From 5e83d1af73e0dff5872c75b384b248d3fc5d9c3e Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@gmail.com>
Date: Thu, 15 Aug 2019 11:01:35 +0800
Subject: [PATCH] update mac80211

---
 package/kernel/mac80211/Makefile              | 1564 +++++++++++-
 package/kernel/mac80211/ath.mk                |  276 --
 package/kernel/mac80211/broadcom.mk           |  487 ----
 .../files/lib/netifd/wireless/mac80211.sh     |   24 +-
 .../mac80211/files/lib/wifi/mac80211.sh       |    0
 .../kernel/mac80211/files/mac80211.hotplug    |    0
 package/kernel/mac80211/intel.mk              |  200 --
 package/kernel/mac80211/marvell.mk            |   90 -
 .../patches/{build => }/000-fix_kconfig.patch |    0
 .../patches/{build => }/001-fix_build.patch   |   12 +-
 .../{build => }/002-change_allconfig.patch    |    0
 .../003-remove_bogus_modparams.patch          |    0
 .../004-kconfig_backport_fix.patch            |    0
 .../patches/005-revert-devcoredump.patch      |   11 +
 .../patches/006-fix-genl-multicast.patch      |   10 +
 .../007-fix-linux-verification-h.patch        |   11 +
 .../patches/008-fix-genl-family-id.patch      |   10 +
 .../patches/009-backport_sg_init_marker.patch |   30 +
 .../{build => }/010-disable_rfkill.patch      |    0
 .../patches/011-backport-overflow_h.patch     |  322 +++
 .../{build => }/012-kernel_build_check.patch  |    0
 ...013-backport-firmware_request_nowarn.patch |   19 +
 .../patches/{build => }/015-ipw200-mtu.patch  |    4 +-
 ...options.patch => 030-rt2x00_options.patch} |    2 +-
 .../{brcm => }/040-brcmutil_option.patch      |    3 +-
 .../{build => }/050-lib80211_option.patch     |    6 +-
 .../patches/060-no_local_ssb_bcma.patch       |  132 +
 .../{ath => }/070-ath_common_config.patch     |    3 +-
 .../{ath => }/080-ath10k_thermal_config.patch |   20 +-
 .../081-ath10k-calibration-variant.patch      |  111 +
 ...press-Unknown-eventid-36925-warnings.patch |   36 +
 ...00-use-TXOP_BACKOFF-for-probe-frames.patch |   40 +
 .../100-remove-cryptoapi-dependencies.patch   |   53 +-
 .../110-mac80211_keep_keys_on_stop_ap.patch   |    4 +-
 .../120-cfg80211_allow_perm_addr_change.patch |    2 +-
 .../{subsys => }/130-disable-fils.patch       |    8 +-
 ...aes-cmac-switch-to-shash-CMAC-driver.patch |    6 +-
 .../132-mac80211-remove-cmac-dependency.patch |    2 +-
 .../{subsys => }/140-tweak-TSQ-setting.patch  |    2 +-
 .../150-disable_addr_notifier.patch           |   16 +-
 ...-IEs-for-variant-before-falling-back.patch |  237 ++
 .../201-ath5k-WAR-for-AR71xx-PCI-bug.patch    |    0
 .../patches/{subsys => }/210-ap_scan.patch    |    2 +-
 ...h10k-fix-build-errors-with-CONFIG_PM.patch |   72 +
 ...y-free-requested-but-not-started-TX-.patch |   37 +
 ...-drop-frames-appearing-to-be-from-us.patch |   25 +
 ...mac-handle-FWHALT-mailbox-indication.patch |   60 +
 ...-packet-filtering-in-promiscuous-mod.patch |  133 +
 ...leanup-brcmf_cfg80211_escan-function.patch |  133 +
 ...cs_to_jiffies-instead-of-calculation.patch |   31 +
 ...rid-of-brcmf_cfg80211_escan-function.patch |   83 +
 ...-of-struct-brcmf_cfg80211_info-activ.patch |   86 +
 ...e-configuration-of-probe-request-IEs.patch |   55 +
 ...15-brcmfmac-add-CLM-download-support.patch |  434 ++++
 ...driver-unbind-order-of-the-sdio-func.patch |   37 +
 ...fmac-Avoid-build-error-with-make-W-1.patch |   33 +
 ...-load-error-for-legacy-chips-when-us.patch |   40 +
 ...ral-scan-support-under-a-separate-co.patch |  103 +
 ...tral-scan-support-under-a-separate-c.patch |   91 +
 ....16-ath9k-discard-undersized-packets.patch |   25 +
 ...ameter-order-in-brcmf_sdiod_f0_write.patch |   39 +
 ...r-sizes-on-hardware-are-not-dependen.patch |  105 +
 ...ac-Split-brcmf_sdiod_regrw_helper-up.patch |  179 ++
 ...ean-up-brcmf_sdiod_set_sbaddr_window.patch |   62 +
 ...16-0005-brcmfmac-Remove-dead-IO-code.patch |   91 +
 ...brcmfmac-Remove-bandaid-for-SleepCSR.patch |   61 +
 ...fmac-Remove-brcmf_sdiod_request_data.patch |  344 +++
 ...brcmfmac-Fix-asymmetric-IO-functions.patch |   28 +
 ...0009-brcmfmac-Remove-noisy-debugging.patch |   53 +
 ...0010-brcmfmac-Rename-bcmerror-to-err.patch |   58 +
 ...Split-brcmf_sdiod_buffrw-function-up.patch |  143 ++
 ...espace-fixes-in-brcmf_sdiod_send_buf.patch |   34 +
 ...003-brcmfmac-Clarify-if-using-braces.patch |   36 +
 ...replace-old-IO-functions-with-simple.patch |  831 ++++++
 ...c-Tidy-register-definitions-a-little.patch |   59 +
 ...brcmfmac-Remove-brcmf_sdiod_addrprep.patch |  190 ++
 ...unnecessary-call-to-brcmf_sdiod_set_.patch |   32 +
 ...v4.16-0008-brcmfmac-Cleanup-offsetof.patch |  134 +
 ...16-0009-brcmfmac-Remove-unused-macro.patch |   26 +
 ...repeated-calls-to-brcmf_chip_get_cor.patch |  128 +
 ...rge-buffer-size-of-caps-to-512-bytes.patch |   44 +
 ...16-0001-brcmfmac-Remove-r-w-_sdreg32.patch |  227 ++
 ...name-buscore-to-core-for-consistency.patch |   33 +
 ...se-the-value-of-sbwad-in-use-for-som.patch |   82 +
 ...rectly-handle-accesses-to-SDIO-func0.patch |   45 +
 ...mac-Remove-func0-from-function-array.patch |  111 +
 ...ficient-and-slightly-easier-to-read-.patch |   40 +
 ...-function-index-with-function-pointe.patch |  347 +++
 ...8-brcmfmac-Clean-up-interrupt-macros.patch |   53 +
 ...-43455-save-restore-SR-feature-if-FW.patch |   27 +
 ...1-brcmfmac-Remove-array-of-functions.patch | 1043 ++++++++
 ...ment-block-in-brcmf_sdio_buscore_rea.patch |   31 +
 ...brcmf_sdiod_buff_-read-write-functio.patch |  137 +
 ...oing-memory-allocator-than-allocator.patch |   59 +
 ...EEE80211_TX_STATUS_HEADROOM-up-to-mu.patch |   26 +
 ...ames-with-unexpected-DS-bits-from-fa.patch |   21 +
 ...80211-support-AP-4-addr-mode-fast-rx.patch |   25 +
 ...-fast-rx-with-incompatible-PS-capabi.patch |   53 +
 ...-support-station-4-addr-mode-fast-rx.patch |   34 +
 ...7-mac80211-support-A-MSDU-in-fast-rx.patch |  256 ++
 ...bcdc-dcmd-api-does-not-return-value-.patch |   68 +
 ...rate-firmware-errors-from-i-o-errors.patch |  186 ++
 ...possibility-to-obtain-firmware-error.patch |   92 +
 ...P_DEVICE-ethernet-address-generation.patch |   64 +
 ...ter-Access-Point-Protocol-packets-by.patch |  157 ++
 ...-brcmfmac-Fix-check-for-ISO3166-code.patch |   29 +
 ...cmf_bus_preinit-call-just-after-chan.patch |   45 +
 ...location-of-control-rx-buffer-to-brc.patch |   69 +
 ...cmf_attach-just-before-calling-brcmf.patch |  106 +
 ...l-brcmf_usb_up-during-brcmf_bus_prei.patch |   41 +
 ...move-brcmf_attach-function-in-core.c.patch |  130 +
 ...emove-brcmf_bus_started-from-bus-api.patch |  190 ++
 ...log-level-for-some-low-level-sdio-fu.patch |   64 +
 ...duplicate-pointer-variable-from-brcm.patch |  126 +
 ...17-0001-brcmfmac-reject-too-long-PSK.patch |   27 +
 ...convert-linux-error-to-firmware-erro.patch |   31 +
 ...mf_chip_name-to-store-name-in-revinf.patch |  203 ++
 ...-use-brcmf_chip_name-for-consistency.patch |   69 +
 ...e-struct-brcmf_pub-instance-using-wi.patch |  452 ++++
 ...brcmfmac-use-wiphy-debugfs-dir-entry.patch |  349 +++
 ...firmware-filenames-from-basename-map.patch |  286 +++
 ...ass-struct-in-brcmf_fw_get_firmwares.patch |  574 +++++
 ...duce-brcmf_fw_alloc_request-function.patch |  328 +++
 ...d-extension-to-.get_fwname-callbacks.patch |  231 ++
 ...get-rid-of-brcmf_fw_map_chip_to_name.patch |   92 +
 ...ac-get-rid-of-brcmf_fw_get_full_name.patch |   44 +
 ...erneldoc-for-struct-brcmf_bus-msgbuf.patch |   23 +
 ...mware-request-processing-if-nvram-lo.patch |   81 +
 ...mac-add-support-for-BCM4366E-chipset.patch |   48 +
 ...-check-p2pdev-mac-address-uniqueness.patch |   34 +
 ...orts-boottime_ns-while-informing-bss.patch |   76 +
 ...0211_band-directly-to-get-ieee80211-.patch |   43 +
 ...mac-constify-firmware-mapping-tables.patch |   76 +
 ...05-brcmfmac-add-hostready-indication.patch |   74 +
 ...support-for-PCIe-shared-structure-re.patch |   97 +
 ...upport-for-bcm43364-wireless-chipset.patch |   45 +
 ...fmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch |   34 +
 ...tialization-of-struct-cfg80211_infor.patch |   29 +
 ...ugfs-entry-for-reading-firmware-capa.patch |   75 +
 ...ALLFFMAC-variable-in-flowring-module.patch |   52 +
 ...support-for-sysfs-initiated-coredump.patch |   76 +
 ...e-user-provided-data-for-memdump-bef.patch |   32 +
 ...-memory-dump-upon-firmware-halt-sign.patch |   38 +
 ...-memory-dump-on-SDIO-firmware-halt-m.patch |   30 +
 ...tchdog-before-detach-and-free-everyt.patch |   70 +
 ...ression-in-parsing-NVRAM-for-multipl.patch |   41 +
 ...firmware-support-for-monitor-interfa.patch |   59 +
 ...firmware-support-for-radiotap-monito.patch |   51 +
 ...msgbuf-packets-marked-with-monitor-m.patch |  137 +
 ...more-bits-for-the-flags-of-struct-br.patch |   60 +
 ...mac-update-STA-info-struct-to-the-v5.patch |   75 +
 ...y-some-features-per-firmware-version.patch |   84 +
 ...cmfmac-add-CYW89342-mini-PCIe-device.patch |   25 +
 ...001-brcmfmac-fix-wrong-strnchr-usage.patch |   38 +
 ...r-proper-support-of-160MHz-bandwidth.patch |  117 +
 ...e-buffer-for-obtaining-firmware-capa.patch |   28 +
 ...set-but-not-used-variables-sfdoff-an.patch |   57 +
 ...reduce-timeout-for-action-frame-scan.patch |   67 +
 ...l-timeout-waiting-for-action-frame-o.patch |   79 +
 ...fix-decoding-channel-info-for-160-MH.patch |   41 +
 ...porting-support-for-160-MHz-channels.patch |   34 +
 ...w-reset-AHB-WMAC-interface-on-AR91xx.patch |    2 +-
 ..._hw-issue-external-reset-for-QCA955x.patch |    4 +-
 ...ctral-scan-enable-bit-on-trigger-for.patch |   21 +
 ...periodic-and-nf-calibation-at-the-sa.patch |   27 +
 ...h9k-force-rx_clear-when-disabling-rx.patch |    0
 ...ve-firmware-loading-code-duplication.patch |  102 +
 ...recursion-from-firmware-load-error-h.patch |  127 +
 ...port-for-first-trying-to-get-a-board.patch |   77 +
 ...rd_type-used-for-nvram-file-selectio.patch |   77 +
 ...rd_type-from-DMI-on-x86-based-machin.patch |  179 ++
 ...cmfmac-Cleanup-brcmf_fw_request_done.patch |   41 +
 ...erpret-requested-txpower-in-EIRP-dom.patch |    9 +-
 ...211-add-hdrlen-to-ieee80211_tx_data.patch} |   57 +-
 ...80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch |  233 ++
 ...l-Enable-STBC-and-LDPC-for-VHT-Rates.patch |   82 +
 ...ata-bit-in-PS-buffered-frame-release.patch |   50 +
 ...ntially-stale-EOSP-status-bit-in-int.patch |   22 +
 .../362-ath9k-report-tx-status-on-EOSP.patch  |   19 +
 ...fix-block-ack-window-tracking-issues.patch |  114 +
 ...fix-channel-maximum-power-level-test.patch |   47 +
 ...power-reduction-for-US-regulatory-do.patch |   12 +-
 ...ata-flag-for-buffered-multicast-pack.patch |   41 +
 ...sable-wake_tx_queue-for-older-device.patch |   27 +
 ...-fix-recent-bandwidth-conversion-bug.patch |   61 +
 ...e-only-1Mbps-for-basic-rates-in-mesh.patch |   55 +
 ...l-remove-unnecessary-debugfs-cleanup.patch |  150 ++
 ...l-merge-with-minstrel_ht-always-enab.patch |  576 +++++
 ...trel-reduce-minstrel_mcs_groups-size.patch |  368 +++
 ...l-fix-using-short-preamble-CCK-rates.patch |   31 +
 ...tect-queue-draining-by-rcu_read_lock.patch |   43 +
 ...rel-fix-CCK-rate-group-streams-value.patch |   20 +
 ...l-fix-sampling-reporting-of-CCK-rate.patch |   58 +
 ...l-do-not-sample-rates-3-times-slower.patch |   40 +
 ...ory-accounting-with-A-MSDU-aggregati.patch |   58 +
 ...ialize-sinfo-in-cfg80211_get_station.patch |   42 +
 ...elling-mistake-Retreiving-Retrieving.patch |   34 +
 ...print-invalid-chanspec-when-WARN-ing.patch |   83 +
 ...-brcmfmac-support-STA-info-struct-v7.patch |   78 +
 ...-of-bounds-memory-access-during-fw-l.patch |  110 +
 ...0005-brcmfmac-fix-roamoff-1-modparam.patch |   68 +
 ...-0006-brcmfmac-Fix-access-point-mode.patch |   41 +
 ...__brcmf_err-to-take-bus-as-a-paramet.patch |  104 +
 ...ass-bus-to-the-__brcmf_err-in-pcie.c.patch |  266 ++
 ...phy_err-and-use-it-in-the-cfg80211.c.patch | 2008 +++++++++++++++
 ...-monitor-frames-with-the-hardware-uc.patch |  143 ++
 ...firmware-reported-ring-status-errors.patch |   67 +
 ...-code-handling-bandwidth-of-firmware.patch |   42 +
 ...-firmware-reporting-160-MHz-channels.patch |   30 +
 ...bphy_err-to-take-struct-brcmf_pub-ar.patch | 2272 +++++++++++++++++
 ...e-bphy_err-in-all-wiphy-related-code.patch | 1704 +++++++++++++
 ...sic-validation-of-shared-RAM-address.patch |   38 +
 ...ize-of-the-struct-msgbuf_ring_status.patch |   29 +
 ...irmware-reported-general-status-erro.patch |   69 +
 ...-teardown-code-before-de-registering.patch |   38 +
 ...x-HWMP-sequence-numbering-to-follow-.patch |   28 +
 ...ernel-panic-when-building-AMSDU-from.patch |  102 +
 ..._update_ft_ies-to-validate-NL80211_A.patch |   27 +
 ...convert-to-A-MSDU-if-frag-subframe-l.patch |   37 +
 ...ys-account-for-A-MSDU-header-changes.patch |   51 +
 ...off-by-one-issue-in-A-MSDU-max_subfr.patch |   26 +
 ...ype-issue-in-ieee80211_chandef_to_op.patch |   33 +
 ...a-race-between-restart-and-CSA-flows.patch |   86 +
 ...tion-bandwidth-setting-after-channel.patch |   96 +
 ...x-a-deauth-frame-if-the-AP-forbade-T.patch |   78 +
 ...0211-shorten-the-IBSS-debug-messages.patch |   74 +
 ...e-TXQs-for-active-monitor-interfaces.patch |   26 +
 ...ting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch |   25 +
 ...-skb-fraglist-before-freeing-the-skb.patch |   31 +
 ...tx-status-for-PS-stations-in-ieee802.patch |   26 +
 ...d-stop-start-logic-for-software-TXQs.patch |  272 ++
 ...call-driver-wake_tx_queue-op-during-.patch |   33 +
 .../{ath => }/400-ath_move_debug_code.patch   |    4 +-
 .../{ath => }/401-ath9k_blink_default.patch   |    2 +-
 .../{ath => }/402-ath_regd_optional.patch     |    4 +-
 .../{ath => }/403-world_regd_fixup.patch      |    0
 .../patches/404-regd_no_assoc_hints.patch     |   19 +
 .../patches/{ath => }/405-ath_regd_us.patch   |   10 +-
 .../406-ath_relax_default_regd.patch          |    0
 .../410-ath9k_allow_adhoc_and_ap.patch        |    2 +-
 .../411-ath5k_allow_adhoc_and_ap.patch        |    6 +-
 .../{ath => }/420-ath5k_disable_fast_cc.patch |    0
 .../{ath => }/430-add_ath5k_platform.patch    |    0
 ...add_platform_eeprom_support_to_ath5k.patch |    0
 .../{ath => }/432-ath5k_add_pciids.patch      |    0
 .../440-ath5k_channel_bw_debugfs.patch        |   13 +-
 ...-repeated-brcmf_fw_alloc_request-cal.patch |   32 +
 ...unction-designated-for-handling-firm.patch |   79 +
 ...c-reset-PCIe-bus-on-a-firmware-crash.patch |  153 ++
 ...NING-during-USB-disconnect-in-case-o.patch |  124 +
 ...L-pointer-derefence-during-USB-disco.patch |  217 ++
 ...e-during-disconnect-when-USB-complet.patch |   84 +
 ...pending-parameter-from-brcmf_usb_fre.patch |   54 +
 ...unused-variable-i-from-brcmf_usb_fre.patch |   29 +
 ...s-when-bringing-up-interface-during-.patch |  123 +
 ...mfmac-fix-missing-checks-for-kmemdup.patch |   35 +
 ...g-the-correct-firmware-for-brcm43456.patch |   35 +
 ...x-leak-of-mypkt-on-error-return-path.patch |   41 +
 ...-nvram-filename-quirk-for-ACEPC-T8-a.patch |   70 +
 ...ilbox-interrupt-twice-for-specific-h.patch |   39 +
 ...ial-NULL-dereference-in-brcmf_cfg802.patch |   50 +
 ...low-request-id-from-1-to-pktids-arra.patch |   49 +
 ...irmware-messages-after-a-firmware-cr.patch |   90 +
 ...mfmac-use-strlcpy-instead-of-strcpy.patch} |    2 +-
 ...c-add-160MHz-in-chandef_to_chanspec.patch} |    4 +-
 ...ix-NULL-pointer-derefence-during-US.patch} |   16 +-
 ...the-order-of-things-in-brcmf_detach.patch} |    2 +-
 ...rmware-command-in-brcmf_netdev_open.patch} |    2 +-
 ...ents-in-brcmf_fweh_detach-will-alwa.patch} |    2 +-
 ...-firmware-commands-when-bus-is-down.patch} |    8 +-
 ...mply-remove-flowring-if-bus-is-down.patch} |    2 +-
 ...nnecessary-strlcpy-upon-obtaining-v.patch} |    2 +-
 ...t_ratelimit-CONSOLE-messages-on-fir.patch} |    2 +-
 .../{ath => }/500-ath9k_eeprom_debugfs.patch  |    4 +-
 .../{ath => }/501-ath9k_ahb_init.patch        |    4 +-
 .../510-ath9k_intr_mitigation_tweak.patch     |    2 +-
 .../{ath => }/511-ath9k_reduce_rxbuf.patch    |    0
 .../512-ath9k_channelbw_debugfs.patch         |    6 +-
 .../{ath => }/513-ath9k_add_pci_ids.patch     |    4 +-
 .../522-mac80211_configure_antenna_gain.patch |   42 +-
 .../{ath => }/530-ath9k_extra_leds.patch      |   16 +-
 .../531-ath9k_extra_platform_leds.patch       |    0
 .../540-ath9k_reduce_ani_interval.patch       |    0
 .../{ath => }/542-ath9k_debugfs_diag.patch    |   12 +-
 .../543-ath9k_entropy_from_adc.patch          |   12 +-
 ...544-ath9k-ar933x-usb-hang-workaround.patch |   10 +-
 .../{ath => }/545-ath9k_ani_ws_detect.patch   |    2 +-
 .../547-ath9k_led_defstate_fix.patch          |    0
 .../548-ath9k_enable_gpio_chip.patch          |    4 +-
 .../549-ath9k_enable_gpio_buttons.patch       |    2 +-
 .../550-ath9k-disable-bands-via-dt.patch      |    2 +-
 .../551-ath9k_ubnt_uap_plus_hsr.patch         |    6 +-
 ...-authentication-messages-for-late-ac.patch |   27 +
 ...ve-debug-log-after-buffer-increments.patch |   88 +
 ...ck-da-enabled-first-in-sampling-rout.patch |   33 +
 ...k-dynack-make-ewma-estimation-faster.patch |  139 +
 ...ath9k-dynack-remove-experimental-tag.patch |   22 +
 ...o-build-rt2800soc-module-for-RT3883.patch} |    4 +-
 ...-rt2800lib-enable-support-for-RT3883.patch |   20 +
 ...x00-rt2800lib-add-rf_vals-for-RF3853.patch |  112 +
 ...ib-enable-VCO-calibration-for-RF3853.patch |   28 +
 ...-add-channel-configuration-function-.patch |  235 ++
 ...2x00-rt2800lib-enable-RF3853-support.patch |   20 +
 ...-add-MAC-register-initialization-for.patch |   62 +
 ...-fix-rt2800soc_disable_radio-for-RT3.patch |   30 +
 ...-add-BBP-register-initialization-for.patch |   71 +
 ...-add-RFCSR-initialization-for-RT3883.patch |  178 ++
 ...-use-the-extended-EEPROM-map-for-RT3.patch |   22 +
 ...ib-force-rf-type-to-RF3853-on-RT3883.patch |   21 +
 ...-add-channel-configuration-code-for-.patch |  136 +
 ...-fix-txpower_to_dev-function-for-RT3.patch |   30 +
 ...-use-correct-txpower-calculation-fun.patch |   23 +
 ...-hardcode-txmixer-gain-values-to-zer.patch |   33 +
 ...b-use-correct-RT-XWI-size-for-RT3883.patch |   20 +
 ...-fix-antenna-configuration-for-RT388.patch |   22 +
 ...-fix-LNA-gain-configuration-for-RT38.patch |   32 +
 ...0-rt2800lib-fix-VGC-setup-for-RT3883.patch |   44 +
 ...-fix-EEPROM-LNA-validation-for-RT388.patch |   42 +
 ...-fix-txpower-compensation-for-RT3883.patch |   22 +
 ...o-add-a-workaround-for-spurious-TX_F.patch |  136 +
 ...1-rt2x00-introduce-rt2x00_platform_h.patch |    2 +-
 .../602-rt2x00-introduce-rt2x00eeprom.patch   |   35 +-
 .../603-rt2x00-of_load_eeprom_filename.patch  |    0
 ...om-on-SoC-from-a-mtd-device-defines-.patch |    7 +-
 ...isabling_bands_through_platform_data.patch |    4 +-
 ...07-rt2x00-add_platform_data_mac_addr.patch |    4 +-
 ...00-allow_disabling_bands_through_dts.patch |    2 +-
 ...c-loadable-via-OF-on-rt288x-305x-SoC.patch |    2 +-
 ...0-rt2x00-change-led-polarity-from-OF.patch |    6 +-
 .../611-rt2x00-add-AP+STA-support.patch       |    2 +-
 ...dd-support-for-external-PA-on-MT7620.patch |   61 +-
 .../651-rt2x00-remove-unneccesary-code.patch  |  132 +
 ...700-mwl8k-missing-pci-id-for-WNR854T.patch |    2 +-
 .../801-libertas-configure-sysfs-links.patch  |    4 +-
 .../802-libertas-set-wireless-macaddr.patch   |    2 +-
 .../810-b43-gpio-mask-module-option.patch     |    6 +-
 .../patches/{brcm => }/811-b43_no_pio.patch   |   12 +-
 .../812-b43-add-antenna-control.patch         |   20 +-
 .../813-b43-reduce-number-of-RX-slots.patch   |    2 +-
 .../814-b43-only-use-gpio-0-1-for-led.patch   |    2 +-
 ...815-b43-always-take-overlapping-devs.patch |    2 +-
 ...-remove-extra-regulation-restriction.patch |    0
 ...-register-wiphy-s-during-module_init.patch |   18 +-
 ...und-bug-with-some-inconsistent-BSSes.patch |    2 +-
 ...62-brcmfmac-Disable-power-management.patch |    2 +-
 ...-in-driver-tables-with-country-codes.patch |    4 +-
 ...e-internal-roaming-engine-by-default.patch |    4 +-
 ...-info-right-before-downloading-PCIe-.patch |    8 +-
 ...21-ath10k_init_devices_synchronously.patch |    4 +-
 .../930-ath10k_add_tpt_led_trigger.patch      |    6 +-
 .../936-ath10k-fix-otp-failure-result.patch   |   11 +
 ...940-mwl8k_init_devices_synchronously.patch |    4 +-
 ...-mwl8k-add-non-DFS-5G-upper-channels.patch |   37 +
 ...0-0010-ath10k-limit-htt-rx-ring-size.patch |   11 +
 ...60-0011-ath10k-limit-pci-buffer-size.patch |    8 +-
 ...d-reported-build-errors-with-CONFIG_PM-off |   93 +
 ..._sdio_reinit_device-out-of-CONFIG_PM.patch |   96 +
 ...-of-peer_bw_rxnss_override-parameter.patch |   96 +-
 ...dling-for-VHT160-in-recent-firmwares.patch |    9 +-
 ...rolling-support-for-various-chipsets.patch |   86 +-
 .../patches/ath/404-regd_no_assoc_hints.patch |   19 -
 .../mac80211/patches/ath/552-ahb_of.patch     |  330 ---
 ...0-0010-ath10k-limit-htt-rx-ring-size.patch |   11 -
 ...75-ath10k-use-tpt-trigger-by-default.patch |   53 -
 ...rect-multicast-broadcast-rate-settin.patch |   43 -
 ...980-ath10k-fix-max-antenna-gain-unit.patch |   49 -
 ...-power-reduction-for-US-regulatory-d.patch |  101 -
 ...source-files-to-using-SPDX-license-i.patch | 1223 ---------
 ...-brcmfmac-fix-typos-in-code-comments.patch |   24 -
 ...DFS_OFFLOAD-extended-feature-if-supp.patch |   63 -
 ...ow-160MHz-in-custom-regulatory-rules.patch |   34 -
 .../patches/build/060-no_local_ssb_bcma.patch |  335 ---
 ...-rt2x00-add-rf-self-txdc-calibration.patch |   89 -
 .../rt2x00/983-rt2x00-add-r-calibration.patch |  193 --
 .../984-rt2x00-add-rxdcoc-calibration.patch   |  102 -
 .../985-rt2x00-add-rxiq-calibration.patch     |  417 ---
 .../986-rt2x00-add-TX-LOFT-calibration.patch  | 1002 --------
 ...1-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch |  304 ---
 .../357-mac80211-optimize-skb-resizing.patch  |  202 --
 package/kernel/mac80211/ralink.mk             |  172 --
 package/kernel/mac80211/realtek.mk            |  170 --
 381 files changed, 30188 insertions(+), 6528 deletions(-)
 delete mode 100644 package/kernel/mac80211/ath.mk
 delete mode 100644 package/kernel/mac80211/broadcom.mk
 mode change 100755 => 100644 package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
 mode change 100755 => 100644 package/kernel/mac80211/files/lib/wifi/mac80211.sh
 mode change 100755 => 100644 package/kernel/mac80211/files/mac80211.hotplug
 delete mode 100644 package/kernel/mac80211/intel.mk
 delete mode 100644 package/kernel/mac80211/marvell.mk
 rename package/kernel/mac80211/patches/{build => }/000-fix_kconfig.patch (100%)
 rename package/kernel/mac80211/patches/{build => }/001-fix_build.patch (93%)
 rename package/kernel/mac80211/patches/{build => }/002-change_allconfig.patch (100%)
 rename package/kernel/mac80211/patches/{build => }/003-remove_bogus_modparams.patch (100%)
 rename package/kernel/mac80211/patches/{build => }/004-kconfig_backport_fix.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/005-revert-devcoredump.patch
 create mode 100644 package/kernel/mac80211/patches/006-fix-genl-multicast.patch
 create mode 100644 package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
 create mode 100644 package/kernel/mac80211/patches/008-fix-genl-family-id.patch
 create mode 100644 package/kernel/mac80211/patches/009-backport_sg_init_marker.patch
 rename package/kernel/mac80211/patches/{build => }/010-disable_rfkill.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/011-backport-overflow_h.patch
 rename package/kernel/mac80211/patches/{build => }/012-kernel_build_check.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch
 rename package/kernel/mac80211/patches/{build => }/015-ipw200-mtu.patch (86%)
 rename package/kernel/mac80211/patches/{rt2x00/100-rt2x00_options.patch => 030-rt2x00_options.patch} (95%)
 rename package/kernel/mac80211/patches/{brcm => }/040-brcmutil_option.patch (79%)
 rename package/kernel/mac80211/patches/{build => }/050-lib80211_option.patch (78%)
 create mode 100644 package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
 rename package/kernel/mac80211/patches/{ath => }/070-ath_common_config.patch (74%)
 rename package/kernel/mac80211/patches/{ath => }/080-ath10k_thermal_config.patch (74%)
 create mode 100644 package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
 create mode 100644 package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
 create mode 100644 package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
 rename package/kernel/mac80211/patches/{subsys => }/100-remove-cryptoapi-dependencies.patch (92%)
 rename package/kernel/mac80211/patches/{subsys => }/110-mac80211_keep_keys_on_stop_ap.patch (71%)
 rename package/kernel/mac80211/patches/{subsys => }/120-cfg80211_allow_perm_addr_change.patch (95%)
 rename package/kernel/mac80211/patches/{subsys => }/130-disable-fils.patch (86%)
 rename package/kernel/mac80211/patches/{subsys => }/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch (98%)
 rename package/kernel/mac80211/patches/{subsys => }/132-mac80211-remove-cmac-dependency.patch (88%)
 rename package/kernel/mac80211/patches/{subsys => }/140-tweak-TSQ-setting.patch (93%)
