq_supported)))
-+		sdiodev->bus_if->wowl_supported = true;
-+#endif
- 
- 	if (brcmf_sdio_kso_init(bus)) {
- 		brcmf_err("error enabling KSO\n");
- 		goto fail;
- 	}
- 
--	if ((bus->sdiodev->pdata) && (bus->sdiodev->pdata->drive_strength))
--		drivestrength = bus->sdiodev->pdata->drive_strength;
-+	if ((sdiodev->pdata) && (sdiodev->pdata->drive_strength))
-+		drivestrength = sdiodev->pdata->drive_strength;
- 	else
- 		drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
--	brcmf_sdio_drivestrengthinit(bus->sdiodev, bus->ci, drivestrength);
-+	brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
- 
- 	/* Set card control so an SDIO card reset does a WLAN backplane reset */
--	reg_val = brcmf_sdiod_regrb(bus->sdiodev,
--				    SDIO_CCCR_BRCM_CARDCTRL, &err);
-+	reg_val = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
- 	if (err)
- 		goto fail;
- 
- 	reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
- 
--	brcmf_sdiod_regwb(bus->sdiodev,
--			  SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
-+	brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
- 	if (err)
- 		goto fail;
- 
- 	/* set PMUControl so a backplane reset does PMU state reload */
- 	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
--	reg_val = brcmf_sdiod_regrl(bus->sdiodev, reg_addr, &err);
-+	reg_val = brcmf_sdiod_regrl(sdiodev, reg_addr, &err);
- 	if (err)
- 		goto fail;
- 
- 	reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
- 
--	brcmf_sdiod_regwl(bus->sdiodev, reg_addr, reg_val, &err);
-+	brcmf_sdiod_regwl(sdiodev, reg_addr, reg_val, &err);
- 	if (err)
- 		goto fail;
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func[1]);
- 
- 	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
- 
-@@ -3867,7 +3896,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	return true;
- 
- fail:
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func[1]);
- 	return false;
- }
- 
-@@ -4045,18 +4074,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->txminmax = BRCMF_TXMINMAX;
- 	bus->tx_seq = SDPCM_SEQ_WRAP - 1;
- 
--	/* platform specific configuration:
--	 *   alignments must be at least 4 bytes for ADMA
--	 */
--	bus->head_align = ALIGNMENT;
--	bus->sgentry_align = ALIGNMENT;
--	if (sdiodev->pdata) {
--		if (sdiodev->pdata->sd_head_align > ALIGNMENT)
--			bus->head_align = sdiodev->pdata->sd_head_align;
--		if (sdiodev->pdata->sd_sgentry_align > ALIGNMENT)
--			bus->sgentry_align = sdiodev->pdata->sd_sgentry_align;
--	}
--
- 	/* single-threaded workqueue */
- 	wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
- 				     dev_name(&sdiodev->func[1]->dev));
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -184,7 +184,7 @@ struct brcmf_sdio_dev {
- 	struct brcmf_sdio *bus;
- 	struct device *dev;
- 	struct brcmf_bus *bus_if;
--	struct brcmfmac_sdio_platform_data *pdata;
-+	struct brcmfmac_sdio_pd *pdata;
- 	bool oob_irq_requested;
- 	bool irq_en;			/* irq enable flags */
- 	spinlock_t irq_en_lock;
---- a/include/linux/platform_data/brcmfmac-sdio.h
-+++ /dev/null
-@@ -1,135 +0,0 @@
--/*
-- * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-- */
--
--#ifndef _LINUX_BRCMFMAC_PLATFORM_H
--#define _LINUX_BRCMFMAC_PLATFORM_H
--
--/*
-- * Platform specific driver functions and data. Through the platform specific
-- * device data functions can be provided to help the brcmfmac driver to
-- * operate with the device in combination with the used platform.
-- *
-- * Use the platform data in the following (similar) way:
-- *
-- *
--#include <brcmfmac_platform.h>
--
--
--static void brcmfmac_power_on(void)
--{
--}
--
--static void brcmfmac_power_off(void)
--{
--}
--
--static void brcmfmac_reset(void)
--{
--}
--
--static struct brcmfmac_sdio_platform_data brcmfmac_sdio_pdata = {
--	.power_on		= brcmfmac_power_on,
--	.power_off		= brcmfmac_power_off,
--	.reset			= brcmfmac_reset
--};
--
--static struct platform_device brcmfmac_device = {
--	.name			= BRCMFMAC_SDIO_PDATA_NAME,
--	.id			= PLATFORM_DEVID_NONE,
--	.dev.platform_data	= &brcmfmac_sdio_pdata
--};
--
--void __init brcmfmac_init_pdata(void)
--{
--	brcmfmac_sdio_pdata.oob_irq_supported = true;
--	brcmfmac_sdio_pdata.oob_irq_nr = gpio_to_irq(GPIO_BRCMF_SDIO_OOB);
--	brcmfmac_sdio_pdata.oob_irq_flags = IORESOURCE_IRQ |
--					    IORESOURCE_IRQ_HIGHLEVEL;
--	platform_device_register(&brcmfmac_device);
--}
-- *
-- *
-- * Note: the brcmfmac can be loaded as module or be statically built-in into
-- * the kernel. If built-in then do note that it uses module_init (and
-- * module_exit) routines which equal device_initcall. So if you intend to
-- * create a module with the platform specific data for the brcmfmac and have
-- * it built-in to the kernel then use a higher initcall then device_initcall
-- * (see init.h). If this is not done then brcmfmac will load without problems
-- * but will not pickup the platform data.
-- *
-- * When the driver does not "detect" platform driver data then it will continue
-- * without reporting anything and just assume there is no data needed. Which is
-- * probably true for most platforms.
-- *
-- * Explanation of the platform_data fields:
-- *
-- * drive_strength: is the preferred drive_strength to be used for the SDIO
-- * pins. If 0 then a default value will be used. This is the target drive
-- * strength, the exact drive strength which will be used depends on the
-- * capabilities of the device.
-- *
-- * oob_irq_supported: does the board have support for OOB interrupts. SDIO
-- * in-band interrupts are relatively slow and for having less overhead on
-- * interrupt processing an out of band interrupt can be used. If the HW
-- * supports this then enable this by setting this field to true and configure
-- * the oob related fields.
-- *
-- * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
-- * used for registering the irq using request_irq function.
-- *
-- * broken_sg_support: flag for broken sg list support of SDIO host controller.
-- * Set this to true if the SDIO host controller has higher align requirement
-- * than 32 bytes for each scatterlist item.
-- *
-- * sd_head_align: alignment requirement for start of data buffer
-- *
-- * sd_sgentry_align: length alignment requirement for each sg entry
-- *
-- * power_on: This function is called by the brcmfmac when the module gets
-- * loaded. This can be particularly useful for low power devices. The platform
-- * spcific routine may for example decide to power up the complete device.
-- * If there is no use-case for this function then provide NULL.
-- *
-- * power_off: This function is called by the brcmfmac when the module gets
-- * unloaded. At this point the device can be powered down or otherwise be reset.
-- * So if an actual power_off is not supported but reset is then reset the device
-- * when this function gets called. This can be particularly useful for low power
-- * devices. If there is no use-case for this function (either power-down or
-- * reset) then provide NULL.
-- *
-- * reset: This function can get called if the device communication broke down.
-- * This functionality is particularly useful in case of SDIO type devices. It is
-- * possible to reset a dongle via sdio data interface, but it requires that
-- * this is fully functional. This function is chip/module specific and this
-- * function should return only after the complete reset has completed.
-- */
--
--#define BRCMFMAC_SDIO_PDATA_NAME	"brcmfmac_sdio"
--
--struct brcmfmac_sdio_platform_data {
--	unsigned int drive_strength;
--	bool oob_irq_supported;
--	unsigned int oob_irq_nr;
--	unsigned long oob_irq_flags;
--	bool broken_sg_support;
--	unsigned short sd_head_align;
--	unsigned short sd_sgentry_align;
--	void (*power_on)(void);
--	void (*power_off)(void);
--	void (*reset)(void);
--};
--
--#endif /* _LINUX_BRCMFMAC_PLATFORM_H */
---- /dev/null
-+++ b/include/linux/platform_data/brcmfmac.h
-@@ -0,0 +1,185 @@
-+/*
-+ * Copyright (c) 201 Broadcom Corporation
-+ *
-+ * Permission to use, copy, modify, and/or distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ */
-+
-+#ifndef _LINUX_BRCMFMAC_PLATFORM_H
-+#define _LINUX_BRCMFMAC_PLATFORM_H
-+
-+
-+#define BRCMFMAC_PDATA_NAME		"brcmfmac"
-+
-+#define BRCMFMAC_COUNTRY_BUF_SZ		4
-+
-+
-+/*
-+ * Platform specific driver functions and data. Through the platform specific
-+ * device data functions and data can be provided to help the brcmfmac driver to
-+ * operate with the device in combination with the used platform.
-+ */
-+
-+
-+/**
-+ * Note: the brcmfmac can be loaded as module or be statically built-in into
-+ * the kernel. If built-in then do note that it uses module_init (and
-+ * module_exit) routines which equal device_initcall. So if you intend to
-+ * create a module with the platform specific data for the brcmfmac and have
-+ * it built-in to the kernel then use a higher initcall then device_initcall
-+ * (see init.h). If this is not done then brcmfmac will load without problems
-+ * but will not pickup the platform data.
-+ *
-+ * When the driver does not "detect" platform driver data then it will continue
-+ * without reporting anything and just assume there is no data needed. Which is
-+ * probably true for most platforms.
-+ */
-+
-+/**
-+ * enum brcmf_bus_type - Bus type identifier. Currently SDIO, USB and PCIE are
-+ *			 supported.
-+ */
-+enum brcmf_bus_type {
-+	BRCMF_BUSTYPE_SDIO,
-+	BRCMF_BUSTYPE_USB,
-+	BRCMF_BUSTYPE_PCIE
-+};
-+
-+
-+/**
-+ * struct brcmfmac_sdio_pd - SDIO Device specific platform data.
-+ *
-+ * @txglomsz:		SDIO txglom size. Use 0 if default of driver is to be
-+ *			used.
-+ * @drive_strength:	is the preferred drive_strength to be used for the SDIO
-+ *			pins. If 0 then a default value will be used. This is
-+ *			the target drive strength, the exact drive strength
-+ *			which will be used depends on the capabilities of the
-+ *			device.
-+ * @oob_irq_supported:	does the board have support for OOB interrupts. SDIO
-+ *			in-band interrupts are relatively slow and for having
-+ *			less overhead on interrupt processing an out of band
-+ *			interrupt can be used. If the HW supports this then
-+ *			enable this by setting this field to true and configure
-+ *			the oob related fields.
-+ * @oob_irq_nr,
-+ * @oob_irq_flags:	the OOB interrupt information. The values are used for
-+ *			registering the irq using request_irq function.
-+ * @broken_sg_support:	flag for broken sg list support of SDIO host controller.
-+ *			Set this to true if the SDIO host controller has higher
-+ *			align requirement than 32 bytes for each scatterlist
-+ *			item.
-+ * @sd_head_align:	alignment requirement for start of data buffer.
-+ * @sd_sgentry_align:	length alignment requirement for each sg entry.
-+ * @reset:		This function can get called if the device communication
-+ *			broke down. This functionality is particularly useful in
-+ *			case of SDIO type devices. It is possible to reset a
-+ *			dongle via sdio data interface, but it requires that
-+ *			this is fully functional. This function is chip/module
-+ *			specific and this function should return only after the
-+ *			complete reset has completed.
-+ */
-+struct brcmfmac_sdio_pd {
-+	int		txglomsz;
-+	unsigned int	drive_strength;
-+	bool		oob_irq_supported;
-+	unsigned int	oob_irq_nr;
-+	unsigned long	oob_irq_flags;
-+	bool		broken_sg_support;
-+	unsigned short	sd_head_align;
-+	unsigned short	sd_sgentry_align;
-+	void		(*reset)(void);
-+};
-+
-+/**
-+ * struct brcmfmac_pd_cc_entry - Struct for translating user space country code
-+ *				 (iso3166) to firmware country code and
-+ *				 revision.
-+ *
-+ * @iso3166:	iso3166 alpha 2 country code string.
-+ * @cc:		firmware country code string.
-+ * @rev:	firmware country code revision.
-+ */
-+struct brcmfmac_pd_cc_entry {
-+	char	iso3166[BRCMFMAC_COUNTRY_BUF_SZ];
-+	char	cc[BRCMFMAC_COUNTRY_BUF_SZ];
-+	s32	rev;
-+};
-+
-+/**
-+ * struct brcmfmac_pd_cc - Struct for translating country codes as set by user
-+ *			   space to a country code and rev which can be used by
-+ *			   firmware.
-+ *
-+ * @table_size:	number of entries in table (> 0)
-+ * @table:	array of 1 or more elements with translation information.
-+ */
-+struct brcmfmac_pd_cc {
-+	int				table_size;
-+	struct brcmfmac_pd_cc_entry	table[0];
-+};
-+
-+/**
-+ * struct brcmfmac_pd_device - Device specific platform data. (id/rev/bus_type)
-+ *			       is the unique identifier of the device.
-+ *
-+ * @id:			ID of the device for which this data is. In case of SDIO
-+ *			or PCIE this is the chipid as identified by chip.c In
-+ *			case of USB this is the chipid as identified by the
-+ *			device query.
-+ * @rev:		chip revision, see id.
-+ * @bus_type:		The type of bus. Some chipid/rev exist for different bus
-+ *			types. Each bus type has its own set of settings.
-+ * @feature_disable:	Bitmask of features to disable (override), See feature.c
-+ *			in brcmfmac for details.
-+ * @country_codes:	If available, pointer to struct for translating country
-+ *			codes.
-+ * @bus:		Bus specific (union) device settings. Currently only
-+ *			SDIO.
-+ */
-+struct brcmfmac_pd_device {
-+	unsigned int		id;
-+	unsigned int		rev;
-+	enum brcmf_bus_type	bus_type;
-+	unsigned int		feature_disable;
-+	struct brcmfmac_pd_cc	*country_codes;
-+	union {
-+		struct brcmfmac_sdio_pd sdio;
-+	} bus;
-+};
-+
-+/**
-+ * struct brcmfmac_platform_data - BRCMFMAC specific platform data.
-+ *
-+ * @power_on:	This function is called by the brcmfmac driver when the module
-+ *		gets loaded. This can be particularly useful for low power
-+ *		devices. The platform spcific routine may for example decide to
-+ *		power up the complete device. If there is no use-case for this
-+ *		function then provide NULL.
-+ * @power_off:	This function is called by the brcmfmac when the module gets
-+ *		unloaded. At this point the devices can be powered down or
-+ *		otherwise be reset. So if an actual power_off is not supported
-+ *		but reset is supported by the devices then reset the devices
-+ *		when this function gets called. This can be particularly useful
-+ *		for low power devices. If there is no use-case for this
-+ *		function then provide NULL.
-+ */
-+struct brcmfmac_platform_data {
-+	void	(*power_on)(void);
-+	void	(*power_off)(void);
-+	char	*fw_alternative_path;
-+	int	device_count;
-+	struct brcmfmac_pd_device devices[0];
-+};
-+
-+
-+#endif /* _LINUX_BRCMFMAC_PLATFORM_H */
diff --git a/package/kernel/mac80211/patches/344-0018-brcmfmac-merge-platform-data-and-module-paramaters.patch b/package/kernel/mac80211/patches/344-0018-brcmfmac-merge-platform-data-and-module-paramaters.patch
deleted file mode 100644
index 34341d7f18..0000000000
--- a/package/kernel/mac80211/patches/344-0018-brcmfmac-merge-platform-data-and-module-paramaters.patch
+++ /dev/null
@@ -1,607 +0,0 @@
-From: Hante Meuleman <meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:08 +0100
-Subject: [PATCH] brcmfmac: merge platform data and module paramaters
-
-Merge module parameters and platform data in one struct. This is the
-last step to move to the new platform data per device. Now parameters
-of platform data will be merged with module parameters per device.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -109,8 +109,8 @@ int brcmf_sdiod_intr_register(struct brc
- 	u32 addr, gpiocontrol;
- 	unsigned long flags;
- 
--	pdata = sdiodev->pdata;
--	if ((pdata) && (pdata->oob_irq_supported)) {
-+	pdata = &sdiodev->settings->bus.sdio;
-+	if (pdata->oob_irq_supported) {
- 		brcmf_dbg(SDIO, "Enter, register OOB IRQ %d\n",
- 			  pdata->oob_irq_nr);
- 		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
-@@ -177,8 +177,8 @@ int brcmf_sdiod_intr_unregister(struct b
- 
- 	brcmf_dbg(SDIO, "Entering\n");
- 
--	pdata = sdiodev->pdata;
--	if ((pdata) && (pdata->oob_irq_supported)) {
-+	pdata = &sdiodev->settings->bus.sdio;
-+	if (pdata->oob_irq_supported) {
- 		sdio_claim_host(sdiodev->func[1]);
- 		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
- 		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
-@@ -522,7 +522,7 @@ static int brcmf_sdiod_sglist_rw(struct
- 	target_list = pktlist;
- 	/* for host with broken sg support, prepare a page aligned list */
- 	__skb_queue_head_init(&local_list);
--	if (sdiodev->pdata && sdiodev->pdata->broken_sg_support && !write) {
-+	if (!write && sdiodev->settings->bus.sdio.broken_sg_support) {
- 		req_sz = 0;
- 		skb_queue_walk(pktlist, pkt_next)
- 			req_sz += pkt_next->len;
-@@ -629,7 +629,7 @@ static int brcmf_sdiod_sglist_rw(struct
- 		}
- 	}
- 
--	if (sdiodev->pdata && sdiodev->pdata->broken_sg_support && !write) {
-+	if (!write && sdiodev->settings->bus.sdio.broken_sg_support) {
- 		local_pkt_next = local_list.next;
- 		orig_offset = 0;
- 		skb_queue_walk(pktlist, pkt_next) {
-@@ -900,7 +900,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
- 		return;
- 
- 	nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE,
--		      sdiodev->bus_if->drvr->settings->sdiod_txglomsz);
-+		      sdiodev->settings->bus.sdio.txglomsz);
- 	nents += (nents >> 4) + 1;
- 
- 	WARN_ON(nents > sdiodev->max_segment_count);
-@@ -912,7 +912,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
- 		sdiodev->sg_support = false;
- 	}
- 
--	sdiodev->txglomsz = sdiodev->bus_if->drvr->settings->sdiod_txglomsz;
-+	sdiodev->txglomsz = sdiodev->settings->bus.sdio.txglomsz;
- }
- 
- #ifdef CONFIG_PM_SLEEP
-@@ -1246,8 +1246,8 @@ static int brcmf_ops_sdio_suspend(struct
- 
- 	sdio_flags = MMC_PM_KEEP_POWER;
- 	if (sdiodev->wowl_enabled) {
--		if (sdiodev->pdata->oob_irq_supported)
--			enable_irq_wake(sdiodev->pdata->oob_irq_nr);
-+		if (sdiodev->settings->bus.sdio.oob_irq_supported)
-+			enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr);
- 		else
- 			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
- 	}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -43,6 +43,8 @@ enum brcmf_bus_protocol_type {
- 	BRCMF_PROTO_MSGBUF
- };
- 
-+struct brcmf_mp_device;
-+
- struct brcmf_bus_dcmd {
- 	char *name;
- 	char *param;
-@@ -217,7 +219,7 @@ bool brcmf_c_prec_enq(struct device *dev
- void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp);
- 
- /* Indication from bus module regarding presence/insertion of dongle. */
--int brcmf_attach(struct device *dev);
-+int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings);
- /* Indication from bus module regarding removal/absence of dongle */
- void brcmf_detach(struct device *dev);
- /* Indication from bus module that dongle should be reset */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -243,14 +243,35 @@ static void brcmf_mp_attach(void)
- 	}
- }
- 
--struct brcmfmac_sdio_pd *brcmf_get_module_param(struct device *dev,
--						enum brcmf_bus_type bus_type,
--						u32 chip, u32 chiprev)
-+struct brcmf_mp_device *brcmf_get_module_param(struct device *dev,
-+					       enum brcmf_bus_type bus_type,
-+					       u32 chip, u32 chiprev)
- {
--	struct brcmfmac_sdio_pd *pdata;
-+	struct brcmf_mp_device *settings;
- 	struct brcmfmac_pd_device *device_pd;
-+	bool found;
- 	int i;
- 
-+	brcmf_dbg(INFO, "Enter, bus=%d, chip=%d, rev=%d\n", bus_type, chip,
-+		  chiprev);
-+	settings = kzalloc(sizeof(*settings), GFP_ATOMIC);
-+	if (!settings)
-+		return NULL;
-+
-+	/* start by using the module paramaters */
-+	settings->p2p_enable = !!brcmf_p2p_enable;
-+	settings->feature_disable = brcmf_feature_disable;
-+	settings->fcmode = brcmf_fcmode;
-+	settings->roamoff = !!brcmf_roamoff;
-+#ifdef DEBUG
-+	settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
-+#endif
-+
-+	if (bus_type == BRCMF_BUSTYPE_SDIO)
-+		settings->bus.sdio.txglomsz = brcmf_sdiod_txglomsz;
-+
-+	/* See if there is any device specific platform data configured */
-+	found = false;
- 	if (brcmfmac_pdata) {
- 		for (i = 0; i < brcmfmac_pdata->device_count; i++) {
- 			device_pd = &brcmfmac_pdata->devices[i];
-@@ -259,38 +280,29 @@ struct brcmfmac_sdio_pd *brcmf_get_modul
- 			    ((device_pd->rev == chiprev) ||
- 			     (device_pd->rev == -1))) {
- 				brcmf_dbg(INFO, "Platform data for device found\n");
-+				settings->country_codes =
-+						device_pd->country_codes;
- 				if (device_pd->bus_type == BRCMF_BUSTYPE_SDIO)
--					return &device_pd->bus.sdio;
-+					memcpy(&settings->bus.sdio,
-+					       &device_pd->bus.sdio,
-+					       sizeof(settings->bus.sdio));
-+				found = true;
- 				break;
- 			}
- 		}
- 	}
--	pdata = NULL;
--	brcmf_of_probe(dev, &pdata);
--
--	return pdata;
--}
--
--int brcmf_mp_device_attach(struct brcmf_pub *drvr)
--{
--	drvr->settings = kzalloc(sizeof(*drvr->settings), GFP_ATOMIC);
--	if (!drvr->settings)
--		return -ENOMEM;
--
--	drvr->settings->sdiod_txglomsz = brcmf_sdiod_txglomsz;
--	drvr->settings->p2p_enable = !!brcmf_p2p_enable;
--	drvr->settings->feature_disable = brcmf_feature_disable;
--	drvr->settings->fcmode = brcmf_fcmode;
--	drvr->settings->roamoff = !!brcmf_roamoff;
--#ifdef DEBUG
--	drvr->settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
--#endif
--	return 0;
-+	if ((bus_type == BRCMF_BUSTYPE_SDIO) && (!found)) {
-+		/* No platform data for this device. In case of SDIO try OF
-+		 * (Open Firwmare) Device Tree.
-+		 */
-+		brcmf_of_probe(dev, &settings->bus.sdio);
-+	}
-+	return settings;
- }
- 
--void brcmf_mp_device_detach(struct brcmf_pub *drvr)
-+void brcmf_release_module_param(struct brcmf_mp_device *module_param)
- {
--	kfree(drvr->settings);
-+	kfree(module_param);
- }
- 
- static int __init brcmf_common_pd_probe(struct platform_device *pdev)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -45,41 +45,30 @@ extern struct brcmf_mp_global_t brcmf_mp
- /**
-  * struct brcmf_mp_device - Device module paramaters.
-  *
-- * @sdiod_txglomsz: SDIO txglom size.
-- * @joinboost_5g_rssi: 5g rssi booost for preferred join selection.
-  * @p2p_enable: Legacy P2P0 enable (old wpa_supplicant).
-  * @feature_disable: Feature_disable bitmask.
-  * @fcmode: FWS flow control.
-  * @roamoff: Firmware roaming off?
-+ * @ignore_probe_fail: Ignore probe failure.
-  * @country_codes: If available, pointer to struct for translating country codes
-+ * @bus: Bus specific platform data. Only SDIO at the mmoment.
-  */
- struct brcmf_mp_device {
--	int	sdiod_txglomsz;
--	int	joinboost_5g_rssi;
--	bool	p2p_enable;
--	int	feature_disable;
--	int	fcmode;
--	bool	roamoff;
--	bool	ignore_probe_fail;
-+	bool		p2p_enable;
-+	unsigned int	feature_disable;
-+	int		fcmode;
-+	bool		roamoff;
-+	bool		ignore_probe_fail;
- 	struct brcmfmac_pd_cc *country_codes;
-+	union {
-+		struct brcmfmac_sdio_pd sdio;
-+	} bus;
- };
- 
--struct brcmfmac_sdio_pd *brcmf_get_module_param(struct device *dev,
--						enum brcmf_bus_type bus_type,
--						u32 chip, u32 chiprev);
--int brcmf_mp_device_attach(struct brcmf_pub *drvr);
--void brcmf_mp_device_detach(struct brcmf_pub *drvr);
--#ifdef DEBUG
--static inline bool brcmf_ignoring_probe_fail(struct brcmf_pub *drvr)
--{
--	return drvr->settings->ignore_probe_fail;
--}
--#else
--static inline bool brcmf_ignoring_probe_fail(struct brcmf_pub *drvr)
--{
--	return false;
--}
--#endif
-+struct brcmf_mp_device *brcmf_get_module_param(struct device *dev,
-+					       enum brcmf_bus_type bus_type,
-+					       u32 chip, u32 chiprev);
-+void brcmf_release_module_param(struct brcmf_mp_device *module_param);
- 
- /* Sets dongle media info (drv_version, mac address). */
- int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1104,7 +1104,7 @@ static int brcmf_inet6addr_changed(struc
- }
- #endif
- 
--int brcmf_attach(struct device *dev)
-+int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
- {
- 	struct brcmf_pub *drvr = NULL;
- 	int ret = 0;
-@@ -1126,10 +1126,7 @@ int brcmf_attach(struct device *dev)
- 	drvr->hdrlen = 0;
- 	drvr->bus_if = dev_get_drvdata(dev);
- 	drvr->bus_if->drvr = drvr;
--
--	/* Initialize device specific settings */
--	if (brcmf_mp_device_attach(drvr))
--		goto fail;
-+	drvr->settings = settings;
- 
- 	/* attach debug facilities */
- 	brcmf_debug_attach(drvr);
-@@ -1274,7 +1271,7 @@ fail:
- 		brcmf_net_detach(p2p_ifp->ndev);
- 	drvr->iflist[0] = NULL;
- 	drvr->iflist[1] = NULL;
--	if (brcmf_ignoring_probe_fail(drvr))
-+	if (drvr->settings->ignore_probe_fail)
- 		ret = 0;
- 
- 	return ret;
-@@ -1350,8 +1347,6 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_proto_detach(drvr);
- 
--	brcmf_mp_device_detach(drvr);
--
- 	brcmf_debug_detach(drvr);
- 	bus_if->drvr = NULL;
- 	kfree(drvr);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -23,7 +23,7 @@
- #include "common.h"
- #include "of.h"
- 
--void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd **sdio)
-+void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd *sdio)
- {
- 	struct device_node *np = dev->of_node;
- 	int irq;
-@@ -33,12 +33,8 @@ void brcmf_of_probe(struct device *dev,
- 	if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
- 		return;
- 
--	*sdio = devm_kzalloc(dev, sizeof(*sdio), GFP_KERNEL);
--	if (!(*sdio))
--		return;
--
- 	if (of_property_read_u32(np, "brcm,drive-strength", &val) == 0)
--		(*sdio)->drive_strength = val;
-+		sdio->drive_strength = val;
- 
- 	/* make sure there are interrupts defined in the node */
- 	if (!of_find_property(np, "interrupts", NULL))
-@@ -51,7 +47,7 @@ void brcmf_of_probe(struct device *dev,
- 	}
- 	irqf = irqd_get_trigger_type(irq_get_irq_data(irq));
- 
--	(*sdio)->oob_irq_supported = true;
--	(*sdio)->oob_irq_nr = irq;
--	(*sdio)->oob_irq_flags = irqf;
-+	sdio->oob_irq_supported = true;
-+	sdio->oob_irq_nr = irq;
-+	sdio->oob_irq_flags = irqf;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-@@ -14,10 +14,9 @@
-  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifdef CONFIG_OF
--void
--brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd **sdio);
-+void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd *sdio);
- #else
--static void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd **sdio)
-+static void brcmf_of_probe(struct device *dev, struct brcmfmac_sdio_pd *sdio)
- {
- }
- #endif /* CONFIG_OF */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -37,6 +37,8 @@
- #include "pcie.h"
- #include "firmware.h"
- #include "chip.h"
-+#include "core.h"
-+#include "common.h"
- 
- 
- enum brcmf_pcie_state {
-@@ -266,6 +268,7 @@ struct brcmf_pciedev_info {
- 	u16 (*read_ptr)(struct brcmf_pciedev_info *devinfo, u32 mem_offset);
- 	void (*write_ptr)(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
- 			  u16 value);
-+	struct brcmf_mp_device *settings;
- };
- 
- struct brcmf_pcie_ringbuf {
-@@ -1525,16 +1528,16 @@ static void brcmf_pcie_release_resource(