 rename package/kernel/mac80211/patches/{subsys => }/150-disable_addr_notifier.patch (80%)
 create mode 100644 package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
 rename package/kernel/mac80211/patches/{ath => }/201-ath5k-WAR-for-AR71xx-PCI-bug.patch (100%)
 rename package/kernel/mac80211/patches/{subsys => }/210-ap_scan.patch (83%)
 create mode 100644 package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
 create mode 100644 package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
 create mode 100644 package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
 create mode 100644 package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
 create mode 100644 package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
 create mode 100644 package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
 create mode 100644 package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
 create mode 100644 package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
 create mode 100644 package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
 create mode 100644 package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
 create mode 100644 package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
 create mode 100644 package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
 create mode 100644 package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
 create mode 100644 package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
 create mode 100644 package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
 create mode 100644 package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
 create mode 100644 package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
 create mode 100644 package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
 create mode 100644 package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
 create mode 100644 package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
 create mode 100644 package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
 create mode 100644 package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
 create mode 100644 package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
 create mode 100644 package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
 create mode 100644 package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
 create mode 100644 package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
 create mode 100644 package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
 create mode 100644 package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
 create mode 100644 package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
 create mode 100644 package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
 create mode 100644 package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
 create mode 100644 package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
 create mode 100644 package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
 create mode 100644 package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
 create mode 100644 package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
 create mode 100644 package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
 create mode 100644 package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
 create mode 100644 package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
 create mode 100644 package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
 create mode 100644 package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
 create mode 100644 package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
 create mode 100644 package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
 create mode 100644 package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
 create mode 100644 package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
 create mode 100644 package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
 create mode 100644 package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
 create mode 100644 package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
 create mode 100644 package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
 create mode 100644 package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
 create mode 100644 package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
 create mode 100644 package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
 create mode 100644 package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
 create mode 100644 package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
 create mode 100644 package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
 create mode 100644 package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
 create mode 100644 package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
 create mode 100644 package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
 create mode 100644 package/kernel/mac80211/patches/342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
 create mode 100644 package/kernel/mac80211/patches/344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch
 create mode 100644 package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
 create mode 100644 package/kernel/mac80211/patches/345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
 create mode 100644 package/kernel/mac80211/patches/346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch
 create mode 100644 package/kernel/mac80211/patches/347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch
 create mode 100644 package/kernel/mac80211/patches/347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
 create mode 100644 package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
 create mode 100644 package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch
 rename package/kernel/mac80211/patches/{ath => }/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch (89%)
 rename package/kernel/mac80211/patches/{ath => }/351-ath9k_hw-issue-external-reset-for-QCA955x.patch (95%)
 create mode 100644 package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
 create mode 100644 package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
 rename package/kernel/mac80211/patches/{ath => }/354-ath9k-force-rx_clear-when-disabling-rx.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
 create mode 100644 package/kernel/mac80211/patches/355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch
 create mode 100644 package/kernel/mac80211/patches/355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch
 create mode 100644 package/kernel/mac80211/patches/355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch
 create mode 100644 package/kernel/mac80211/patches/355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch
 create mode 100644 package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
 rename package/kernel/mac80211/patches/{ath => }/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch (82%)
 rename package/kernel/mac80211/patches/{subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch => 357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch} (78%)
 create mode 100644 package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
 create mode 100644 package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
 create mode 100644 package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
 create mode 100644 package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
 create mode 100644 package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
 create mode 100644 package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
 create mode 100644 package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
 rename package/kernel/mac80211/patches/{ath => }/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch (59%)
 create mode 100644 package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
 create mode 100644 package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
 create mode 100644 package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
 create mode 100644 package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
 create mode 100644 package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
 create mode 100644 package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
 create mode 100644 package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
 create mode 100644 package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
 create mode 100644 package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
 create mode 100644 package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
 create mode 100644 package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
 create mode 100644 package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
 create mode 100644 package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
 create mode 100644 package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
 create mode 100644 package/kernel/mac80211/patches/380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch
 create mode 100644 package/kernel/mac80211/patches/380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch
 create mode 100644 package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch
 create mode 100644 package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
 create mode 100644 package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch
 create mode 100644 package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch
 create mode 100644 package/kernel/mac80211/patches/381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch
 create mode 100644 package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
 create mode 100644 package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
 create mode 100644 package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
 create mode 100644 package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
 create mode 100644 package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
 create mode 100644 package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
 create mode 100644 package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
 create mode 100644 package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
 create mode 100644 package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
 create mode 100644 package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
 create mode 100644 package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
 create mode 100644 package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
 create mode 100644 package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
 create mode 100644 package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
 create mode 100644 package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
 create mode 100644 package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch
 create mode 100644 package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch
 create mode 100644 package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
 rename package/kernel/mac80211/patches/{ath => }/400-ath_move_debug_code.patch (88%)
 rename package/kernel/mac80211/patches/{ath => }/401-ath9k_blink_default.patch (88%)
 rename package/kernel/mac80211/patches/{ath => }/402-ath_regd_optional.patch (97%)
 rename package/kernel/mac80211/patches/{ath => }/403-world_regd_fixup.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
 rename package/kernel/mac80211/patches/{ath => }/405-ath_regd_us.patch (72%)
 rename package/kernel/mac80211/patches/{ath => }/406-ath_relax_default_regd.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/410-ath9k_allow_adhoc_and_ap.patch (83%)
 rename package/kernel/mac80211/patches/{ath => }/411-ath5k_allow_adhoc_and_ap.patch (89%)
 rename package/kernel/mac80211/patches/{ath => }/420-ath5k_disable_fast_cc.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/430-add_ath5k_platform.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/431-add_platform_eeprom_support_to_ath5k.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/432-ath5k_add_pciids.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/440-ath5k_channel_bw_debugfs.patch (92%)
 create mode 100644 package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
 create mode 100644 package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
 create mode 100644 package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
 create mode 100644 package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
 create mode 100644 package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
 create mode 100644 package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
 create mode 100644 package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
 create mode 100644 package/kernel/mac80211/patches/452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch
 create mode 100644 package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
 create mode 100644 package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
 create mode 100644 package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
 create mode 100644 package/kernel/mac80211/patches/456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
 create mode 100644 package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
 create mode 100644 package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
 create mode 100644 package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
 create mode 100644 package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
 create mode 100644 package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
 rename package/kernel/mac80211/patches/{brcm/102-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch => 467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch} (94%)
 rename package/kernel/mac80211/patches/{brcm/103-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch => 468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch} (93%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch => 469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch} (94%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch => 469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch} (97%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch => 469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch} (94%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch => 469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch} (95%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch => 469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch} (91%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch => 469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch} (95%)
 rename package/kernel/mac80211/patches/{brcm/104-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch => 469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch} (95%)
 rename package/kernel/mac80211/patches/{brcm/105-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch => 470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch} (96%)
 rename package/kernel/mac80211/patches/{ath => }/500-ath9k_eeprom_debugfs.patch (92%)
 rename package/kernel/mac80211/patches/{ath => }/501-ath9k_ahb_init.patch (86%)
 rename package/kernel/mac80211/patches/{ath => }/510-ath9k_intr_mitigation_tweak.patch (87%)
 rename package/kernel/mac80211/patches/{ath => }/511-ath9k_reduce_rxbuf.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/512-ath9k_channelbw_debugfs.patch (95%)
 rename package/kernel/mac80211/patches/{ath => }/513-ath9k_add_pci_ids.patch (87%)
 rename package/kernel/mac80211/patches/{subsys => }/522-mac80211_configure_antenna_gain.patch (79%)
 rename package/kernel/mac80211/patches/{ath => }/530-ath9k_extra_leds.patch (93%)
 rename package/kernel/mac80211/patches/{ath => }/531-ath9k_extra_platform_leds.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/540-ath9k_reduce_ani_interval.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/542-ath9k_debugfs_diag.patch (91%)
 rename package/kernel/mac80211/patches/{ath => }/543-ath9k_entropy_from_adc.patch (93%)
 rename package/kernel/mac80211/patches/{ath => }/544-ath9k-ar933x-usb-hang-workaround.patch (84%)
 rename package/kernel/mac80211/patches/{ath => }/545-ath9k_ani_ws_detect.patch (98%)
 rename package/kernel/mac80211/patches/{ath => }/547-ath9k_led_defstate_fix.patch (100%)
 rename package/kernel/mac80211/patches/{ath => }/548-ath9k_enable_gpio_chip.patch (98%)
 rename package/kernel/mac80211/patches/{ath => }/549-ath9k_enable_gpio_buttons.patch (98%)
 rename package/kernel/mac80211/patches/{ath => }/550-ath9k-disable-bands-via-dt.patch (88%)
 rename package/kernel/mac80211/patches/{ath => }/551-ath9k_ubnt_uap_plus_hsr.patch (98%)
 create mode 100644 package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch
 create mode 100644 package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch
 create mode 100644 package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch
 create mode 100644 package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch
 create mode 100644 package/kernel/mac80211/patches/556-ath9k-dynack-remove-experimental-tag.patch
 rename package/kernel/mac80211/patches/{rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch => 600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch} (93%)
 create mode 100644 package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
 create mode 100644 package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
 create mode 100644 package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
 create mode 100644 package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
 create mode 100644 package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
 create mode 100644 package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
 create mode 100644 package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
 create mode 100644 package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
 create mode 100644 package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
 create mode 100644 package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
 create mode 100644 package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
 create mode 100644 package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
 create mode 100644 package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
 create mode 100644 package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
 create mode 100644 package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
 create mode 100644 package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
 create mode 100644 package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
 create mode 100644 package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
 create mode 100644 package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
 create mode 100644 package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
 create mode 100644 package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
 create mode 100644 package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
 rename package/kernel/mac80211/patches/{rt2x00 => }/601-rt2x00-introduce-rt2x00_platform_h.patch (97%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/602-rt2x00-introduce-rt2x00eeprom.patch (89%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/603-rt2x00-of_load_eeprom_filename.patch (100%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch (95%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/606-rt2x00-allow_disabling_bands_through_platform_data.patch (92%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/607-rt2x00-add_platform_data_mac_addr.patch (89%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/608-rt2x00-allow_disabling_bands_through_dts.patch (91%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch (94%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/610-rt2x00-change-led-polarity-from-OF.patch (89%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/611-rt2x00-add-AP+STA-support.patch (86%)
 rename package/kernel/mac80211/patches/{rt2x00 => }/650-rt2x00-add-support-for-external-PA-on-MT7620.patch (58%)
 create mode 100644 package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
 rename package/kernel/mac80211/patches/{mwl => }/700-mwl8k-missing-pci-id-for-WNR854T.patch (87%)
 rename package/kernel/mac80211/patches/{mwl => }/801-libertas-configure-sysfs-links.patch (78%)
 rename package/kernel/mac80211/patches/{mwl => }/802-libertas-set-wireless-macaddr.patch (85%)
 rename package/kernel/mac80211/patches/{brcm => }/810-b43-gpio-mask-module-option.patch (88%)
 rename package/kernel/mac80211/patches/{brcm => }/811-b43_no_pio.patch (86%)
 rename package/kernel/mac80211/patches/{brcm => }/812-b43-add-antenna-control.patch (86%)
 rename package/kernel/mac80211/patches/{brcm => }/813-b43-reduce-number-of-RX-slots.patch (88%)
 rename package/kernel/mac80211/patches/{brcm => }/814-b43-only-use-gpio-0-1-for-led.patch (90%)
 rename package/kernel/mac80211/patches/{brcm => }/815-b43-always-take-overlapping-devs.patch (90%)
 rename package/kernel/mac80211/patches/{brcm => }/850-brcmsmac-remove-extra-regulation-restriction.patch (100%)
 rename package/kernel/mac80211/patches/{brcm => }/860-brcmfmac-register-wiphy-s-during-module_init.patch (83%)
 rename package/kernel/mac80211/patches/{brcm => }/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch (96%)
 rename package/kernel/mac80211/patches/{brcm => }/862-brcmfmac-Disable-power-management.patch (93%)
 rename package/kernel/mac80211/patches/{brcm => }/863-brcmfmac-add-in-driver-tables-with-country-codes.patch (95%)
 rename package/kernel/mac80211/patches/{brcm => }/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch (87%)
 rename package/kernel/mac80211/patches/{brcm => }/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch (91%)
 rename package/kernel/mac80211/patches/{ath => }/921-ath10k_init_devices_synchronously.patch (92%)
 rename package/kernel/mac80211/patches/{ath => }/930-ath10k_add_tpt_led_trigger.patch (84%)
 create mode 100644 package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
 rename package/kernel/mac80211/patches/{mwl => }/940-mwl8k_init_devices_synchronously.patch (75%)
 create mode 100644 package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
 create mode 100644 package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
 rename package/kernel/mac80211/patches/{ath => }/960-0011-ath10k-limit-pci-buffer-size.patch (75%)
 create mode 100644 package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
 create mode 100644 package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
 rename package/kernel/mac80211/patches/{ath => }/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch (55%)
 rename package/kernel/mac80211/patches/{ath => }/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch (88%)
 rename package/kernel/mac80211/patches/{ath => }/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch (90%)
 delete mode 100644 package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
 delete mode 100644 package/kernel/mac80211/patches/ath/552-ahb_of.patch
 delete mode 100644 package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
 delete mode 100644 package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
 delete mode 100644 package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
 delete mode 100644 package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch
 delete mode 100644 package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
 delete mode 100644 package/kernel/mac80211/patches/brcm/100-v5.4-0001-brcmfmac-switch-source-files-to-using-SPDX-license-i.patch
 delete mode 100644 package/kernel/mac80211/patches/brcm/101-v5.4-brcmfmac-fix-typos-in-code-comments.patch
 delete mode 100644 package/kernel/mac80211/patches/brcm/103-v5.4-0002-brcmfmac-enable-DFS_OFFLOAD-extended-feature-if-supp.patch
 delete mode 100644 package/kernel/mac80211/patches/brcm/103-v5.4-0003-brcmfmac-allow-160MHz-in-custom-regulatory-rules.patch
 delete mode 100644 package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
 delete mode 100644 package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
 delete mode 100644 package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
 delete mode 100644 package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
 delete mode 100644 package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
 delete mode 100644 package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
 delete mode 100644 package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch
 delete mode 100644 package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch
 delete mode 100644 package/kernel/mac80211/ralink.mk
 delete mode 100644 package/kernel/mac80211/realtek.mk

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 3ae39888e1..f091199864 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=5.2-rc7-1
-PKG_RELEASE:=1
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.2-rc7/
-PKG_HASH:=3179a4ec398bd6366a4fd8a44b311a57f8da87ad10720baf7c17aef9c8ec2983
+PKG_VERSION:=2017-11-01
+PKG_RELEASE:=10
+PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
+PKG_HASH:=8437ab7886b988c8152e7a4db30b7f41009e49a3b2cb863edd05da1ecd7eb05a
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@@ -24,23 +24,58 @@ PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_DRIVERS = \
 	adm8211 \
 	airo \
+	ath ath5k ath6kl ath6kl-sdio ath6kl-usb ath9k ath9k-common ath9k-htc ath10k \
+	b43 b43legacy \
+	carl9170 \
 	hermes hermes-pci hermes-pcmcia hermes-plx\
+	iwl-legacy iwl3945 iwl4965 iwlwifi \
 	lib80211 \
+	libipw ipw2100 ipw2200 \
+	libertas-sdio libertas-usb libertas-spi \
 	mac80211-hwsim \
 	mt7601u \
-	p54-common p54-pci p54-usb \
+	mwl8k mwifiex-pcie mwifiex-sdio \
+	p54-common p54-pci p54-spi p54-usb \
 	rsi91x rsi91x-usb rsi91x-sdio\
+	rt2x00-lib rt2x00-pci rt2x00-usb \
+	rt2400-pci rt2500-pci rt2500-usb \
+	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
+	rt61-pci rt73-usb \
+	rtl8180 rtl8187 \
+	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
+	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8821ae \
+	rtl8xxxu \
 	wlcore wl12xx wl18xx \
 	zd1211rw
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-mac80211 \
+	$(patsubst %,CONFIG_PACKAGE_kmod-%,$(PKG_DRIVERS)) \
 	CONFIG_PACKAGE_MAC80211_DEBUGFS \
 	CONFIG_PACKAGE_MAC80211_MESH \
 	CONFIG_PACKAGE_MAC80211_TRACING \
+	CONFIG_PACKAGE_ATH_DEBUG \
+	CONFIG_PACKAGE_ATH_DFS \
+	CONFIG_PACKAGE_ATH_SPECTRAL \
+	CONFIG_PACKAGE_ATH_DYNACK \
+	CONFIG_PACKAGE_B43_DEBUG \
+	CONFIG_PACKAGE_B43_PIO \
+	CONFIG_PACKAGE_B43_PHY_G \
+	CONFIG_PACKAGE_B43_PHY_N \
+	CONFIG_PACKAGE_B43_PHY_LP \
+	CONFIG_PACKAGE_B43_PHY_HT \
+	CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB \
+	CONFIG_PACKAGE_B43_BUSES_BCMA \
+	CONFIG_PACKAGE_B43_BUSES_SSB \
+	CONFIG_PACKAGE_BRCM80211_DEBUG \
 	CONFIG_PACKAGE_IWLWIFI_DEBUG \
 	CONFIG_PACKAGE_IWLWIFI_DEBUGFS \
+	CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS \
+	CONFIG_PACKAGE_RT2X00_DEBUG \
 	CONFIG_PACKAGE_RTLWIFI_DEBUG \
+	CONFIG_ATH9K_SUPPORT_PCOEM \
+	CONFIG_ATH9K_TX99 \
+	CONFIG_ATH_USER_REGD \
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -52,53 +87,10 @@ define KernelPackage/mac80211/Default
   MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 endef
 
-config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
-
-config-y:= \
-	WLAN \
-	NL80211_TESTMODE \
-	CFG80211_WEXT \
-	CFG80211_CERTIFICATION_ONUS \
-	MAC80211_RC_MINSTREL \
-	MAC80211_RC_MINSTREL_HT \
-	MAC80211_RC_MINSTREL_VHT \
-	MAC80211_RC_DEFAULT_MINSTREL \
-	WLAN_VENDOR_ADMTEK \
-	WLAN_VENDOR_ATH \
-	WLAN_VENDOR_ATMEL \
-	WLAN_VENDOR_BROADCOM \
-	WLAN_VENDOR_CISCO \
-	WLAN_VENDOR_INTEL \
-	WLAN_VENDOR_INTERSIL \
-	WLAN_VENDOR_MARVELL \
-	WLAN_VENDOR_MEDIATEK \
-	WLAN_VENDOR_RALINK \
-	WLAN_VENDOR_REALTEK \
-	WLAN_VENDOR_RSI \
-	WLAN_VENDOR_ST \
-	WLAN_VENDOR_TI \
-	WLAN_VENDOR_ZYDAS \
-
-config-$(call config_package,cfg80211) += CFG80211
-
-config-$(call config_package,mac80211) += MAC80211
-config-$(CONFIG_PACKAGE_MAC80211_MESH) += MAC80211_MESH
-
-include ath.mk
-include broadcom.mk
-include intel.mk
-include marvell.mk
-include ralink.mk
-include realtek.mk
-
-PKG_CONFIG_DEPENDS += \
-	$(patsubst %,CONFIG_PACKAGE_kmod-%,$(PKG_DRIVERS))
-
 define KernelPackage/cfg80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=cfg80211 - wireless configuration API
   DEPENDS+= +iw +wireless-regdb
-  ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   FILES:= \
 	$(PKG_BUILD_DIR)/compat/compat.ko \
 	$(PKG_BUILD_DIR)/net/wireless/cfg80211.ko
@@ -116,7 +108,6 @@ define KernelPackage/mac80211
   KCONFIG:=\
 	CONFIG_AVERAGE=y
   FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.ko
-  ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   MENU:=1
 endef
 
@@ -171,6 +162,645 @@ define KernelPackage/airo/description
  Kernel support for Cisco Aironet cards
 endef
 
+define KernelPackage/ath/config
+  if PACKAGE_kmod-ath
+	config ATH_USER_REGD
+		bool "Force Atheros drivers to respect the user's regdomain settings"
+		default y
+		help
+		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
+		  the regulatory limits and the user is only allowed to restrict the settings
+		  even further, even if the country allows frequencies or power levels that
+		  are forbidden by the EEPROM settings.
+
+		  Select this option if you want the driver to respect the user's decision about
+		  regulatory settings.
+
+	config PACKAGE_ATH_DEBUG
+		bool "Atheros wireless debugging"
+		help
+		  Say Y, if you want to debug atheros wireless drivers.
+		  Only ath9k & ath10k make use of this.
+
+	config PACKAGE_ATH_DFS
+		bool "Enable DFS support"
+		default y
+		help
+		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
+		  channels in Europe, US, and Japan.
+
+		  Select this option if you want to use such channels.
+
+	config PACKAGE_ATH_SPECTRAL
+		bool "Atheros spectral scan support"
+		depends on PACKAGE_ATH_DEBUG
+		select KERNEL_RELAY
+		help
+		  Say Y to enable access to the FFT/spectral data via debugfs.
+
+	config PACKAGE_ATH_DYNACK
+		bool "Enable Dynack support"
+		depends on PACKAGE_kmod-ath9k-common
+		help
+		  Enables support for Dynamic ACK estimation, which allows the fastest possible speed
+		  at any distance automatically by increasing/decreasing the max frame ACK time for
+		  the most remote station detected.  It can be enabled by using iw (iw phy0 set distance auto),
+		  or by sending the NL80211_ATTR_WIPHY_DYN_ACK flag to mac80211 driver using netlink.
+
+		  Select this option if you want to enable this feature
+
+  endif
+endef
+
+define KernelPackage/ath
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros common driver part
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath25 +kmod-mac80211
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
+  MENU:=1
+endef
+
+define KernelPackage/ath/description
+ This module contains some common parts needed by Atheros Wireless drivers.
+endef
+
+define KernelPackage/ath5k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 5xxx wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
+  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath +@DRIVER_11W_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
+  AUTOLOAD:=$(call AutoProbe,ath5k)
+endef
+
+define KernelPackage/ath5k/description
+ This module adds support for wireless adapters based on
+ Atheros 5xxx chipset.
+endef
+
+define KernelPackage/ath6kl
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros FullMAC wireless devices (common code for ath6kl_sdio and ath6kl_usb)
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
+  HIDDEN:=1
+  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_core.ko
+endef
+
+define KernelPackage/ath6kl-sdio
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n SDIO wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
+  DEPENDS+= +kmod-mmc +kmod-ath6kl
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,ath6kl_sdio)
+endef
+
+define KernelPackage/ath6kl-sdio/description
+This module adds support for wireless adapters based on
+Atheros IEEE 802.11n AR6003 and AR6004 family of chipsets.
+endef
+
+define KernelPackage/ath6kl-usb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n USB wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-ath6kl
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_usb.ko
+  AUTOLOAD:=$(call AutoProbe,ath6kl_usb)
+endef
+
+define KernelPackage/ath6kl-usb/description
+This module adds support for wireless adapters based on the
+Atheros IEEE 802.11n AR6004 chipset.
+endef
+
+define KernelPackage/ath9k-common
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
+  HIDDEN:=1
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
+endef
+
+define KernelPackage/ath9k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n PCI wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
+  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx +kmod-ath9k-common
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
+  AUTOLOAD:=$(call AutoProbe,ath9k)
+endef
+
+define KernelPackage/ath9k/description
+This module adds support for wireless adapters based on
+Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
+endef
+
+define KernelPackage/ath9k/config
+
+	config ATH9K_SUPPORT_PCOEM
+		bool "Support chips used in PC OEM cards"
+		depends on PACKAGE_kmod-ath9k
+
+       config ATH9K_TX99
+               bool "Enable TX99 support (WARNING: testing only, breaks normal operation!)"
+               depends on PACKAGE_kmod-ath9k
+
+	config ATH9K_UBNTHSR
+		bool "Support for Ubiquiti UniFi Outdoor+ access point"
+		depends on PACKAGE_kmod-ath9k && TARGET_ar71xx_generic
+		default y
+
+endef
+
+define KernelPackage/ath9k-htc
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n USB device support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
+  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core +ath9k-htc-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
+  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
+endef
+
+define KernelPackage/ath9k-htc/description
+This module adds support for wireless adapters based on
+Atheros USB AR9271 and AR7010 family of chipsets.
+endef
+
+define KernelPackage/ath10k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11ac wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
+  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
+  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
+endef
+
+define KernelPackage/ath10k/description
+This module adds support for wireless adapters based on
+Atheros IEEE 802.11ac family of chipsets. For now only
+PCI is supported.
+endef
+
+#Broadcom firmware
+ifneq ($(CONFIG_B43_FW_6_30),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=6.30.163.46
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).wl_apsta.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
+  PKG_B43_FWV4_HASH:=a07c3b6b277833c7dbe61daa511f908cd66c5e2763eb7a0859abc36cd9335c2d
+else
+ifneq ($(CONFIG_B43_FW_5_10),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=5.10.56.27.3
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta/wl_prebuilt.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)_mipsel.tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+  PKG_B43_FWV4_HASH:=26a8c370f48fc129d0731cfd751c36cae1419b0bc8ca35781126744e60eae009
+else
+ifneq ($(CONFIG_B43_FW_4_178),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=4.178.10.4
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+  PKG_B43_FWV4_HASH:=32f6ad98facbb9045646fdc8b54bb03086d204153253f9c65d0234a5d90ae53f
+else
+ifneq ($(CONFIG_B43_FW_5_100_138),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=5.100.138
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
+  PKG_B43_FWV4_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
+else
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=4.150.10.5
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta_mimo.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+  PKG_B43_FWV4_HASH:=a9f4e276a4d8d3a1cd0f2eb87080ae89b77f0a7140f06d4e9e2135fc44fdd533
+endif
+endif
+endif
+endif
+ifneq ($(CONFIG_B43_OPENFIRMWARE),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=5.2
+  PKG_B43_FWV4_OBJECT:=openfwwf-$(PKG_B43_FWV4_VERSION)
+  PKG_B43_FWV4_SOURCE:=openfwwf-$(PKG_B43_FWV4_VERSION).tar.gz
+  PKG_B43_FWV4_SOURCE_URL:=http://netweb.ing.unibs.it/~openfwwf/firmware
+  PKG_B43_FWV4_HASH:=9de03320083201080b2e94b81637ac07a159cf4e6f3481383e1a217e627bc0dc
+endif
+
+
+define Download/b43
+  FILE:=$(PKG_B43_FWV4_SOURCE)
+  URL:=$(PKG_B43_FWV4_SOURCE_URL)
+  HASH:=$(PKG_B43_FWV4_HASH)
+endef
+$(eval $(call Download,b43))
+
+define KernelPackage/b43
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom 43xx wireless support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
+  KCONFIG:= \
+  	CONFIG_HW_RANDOM=y
+  # Depend on PCI_SUPPORT to make sure we can select kmod-bcma or kmod-ssb
+  DEPENDS += \
+	@PCI_SUPPORT +kmod-mac80211 \
+	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
+	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43/b43.ko
+  AUTOLOAD:=$(call AutoProbe,b43)
+  MENU:=1
+endef
+
+define KernelPackage/b43/config
+
+config PACKAGE_B43_USE_SSB
+	select PACKAGE_kmod-ssb
+	tristate
+	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
+
+config PACKAGE_B43_USE_BCMA
+	select PACKAGE_kmod-bcma
+	tristate
+	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
+
+  if PACKAGE_kmod-b43
+
+	choice
+		prompt "b43 firmware version"
+		default B43_FW_5_100_138
+		help
+		  This option allows you to select the version of the b43 firmware.
+
+	config B43_FW_4_150
+		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
+		help
+		  Old stable firmware for BCM43xx devices.
+
+		  If unsure, select this.
+
+	config B43_FW_4_178
+		bool "Firmware 478.104 from driver 4.178.10.4"
+		help
+		  Older firmware for BCM43xx devices.
+
+		  If unsure, select the "stable" firmware.
+
+	config B43_FW_5_10
+		bool "Firmware 508.1084 from driver 5.10.56.27"
+		help
+		  Older firmware for BCM43xx devices.
+
+		  If unsure, select the "stable" firmware.
+
+	config B43_FW_5_100_138
+		bool "Firmware 666.2 from driver 5.100.138 (stable)"
+		help
+		  The currently default firmware for BCM43xx devices.
+
+		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
+
+		  If unsure, select the this firmware.
+
+	config B43_FW_6_30
+		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
+		help
+		  Newer experimental firmware for BCM43xx devices.
+
+		  This firmware is mostly untested.
+
+		  If unsure, select the "stable" firmware.
+
+	config B43_OPENFIRMWARE
+		bool "Open FirmWare for WiFi networks"
+		help
+		  Opensource firmware for BCM43xx devices.
+
+		  Do _not_ select this, unless you know what you are doing.
+		  The Opensource firmware is not suitable for embedded devices, yet.
+		  It does not support QoS, which is bad for AccessPoints.
+		  It does not support hardware crypto acceleration, which is a showstopper
+		  for embedded devices with low CPU resources.
+
+		  If unsure, select the "stable" firmware.
+
+	endchoice
+
+	config B43_FW_SQUASH
+		bool "Remove unnecessary firmware files"
+		depends on !B43_OPENFIRMWARE
+		default y
+		help
+		  This options allows you to remove unnecessary b43 firmware files
+		  from the final rootfs image. This can reduce the rootfs size by
+		  up to 200k.
+
+		  If unsure, say Y.
+
+	config B43_FW_SQUASH_COREREVS
+		string "Core revisions to include"
+		depends on B43_FW_SQUASH
+		default "5,6,7,8,9,10,11,13,15" if TARGET_brcm47xx_legacy
+		default "16,28,29,30" if TARGET_brcm47xx_mips74k
+		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
+		help
+		  This is a comma seperated list of core revision numbers.
+
+		  Example (keep files for rev5 only):
+		    5
+
+		  Example (keep files for rev5 and rev11):
+		    5,11
+
+	config B43_FW_SQUASH_PHYTYPES
+		string "PHY types to include"
+		depends on B43_FW_SQUASH
+		default "G,N,LP" if TARGET_brcm47xx_legacy
+		default "N,HT" if TARGET_brcm47xx_mips74k
+		default "G,N,LP,HT"
+		help
+		  This is a comma seperated list of PHY types:
+		    A  => A-PHY
+		    AG => Dual A-PHY G-PHY
+		    G  => G-PHY
+		    LP => LP-PHY
+		    N  => N-PHY
+		    HT  => HT-PHY
+		    LCN  => LCN-PHY
+		    LCN40  => LCN40-PHY
+		    AC  => AC-PHY
+
+		  Example (keep files for G-PHY only):
+		    G
+
+		  Example (keep files for G-PHY and N-PHY):
+		    G,N
+
+	choice
+		prompt "Supported buses"
+		default PACKAGE_B43_BUSES_BCMA_AND_SSB
+		help
+		  This allows choosing buses that b43 should support.
+
+	config PACKAGE_B43_BUSES_BCMA_AND_SSB
+		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
+		bool "BCMA and SSB"
+
+	config PACKAGE_B43_BUSES_BCMA
+		depends on !TARGET_brcm47xx_legacy
+		bool "BCMA only"
+
+	config PACKAGE_B43_BUSES_SSB
+		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
+		bool "SSB only"
+
+	endchoice
+
+	config PACKAGE_B43_DEBUG
+		bool "Enable debug output and debugfs for b43"
+		default n
+		help
+		  Enable additional debug output and runtime sanity checks for b43
+		  and enables the debugfs interface.
+
+		  If unsure, say N.
+
+	config PACKAGE_B43_PIO
+		bool "Enable support for PIO transfer mode"
+		default n
+		help
+		  Enable support for using PIO instead of DMA. Unless you have DMA
+		  transfer problems you don't need this.
+
+		  If unsure, say N.
+
+	config PACKAGE_B43_PHY_G
+		bool "Enable support for G-PHYs"
+		default n if TARGET_brcm47xx_mips74k
+		default y
+		help
+		  Enable support for G-PHY. This includes support for the following devices:
+		  PCI: BCM4306, BCM4311, BCM4318
+		  SoC: BCM5352E, BCM4712
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_N
+		bool "Enable support for N-PHYs"
+		default y
+		help
+		  Enable support for N-PHY. This includes support for the following devices:
+		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
+		  SoC: BCM4716, BCM4717, BCM4718
+
+		  Currently only 11g speed is available.
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_LP
+		bool "Enable support for LP-PHYs"
+		default n if TARGET_brcm47xx_mips74k
+		default y
+		help
+		  Enable support for LP-PHY. This includes support for the following devices:
+		  PCI: BCM4312
+		  SoC: BCM5354
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_HT
+		bool "Enable support for HT-PHYs"
+		default n if TARGET_brcm47xx_legacy
+		default y
+		help
+		  Enable support for HT-PHY. This includes support for the following devices:
+		  PCI: BCM4331
+
+		  Currently only 11g speed is available.
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_LCN
+		bool "Enable support for LCN-PHYs"
+		depends on BROKEN
+		default n
+		help
+		  Currently broken.
+
+		  If unsure, say N.
+
+  endif
+endef
+
+define KernelPackage/b43/description
+Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
+endef
+
+define KernelPackage/b43legacy
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom 43xx-legacy wireless support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
+  KCONFIG:= \
+  	CONFIG_HW_RANDOM=y
+  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb +b43legacy-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
+  AUTOLOAD:=$(call AutoProbe,b43legacy)
+  MENU:=1
+endef
+
+define KernelPackage/b43legacy/description
+Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
+endef
+
+
+define KernelPackage/brcmutil
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom IEEE802.11n common driver parts
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmutil/brcmutil.ko
+  AUTOLOAD:=$(call AutoProbe,brcmutil)
+  MENU:=1
+endef
+
+define KernelPackage/brcmutil/description
+ This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
+endef
+
+define KernelPackage/brcmutil/config
+  if PACKAGE_kmod-brcmutil
+
+	config PACKAGE_BRCM80211_DEBUG
+		bool "Broadcom wireless driver debugging"
+		help
+		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
+
+  endif
+endef
+
+PKG_BRCMSMAC_FW_NAME:=broadcom-wl
+PKG_BRCMSMAC_FW_VERSION:=5.100.138
+PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
+PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
+PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
+PKG_BRCMSMAC_FW_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
+
+define Download/brcmsmac
+  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
+  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
+  HASH:=$(PKG_BRCMSMAC_FW_HASH)
+endef
+$(eval $(call Download,brcmsmac))
+
+define KernelPackage/brcmsmac
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
+  AUTOLOAD:=$(call AutoProbe,brcmsmac)
+  MENU:=1
+endef
+
+define KernelPackage/brcmsmac/description
+ Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
+endef
+
+define KernelPackage/brcmsmac/config
+  if PACKAGE_kmod-brcmsmac
+
+	config BRCMSMAC_USE_FW_FROM_WL
+		bool "Use firmware extracted from broadcom proprietary driver"
+		default y
+		help
+		  Instead of using the official brcmsmac firmware a firmware
+		  version 666.2 extracted from the proprietary Broadcom driver
+		  is used. This is needed to get core rev 17 used in bcm4716
+		  to work.
+
+		  If unsure, say Y.
+
+  endif
+endef
+
+
+define KernelPackage/brcmfmac
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +kmod-brcmutil \
+	+BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
+	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
+  AUTOLOAD:=$(call AutoProbe,brcmfmac)
+endef
+
+define KernelPackage/brcmfmac/description
+ Kernel module for Broadcom IEEE802.11n USB Wireless cards
+endef
+
+define KernelPackage/brcmfmac/config
+  if PACKAGE_kmod-brcmfmac
+
+	config BRCMFMAC_SDIO
+		bool "Enable SDIO bus interface support"
+		default y if TARGET_brcm2708
+		default y if TARGET_sunxi
+		default n
+		help
+		  Enable support for cards attached to an SDIO bus.
+		  Select this option only if you are sure that your
+		  board has a Broadcom wireless chip atacched to
+		  that bus.
+
+	config BRCMFMAC_USB
+		bool "Enable USB bus interface support"
+		depends on USB_SUPPORT
+		default y
+		help
+		  Supported USB connected chipsets:
+		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
+		  BCM43143, BCM43242, BCM43566, BCM43569
+
+	config BRCMFMAC_PCIE
+		bool "Enable PCIE bus interface support"
+		depends on PCI_SUPPORT
+		default y
+		help
+		  Supported PCIe connected chipsets:
+		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
+
+  endif
+endef
+
+
+define KernelPackage/carl9170
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Atheros AR9170 USB sticks
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
+  AUTOLOAD:=$(call AutoProbe,carl9170)
+endef
+
+
 define KernelPackage/hermes
   $(call KernelPackage/mac80211/Default)
   TITLE:=Hermes 802.11b chipset support
@@ -210,7 +840,7 @@ endef
 define KernelPackage/hermes-pcmcia
   $(call KernelPackage/mac80211/Default)
   TITLE:=Hermes based PCMCIA adaptors
-  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes +kmod-pcmcia-core
+  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes @BROKEN
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
   AUTOLOAD:=$(call AutoProbe,orinoco_cs)
 endef
@@ -220,6 +850,114 @@ define KernelPackage/hermes-pcmcia/description
 endef
 