- }
- 
- 
--static int brcmf_pcie_attach_bus(struct device *dev)
-+static int brcmf_pcie_attach_bus(struct brcmf_pciedev_info *devinfo)
- {
- 	int ret;
- 
- 	/* Attach to the common driver interface */
--	ret = brcmf_attach(dev);
-+	ret = brcmf_attach(&devinfo->pdev->dev, devinfo->settings);
- 	if (ret) {
- 		brcmf_err("brcmf_attach failed\n");
- 	} else {
--		ret = brcmf_bus_start(dev);
-+		ret = brcmf_bus_start(&devinfo->pdev->dev);
- 		if (ret)
- 			brcmf_err("dongle is not responding\n");
- 	}
-@@ -1672,7 +1675,7 @@ static void brcmf_pcie_setup(struct devi
- 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
- 
- 	brcmf_pcie_intr_enable(devinfo);
--	if (brcmf_pcie_attach_bus(bus->dev) == 0)
-+	if (brcmf_pcie_attach_bus(devinfo) == 0)
- 		return;
- 
- 	brcmf_pcie_bus_console_read(devinfo);
-@@ -1716,6 +1719,15 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 		goto fail;
- 	}
- 
-+	devinfo->settings = brcmf_get_module_param(&devinfo->pdev->dev,
-+						   BRCMF_BUSTYPE_PCIE,
-+						   devinfo->ci->chip,
-+						   devinfo->ci->chiprev);
-+	if (!devinfo->settings) {
-+		ret = -ENOMEM;
-+		goto fail;
-+	}
-+
- 	bus = kzalloc(sizeof(*bus), GFP_KERNEL);
- 	if (!bus) {
- 		ret = -ENOMEM;
-@@ -1760,6 +1772,8 @@ fail:
- 	brcmf_pcie_release_resource(devinfo);
- 	if (devinfo->ci)
- 		brcmf_chip_detach(devinfo->ci);
-+	if (devinfo->settings)
-+		brcmf_release_module_param(devinfo->settings);
- 	kfree(pcie_bus_dev);
- 	kfree(devinfo);
- 	return ret;
-@@ -1799,6 +1813,8 @@ brcmf_pcie_remove(struct pci_dev *pdev)
- 
- 	if (devinfo->ci)
- 		brcmf_chip_detach(devinfo->ci);
-+	if (devinfo->settings)
-+		brcmf_release_module_param(devinfo->settings);
- 
- 	kfree(devinfo);
- 	dev_set_drvdata(&pdev->dev, NULL);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -2442,15 +2442,17 @@ static void brcmf_sdio_bus_stop(struct d
- 
- static inline void brcmf_sdio_clrintr(struct brcmf_sdio *bus)
- {
-+	struct brcmf_sdio_dev *sdiodev;
- 	unsigned long flags;
- 
--	if (bus->sdiodev->oob_irq_requested) {
--		spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
--		if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
--			enable_irq(bus->sdiodev->pdata->oob_irq_nr);
--			bus->sdiodev->irq_en = true;
-+	sdiodev = bus->sdiodev;
-+	if (sdiodev->oob_irq_requested) {
-+		spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
-+		if (!sdiodev->irq_en && !atomic_read(&bus->ipend)) {
-+			enable_irq(sdiodev->settings->bus.sdio.oob_irq_nr);
-+			sdiodev->irq_en = true;
- 		}
--		spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
-+		spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
- 	}
- }
- 
-@@ -3394,9 +3396,7 @@ static int brcmf_sdio_bus_preinit(struct
- 					   sizeof(u32));
- 	} else {
- 		/* otherwise, set txglomalign */
--		value = 4;
--		if (sdiodev->pdata)
--			value = sdiodev->pdata->sd_sgentry_align;
-+		value = sdiodev->settings->bus.sdio.sd_sgentry_align;
- 		/* SDIO ADMA requires at least 32 bit alignment */
- 		value = max_t(u32, value, 4);
- 		err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
-@@ -3811,21 +3811,25 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 		bus->ci = NULL;
- 		goto fail;
- 	}
--	sdiodev->pdata = brcmf_get_module_param(sdiodev->dev,
-+	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
- 						   BRCMF_BUSTYPE_SDIO,
- 						   bus->ci->chip,
- 						   bus->ci->chiprev);
-+	if (!sdiodev->settings) {
-+		brcmf_err("Failed to get device parameters\n");
-+		goto fail;
-+	}
- 	/* platform specific configuration:
- 	 *   alignments must be at least 4 bytes for ADMA
- 	 */
- 	bus->head_align = ALIGNMENT;
- 	bus->sgentry_align = ALIGNMENT;
--	if (sdiodev->pdata) {
--		if (sdiodev->pdata->sd_head_align > ALIGNMENT)
--			bus->head_align = sdiodev->pdata->sd_head_align;
--		if (sdiodev->pdata->sd_sgentry_align > ALIGNMENT)
--			bus->sgentry_align = sdiodev->pdata->sd_sgentry_align;
--	}
-+	if (sdiodev->settings->bus.sdio.sd_head_align > ALIGNMENT)
-+		bus->head_align = sdiodev->settings->bus.sdio.sd_head_align;
-+	if (sdiodev->settings->bus.sdio.sd_sgentry_align > ALIGNMENT)
-+		bus->sgentry_align =
-+				sdiodev->settings->bus.sdio.sd_sgentry_align;
-+
- 	/* allocate scatter-gather table. sg support
- 	 * will be disabled upon allocation failure.
- 	 */
-@@ -3837,7 +3841,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	 */
- 	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
- 	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
--	     (sdiodev->pdata && sdiodev->pdata->oob_irq_supported)))
-+	     (sdiodev->settings->bus.sdio.oob_irq_supported)))
- 		sdiodev->bus_if->wowl_supported = true;
- #endif
- 
-@@ -3846,8 +3850,8 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 		goto fail;
- 	}
- 
--	if ((sdiodev->pdata) && (sdiodev->pdata->drive_strength))
--		drivestrength = sdiodev->pdata->drive_strength;
-+	if (sdiodev->settings->bus.sdio.drive_strength)
-+		drivestrength = sdiodev->settings->bus.sdio.drive_strength;
- 	else
- 		drivestrength = DEFAULT_SDIO_DRIVE_STRENGTH;
- 	brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
-@@ -4124,7 +4128,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
- 
- 	/* Attach to the common layer, reserve hdr space */
--	ret = brcmf_attach(bus->sdiodev->dev);
-+	ret = brcmf_attach(bus->sdiodev->dev, bus->sdiodev->settings);
- 	if (ret != 0) {
- 		brcmf_err("brcmf_attach failed\n");
- 		goto fail;
-@@ -4228,6 +4232,8 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 			}
- 			brcmf_chip_detach(bus->ci);
- 		}
-+		if (bus->sdiodev->settings)
-+			brcmf_release_module_param(bus->sdiodev->settings);
- 
- 		kfree(bus->rxbuf);
- 		kfree(bus->hdrbuf);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -184,7 +184,7 @@ struct brcmf_sdio_dev {
- 	struct brcmf_sdio *bus;
- 	struct device *dev;
- 	struct brcmf_bus *bus_if;
--	struct brcmfmac_sdio_pd *pdata;
-+	struct brcmf_mp_device *settings;
- 	bool oob_irq_requested;
- 	bool irq_en;			/* irq enable flags */
- 	spinlock_t irq_en_lock;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -27,6 +27,8 @@
- #include "debug.h"
- #include "firmware.h"
- #include "usb.h"
-+#include "core.h"
-+#include "common.h"
- 
- 
- #define IOCTL_RESP_TIMEOUT		msecs_to_jiffies(2000)
-@@ -171,6 +173,7 @@ struct brcmf_usbdev_info {
- 	struct urb *bulk_urb; /* used for FW download */
- 
- 	bool wowl_enabled;
-+	struct brcmf_mp_device *settings;
- };
- 
- static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
-@@ -1027,6 +1030,9 @@ static void brcmf_usb_detach(struct brcm
- 
- 	kfree(devinfo->tx_reqs);
- 	kfree(devinfo->rx_reqs);
-+
-+	if (devinfo->settings)
-+		brcmf_release_module_param(devinfo->settings);
- }
- 
- 
-@@ -1136,7 +1142,7 @@ static int brcmf_usb_bus_setup(struct br
- 	int ret;
- 
- 	/* Attach to the common driver interface */
--	ret = brcmf_attach(devinfo->dev);
-+	ret = brcmf_attach(devinfo->dev, devinfo->settings);
- 	if (ret) {
- 		brcmf_err("brcmf_attach failed\n");
- 		return ret;
-@@ -1223,6 +1229,14 @@ static int brcmf_usb_probe_cb(struct brc
- 	bus->wowl_supported = true;
- #endif
- 
-+	devinfo->settings = brcmf_get_module_param(bus->dev, BRCMF_BUSTYPE_USB,
-+						   bus_pub->devid,
-+						   bus_pub->chiprev);
-+	if (!devinfo->settings) {
-+		ret = -ENOMEM;
-+		goto fail;
-+	}
-+
- 	if (!brcmf_usb_dlneeded(devinfo)) {
- 		ret = brcmf_usb_bus_setup(devinfo);
- 		if (ret)
diff --git a/package/kernel/mac80211/patches/344-0019-brcmfmac-integrate-add_keyext-in-add_key.patch b/package/kernel/mac80211/patches/344-0019-brcmfmac-integrate-add_keyext-in-add_key.patch
deleted file mode 100644
index eb680fccfc..0000000000
--- a/package/kernel/mac80211/patches/344-0019-brcmfmac-integrate-add_keyext-in-add_key.patch
+++ /dev/null
@@ -1,227 +0,0 @@
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:09 +0100
-Subject: [PATCH] brcmfmac: integrate add_keyext in add_key
-
-brcmf_add_keyext is called when a key is configured for a specific
-mac address. This function is very similar to the calling function
-brcmf_add_key. Integrate this function and also use existing del_key
-function in case key is to be cleared.
-
-Reviewed-by: Arend Van Spriel <arend.van@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2073,84 +2073,34 @@ done:
- }
- 
- static s32
--brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
--	      u8 key_idx, const u8 *mac_addr, struct key_params *params)
-+brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
-+		       u8 key_idx, bool pairwise, const u8 *mac_addr)
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	struct brcmf_wsec_key key;
- 	s32 err = 0;
--	u8 keybuf[8];
-+
-+	brcmf_dbg(TRACE, "Enter\n");
-+	if (!check_vif_up(ifp->vif))
-+		return -EIO;
-+
-+	if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
-+		/* we ignore this key index in this case */
-+		return -EINVAL;
-+	}
- 
- 	memset(&key, 0, sizeof(key));
--	key.index = (u32) key_idx;
--	/* Instead of bcast for ea address for default wep keys,
--		 driver needs it to be Null */
--	if (!is_multicast_ether_addr(mac_addr))
--		memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
--	key.len = (u32) params->key_len;
--	/* check for key index change */
--	if (key.len == 0) {
--		/* key delete */
--		err = send_key_to_dongle(ifp, &key);
--		if (err)
--			brcmf_err("key delete error (%d)\n", err);
--	} else {
--		if (key.len > sizeof(key.data)) {
--			brcmf_err("Invalid key length (%d)\n", key.len);
--			return -EINVAL;
--		}
- 
--		brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
--		memcpy(key.data, params->key, key.len);
-+	key.index = (u32)key_idx;
-+	key.flags = BRCMF_PRIMARY_KEY;
-+	key.algo = CRYPTO_ALGO_OFF;
- 
--		if (!brcmf_is_apmode(ifp->vif) &&
--		    (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
--			brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
--			memcpy(keybuf, &key.data[24], sizeof(keybuf));
--			memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
--			memcpy(&key.data[16], keybuf, sizeof(keybuf));
--		}
-+	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
- 
--		/* if IW_ENCODE_EXT_RX_SEQ_VALID set */
--		if (params->seq && params->seq_len == 6) {
--			/* rx iv */
--			u8 *ivptr;
--			ivptr = (u8 *) params->seq;
--			key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
--			    (ivptr[3] << 8) | ivptr[2];
--			key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
--			key.iv_initialized = true;
--		}
-+	/* Set the new key/index */
-+	err = send_key_to_dongle(ifp, &key);
- 
--		switch (params->cipher) {
--		case WLAN_CIPHER_SUITE_WEP40:
--			key.algo = CRYPTO_ALGO_WEP1;
--			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
--			break;
--		case WLAN_CIPHER_SUITE_WEP104:
--			key.algo = CRYPTO_ALGO_WEP128;
--			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
--			break;
--		case WLAN_CIPHER_SUITE_TKIP:
--			key.algo = CRYPTO_ALGO_TKIP;
--			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
--			break;
--		case WLAN_CIPHER_SUITE_AES_CMAC:
--			key.algo = CRYPTO_ALGO_AES_CCM;
--			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
--			break;
--		case WLAN_CIPHER_SUITE_CCMP:
--			key.algo = CRYPTO_ALGO_AES_CCM;
--			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
--			break;
--		default:
--			brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
--			return -EINVAL;
--		}
--		err = send_key_to_dongle(ifp, &key);
--		if (err)
--			brcmf_err("wsec_key error (%d)\n", err);
--	}
-+	brcmf_dbg(TRACE, "Exit\n");
- 	return err;
- }
- 
-@@ -2163,8 +2113,9 @@ brcmf_cfg80211_add_key(struct wiphy *wip
- 	struct brcmf_wsec_key *key;
- 	s32 val;
- 	s32 wsec;
--	s32 err = 0;
-+	s32 err;
- 	u8 keybuf[8];
-+	bool ext_key;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
-@@ -2177,27 +2128,32 @@ brcmf_cfg80211_add_key(struct wiphy *wip
- 		return -EINVAL;
- 	}
- 
--	if (mac_addr &&
--		(params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
--		(params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
--		brcmf_dbg(TRACE, "Exit");
--		return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
--	}
--
--	key = &ifp->vif->profile.key[key_idx];
--	memset(key, 0, sizeof(*key));
-+	if (params->key_len == 0)
-+		return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
-+					      mac_addr);
- 
- 	if (params->key_len > sizeof(key->data)) {
- 		brcmf_err("Too long key length (%u)\n", params->key_len);
--		err = -EINVAL;
--		goto done;
-+		return -EINVAL;
-+	}
-+
-+	ext_key = false;
-+	if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
-+	    (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
-+		brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
-+		ext_key = true;
- 	}
-+
-+	key = &ifp->vif->profile.key[key_idx];
-+	memset(key, 0, sizeof(*key));
-+	if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
-+		memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
- 	key->len = params->key_len;
- 	key->index = key_idx;
--
- 	memcpy(key->data, params->key, key->len);
-+	if (!ext_key)
-+		key->flags = BRCMF_PRIMARY_KEY;
- 
--	key->flags = BRCMF_PRIMARY_KEY;
- 	switch (params->cipher) {
- 	case WLAN_CIPHER_SUITE_WEP40:
- 		key->algo = CRYPTO_ALGO_WEP1;
-@@ -2237,7 +2193,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
- 	}
- 
- 	err = send_key_to_dongle(ifp, key);
--	if (err)
-+	if (ext_key || err)
- 		goto done;
- 
- 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
-@@ -2256,38 +2212,6 @@ done:
- 	brcmf_dbg(TRACE, "Exit\n");
- 	return err;
- }
--
--static s32
--brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
--		    u8 key_idx, bool pairwise, const u8 *mac_addr)
--{
--	struct brcmf_if *ifp = netdev_priv(ndev);
--	struct brcmf_wsec_key key;
--	s32 err = 0;
--
--	brcmf_dbg(TRACE, "Enter\n");
--	if (!check_vif_up(ifp->vif))
--		return -EIO;
--
--	if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
--		/* we ignore this key index in this case */
--		return -EINVAL;
--	}
--
--	memset(&key, 0, sizeof(key));
--
--	key.index = (u32) key_idx;
--	key.flags = BRCMF_PRIMARY_KEY;
--	key.algo = CRYPTO_ALGO_OFF;
--
--	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
--
--	/* Set the new key/index */
--	err = send_key_to_dongle(ifp, &key);
--
--	brcmf_dbg(TRACE, "Exit\n");
--	return err;
--}
- 
- static s32
- brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
diff --git a/package/kernel/mac80211/patches/344-0020-brcmfmac-add-802.11w-management-frame-protection-sup.patch b/package/kernel/mac80211/patches/344-0020-brcmfmac-add-802.11w-management-frame-protection-sup.patch
deleted file mode 100644
index c20d40c049..0000000000
--- a/package/kernel/mac80211/patches/344-0020-brcmfmac-add-802.11w-management-frame-protection-sup.patch
+++ /dev/null
@@ -1,509 +0,0 @@
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Wed, 17 Feb 2016 11:27:10 +0100
-Subject: [PATCH] brcmfmac: add 802.11w management frame protection support
-
-Add full support for both AP and STA for management frame protection.
-
-Reviewed-by: Arend Van Spriel <arend.van@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -72,8 +72,13 @@
- #define RSN_AKM_NONE			0	/* None (IBSS) */
- #define RSN_AKM_UNSPECIFIED		1	/* Over 802.1x */
- #define RSN_AKM_PSK			2	/* Pre-shared Key */
-+#define RSN_AKM_SHA256_1X		5	/* SHA256, 802.1X */
-+#define RSN_AKM_SHA256_PSK		6	/* SHA256, Pre-shared Key */
- #define RSN_CAP_LEN			2	/* Length of RSN capabilities */
--#define RSN_CAP_PTK_REPLAY_CNTR_MASK	0x000C
-+#define RSN_CAP_PTK_REPLAY_CNTR_MASK	(BIT(2) | BIT(3))
-+#define RSN_CAP_MFPR_MASK		BIT(6)
-+#define RSN_CAP_MFPC_MASK		BIT(7)
-+#define RSN_PMKID_COUNT_LEN		2
- 
- #define VNDR_IE_CMD_LEN			4	/* length of the set command
- 						 * string :"add", "del" (+ NUL)
-@@ -211,12 +216,19 @@ static const struct ieee80211_regdomain
- 		REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
- };
- 
--static const u32 __wl_cipher_suites[] = {
-+/* Note: brcmf_cipher_suites is an array of int defining which cipher suites
-+ * are supported. A pointer to this array and the number of entries is passed
-+ * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
-+ * So the cipher suite AES_CMAC has to be the last one in the array, and when
-+ * device does not support MFP then the number of suites will be decreased by 1
-+ */
-+static const u32 brcmf_cipher_suites[] = {
- 	WLAN_CIPHER_SUITE_WEP40,
- 	WLAN_CIPHER_SUITE_WEP104,
- 	WLAN_CIPHER_SUITE_TKIP,
- 	WLAN_CIPHER_SUITE_CCMP,
--	WLAN_CIPHER_SUITE_AES_CMAC,
-+	/* Keep as last entry: */
-+	WLAN_CIPHER_SUITE_AES_CMAC
- };
- 
- /* Vendor specific ie. id = 221, oui and type defines exact ie */
-@@ -1533,7 +1545,7 @@ static s32 brcmf_set_auth_type(struct ne
- 
- static s32
- brcmf_set_wsec_mode(struct net_device *ndev,
--		     struct cfg80211_connect_params *sme, bool mfp)
-+		    struct cfg80211_connect_params *sme)
- {
- 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
- 	struct brcmf_cfg80211_security *sec;
-@@ -1592,10 +1604,7 @@ brcmf_set_wsec_mode(struct net_device *n
- 	    sme->privacy)
- 		pval = AES_ENABLED;
- 
--	if (mfp)
--		wsec = pval | gval | MFP_CAPABLE;
--	else
--		wsec = pval | gval;
-+	wsec = pval | gval;
- 	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
- 	if (err) {
- 		brcmf_err("error (%d)\n", err);
-@@ -1612,56 +1621,100 @@ brcmf_set_wsec_mode(struct net_device *n
- static s32
- brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
- {
--	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
--	struct brcmf_cfg80211_security *sec;
--	s32 val = 0;
--	s32 err = 0;
-+	struct brcmf_if *ifp = netdev_priv(ndev);
-+	s32 val;
-+	s32 err;
-+	const struct brcmf_tlv *rsn_ie;
-+	const u8 *ie;
-+	u32 ie_len;
-+	u32 offset;
-+	u16 rsn_cap;
-+	u32 mfp;
-+	u16 count;
- 
--	if (sme->crypto.n_akm_suites) {
--		err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
--					       "wpa_auth", &val);
--		if (err) {
--			brcmf_err("could not get wpa_auth (%d)\n", err);
--			return err;
-+	if (!sme->crypto.n_akm_suites)
-+		return 0;
-+
-+	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
-+	if (err) {
-+		brcmf_err("could not get wpa_auth (%d)\n", err);
-+		return err;
-+	}
-+	if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
-+		switch (sme->crypto.akm_suites[0]) {
-+		case WLAN_AKM_SUITE_8021X:
-+			val = WPA_AUTH_UNSPECIFIED;
-+			break;
-+		case WLAN_AKM_SUITE_PSK:
-+			val = WPA_AUTH_PSK;
-+			break;
-+		default:
-+			brcmf_err("invalid cipher group (%d)\n",
-+				  sme->crypto.cipher_group);
-+			return -EINVAL;
- 		}
--		if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
--			switch (sme->crypto.akm_suites[0]) {
--			case WLAN_AKM_SUITE_8021X:
--				val = WPA_AUTH_UNSPECIFIED;
--				break;
--			case WLAN_AKM_SUITE_PSK:
--				val = WPA_AUTH_PSK;
--				break;
--			default:
--				brcmf_err("invalid cipher group (%d)\n",
--					  sme->crypto.cipher_group);
--				return -EINVAL;
--			}
--		} else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
--			switch (sme->crypto.akm_suites[0]) {
--			case WLAN_AKM_SUITE_8021X:
--				val = WPA2_AUTH_UNSPECIFIED;
--				break;
--			case WLAN_AKM_SUITE_PSK:
--				val = WPA2_AUTH_PSK;
--				break;
--			default:
--				brcmf_err("invalid cipher group (%d)\n",
--					  sme->crypto.cipher_group);
--				return -EINVAL;
--			}
-+	} else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
-+		switch (sme->crypto.akm_suites[0]) {
-+		case WLAN_AKM_SUITE_8021X:
-+			val = WPA2_AUTH_UNSPECIFIED;
-+			break;
-+		case WLAN_AKM_SUITE_8021X_SHA256:
-+			val = WPA2_AUTH_1X_SHA256;
-+			break;
-+		case WLAN_AKM_SUITE_PSK_SHA256:
-+			val = WPA2_AUTH_PSK_SHA256;
-+			break;
-+		case WLAN_AKM_SUITE_PSK:
-+			val = WPA2_AUTH_PSK;
-+			break;
-+		default:
-+			brcmf_err("invalid cipher group (%d)\n",
-+				  sme->crypto.cipher_group);
-+			return -EINVAL;
- 		}
-+	}
- 
--		brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
--		err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev),
--					       "wpa_auth", val);
--		if (err) {
--			brcmf_err("could not set wpa_auth (%d)\n", err);
--			return err;
--		}
-+	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
-+		goto skip_mfp_config;
-+	/* The MFP mode (1 or 2) needs to be determined, parse IEs. The
-+	 * IE will not be verified, just a quick search for MFP config
-+	 */
-+	rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
-+				  WLAN_EID_RSN);
-+	if (!rsn_ie)
-+		goto skip_mfp_config;
-+	ie = (const u8 *)rsn_ie;
-+	ie_len = rsn_ie->len + TLV_HDR_LEN;
-+	/* Skip unicast suite */
-+	offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
-+	if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
-+		goto skip_mfp_config;
-+	/* Skip multicast suite */
-+	count = ie[offset] + (ie[offset + 1] << 8);
-+	offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
-+	if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
-+		goto skip_mfp_config;
-+	/* Skip auth key management suite(s) */
-+	count = ie[offset] + (ie[offset + 1] << 8);
-+	offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
-+	if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
-+		goto skip_mfp_config;
-+	/* Ready to read capabilities */
-+	mfp = BRCMF_MFP_NONE;
-+	rsn_cap = ie[offset] + (ie[offset + 1] << 8);
-+	if (rsn_cap & RSN_CAP_MFPR_MASK)
-+		mfp = BRCMF_MFP_REQUIRED;
-+	else if (rsn_cap & RSN_CAP_MFPC_MASK)
-+		mfp = BRCMF_MFP_CAPABLE;
-+	brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
-+
-+skip_mfp_config:
-+	brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
-+	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
-+	if (err) {
-+		brcmf_err("could not set wpa_auth (%d)\n", err);
-+		return err;
- 	}
--	sec = &profile->sec;
--	sec->wpa_auth = sme->crypto.akm_suites[0];
- 
- 	return err;
- }
-@@ -1827,7 +1880,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
- 		goto done;
- 	}
- 
--	err = brcmf_set_wsec_mode(ndev, sme, sme->mfp == NL80211_MFP_REQUIRED);
-+	err = brcmf_set_wsec_mode(ndev, sme);
- 	if (err) {
- 		brcmf_err("wl_set_set_cipher failed (%d)\n", err);
- 		goto done;
-@@ -2077,10 +2130,12 @@ brcmf_cfg80211_del_key(struct wiphy *wip
- 		       u8 key_idx, bool pairwise, const u8 *mac_addr)
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
--	struct brcmf_wsec_key key;
--	s32 err = 0;
-+	struct brcmf_wsec_key *key;
-+	s32 err;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
-+
- 	if (!check_vif_up(ifp->vif))
- 		return -EIO;
- 
-@@ -2089,16 +2144,19 @@ brcmf_cfg80211_del_key(struct wiphy *wip
- 		return -EINVAL;
- 	}
- 
--	memset(&key, 0, sizeof(key));
-+	key = &ifp->vif->profile.key[key_idx];
- 
--	key.index = (u32)key_idx;
--	key.flags = BRCMF_PRIMARY_KEY;
--	key.algo = CRYPTO_ALGO_OFF;
-+	if (key->algo == CRYPTO_ALGO_OFF) {
-+		brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
-+		return -EINVAL;
-+	}
- 
--	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
-+	memset(key, 0, sizeof(*key));
-+	key->index = (u32)key_idx;
-+	key->flags = BRCMF_PRIMARY_KEY;
- 
--	/* Set the new key/index */
--	err = send_key_to_dongle(ifp, &key);
-+	/* Clear the key/index */
-+	err = send_key_to_dongle(ifp, key);
- 
- 	brcmf_dbg(TRACE, "Exit\n");
- 	return err;
-@@ -2106,8 +2164,8 @@ brcmf_cfg80211_del_key(struct wiphy *wip
- 
- static s32
- brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
--		    u8 key_idx, bool pairwise, const u8 *mac_addr,
--		    struct key_params *params)
-+		       u8 key_idx, bool pairwise, const u8 *mac_addr,
-+		       struct key_params *params)
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	struct brcmf_wsec_key *key;
-@@ -2214,9 +2272,10 @@ done:
- }
- 
- static s32
--brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
--		    u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
--		    void (*callback) (void *cookie, struct key_params * params))
-+brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
-+		       bool pairwise, const u8 *mac_addr, void *cookie,
-+		       void (*callback)(void *cookie,
-+					struct key_params *params))
- {
- 	struct key_params params;
- 	struct brcmf_if *ifp = netdev_priv(ndev);
-@@ -2268,8 +2327,15 @@ done:
- 
- static s32
- brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
--				    struct net_device *ndev, u8 key_idx)
-+				       struct net_device *ndev, u8 key_idx)
- {
-+	struct brcmf_if *ifp = netdev_priv(ndev);
-+
-+	brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
-+
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
-+		return 0;
-+
- 	brcmf_dbg(INFO, "Not supported\n");
- 
- 	return -EOPNOTSUPP;
-@@ -3769,7 +3835,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
- 	u32 auth = 0; /* d11 open authentication */
- 	u16 count;
- 	s32 err = 0;
--	s32 len = 0;
-+	s32 len;
- 	u32 i;
- 	u32 wsec;
- 	u32 pval = 0;
-@@ -3779,6 +3845,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
- 	u8 *data;
- 	u16 rsn_cap;
- 	u32 wme_bss_disable;
-+	u32 mfp;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 	if (wpa_ie == NULL)
-@@ -3893,19 +3960,53 @@ brcmf_configure_wpaie(struct brcmf_if *i
- 			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
- 				    (wpa_auth |= WPA_AUTH_PSK);
- 			break;
-+		case RSN_AKM_SHA256_PSK:
-+			brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
-+			wpa_auth |= WPA2_AUTH_PSK_SHA256;
-+			break;
-+		case RSN_AKM_SHA256_1X:
-+			brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
-+			wpa_auth |= WPA2_AUTH_1X_SHA256;
-+			break;
- 		default:
- 			brcmf_err("Ivalid key mgmt info\n");
- 		}
- 		offset++;
- 	}
- 
-+	mfp = BRCMF_MFP_NONE;
- 	if (is_rsn_ie) {
- 		wme_bss_disable = 1;
- 		if ((offset + RSN_CAP_LEN) <= len) {
- 			rsn_cap = data[offset] + (data[offset + 1] << 8);
- 			if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
- 				wme_bss_disable = 0;
-+			if (rsn_cap & RSN_CAP_MFPR_MASK) {
-+				brcmf_dbg(TRACE, "MFP Required\n");
-+				mfp = BRCMF_MFP_REQUIRED;
-+				/* Firmware only supports mfp required in
-+				 * combination with WPA2_AUTH_PSK_SHA256 or
-+				 * WPA2_AUTH_1X_SHA256.
-+				 */
-+				if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
-+						  WPA2_AUTH_1X_SHA256))) {
-+					err = -EINVAL;
-+					goto exit;
-+				}
-+				/* Firmware has requirement that WPA2_AUTH_PSK/
-+				 * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
-+				 * is to be included in the rsn ie.
-+				 */
-+				if (wpa_auth & WPA2_AUTH_PSK_SHA256)
-+					wpa_auth |= WPA2_AUTH_PSK;
-+				else if (wpa_auth & WPA2_AUTH_1X_SHA256)
-+					wpa_auth |= WPA2_AUTH_UNSPECIFIED;
-+			} else if (rsn_cap & RSN_CAP_MFPC_MASK) {
-+				brcmf_dbg(TRACE, "MFP Capable\n");