 
+define KernelPackage/iwlwifi
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT @!LINUX_3_18
+  TITLE:=Intel AGN Wireless support
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/dvm/iwldvm.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/mvm/iwlmvm.ko
+  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm iwlmvm)
+  MENU:=1
+endef
+
+define KernelPackage/iwlwifi/description
+ iwlwifi kernel module for
+ Intel Wireless WiFi Link 6250AGN Adapter
+ Intel 6000 Series Wi-Fi Adapters (6200AGN and 6300AGN)
+ Intel WiFi Link 1000BGN
+ Intel Wireless WiFi 5150AGN
+ Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
+ Intel 6005 Series Wi-Fi Adapters
+ Intel 6030 Series Wi-Fi Adapters
+ Intel Wireless WiFi Link 6150BGN 2 Adapter
+ Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
+ Intel 2000 Series Wi-Fi Adapters
+ Intel 7260 Wi-Fi Adapter
+ Intel 3160 Wi-Fi Adapter
+ Intel 7265 Wi-Fi Adapter
+ Intel 8260 Wi-Fi Adapter
+ Intel 3165 Wi-Fi Adapter
+endef
+
+define KernelPackage/iwlwifi/config
+  if PACKAGE_kmod-iwlwifi
+
+	config PACKAGE_IWLWIFI_DEBUG
+		bool "Enable full debugging output in the iwlwifi driver"
+		default n
+		help
+		  This option will enable debug tracing output for the iwlwifi drivers
+
+		  This will result in the kernel module being ~100k larger.  You can
+		  control which debug output is sent to the kernel log by setting the
+		  value in
+
+			/sys/module/iwlwifi/parameters/debug
+
+		  This entry will only exist if this option is enabled.
+
+		  To set a value, simply echo an 8-byte hex value to the same file:
+
+			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
+
+		  You can find the list of debug mask values in:
+			  drivers/net/wireless/intel/iwlwifi/iwl-debug.h
+
+		  If this is your first time using this driver, you should say Y here
+		  as the debug information can assist others in helping you resolve
+		  any problems you may encounter.
+
+	config PACKAGE_IWLWIFI_DEBUGFS
+	        bool "iwlwifi debugfs support"
+		depends on PACKAGE_MAC80211_DEBUGFS
+		default n
+		help
+		  Enable creation of debugfs files for the iwlwifi drivers. This
+		  is a low-impact option that allows getting insight into the
+		  driver's state at runtime.
+
+  endif
+endef
+
+define KernelPackage/iwl-legacy
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
+  TITLE:=Intel legacy Wireless support
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
+  AUTOLOAD:=$(call AutoProbe,iwlegacy)
+endef
+
+define KernelPackage/iwl-legacy/description
+ iwl-legacy kernel module for legacy Intel wireless support
+endef
+
+define KernelPackage/iwl3945
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
+  TITLE:=Intel iwl3945 Wireless support
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
+  AUTOLOAD:=$(call AutoProbe,iwl3945)
+endef
+
+define KernelPackage/iwl3945/description
+ iwl3945 kernel module for Intel 3945 support
+endef
+
+define KernelPackage/iwl4965
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
+  TITLE:=Intel iwl4965 Wireless support
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
+  AUTOLOAD:=$(call AutoProbe,iwl4965)
+endef
+
+define KernelPackage/iwl4965/description
+ iwl4965 kernel module for Intel 4965 support
+endef
+
+
 define KernelPackage/lib80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=802.11 Networking stack
@@ -247,6 +985,109 @@ define KernelPackage/lib80211/description
 endef
 
 
+define KernelPackage/libipw
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=libipw for ipw2100 and ipw2200
+  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-crypto-ecb +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN @!LINUX_3_18
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
+  AUTOLOAD:=$(call AutoProbe,libipw)
+endef
+
+define KernelPackage/libipw/description
+ Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
+endef
+
+IPW2100_NAME:=ipw2100-fw
+IPW2100_VERSION:=1.3
+
+define Download/ipw2100
+  URL:= \
+	https://src.fedoraproject.org/repo/pkgs/ipw2100-firmware/ipw2100-fw-1.3.tgz/46aa75bcda1a00efa841f9707bbbd113/ \
+	https://archlinux.mirror.pkern.at/other/packages/ipw2100-fw/ \
+	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
+	http://firmware.openbsd.org/firmware-dist/
+  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
+  HASH:=e1107c455e48d324a616b47a622593bc8413dcce72026f72731c0b03dae3a7a2
+endef
+$(eval $(call Download,ipw2100))
+
+define KernelPackage/ipw2100
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Intel IPW2100 driver
+  DEPENDS:=@PCI_SUPPORT +kmod-libipw
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
+  AUTOLOAD:=$(call AutoProbe,ipw2100)
+endef
+
+define KernelPackage/ipw2100/description
+ Kernel support for Intel IPW2100
+ Includes:
+ - ipw2100
+endef
+
+IPW2200_NAME:=ipw2200-fw
+IPW2200_VERSION:=3.1
+
+define Download/ipw2200
+  URL:= \
+	https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-3.1.tgz/eaba788643c7cc7483dd67ace70f6e99/ \
+	https://archlinux.mirror.pkern.at/other/packages/ipw2200-fw/ \
+	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
+	http://firmware.openbsd.org/firmware-dist/
+  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
+  HASH:=c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd
+endef
+$(eval $(call Download,ipw2200))
+
+define KernelPackage/ipw2200
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Intel IPW2200 driver
+  DEPENDS:=@PCI_SUPPORT +kmod-libipw
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
+  AUTOLOAD:=$(call AutoProbe,ipw2200)
+endef
+
+define KernelPackage/ipw2200/description
+ Kernel support for Intel IPW2200
+ Includes:
+ - ipw2200
+endef
+
+
+define KernelPackage/libertas-usb
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware @!LINUX_3_18
+  TITLE:=Marvell 88W8015 Wireless Driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
+  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
+endef
+
+define KernelPackage/libertas-sdio
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware @!LINUX_3_18
+  TITLE:=Marvell 88W8686 Wireless Driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
+endef
+
+define KernelPackage/libertas-spi
+  $(call KernelPackage/mac80211/Default)
+  SUBMENU:=Wireless Drivers
+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-spi-firmware @!LINUX_3_18
+  KCONFIG := \
+	CONFIG_SPI=y \
+	CONFIG_SPI_MASTER=y
+  TITLE:=Marvell 88W8686 SPI Wireless Driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
+  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
+endef
+
 define KernelPackage/mac80211-hwsim
   $(call KernelPackage/mac80211/Default)
   TITLE:=mac80211 HW simulation device
@@ -259,11 +1100,56 @@ endef
 define KernelPackage/mt7601u
   $(call KernelPackage/mac80211/Default)
   TITLE:=MT7601U-based USB dongles Wireless Driver
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
   AUTOLOAD:=$(call AutoProbe,mt7601u)
 endef
 
+
+define KernelPackage/mwl8k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
+  AUTOLOAD:=$(call AutoProbe,mwl8k)
+endef
+
+define KernelPackage/mwl8k/description
+ Kernel modules for Marvell TOPDOG 802.11 Wireless cards
+endef
+
+
+define KernelPackage/mwifiex-pcie
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
+  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
+endef
+
+define KernelPackage/mwifiex-pcie/description
+ Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
+endef
+
+define KernelPackage/mwifiex-sdio
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
+  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,mwifiex_sdio)
+endef
+
+define KernelPackage/mwifiex-sdio/description
+ Kernel modules for Marvell 802.11n/802.11ac SDIO Wireless cards
+endef
+
 define KernelPackage/p54/Default
   $(call KernelPackage/mac80211/Default)
   TITLE:=Prism54 Drivers
@@ -275,7 +1161,7 @@ endef
 
 define KernelPackage/p54-common
   $(call KernelPackage/p54/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +kmod-lib-crc-ccitt +@DRIVER_11W_SUPPORT
+  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt
   TITLE+= (COMMON)
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54common.ko
 endef
@@ -296,6 +1182,14 @@ define KernelPackage/p54-usb
   AUTOLOAD:=$(call AutoProbe,p54usb)
 endef
 
+define KernelPackage/p54-spi
+  $(call KernelPackage/p54/Default)
+  TITLE+= (SPI)
+  DEPENDS+= @TARGET_omap24xx +kmod-p54-common +p54-spi-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54spi.ko
+  AUTOLOAD:=$(call AutoProbe,p54spi)
+endef
+
 define KernelPackage/rsi91x
   $(call KernelPackage/mac80211/Default)
   TITLE:=Redpine Signals Inc 91x WLAN driver support
@@ -320,6 +1214,297 @@ define KernelPackage/rsi91x-sdio
 endef
 
 
+
+define KernelPackage/rt2x00/Default
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Ralink Drivers for RT2x00 cards
+endef
+
+define KernelPackage/rt2x00-lib
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-lib-crc-itu-t
+  TITLE+= (LIB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00lib.ko
+  MENU:=1
+endef
+
+define KernelPackage/rt2x00-lib/config
+  if PACKAGE_kmod-rt2x00-lib
+
+	config PACKAGE_RT2X00_LIB_DEBUGFS
+		bool "Enable rt2x00 debugfs support"
+		depends on PACKAGE_MAC80211_DEBUGFS
+		help
+		  Enable creation of debugfs files for the rt2x00 drivers.
+		  These debugfs files support both reading and writing of the
+		  most important register types of the rt2x00 hardware.
+
+	config PACKAGE_RT2X00_DEBUG
+		bool "Enable rt2x00 debug output"
+		help
+		  Enable debugging output for all rt2x00 modules
+
+  endif
+endef
+
+define KernelPackage/rt2x00-mmio
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
+  HIDDEN:=1
+  TITLE+= (MMIO)
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko
+endef
+
+define KernelPackage/rt2x00-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
+  HIDDEN:=1
+  TITLE+= (PCI)
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
+endef
+
+define KernelPackage/rt2x00-usb
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
+  HIDDEN:=1
+  TITLE+= (USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
+endef
+
+define KernelPackage/rt2800-lib
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
+  HIDDEN:=1
+  TITLE+= (rt2800 LIB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
+endef
+
+define KernelPackage/rt2400-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
+  TITLE+= (RT2400 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2400pci)
+endef
+
+define KernelPackage/rt2500-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
+  TITLE+= (RT2500 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2500pci)
+endef
+
+define KernelPackage/rt2500-usb
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
+  TITLE+= (RT2500 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt2500usb)
+endef
+
+define KernelPackage/rt2800-mmio
+$(call KernelPackage/rt2x00/Default)
+  TITLE += (RT28xx/RT3xxx MMIO)
+  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
+  HIDDEN:=1
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800mmio.ko
+endef
+
+define KernelPackage/rt2800-soc
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
+  TITLE += (RT28xx/RT3xxx SoC)
+  FILES := \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00soc.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800soc.ko
+  AUTOLOAD:=$(call AutoProbe,rt2800soc)
+endef
+
+define KernelPackage/rt2800-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio +rt2800-pci-firmware
+  TITLE+= (RT2860 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2800pci)
+endef
+
+define KernelPackage/rt2800-usb
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt +rt2800-usb-firmware
+  TITLE+= (RT2870 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt2800usb)
+endef
+
+
+define KernelPackage/rt61-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +rt61-pci-firmware
+  TITLE+= (RT2x61 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt61pci)
+endef
+
+define KernelPackage/rt73-usb
+  $(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +rt73-usb-firmware
+  TITLE+= (RT73 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt73usb)
+endef
+
+
+define KernelPackage/rtl818x/Default
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek Drivers for RTL818x devices
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/rtl8187
+  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
+endef
+
+define KernelPackage/rtl8180
+  $(call KernelPackage/rtl818x/Default)
+  DEPENDS+= @PCI_SUPPORT
+  TITLE+= (RTL8180 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
+  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
+endef
+
+define KernelPackage/rtl8187
+$(call KernelPackage/rtl818x/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core
+  TITLE+= (RTL8187 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8187)
+endef
+
+define KernelPackage/rtlwifi/config
+	config PACKAGE_RTLWIFI_DEBUG
+		bool "Realtek wireless debugging"
+		depends on PACKAGE_kmod-rtlwifi
+		help
+		  Say Y, if you want to debug realtek wireless drivers.
+
+endef
+
+define KernelPackage/rtlwifi
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek common driver part
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtlwifi-pci
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek common driver part (PCI support)
+  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
+  AUTOLOAD:=$(call AutoProbe,rtl_pci)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtlwifi-btcoexist
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek BT coexist support
+  DEPENDS+= +kmod-rtlwifi
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/btcoexist/btcoexist.ko
+  AUTOLOAD:=$(call AutoProbe,btcoexist)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtlwifi-usb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek common driver part (USB support)
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
+  AUTOLOAD:=$(call AutoProbe,rtl_usb)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtl8192c-common
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
+  DEPENDS+= +kmod-rtlwifi
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtl8192ce
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192CE/RTL8188CE support
+  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common +rtl8192ce-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
+endef
+
+define KernelPackage/rtl8192se
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192SE/RTL8191SE support
+  DEPENDS+= +kmod-rtlwifi-pci +rtl8192se-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192se)
+endef
+
+define KernelPackage/rtl8192de
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192DE/RTL8188DE support
+  DEPENDS+= +kmod-rtlwifi-pci +rtl8192de-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192de)
+endef
+
+define KernelPackage/rtl8192cu
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192CU/RTL8188CU support
+  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common +rtl8192cu-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
+endef
+
+define KernelPackage/rtl8821ae
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8821AE support
+  DEPENDS+= +kmod-rtlwifi-btcoexist +kmod-rtlwifi-pci +rtl8821ae-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/rtl8821ae.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8821ae)
+endef
+
+define KernelPackage/rtl8xxxu
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=alternative Realtek RTL8XXXU support
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8xxxu)
+endef
+
+define KernelPackage/rtl8xxxu/description
+  This is an alternative driver for various Realtek RTL8XXX
+  parts written to utilize the Linux mac80211 stack.
+  The driver is known to work with a number of RTL8723AU,
+  RL8188CU, RTL8188RU, RTL8191CU, and RTL8192CU devices
+
+  This driver is under development and has a limited feature
+  set. In particular it does not yet support 40MHz channels
+  and power management. However it should have a smaller
+  memory footprint than the vendor drivers and benetifs
+  from the in kernel mac80211 stack.
+
+  It can coexist with drivers from drivers/staging/rtl8723au,
+  drivers/staging/rtl8192u, and drivers/net/wireless/rtlwifi,
+  but you will need to control which module you wish to load.
+
+  RTL8XXXU_UNTESTED is enabled
+  This option enables detection of Realtek 8723/8188/8191/8192 WiFi
+  USB devices which have not been tested directly by the driver
+  author or reported to be working by third parties.
+
+  Please report your results!
+endef
+
+
 define KernelPackage/wlcore
   $(call KernelPackage/mac80211/Default)
   TITLE:=TI common driver part
@@ -373,19 +1558,63 @@ $(eval $(call Download,zd1211rw))
 define KernelPackage/zd1211rw
   $(call KernelPackage/mac80211/Default)
   TITLE:=Zydas ZD1211 support
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211 +@DRIVER_11W_SUPPORT
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zydas/zd1211rw/zd1211rw.ko
   AUTOLOAD:=$(call AutoProbe,zd1211rw)
 endef
 
+
+
+config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
+
+config-y:= \
+	WLAN \
+	NL80211_TESTMODE \
+	CFG80211_WEXT \
+	CFG80211_CERTIFICATION_ONUS \
+	MAC80211_RC_MINSTREL \
+	MAC80211_RC_MINSTREL_HT \
+	MAC80211_RC_MINSTREL_VHT \
+	MAC80211_RC_DEFAULT_MINSTREL \
+	WLAN_VENDOR_ADMTEK \
+	WLAN_VENDOR_ATH \
+	WLAN_VENDOR_ATMEL \
+	WLAN_VENDOR_BROADCOM \
+	WLAN_VENDOR_CISCO \
+	WLAN_VENDOR_INTEL \
+	WLAN_VENDOR_INTERSIL \
+	WLAN_VENDOR_MARVELL \
+	WLAN_VENDOR_MEDIATEK \
+	WLAN_VENDOR_RALINK \
+	WLAN_VENDOR_REALTEK \
+	WLAN_VENDOR_RSI \
+	WLAN_VENDOR_ST \
+	WLAN_VENDOR_TI \
+	WLAN_VENDOR_ZYDAS \
+
+config-$(call config_package,cfg80211) += CFG80211
+
+config-$(call config_package,mac80211) += MAC80211
+config-$(CONFIG_PACKAGE_MAC80211_MESH) += MAC80211_MESH
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
 	CFG80211_DEBUGFS \
-	MAC80211_DEBUGFS
+	MAC80211_DEBUGFS \
+	ATH9K_DEBUGFS \
+	ATH9K_HTC_DEBUGFS \
+	ATH10K_DEBUGFS \
+	CARL9170_DEBUGFS \
+	ATH5K_DEBUG \
+	ATH6KL_DEBUG
 endif
 
 ifdef CONFIG_PACKAGE_MAC80211_TRACING
   config-y += \
+	ATH10K_TRACING \
+	ATH6KL_TRACING \
+	ATH_TRACEPOINTS \
+	WIL6210_TRACING \
+	ATH5K_TRACER \
 	IWLWIFI_DEVICE_TRACING
 endif
 
@@ -393,13 +1622,100 @@ config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_C
 
 config-$(call config_package,airo) += AIRO
 
+config-$(call config_package,ath) += ATH_CARDS ATH_COMMON ATH_REG_DYNAMIC_USER_REG_HINTS
+config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
+config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
+config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
+config-$(CONFIG_PACKAGE_ATH_DYNACK) += ATH9K_DYNACK
+config-$(call config_package,ath9k) += ATH9K
+config-$(call config_package,ath9k-common) += ATH9K_COMMON
+config-$(CONFIG_TARGET_ar71xx) += ATH9K_AHB
+config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
+config-$(CONFIG_PCI) += ATH9K_PCI
+config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
+config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
+config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
+config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
+
+config-$(call config_package,ath9k-htc) += ATH9K_HTC
+config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
+
+config-$(call config_package,ath5k) += ATH5K
+ifdef CONFIG_TARGET_ath25
+  config-y += ATH5K_AHB
+else
+  config-y += ATH5K_PCI
+endif
+
+config-$(call config_package,ath6kl) += ATH6KL
+config-$(call config_package,ath6kl-sdio) += ATH6KL_SDIO
+config-$(call config_package,ath6kl-usb) += ATH6KL_USB
+
+config-$(call config_package,carl9170) += CARL9170
+
+config-$(call config_package,b43) += B43
+config-$(CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB) += B43_BUSES_BCMA_AND_SSB
+config-$(CONFIG_PACKAGE_B43_BUSES_BCMA) += B43_BUSES_BCMA
+config-$(CONFIG_PACKAGE_B43_BUSES_SSB) += B43_BUSES_SSB
+config-$(CONFIG_PACKAGE_B43_PHY_G) += B43_PHY_G
+config-$(CONFIG_PACKAGE_B43_PHY_N) += B43_PHY_N
+config-$(CONFIG_PACKAGE_B43_PHY_LP) += B43_PHY_LP
+config-$(CONFIG_PACKAGE_B43_PHY_HT) += B43_PHY_HT
+config-$(CONFIG_PACKAGE_B43_PIO) += B43_PIO
+config-$(CONFIG_PACKAGE_B43_DEBUG) += B43_DEBUG
+
+config-$(call config_package,b43legacy) += B43LEGACY
+config-y += B43LEGACY_DMA_MODE
+
+config-$(call config_package,brcmutil) += BRCMUTIL
+config-$(call config_package,brcmsmac) += BRCMSMAC
+config-$(call config_package,brcmfmac) += BRCMFMAC
+config-$(CONFIG_BRCMFMAC_SDIO) += BRCMFMAC_SDIO
+config-$(CONFIG_BRCMFMAC_USB) += BRCMFMAC_USB
+config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
+config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
+
 config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
 config-$(call config_package,mt7601u) += MT7601U
 config-y += WL_MEDIATEK
 
+config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
+config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
+config-$(call config_package,rt2x00-mmio) += RT2X00_LIB_MMIO
+config-$(call config_package,rt2x00-usb) += RT2X00_LIB_USB
+config-$(CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS) += RT2X00_LIB_DEBUGFS
+config-$(CONFIG_PACKAGE_RT2X00_DEBUG) += RT2X00_DEBUG
+
+config-$(call config_package,rt2400-pci) += RT2400PCI
+config-$(call config_package,rt2500-pci) += RT2500PCI
+config-$(call config_package,rt2500-usb) += RT2500USB
+config-$(call config_package,rt61-pci) += RT61PCI
+config-$(call config_package,rt73-usb) += RT73USB
+
+config-$(call config_package,rt2800-lib) += RT2800_LIB
+
+config-$(call config_package,rt2800-soc) += RT2800SOC
+config-$(call config_package,rt2800-pci) += RT2800PCI
+config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
+
+config-$(call config_package,rt2800-usb) += RT2800USB
+config-y += RT2800USB_RT33XX RT2800USB_RT35XX RT2800USB_RT3573 RT2800USB_RT53XX RT2800USB_RT55XX RT2800USB_UNKNOWN
+
+config-$(call config_package,iwl-legacy) += IWLEGACY
+config-$(call config_package,iwl3945) += IWL3945
+config-$(call config_package,iwl4965) += IWL4965
+config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
+config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
+config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
+
+config-$(call config_package,libipw) += LIBIPW
+config-$(call config_package,ipw2100) += IPW2100
+config-$(call config_package,ipw2200) += IPW2200
+
 config-$(call config_package,p54-common) += P54_COMMON
 config-$(call config_package,p54-pci) += P54_PCI
 config-$(call config_package,p54-usb) += P54_USB
+config-$(call config_package,p54-spi) += P54_SPI
 
 config-$(call config_package,hermes) += HERMES
 config-$(call config_package,hermes-pci) += PCI_HERMES
@@ -408,6 +1724,14 @@ config-$(call config_package,hermes-pcmcia) += PCMCIA_HERMES
 config-y += HERMES_PRISM
 
 config-$(call config_package,adm8211) += ADM8211
+config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
+config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
+config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
+config-$(call config_package,mwl8k) += MWL8K
+config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
+config-$(call config_package,mwifiex-sdio) += MWIFIEX MWIFIEX_SDIO
+config-$(call config_package,rtl8180) += RTL8180
+config-$(call config_package,rtl8187) += RTL8187
 config-$(call config_package,wlcore) += WLCORE WLCORE_SDIO
 config-$(call config_package,wl12xx) += WL12XX
 config-$(call config_package,wl18xx) += WL18XX
@@ -417,7 +1741,22 @@ config-$(call config_package,rsi91x) += RSI_91X
 config-$(call config_package,rsi91x-usb) += RSI_USB
 config-$(call config_package,rsi91x-sdio) += RSI_SDIO
 
-config-$(CONFIG_LEDS_TRIGGERS) += MAC80211_LEDS
+config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
+config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
+config-$(call config_package,rtlwifi-btcoexist) += RTLBTCOEXIST
+config-$(call config_package,rtlwifi-usb) += RTLWIFI_USB
+config-$(call config_package,rtl8192c-common) += RTL8192C_COMMON
+config-$(call config_package,rtl8192ce) += RTL8192CE
+config-$(call config_package,rtl8192se) += RTL8192SE
+config-$(call config_package,rtl8192de) += RTL8192DE
+config-$(call config_package,rtl8192cu) += RTL8192CU
+config-$(call config_package,rtl8821ae) += RTL8821AE
+config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
+
+config-$(call config_package,rtl8xxxu) += RTL8XXXU
+config-y += RTL8XXXU_UNTESTED
+
+config-$(CONFIG_LEDS_TRIGGERS) += MAC80211_LEDS B43_LEDS B43LEGACY_LEDS
 
 MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
 	$(KERNEL_MAKE_FLAGS) \
@@ -481,26 +1820,6 @@ ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
   endif
 endif
 
-define Build/Patch
-	$(if $(QUILT),rm -rf $(PKG_BUILD_DIR)/patches; mkdir -p $(PKG_BUILD_DIR)/patches)
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
-	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
-endef
-
-define Quilt/Refresh/Package
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
-endef
-
 define Build/Compile
 	$(SH_FUNC) var2file "$(call shvar,mac80211_config)" $(PKG_BUILD_DIR)/.config
 	$(MAKE) $(MAKE_OPTS) allnoconfig
@@ -543,6 +1862,14 @@ ifneq ($(CONFIG_B43_FW_SQUASH),)
 endif
 endef
 
+define KernelPackage/brcmsmac/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+ifeq ($(CONFIG_BRCMSMAC_USE_FW_FROM_WL),y)
+	tar xjf "$(DL_DIR)/$(PKG_BRCMSMAC_FW_SOURCE)" -C "$(PKG_BUILD_DIR)"
+	b43-fwcutter --brcmsmac -w $(1)/lib/firmware/ $(PKG_BUILD_DIR)/$(PKG_BRCMSMAC_FW_OBJECT)
+endif
+endef
+
 define KernelPackage/cfg80211/install
 	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
 	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
@@ -551,11 +1878,96 @@ define KernelPackage/cfg80211/install
 	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/10-wifi-detect
 endef
 
+define KernelPackage/ipw2100/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
+endef
+
+define KernelPackage/ipw2200/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
+endef
+
 define KernelPackage/zd1211rw/install
 	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
 endef
 
-$(eval $(foreach drv,$(PKG_DRIVERS),$(call KernelPackage,$(drv))))
+
+$(eval $(call KernelPackage,adm8211))
+$(eval $(call KernelPackage,airo))
+$(eval $(call KernelPackage,ath))
+$(eval $(call KernelPackage,ath10k))
+$(eval $(call KernelPackage,ath5k))
+$(eval $(call KernelPackage,ath6kl))
+$(eval $(call KernelPackage,ath6kl-sdio))
+$(eval $(call KernelPackage,ath6kl-usb))
+$(eval $(call KernelPackage,ath9k))
+$(eval $(call KernelPackage,ath9k-common))
+$(eval $(call KernelPackage,ath9k-htc))
+$(eval $(call KernelPackage,b43))
+$(eval $(call KernelPackage,b43legacy))
+$(eval $(call KernelPackage,brcmsmac))
+$(eval $(call KernelPackage,brcmfmac))
+$(eval $(call KernelPackage,brcmutil))
+$(eval $(call KernelPackage,carl9170))
 $(eval $(call KernelPackage,cfg80211))
+$(eval $(call KernelPackage,hermes))
+$(eval $(call KernelPackage,hermes-pci))
+$(eval $(call KernelPackage,hermes-plx))
+$(eval $(call KernelPackage,hermes-pcmcia))
+$(eval $(call KernelPackage,iwlwifi))
+$(eval $(call KernelPackage,iwl-legacy))
+$(eval $(call KernelPackage,iwl4965))
+$(eval $(call KernelPackage,iwl3945))
+$(eval $(call KernelPackage,lib80211))
+$(eval $(call KernelPackage,libertas-usb))
+$(eval $(call KernelPackage,libertas-sdio))
+$(eval $(call KernelPackage,libertas-spi))
+$(eval $(call KernelPackage,libipw))
+$(eval $(call KernelPackage,ipw2100))
+$(eval $(call KernelPackage,ipw2200))
 $(eval $(call KernelPackage,mac80211))
+$(eval $(call KernelPackage,mac80211-hwsim))
+$(eval $(call KernelPackage,mt7601u))
+$(eval $(call KernelPackage,mwl8k))
+$(eval $(call KernelPackage,mwifiex-pcie))
+$(eval $(call KernelPackage,mwifiex-sdio))
+$(eval $(call KernelPackage,p54-common))
+$(eval $(call KernelPackage,p54-pci))
+$(eval $(call KernelPackage,p54-usb))
+$(eval $(call KernelPackage,p54-spi))
+$(eval $(call KernelPackage,rsi91x))
+$(eval $(call KernelPackage,rsi91x-usb))
+$(eval $(call KernelPackage,rsi91x-sdio))
+$(eval $(call KernelPackage,rt2x00-lib))
+$(eval $(call KernelPackage,rt2x00-mmio))
+$(eval $(call KernelPackage,rt2x00-pci))
+$(eval $(call KernelPackage,rt2x00-usb))
+$(eval $(call KernelPackage,rt2800-lib))
+$(eval $(call KernelPackage,rt2400-pci))
+$(eval $(call KernelPackage,rt2500-pci))
+$(eval $(call KernelPackage,rt2500-usb))
+$(eval $(call KernelPackage,rt2800-mmio))
+$(eval $(call KernelPackage,rt2800-soc))
+$(eval $(call KernelPackage,rt2800-pci))
+$(eval $(call KernelPackage,rt2800-usb))
+$(eval $(call KernelPackage,rt61-pci))
+$(eval $(call KernelPackage,rt73-usb))
+$(eval $(call KernelPackage,rtl8180))
+$(eval $(call KernelPackage,rtl8187))
+$(eval $(call KernelPackage,rtlwifi))
+$(eval $(call KernelPackage,rtlwifi-pci))
+$(eval $(call KernelPackage,rtlwifi-btcoexist))
+$(eval $(call KernelPackage,rtlwifi-usb))
+$(eval $(call KernelPackage,rtl8192c-common))
+$(eval $(call KernelPackage,rtl8192ce))
+$(eval $(call KernelPackage,rtl8192se))
+$(eval $(call KernelPackage,rtl8192de))
+$(eval $(call KernelPackage,rtl8192cu))
+$(eval $(call KernelPackage,rtl8821ae))
+$(eval $(call KernelPackage,rtl8xxxu))
+$(eval $(call KernelPackage,wlcore))
+$(eval $(call KernelPackage,wl12xx))
+$(eval $(call KernelPackage,wl18xx))
+$(eval $(call KernelPackage,zd1211rw))
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
deleted file mode 100644
index 64aac41b4d..0000000000
--- a/package/kernel/mac80211/ath.mk
+++ /dev/null
@@ -1,276 +0,0 @@
-PKG_DRIVERS += \
-	ath ath5k ath6kl ath6kl-sdio ath6kl-usb ath9k ath9k-common ath9k-htc ath10k \
-	carl9170
-
-PKG_CONFIG_DEPENDS += \
-	CONFIG_PACKAGE_ATH_DEBUG \
-	CONFIG_PACKAGE_ATH_DFS \
-	CONFIG_PACKAGE_ATH_SPECTRAL \
-	CONFIG_PACKAGE_ATH_DYNACK \
-	CONFIG_ATH9K_SUPPORT_PCOEM \
-	CONFIG_ATH9K_TX99 \
-	CONFIG_ATH10K_LEDS \
-	CONFIG_ATH10K_THERMAL \
-	CONFIG_ATH_USER_REGD
-
-ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
-  config-y += \
-	ATH9K_DEBUGFS \
-	ATH9K_HTC_DEBUGFS \
-	ATH10K_DEBUGFS \
-	CARL9170_DEBUGFS \
-	ATH5K_DEBUG \
-	ATH6KL_DEBUG
-endif
-
-ifdef CONFIG_PACKAGE_MAC80211_TRACING
-  config-y += \
-	ATH10K_TRACING \
-	ATH6KL_TRACING \
-	ATH_TRACEPOINTS \
-	ATH5K_TRACER
-endif
-
-config-$(call config_package,ath) += ATH_CARDS ATH_COMMON ATH_REG_DYNAMIC_USER_REG_HINTS
-config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
-config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
-config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
-config-$(CONFIG_PACKAGE_ATH_DYNACK) += ATH9K_DYNACK
-config-$(call config_package,ath9k) += ATH9K
-config-$(call config_package,ath9k-common) += ATH9K_COMMON
-config-$(CONFIG_TARGET_ar71xx) += ATH9K_AHB
-config-$(CONFIG_TARGET_ath79) += ATH9K_AHB
-config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
-config-$(CONFIG_PCI) += ATH9K_PCI
-config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
-config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
-config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
-config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
-config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
-config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
-
-config-$(call config_package,ath9k-htc) += ATH9K_HTC
-config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
-
-config-$(call config_package,ath5k) += ATH5K
-ifdef CONFIG_TARGET_ath25
-  config-y += ATH5K_AHB
-else
-  config-y += ATH5K_PCI
-endif
-
-config-$(call config_package,ath6kl) += ATH6KL
-config-$(call config_package,ath6kl-sdio) += ATH6KL_SDIO
-config-$(call config_package,ath6kl-usb) += ATH6KL_USB
-
-config-$(call config_package,carl9170) += CARL9170
-
-define KernelPackage/ath/config
-  if PACKAGE_kmod-ath
-	config ATH_USER_REGD
-		bool "Force Atheros drivers to respect the user's regdomain settings"
-		default y
-		help
-		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
-		  the regulatory limits and the user is only allowed to restrict the settings
-		  even further, even if the country allows frequencies or power levels that
-		  are forbidden by the EEPROM settings.
-
-		  Select this option if you want the driver to respect the user's decision about
-		  regulatory settings.
-
-	config PACKAGE_ATH_DEBUG
-		bool "Atheros wireless debugging"
-		help
-		  Say Y, if you want to debug atheros wireless drivers.
-		  Only ath9k & ath10k make use of this.
-
-	config PACKAGE_ATH_DFS
-		bool "Enable DFS support"
-		default y
-		help
-		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
-		  channels in Europe, US, and Japan.
-
-		  Select this option if you want to use such channels.
-
-	config PACKAGE_ATH_SPECTRAL
-		bool "Atheros spectral scan support"
-		depends on PACKAGE_ATH_DEBUG
-		select KERNEL_RELAY
-		help
-		  Say Y to enable access to the FFT/spectral data via debugfs.
-
-	config PACKAGE_ATH_DYNACK
-		bool "Enable Dynack support"
-		depends on PACKAGE_kmod-ath9k-common
-		help
-		  Enables support for Dynamic ACK estimation, which allows the fastest possible speed
-		  at any distance automatically by increasing/decreasing the max frame ACK time for
-		  the most remote station detected.  It can be enabled by using iw (iw phy0 set distance auto),
-		  or by sending the NL80211_ATTR_WIPHY_DYN_ACK flag to mac80211 driver using netlink.
-
-		  Select this option if you want to enable this feature
-
-  endif
-endef
-
-define KernelPackage/ath
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros common driver part
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath79||TARGET_ath25 +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
-  MENU:=1
-endef
-
-define KernelPackage/ath/description
- This module contains some common parts needed by Atheros Wireless drivers.
-endef
-
-define KernelPackage/ath5k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 5xxx wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
-  DEPENDS+= @(PCI_SUPPORT||TARGET_ath25) +kmod-ath +@DRIVER_11W_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
-  AUTOLOAD:=$(call AutoProbe,ath5k)
-endef
-
-define KernelPackage/ath5k/description
- This module adds support for wireless adapters based on
- Atheros 5xxx chipset.
-endef
-
-define KernelPackage/ath6kl
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros FullMAC wireless devices (common code for ath6kl_sdio and ath6kl_usb)
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
-  HIDDEN:=1
-  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_core.ko
-endef
-
-define KernelPackage/ath6kl-sdio
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n SDIO wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
-  DEPENDS+= +kmod-mmc +kmod-ath6kl
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,ath6kl_sdio)
-endef
-
-define KernelPackage/ath6kl-sdio/description
-This module adds support for wireless adapters based on
-Atheros IEEE 802.11n AR6003 and AR6004 family of chipsets.
-endef
-
-define KernelPackage/ath6kl-usb
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n USB wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-ath6kl
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_usb.ko
-  AUTOLOAD:=$(call AutoProbe,ath6kl_usb)
-endef
-
-define KernelPackage/ath6kl-usb/description
-This module adds support for wireless adapters based on the
-Atheros IEEE 802.11n AR6004 chipset.
-endef
-
-define KernelPackage/ath9k-common
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-  HIDDEN:=1
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
-endef
-
-define KernelPackage/ath9k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n PCI wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx||TARGET_ath79 +kmod-ath9k-common
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
-  AUTOLOAD:=$(call AutoProbe,ath9k)
-endef
-
-define KernelPackage/ath9k/description
-This module adds support for wireless adapters based on
-Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
-endef
-
-define KernelPackage/ath9k/config
-
-	config ATH9K_SUPPORT_PCOEM
-		bool "Support chips used in PC OEM cards"
-		depends on PACKAGE_kmod-ath9k
-
-       config ATH9K_TX99
-               bool "Enable TX99 support (WARNING: testing only, breaks normal operation!)"
-               depends on PACKAGE_kmod-ath9k
-
-	config ATH9K_UBNTHSR
-		bool "Support for Ubiquiti UniFi Outdoor+ access point"
-		depends on PACKAGE_kmod-ath9k && (TARGET_ar71xx_generic||TARGET_ath79)
-		default y
-
-endef
-
-define KernelPackage/ath9k-htc
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n USB device support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core +ath9k-htc-firmware
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
-  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
-endef
-
-define KernelPackage/ath9k-htc/description
-This module adds support for wireless adapters based on
-Atheros USB AR9271 and AR7010 family of chipsets.
-endef
-
-define KernelPackage/ath10k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11ac wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
-  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT \
-	+ATH10K_THERMAL:kmod-hwmon-core +ATH10K_THERMAL:kmod-thermal
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
-  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
-endef
-
-define KernelPackage/ath10k/description
-This module adds support for wireless adapters based on
-Atheros IEEE 802.11ac family of chipsets. For now only
-PCI is supported.
-endef
-
-define KernelPackage/ath10k/config
-
-       config ATH10K_LEDS
-               bool "Enable LED support"
-               default y
-               depends on PACKAGE_kmod-ath10k
-
-       config ATH10K_THERMAL
-               bool "Enable thermal sensors and throttling support"
-               depends on PACKAGE_kmod-ath10k
-
-endef
-
-define KernelPackage/carl9170
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Atheros AR9170 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +carl9170-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
-  AUTOLOAD:=$(call AutoProbe,carl9170)
-endef
diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
deleted file mode 100644
index f55f38d55e..0000000000
--- a/package/kernel/mac80211/broadcom.mk
+++ /dev/null
@@ -1,487 +0,0 @@
-PKG_DRIVERS += \
-	b43 b43legacy brcmsmac brcmfmac brcmutil
-
-PKG_CONFIG_DEPENDS += \
-	CONFIG_PACKAGE_B43_DEBUG \
-	CONFIG_PACKAGE_B43_PIO \
-	CONFIG_PACKAGE_B43_PHY_G \
-	CONFIG_PACKAGE_B43_PHY_N \
-	CONFIG_PACKAGE_B43_PHY_LP \
-	CONFIG_PACKAGE_B43_PHY_HT \
-	CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB \
-	CONFIG_PACKAGE_B43_BUSES_BCMA \
-	CONFIG_PACKAGE_B43_BUSES_SSB \
-	CONFIG_PACKAGE_BRCM80211_DEBUG
-
-config-$(call config_package,b43) += B43
-config-$(CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB) += B43_BUSES_BCMA_AND_SSB
-config-$(CONFIG_PACKAGE_B43_BUSES_BCMA) += B43_BUSES_BCMA
-config-$(CONFIG_PACKAGE_B43_BUSES_SSB) += B43_BUSES_SSB
-config-$(CONFIG_PACKAGE_B43_PHY_G) += B43_PHY_G
-config-$(CONFIG_PACKAGE_B43_PHY_N) += B43_PHY_N
-config-$(CONFIG_PACKAGE_B43_PHY_LP) += B43_PHY_LP
-config-$(CONFIG_PACKAGE_B43_PHY_HT) += B43_PHY_HT
-config-$(CONFIG_PACKAGE_B43_PIO) += B43_PIO
-config-$(CONFIG_PACKAGE_B43_DEBUG) += B43_DEBUG
-
-config-$(call config_package,b43legacy) += B43LEGACY
-config-y += B43LEGACY_DMA_MODE
-
-config-$(call config_package,brcmutil) += BRCMUTIL
-config-$(call config_package,brcmsmac) += BRCMSMAC
-config-$(call config_package,brcmfmac) += BRCMFMAC
-config-$(CONFIG_BRCMFMAC_SDIO) += BRCMFMAC_SDIO
-config-$(CONFIG_BRCMFMAC_USB) += BRCMFMAC_USB
-config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
-config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
-
-config-$(CONFIG_LEDS_TRIGGERS) += B43_LEDS B43LEGACY_LEDS
-
-#Broadcom firmware
-ifneq ($(CONFIG_B43_FW_6_30),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=6.30.163.46
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).wl_apsta.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-  PKG_B43_FWV4_HASH:=a07c3b6b277833c7dbe61daa511f908cd66c5e2763eb7a0859abc36cd9335c2d
-else
-ifneq ($(CONFIG_B43_FW_5_10),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=5.10.56.27.3
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta/wl_prebuilt.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)_mipsel.tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-  PKG_B43_FWV4_HASH:=26a8c370f48fc129d0731cfd751c36cae1419b0bc8ca35781126744e60eae009
-else
-ifneq ($(CONFIG_B43_FW_4_178),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=4.178.10.4
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-  PKG_B43_FWV4_HASH:=32f6ad98facbb9045646fdc8b54bb03086d204153253f9c65d0234a5d90ae53f
-else
-ifneq ($(CONFIG_B43_FW_5_100_138),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=5.100.138
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-  PKG_B43_FWV4_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
-else
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=4.150.10.5
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta_mimo.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-  PKG_B43_FWV4_HASH:=a9f4e276a4d8d3a1cd0f2eb87080ae89b77f0a7140f06d4e9e2135fc44fdd533
-endif
-endif
-endif
-endif
-ifneq ($(CONFIG_B43_OPENFIRMWARE),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=5.2
-  PKG_B43_FWV4_OBJECT:=openfwwf-$(PKG_B43_FWV4_VERSION)
-  PKG_B43_FWV4_SOURCE:=openfwwf-$(PKG_B43_FWV4_VERSION).tar.gz
-  PKG_B43_FWV4_SOURCE_URL:=http://netweb.ing.unibs.it/~openfwwf/firmware
-  PKG_B43_FWV4_HASH:=9de03320083201080b2e94b81637ac07a159cf4e6f3481383e1a217e627bc0dc
-endif
-
-
-define Download/b43
-  FILE:=$(PKG_B43_FWV4_SOURCE)
-  URL:=$(PKG_B43_FWV4_SOURCE_URL)
-  HASH:=$(PKG_B43_FWV4_HASH)
-endef
-$(eval $(call Download,b43))
-
-define KernelPackage/b43
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom 43xx wireless support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-  KCONFIG:= \
-  	CONFIG_HW_RANDOM=y
-  # Depend on PCI_SUPPORT to make sure we can select kmod-bcma or kmod-ssb
-  DEPENDS += \
-	@PCI_SUPPORT +kmod-mac80211 +kmod-lib-cordic \
-	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
-	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43/b43.ko
-  AUTOLOAD:=$(call AutoProbe,b43)
-  MENU:=1
-endef
-
-define KernelPackage/b43/config
-
-config PACKAGE_B43_USE_SSB
-	select PACKAGE_kmod-ssb
-	tristate
-	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
-
-config PACKAGE_B43_USE_BCMA
-	select PACKAGE_kmod-bcma
-	tristate
-	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
-
-  if PACKAGE_kmod-b43
-
-	choice
-		prompt "b43 firmware version"
-		default B43_FW_5_100_138
-		help
-		  This option allows you to select the version of the b43 firmware.
-
-	config B43_FW_4_150
-		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
-		help
-		  Old stable firmware for BCM43xx devices.
-
-		  If unsure, select this.
-
-	config B43_FW_4_178
-		bool "Firmware 478.104 from driver 4.178.10.4"
-		help
-		  Older firmware for BCM43xx devices.
-
-		  If unsure, select the "stable" firmware.
-
-	config B43_FW_5_10
-		bool "Firmware 508.1084 from driver 5.10.56.27"
-		help
-		  Older firmware for BCM43xx devices.
-
-		  If unsure, select the "stable" firmware.
-
-	config B43_FW_5_100_138
-		bool "Firmware 666.2 from driver 5.100.138 (stable)"
-		help
-		  The currently default firmware for BCM43xx devices.
-
-		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
-
-		  If unsure, select the this firmware.
-
-	config B43_FW_6_30
-		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
-		help
-		  Newer experimental firmware for BCM43xx devices.
-
-		  This firmware is mostly untested.
-
-		  If unsure, select the "stable" firmware.
-
-	config B43_OPENFIRMWARE
-		bool "Open FirmWare for WiFi networks"
-		help
-		  Opensource firmware for BCM43xx devices.
-
-		  Do _not_ select this, unless you know what you are doing.
-		  The Opensource firmware is not suitable for embedded devices, yet.
-		  It does not support QoS, which is bad for AccessPoints.
-		  It does not support hardware crypto acceleration, which is a showstopper
-		  for embedded devices with low CPU resources.
-
-		  If unsure, select the "stable" firmware.
-
-	endchoice
-
-	config B43_FW_SQUASH
-		bool "Remove unnecessary firmware files"
-		depends on !B43_OPENFIRMWARE
-		default y
-		help
-		  This options allows you to remove unnecessary b43 firmware files
-		  from the final rootfs image. This can reduce the rootfs size by
-		  up to 200k.
-
-		  If unsure, say Y.
-
-	config B43_FW_SQUASH_COREREVS
-		string "Core revisions to include"
-		depends on B43_FW_SQUASH
-		default "5,6,7,8,9,10,11,13,15" if TARGET_brcm47xx_legacy
-		default "16,28,29,30" if TARGET_brcm47xx_mips74k
-		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
-		help
-		  This is a comma seperated list of core revision numbers.
-
-		  Example (keep files for rev5 only):
-		    5
-
-		  Example (keep files for rev5 and rev11):
-		    5,11
-
-	config B43_FW_SQUASH_PHYTYPES
-		string "PHY types to include"
-		depends on B43_FW_SQUASH
-		default "G,N,LP" if TARGET_brcm47xx_legacy
-		default "N,HT" if TARGET_brcm47xx_mips74k
-		default "G,N,LP,HT"
-		help
-		  This is a comma seperated list of PHY types:
-		    A  => A-PHY
-		    AG => Dual A-PHY G-PHY
-		    G  => G-PHY
-		    LP => LP-PHY
-		    N  => N-PHY
-		    HT  => HT-PHY
-		    LCN  => LCN-PHY
-		    LCN40  => LCN40-PHY
-		    AC  => AC-PHY
-
-		  Example (keep files for G-PHY only):
-		    G
-
-		  Example (keep files for G-PHY and N-PHY):
-		    G,N
-
-	choice
-		prompt "Supported buses"
-		default PACKAGE_B43_BUSES_BCMA_AND_SSB
-		help
-		  This allows choosing buses that b43 should support.
-
-	config PACKAGE_B43_BUSES_BCMA_AND_SSB
-		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
-		bool "BCMA and SSB"
-
-	config PACKAGE_B43_BUSES_BCMA
-		depends on !TARGET_brcm47xx_legacy
-		bool "BCMA only"
-
-	config PACKAGE_B43_BUSES_SSB
-		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
-		bool "SSB only"
-
-	endchoice
-
-	config PACKAGE_B43_DEBUG
-		bool "Enable debug output and debugfs for b43"
-		default n
-		help
-		  Enable additional debug output and runtime sanity checks for b43
-		  and enables the debugfs interface.
-
-		  If unsure, say N.
-
-	config PACKAGE_B43_PIO
-		bool "Enable support for PIO transfer mode"
-		default n
-		help
-		  Enable support for using PIO instead of DMA. Unless you have DMA
-		  transfer problems you don't need this.
-
-		  If unsure, say N.
-
-	config PACKAGE_B43_PHY_G
-		bool "Enable support for G-PHYs"
-		default n if TARGET_brcm47xx_mips74k
-		default y
-		help
-		  Enable support for G-PHY. This includes support for the following devices:
-		  PCI: BCM4306, BCM4311, BCM4318
-		  SoC: BCM5352E, BCM4712
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_N
-		bool "Enable support for N-PHYs"
-		default y
-		help
-		  Enable support for N-PHY. This includes support for the following devices:
-		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
-		  SoC: BCM4716, BCM4717, BCM4718
-
-		  Currently only 11g speed is available.
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_LP
-		bool "Enable support for LP-PHYs"
-		default n if TARGET_brcm47xx_mips74k
-		default y
-		help
-		  Enable support for LP-PHY. This includes support for the following devices:
-		  PCI: BCM4312
-		  SoC: BCM5354
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_HT
-		bool "Enable support for HT-PHYs"
-		default n if TARGET_brcm47xx_legacy
-		default y
-		help
-		  Enable support for HT-PHY. This includes support for the following devices:
-		  PCI: BCM4331
-
-		  Currently only 11g speed is available.
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_LCN
-		bool "Enable support for LCN-PHYs"
-		depends on BROKEN
-		default n
-		help
-		  Currently broken.
-
-		  If unsure, say N.
-
-  endif
-endef
-
-define KernelPackage/b43/description
-Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
-endef
-
-define KernelPackage/b43legacy
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom 43xx-legacy wireless support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-  KCONFIG:= \
-  	CONFIG_HW_RANDOM=y
-  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb @!TARGET_brcm47xx_mips74k +b43legacy-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
-  AUTOLOAD:=$(call AutoProbe,b43legacy)
-  MENU:=1
-endef
-
-define KernelPackage/b43legacy/description
-Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
-endef
-
-
-define KernelPackage/brcmutil
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom IEEE802.11n common driver parts
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmutil/brcmutil.ko
-  AUTOLOAD:=$(call AutoProbe,brcmutil)
-  MENU:=1
-endef
-
-define KernelPackage/brcmutil/description
- This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
-endef
-
-define KernelPackage/brcmutil/config
-  if PACKAGE_kmod-brcmutil
-
-	config PACKAGE_BRCM80211_DEBUG
-		bool "Broadcom wireless driver debugging"
-		help
-		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
-
-  endif
-endef
-
-PKG_BRCMSMAC_FW_NAME:=broadcom-wl
-PKG_BRCMSMAC_FW_VERSION:=5.100.138
-PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
-PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
-PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-PKG_BRCMSMAC_FW_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
-
-define Download/brcmsmac
-  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
-  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
-  HASH:=$(PKG_BRCMSMAC_FW_HASH)
-endef
-$(eval $(call Download,brcmsmac))
-
-define KernelPackage/brcmsmac
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
-  AUTOLOAD:=$(call AutoProbe,brcmsmac)
-  MENU:=1
-endef
-
-define KernelPackage/brcmsmac/description
- Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
-endef
-
-define KernelPackage/brcmsmac/config
-  if PACKAGE_kmod-brcmsmac
-
-	config BRCMSMAC_USE_FW_FROM_WL
-		bool "Use firmware extracted from broadcom proprietary driver"
-		default y
-		help
-		  Instead of using the official brcmsmac firmware a firmware
-		  version 666.2 extracted from the proprietary Broadcom driver
-		  is used. This is needed to get core rev 17 used in bcm4716
-		  to work.
-
-		  If unsure, say Y.
-
-  endif
-endef
-
-
-define KernelPackage/brcmfmac
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT \
-  	+kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
-	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
-  AUTOLOAD:=$(call AutoProbe,brcmfmac)
-endef
-
-define KernelPackage/brcmfmac/description
- Kernel module for Broadcom IEEE802.11n USB Wireless cards
-endef
-
-define KernelPackage/brcmfmac/config
-  if PACKAGE_kmod-brcmfmac
-
-	config BRCMFMAC_SDIO
-		bool "Enable SDIO bus interface support"
-		default y if TARGET_brcm2708
-		default y if TARGET_sunxi
-		default n
-		help
-		  Enable support for cards attached to an SDIO bus.
-		  Select this option only if you are sure that your
-		  board has a Broadcom wireless chip atacched to
-		  that bus.
-
-	config BRCMFMAC_USB
-		bool "Enable USB bus interface support"
-		depends on USB_SUPPORT
-		default y
-		help
-		  Supported USB connected chipsets:
-		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
-		  BCM43143, BCM43242, BCM43566, BCM43569
-
-	config BRCMFMAC_PCIE
-		bool "Enable PCIE bus interface support"
-		depends on PCI_SUPPORT
-		default y
-		help
-		  Supported PCIe connected chipsets:
-		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
-
-  endif
-endef
-
-define KernelPackage/brcmsmac/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-ifeq ($(CONFIG_BRCMSMAC_USE_FW_FROM_WL),y)
-	tar xjf "$(DL_DIR)/$(PKG_BRCMSMAC_FW_SOURCE)" -C "$(PKG_BUILD_DIR)"
-	b43-fwcutter --brcmsmac -w $(1)/lib/firmware/ $(PKG_BUILD_DIR)/$(PKG_BRCMSMAC_FW_OBJECT)
-endif
-endef
diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
old mode 100755
new mode 100644
index 6dc4e5bf5f..e7d442f8ef
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -23,7 +23,6 @@ drv_mac80211_init_device_config() {
 