-+				mfp = BRCMF_MFP_CAPABLE;
-+			}
- 		}
-+		offset += RSN_CAP_LEN;
- 		/* set wme_bss_disable to sync RSN Capabilities */
- 		err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
- 					       wme_bss_disable);
-@@ -3913,6 +4014,21 @@ brcmf_configure_wpaie(struct brcmf_if *i
- 			brcmf_err("wme_bss_disable error %d\n", err);
- 			goto exit;
- 		}
-+
-+		/* Skip PMKID cnt as it is know to be 0 for AP. */
-+		offset += RSN_PMKID_COUNT_LEN;
-+
-+		/* See if there is BIP wpa suite left for MFP */
-+		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
-+		    ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
-+			err = brcmf_fil_bsscfg_data_set(ifp, "bip",
-+							&data[offset],
-+							WPA_IE_MIN_OUI_LEN);
-+			if (err < 0) {
-+				brcmf_err("bip error %d\n", err);
-+				goto exit;
-+			}
-+		}
- 	}
- 	/* FOR WPS , set SES_OW_ENABLED */
- 	wsec = (pval | gval | SES_OW_ENABLED);
-@@ -3929,6 +4045,16 @@ brcmf_configure_wpaie(struct brcmf_if *i
- 		brcmf_err("wsec error %d\n", err);
- 		goto exit;
- 	}
-+	/* Configure MFP, this needs to go after wsec otherwise the wsec command
-+	 * will overwrite the values set by MFP
-+	 */
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
-+		err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
-+		if (err < 0) {
-+			brcmf_err("mfp error %d\n", err);
-+			goto exit;
-+		}
-+	}
- 	/* set upper-layer auth */
- 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
- 	if (err < 0) {
-@@ -6149,8 +6275,10 @@ static int brcmf_setup_wiphy(struct wiph
- 	wiphy->n_addresses = i;
- 
- 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
--	wiphy->cipher_suites = __wl_cipher_suites;
--	wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
-+	wiphy->cipher_suites = brcmf_cipher_suites;
-+	wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
-+	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
-+		wiphy->n_cipher_suites--;
- 	wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
- 			WIPHY_FLAG_OFFCHAN_TX |
- 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -72,7 +72,7 @@
- 
- #define BRCMF_VNDR_IE_P2PAF_SHIFT	12
- 
--#define BRCMF_MAX_DEFAULT_KEYS		4
-+#define BRCMF_MAX_DEFAULT_KEYS		6
- 
- /* beacon loss timeout defaults */
- #define BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON	2
-@@ -107,7 +107,6 @@ struct brcmf_cfg80211_security {
- 	u32 auth_type;
- 	u32 cipher_pairwise;
- 	u32 cipher_group;
--	u32 wpa_auth;
- };
- 
- /**
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -161,6 +161,7 @@ void brcmf_feat_attach(struct brcmf_pub
- 		ifp->drvr->feat_flags &= ~BIT(BRCMF_FEAT_MBSS);
- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_RSDB, "rsdb_mode");
- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_TDLS, "tdls_enable");
-+	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MFP, "mfp");
- 
- 	pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
- 	err = brcmf_fil_iovar_data_get(ifp, "pfn_macaddr", &pfn_mac,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -30,6 +30,7 @@
-  * WOWL_ND: WOWL net detect (PNO)
-  * WOWL_GTK: (WOWL) GTK rekeying offload
-  * WOWL_ARP_ND: ARP and Neighbor Discovery offload support during WOWL.
-+ * MFP: 802.11w Management Frame Protection.
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -42,7 +43,8 @@
- 	BRCMF_FEAT_DEF(SCAN_RANDOM_MAC) \
- 	BRCMF_FEAT_DEF(WOWL_ND) \
- 	BRCMF_FEAT_DEF(WOWL_GTK) \
--	BRCMF_FEAT_DEF(WOWL_ARP_ND)
-+	BRCMF_FEAT_DEF(WOWL_ARP_ND) \
-+	BRCMF_FEAT_DEF(MFP)
- 
- /*
-  * Quirks:
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -142,6 +142,10 @@
- #define BRCMF_RSN_KEK_LENGTH		16
- #define BRCMF_RSN_REPLAY_LEN		8
- 
-+#define BRCMF_MFP_NONE			0
-+#define BRCMF_MFP_CAPABLE		1
-+#define BRCMF_MFP_REQUIRED		2
-+
- /* join preference types for join_pref iovar */
- enum brcmf_join_pref_types {
- 	BRCMF_JOIN_PREF_RSSI = 1,
---- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
-@@ -236,6 +236,8 @@ static inline bool ac_bitmap_tst(u8 bitm
- #define WPA2_AUTH_RESERVED3	0x0200
- #define WPA2_AUTH_RESERVED4	0x0400
- #define WPA2_AUTH_RESERVED5	0x0800
-+#define WPA2_AUTH_1X_SHA256	0x1000  /* 1X with SHA256 key derivation */
-+#define WPA2_AUTH_PSK_SHA256	0x8000	/* PSK with SHA256 key derivation */
- 
- #define DOT11_DEFAULT_RTS_LEN		2347
- #define DOT11_DEFAULT_FRAG_LEN		2346
diff --git a/package/kernel/mac80211/patches/345-brcmfmac-Remove-waitqueue_active-check.patch b/package/kernel/mac80211/patches/345-brcmfmac-Remove-waitqueue_active-check.patch
deleted file mode 100644
index 39f438321e..0000000000
--- a/package/kernel/mac80211/patches/345-brcmfmac-Remove-waitqueue_active-check.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Hui Wang <hui.wang@canonical.com>
-Date: Wed, 9 Mar 2016 15:25:26 +0800
-Subject: [PATCH] brcmfmac: Remove waitqueue_active check
-
-We met a problem of pm_suspend  when repeated closing/opening the lid
-on a Lenovo laptop (1/20 reproduce rate), below is the log:
-
-[ 199.735876] PM: Entering mem sleep
-[ 199.750516] e1000e: EEE TX LPI TIMER: 00000011
-[ 199.856638] Trying to free nonexistent resource <000000000000d000-000000000000d0ff>
-[ 201.753566] brcmfmac: brcmf_pcie_suspend: Timeout on response for entering D3 substate
-[ 201.753581] pci_legacy_suspend(): brcmf_pcie_suspend+0x0/0x1f0 [brcmfmac] returns -5
-[ 201.753585] dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -5
-[ 201.753589] PM: Device 0000:04:00.0 failed to suspend async: error -5
-
-Through debugging, we found when problem happens, it is not the device
-fails to enter D3, but the signal D3_ACK comes too early to pass the
-waitqueue_active() check.
-
-Just like this:
-brcmf_pcie_send_mb_data(devinfo, BRCMF_H2D_HOST_D3_INFORM);
-// signal is triggered here
-wait_event_timeout(devinfo->mbdata_resp_wait, devinfo->mbdata_completed,
-		   BRCMF_PCIE_MBDATA_TIMEOUT);
-
-So far I think it is safe to remove waitqueue_active check since there
-is only one place to trigger this signal (sending
-BRCMF_H2D_HOST_D3_INFORM). And it is not a problem calling wake_up
-event earlier than calling wait_event.
-
-Cc: Brett Rudley <brudley@broadcom.com>
-Cc: Hante Meuleman <meuleman@broadcom.com>
-Cc: Franky (Zhenhui) Lin <frankyl@broadcom.com>
-Cc: Pieter-Paul Giesberts <pieterpg@broadcom.com>
-Cc: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Hui Wang <hui.wang@canonical.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -677,10 +677,8 @@ static void brcmf_pcie_handle_mb_data(st
- 		brcmf_dbg(PCIE, "D2H_MB_DATA: DEEP SLEEP EXIT\n");
- 	if (dtoh_mb_data & BRCMF_D2H_DEV_D3_ACK) {
- 		brcmf_dbg(PCIE, "D2H_MB_DATA: D3 ACK\n");
--		if (waitqueue_active(&devinfo->mbdata_resp_wait)) {
--			devinfo->mbdata_completed = true;
--			wake_up(&devinfo->mbdata_resp_wait);
--		}
-+		devinfo->mbdata_completed = true;
-+		wake_up(&devinfo->mbdata_resp_wait);
- 	}
- }
- 
diff --git a/package/kernel/mac80211/patches/346-brcmfmac-uninitialized-ret-variable.patch b/package/kernel/mac80211/patches/346-brcmfmac-uninitialized-ret-variable.patch
deleted file mode 100644
index 3c9ed425da..0000000000
--- a/package/kernel/mac80211/patches/346-brcmfmac-uninitialized-ret-variable.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Tue, 15 Mar 2016 10:06:10 +0300
-Subject: [PATCH] brcmfmac: uninitialized "ret" variable
-
-There is an error path where "ret" isn't initialized.
-
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -250,7 +250,7 @@ static int brcmf_sdiod_request_data(stru
- 				    u32 addr, u8 regsz, void *data, bool write)
- {
- 	struct sdio_func *func;
--	int ret;
-+	int ret = -EINVAL;
- 
- 	brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
- 		  write, fn, addr, regsz);
diff --git a/package/kernel/mac80211/patches/347-brcmfmac-sdio-remove-unused-variable-retry_limit.patch b/package/kernel/mac80211/patches/347-brcmfmac-sdio-remove-unused-variable-retry_limit.patch
deleted file mode 100644
index d1deb6ee5c..0000000000
--- a/package/kernel/mac80211/patches/347-brcmfmac-sdio-remove-unused-variable-retry_limit.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From: Colin Ian King <colin.king@canonical.com>
-Date: Sun, 20 Mar 2016 17:34:52 +0000
-Subject: [PATCH] brcmfmac: sdio: remove unused variable retry_limit
-
-retry_limit has never been used during the life of this driver, so
-we may as well remove it as it is redundant.
-
-Signed-off-by: Colin Ian King <colin.king@canonical.com>
-Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -535,9 +535,6 @@ static int qcount[NUMPRIO];
- 
- #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
- 
--/* Retry count for register access failures */
--static const uint retry_limit = 2;
--
- /* Limit on rounding up frames */
- static const uint max_roundup = 512;
- 
diff --git a/package/kernel/mac80211/patches/348-brcmfmac-Delete-unnecessary-variable-initialisation.patch b/package/kernel/mac80211/patches/348-brcmfmac-Delete-unnecessary-variable-initialisation.patch
deleted file mode 100644
index d399b264ea..0000000000
--- a/package/kernel/mac80211/patches/348-brcmfmac-Delete-unnecessary-variable-initialisation.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Markus Elfring <elfring@users.sourceforge.net>
-Date: Fri, 18 Mar 2016 13:23:24 +1100
-Subject: [PATCH] brcmfmac: Delete unnecessary variable initialisation
-
-In brcmf_sdio_download_firmware(), bcmerror is set by the call to
-brcmf_sdio_download_code_file(), before it's checked in the following
-line.
-
-Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
-Acked-by: Arend van Spriel <arend@broadcom.com>
-[Rewrote commit message]
-Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3258,7 +3258,7 @@ static int brcmf_sdio_download_firmware(
- 					const struct firmware *fw,
- 					void *nvram, u32 nvlen)
- {
--	int bcmerror = -EFAULT;
-+	int bcmerror;
- 	u32 rstvec;
- 
- 	sdio_claim_host(bus->sdiodev->func[1]);
diff --git a/package/kernel/mac80211/patches/349-0001-brcmfmac-clear-eventmask-array-before-using-it.patch b/package/kernel/mac80211/patches/349-0001-brcmfmac-clear-eventmask-array-before-using-it.patch
deleted file mode 100644
index 0acb4faaf1..0000000000
--- a/package/kernel/mac80211/patches/349-0001-brcmfmac-clear-eventmask-array-before-using-it.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:21 +0200
-Subject: [PATCH] brcmfmac: clear eventmask array before using it
-
-When the event_msgs iovar is set an array is used to configure the
-enabled events. This arrays needs to nulled before configuring
-otherwise unhandled events will be enabled. This solves a problem
-where in case of wowl the host got woken by an incorrectly enabled
-event.
-
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -371,6 +371,7 @@ int brcmf_fweh_activate_events(struct br
- 	int i, err;
- 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
- 
-+	memset(eventmask, 0, sizeof(eventmask));
- 	for (i = 0; i < BRCMF_E_LAST; i++) {
- 		if (ifp->drvr->fweh.evt_handler[i]) {
- 			brcmf_dbg(EVENT, "enable event %s\n",
diff --git a/package/kernel/mac80211/patches/349-0002-brcmfmac-fix-clearing-wowl-wake-indicators.patch b/package/kernel/mac80211/patches/349-0002-brcmfmac-fix-clearing-wowl-wake-indicators.patch
deleted file mode 100644
index 8d3067890c..0000000000
--- a/package/kernel/mac80211/patches/349-0002-brcmfmac-fix-clearing-wowl-wake-indicators.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:22 +0200
-Subject: [PATCH] brcmfmac: fix clearing wowl wake indicators
-
-Newer firmwares require the usage of the wowl wakeind struct as size
-for the iovar to clear the wake indicators. Older firmwares do not
-care, so change the used size.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3608,7 +3608,8 @@ static void brcmf_configure_wowl(struct
- 	if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
- 		wowl_config |= BRCMF_WOWL_UNASSOC;
- 
--	brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear", strlen("clear"));
-+	brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear",
-+				 sizeof(struct brcmf_wowl_wakeind_le));
- 	brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
- 	brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
- 	brcmf_bus_wowl_config(cfg->pub->bus_if, true);
diff --git a/package/kernel/mac80211/patches/349-0003-brcmfmac-insert-default-boardrev-in-nvram-data-if-mi.patch b/package/kernel/mac80211/patches/349-0003-brcmfmac-insert-default-boardrev-in-nvram-data-if-mi.patch
deleted file mode 100644
index f293401ca8..0000000000
--- a/package/kernel/mac80211/patches/349-0003-brcmfmac-insert-default-boardrev-in-nvram-data-if-mi.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:23 +0200
-Subject: [PATCH] brcmfmac: insert default boardrev in nvram data if
- missing
-
-Some nvram files/stores come without the boardrev information,
-but firmware requires this to be set. When not found in nvram then
-add a default boardrev string to the nvram data.
-
-Reported-by: Rafal Milecki <zajec5@gmail.com>
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Franky (Zhenhui) Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -29,6 +29,7 @@
- #define BRCMF_FW_MAX_NVRAM_SIZE			64000
- #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
- #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
-+#define BRCMF_FW_DEFAULT_BOARDREV		"boardrev=0xff"
- 
- enum nvram_parser_state {
- 	IDLE,
-@@ -51,6 +52,7 @@ enum nvram_parser_state {
-  * @entry: start position of key,value entry.
-  * @multi_dev_v1: detect pcie multi device v1 (compressed).
-  * @multi_dev_v2: detect pcie multi device v2.
-+ * @boardrev_found: nvram contains boardrev information.
-  */
- struct nvram_parser {
- 	enum nvram_parser_state state;
-@@ -63,6 +65,7 @@ struct nvram_parser {
- 	u32 entry;
- 	bool multi_dev_v1;
- 	bool multi_dev_v2;
-+	bool boardrev_found;
- };
- 
- /**
-@@ -125,6 +128,8 @@ static enum nvram_parser_state brcmf_nvr
- 			nvp->multi_dev_v1 = true;
- 		if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
- 			nvp->multi_dev_v2 = true;
-+		if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
-+			nvp->boardrev_found = true;
- 	} else if (!is_nvram_char(c) || c == ' ') {
- 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
- 			  nvp->line, nvp->column);
-@@ -284,6 +289,8 @@ static void brcmf_fw_strip_multi_v1(stru
- 	while (i < nvp->nvram_len) {
- 		if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
- 			i += 2;
-+			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
-+				nvp->boardrev_found = true;
- 			while (nvp->nvram[i] != 0) {
- 				nvram[j] = nvp->nvram[i];
- 				i++;
-@@ -335,6 +342,8 @@ static void brcmf_fw_strip_multi_v2(stru
- 	while (i < nvp->nvram_len - len) {
- 		if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
- 			i += len;
-+			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
-+				nvp->boardrev_found = true;
- 			while (nvp->nvram[i] != 0) {
- 				nvram[j] = nvp->nvram[i];
- 				i++;
-@@ -356,6 +365,18 @@ fail:
- 	nvp->nvram_len = 0;
- }
- 
-+static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
-+{
-+	if (nvp->boardrev_found)
-+		return;
-+
-+	memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
-+	       strlen(BRCMF_FW_DEFAULT_BOARDREV));
-+	nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
-+	nvp->nvram[nvp->nvram_len] = '\0';
-+	nvp->nvram_len++;
-+}
-+
- /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
-  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
-  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
-@@ -377,16 +398,21 @@ static void *brcmf_fw_nvram_strip(const
- 		if (nvp.state == END)
- 			break;
- 	}
--	if (nvp.multi_dev_v1)
-+	if (nvp.multi_dev_v1) {
-+		nvp.boardrev_found = false;
- 		brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
--	else if (nvp.multi_dev_v2)
-+	} else if (nvp.multi_dev_v2) {
-+		nvp.boardrev_found = false;
- 		brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
-+	}
- 
- 	if (nvp.nvram_len == 0) {
- 		kfree(nvp.nvram);
- 		return NULL;
- 	}
- 
-+	brcmf_fw_add_defaults(&nvp);
-+
- 	pad = nvp.nvram_len;
- 	*new_length = roundup(nvp.nvram_len + 1, 4);
- 	while (pad != *new_length) {
diff --git a/package/kernel/mac80211/patches/349-0004-brcmfmac-fix-p2p-scan-abort-null-pointer-exception.patch b/package/kernel/mac80211/patches/349-0004-brcmfmac-fix-p2p-scan-abort-null-pointer-exception.patch
deleted file mode 100644
index ed0c83f9bb..0000000000
--- a/package/kernel/mac80211/patches/349-0004-brcmfmac-fix-p2p-scan-abort-null-pointer-exception.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:24 +0200
-Subject: [PATCH] brcmfmac: fix p2p scan abort null pointer exception
-
-When p2p connection setup is performed without having ever done an
-escan a null pointer exception can occur. This is because the ifp
-to abort scanning is taken from escan struct while it was never
-initialized. Fix this by using the primary ifp for scan abort. The
-abort should still be performed and all scan related commands are
-performed on primary ifp.
-
-Reviewed-by: Arend Van Spriel <arend@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -1266,7 +1266,7 @@ static void
- brcmf_p2p_stop_wait_next_action_frame(struct brcmf_cfg80211_info *cfg)
- {
- 	struct brcmf_p2p_info *p2p = &cfg->p2p;
--	struct brcmf_if *ifp = cfg->escan_info.ifp;
-+	struct brcmf_if *ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
- 
- 	if (test_bit(BRCMF_P2P_STATUS_SENDING_ACT_FRAME, &p2p->status) &&
- 	    (test_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status) ||
diff --git a/package/kernel/mac80211/patches/349-0005-brcmfmac-screening-firmware-event-packet.patch b/package/kernel/mac80211/patches/349-0005-brcmfmac-screening-firmware-event-packet.patch
deleted file mode 100644
index 4d26404f51..0000000000
--- a/package/kernel/mac80211/patches/349-0005-brcmfmac-screening-firmware-event-packet.patch
+++ /dev/null
@@ -1,297 +0,0 @@
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:25 +0200
-Subject: [PATCH] brcmfmac: screening firmware event packet
-
-Firmware uses asynchronized events as a communication method to the
-host. The event packets are marked as ETH_P_LINK_CTL protocol type. For
-SDIO and PCIe bus, this kind of packets are delivered through virtual
-event channel not data channel. This patch adds a screening logic to
-make sure the event handler only processes the events coming from the
-correct channel.
-
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -216,7 +216,9 @@ bool brcmf_c_prec_enq(struct device *dev
- 		      int prec);
- 
- /* Receive frame for delivery to OS.  Callee disposes of rxp. */
--void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp);
-+void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp, bool handle_evnt);
-+/* Receive async event packet from firmware. Callee disposes of rxp. */
-+void brcmf_rx_event(struct device *dev, struct sk_buff *rxp);
- 
- /* Indication from bus module regarding presence/insertion of dongle. */
- int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -311,16 +311,17 @@ void brcmf_txflowblock(struct device *de
- 	brcmf_fws_bus_blocked(drvr, state);
- }
- 
--void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
-+void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb,
-+		    bool handle_event)
- {
--	skb->dev = ifp->ndev;
--	skb->protocol = eth_type_trans(skb, skb->dev);
-+	skb->protocol = eth_type_trans(skb, ifp->ndev);
- 
- 	if (skb->pkt_type == PACKET_MULTICAST)
- 		ifp->stats.multicast++;
- 
- 	/* Process special event packets */
--	brcmf_fweh_process_skb(ifp->drvr, skb);
-+	if (handle_event)
-+		brcmf_fweh_process_skb(ifp->drvr, skb);
- 
- 	if (!(ifp->ndev->flags & IFF_UP)) {
- 		brcmu_pkt_buf_free_skb(skb);
-@@ -381,7 +382,7 @@ static void brcmf_rxreorder_process_info
- 	/* validate flags and flow id */
- 	if (flags == 0xFF) {
- 		brcmf_err("invalid flags...so ignore this packet\n");
--		brcmf_netif_rx(ifp, pkt);
-+		brcmf_netif_rx(ifp, pkt, false);
- 		return;
- 	}
- 
-@@ -393,7 +394,7 @@ static void brcmf_rxreorder_process_info
- 		if (rfi == NULL) {
- 			brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
- 				  flow_id);
--			brcmf_netif_rx(ifp, pkt);
-+			brcmf_netif_rx(ifp, pkt, false);
- 			return;
- 		}
- 
-@@ -418,7 +419,7 @@ static void brcmf_rxreorder_process_info
- 		rfi = kzalloc(buf_size, GFP_ATOMIC);
- 		if (rfi == NULL) {
- 			brcmf_err("failed to alloc buffer\n");
--			brcmf_netif_rx(ifp, pkt);
-+			brcmf_netif_rx(ifp, pkt, false);
- 			return;
- 		}
- 
-@@ -532,11 +533,11 @@ static void brcmf_rxreorder_process_info
- netif_rx:
- 	skb_queue_walk_safe(&reorder_list, pkt, pnext) {
- 		__skb_unlink(pkt, &reorder_list);
--		brcmf_netif_rx(ifp, pkt);
-+		brcmf_netif_rx(ifp, pkt, false);
- 	}
- }
- 
--void brcmf_rx_frame(struct device *dev, struct sk_buff *skb)
-+void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_evnt)
- {
- 	struct brcmf_if *ifp;
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-@@ -560,7 +561,32 @@ void brcmf_rx_frame(struct device *dev,
- 	if (rd->reorder)
- 		brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
- 	else
--		brcmf_netif_rx(ifp, skb);
-+		brcmf_netif_rx(ifp, skb, handle_evnt);
-+}
-+
-+void brcmf_rx_event(struct device *dev, struct sk_buff *skb)
-+{
-+	struct brcmf_if *ifp;
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_pub *drvr = bus_if->drvr;
-+	int ret;
-+
-+	brcmf_dbg(EVENT, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
-+
-+	/* process and remove protocol-specific header */
-+	ret = brcmf_proto_hdrpull(drvr, true, skb, &ifp);
-+
-+	if (ret || !ifp || !ifp->ndev) {
-+		if (ret != -ENODATA && ifp)
-+			ifp->stats.rx_errors++;
-+		brcmu_pkt_buf_free_skb(skb);
-+		return;
-+	}
-+
-+	skb->protocol = eth_type_trans(skb, ifp->ndev);
-+
-+	brcmf_fweh_process_skb(ifp->drvr, skb);
-+	brcmu_pkt_buf_free_skb(skb);
- }
- 
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -225,7 +225,8 @@ int brcmf_get_next_free_bsscfgidx(struct
- void brcmf_txflowblock_if(struct brcmf_if *ifp,
- 			  enum brcmf_netif_stop_reason reason, bool state);
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
--void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
-+void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb,
-+		    bool handle_event);
- void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
- int __init brcmf_core_init(void);
- void __exit brcmf_core_exit(void);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -20,6 +20,7 @@
- 
- #include <linux/types.h>
- #include <linux/netdevice.h>
-+#include <linux/etherdevice.h>
- 
- #include <brcmu_utils.h>
- #include <brcmu_wifi.h>
-@@ -1075,28 +1076,13 @@ static void brcmf_msgbuf_rxbuf_event_pos
- }
- 
- 
--static void
--brcmf_msgbuf_rx_skb(struct brcmf_msgbuf *msgbuf, struct sk_buff *skb,
--		    u8 ifidx)
--{
--	struct brcmf_if *ifp;
--
--	ifp = brcmf_get_ifp(msgbuf->drvr, ifidx);
--	if (!ifp || !ifp->ndev) {
--		brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
--		brcmu_pkt_buf_free_skb(skb);
--		return;
--	}
--	brcmf_netif_rx(ifp, skb);
--}
--
--
- static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
- {
- 	struct msgbuf_rx_event *event;
- 	u32 idx;
- 	u16 buflen;
- 	struct sk_buff *skb;
-+	struct brcmf_if *ifp;
- 
- 	event = (struct msgbuf_rx_event *)buf;
- 	idx = le32_to_cpu(event->msg.request_id);
-@@ -1116,7 +1102,19 @@ static void brcmf_msgbuf_process_event(s
- 
- 	skb_trim(skb, buflen);
- 
--	brcmf_msgbuf_rx_skb(msgbuf, skb, event->msg.ifidx);
-+	ifp = brcmf_get_ifp(msgbuf->drvr, event->msg.ifidx);
-+	if (!ifp || !ifp->ndev) {
-+		brcmf_err("Received pkt for invalid ifidx %d\n",
-+			  event->msg.ifidx);
-+		goto exit;
-+	}
-+
-+	skb->protocol = eth_type_trans(skb, ifp->ndev);
-+
-+	brcmf_fweh_process_skb(ifp->drvr, skb);
-+
-+exit:
-+	brcmu_pkt_buf_free_skb(skb);
- }
- 
- 
-@@ -1128,6 +1126,7 @@ brcmf_msgbuf_process_rx_complete(struct
- 	u16 data_offset;
- 	u16 buflen;
- 	u32 idx;
-+	struct brcmf_if *ifp;
- 
- 	brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1);
- 
-@@ -1148,7 +1147,14 @@ brcmf_msgbuf_process_rx_complete(struct
- 
- 	skb_trim(skb, buflen);
- 
--	brcmf_msgbuf_rx_skb(msgbuf, skb, rx_complete->msg.ifidx);
-+	ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
-+	if (!ifp || !ifp->ndev) {
-+		brcmf_err("Received pkt for invalid ifidx %d\n",
-+			  rx_complete->msg.ifidx);
-+		brcmu_pkt_buf_free_skb(skb);
-+		return;
-+	}
-+	brcmf_netif_rx(ifp, skb, false);
- }
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1294,6 +1294,17 @@ static inline u8 brcmf_sdio_getdatoffset
- 	return (u8)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT);
- }
- 
-+static inline bool brcmf_sdio_fromevntchan(u8 *swheader)
-+{
-+	u32 hdrvalue;
-+	u8 ret;
-+
-+	hdrvalue = *(u32 *)swheader;
-+	ret = (u8)((hdrvalue & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT);
-+
-+	return (ret == SDPCM_EVENT_CHANNEL);
-+}
-+
- static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
- 			      struct brcmf_sdio_hdrinfo *rd,
- 			      enum brcmf_sdio_frmtype type)
-@@ -1641,7 +1652,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 					   pfirst->len, pfirst->next,
- 					   pfirst->prev);
- 			skb_unlink(pfirst, &bus->glom);
--			brcmf_rx_frame(bus->sdiodev->dev, pfirst);
-+			if (brcmf_sdio_fromevntchan(pfirst->data))
-+				brcmf_rx_event(bus->sdiodev->dev, pfirst);
-+			else
-+				brcmf_rx_frame(bus->sdiodev->dev, pfirst,
-+					       false);
- 			bus->sdcnt.rxglompkts++;
- 		}
- 
-@@ -1967,18 +1982,19 @@ static uint brcmf_sdio_readframes(struct
- 		__skb_trim(pkt, rd->len);
- 		skb_pull(pkt, rd->dat_offset);
- 
-+		if (pkt->len == 0)
-+			brcmu_pkt_buf_free_skb(pkt);
-+		else if (rd->channel == SDPCM_EVENT_CHANNEL)
-+			brcmf_rx_event(bus->sdiodev->dev, pkt);
-+		else
-+			brcmf_rx_frame(bus->sdiodev->dev, pkt,
-+				       false);
-+
- 		/* prepare the descriptor for the next read */
- 		rd->len = rd->len_nxtfrm << 4;
- 		rd->len_nxtfrm = 0;
- 		/* treat all packet as event if we don't know */
- 		rd->channel = SDPCM_EVENT_CHANNEL;
--
--		if (pkt->len == 0) {
--			brcmu_pkt_buf_free_skb(pkt);
--			continue;
--		}
--
--		brcmf_rx_frame(bus->sdiodev->dev, pkt);
- 	}
- 
- 	rxcount = maxframes - rxleft;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -514,7 +514,7 @@ static void brcmf_usb_rx_complete(struct
- 
- 	if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
- 		skb_put(skb, urb->actual_length);
--		brcmf_rx_frame(devinfo->dev, skb);
-+		brcmf_rx_frame(devinfo->dev, skb, true);
- 		brcmf_usb_rx_refill(devinfo, req);
- 	} else {
- 		brcmu_pkt_buf_free_skb(skb);
diff --git a/package/kernel/mac80211/patches/349-0006-brcmfmac-cleanup-ampdu-rx-host-reorder-code.patch b/package/kernel/mac80211/patches/349-0006-brcmfmac-cleanup-ampdu-rx-host-reorder-code.patch
deleted file mode 100644
index 33b263df3a..0000000000
--- a/package/kernel/mac80211/patches/349-0006-brcmfmac-cleanup-ampdu-rx-host-reorder-code.patch
+++ /dev/null
@@ -1,585 +0,0 @@
-From: Arend van Spriel <arend@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:26 +0200
-Subject: [PATCH] brcmfmac: cleanup ampdu-rx host reorder code
-
-The code for ampdu-rx host reorder is related to the firmware signalling
-supported in BCDC protocol. This change moves the code to fwsignal module.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -351,6 +351,12 @@ brcmf_proto_bcdc_add_tdls_peer(struct br
- {
- }
- 
-+static void brcmf_proto_bcdc_rxreorder(struct brcmf_if *ifp,
-+				       struct sk_buff *skb)
-+{
-+	brcmf_fws_rxreorder(ifp, skb);
-+}
-+
- int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_bcdc *bcdc;
-@@ -372,6 +378,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
- 	drvr->proto->configure_addr_mode = brcmf_proto_bcdc_configure_addr_mode;
- 	drvr->proto->delete_peer = brcmf_proto_bcdc_delete_peer;
- 	drvr->proto->add_tdls_peer = brcmf_proto_bcdc_add_tdls_peer;
-+	drvr->proto->rxreorder = brcmf_proto_bcdc_rxreorder;
- 	drvr->proto->pd = bcdc;
- 
- 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -40,19 +40,6 @@
- 
- #define MAX_WAIT_FOR_8021X_TX			msecs_to_jiffies(950)
- 
--/* AMPDU rx reordering definitions */
--#define BRCMF_RXREORDER_FLOWID_OFFSET		0
--#define BRCMF_RXREORDER_MAXIDX_OFFSET		2
--#define BRCMF_RXREORDER_FLAGS_OFFSET		4
--#define BRCMF_RXREORDER_CURIDX_OFFSET		6
--#define BRCMF_RXREORDER_EXPIDX_OFFSET		8
--
--#define BRCMF_RXREORDER_DEL_FLOW		0x01
--#define BRCMF_RXREORDER_FLUSH_ALL		0x02
--#define BRCMF_RXREORDER_CURIDX_VALID		0x04
--#define BRCMF_RXREORDER_EXPIDX_VALID		0x08
--#define BRCMF_RXREORDER_NEW_HOLE		0x10
--
- #define BRCMF_BSSIDX_INVALID			-1
- 
- char *brcmf_ifname(struct brcmf_if *ifp)
-@@ -342,207 +329,11 @@ void brcmf_netif_rx(struct brcmf_if *ifp
- 		netif_rx_ni(skb);
- }
- 
--static void brcmf_rxreorder_get_skb_list(struct brcmf_ampdu_rx_reorder *rfi,
--					 u8 start, u8 end,
--					 struct sk_buff_head *skb_list)
--{
--	/* initialize return list */
--	__skb_queue_head_init(skb_list);
--
--	if (rfi->pend_pkts == 0) {
--		brcmf_dbg(INFO, "no packets in reorder queue\n");
--		return;
--	}
--
--	do {
--		if (rfi->pktslots[start]) {
--			__skb_queue_tail(skb_list, rfi->pktslots[start]);
--			rfi->pktslots[start] = NULL;
--		}
--		start++;
--		if (start > rfi->max_idx)
--			start = 0;
--	} while (start != end);
--	rfi->pend_pkts -= skb_queue_len(skb_list);
--}
--
--static void brcmf_rxreorder_process_info(struct brcmf_if *ifp, u8 *reorder_data,
--					 struct sk_buff *pkt)
--{
--	u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
--	struct brcmf_ampdu_rx_reorder *rfi;
--	struct sk_buff_head reorder_list;
--	struct sk_buff *pnext;
--	u8 flags;
--	u32 buf_size;
--
--	flow_id = reorder_data[BRCMF_RXREORDER_FLOWID_OFFSET];
--	flags = reorder_data[BRCMF_RXREORDER_FLAGS_OFFSET];
--
--	/* validate flags and flow id */
--	if (flags == 0xFF) {
--		brcmf_err("invalid flags...so ignore this packet\n");
--		brcmf_netif_rx(ifp, pkt, false);
--		return;
--	}
--
--	rfi = ifp->drvr->reorder_flows[flow_id];
--	if (flags & BRCMF_RXREORDER_DEL_FLOW) {
--		brcmf_dbg(INFO, "flow-%d: delete\n",
--			  flow_id);
--
--		if (rfi == NULL) {
--			brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
--				  flow_id);
--			brcmf_netif_rx(ifp, pkt, false);
--			return;
--		}
--
--		brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, rfi->exp_idx,
--					     &reorder_list);
--		/* add the last packet */
--		__skb_queue_tail(&reorder_list, pkt);
--		kfree(rfi);
--		ifp->drvr->reorder_flows[flow_id] = NULL;
--		goto netif_rx;
--	}
--	/* from here on we need a flow reorder instance */
--	if (rfi == NULL) {
--		buf_size = sizeof(*rfi);
--		max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
--
--		buf_size += (max_idx + 1) * sizeof(pkt);
--
--		/* allocate space for flow reorder info */
--		brcmf_dbg(INFO, "flow-%d: start, maxidx %d\n",
--			  flow_id, max_idx);
--		rfi = kzalloc(buf_size, GFP_ATOMIC);
--		if (rfi == NULL) {
--			brcmf_err("failed to alloc buffer\n");
--			brcmf_netif_rx(ifp, pkt, false);
--			return;
--		}
--
--		ifp->drvr->reorder_flows[flow_id] = rfi;
--		rfi->pktslots = (struct sk_buff **)(rfi+1);
--		rfi->max_idx = max_idx;
--	}
--	if (flags & BRCMF_RXREORDER_NEW_HOLE)  {
--		if (rfi->pend_pkts) {
--			brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx,
--						     rfi->exp_idx,
--						     &reorder_list);
--			WARN_ON(rfi->pend_pkts);
--		} else {
--			__skb_queue_head_init(&reorder_list);
--		}
--		rfi->cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
--		rfi->exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
--		rfi->max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
--		rfi->pktslots[rfi->cur_idx] = pkt;
--		rfi->pend_pkts++;
--		brcmf_dbg(DATA, "flow-%d: new hole %d (%d), pending %d\n",
--			  flow_id, rfi->cur_idx, rfi->exp_idx, rfi->pend_pkts);
--	} else if (flags & BRCMF_RXREORDER_CURIDX_VALID) {
--		cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
--		exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
--
--		if ((exp_idx == rfi->exp_idx) && (cur_idx != rfi->exp_idx)) {
--			/* still in the current hole */
--			/* enqueue the current on the buffer chain */
--			if (rfi->pktslots[cur_idx] != NULL) {
--				brcmf_dbg(INFO, "HOLE: ERROR buffer pending..free it\n");
--				brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
--				rfi->pktslots[cur_idx] = NULL;
--			}
--			rfi->pktslots[cur_idx] = pkt;
--			rfi->pend_pkts++;
--			rfi->cur_idx = cur_idx;
--			brcmf_dbg(DATA, "flow-%d: store pkt %d (%d), pending %d\n",
--				  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
--
--			/* can return now as there is no reorder
--			 * list to process.
--			 */
--			return;
--		}
--		if (rfi->exp_idx == cur_idx) {
--			if (rfi->pktslots[cur_idx] != NULL) {
--				brcmf_dbg(INFO, "error buffer pending..free it\n");
--				brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
--				rfi->pktslots[cur_idx] = NULL;
--			}
--			rfi->pktslots[cur_idx] = pkt;
--			rfi->pend_pkts++;
--
--			/* got the expected one. flush from current to expected
--			 * and update expected
--			 */
--			brcmf_dbg(DATA, "flow-%d: expected %d (%d), pending %d\n",
--				  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
--
--			rfi->cur_idx = cur_idx;
--			rfi->exp_idx = exp_idx;
--
--			brcmf_rxreorder_get_skb_list(rfi, cur_idx, exp_idx,
--						     &reorder_list);
--			brcmf_dbg(DATA, "flow-%d: freeing buffers %d, pending %d\n",
--				  flow_id, skb_queue_len(&reorder_list),
--				  rfi->pend_pkts);
--		} else {
--			u8 end_idx;
--
--			brcmf_dbg(DATA, "flow-%d (0x%x): both moved, old %d/%d, new %d/%d\n",
--				  flow_id, flags, rfi->cur_idx, rfi->exp_idx,
--				  cur_idx, exp_idx);
--			if (flags & BRCMF_RXREORDER_FLUSH_ALL)
--				end_idx = rfi->exp_idx;
--			else
--				end_idx = exp_idx;
--
--			/* flush pkts first */
--			brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
--						     &reorder_list);
--
--			if (exp_idx == ((cur_idx + 1) % (rfi->max_idx + 1))) {
--				__skb_queue_tail(&reorder_list, pkt);
--			} else {
--				rfi->pktslots[cur_idx] = pkt;
--				rfi->pend_pkts++;
--			}
--			rfi->exp_idx = exp_idx;
--			rfi->cur_idx = cur_idx;
--		}
--	} else {
--		/* explicity window move updating the expected index */
--		exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
--
--		brcmf_dbg(DATA, "flow-%d (0x%x): change expected: %d -> %d\n",
--			  flow_id, flags, rfi->exp_idx, exp_idx);
--		if (flags & BRCMF_RXREORDER_FLUSH_ALL)
--			end_idx =  rfi->exp_idx;
--		else
--			end_idx =  exp_idx;
--
--		brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
--					     &reorder_list);
--		__skb_queue_tail(&reorder_list, pkt);
--		/* set the new expected idx */
--		rfi->exp_idx = exp_idx;
--	}
--netif_rx:
--	skb_queue_walk_safe(&reorder_list, pkt, pnext) {
--		__skb_unlink(pkt, &reorder_list);
--		brcmf_netif_rx(ifp, pkt, false);
--	}
--}
--
- void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_evnt)
- {
- 	struct brcmf_if *ifp;
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_pub *drvr = bus_if->drvr;
--	struct brcmf_skb_reorder_data *rd;
- 	int ret;
- 
- 	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
-@@ -557,9 +348,8 @@ void brcmf_rx_frame(struct device *dev,
- 		return;
- 	}
- 
--	rd = (struct brcmf_skb_reorder_data *)skb->cb;
--	if (rd->reorder)
--		brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
-+	if (brcmf_proto_is_reorder_skb(skb))
-+		brcmf_proto_rxreorder(ifp, skb);
- 	else
- 		brcmf_netif_rx(ifp, skb, handle_evnt);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -208,10 +208,6 @@ struct brcmf_if {
- 	u8 ipv6addr_idx;
- };
- 
--struct brcmf_skb_reorder_data {
--	u8 *reorder;
--};
--
- int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
- 
- /* Return pointer to interface name */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -92,6 +92,19 @@ enum brcmf_fws_tlv_len {
- };
- #undef BRCMF_FWS_TLV_DEF
- 
-+/* AMPDU rx reordering definitions */
-+#define BRCMF_RXREORDER_FLOWID_OFFSET		0
-+#define BRCMF_RXREORDER_MAXIDX_OFFSET		2
-+#define BRCMF_RXREORDER_FLAGS_OFFSET		4
-+#define BRCMF_RXREORDER_CURIDX_OFFSET		6
-+#define BRCMF_RXREORDER_EXPIDX_OFFSET		8
-+
-+#define BRCMF_RXREORDER_DEL_FLOW		0x01
-+#define BRCMF_RXREORDER_FLUSH_ALL		0x02
-+#define BRCMF_RXREORDER_CURIDX_VALID		0x04
-+#define BRCMF_RXREORDER_EXPIDX_VALID		0x08
-+#define BRCMF_RXREORDER_NEW_HOLE		0x10
-+
- #ifdef DEBUG
- /*
-  * brcmf_fws_tlv_names - array of tlv names.
-@@ -1614,6 +1627,202 @@ static int brcmf_fws_notify_bcmc_credit_
- 	return 0;
- }
- 
-+static void brcmf_rxreorder_get_skb_list(struct brcmf_ampdu_rx_reorder *rfi,
-+					 u8 start, u8 end,
-+					 struct sk_buff_head *skb_list)
-+{
-+	/* initialize return list */
-+	__skb_queue_head_init(skb_list);
-+
-+	if (rfi->pend_pkts == 0) {
-+		brcmf_dbg(INFO, "no packets in reorder queue\n");
-+		return;
-+	}
-+
-+	do {
-+		if (rfi->pktslots[start]) {
-+			__skb_queue_tail(skb_list, rfi->pktslots[start]);
-+			rfi->pktslots[start] = NULL;
-+		}
-+		start++;
-+		if (start > rfi->max_idx)
-+			start = 0;
-+	} while (start != end);
-+	rfi->pend_pkts -= skb_queue_len(skb_list);
-+}
-+
-+void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *pkt)
-+{
-+	u8 *reorder_data;
-+	u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
-+	struct brcmf_ampdu_rx_reorder *rfi;
-+	struct sk_buff_head reorder_list;
-+	struct sk_buff *pnext;
-+	u8 flags;
-+	u32 buf_size;
-+
-+	reorder_data = ((struct brcmf_skb_reorder_data *)pkt->cb)->reorder;
-+	flow_id = reorder_data[BRCMF_RXREORDER_FLOWID_OFFSET];
-+	flags = reorder_data[BRCMF_RXREORDER_FLAGS_OFFSET];
-+
-+	/* validate flags and flow id */
-+	if (flags == 0xFF) {
-+		brcmf_err("invalid flags...so ignore this packet\n");
-+		brcmf_netif_rx(ifp, pkt, false);
-+		return;
-+	}
-+
-+	rfi = ifp->drvr->reorder_flows[flow_id];
-+	if (flags & BRCMF_RXREORDER_DEL_FLOW) {
-+		brcmf_dbg(INFO, "flow-%d: delete\n",
-+			  flow_id);
-+
-+		if (rfi == NULL) {
-+			brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
-+				  flow_id);
-+			brcmf_netif_rx(ifp, pkt, false);
-+			return;
-+		}
-+
-+		brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, rfi->exp_idx,
-+					     &reorder_list);
-+		/* add the last packet */
-+		__skb_queue_tail(&reorder_list, pkt);
-+		kfree(rfi);
-+		ifp->drvr->reorder_flows[flow_id] = NULL;
-+		goto netif_rx;
-+	}
-+	/* from here on we need a flow reorder instance */
-+	if (rfi == NULL) {
-+		buf_size = sizeof(*rfi);
-+		max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
-+
-+		buf_size += (max_idx + 1) * sizeof(pkt);
-+
-+		/* allocate space for flow reorder info */
-+		brcmf_dbg(INFO, "flow-%d: start, maxidx %d\n",
-+			  flow_id, max_idx);
-+		rfi = kzalloc(buf_size, GFP_ATOMIC);
-+		if (rfi == NULL) {
-+			brcmf_err("failed to alloc buffer\n");
-+			brcmf_netif_rx(ifp, pkt, false);
-+			return;
-+		}
-+
-+		ifp->drvr->reorder_flows[flow_id] = rfi;
-+		rfi->pktslots = (struct sk_buff **)(rfi + 1);
-+		rfi->max_idx = max_idx;
-+	}
-+	if (flags & BRCMF_RXREORDER_NEW_HOLE)  {
-+		if (rfi->pend_pkts) {
-+			brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx,
-+						     rfi->exp_idx,
-+						     &reorder_list);
-+			WARN_ON(rfi->pend_pkts);
-+		} else {
-+			__skb_queue_head_init(&reorder_list);
-+		}
-+		rfi->cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
-+		rfi->exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
-+		rfi->max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
-+		rfi->pktslots[rfi->cur_idx] = pkt;
-+		rfi->pend_pkts++;
-+		brcmf_dbg(DATA, "flow-%d: new hole %d (%d), pending %d\n",
-+			  flow_id, rfi->cur_idx, rfi->exp_idx, rfi->pend_pkts);
-+	} else if (flags & BRCMF_RXREORDER_CURIDX_VALID) {
-+		cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
-+		exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
-+
-+		if ((exp_idx == rfi->exp_idx) && (cur_idx != rfi->exp_idx)) {
-+			/* still in the current hole */
-+			/* enqueue the current on the buffer chain */
-+			if (rfi->pktslots[cur_idx] != NULL) {
-+				brcmf_dbg(INFO, "HOLE: ERROR buffer pending..free it\n");
-+				brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
-+				rfi->pktslots[cur_idx] = NULL;
-+			}
-+			rfi->pktslots[cur_idx] = pkt;
-+			rfi->pend_pkts++;
-+			rfi->cur_idx = cur_idx;
-+			brcmf_dbg(DATA, "flow-%d: store pkt %d (%d), pending %d\n",
-+				  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
-+
-+			/* can return now as there is no reorder
-+			 * list to process.
-+			 */
-+			return;
-+		}
-+		if (rfi->exp_idx == cur_idx) {
-+			if (rfi->pktslots[cur_idx] != NULL) {
-+				brcmf_dbg(INFO, "error buffer pending..free it\n");
-+				brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
-+				rfi->pktslots[cur_idx] = NULL;
-+			}
-+			rfi->pktslots[cur_idx] = pkt;
-+			rfi->pend_pkts++;
-+
-+			/* got the expected one. flush from current to expected
-+			 * and update expected
-+			 */
-+			brcmf_dbg(DATA, "flow-%d: expected %d (%d), pending %d\n",
-+				  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
-+
-+			rfi->cur_idx = cur_idx;
-+			rfi->exp_idx = exp_idx;
-+
-+			brcmf_rxreorder_get_skb_list(rfi, cur_idx, exp_idx,
-+						     &reorder_list);
-+			brcmf_dbg(DATA, "flow-%d: freeing buffers %d, pending %d\n",
-+				  flow_id, skb_queue_len(&reorder_list),
-+				  rfi->pend_pkts);
-+		} else {
-+			u8 end_idx;
-+
-+			brcmf_dbg(DATA, "flow-%d (0x%x): both moved, old %d/%d, new %d/%d\n",
-+				  flow_id, flags, rfi->cur_idx, rfi->exp_idx,
-+				  cur_idx, exp_idx);
-+			if (flags & BRCMF_RXREORDER_FLUSH_ALL)
-+				end_idx = rfi->exp_idx;
-+			else
-+				end_idx = exp_idx;
-+
-+			/* flush pkts first */
-+			brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
-+						     &reorder_list);
-+
-+			if (exp_idx == ((cur_idx + 1) % (rfi->max_idx + 1))) {
-+				__skb_queue_tail(&reorder_list, pkt);
-+			} else {
-+				rfi->pktslots[cur_idx] = pkt;
-+				rfi->pend_pkts++;
-+			}
-+			rfi->exp_idx = exp_idx;
-+			rfi->cur_idx = cur_idx;
-+		}
-+	} else {
-+		/* explicity window move updating the expected index */
-+		exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
-+
-+		brcmf_dbg(DATA, "flow-%d (0x%x): change expected: %d -> %d\n",
-+			  flow_id, flags, rfi->exp_idx, exp_idx);
-+		if (flags & BRCMF_RXREORDER_FLUSH_ALL)
-+			end_idx =  rfi->exp_idx;
-+		else
-+			end_idx =  exp_idx;
-+
-+		brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
-+					     &reorder_list);
-+		__skb_queue_tail(&reorder_list, pkt);
-+		/* set the new expected idx */
-+		rfi->exp_idx = exp_idx;
-+	}
-+netif_rx:
-+	skb_queue_walk_safe(&reorder_list, pkt, pnext) {
-+		__skb_unlink(pkt, &reorder_list);
-+		brcmf_netif_rx(ifp, pkt, false);
-+	}
-+}
-+
- void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
- {
- 	struct brcmf_skb_reorder_data *rd;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-@@ -29,5 +29,6 @@ void brcmf_fws_add_interface(struct brcm
- void brcmf_fws_del_interface(struct brcmf_if *ifp);
- void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb);
- void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked);
-+void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb);
- 
- #endif /* FWSIGNAL_H_ */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -527,6 +527,9 @@ static int brcmf_msgbuf_hdrpull(struct b
- 	return -ENODEV;
- }
- 
-+static void brcmf_msgbuf_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb)
-+{
-+}
- 
- static void
- brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
-@@ -1466,6 +1469,7 @@ int brcmf_proto_msgbuf_attach(struct brc
- 	drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
- 	drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
- 	drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
-+	drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
- 	drvr->proto->pd = msgbuf;
- 
- 	init_waitqueue_head(&msgbuf->ioctl_resp_wait);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -22,6 +22,9 @@ enum proto_addr_mode {
- 	ADDR_DIRECT
- };
- 
-+struct brcmf_skb_reorder_data {
-+	u8 *reorder;
-+};
- 
- struct brcmf_proto {
- 	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
-@@ -38,6 +41,7 @@ struct brcmf_proto {
- 			    u8 peer[ETH_ALEN]);
- 	void (*add_tdls_peer)(struct brcmf_pub *drvr, int ifidx,
- 			      u8 peer[ETH_ALEN]);
-+	void (*rxreorder)(struct brcmf_if *ifp, struct sk_buff *skb);
- 	void *pd;
- };
- 
-@@ -91,6 +95,18 @@ brcmf_proto_add_tdls_peer(struct brcmf_p
- {
- 	drvr->proto->add_tdls_peer(drvr, ifidx, peer);
- }
-+static inline bool brcmf_proto_is_reorder_skb(struct sk_buff *skb)
-+{
-+	struct brcmf_skb_reorder_data *rd;
-+
-+	rd = (struct brcmf_skb_reorder_data *)skb->cb;
-+	return !!rd->reorder;
-+}
- 
-+static inline void
-+brcmf_proto_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb)
-+{
-+	ifp->drvr->proto->rxreorder(ifp, skb);
-+}
- 
- #endif /* BRCMFMAC_PROTO_H */
diff --git a/package/kernel/mac80211/patches/349-0007-brcmfmac-revise-handling-events-in-receive-path.patch b/package/kernel/mac80211/patches/349-0007-brcmfmac-revise-handling-events-in-receive-path.patch
deleted file mode 100644
index a43feffe17..0000000000
--- a/package/kernel/mac80211/patches/349-0007-brcmfmac-revise-handling-events-in-receive-path.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From: Arend van Spriel <arend@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:27 +0200
-Subject: [PATCH] brcmfmac: revise handling events in receive path
-
-Move event handling out of brcmf_netif_rx() avoiding the need
-to pass a flag. This flag is only ever true for USB hosts as
-other interface use separate brcmf_rx_event() function.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -216,7 +216,7 @@ bool brcmf_c_prec_enq(struct device *dev
- 		      int prec);
- 
- /* Receive frame for delivery to OS.  Callee disposes of rxp. */
--void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp, bool handle_evnt);
-+void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp, bool handle_event);
- /* Receive async event packet from firmware. Callee disposes of rxp. */
- void brcmf_rx_event(struct device *dev, struct sk_buff *rxp);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -298,18 +298,11 @@ void brcmf_txflowblock(struct device *de
- 	brcmf_fws_bus_blocked(drvr, state);
- }
- 
--void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb,
--		    bool handle_event)
-+void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
- {
--	skb->protocol = eth_type_trans(skb, ifp->ndev);
--
- 	if (skb->pkt_type == PACKET_MULTICAST)
- 		ifp->stats.multicast++;
- 
--	/* Process special event packets */
--	if (handle_event)
--		brcmf_fweh_process_skb(ifp->drvr, skb);
--
- 	if (!(ifp->ndev->flags & IFF_UP)) {
- 		brcmu_pkt_buf_free_skb(skb);
- 		return;
-@@ -329,7 +322,7 @@ void brcmf_netif_rx(struct brcmf_if *ifp
- 		netif_rx_ni(skb);
- }
- 
--void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_evnt)
-+void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event)
- {
- 	struct brcmf_if *ifp;
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-@@ -348,10 +341,17 @@ void brcmf_rx_frame(struct device *dev,
- 		return;
- 	}
- 
--	if (brcmf_proto_is_reorder_skb(skb))
-+	skb->protocol = eth_type_trans(skb, ifp->ndev);
-+
-+	if (brcmf_proto_is_reorder_skb(skb)) {
- 		brcmf_proto_rxreorder(ifp, skb);
--	else
--		brcmf_netif_rx(ifp, skb, handle_evnt);
-+	} else {
-+		/* Process special event packets */
-+		if (handle_event)
-+			brcmf_fweh_process_skb(ifp->drvr, skb);
-+
-+		brcmf_netif_rx(ifp, skb);
-+	}
- }
- 
- void brcmf_rx_event(struct device *dev, struct sk_buff *skb)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -221,8 +221,7 @@ int brcmf_get_next_free_bsscfgidx(struct
- void brcmf_txflowblock_if(struct brcmf_if *ifp,
- 			  enum brcmf_netif_stop_reason reason, bool state);
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
--void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb,
--		    bool handle_event);
-+void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
- void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
- int __init brcmf_core_init(void);
- void __exit brcmf_core_exit(void);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -1668,7 +1668,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
- 	/* validate flags and flow id */
- 	if (flags == 0xFF) {
- 		brcmf_err("invalid flags...so ignore this packet\n");
--		brcmf_netif_rx(ifp, pkt, false);
-+		brcmf_netif_rx(ifp, pkt);
- 		return;
- 	}
- 
-@@ -1680,7 +1680,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
- 		if (rfi == NULL) {
- 			brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
- 				  flow_id);
--			brcmf_netif_rx(ifp, pkt, false);
-+			brcmf_netif_rx(ifp, pkt);
- 			return;
- 		}
- 
-@@ -1705,7 +1705,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
- 		rfi = kzalloc(buf_size, GFP_ATOMIC);
- 		if (rfi == NULL) {
- 			brcmf_err("failed to alloc buffer\n");
--			brcmf_netif_rx(ifp, pkt, false);
-+			brcmf_netif_rx(ifp, pkt);
- 			return;
- 		}
- 
-@@ -1819,7 +1819,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
- netif_rx:
- 	skb_queue_walk_safe(&reorder_list, pkt, pnext) {
- 		__skb_unlink(pkt, &reorder_list);
--		brcmf_netif_rx(ifp, pkt, false);
-+		brcmf_netif_rx(ifp, pkt);
- 	}
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1157,7 +1157,7 @@ brcmf_msgbuf_process_rx_complete(struct
- 		brcmu_pkt_buf_free_skb(skb);
- 		return;
- 	}
--	brcmf_netif_rx(ifp, skb, false);
-+	brcmf_netif_rx(ifp, skb);
- }
- 
- 
diff --git a/package/kernel/mac80211/patches/349-0008-brcmfmac-create-common-function-for-handling-brcmf_p.patch b/package/kernel/mac80211/patches/349-0008-brcmfmac-create-common-function-for-handling-brcmf_p.patch
deleted file mode 100644
index 08ea235fdd..0000000000
--- a/package/kernel/mac80211/patches/349-0008-brcmfmac-create-common-function-for-handling-brcmf_p.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From: Arend van Spriel <arend@broadcom.com>
-Date: Mon, 11 Apr 2016 11:35:28 +0200
-Subject: [PATCH] brcmfmac: create common function for handling
- brcmf_proto_hdrpull()
-
-In receive path brcmf_proto_hdrpull() needs to be called and handled
-similar in brcmf_rx_frame() and brcmf_rx_event(). Move that duplicated
-code in separate function.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -322,26 +322,35 @@ void brcmf_netif_rx(struct brcmf_if *ifp
- 		netif_rx_ni(skb);
- }
- 
--void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event)
-+static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
-+			    struct brcmf_if **ifp)
- {
--	struct brcmf_if *ifp;
--	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_pub *drvr = bus_if->drvr;
- 	int ret;
- 
--	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
--
- 	/* process and remove protocol-specific header */
--	ret = brcmf_proto_hdrpull(drvr, true, skb, &ifp);
-+	ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
- 
--	if (ret || !ifp || !ifp->ndev) {
-+	if (ret || !(*ifp) || !(*ifp)->ndev) {
- 		if (ret != -ENODATA && ifp)
--			ifp->stats.rx_errors++;
-+			(*ifp)->stats.rx_errors++;
- 		brcmu_pkt_buf_free_skb(skb);
--		return;
-+		return -ENODATA;
- 	}
- 
--	skb->protocol = eth_type_trans(skb, ifp->ndev);
-+	skb->protocol = eth_type_trans(skb, (*ifp)->ndev);
-+	return 0;
-+}
-+
-+void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event)
-+{
-+	struct brcmf_if *ifp;
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_pub *drvr = bus_if->drvr;
-+
-+	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
-+
-+	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
-+		return;
- 
- 	if (brcmf_proto_is_reorder_skb(skb)) {
- 		brcmf_proto_rxreorder(ifp, skb);
-@@ -359,21 +368,11 @@ void brcmf_rx_event(struct device *dev,
- 	struct brcmf_if *ifp;
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_pub *drvr = bus_if->drvr;
--	int ret;
- 
- 	brcmf_dbg(EVENT, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
- 
--	/* process and remove protocol-specific header */
--	ret = brcmf_proto_hdrpull(drvr, true, skb, &ifp);
--
--	if (ret || !ifp || !ifp->ndev) {
--		if (ret != -ENODATA && ifp)
--			ifp->stats.rx_errors++;
--		brcmu_pkt_buf_free_skb(skb);
-+	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
- 		return;
--	}
--
--	skb->protocol = eth_type_trans(skb, ifp->ndev);
- 
- 	brcmf_fweh_process_skb(ifp->drvr, skb);
- 	brcmu_pkt_buf_free_skb(skb);
diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
index 7351353076..463428371b 100644
--- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
@@ -8,7 +8,7 @@
 +	return;
 +#endif
 +
- 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+ 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
  		if (!wiphy->bands[band])
  			continue;
 @@ -374,6 +378,10 @@ ath_reg_apply_ir_flags(struct wiphy *wip
@@ -19,7 +19,7 @@
 +	return;
 +#endif
 +
- 	sband = wiphy->bands[IEEE80211_BAND_2GHZ];
+ 	sband = wiphy->bands[NL80211_BAND_2GHZ];
  	if (!sband)
  		return;
 @@ -402,6 +410,10 @@ static void ath_reg_apply_radar_flags(st
@@ -30,7 +30,7 @@
 +	return;
 +#endif
 +
- 	if (!wiphy->bands[IEEE80211_BAND_5GHZ])
+ 	if (!wiphy->bands[NL80211_BAND_5GHZ])
  		return;
  