 	config_add_string path phy 'macaddr:macaddr'
 	config_add_string hwmode
-	config_add_string tx_burst
 	config_add_int beacon_int chanbw frag rts
 	config_add_int rxantenna txantenna antenna_gain txpower distance
 	config_add_boolean noscan ht_coex
@@ -98,10 +97,7 @@ mac80211_hostapd_setup_base() {
 	[ "$auto_channel" -gt 0 ] && json_get_values channel_list channels
 
 	json_get_vars noscan ht_coex
-	json_get_values ht_capab_list ht_capab tx_burst
-
-	[ -n "$noscan" -a "$noscan" -gt 0 ] && hostapd_noscan=1
-	[ "$tx_burst" = 0 ] && tx_burst=
+	json_get_values ht_capab_list ht_capab
 
 	ieee80211n=1
 	ht_capab=
@@ -231,7 +227,6 @@ mac80211_hostapd_setup_base() {
 			vht_link_adapt:3 \
 			vht160:2
 
-		set_default tx_burst 2.0
 		append base_cfg "ieee80211ac=1" "$N"
 		vht_cap=0
 		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
@@ -312,8 +307,7 @@ mac80211_hostapd_setup_base() {
 	cat >> "$hostapd_conf_file" <<EOF
 ${channel:+channel=$channel}
 ${channel_list:+chanlist=$channel_list}
-${hostapd_noscan:+noscan=1}
-${tx_burst:+tx_queue_data2_burst=$tx_burst}
+${noscan:+noscan=$noscan}
 $base_cfg
 
 EOF
@@ -741,10 +735,6 @@ mac80211_interface_cleanup() {
 	done
 }
 
-mac80211_set_noscan() {
-	hostapd_noscan=1
-}
-
 drv_mac80211_cleanup() {
 	hostapd_common_cleanup
 }
@@ -791,14 +781,11 @@ drv_mac80211_setup() {
 		done
 	}
 
-	set_default rxantenna 0xffffffff
-	set_default txantenna 0xffffffff
+	set_default rxantenna all
+	set_default txantenna all
 	set_default distance 0
 	set_default antenna_gain 0
 
-	[ "$txantenna" = "all" ] && txantenna=0xffffffff
-	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
-
 	iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
 	iw phy "$phy" set antenna_gain $antenna_gain
 	iw phy "$phy" set distance "$distance"
@@ -808,12 +795,9 @@ drv_mac80211_setup() {
 
 	has_ap=
 	hostapd_ctrl=
-	hostapd_noscan=
 	for_each_interface "ap" mac80211_check_ap
 
 	rm -f "$hostapd_conf_file"
-
-	for_each_interface "sta adhoc mesh" mac80211_set_noscan
 	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
 
 	for_each_interface "sta adhoc mesh monitor" mac80211_prepare_vif
diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
old mode 100755
new mode 100644
diff --git a/package/kernel/mac80211/files/mac80211.hotplug b/package/kernel/mac80211/files/mac80211.hotplug
old mode 100755
new mode 100644
diff --git a/package/kernel/mac80211/intel.mk b/package/kernel/mac80211/intel.mk
deleted file mode 100644
index a8ae4ff7c7..0000000000
--- a/package/kernel/mac80211/intel.mk
+++ /dev/null
@@ -1,200 +0,0 @@
-PKG_DRIVERS += \
-	iwl-legacy iwl3945 iwl4965 iwlwifi \
-	libipw ipw2100 ipw2200 \
-
-config-$(call config_package,iwl-legacy) += IWLEGACY
-config-$(call config_package,iwl3945) += IWL3945
-config-$(call config_package,iwl4965) += IWL4965
-config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
-config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
-config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
-
-config-$(call config_package,libipw) += LIBIPW
-config-$(call config_package,ipw2100) += IPW2100
-config-$(call config_package,ipw2200) += IPW2200
-
-define KernelPackage/iwlwifi
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT
-  TITLE:=Intel AGN Wireless support
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/dvm/iwldvm.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/mvm/iwlmvm.ko
-  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm iwlmvm)
-  MENU:=1
-endef
-
-define KernelPackage/iwlwifi/description
- iwlwifi kernel module for
- Intel Wireless WiFi Link 6250AGN Adapter
- Intel 6000 Series Wi-Fi Adapters (6200AGN and 6300AGN)
- Intel WiFi Link 1000BGN
- Intel Wireless WiFi 5150AGN
- Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
- Intel 6005 Series Wi-Fi Adapters
- Intel 6030 Series Wi-Fi Adapters
- Intel Wireless WiFi Link 6150BGN 2 Adapter
- Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
- Intel 2000 Series Wi-Fi Adapters
- Intel 7260 Wi-Fi Adapter
- Intel 3160 Wi-Fi Adapter
- Intel 7265 Wi-Fi Adapter
- Intel 8260 Wi-Fi Adapter
- Intel 3165 Wi-Fi Adapter
-endef
-
-define KernelPackage/iwlwifi/config
-  if PACKAGE_kmod-iwlwifi
-
-	config PACKAGE_IWLWIFI_DEBUG
-		bool "Enable full debugging output in the iwlwifi driver"
-		default n
-		help
-		  This option will enable debug tracing output for the iwlwifi drivers
-
-		  This will result in the kernel module being ~100k larger.  You can
-		  control which debug output is sent to the kernel log by setting the
-		  value in
-
-			/sys/module/iwlwifi/parameters/debug
-
-		  This entry will only exist if this option is enabled.
-
-		  To set a value, simply echo an 8-byte hex value to the same file:
-
-			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
-
-		  You can find the list of debug mask values in:
-			  drivers/net/wireless/intel/iwlwifi/iwl-debug.h
-
-		  If this is your first time using this driver, you should say Y here
-		  as the debug information can assist others in helping you resolve
-		  any problems you may encounter.
-
-	config PACKAGE_IWLWIFI_DEBUGFS
-	        bool "iwlwifi debugfs support"
-		depends on PACKAGE_MAC80211_DEBUGFS
-		default n
-		help
-		  Enable creation of debugfs files for the iwlwifi drivers. This
-		  is a low-impact option that allows getting insight into the
-		  driver's state at runtime.
-
-  endif
-endef
-
-define KernelPackage/iwl-legacy
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
-  TITLE:=Intel legacy Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
-  AUTOLOAD:=$(call AutoProbe,iwlegacy)
-endef
-
-define KernelPackage/iwl-legacy/description
- iwl-legacy kernel module for legacy Intel wireless support
-endef
-
-define KernelPackage/iwl3945
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
-  TITLE:=Intel iwl3945 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
-  AUTOLOAD:=$(call AutoProbe,iwl3945)
-endef
-
-define KernelPackage/iwl3945/description
- iwl3945 kernel module for Intel 3945 support
-endef
-
-define KernelPackage/iwl4965
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
-  TITLE:=Intel iwl4965 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
-  AUTOLOAD:=$(call AutoProbe,iwl4965)
-endef
-
-define KernelPackage/iwl4965/description
- iwl4965 kernel module for Intel 4965 support
-endef
-
-
-define KernelPackage/libipw
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=libipw for ipw2100 and ipw2200
-  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-crypto-ecb +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
-  AUTOLOAD:=$(call AutoProbe,libipw)
-endef
-
-define KernelPackage/libipw/description
- Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-endef
-
-IPW2100_NAME:=ipw2100-fw
-IPW2100_VERSION:=1.3
-
-define Download/ipw2100
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2100-firmware/ipw2100-fw-1.3.tgz/46aa75bcda1a00efa841f9707bbbd113/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2100-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-  HASH:=e1107c455e48d324a616b47a622593bc8413dcce72026f72731c0b03dae3a7a2
-endef
-$(eval $(call Download,ipw2100))
-
-define KernelPackage/ipw2100
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2100 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2100)
-endef
-
-define KernelPackage/ipw2100/description
- Kernel support for Intel IPW2100
- Includes:
- - ipw2100
-endef
-
-IPW2200_NAME:=ipw2200-fw
-IPW2200_VERSION:=3.1
-
-define Download/ipw2200
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-3.1.tgz/eaba788643c7cc7483dd67ace70f6e99/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2200-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-  HASH:=c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd
-endef
-$(eval $(call Download,ipw2200))
-
-define KernelPackage/ipw2200
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2200 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2200)
-endef
-
-define KernelPackage/ipw2200/description
- Kernel support for Intel IPW2200
- Includes:
- - ipw2200
-endef
-
-define KernelPackage/ipw2100/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
-endef
-
-define KernelPackage/ipw2200/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
-endef
diff --git a/package/kernel/mac80211/marvell.mk b/package/kernel/mac80211/marvell.mk
deleted file mode 100644
index a0e67091e5..0000000000
--- a/package/kernel/mac80211/marvell.mk
+++ /dev/null
@@ -1,90 +0,0 @@
-PKG_DRIVERS += \
-	libertas-sdio libertas-usb libertas-spi \
-	mwl8k mwifiex-pcie mwifiex-sdio
-
-config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
-config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
-config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
-config-$(call config_package,mwl8k) += MWL8K
-config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
-config-$(call config_package,mwifiex-sdio) += MWIFIEX MWIFIEX_SDIO
-
-define KernelPackage/libertas-usb
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware
-  TITLE:=Marvell 88W8015 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
-  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
-endef
-
-define KernelPackage/libertas-sdio
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware
-  TITLE:=Marvell 88W8686 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
-endef
-
-define KernelPackage/libertas-spi
-  $(call KernelPackage/mac80211/Default)
-  SUBMENU:=Wireless Drivers
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-spi-firmware
-  KCONFIG := \
-	CONFIG_SPI=y \
-	CONFIG_SPI_MASTER=y
-  TITLE:=Marvell 88W8686 SPI Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
-endef
-
-
-define KernelPackage/mwl8k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
-  AUTOLOAD:=$(call AutoProbe,mwl8k)
-endef
-
-define KernelPackage/mwl8k/description
- Kernel modules for Marvell TOPDOG 802.11 Wireless cards
-endef
-
-
-define KernelPackage/mwifiex-pcie
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
-  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
-endef
-
-define KernelPackage/mwifiex-pcie/description
- Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
-endef
-
-define KernelPackage/mwifiex-sdio
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,mwifiex_sdio)
-endef
-
-define KernelPackage/mwifiex-sdio/description
- Kernel modules for Marvell 802.11n/802.11ac SDIO Wireless cards
-endef
-
diff --git a/package/kernel/mac80211/patches/build/000-fix_kconfig.patch b/package/kernel/mac80211/patches/000-fix_kconfig.patch
similarity index 100%
rename from package/kernel/mac80211/patches/build/000-fix_kconfig.patch
rename to package/kernel/mac80211/patches/000-fix_kconfig.patch
diff --git a/package/kernel/mac80211/patches/build/001-fix_build.patch b/package/kernel/mac80211/patches/001-fix_build.patch
similarity index 93%
rename from package/kernel/mac80211/patches/build/001-fix_build.patch
rename to package/kernel/mac80211/patches/001-fix_build.patch
index e57ca190e4..9e272e90af 100644
--- a/package/kernel/mac80211/patches/build/001-fix_build.patch
+++ b/package/kernel/mac80211/patches/001-fix_build.patch
@@ -27,7 +27,7 @@
  	@set -e ; test -f local-symbols || (						\
  	echo "/--------------"								;\
  	echo "| You shouldn't run make in the backports tree, but only in"		;\
-@@ -60,58 +62,62 @@ mrproper:
+@@ -60,57 +62,61 @@ mrproper:
  	echo "| (that isn't currently running.)"					;\
  	echo "\\--"									;\
  	false)
@@ -56,13 +56,12 @@
 -			done								\
 -		) > Kconfig.kernel							;\
 -		kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
--			sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
+-			sed 's/^\(\([3-4]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
 -		test "$$kver" != "" || echo "Kernel version parse failed!"		;\
 -		test "$$kver" != ""							;\
 -		kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
 -		kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')"				;\
--		kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')"				;\
--		kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')"				;\
+-		kvers="$$kvers $$(seq 0 99 | sed 's/^/4./')"				;\
 -		print=0									;\
 -		for v in $$kvers ; do							\
 -			if [ "$$print" = "1" ] ; then					\
@@ -113,13 +112,12 @@
 +
 +Kconfig.versions: Kconfig.kernel
 +	@kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
-+		sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
++		sed 's/^\(\([3-4]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
 +	test "$$kver" != "" || echo "Kernel version parse failed!"		;\
 +	test "$$kver" != ""							;\
 +	kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
 +	kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')"				;\
-+	kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')"				;\
-+	kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')"				;\
++	kvers="$$kvers $$(seq 0 99 | sed 's/^/4./')"				;\
 +	print=0									;\
 +	for v in $$kvers ; do							\
 +		if [ "$$print" = "1" ] ; then					\
diff --git a/package/kernel/mac80211/patches/build/002-change_allconfig.patch b/package/kernel/mac80211/patches/002-change_allconfig.patch
similarity index 100%
rename from package/kernel/mac80211/patches/build/002-change_allconfig.patch
rename to package/kernel/mac80211/patches/002-change_allconfig.patch
diff --git a/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch b/package/kernel/mac80211/patches/003-remove_bogus_modparams.patch
similarity index 100%
rename from package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
rename to package/kernel/mac80211/patches/003-remove_bogus_modparams.patch
diff --git a/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch b/package/kernel/mac80211/patches/004-kconfig_backport_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
rename to package/kernel/mac80211/patches/004-kconfig_backport_fix.patch
diff --git a/package/kernel/mac80211/patches/005-revert-devcoredump.patch b/package/kernel/mac80211/patches/005-revert-devcoredump.patch
new file mode 100644
index 0000000000..d485d95586
--- /dev/null
+++ b/package/kernel/mac80211/patches/005-revert-devcoredump.patch
@@ -0,0 +1,11 @@
+--- a/compat/Makefile
++++ b/compat/Makefile
+@@ -70,8 +70,6 @@ quiet_cmd_build_OID_registry = GEN     $
+ 	cmd_build_OID_registry = perl $(src)/build_OID_registry $< $@
+ compat-$(CPTCFG_BPAUTO_ASN1_DECODER) += lib-asn1_decoder.o
+ compat-$(CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION) += lib-oid_registry.o
+-skcipher-objs += crypto-skcipher.o
+-obj-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += skcipher.o
+ compat-$(CPTCFG_BPAUTO_RHASHTABLE) += lib-rhashtable.o
+ cordic-objs += lib-cordic.o
+ obj-$(CPTCFG_BPAUTO_BUILD_CORDIC) += cordic.o
diff --git a/package/kernel/mac80211/patches/006-fix-genl-multicast.patch b/package/kernel/mac80211/patches/006-fix-genl-multicast.patch
new file mode 100644
index 0000000000..42fd3e8271
--- /dev/null
+++ b/package/kernel/mac80211/patches/006-fix-genl-multicast.patch
@@ -0,0 +1,10 @@
+--- a/compat/backport-4.12.c
++++ b/compat/backport-4.12.c
+@@ -225,6 +225,7 @@ int bp_extack_genl_register_family(struc
+ 
+ 	/* copy this since the family might access it directly */
+ 	family->attrbuf = copy->family.attrbuf;
++	family->mcgrp_offset = copy->family.mcgrp_offset;
+ 
+ 	mutex_lock(&copies_mutex);
+ 	list_add_tail(&copy->list, &copies_list);
diff --git a/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch b/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
new file mode 100644
index 0000000000..4011f1d3ba
--- /dev/null
+++ b/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
@@ -0,0 +1,11 @@
+--- a/backport-include/linux/verification.h
++++ b/backport-include/linux/verification.h
+@@ -1,7 +1,7 @@
+ #ifndef __BP_VERIFICATION_H
+ #define __BP_VERIFICATION_H
+ #include <linux/version.h>
+-#ifndef CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION
++#if LINUX_VERSION_IS_GEQ(4,7,0) && !defined(CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION)
+ #include_next <linux/verification.h>
+ #else
+ #include <linux/key.h>
diff --git a/package/kernel/mac80211/patches/008-fix-genl-family-id.patch b/package/kernel/mac80211/patches/008-fix-genl-family-id.patch
new file mode 100644
index 0000000000..ee8fa6c2bc
--- /dev/null
+++ b/package/kernel/mac80211/patches/008-fix-genl-family-id.patch
@@ -0,0 +1,10 @@
+--- a/compat/backport-4.12.c
++++ b/compat/backport-4.12.c
+@@ -224,6 +224,7 @@ int bp_extack_genl_register_family(struc
+ 	}
+ 
+ 	/* copy this since the family might access it directly */
++	family->id = copy->family.id;
+ 	family->attrbuf = copy->family.attrbuf;
+ 	family->mcgrp_offset = copy->family.mcgrp_offset;
+ 
diff --git a/package/kernel/mac80211/patches/009-backport_sg_init_marker.patch b/package/kernel/mac80211/patches/009-backport_sg_init_marker.patch
new file mode 100644
index 0000000000..d7c20daf16
--- /dev/null
+++ b/package/kernel/mac80211/patches/009-backport_sg_init_marker.patch
@@ -0,0 +1,30 @@
+--- a/backport-include/linux/scatterlist.h
++++ b/backport-include/linux/scatterlist.h
+@@ -102,4 +102,27 @@ size_t sg_pcopy_from_buffer(struct scatt
+ 
+ #endif /* LINUX_VERSION_IS_LESS(3, 11, 0) */
+ 
++#if LINUX_VERSION_IS_LESS(4, 17, 0)
++
++#define sg_init_marker LINUX_BACKPORT(sg_init_marker)
++/**
++ * sg_init_marker - Initialize markers in sg table
++ * @sgl:	   The SG table
++ * @nents:	   Number of entries in table
++ *
++ **/
++static inline void sg_init_marker(struct scatterlist *sgl,
++				  unsigned int nents)
++{
++#ifdef CONFIG_DEBUG_SG
++	unsigned int i;
++
++	for (i = 0; i < nents; i++)
++		sgl[i].sg_magic = SG_MAGIC;
++#endif
++	sg_mark_end(&sgl[nents - 1]);
++}
++
++#endif /* LINUX_VERSION_IS_LESS(4, 17, 0) */
++
+ #endif /* __BACKPORT_SCATTERLIST_H */
diff --git a/package/kernel/mac80211/patches/build/010-disable_rfkill.patch b/package/kernel/mac80211/patches/010-disable_rfkill.patch
similarity index 100%
rename from package/kernel/mac80211/patches/build/010-disable_rfkill.patch
rename to package/kernel/mac80211/patches/010-disable_rfkill.patch
diff --git a/package/kernel/mac80211/patches/011-backport-overflow_h.patch b/package/kernel/mac80211/patches/011-backport-overflow_h.patch
new file mode 100644
index 0000000000..169d3bab15
--- /dev/null
+++ b/package/kernel/mac80211/patches/011-backport-overflow_h.patch
@@ -0,0 +1,322 @@
+--- a/backport-include/linux/slab.h
++++ b/backport-include/linux/slab.h
+@@ -1,6 +1,7 @@
+ #ifndef __BACKPORT_SLAB_H
+ #define __BACKPORT_SLAB_H
+ #include_next <linux/slab.h>
++#include <linux/overflow.h>
+ #include <linux/version.h>
+ 
+ #if LINUX_VERSION_IS_LESS(3,4,0)
+--- /dev/null
++++ b/include/linux/overflow.h
+@@ -0,0 +1,309 @@
++/* SPDX-License-Identifier: GPL-2.0 OR MIT */
++#ifndef __LINUX_OVERFLOW_H
++#define __LINUX_OVERFLOW_H
++
++#include <linux/compiler.h>
++
++/*
++ * In the fallback code below, we need to compute the minimum and
++ * maximum values representable in a given type. These macros may also
++ * be useful elsewhere, so we provide them outside the
++ * COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW block.
++ *
++ * It would seem more obvious to do something like
++ *
++ * #define type_min(T) (T)(is_signed_type(T) ? (T)1 << (8*sizeof(T)-1) : 0)
++ * #define type_max(T) (T)(is_signed_type(T) ? ((T)1 << (8*sizeof(T)-1)) - 1 : ~(T)0)
++ *
++ * Unfortunately, the middle expressions, strictly speaking, have
++ * undefined behaviour, and at least some versions of gcc warn about
++ * the type_max expression (but not if -fsanitize=undefined is in
++ * effect; in that case, the warning is deferred to runtime...).
++ *
++ * The slightly excessive casting in type_min is to make sure the
++ * macros also produce sensible values for the exotic type _Bool. [The
++ * overflow checkers only almost work for _Bool, but that's
++ * a-feature-not-a-bug, since people shouldn't be doing arithmetic on
++ * _Bools. Besides, the gcc builtins don't allow _Bool* as third
++ * argument.]
++ *
++ * Idea stolen from
++ * https://mail-index.netbsd.org/tech-misc/2007/02/05/0000.html -
++ * credit to Christian Biere.
++ */
++#define is_signed_type(type)       (((type)(-1)) < (type)1)
++#define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
++#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
++#define type_min(T) ((T)((T)-type_max(T)-(T)1))
++
++
++#ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
++/*
++ * For simplicity and code hygiene, the fallback code below insists on
++ * a, b and *d having the same type (similar to the min() and max()
++ * macros), whereas gcc's type-generic overflow checkers accept
++ * different types. Hence we don't just make check_add_overflow an
++ * alias for __builtin_add_overflow, but add type checks similar to
++ * below.
++ */
++#define check_add_overflow(a, b, d) ({		\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	__builtin_add_overflow(__a, __b, __d);	\
++})
++
++#define check_sub_overflow(a, b, d) ({		\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	__builtin_sub_overflow(__a, __b, __d);	\
++})
++
++#define check_mul_overflow(a, b, d) ({		\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	__builtin_mul_overflow(__a, __b, __d);	\
++})
++
++#else
++
++
++/* Checking for unsigned overflow is relatively easy without causing UB. */
++#define __unsigned_add_overflow(a, b, d) ({	\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	*__d = __a + __b;			\
++	*__d < __a;				\
++})
++#define __unsigned_sub_overflow(a, b, d) ({	\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	*__d = __a - __b;			\
++	__a < __b;				\
++})
++/*
++ * If one of a or b is a compile-time constant, this avoids a division.
++ */
++#define __unsigned_mul_overflow(a, b, d) ({		\
++	typeof(a) __a = (a);				\
++	typeof(b) __b = (b);				\
++	typeof(d) __d = (d);				\
++	(void) (&__a == &__b);				\
++	(void) (&__a == __d);				\
++	*__d = __a * __b;				\
++	__builtin_constant_p(__b) ?			\
++	  __b > 0 && __a > type_max(typeof(__a)) / __b : \
++	  __a > 0 && __b > type_max(typeof(__b)) / __a;	 \
++})
++
++/*
++ * For signed types, detecting overflow is much harder, especially if
++ * we want to avoid UB. But the interface of these macros is such that
++ * we must provide a result in *d, and in fact we must produce the
++ * result promised by gcc's builtins, which is simply the possibly
++ * wrapped-around value. Fortunately, we can just formally do the
++ * operations in the widest relevant unsigned type (u64) and then
++ * truncate the result - gcc is smart enough to generate the same code
++ * with and without the (u64) casts.
++ */
++
++/*
++ * Adding two signed integers can overflow only if they have the same
++ * sign, and overflow has happened iff the result has the opposite
++ * sign.
++ */
++#define __signed_add_overflow(a, b, d) ({	\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	*__d = (u64)__a + (u64)__b;		\
++	(((~(__a ^ __b)) & (*__d ^ __a))	\
++		& type_min(typeof(__a))) != 0;	\
++})
++
++/*
++ * Subtraction is similar, except that overflow can now happen only
++ * when the signs are opposite. In this case, overflow has happened if
++ * the result has the opposite sign of a.
++ */
++#define __signed_sub_overflow(a, b, d) ({	\
++	typeof(a) __a = (a);			\
++	typeof(b) __b = (b);			\
++	typeof(d) __d = (d);			\
++	(void) (&__a == &__b);			\
++	(void) (&__a == __d);			\
++	*__d = (u64)__a - (u64)__b;		\
++	((((__a ^ __b)) & (*__d ^ __a))		\
++		& type_min(typeof(__a))) != 0;	\
++})
++
++/*
++ * Signed multiplication is rather hard. gcc always follows C99, so
++ * division is truncated towards 0. This means that we can write the
++ * overflow check like this:
++ *
++ * (a > 0 && (b > MAX/a || b < MIN/a)) ||
++ * (a < -1 && (b > MIN/a || b < MAX/a) ||
++ * (a == -1 && b == MIN)
++ *
++ * The redundant casts of -1 are to silence an annoying -Wtype-limits
++ * (included in -Wextra) warning: When the type is u8 or u16, the
++ * __b_c_e in check_mul_overflow obviously selects
++ * __unsigned_mul_overflow, but unfortunately gcc still parses this
++ * code and warns about the limited range of __b.
++ */
++
++#define __signed_mul_overflow(a, b, d) ({				\
++	typeof(a) __a = (a);						\
++	typeof(b) __b = (b);						\
++	typeof(d) __d = (d);						\
++	typeof(a) __tmax = type_max(typeof(a));				\
++	typeof(a) __tmin = type_min(typeof(a));				\
++	(void) (&__a == &__b);						\
++	(void) (&__a == __d);						\
++	*__d = (u64)__a * (u64)__b;					\
++	(__b > 0   && (__a > __tmax/__b || __a < __tmin/__b)) ||	\
++	(__b < (typeof(__b))-1  && (__a > __tmin/__b || __a < __tmax/__b)) || \
++	(__b == (typeof(__b))-1 && __a == __tmin);			\
++})
++
++
++#define check_add_overflow(a, b, d)					\
++	__builtin_choose_expr(is_signed_type(typeof(a)),		\
++			__signed_add_overflow(a, b, d),			\
++			__unsigned_add_overflow(a, b, d))
++
++#define check_sub_overflow(a, b, d)					\
++	__builtin_choose_expr(is_signed_type(typeof(a)),		\
++			__signed_sub_overflow(a, b, d),			\
++			__unsigned_sub_overflow(a, b, d))
++
++#define check_mul_overflow(a, b, d)					\
++	__builtin_choose_expr(is_signed_type(typeof(a)),		\
++			__signed_mul_overflow(a, b, d),			\
++			__unsigned_mul_overflow(a, b, d))
++
++
++#endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
++
++/** check_shl_overflow() - Calculate a left-shifted value and check overflow
++ *
++ * @a: Value to be shifted
++ * @s: How many bits left to shift
++ * @d: Pointer to where to store the result
++ *
++ * Computes *@d = (@a << @s)
++ *
++ * Returns true if '*d' cannot hold the result or when 'a << s' doesn't
++ * make sense. Example conditions:
++ * - 'a << s' causes bits to be lost when stored in *d.
++ * - 's' is garbage (e.g. negative) or so large that the result of
++ *   'a << s' is guaranteed to be 0.
++ * - 'a' is negative.
++ * - 'a << s' sets the sign bit, if any, in '*d'.
++ *
++ * '*d' will hold the results of the attempted shift, but is not
++ * considered "safe for use" if false is returned.
++ */
++#define check_shl_overflow(a, s, d) ({					\
++	typeof(a) _a = a;						\
++	typeof(s) _s = s;						\
++	typeof(d) _d = d;						\
++	u64 _a_full = _a;						\
++	unsigned int _to_shift =					\
++		_s >= 0 && _s < 8 * sizeof(*d) ? _s : 0;		\
++	*_d = (_a_full << _to_shift);					\
++	(_to_shift != _s || *_d < 0 || _a < 0 ||			\
++		(*_d >> _to_shift) != _a);				\
++})
++
++/**
++ * array_size() - Calculate size of 2-dimensional array.
++ *
++ * @a: dimension one
++ * @b: dimension two
++ *
++ * Calculates size of 2-dimensional array: @a * @b.
++ *
++ * Returns: number of bytes needed to represent the array or SIZE_MAX on
++ * overflow.
++ */
++static inline __must_check size_t array_size(size_t a, size_t b)
++{
++	size_t bytes;
++
++	if (check_mul_overflow(a, b, &bytes))
++		return SIZE_MAX;
++
++	return bytes;
++}
++
++/**
++ * array3_size() - Calculate size of 3-dimensional array.
++ *
++ * @a: dimension one
++ * @b: dimension two
++ * @c: dimension three
++ *
++ * Calculates size of 3-dimensional array: @a * @b * @c.
++ *
++ * Returns: number of bytes needed to represent the array or SIZE_MAX on
++ * overflow.
++ */
++static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
++{
++	size_t bytes;
++
++	if (check_mul_overflow(a, b, &bytes))
++		return SIZE_MAX;
++	if (check_mul_overflow(bytes, c, &bytes))
++		return SIZE_MAX;
++
++	return bytes;
++}
++
++static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
++{
++	size_t bytes;
++
++	if (check_mul_overflow(n, size, &bytes))
++		return SIZE_MAX;
++	if (check_add_overflow(bytes, c, &bytes))
++		return SIZE_MAX;
++
++	return bytes;
++}
++
++/**
++ * struct_size() - Calculate size of structure with trailing array.
++ * @p: Pointer to the structure.
++ * @member: Name of the array member.
++ * @n: Number of elements in the array.
++ *
++ * Calculates size of memory needed for structure @p followed by an
++ * array of @n @member elements.
++ *
++ * Return: number of bytes needed or SIZE_MAX on overflow.
++ */
++#define struct_size(p, member, n)					\
++	__ab_c_size(n,							\
++		    sizeof(*(p)->member) + __must_be_array((p)->member),\
++		    sizeof(*(p)))
++
++#endif /* __LINUX_OVERFLOW_H */
diff --git a/package/kernel/mac80211/patches/build/012-kernel_build_check.patch b/package/kernel/mac80211/patches/012-kernel_build_check.patch
similarity index 100%
rename from package/kernel/mac80211/patches/build/012-kernel_build_check.patch
rename to package/kernel/mac80211/patches/012-kernel_build_check.patch
diff --git a/package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch b/package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch
new file mode 100644
index 0000000000..f71e40bf10
--- /dev/null
+++ b/package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch
@@ -0,0 +1,19 @@
+--- a/backport-include/linux/firmware.h
++++ b/backport-include/linux/firmware.h
+@@ -5,5 +5,16 @@
+ #if LINUX_VERSION_IS_LESS(3,14,0)
+ #define request_firmware_direct(fw, name, device) request_firmware(fw, name, device)
+ #endif
++#if LINUX_VERSION_IS_LESS(4,18,0)
++#define firmware_request_nowarn(fw, name, device) request_firmware(fw, name, device)
++#endif
++
++#if LINUX_VERSION_IS_LESS(4,17,0)
++#define firmware_request_cache LINUX_BACKPORT(firmware_request_cache)
++static inline int firmware_request_cache(struct device *device, const char *name)
++{
++	return 0;
++}
++#endif
+ 
+ #endif /* __BACKPORT_LINUX_FIRMWARE_H */
diff --git a/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch b/package/kernel/mac80211/patches/015-ipw200-mtu.patch
similarity index 86%
rename from package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
rename to package/kernel/mac80211/patches/015-ipw200-mtu.patch
index 68dd821331..8d273a095b 100644
--- a/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
+++ b/package/kernel/mac80211/patches/015-ipw200-mtu.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
 +++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-@@ -11481,6 +11481,15 @@ static const struct attribute_group ipw_
+@@ -11506,6 +11506,15 @@ static const struct attribute_group ipw_
  	.attrs = ipw_sysfs_entries,
  };
  
@@ -16,7 +16,7 @@
  #ifdef CPTCFG_IPW2200_PROMISCUOUS
  static int ipw_prom_open(struct net_device *dev)
  {
-@@ -11529,15 +11538,6 @@ static netdev_tx_t ipw_prom_hard_start_x
+@@ -11554,15 +11563,6 @@ static netdev_tx_t ipw_prom_hard_start_x
  	return NETDEV_TX_OK;
  }
  
diff --git a/package/kernel/mac80211/patches/rt2x00/100-rt2x00_options.patch b/package/kernel/mac80211/patches/030-rt2x00_options.patch
similarity index 95%
rename from package/kernel/mac80211/patches/rt2x00/100-rt2x00_options.patch
rename to package/kernel/mac80211/patches/030-rt2x00_options.patch
index 295904c64e..9dd348151c 100644
--- a/package/kernel/mac80211/patches/rt2x00/100-rt2x00_options.patch
+++ b/package/kernel/mac80211/patches/030-rt2x00_options.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/Kconfig
 +++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
-@@ -226,36 +226,37 @@ config RT2800SOC
+@@ -225,36 +225,37 @@ config RT2800SOC
  
  
  config RT2800_LIB
diff --git a/package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch b/package/kernel/mac80211/patches/040-brcmutil_option.patch
similarity index 79%
rename from package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch
rename to package/kernel/mac80211/patches/040-brcmutil_option.patch
index 3e8505b5b4..167332d916 100644
--- a/package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch
+++ b/package/kernel/mac80211/patches/040-brcmutil_option.patch
@@ -1,7 +1,6 @@
 --- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
 +++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
-@@ -1,6 +1,6 @@
- # SPDX-License-Identifier: GPL-2.0-only
+@@ -1,5 +1,5 @@
  config BRCMUTIL
 -	tristate
 +	tristate "Broadcom 802.11 driver utility functions"
diff --git a/package/kernel/mac80211/patches/build/050-lib80211_option.patch b/package/kernel/mac80211/patches/050-lib80211_option.patch
similarity index 78%
rename from package/kernel/mac80211/patches/build/050-lib80211_option.patch
rename to package/kernel/mac80211/patches/050-lib80211_option.patch
index f6e1f9be07..28a0d905b7 100644
--- a/package/kernel/mac80211/patches/build/050-lib80211_option.patch
+++ b/package/kernel/mac80211/patches/050-lib80211_option.patch
@@ -1,7 +1,7 @@
 --- a/net/wireless/Kconfig
 +++ b/net/wireless/Kconfig
-@@ -186,7 +186,7 @@ config CFG80211_WEXT_EXPORT
- endif # CFG80211
+@@ -181,7 +181,7 @@ config CFG80211_WEXT_EXPORT
+ 	  wext compatibility symbols to be exported.
  
  config LIB80211
 -	tristate
@@ -9,7 +9,7 @@
  	depends on m
  	default n
  	help
-@@ -196,15 +196,15 @@ config LIB80211
+@@ -191,15 +191,15 @@ config LIB80211
  	  Drivers should select this themselves if needed.
  