 @@ -633,6 +645,11 @@ ath_regd_init_wiphy(struct ath_regulator
@@ -59,7 +59,7 @@
  	---help---
 --- a/.local-symbols
 +++ b/.local-symbols
-@@ -125,6 +125,7 @@ ADM8211=
+@@ -127,6 +127,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
index 1a62484954..819e64f370 100644
--- a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -722,6 +722,7 @@ static const struct ieee80211_iface_limi
+@@ -728,6 +728,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
index a7f9d9f8b9..4b6da975b3 100644
--- a/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
+++ b/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1301,6 +1301,53 @@ void ath9k_deinit_debug(struct ath_softc
+@@ -1319,6 +1319,53 @@ void ath9k_deinit_debug(struct ath_softc
  	ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
  }
  
@@ -54,7 +54,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1320,6 +1367,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1338,6 +1385,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	ath9k_tx99_init_debug(sc);
  	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
  
diff --git a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
index 5892c3e17a..1825d77b7f 100644
--- a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1024,23 +1024,23 @@ static int __init ath9k_init(void)
+@@ -1030,23 +1030,23 @@ static int __init ath9k_init(void)
  {
  	int error;
  
diff --git a/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
index 5ecf528e59..a105d40662 100644
--- a/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1348,6 +1348,52 @@ static const struct file_operations fops
+@@ -1366,6 +1366,52 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -53,7 +53,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1369,6 +1415,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1387,6 +1433,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
@@ -90,7 +90,7 @@
  	ichan->channel = chan->center_freq;
  	ichan->chan = chan;
 @@ -308,7 +310,19 @@ static void ath9k_cmn_update_ichannel(st
- 	if (chan->band == IEEE80211_BAND_5GHZ)
+ 	if (chan->band == NL80211_BAND_5GHZ)
  		flags |= CHANNEL_5GHZ;
  
 -	switch (chandef->width) {
diff --git a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
index c84d1bc829..167eeff2d2 100644
--- a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
@@ -20,7 +20,7 @@
  #define AR9160_DEVID_PCI	0x0027
 --- a/drivers/net/wireless/ath/ath9k/pci.c
 +++ b/drivers/net/wireless/ath/ath9k/pci.c
-@@ -751,6 +751,7 @@ static const struct pci_device_id ath_pc
+@@ -761,6 +761,7 @@ static const struct pci_device_id ath_pc
  	  .driver_data = ATH9K_PCI_BT_ANT_DIV },
  #endif
  
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index e151a12967..28f5dcca90 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -2363,6 +2363,7 @@ struct cfg80211_qos_map {
+@@ -2406,6 +2406,7 @@ struct cfg80211_qos_map {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -2624,6 +2625,7 @@ struct cfg80211_ops {
+@@ -2667,6 +2668,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -18,7 +18,7 @@
  				const u8 *addr);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1286,6 +1286,7 @@ enum ieee80211_smps_mode {
+@@ -1305,6 +1305,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1306,6 +1307,7 @@ enum ieee80211_smps_mode {
+@@ -1325,6 +1326,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,9 +36,9 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -1790,6 +1790,9 @@ enum nl80211_commands {
-  *	between scans. The scan plans are executed sequentially.
-  *	Each scan plan is a nested attribute of &enum nl80211_sched_scan_plan.
+@@ -1819,6 +1819,9 @@ enum nl80211_commands {
+  *
+  * @NL80211_ATTR_PAD: attribute used for padding for 64-bit alignment
   *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2164,6 +2167,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
- 	NL80211_ATTR_SCHED_SCAN_PLANS,
+@@ -2201,6 +2204,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_PAD,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2229,6 +2229,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2238,6 +2238,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3403,6 +3416,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3412,6 +3425,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1318,6 +1318,7 @@ struct ieee80211_local {
+@@ -1322,6 +1322,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -586,6 +592,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -588,6 +594,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,15 +129,15 @@
  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -403,6 +403,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
- 	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
- 	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
+@@ -406,6 +406,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
+ 	[NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -2220,6 +2221,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -2251,6 +2252,20 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			return result;
  	}
diff --git a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
index 5a5e4643f5..60012662e1 100644
--- a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
@@ -1,16 +1,16 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -814,6 +814,9 @@ static inline int ath9k_dump_btcoex(stru
+@@ -813,6 +813,9 @@ static inline int ath9k_dump_btcoex(stru
+ #ifdef CPTCFG_MAC80211_LEDS
  void ath_init_leds(struct ath_softc *sc);
  void ath_deinit_leds(struct ath_softc *sc);
- void ath_fill_led_pin(struct ath_softc *sc);
 +int ath_create_gpio_led(struct ath_softc *sc, int gpio, const char *name,
-+                        const char *trigger, bool active_low);
++			const char *trigger, bool active_low);
 +
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -953,6 +956,13 @@ void ath_ant_comb_scan(struct ath_softc
+@@ -949,6 +952,13 @@ void ath_ant_comb_scan(struct ath_softc
  
  #define ATH9K_NUM_CHANCTX  2 /* supports 2 operating channels */
  
@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1005,9 +1015,8 @@ struct ath_softc {
+@@ -1001,9 +1011,8 @@ struct ath_softc {
  	spinlock_t chan_lock;
  
  #ifdef CPTCFG_MAC80211_LEDS
@@ -38,24 +38,33 @@
  #ifdef CPTCFG_ATH9K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -24,45 +24,102 @@
- static void ath_led_brightness(struct led_classdev *led_cdev,
- 			       enum led_brightness brightness)
+@@ -22,7 +22,7 @@
+ 
+ #ifdef CPTCFG_MAC80211_LEDS
+ 
+-void ath_fill_led_pin(struct ath_softc *sc)
++static void ath_fill_led_pin(struct ath_softc *sc)
  {
--	struct ath_softc *sc = container_of(led_cdev, struct ath_softc, led_cdev);
--	u32 val = (brightness == LED_OFF);
+ 	struct ath_hw *ah = sc->sc_ah;
+ 
+@@ -39,61 +39,111 @@ void ath_fill_led_pin(struct ath_softc *
+ 		else
+ 			ah->led_pin = ATH_LED_PIN_DEF;
+ 	}
++}
++
++static void ath_led_brightness(struct led_classdev *led_cdev,
++			       enum led_brightness brightness)
++{
 +	struct ath_led *led = container_of(led_cdev, struct ath_led, cdev);
 +	struct ath_softc *sc = led->sc;
- 
--	if (sc->sc_ah->config.led_active_high)
--		val = !val;
++
 +	ath9k_ps_wakeup(sc);
 +	ath9k_hw_set_gpio(sc->sc_ah, led->gpio->gpio,
 +			  (brightness != LED_OFF) ^ led->gpio->active_low);
 +	ath9k_ps_restore(sc);
 +}
- 
--	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
++
 +static int ath_add_led(struct ath_softc *sc, struct ath_led *led)
 +{
 +	const struct gpio_led *gpio = led->gpio;
@@ -71,30 +80,40 @@
 +
 +	led->sc = sc;
 +	list_add(&led->list, &sc->leds);
-+
-+	/* Configure gpio for output */
-+	ath9k_hw_cfg_output(sc->sc_ah, gpio->gpio,
-+			    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-+
+ 
+ 	/* Configure gpio for output */
+-	ath9k_hw_gpio_request_out(ah, ah->led_pin, "ath9k-led",
++	ath9k_hw_gpio_request_out(sc->sc_ah, gpio->gpio, gpio->name,
+ 				  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+ 
+-	/* LED off, active low */
+-	ath9k_hw_set_gpio(ah, ah->led_pin, ah->config.led_active_high ? 0 : 1);
 +	/* LED off */
 +	ath9k_hw_set_gpio(sc->sc_ah, gpio->gpio, gpio->active_low);
 +
 +	return 0;
-+}
-+
+ }
+ 
+-static void ath_led_brightness(struct led_classdev *led_cdev,
+-			       enum led_brightness brightness)
 +int ath_create_gpio_led(struct ath_softc *sc, int gpio_num, const char *name,
 +			const char *trigger, bool active_low)
-+{
+ {
+-	struct ath_softc *sc = container_of(led_cdev, struct ath_softc, led_cdev);
+-	u32 val = (brightness == LED_OFF);
 +	struct ath_led *led;
 +	struct gpio_led *gpio;
 +	char *_name;
 +	int ret;
-+
+ 
+-	if (sc->sc_ah->config.led_active_high)
+-		val = !val;
 +	led = kzalloc(sizeof(*led) + sizeof(*gpio) + strlen(name) + 1,
 +		      GFP_KERNEL);
 +	if (!led)
 +		return -ENOMEM;
-+
+ 
+-	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
 +	led->gpio = gpio = (struct gpio_led *) (led + 1);
 +	_name = (char *) (led->gpio + 1);
 +
@@ -115,15 +134,18 @@
  {
 -	if (!sc->led_registered)
 -		return;
-+	struct ath_led *led;
- 
+-
 -	ath_led_brightness(&sc->led_cdev, LED_OFF);
 -	led_classdev_unregister(&sc->led_cdev);
++	struct ath_led *led;
+ 
+-	ath9k_hw_gpio_free(sc->sc_ah, sc->sc_ah->led_pin);
 +	while (!list_empty(&sc->leds)) {
 +		led = list_first_entry(&sc->leds, struct ath_led, list);
 +		list_del(&led->list);
 +		ath_led_brightness(&led->cdev, LED_OFF);
 +		led_classdev_unregister(&led->cdev);
++		ath9k_hw_gpio_free(sc->sc_ah, led->gpio->gpio);
 +		kfree(led);
 +	}
  }
@@ -139,6 +161,8 @@
  	if (AR_SREV_9100(sc->sc_ah))
  		return;
  
+ 	ath_fill_led_pin(sc);
+ 
 -	if (!ath9k_led_blink)
 -		sc->led_cdev.default_trigger =
 -			ieee80211_get_radio_led_name(sc->hw);
@@ -159,13 +183,14 @@
 +		trigger = ieee80211_get_radio_led_name(sc->hw);
  
 -	sc->led_registered = true;
-+	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
++	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger,
++			   !sc->sc_ah->config.led_active_high);
  }
+ #endif
  
- void ath_fill_led_pin(struct ath_softc *sc)
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -936,7 +936,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -942,7 +942,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -176,7 +201,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1393,6 +1393,61 @@ static const struct file_operations fops
+@@ -1411,6 +1411,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -238,7 +263,7 @@
  
  int ath9k_init_debug(struct ath_hw *ah)
  {
-@@ -1417,6 +1472,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1435,6 +1490,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);
diff --git a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
index 7c10ea6b0d..f656697a07 100644
--- a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
+++ b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
@@ -1,6 +1,6 @@
 --- a/include/linux/ath9k_platform.h
 +++ b/include/linux/ath9k_platform.h
-@@ -41,6 +41,9 @@ struct ath9k_platform_data {
+@@ -45,6 +45,9 @@ struct ath9k_platform_data {
  	int (*external_reset)(void);
  
  	bool use_eeprom;
@@ -20,7 +20,7 @@
  
  /********************************/
  /*	 LED functions		*/
-@@ -88,6 +89,24 @@ int ath_create_gpio_led(struct ath_softc
+@@ -108,6 +109,24 @@ int ath_create_gpio_led(struct ath_softc
  	return ret;
  }
  
@@ -45,7 +45,7 @@
  void ath_deinit_leds(struct ath_softc *sc)
  {
  	struct ath_led *led;
-@@ -103,8 +122,10 @@ void ath_deinit_leds(struct ath_softc *s
+@@ -124,8 +143,10 @@ void ath_deinit_leds(struct ath_softc *s
  
  void ath_init_leds(struct ath_softc *sc)
  {
@@ -56,10 +56,10 @@
  
  	INIT_LIST_HEAD(&sc->leds);
  
-@@ -120,6 +141,12 @@ void ath_init_leds(struct ath_softc *sc)
- 		trigger = ieee80211_get_radio_led_name(sc->hw);
+@@ -144,6 +165,12 @@ void ath_init_leds(struct ath_softc *sc)
  
- 	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
+ 	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger,
+ 			   !sc->sc_ah->config.led_active_high);
 +
 +	if (!pdata)
 +		return;
@@ -67,5 +67,5 @@
 +	for (i = 0; i < pdata->num_leds; i++)
 +		ath_create_platform_led(sc, &pdata->leds[i]);
  }
+ #endif
  
- void ath_fill_led_pin(struct ath_softc *sc)
diff --git a/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
index 6d62a2b1c2..986f155192 100644
--- a/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
+++ b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
@@ -1,6 +1,6 @@
 --- a/include/linux/ath9k_platform.h
 +++ b/include/linux/ath9k_platform.h
-@@ -36,6 +36,7 @@ struct ath9k_platform_data {
+@@ -40,6 +40,7 @@ struct ath9k_platform_data {
  	bool tx_gain_buffalo;
  	bool disable_2ghz;
  	bool disable_5ghz;
@@ -10,7 +10,7 @@
  	int (*external_reset)(void);
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -577,6 +577,7 @@ static int ath9k_init_softc(u16 devid, s
+@@ -581,6 +581,7 @@ static int ath9k_init_softc(u16 devid, s
  		ah->external_reset = pdata->external_reset;
  		ah->disable_2ghz = pdata->disable_2ghz;
  		ah->disable_5ghz = pdata->disable_5ghz;
diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
index e83c6bfbf9..f4bb0f2d90 100644
--- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1449,6 +1449,50 @@ static const struct file_operations fops
+@@ -1467,6 +1467,50 @@ static const struct file_operations fops
  #endif
  
  
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1476,6 +1520,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1494,6 +1538,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -62,7 +62,7 @@
  	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -519,6 +519,12 @@ enum {
+@@ -520,6 +520,12 @@ enum {
  	ATH9K_RESET_COLD,
  };
  
@@ -75,7 +75,7 @@
  struct ath9k_hw_version {
  	u32 magic;
  	u16 devid;
-@@ -804,6 +810,8 @@ struct ath_hw {
+@@ -805,6 +811,8 @@ struct ath_hw {
  	u32 rfkill_polarity;
  	u32 ah_flags;
  
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1066,6 +1074,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
+@@ -1067,6 +1075,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1819,6 +1819,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1821,6 +1821,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2027,6 +2041,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2029,6 +2043,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
index d7bb5a12ce..7da71653a9 100644
--- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -720,6 +720,7 @@ struct ath_spec_scan {
+@@ -721,6 +721,7 @@ struct ath_spec_scan {
   * @config_pci_powersave:
   * @calibrate: periodic calibration for NF, ANI, IQ, ADC gain, ADC-DC
   *
@@ -8,7 +8,7 @@
   * @spectral_scan_config: set parameters for spectral scan and enable/disable it
   * @spectral_scan_trigger: trigger a spectral scan run
   * @spectral_scan_wait: wait for a spectral scan run to finish
-@@ -742,6 +743,7 @@ struct ath_hw_ops {
+@@ -743,6 +744,7 @@ struct ath_hw_ops {
  			struct ath_hw_antcomb_conf *antconf);
  	void (*antdiv_comb_conf_set)(struct ath_hw *ah,
  			struct ath_hw_antcomb_conf *antconf);
@@ -18,7 +18,7 @@
  	void (*spectral_scan_trigger)(struct ath_hw *ah);
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1998,6 +1998,26 @@ void ar9003_hw_init_rate_txpower(struct
+@@ -1945,6 +1945,26 @@ void ar9003_hw_init_rate_txpower(struct
  	}
  }
  
@@ -45,7 +45,7 @@
  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  {
  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-@@ -2034,6 +2054,7 @@ void ar9003_hw_attach_phy_ops(struct ath
+@@ -1981,6 +2001,7 @@ void ar9003_hw_attach_phy_ops(struct ath
  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
  
@@ -55,9 +55,9 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -711,7 +711,8 @@ static void ath9k_init_txpower_limits(st
+@@ -717,7 +717,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
- 		ath9k_init_band_txpower(sc, IEEE80211_BAND_5GHZ);
+ 		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
 -	ah->curchan = curchan;
 +	if (curchan)
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -897,6 +898,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -903,6 +904,18 @@ static void ath9k_set_hw_capab(struct at
  	SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
  }
  
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -942,6 +955,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -948,6 +961,8 @@ int ath9k_init_device(u16 devid, struct
  		ARRAY_SIZE(ath9k_tpt_blink));
  #endif
  
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1327,9 +1327,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1325,9 +1325,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1344,6 +1365,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1342,6 +1363,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
index 8768c5d89a..9462fcaafa 100644
--- a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1797,8 +1816,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1799,8 +1818,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2052,6 +2077,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2054,6 +2079,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
index 3d24ccda1f..b639f972d8 100644
--- a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -956,55 +956,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -954,55 +954,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
@@ -58,7 +58,7 @@
  			REG_SET_BIT(ah, AR_PHY_SFCORR_LOW,
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -41,20 +41,6 @@ static const int cycpwrThr1_table[] =
+@@ -42,20 +42,6 @@ static const int cycpwrThr1_table[] =
  /* level:  0   1   2   3   4   5   6   7   8  */
  	{ -6, -4, -2,  0,  2,  4,  6,  8 };     /* lvl 0-7, default 3 */
  
@@ -79,7 +79,7 @@
  static const u8 ofdm2pwr[] = {
  	ALL_TARGET_LEGACY_6_24,
  	ALL_TARGET_LEGACY_6_24,
-@@ -1089,11 +1075,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1095,11 +1081,6 @@ static bool ar9003_hw_ani_control(struct
  	struct ath_common *common = ath9k_hw_common(ah);
  	struct ath9k_channel *chan = ah->curchan;
  	struct ar5416AniState *aniState = &ah->ani;
@@ -91,7 +91,7 @@
  	s32 value, value2;
  
  	switch (cmd & ah->ani_function) {
-@@ -1107,61 +1088,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1113,61 +1094,6 @@ static bool ar9003_hw_ani_control(struct
  		 */
  		u32 on = param ? 1 : 0;
  
diff --git a/package/kernel/mac80211/patches/546-ath9k_platform_led_name.patch b/package/kernel/mac80211/patches/546-ath9k_platform_led_name.patch
index 8d2d899112..ced72c6c69 100644
--- a/package/kernel/mac80211/patches/546-ath9k_platform_led_name.patch
+++ b/package/kernel/mac80211/patches/546-ath9k_platform_led_name.patch
@@ -13,9 +13,9 @@ Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
 
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -132,15 +132,19 @@ void ath_init_leds(struct ath_softc *sc)
- 	if (AR_SREV_9100(sc->sc_ah))
- 		return;
+@@ -155,8 +155,11 @@ void ath_init_leds(struct ath_softc *sc)
+ 
+ 	ath_fill_led_pin(sc);
  
 -	snprintf(led_name, sizeof(led_name), "ath9k-%s",
 -		 wiphy_name(sc->hw->wiphy));
@@ -23,22 +23,13 @@ Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
 +		strncpy(led_name, pdata->led_name, sizeof(led_name));
 +	else
 +		snprintf(led_name, sizeof(led_name), "ath9k-%s",
-+		 	 wiphy_name(sc->hw->wiphy));
++			 wiphy_name(sc->hw->wiphy));
  
  	if (ath9k_led_blink)
  		trigger = sc->led_default_trigger;
- 	else
- 		trigger = ieee80211_get_radio_led_name(sc->hw);
- 
--	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger, !sc->sc_ah->config.led_active_high);
-+	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger,
-+			    !sc->sc_ah->config.led_active_high);
- 
- 	if (!pdata)
- 		return;
 --- a/include/linux/ath9k_platform.h
 +++ b/include/linux/ath9k_platform.h
-@@ -45,6 +45,7 @@ struct ath9k_platform_data {
+@@ -49,6 +49,7 @@ struct ath9k_platform_data {
  
  	int num_leds;
  	const struct gpio_led *leds;
diff --git a/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch b/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
index db0b61996f..5d84cf0c42 100644
--- a/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
+++ b/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
@@ -13,9 +13,9 @@ Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
 
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -54,8 +54,11 @@ static int ath_add_led(struct ath_softc
- 	ath9k_hw_cfg_output(sc->sc_ah, gpio->gpio,
- 			    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+@@ -74,8 +74,11 @@ static int ath_add_led(struct ath_softc
+ 	ath9k_hw_gpio_request_out(sc->sc_ah, gpio->gpio, gpio->name,
+ 				  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
  
 -	/* LED off */
 -	ath9k_hw_set_gpio(sc->sc_ah, gpio->gpio, gpio->active_low);
diff --git a/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch b/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
index f91d85c6f8..0bc4fb3dd1 100644
--- a/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
+++ b/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  #include "common.h"
  #include "debug.h"
-@@ -963,6 +964,14 @@ struct ath_led {
+@@ -959,6 +960,14 @@ struct ath_led {
  	struct led_classdev cdev;
  };
  
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1017,6 +1026,9 @@ struct ath_softc {
+@@ -1013,6 +1022,9 @@ struct ath_softc {
  #ifdef CPTCFG_MAC80211_LEDS
  	const char *led_default_trigger;
  	struct list_head leds;
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #ifdef CPTCFG_ATH9K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -16,12 +16,138 @@
+@@ -16,13 +16,138 @@
  
  #include "ath9k.h"
  #include <linux/ath9k_platform.h>
@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +	struct ath9k_gpio_chip *gc = container_of(chip, struct ath9k_gpio_chip,
 +						  gchip);
 +
-+	ath9k_hw_cfg_gpio_input(gc->sc->sc_ah, offset);
++	ath9k_hw_gpio_request_in(gc->sc->sc_ah, offset, "ath9k-gpio");
 +
 +	return 0;
 +}
@@ -77,8 +77,8 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +	struct ath9k_gpio_chip *gc = container_of(chip, struct ath9k_gpio_chip,
 +						  gchip);
 +
-+	ath9k_hw_cfg_output(gc->sc->sc_ah, offset,
-+			    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
++	ath9k_hw_gpio_request_out(gc->sc->sc_ah, offset, "ath9k-gpio",
++				  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
 +	ath9k_hw_set_gpio(gc->sc->sc_ah, offset, value);
 +
 +	return 0;
@@ -182,10 +182,11 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  /********************************/
  
 -#ifdef CPTCFG_MAC80211_LEDS
- static void ath_led_brightness(struct led_classdev *led_cdev,
- 			       enum led_brightness brightness)
+-
+ static void ath_fill_led_pin(struct ath_softc *sc)
  {
-@@ -60,6 +186,12 @@ static int ath_add_led(struct ath_softc
+ 	struct ath_hw *ah = sc->sc_ah;
+@@ -80,6 +205,12 @@ static int ath_add_led(struct ath_softc
  	else
  		ath9k_hw_set_gpio(sc->sc_ah, gpio->gpio, gpio->active_low);
  
@@ -198,7 +199,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	return 0;
  }
  
-@@ -116,11 +248,17 @@ void ath_deinit_leds(struct ath_softc *s
+@@ -136,12 +267,18 @@ void ath_deinit_leds(struct ath_softc *s
  
  	while (!list_empty(&sc->leds)) {
  		led = list_first_entry(&sc->leds, struct ath_led, list);
@@ -210,24 +211,25 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		list_del(&led->list);
  		ath_led_brightness(&led->cdev, LED_OFF);
  		led_classdev_unregister(&led->cdev);
+ 		ath9k_hw_gpio_free(sc->sc_ah, led->gpio->gpio);
  		kfree(led);
  	}
 +	ath9k_unregister_gpio_chip(sc);
  }
  
  void ath_init_leds(struct ath_softc *sc)
-@@ -135,6 +273,8 @@ void ath_init_leds(struct ath_softc *sc)
- 	if (AR_SREV_9100(sc->sc_ah))
- 		return;
+@@ -158,6 +295,8 @@ void ath_init_leds(struct ath_softc *sc)
+ 
+ 	ath_fill_led_pin(sc);
  
 +	ath9k_register_gpio_chip(sc);
 +
  	if (pdata && pdata->led_name)
  		strncpy(led_name, pdata->led_name, sizeof(led_name));
  	else
-@@ -186,6 +326,7 @@ void ath_fill_led_pin(struct ath_softc *
- 	/* LED off, active low */
- 	ath9k_hw_set_gpio(ah, ah->led_pin, (ah->config.led_active_high) ? 0 : 1);
+@@ -178,6 +317,7 @@ void ath_init_leds(struct ath_softc *sc)
+ 	for (i = 0; i < pdata->num_leds; i++)
+ 		ath_create_platform_led(sc, &pdata->leds[i]);
  }
 +
  #endif
diff --git a/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch b/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
index 05274065c7..2e1623555f 100644
--- a/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
+++ b/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 ---
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -1028,6 +1028,7 @@ struct ath_softc {
+@@ -1024,6 +1024,7 @@ struct ath_softc {
  	struct list_head leds;
  #ifdef CONFIG_GPIOLIB
  	struct ath9k_gpio_chip *gpiochip;
@@ -29,7 +29,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  #ifdef CPTCFG_MAC80211_LEDS
  
-@@ -132,6 +134,63 @@ static void ath9k_unregister_gpio_chip(s
+@@ -132,6 +134,64 @@ static void ath9k_unregister_gpio_chip(s
  	sc->gpiochip = NULL;
  }
  
@@ -59,7 +59,8 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +		return;
 +
 +	for (i = 0; i < pdata->num_btns; i++) {
-+		ath9k_hw_cfg_gpio_input(sc->sc_ah, pdata->btns[i].gpio);
++		ath9k_hw_gpio_request_in(sc->sc_ah, pdata->btns[i].gpio,
++					 "ath9k-gpio");
 +		bt[i].gpio = sc->gpiochip->gchip.base + pdata->btns[i].gpio;
 +	}
 +
@@ -93,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #else /* CONFIG_GPIOLIB */
  
  static inline void ath9k_register_gpio_chip(struct ath_softc *sc)
-@@ -142,6 +201,14 @@ static inline void ath9k_unregister_gpio
+@@ -142,6 +202,14 @@ static inline void ath9k_unregister_gpio
  {
  }
  
@@ -108,7 +109,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #endif /* CONFIG_GPIOLIB */
  
  /********************************/
-@@ -246,6 +313,7 @@ void ath_deinit_leds(struct ath_softc *s
+@@ -265,6 +333,7 @@ void ath_deinit_leds(struct ath_softc *s
  {
  	struct ath_led *led;
  
@@ -116,17 +117,17 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	while (!list_empty(&sc->leds)) {
  		led = list_first_entry(&sc->leds, struct ath_led, list);
  #ifdef CONFIG_GPIOLIB
-@@ -274,6 +342,7 @@ void ath_init_leds(struct ath_softc *sc)
- 		return;
+@@ -296,6 +365,7 @@ void ath_init_leds(struct ath_softc *sc)
+ 	ath_fill_led_pin(sc);
  
  	ath9k_register_gpio_chip(sc);
 +	ath9k_init_buttons(sc);
  
  	if (pdata && pdata->led_name)
  		strncpy(led_name, pdata->led_name, sizeof(led_name));
-@@ -289,7 +358,7 @@ void ath_init_leds(struct ath_softc *sc)
+@@ -311,7 +381,7 @@ void ath_init_leds(struct ath_softc *sc)
  	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger,
- 			    !sc->sc_ah->config.led_active_high);
+ 			   !sc->sc_ah->config.led_active_high);
  
 -	if (!pdata)
 +	if (!pdata || !pdata->leds || !pdata->num_leds)
@@ -135,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	for (i = 0; i < pdata->num_leds; i++)
 --- a/include/linux/ath9k_platform.h
 +++ b/include/linux/ath9k_platform.h
-@@ -46,6 +46,10 @@ struct ath9k_platform_data {
+@@ -50,6 +50,10 @@ struct ath9k_platform_data {
  	int num_leds;
  	const struct gpio_led *leds;
  	const char *led_name;
diff --git a/package/kernel/mac80211/patches/550-ath9k_add_ar9280_gpio_chip.patch b/package/kernel/mac80211/patches/550-ath9k_add_ar9280_gpio_chip.patch
index 3fe7e43209..22e2c66747 100644
--- a/package/kernel/mac80211/patches/550-ath9k_add_ar9280_gpio_chip.patch
+++ b/package/kernel/mac80211/patches/550-ath9k_add_ar9280_gpio_chip.patch
@@ -21,7 +21,7 @@ Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
  	else if (AR_SREV_9285(sc->sc_ah))
  		ng = AR9285_NUM_GPIO;
 +	else if (AR_SREV_9280(sc->sc_ah))
-+		ng = AR928X_NUM_GPIO;
++		ng = AR9280_NUM_GPIO;
  	else
  		return;
  
diff --git a/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch b/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
index 82459091fe..db70a334bd 100644
--- a/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
+++ b/package/kernel/mac80211/patches/600-0002-rt2x00-rt2800lib-introduce-RT2800_HAS_HIGH_SHARED_ME.patch
@@ -24,7 +24,7 @@ Changes since v1:
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -7722,6 +7722,7 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -7726,6 +7726,7 @@ static int rt2800_probe_rt(struct rt2x00
  
  int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
  {
@@ -32,7 +32,7 @@ Changes since v1:
  	int retval;
  	u32 reg;
  
-@@ -7729,6 +7730,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -7733,6 +7734,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	if (retval)
  		return retval;
  
diff --git a/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch b/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
index 7abfcd16f2..a3b62bcc14 100644
--- a/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
+++ b/package/kernel/mac80211/patches/600-0003-rt2x00-rt2800-serialize-shared-memory-access.patch
@@ -239,7 +239,7 @@ Changes since v1: ---
  	msleep(1);
  
  	/*
-@@ -7726,6 +7774,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -7730,6 +7778,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	int retval;
  	u32 reg;
  
@@ -248,7 +248,7 @@ Changes since v1: ---
  	retval = rt2800_probe_rt(rt2x00dev);
  	if (retval)
  		return retval;
-@@ -7809,8 +7859,11 @@ void rt2800_get_key_seq(struct ieee80211
+@@ -7813,8 +7863,11 @@ void rt2800_get_key_seq(struct ieee80211
  		return;
  
  	offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
diff --git a/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch b/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
index 02b2acfeee..f41a160d3f 100644
--- a/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
+++ b/package/kernel/mac80211/patches/600-0005-rt2x00-rt2800lib-add-hw_beacon_count-field-to-struct.patch
@@ -41,7 +41,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  		rt2800_clear_beacon_register(rt2x00dev, i);
  
  	if (rt2x00_is_usb(rt2x00dev)) {
-@@ -7827,6 +7828,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -7831,6 +7832,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	if (rt2x00_rt(rt2x00dev, RT3593))
  		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
  
diff --git a/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch b/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
index e909272710..5099c64492 100644
--- a/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
+++ b/package/kernel/mac80211/patches/600-0007-rt2x00-rt2800lib-fix-max-supported-beacon-count-for-.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -7852,7 +7852,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -7856,7 +7856,10 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	if (rt2x00_rt(rt2x00dev, RT3593))
  		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
  
diff --git a/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch b/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
index 7fe38e0958..a2e701527b 100644
--- a/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/600-0009-rt2x00-rt2800lib-enable-support-for-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -7822,6 +7822,7 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -7826,6 +7826,7 @@ static int rt2800_probe_rt(struct rt2x00
  	case RT3390:
  	case RT3572:
  	case RT3593:
diff --git a/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch b/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
index 253a0c0c1e..89bd0acb87 100644
--- a/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
+++ b/package/kernel/mac80211/patches/600-0010-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
@@ -98,7 +98,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  static const struct rf_channel rf_vals_5592_xtal20[] = {
  	/* Channel, N, K, mod, R */
  	{1, 482, 4, 10, 3},
-@@ -7669,6 +7729,11 @@ static int rt2800_probe_hw_mode(struct r
+@@ -7673,6 +7733,11 @@ static int rt2800_probe_hw_mode(struct r
  		spec->channels = rf_vals_3x;
  		break;
  
diff --git a/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch b/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
index f15c22b30f..b7efc9f31b 100644
--- a/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
+++ b/package/kernel/mac80211/patches/600-0011-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
@@ -18,7 +18,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	case RF5360:
  	case RF5362:
  	case RF5370:
-@@ -7848,6 +7849,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -7852,6 +7853,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF3053:
  	case RF3070:
  	case RF3290:
diff --git a/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch b/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
index 6ce224aba2..220e35fe4c 100644
--- a/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/600-0026-rt2x00-rt2800lib-use-correct-beacon-count-for-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8403,7 +8403,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -8407,7 +8407,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	if (rt2x00_rt(rt2x00dev, RT3593))
  		__set_bit(RT2800_HAS_HIGH_SHARED_MEM, &drv_data->rt2800_flags);
  
diff --git a/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch b/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
index 25753af81b..2ffa5a4162 100644
--- a/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
+++ b/package/kernel/mac80211/patches/600-0032-rt2x00-rt2800lib-enable-RT2800_HAS_HIGH_SHARED_MEM-f.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8416,7 +8416,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -8420,7 +8420,8 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	if (retval)
  		return retval;
  
diff --git a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
index 7a183a404b..daa5dc61f9 100644
--- a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
+++ b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00_platform_h.patch
@@ -22,10 +22,10 @@
 +#endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -38,6 +38,7 @@
- #include <linux/kfifo.h>
+@@ -39,6 +39,7 @@
  #include <linux/hrtimer.h>
  #include <linux/average.h>
+ #include <linux/usb.h>
 +#include <linux/rt2x00_platform.h>
  
  #include <net/mac80211.h>
diff --git a/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
index bc056cd735..8ae5da3879 100644
--- a/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/.local-symbols
 +++ b/.local-symbols
-@@ -329,6 +329,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -331,6 +331,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -105,7 +105,7 @@
  	.drv_init_registers	= rt2800mmio_init_registers,
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -697,6 +697,7 @@ enum rt2x00_capability_flags {
+@@ -699,6 +699,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
  	REQUIRE_DELAYED_RFKILL,
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1335,6 +1335,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1334,6 +1334,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1475,6 +1479,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1477,6 +1481,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
diff --git a/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
index d923e05c77..a2e1faf9c3 100644
--- a/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/kernel/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -405,6 +405,7 @@ struct hw_mode_spec {
+@@ -406,6 +406,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
index a645ba176e..6704ff835c 100644
--- a/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
+++ b/package/kernel/mac80211/patches/608-add_platform_data_mac_addr.patch
@@ -31,7 +31,7 @@
  {
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -1414,6 +1414,7 @@ static inline void rt2x00debug_dump_fram
+@@ -1416,6 +1416,7 @@ static inline void rt2x00debug_dump_fram
   */
  u32 rt2x00lib_get_bssidx(struct rt2x00_dev *rt2x00dev,
  			 struct ieee80211_vif *vif);
diff --git a/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch b/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
index c69d33025d..9f10fe35c3 100644
--- a/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
+++ b/package/kernel/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
@@ -200,7 +200,7 @@
   * EEPROM frequency
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -717,6 +717,8 @@ enum rt2x00_capability_flags {
+@@ -719,6 +719,8 @@ enum rt2x00_capability_flags {
  	CAPABILITY_DOUBLE_ANTENNA,
  	CAPABILITY_BT_COEXIST,
  	CAPABILITY_VCO_RECALIBRATION,
diff --git a/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch b/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
index b44fe900d5..860fdc07ed 100644
--- a/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
+++ b/package/kernel/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
@@ -28,7 +28,7 @@
  static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
  {
  	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -8272,7 +8293,10 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8276,7 +8297,10 @@ static int rt2800_probe_hw_mode(struct r
  	case RF5390:
  	case RF5392:
  		spec->num_channels = 14;
@@ -40,7 +40,7 @@
  		break;
  
  	case RF3052:
-@@ -8456,6 +8480,19 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -8460,6 +8484,19 @@ static int rt2800_probe_rt(struct rt2x00
  	return 0;
  }
  
@@ -60,7 +60,7 @@
  int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
-@@ -8498,6 +8535,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -8502,6 +8539,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
  
  	/*
@@ -78,7 +78,7 @@
  	retval = rt2800_probe_hw_mode(rt2x00dev);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -400,6 +400,7 @@ static inline struct rt2x00_intf* vif_to
+@@ -401,6 +401,7 @@ static inline struct rt2x00_intf* vif_to
   * @channels: Device/chipset specific channel values (See &struct rf_channel).
   * @channels_info: Additional information for channels (See &struct channel_info).
   * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
@@ -86,7 +86,7 @@
   */
  struct hw_mode_spec {
  	unsigned int supported_bands;
-@@ -416,6 +417,7 @@ struct hw_mode_spec {
+@@ -417,6 +418,7 @@ struct hw_mode_spec {
  	const struct channel_info *channels_info;
  
  	struct ieee80211_sta_ht_cap ht;
diff --git a/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch b/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
index 8e3bd2a362..e7b2a8ca89 100644
--- a/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
+++ b/package/kernel/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -8482,13 +8483,14 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -8486,13 +8487,14 @@ static int rt2800_probe_rt(struct rt2x00
  
  int rt2800_probe_clk(struct rt2x00_dev *rt2x00dev)
  {
diff --git a/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch b/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
index faa5879de6..44bd8a194b 100644
--- a/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
+++ b/package/kernel/mac80211/patches/616-rt2x00-support-rt5350.patch
@@ -240,7 +240,7 @@
  	case RF5360:
  	case RF5362:
  	case RF5370:
-@@ -8287,6 +8398,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8291,6 +8402,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF3290:
  	case RF3320:
  	case RF3322:
@@ -248,7 +248,7 @@
  	case RF5360:
  	case RF5362:
  	case RF5370:
-@@ -8426,6 +8538,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8430,6 +8542,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF3070:
  	case RF3290:
  	case RF3853:
@@ -256,7 +256,7 @@
  	case RF5360:
  	case RF5362:
  	case RF5370:
-@@ -8466,6 +8579,7 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -8470,6 +8583,7 @@ static int rt2800_probe_rt(struct rt2x00
  	case RT3572:
  	case RT3593:
  	case RT3883:
@@ -266,7 +266,7 @@
  	case RT5592:
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -169,6 +169,7 @@ struct rt2x00_chip {
+@@ -170,6 +170,7 @@ struct rt2x00_chip {
  #define RT3572		0x3572
  #define RT3593		0x3593
  #define RT3883		0x3883	/* WSOC */
diff --git a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
index 55452b9ebd..dba6033edb 100644
--- a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1284,7 +1284,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1283,7 +1283,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
index fd885cc002..02f3053b2f 100644
--- a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2084,6 +2084,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2122,6 +2122,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
diff --git a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
index b67a95f948..ad306083da 100644
--- a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2174,6 +2174,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2212,6 +2212,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch b/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch
deleted file mode 100644
index 74cd4489f1..0000000000
--- a/package/kernel/mac80211/patches/804-b43-sync-with-bcma.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- a/drivers/net/wireless/broadcom/b43/main.c
-+++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -1215,10 +1215,10 @@ void b43_wireless_core_phy_pll_reset(str
- 	case B43_BUS_BCMA:
- 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
- 
--		bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
--		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
--		bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
--		bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
-+		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
-+		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
-+		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
-+		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
- 		break;
- #endif
- #ifdef CPTCFG_B43_SSB
diff --git a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
index 06c731fce6..b60ef76a65 100644
--- a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5209,6 +5206,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5207,6 +5204,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -5230,6 +5268,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5228,6 +5266,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5538,6 +5578,8 @@ static int b43_one_core_attach(struct b4
+@@ -5536,6 +5576,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5628,6 +5670,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5626,6 +5668,9 @@ static struct b43_wl *b43_wireless_init(
  
  	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
  
diff --git a/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch b/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch
index 7100820710..46227c48dd 100644
--- a/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch
+++ b/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch
@@ -14,7 +14,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1157,6 +1157,9 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
+@@ -1157,6 +1157,9 @@ brcmf_msgbuf_process_rx_complete(struct
  		brcmu_pkt_buf_free_skb(skb);
  		return;
  	}
diff --git a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
index ac0f704538..5f69043ada 100644
--- a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
+++ b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -636,9 +636,37 @@ static struct wireless_dev *brcmf_cfg802
+@@ -650,9 +650,37 @@ static struct wireless_dev *brcmf_cfg802
  						     u32 *flags,
  						     struct vif_params *params)
  {
diff --git a/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch
index 1615202d8e..f971bb7f26 100644
--- a/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2651,6 +2651,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2711,6 +2711,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
index f2e21ea49f..be210f2d4b 100644
--- a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
+++ b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
@@ -1184,7 +1184,7 @@
  		break;
  	default:
  		rt2x00_err(rt2x00dev, "Invalid RF chipset 0x%04x detected\n",
-@@ -8423,6 +9363,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8427,6 +9367,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF5372:
  	case RF5390:
  	case RF5392:
@@ -1192,7 +1192,7 @@
  		spec->num_channels = 14;
  		if (spec->clk_is_20mhz)
  			spec->channels = rf_vals_xtal20mhz_3x;
-@@ -8563,6 +9504,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8567,6 +9508,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF5372:
  	case RF5390:
  	case RF5392:
diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
index 8c6d720a73..6a904ec7ce 100644
--- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -1914,6 +1914,16 @@ int ath10k_core_register(struct ath10k *
+@@ -2009,6 +2009,16 @@ int ath10k_core_register(struct ath10k *
  	ar->chip_id = chip_id;
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
index 281b4475ad..60b5b1be0c 100644
--- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -7141,6 +7141,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
+@@ -7662,6 +7662,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
  	return arvif_iter.arvif;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -7357,6 +7372,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -7880,6 +7895,12 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->wiphy->cipher_suites = cipher_suites;
  	ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  
diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index 1e7dc79369..f66d039245 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mt76
-PKG_VERSION:=2016-04-27
+PKG_VERSION:=2016-05-14
 PKG_RELEASE=1
 
 PKG_LICENSE:=GPLv2
@@ -10,7 +10,7 @@ PKG_LICENSE_FILES:=
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=7605d326e6f6dcc3cf0cceea9779f3fd15e1eca7
+PKG_SOURCE_VERSION:=810eef8383cf2669cd4354135fc560ccfe71786c
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
diff --git a/package/kernel/mwlwifi/patches/110-api_sync.patch b/package/kernel/mwlwifi/patches/110-api_sync.patch
index ed3e06a1c1..920cb8cd66 100644
--- a/package/kernel/mwlwifi/patches/110-api_sync.patch
+++ b/package/kernel/mwlwifi/patches/110-api_sync.patch
@@ -1,6 +1,30 @@
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -597,10 +597,13 @@ static int mwl_mac80211_get_survey(struc
+@@ -260,12 +260,12 @@ static int mwl_mac80211_config(struct ie
+ 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+ 		int rate = 0;
+ 
+-		if (conf->chandef.chan->band == IEEE80211_BAND_2GHZ) {
++		if (conf->chandef.chan->band == NL80211_BAND_2GHZ) {
+ 			mwl_fwcmd_set_apmode(hw, AP_MODE_2_4GHZ_11AC_MIXED);
+ 			mwl_fwcmd_set_linkadapt_cs_mode(hw,
+ 							LINK_CS_STATE_CONSERV);
+ 			rate = mwl_rates_24[0].hw_value;
+-		} else if (conf->chandef.chan->band == IEEE80211_BAND_5GHZ) {
++		} else if (conf->chandef.chan->band == NL80211_BAND_5GHZ) {
+ 			mwl_fwcmd_set_apmode(hw, AP_MODE_11AC);
+ 			mwl_fwcmd_set_linkadapt_cs_mode(hw,
+ 							LINK_CS_STATE_AUTO);
+@@ -333,7 +333,7 @@ static void mwl_mac80211_bss_info_change
+ 		if (idx)
+ 			idx--;
+ 
+-		if (hw->conf.chandef.chan->band == IEEE80211_BAND_2GHZ)
++		if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
+ 			rate = mwl_rates_24[idx].hw_value;
+ 		else
+ 			rate = mwl_rates_50[idx].hw_value;
+@@ -600,10 +600,13 @@ static int mwl_mac80211_get_survey(struc
  
  static int mwl_mac80211_ampdu_action(struct ieee80211_hw *hw,
  				     struct ieee80211_vif *vif,
@@ -17,3 +41,227 @@
  	int rc = 0;
  	struct mwl_priv *priv = hw->priv;
  	struct mwl_ampdu_stream *stream;
+--- a/fwcmd.c
++++ b/fwcmd.c
+@@ -730,9 +730,9 @@ static int mwl_fwcmd_set_country_code(st
+ 	bool enable = false;
+ 
+ 	if (b_inf->ie_country_ptr) {
+-		if (bss_conf->chandef.chan->band == IEEE80211_BAND_2GHZ)
++		if (bss_conf->chandef.chan->band == NL80211_BAND_2GHZ)
+ 			a_band = false;
+-		else if (bss_conf->chandef.chan->band == IEEE80211_BAND_5GHZ)
++		else if (bss_conf->chandef.chan->band == NL80211_BAND_5GHZ)
+ 			a_band = true;
+ 		else
+ 			return -EINVAL;
+@@ -1075,9 +1075,9 @@ int mwl_fwcmd_max_tx_power(struct ieee80
+ 		break;
+ 	}
+ 
+-	if (channel->band == IEEE80211_BAND_2GHZ)
++	if (channel->band == NL80211_BAND_2GHZ)
+ 		band = FREQ_BAND_2DOT4GHZ;
+-	else if (channel->band == IEEE80211_BAND_5GHZ)
++	else if (channel->band == NL80211_BAND_5GHZ)
+ 		band = FREQ_BAND_5GHZ;
+ 
+ 	switch (conf->chandef.width) {
+@@ -1161,9 +1161,9 @@ int mwl_fwcmd_tx_power(struct ieee80211_
+ 		break;
+ 	}
+ 
+-	if (channel->band == IEEE80211_BAND_2GHZ)
++	if (channel->band == NL80211_BAND_2GHZ)
+ 		band = FREQ_BAND_2DOT4GHZ;
+-	else if (channel->band == IEEE80211_BAND_5GHZ)
++	else if (channel->band == NL80211_BAND_5GHZ)
+ 		band = FREQ_BAND_5GHZ;
+ 
+ 	switch (conf->chandef.width) {
+@@ -1354,9 +1354,9 @@ int mwl_fwcmd_set_rf_channel(struct ieee
+ 	pcmd->action = cpu_to_le16(WL_SET);
+ 	pcmd->curr_chnl = channel->hw_value;
+ 
+-	if (channel->band == IEEE80211_BAND_2GHZ) {
++	if (channel->band == NL80211_BAND_2GHZ) {
+ 		freq_band = FREQ_BAND_2DOT4GHZ;
+-	} else if (channel->band == IEEE80211_BAND_5GHZ) {
++	} else if (channel->band == NL80211_BAND_5GHZ) {
+ 		freq_band = FREQ_BAND_5GHZ;
+ 	} else {
+ 		mutex_unlock(&priv->fwcmd_mutex);
+@@ -1923,10 +1923,10 @@ int mwl_fwcmd_set_new_stn_add(struct iee
+ 	}
+ 	ether_addr_copy(pcmd->mac_addr, sta->addr);
+ 
+-	if (hw->conf.chandef.chan->band == IEEE80211_BAND_2GHZ)
+-		rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
++	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
++		rates = sta->supp_rates[NL80211_BAND_2GHZ];
+ 	else
+-		rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
++		rates = sta->supp_rates[NL80211_BAND_5GHZ] << 5;
+ 	pcmd->peer_info.legacy_rate_bitmap = cpu_to_le32(rates);
+ 
+ 	if (sta->ht_cap.ht_supported) {
+@@ -2097,9 +2097,9 @@ int mwl_fwcmd_set_switch_channel(struct
+ 	if (priv->csa_active)
+ 		return 0;
+ 
+-	if (channel->band == IEEE80211_BAND_2GHZ)
++	if (channel->band == NL80211_BAND_2GHZ)
+ 		freq_band = FREQ_BAND_2DOT4GHZ;
+-	else if (channel->band == IEEE80211_BAND_5GHZ)
++	else if (channel->band == NL80211_BAND_5GHZ)
+ 		freq_band = FREQ_BAND_5GHZ;
+ 	else
+ 		return -EINVAL;
+--- a/main.c
++++ b/main.c
+@@ -63,20 +63,20 @@ static struct mwl_chip_info mwl_chip_tbl
+ };
+ 
+ static const struct ieee80211_channel mwl_channels_24[] = {
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2412, .hw_value = 1, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2417, .hw_value = 2, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2422, .hw_value = 3, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2427, .hw_value = 4, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2432, .hw_value = 5, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2437, .hw_value = 6, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2442, .hw_value = 7, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2447, .hw_value = 8, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2452, .hw_value = 9, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2457, .hw_value = 10, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2462, .hw_value = 11, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2467, .hw_value = 12, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2472, .hw_value = 13, },
+-	{ .band = IEEE80211_BAND_2GHZ, .center_freq = 2484, .hw_value = 14, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2412, .hw_value = 1, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2417, .hw_value = 2, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2422, .hw_value = 3, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2427, .hw_value = 4, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2432, .hw_value = 5, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2437, .hw_value = 6, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2442, .hw_value = 7, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2447, .hw_value = 8, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2452, .hw_value = 9, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2457, .hw_value = 10, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2462, .hw_value = 11, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2467, .hw_value = 12, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2472, .hw_value = 13, },
++	{ .band = NL80211_BAND_2GHZ, .center_freq = 2484, .hw_value = 14, },
+ };
+ 
+ static const struct ieee80211_rate mwl_rates_24[] = {
+@@ -96,30 +96,30 @@ static const struct ieee80211_rate mwl_r
+ };
+ 
+ static const struct ieee80211_channel mwl_channels_50[] = {
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5180, .hw_value = 36, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5260, .hw_value = 52, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5280, .hw_value = 56, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5300, .hw_value = 60, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5320, .hw_value = 64, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5500, .hw_value = 100, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5520, .hw_value = 104, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5540, .hw_value = 108, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5560, .hw_value = 112, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5580, .hw_value = 116, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5600, .hw_value = 120, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5620, .hw_value = 124, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5640, .hw_value = 128, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5660, .hw_value = 132, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5680, .hw_value = 136, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5700, .hw_value = 140, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5720, .hw_value = 144, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5745, .hw_value = 149, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5765, .hw_value = 153, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5785, .hw_value = 157, },
+-	{ .band = IEEE80211_BAND_5GHZ, .center_freq = 5805, .hw_value = 161, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5180, .hw_value = 36, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5260, .hw_value = 52, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5280, .hw_value = 56, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5300, .hw_value = 60, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5320, .hw_value = 64, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5500, .hw_value = 100, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5520, .hw_value = 104, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5540, .hw_value = 108, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5560, .hw_value = 112, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5580, .hw_value = 116, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5600, .hw_value = 120, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5620, .hw_value = 124, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5640, .hw_value = 128, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5660, .hw_value = 132, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5680, .hw_value = 136, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5700, .hw_value = 140, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5720, .hw_value = 144, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5745, .hw_value = 149, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5765, .hw_value = 153, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5785, .hw_value = 157, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5805, .hw_value = 161, },
+ };
+ 
+ static const struct ieee80211_rate mwl_rates_50[] = {
+@@ -478,7 +478,7 @@ static void mwl_set_caps(struct mwl_priv
+ 		BUILD_BUG_ON(sizeof(priv->rates_24) != sizeof(mwl_rates_24));
+ 		memcpy(priv->rates_24, mwl_rates_24, sizeof(mwl_rates_24));
+ 
+-		priv->band_24.band = IEEE80211_BAND_2GHZ;
++		priv->band_24.band = NL80211_BAND_2GHZ;
+ 		priv->band_24.channels = priv->channels_24;
+ 		priv->band_24.n_channels = ARRAY_SIZE(mwl_channels_24);
+ 		priv->band_24.bitrates = priv->rates_24;
+@@ -487,7 +487,7 @@ static void mwl_set_caps(struct mwl_priv
+ 		mwl_set_ht_caps(priv, &priv->band_24);
+ 		mwl_set_vht_caps(priv, &priv->band_24);
+ 
+-		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band_24;
++		hw->wiphy->bands[NL80211_BAND_2GHZ] = &priv->band_24;
+ 	}
+ 
+ 	/* set up band information for 5G */
+@@ -500,7 +500,7 @@ static void mwl_set_caps(struct mwl_priv
+ 		BUILD_BUG_ON(sizeof(priv->rates_50) != sizeof(mwl_rates_50));
+ 		memcpy(priv->rates_50, mwl_rates_50, sizeof(mwl_rates_50));
+ 
+-		priv->band_50.band = IEEE80211_BAND_5GHZ;
++		priv->band_50.band = NL80211_BAND_5GHZ;
+ 		priv->band_50.channels = priv->channels_50;
+ 		priv->band_50.n_channels = ARRAY_SIZE(mwl_channels_50);
+ 		priv->band_50.bitrates = priv->rates_50;
+@@ -509,7 +509,7 @@ static void mwl_set_caps(struct mwl_priv
+ 		mwl_set_ht_caps(priv, &priv->band_50);
+ 		mwl_set_vht_caps(priv, &priv->band_50);
+ 
+-		hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &priv->band_50;
++		hw->wiphy->bands[NL80211_BAND_5GHZ] = &priv->band_50;
+ 	}
+ }
+ 
+--- a/rx.c
++++ b/rx.c
+@@ -243,7 +243,7 @@ static inline void mwl_rx_prepare_status
+ 	status->rate_idx = rt;
+ 
+ 	if (pdesc->channel > BAND_24_CHANNEL_NUM) {
+-		status->band = IEEE80211_BAND_5GHZ;
++		status->band = NL80211_BAND_5GHZ;
+ 		if ((!(status->flag & RX_FLAG_HT)) &&
+ 		    (!(status->flag & RX_FLAG_VHT))) {
+ 			status->rate_idx -= 5;
+@@ -251,7 +251,7 @@ static inline void mwl_rx_prepare_status
+ 				status->rate_idx = BAND_50_RATE_NUM - 1;
+ 		}
+ 	} else {
+-		status->band = IEEE80211_BAND_2GHZ;
++		status->band = NL80211_BAND_2GHZ;
+ 		if ((!(status->flag & RX_FLAG_HT)) &&
+ 		    (!(status->flag & RX_FLAG_VHT))) {
+ 			if (status->rate_idx >= BAND_24_RATE_NUM)
diff --git a/package/network/utils/iw/patches/001-nl80211_h_sync.patch b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
index 7de225859b..e5ea8f7c8a 100644
--- a/package/network/utils/iw/patches/001-nl80211_h_sync.patch
+++ b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
@@ -8,7 +8,17 @@
   *
   * Permission to use, copy, modify, and/or distribute this software for any
   * purpose with or without fee is hereby granted, provided that the above
-@@ -328,7 +329,15 @@
+@@ -321,14 +322,24 @@
+  * @NL80211_CMD_GET_SCAN: get scan results
+  * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
+  *	%NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
+- *	probe requests at CCK rate or not.
++ *	probe requests at CCK rate or not. %NL80211_ATTR_MAC can be used to
++ *	specify a BSSID to scan for; if not included, the wildcard BSSID will
++ *	be used.
+  * @NL80211_CMD_NEW_SCAN_RESULTS: scan notification (as a reply to
+  *	NL80211_CMD_GET_SCAN and on the "scan" multicast group)
+  * @NL80211_CMD_SCAN_ABORTED: scan was aborted, for unspecified reasons,
   *	partial scan results may be available
   *
   * @NL80211_CMD_START_SCHED_SCAN: start a scheduled scan at certain
@@ -25,7 +35,82 @@
   *	Like with normal scans, if SSIDs (%NL80211_ATTR_SCAN_SSIDS)
   *	are passed, they are used in the probe requests.  For
   *	broadcast, a broadcast SSID must be passed (ie. an empty
-@@ -1761,6 +1770,22 @@ enum nl80211_commands {
+@@ -418,7 +429,11 @@
+  * @NL80211_CMD_ASSOCIATE: association request and notification; like
+  *	NL80211_CMD_AUTHENTICATE but for Association and Reassociation
+  *	(similar to MLME-ASSOCIATE.request, MLME-REASSOCIATE.request,
+- *	MLME-ASSOCIATE.confirm or MLME-REASSOCIATE.confirm primitives).
++ *	MLME-ASSOCIATE.confirm or MLME-REASSOCIATE.confirm primitives). The
++ *	%NL80211_ATTR_PREV_BSSID attribute is used to specify whether the
++ *	request is for the initial association to an ESS (that attribute not
++ *	included) or for reassociation within the ESS (that attribute is
++ *	included).
+  * @NL80211_CMD_DEAUTHENTICATE: deauthentication request and notification; like
+  *	NL80211_CMD_AUTHENTICATE but for Deauthentication frames (similar to
+  *	MLME-DEAUTHENTICATION.request and MLME-DEAUTHENTICATE.indication
+@@ -468,6 +483,9 @@
+  *	set of BSSID,frequency parameters is used (i.e., either the enforcing
+  *	%NL80211_ATTR_MAC,%NL80211_ATTR_WIPHY_FREQ or the less strict
+  *	%NL80211_ATTR_MAC_HINT and %NL80211_ATTR_WIPHY_FREQ_HINT).
++ *	%NL80211_ATTR_PREV_BSSID can be used to request a reassociation within
++ *	the ESS in case the device is already associated and an association with
++ *	a different BSS is desired.
+  *	Background scan period can optionally be
+  *	specified in %NL80211_ATTR_BG_SCAN_PERIOD,
+  *	if not specified default background scan configuration
+@@ -811,6 +829,10 @@
+  *	as an event to indicate changes for devices with wiphy-specific regdom
+  *	management.
+  *
++ * @NL80211_CMD_ABORT_SCAN: Stop an ongoing scan. Returns -ENOENT if a scan is
++ *	not running. The driver indicates the status of the scan through
++ *	cfg80211_scan_done().
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -997,6 +1019,8 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_WIPHY_REG_CHANGE,
+ 
++	NL80211_CMD_ABORT_SCAN,
++
+ 	/* add new commands above here */
+ 
+ 	/* used to define NL80211_CMD_MAX below */
+@@ -1270,8 +1294,11 @@ enum nl80211_commands {
+  * @NL80211_ATTR_RESP_IE: (Re)association response information elements as
+  *	sent by peer, for ROAM and successful CONNECT events.
+  *
+- * @NL80211_ATTR_PREV_BSSID: previous BSSID, to be used by in ASSOCIATE
+- *	commands to specify using a reassociate frame
++ * @NL80211_ATTR_PREV_BSSID: previous BSSID, to be used in ASSOCIATE and CONNECT
++ *	commands to specify a request to reassociate within an ESS, i.e., to use
++ *	Reassociate Request frame (with the value of this attribute in the
++ *	Current AP address field) instead of Association Request frame which is
++ *	used for the initial association to an ESS.
+  *
+  * @NL80211_ATTR_KEY: key information in a nested attribute with
+  *	%NL80211_KEY_* sub-attributes
+@@ -1712,6 +1739,8 @@ enum nl80211_commands {
+  *	underlying device supports these minimal RRM features:
+  *		%NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES,
+  *		%NL80211_FEATURE_QUIET,
++ *	Or, if global RRM is supported, see:
++ *		%NL80211_EXT_FEATURE_RRM
+  *	If this flag is used, driver must add the Power Capabilities IE to the
+  *	association request. In addition, it must also set the RRM capability
+  *	flag in the association request's Capability Info field.
+@@ -1755,12 +1784,44 @@ enum nl80211_commands {
+  *	over all channels.
+  *
+  * @NL80211_ATTR_SCHED_SCAN_DELAY: delay before the first cycle of a
+- *	scheduled scan (or a WoWLAN net-detect scan) is started, u32
+- *	in seconds.
++ *	scheduled scan is started.  Or the delay before a WoWLAN
++ *	net-detect scan is started, counting from the moment the
++ *	system is suspended.  This value is a u32, in seconds.
+ 
   * @NL80211_ATTR_REG_INDOOR: flag attribute, if set indicates that the device
   *      is operating in an indoor environment.
   *
@@ -41,6 +126,21 @@
 + *	thus it must not specify the number of iterations, only the interval
 + *	between scans. The scan plans are executed sequentially.
 + *	Each scan plan is a nested attribute of &enum nl80211_sched_scan_plan.
++ * @NL80211_ATTR_PBSS: flag attribute. If set it means operate
++ *	in a PBSS. Specified in %NL80211_CMD_CONNECT to request
++ *	connecting to a PCP, and in %NL80211_CMD_START_AP to start
++ *	a PCP instead of AP. Relevant for DMG networks only.
++ * @NL80211_ATTR_BSS_SELECT: nested attribute for driver supporting the
++ *	BSS selection feature. When used with %NL80211_CMD_GET_WIPHY it contains
++ *	attributes according &enum nl80211_bss_select_attr to indicate what
++ *	BSS selection behaviours are supported. When used with %NL80211_CMD_CONNECT
++ *	it contains the behaviour-specific attribute containing the parameters for
++ *	BSS selection to be done by driver and/or firmware.
++ *
++ * @NL80211_ATTR_STA_SUPPORT_P2P_PS: whether P2P PS mechanism supported
++ *	or not. u8, one of the values of &enum nl80211_sta_p2p_ps_status
++ *
++ * @NL80211_ATTR_PAD: attribute used for padding for 64-bit alignment
 + *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -48,7 +148,7 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2130,6 +2155,13 @@ enum nl80211_attrs {
+@@ -2130,6 +2191,21 @@ enum nl80211_attrs {
  
  	NL80211_ATTR_REG_INDOOR,
  
@@ -57,30 +157,147 @@
 +	NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
 +	NL80211_ATTR_SCHED_SCAN_PLANS,
 +
++	NL80211_ATTR_PBSS,
++
++	NL80211_ATTR_BSS_SELECT,
++
++	NL80211_ATTR_STA_SUPPORT_P2P_PS,
++
++	NL80211_ATTR_PAD,
++
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
  	/* add attributes here, update the policy in nl80211.c */
  
  	__NL80211_ATTR_AFTER_LAST,
-@@ -3364,6 +3396,9 @@ enum nl80211_bss_scan_width {
+@@ -2273,6 +2349,20 @@ enum nl80211_sta_flags {
+ 	NL80211_STA_FLAG_MAX = __NL80211_STA_FLAG_AFTER_LAST - 1
+ };
+ 
++/**
++ * enum nl80211_sta_p2p_ps_status - station support of P2P PS
++ *
++ * @NL80211_P2P_PS_UNSUPPORTED: station doesn't support P2P PS mechanism
++ * @@NL80211_P2P_PS_SUPPORTED: station supports P2P PS mechanism
++ * @NUM_NL80211_P2P_PS_STATUS: number of values
++ */
++enum nl80211_sta_p2p_ps_status {
++	NL80211_P2P_PS_UNSUPPORTED = 0,
++	NL80211_P2P_PS_SUPPORTED,
++
++	NUM_NL80211_P2P_PS_STATUS,
++};
++
+ #define NL80211_STA_FLAG_MAX_OLD_API	NL80211_STA_FLAG_TDLS_PEER
+ 
+ /**
+@@ -2430,6 +2520,9 @@ enum nl80211_sta_bss_param {
+  *	TID+1 and the special TID 16 (i.e. value 17) is used for non-QoS frames;
+  *	each one of those is again nested with &enum nl80211_tid_stats
+  *	attributes carrying the actual values.
++ * @NL80211_STA_INFO_RX_DURATION: aggregate PPDU duration for all frames
++ *	received from the station (u64, usec)
++ * @NL80211_STA_INFO_PAD: attribute used for padding for 64-bit alignment
+  * @__NL80211_STA_INFO_AFTER_LAST: internal
+  * @NL80211_STA_INFO_MAX: highest possible station info attribute
+  */
+@@ -2466,6 +2559,8 @@ enum nl80211_sta_info {
+ 	NL80211_STA_INFO_BEACON_RX,
+ 	NL80211_STA_INFO_BEACON_SIGNAL_AVG,
+ 	NL80211_STA_INFO_TID_STATS,
++	NL80211_STA_INFO_RX_DURATION,
++	NL80211_STA_INFO_PAD,
+ 
+ 	/* keep last */
+ 	__NL80211_STA_INFO_AFTER_LAST,
+@@ -2482,6 +2577,7 @@ enum nl80211_sta_info {
+  *	transmitted MSDUs (not counting the first attempt; u64)
+  * @NL80211_TID_STATS_TX_MSDU_FAILED: number of failed transmitted
+  *	MSDUs (u64)
++ * @NL80211_TID_STATS_PAD: attribute used for padding for 64-bit alignment
+  * @NUM_NL80211_TID_STATS: number of attributes here
+  * @NL80211_TID_STATS_MAX: highest numbered attribute here
+  */
+@@ -2491,6 +2587,7 @@ enum nl80211_tid_stats {
+ 	NL80211_TID_STATS_TX_MSDU,
+ 	NL80211_TID_STATS_TX_MSDU_RETRIES,
+ 	NL80211_TID_STATS_TX_MSDU_FAILED,
++	NL80211_TID_STATS_PAD,
+ 
+ 	/* keep last */
+ 	NUM_NL80211_TID_STATS,
+@@ -2927,6 +3024,7 @@ enum nl80211_user_reg_hint_type {
+  *	transmitting data (on channel or globally)
+  * @NL80211_SURVEY_INFO_TIME_SCAN: time the radio spent for scan
+  *	(on this channel or globally)
++ * @NL80211_SURVEY_INFO_PAD: attribute used for padding for 64-bit alignment
+  * @NL80211_SURVEY_INFO_MAX: highest survey info attribute number
+  *	currently defined
+  * @__NL80211_SURVEY_INFO_AFTER_LAST: internal use
+@@ -2942,6 +3040,7 @@ enum nl80211_survey_info {
+ 	NL80211_SURVEY_INFO_TIME_RX,
+ 	NL80211_SURVEY_INFO_TIME_TX,
+ 	NL80211_SURVEY_INFO_TIME_SCAN,
++	NL80211_SURVEY_INFO_PAD,
+ 
+ 	/* keep last */
+ 	__NL80211_SURVEY_INFO_AFTER_LAST,
+@@ -3364,6 +3463,10 @@ enum nl80211_bss_scan_width {
   *	(not present if no beacon frame has been received yet)
   * @NL80211_BSS_PRESP_DATA: the data in @NL80211_BSS_INFORMATION_ELEMENTS and
   *	@NL80211_BSS_TSF is known to be from a probe response (flag attribute)
 + * @NL80211_BSS_LAST_SEEN_BOOTTIME: CLOCK_BOOTTIME timestamp when this entry
 + *	was last updated by a received frame. The value is expected to be
 + *	accurate to about 10ms. (u64, nanoseconds)
++ * @NL80211_BSS_PAD: attribute used for padding for 64-bit alignment
   * @__NL80211_BSS_AFTER_LAST: internal
   * @NL80211_BSS_MAX: highest BSS attribute
   */
-@@ -3383,6 +3418,7 @@ enum nl80211_bss {
+@@ -3383,6 +3486,8 @@ enum nl80211_bss {
  	NL80211_BSS_CHAN_WIDTH,
  	NL80211_BSS_BEACON_TSF,
  	NL80211_BSS_PRESP_DATA,
 +	NL80211_BSS_LAST_SEEN_BOOTTIME,
++	NL80211_BSS_PAD,
  
  	/* keep last */
  	__NL80211_BSS_AFTER_LAST,
-@@ -4589,4 +4625,28 @@ enum nl80211_tdls_peer_capability {
+@@ -3568,11 +3673,15 @@ enum nl80211_txrate_gi {
+  * @NL80211_BAND_2GHZ: 2.4 GHz ISM band
+  * @NL80211_BAND_5GHZ: around 5 GHz band (4.9 - 5.7 GHz)
+  * @NL80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
++ * @NUM_NL80211_BANDS: number of bands, avoid using this in userspace
++ *	since newer kernel versions may support more bands
+  */
+ enum nl80211_band {
+ 	NL80211_BAND_2GHZ,
+ 	NL80211_BAND_5GHZ,
+ 	NL80211_BAND_60GHZ,
++
++	NUM_NL80211_BANDS,
+ };
+ 
+ /**
+@@ -4358,12 +4467,18 @@ enum nl80211_feature_flags {
+ /**
+  * enum nl80211_ext_feature_index - bit index of extended features.
+  * @NL80211_EXT_FEATURE_VHT_IBSS: This driver supports IBSS with VHT datarates.
++ * @NL80211_EXT_FEATURE_RRM: This driver supports RRM. When featured, user can
++ *	can request to use RRM (see %NL80211_ATTR_USE_RRM) with
++ *	%NL80211_CMD_ASSOCIATE and %NL80211_CMD_CONNECT requests, which will set
++ *	the ASSOC_REQ_USE_RRM flag in the association request even if
++ *	NL80211_FEATURE_QUIET is not advertized.
+  *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_VHT_IBSS,
++	NL80211_EXT_FEATURE_RRM,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+@@ -4589,4 +4704,72 @@ enum nl80211_tdls_peer_capability {
  	NL80211_TDLS_PEER_WMM = 1<<2,
  };
  
@@ -108,4 +325,48 @@
 +		__NL80211_SCHED_SCAN_PLAN_AFTER_LAST - 1
 +};
 +
++/**
++ * struct nl80211_bss_select_rssi_adjust - RSSI adjustment parameters.
++ *
++ * @band: band of BSS that must match for RSSI value adjustment.
++ * @delta: value used to adjust the RSSI value of matching BSS.
++ */
++struct nl80211_bss_select_rssi_adjust {
++	__u8 band;
++	__s8 delta;
++} __attribute__((packed));
++
++/**
++ * enum nl80211_bss_select_attr - attributes for bss selection.
++ *
++ * @__NL80211_BSS_SELECT_ATTR_INVALID: reserved.
++ * @NL80211_BSS_SELECT_ATTR_RSSI: Flag indicating only RSSI-based BSS selection
++ *	is requested.
++ * @NL80211_BSS_SELECT_ATTR_BAND_PREF: attribute indicating BSS
++ *	selection should be done such that the specified band is preferred.
++ *	When there are multiple BSS-es in the preferred band, the driver
++ *	shall use RSSI-based BSS selection as a second step. The value of
++ *	this attribute is according to &enum nl80211_band (u32).
++ * @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST: When present the RSSI level for
++ *	BSS-es in the specified band is to be adjusted before doing
++ *	RSSI-based BSS selection. The attribute value is a packed structure
++ *	value as specified by &struct nl80211_bss_select_rssi_adjust.
++ * @NL80211_BSS_SELECT_ATTR_MAX: highest bss select attribute number.
++ * @__NL80211_BSS_SELECT_ATTR_AFTER_LAST: internal use.
++ *
++ * One and only one of these attributes are found within %NL80211_ATTR_BSS_SELECT
++ * for %NL80211_CMD_CONNECT. It specifies the required BSS selection behaviour
++ * which the driver shall use.
++ */
++enum nl80211_bss_select_attr {
++	__NL80211_BSS_SELECT_ATTR_INVALID,
++	NL80211_BSS_SELECT_ATTR_RSSI,
++	NL80211_BSS_SELECT_ATTR_BAND_PREF,
++	NL80211_BSS_SELECT_ATTR_RSSI_ADJUST,
++
++	/* keep last */
++	__NL80211_BSS_SELECT_ATTR_AFTER_LAST,
++	NL80211_BSS_SELECT_ATTR_MAX = __NL80211_BSS_SELECT_ATTR_AFTER_LAST - 1
++};
++
  #endif /* __LINUX_NL80211_H */
diff --git a/target/linux/generic/files/include/linux/ath9k_platform.h b/target/linux/generic/files/include/linux/ath9k_platform.h
index e543a64060..2c19f3b494 100644
--- a/target/linux/generic/files/include/linux/ath9k_platform.h
+++ b/target/linux/generic/files/include/linux/ath9k_platform.h
@@ -31,6 +31,10 @@ struct ath9k_platform_data {
 	u32 gpio_mask;
 	u32 gpio_val;
 
+	u32 bt_active_pin;
+	u32 bt_priority_pin;
+	u32 wlan_active_pin;
+
 	bool endian_check;
 	bool is_clk_25mhz;
 	bool tx_gain_buffalo;