  config LIB80211_CRYPT_WEP
diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
new file mode 100644
index 0000000000..d897b2b40e
--- /dev/null
+++ b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
@@ -0,0 +1,132 @@
+--- a/local-symbols
++++ b/local-symbols
+@@ -388,45 +388,6 @@ USB_IPHETH=
+ USB_SIERRA_NET=
+ USB_VL600=
+ USB_NET_CH9200=
+-SSB_POSSIBLE=
+-SSB=
+-SSB_SPROM=
+-SSB_BLOCKIO=
+-SSB_PCIHOST_POSSIBLE=
+-SSB_PCIHOST=
+-SSB_B43_PCI_BRIDGE=
+-SSB_PCMCIAHOST_POSSIBLE=
+-SSB_PCMCIAHOST=
+-SSB_SDIOHOST_POSSIBLE=
+-SSB_SDIOHOST=
+-SSB_HOST_SOC=
+-SSB_SILENT=
+-SSB_DEBUG=
+-SSB_SERIAL=
+-SSB_DRIVER_PCICORE_POSSIBLE=
+-SSB_DRIVER_PCICORE=
+-SSB_PCICORE_HOSTMODE=
+-SSB_DRIVER_MIPS=
+-SSB_SFLASH=
+-SSB_EMBEDDED=
+-SSB_DRIVER_EXTIF=
+-SSB_DRIVER_GIGE=
+-SSB_DRIVER_GPIO=
+-BCMA_POSSIBLE=
+-BCMA=
+-BCMA_BLOCKIO=
+-BCMA_HOST_PCI_POSSIBLE=
+-BCMA_HOST_PCI=
+-BCMA_HOST_SOC=
+-BCMA_DRIVER_PCI=
+-BCMA_DRIVER_PCI_HOSTMODE=
+-BCMA_DRIVER_MIPS=
+-BCMA_PFLASH=
+-BCMA_SFLASH=
+-BCMA_NFLASH=
+-BCMA_DRIVER_GMAC_CMN=
+-BCMA_DRIVER_GPIO=
+-BCMA_DEBUG=
+ NFC=
+ NFC_DIGITAL=
+ NFC_NCI=
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -2876,7 +2876,7 @@ static struct ssb_device *b43_ssb_gpio_d
+ {
+ 	struct ssb_bus *bus = dev->dev->sdev->bus;
+ 
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
+ #else
+ 	return bus->chipco.dev;
+@@ -4893,7 +4893,7 @@ static int b43_wireless_core_init(struct
+ 	}
+ 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
+ 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
+-#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
++#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
+ 	if (dev->dev->bus_type == B43_BUS_SSB &&
+ 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
+ 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
+ 	if (dev->dev->id.revision >= 2)
+ 		mask  |= 0x0010; /* FIXME: This is redundant. */
+ 
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ 	pcidev = bus->pcicore.dev;
+ #endif
+ 	gpiodev = bus->chipco.dev ? : pcidev;
+@@ -1956,7 +1956,7 @@ static void b43legacy_gpio_cleanup(struc
+ 	struct ssb_bus *bus = dev->dev->bus;
+ 	struct ssb_device *gpiodev, *pcidev = NULL;
+ 
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ 	pcidev = bus->pcicore.dev;
+ #endif
+ 	gpiodev = bus->chipco.dev ? : pcidev;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
+@@ -42,6 +42,6 @@ brcmsmac-y := \
+ 	brcms_trace_events.o \
+ 	debug.o
+ 
+-brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
++brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
+ 
+ obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
+@@ -22,7 +22,7 @@ struct brcms_led {
+ 	bool active_low;
+ };
+ 
+-#ifdef CPTCFG_BCMA_DRIVER_GPIO
++#ifdef CONFIG_BCMA_DRIVER_GPIO
+ void brcms_led_unregister(struct brcms_info *wl);
+ int brcms_led_register(struct brcms_info *wl);
+ #else
+--- a/Kconfig.sources
++++ b/Kconfig.sources
+@@ -9,9 +9,6 @@ source "$BACKPORT_DIR/drivers/net/wirele
+ #source "$BACKPORT_DIR/drivers/net/ethernet/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
+ 
+-source "$BACKPORT_DIR/drivers/ssb/Kconfig"
+-source "$BACKPORT_DIR/drivers/bcma/Kconfig"
+-
+ source "$BACKPORT_DIR/net/nfc/Kconfig"
+ 
+ #source "$BACKPORT_DIR/drivers/media/Kconfig"
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -42,8 +42,6 @@ obj-$(CPTCFG_MAC80211) += net/mac80211/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+ #obj-$(CPTCFG_BT) += net/bluetooth/
+ #obj-$(CPTCFG_BT) += drivers/bluetooth/
+-obj-$(CPTCFG_SSB) += drivers/ssb/
+-obj-$(CPTCFG_BCMA) += drivers/bcma/
+ #obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+ obj-$(CPTCFG_NFC) += net/nfc/
diff --git a/package/kernel/mac80211/patches/ath/070-ath_common_config.patch b/package/kernel/mac80211/patches/070-ath_common_config.patch
similarity index 74%
rename from package/kernel/mac80211/patches/ath/070-ath_common_config.patch
rename to package/kernel/mac80211/patches/070-ath_common_config.patch
index cc84c1b5de..41774fe53e 100644
--- a/package/kernel/mac80211/patches/ath/070-ath_common_config.patch
+++ b/package/kernel/mac80211/patches/070-ath_common_config.patch
@@ -1,7 +1,6 @@
 --- a/drivers/net/wireless/ath/Kconfig
 +++ b/drivers/net/wireless/ath/Kconfig
-@@ -1,6 +1,6 @@
- # SPDX-License-Identifier: GPL-2.0-only
+@@ -1,5 +1,5 @@
  config ATH_COMMON
 -	tristate
 +	tristate "ath.ko"
diff --git a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
similarity index 74%
rename from package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
rename to package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
index cef57f09c9..796615b03c 100644
--- a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -87,6 +87,12 @@ config ATH10K_TRACING
+@@ -65,6 +65,12 @@ config ATH10K_TRACING
  	---help---
  	  Select this to ath10k use tracing infrastructure.
  
@@ -15,18 +15,18 @@
  	depends on ATH10K && CFG80211_CERTIFICATION_ONUS
 --- a/drivers/net/wireless/ath/ath10k/Makefile
 +++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -18,7 +18,7 @@ ath10k_core-y += mac.o \
- ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) += spectral.o
+@@ -17,7 +17,7 @@ ath10k_core-y += mac.o \
+ ath10k_core-$(CPTCFG_ATH10K_DEBUGFS) += spectral.o
  ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
 -ath10k_core-$(CONFIG_THERMAL) += thermal.o
 +ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
  ath10k_core-$(CPTCFG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
- ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
+ 
 --- a/drivers/net/wireless/ath/ath10k/thermal.h
 +++ b/drivers/net/wireless/ath/ath10k/thermal.h
-@@ -25,7 +25,7 @@ struct ath10k_thermal {
+@@ -36,7 +36,7 @@ struct ath10k_thermal {
  	int temperature;
  };
  
@@ -35,13 +35,3 @@
  int ath10k_thermal_register(struct ath10k *ar);
  void ath10k_thermal_unregister(struct ath10k *ar);
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
---- a/local-symbols
-+++ b/local-symbols
-@@ -139,6 +139,7 @@ ATH10K_SNOC=
- ATH10K_DEBUG=
- ATH10K_DEBUGFS=
- ATH10K_SPECTRAL=
-+ATH10K_THERMAL=
- ATH10K_TRACING=
- ATH10K_DFS_CERTIFIED=
- WCN36XX=
diff --git a/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch b/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
new file mode 100644
index 0000000000..2724027866
--- /dev/null
+++ b/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
@@ -0,0 +1,111 @@
+From d06f26c5c8a41f246a9c40862a77a55725cedbd3 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Fri, 8 Dec 2017 11:37:42 +0100
+Subject: ath10k: search DT for qcom,ath10k-calibration-variant
+
+Board Data File (BDF) is loaded upon driver boot-up procedure. The right
+board data file is identified on QCA4019 using bus, bmi-chip-id and
+bmi-board-id.
+
+The problem, however, can occur when the (default) board data file cannot
+fulfill with the vendor requirements and it is necessary to use a different
+board data file.
+
+This problem was solved for SMBIOS by adding a special SMBIOS type 0xF8.
+Something similar has to be provided for systems without SMBIOS but with
+device trees. No solution was specified by QCA and therefore a new one has
+to be found for ath10k.
+
+The device tree requires addition strings to define the variant name
+
+    wifi@a000000 {
+    	status = "okay";
+    	qcom,ath10k-calibration-variant = "RT-AC58U";
+    };
+
+    wifi@a800000 {
+    	status = "okay";
+    	qcom,ath10k-calibration-variant = "RT-AC58U";
+    };
+
+This would create the boarddata identifiers for the board-2.bin search
+
+ *  bus=ahb,bmi-chip-id=0,bmi-board-id=16,variant=RT-AC58U
+ *  bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=RT-AC58U
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 40 ++++++++++++++++++++++++++++------
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -860,6 +860,28 @@ static int ath10k_core_check_smbios(stru
+ 	return 0;
+ }
+ 
++static int ath10k_core_check_dt(struct ath10k *ar)
++{
++	struct device_node *node;
++	const char *variant = NULL;
++
++	node = ar->dev->of_node;
++	if (!node)
++		return -ENOENT;
++
++	of_property_read_string(node, "qcom,ath10k-calibration-variant",
++				&variant);
++	if (!variant)
++		return -ENODATA;
++
++	if (strscpy(ar->id.bdf_ext, variant, sizeof(ar->id.bdf_ext)) < 0)
++		ath10k_dbg(ar, ATH10K_DBG_BOOT,
++			   "bdf variant string is longer than the buffer can accommodate (variant: %s)\n",
++			    variant);
++
++	return 0;
++}
++
+ static int ath10k_download_and_run_otp(struct ath10k *ar)
+ {
+ 	u32 result, address = ar->hw_params.patch_load_addr;
+@@ -1231,19 +1253,19 @@ static int ath10k_core_create_board_name
+ 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
+ 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
+ 
++	if (ar->id.bdf_ext[0] != '\0')
++		scnprintf(variant, sizeof(variant), ",variant=%s",
++			  ar->id.bdf_ext);
++
+ 	if (ar->id.bmi_ids_valid) {
+ 		scnprintf(name, name_len,
+-			  "bus=%s,bmi-chip-id=%d,bmi-board-id=%d",
++			  "bus=%s,bmi-chip-id=%d,bmi-board-id=%d%s",
+ 			  ath10k_bus_str(ar->hif.bus),
+ 			  ar->id.bmi_chip_id,
+-			  ar->id.bmi_board_id);
++			  ar->id.bmi_board_id, variant);
+ 		goto out;
+ 	}
+ 
+-	if (ar->id.bdf_ext[0] != '\0')
+-		scnprintf(variant, sizeof(variant), ",variant=%s",
+-			  ar->id.bdf_ext);
+-
+ 	scnprintf(name, name_len,
+ 		  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x%s",
+ 		  ath10k_bus_str(ar->hif.bus),
+@@ -2343,7 +2365,11 @@ static int ath10k_core_probe_fw(struct a
+ 
+ 	ret = ath10k_core_check_smbios(ar);
+ 	if (ret)
+-		ath10k_dbg(ar, ATH10K_DBG_BOOT, "bdf variant name not set.\n");
++		ath10k_dbg(ar, ATH10K_DBG_BOOT, "SMBIOS bdf variant name not set.\n");
++
++	ret = ath10k_core_check_dt(ar);
++	if (ret)
++		ath10k_dbg(ar, ATH10K_DBG_BOOT, "DT bdf variant name not set.\n");
+ 
+ 	ret = ath10k_core_fetch_board_file(ar);
+ 	if (ret) {
diff --git a/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch b/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
new file mode 100644
index 0000000000..9ddede3a67
--- /dev/null
+++ b/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
@@ -0,0 +1,36 @@
+From 606204bb863fa3b0bb54929d79b4dc46338f9180 Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Tue, 27 Mar 2018 11:26:46 +0300
+Subject: [PATCH] ath10k: suppress "Unknown eventid: 36925" warnings
+
+FW has Smart Logging feature enabled by default for detecting failures
+and processing FATAL_CONDITION_EVENTID (36925 - 0x903D) back to host.
+
+Since ath10k doesn't implement the Smart Logging and FATAL CONDITION
+EVENT processing yet, suppressing the unknown event ID warning by moving
+this under ATH10K_DBG_WMI.
+
+Simulated the same issue by having associated STA powered off when
+ping flood was running from AP backbone. This triggerd STA KICKOUT
+in AP followed by FATAL CONDITION event 36925.
+
+Issue was reproduced and verified in below DUT
+------------------------------------------------
+AP mode of OpenWRT QCA9984 running 6.0.8 with FW ver 10.4-3.5.3-00053
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5462,6 +5462,7 @@ static void ath10k_wmi_10_4_op_rx(struct
+ 	case WMI_10_4_WOW_WAKEUP_HOST_EVENTID:
+ 	case WMI_10_4_PEER_RATECODE_LIST_EVENTID:
+ 	case WMI_10_4_WDS_PEER_EVENTID:
++	case WMI_10_4_DEBUG_FATAL_CONDITION_EVENTID:
+ 		ath10k_dbg(ar, ATH10K_DBG_WMI,
+ 			   "received event id %d not implemented\n", id);
+ 		break;
diff --git a/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch b/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
new file mode 100644
index 0000000000..57b4a727eb
--- /dev/null
+++ b/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
@@ -0,0 +1,40 @@
+From 52a192362932f333a7ebafd581c4d9b81da2fec8 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Mon, 28 May 2018 13:25:06 +0200
+Subject: [PATCH] Revert "rt2800: use TXOP_BACKOFF for probe frames"
+
+This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e.
+
+In some situations when we set TXOP_BACKOFF, the probe frame is
+not sent at all. What it worse then sending probe frame as part
+of AMPDU and can degrade 11n performance to 11g rates.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri
+ 
+ 	/*
+ 	 * Determine IFS values
+-	 * - Use TXOP_BACKOFF for probe and management frames except beacons
++	 * - Use TXOP_BACKOFF for management frames except beacons
+ 	 * - Use TXOP_SIFS for fragment bursts
+ 	 * - Use TXOP_HTTXOP for everything else
+ 	 *
+ 	 * Note: rt2800 devices won't use CTS protection (if used)
+ 	 * for frames not transmitted with TXOP_HTTXOP
+ 	 */
+-	if ((ieee80211_is_mgmt(hdr->frame_control) &&
+-	     !ieee80211_is_beacon(hdr->frame_control)) ||
+-	    (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
++	if (ieee80211_is_mgmt(hdr->frame_control) &&
++	    !ieee80211_is_beacon(hdr->frame_control))
+ 		txdesc->u.ht.txop = TXOP_BACKOFF;
+ 	else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
+ 		txdesc->u.ht.txop = TXOP_SIFS;
diff --git a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
similarity index 92%
rename from package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
rename to package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
index 1a13fdc56f..8d7a39a6df 100644
--- a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
+++ b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/Makefile
 +++ b/net/mac80211/Makefile
-@@ -7,7 +7,6 @@ mac80211-y := \
+@@ -6,7 +6,6 @@ mac80211-y := \
  	driver-ops.o \
  	sta_info.o \
  	wep.o \
@@ -8,7 +8,7 @@
  	wpa.o \
  	scan.o offchannel.o \
  	ht.o agg-tx.o agg-rx.o \
-@@ -18,8 +17,8 @@ mac80211-y := \
+@@ -16,8 +15,8 @@ mac80211-y := \
  	rate.o \
  	michael.o \
  	tkip.o \
@@ -20,14 +20,17 @@
  	ethtool.o \
 --- a/net/mac80211/aead_api.c
 +++ /dev/null
-@@ -1,112 +0,0 @@
--// SPDX-License-Identifier: GPL-2.0-only
+@@ -1,115 +0,0 @@
 -/*
 - * Copyright 2003-2004, Instant802 Networks, Inc.
 - * Copyright 2005-2006, Devicescape Software, Inc.
 - * Copyright 2014-2015, Qualcomm Atheros, Inc.
 - *
 - * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
 - */
 -
 -#include <linux/kernel.h>
@@ -135,8 +138,12 @@
 -}
 --- a/net/mac80211/aead_api.h
 +++ /dev/null
-@@ -1,23 +0,0 @@
--/* SPDX-License-Identifier: GPL-2.0-only */
+@@ -1,27 +0,0 @@
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
 -
 -#ifndef _AEAD_API_H
 -#define _AEAD_API_H
@@ -161,7 +168,7 @@
 -#endif /* _AEAD_API_H */
 --- a/net/mac80211/aes_ccm.h
 +++ b/net/mac80211/aes_ccm.h
-@@ -7,39 +7,17 @@
+@@ -10,39 +10,17 @@
  #ifndef AES_CCM_H
  #define AES_CCM_H
  
@@ -326,7 +333,7 @@
 +}
 --- a/net/mac80211/aes_gcm.h
 +++ b/net/mac80211/aes_gcm.h
-@@ -6,38 +6,30 @@
+@@ -9,38 +9,30 @@
  #ifndef AES_GCM_H
  #define AES_GCM_H
  
@@ -378,7 +385,7 @@
  #endif /* AES_GCM_H */
 --- a/net/mac80211/wpa.c
 +++ b/net/mac80211/wpa.c
-@@ -311,7 +311,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
+@@ -306,7 +306,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
  }
  
  
@@ -388,7 +395,7 @@
  {
  	__le16 mask_fc;
  	int a4_included, mgmt;
-@@ -341,14 +342,8 @@ static void ccmp_special_blocks(struct s
+@@ -336,14 +337,8 @@ static void ccmp_special_blocks(struct s
  	else
  		qos_tid = 0;
  
@@ -405,7 +412,7 @@
  
  	/* Nonce: Nonce Flags | A2 | PN
  	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-@@ -356,6 +351,8 @@ static void ccmp_special_blocks(struct s
+@@ -351,6 +346,8 @@ static void ccmp_special_blocks(struct s
  	b_0[1] = qos_tid | (mgmt << 4);
  	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
  	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
@@ -414,7 +421,7 @@
  
  	/* AAD (extra authenticate-only data) / masked 802.11 header
  	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-@@ -412,7 +409,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -407,7 +404,7 @@ static int ccmp_encrypt_skb(struct ieee8
  	u8 *pos;
  	u8 pn[6];
  	u64 pn64;
@@ -423,7 +430,7 @@
  	u8 b_0[AES_BLOCK_SIZE];
  
  	if (info->control.hw_key &&
-@@ -467,9 +464,11 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -462,9 +459,11 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  
  	pos += IEEE80211_CCMP_HDR_LEN;
@@ -438,7 +445,7 @@
  }
  
  
-@@ -542,13 +541,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
+@@ -537,13 +536,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
  			u8 aad[2 * AES_BLOCK_SIZE];
  			u8 b_0[AES_BLOCK_SIZE];
  			/* hardware didn't decrypt/verify MIC */
@@ -454,7 +461,7 @@
  				return RX_DROP_UNUSABLE;
  		}
  
-@@ -643,7 +642,7 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -639,7 +638,7 @@ static int gcmp_encrypt_skb(struct ieee8
  	u8 *pos;
  	u8 pn[6];
  	u64 pn64;
@@ -463,7 +470,7 @@
  	u8 j_0[AES_BLOCK_SIZE];
  
  	if (info->control.hw_key &&
-@@ -700,8 +699,10 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -696,8 +695,10 @@ static int gcmp_encrypt_skb(struct ieee8
  
  	pos += IEEE80211_GCMP_HDR_LEN;
  	gcmp_special_blocks(skb, pn, j_0, aad);
@@ -476,7 +483,7 @@
  }
  
  ieee80211_tx_result
-@@ -1124,9 +1125,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
+@@ -1121,9 +1122,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_mmie_16 *mmie;
  	struct ieee80211_hdr *hdr;
@@ -488,12 +495,12 @@
  
  	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
  		return TX_DROP;
-@@ -1172,7 +1173,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
+@@ -1169,7 +1170,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
  	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  	struct ieee80211_key *key = rx->key;
  	struct ieee80211_mmie_16 *mmie;
--	u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
-+	u8 aad[20], *mic, ipn[6], nonce[12];
+-	u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN];
++	u8 aad[20], mic[16], ipn[6], nonce[12];
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  
  	if (!ieee80211_is_mgmt(hdr->frame_control))
@@ -646,7 +653,7 @@
 +}
 --- a/net/mac80211/Kconfig
 +++ b/net/mac80211/Kconfig
-@@ -6,8 +6,6 @@ config MAC80211
+@@ -5,8 +5,6 @@ config MAC80211
  	depends on CRYPTO
  	depends on CRYPTO_ARC4
  	depends on CRYPTO_AES
@@ -657,7 +664,7 @@
  	---help---
 --- a/net/mac80211/aes_gmac.h
 +++ b/net/mac80211/aes_gmac.h
-@@ -12,10 +12,22 @@
+@@ -15,10 +15,22 @@
  #define GMAC_MIC_LEN	16
  #define GMAC_NONCE_LEN	12
  
@@ -687,7 +694,7 @@
  #endif /* AES_GMAC_H */
 --- a/net/mac80211/key.h
 +++ b/net/mac80211/key.h
-@@ -86,7 +86,7 @@ struct ieee80211_key {
+@@ -88,7 +88,7 @@ struct ieee80211_key {
  			 * Management frames.
  			 */
  			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
similarity index 71%
rename from package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
rename to package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
index 59144f7310..3b1fcdf9c8 100644
--- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,8 +2,8 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1162,7 +1162,6 @@ static int ieee80211_stop_ap(struct wiph
- 	sdata->vif.bss_conf.ftmr_params = NULL;
+@@ -1058,7 +1058,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
  
  	__sta_info_flush(sdata, true);
 -	ieee80211_free_keys(sdata, true);
diff --git a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch
similarity index 95%
rename from package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
rename to package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch
index 172e5b04fd..ffd8807ccc 100644
--- a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
+++ b/package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/sysfs.c
 +++ b/net/wireless/sysfs.c
-@@ -23,18 +23,35 @@ static inline struct cfg80211_registered
+@@ -24,18 +24,35 @@ static inline struct cfg80211_registered
  	return container_of(dev, struct cfg80211_registered_device, wiphy.dev);
  }
  
diff --git a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch b/package/kernel/mac80211/patches/130-disable-fils.patch
similarity index 86%
rename from package/kernel/mac80211/patches/subsys/130-disable-fils.patch
rename to package/kernel/mac80211/patches/130-disable-fils.patch
index dd1ccc8597..1f03589878 100644
--- a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
+++ b/package/kernel/mac80211/patches/130-disable-fils.patch
@@ -2,7 +2,7 @@ Disable FILS support, since it pulls in crypto hash support
 
 --- a/net/mac80211/fils_aead.h
 +++ b/net/mac80211/fils_aead.h
-@@ -7,7 +7,7 @@
+@@ -10,7 +10,7 @@
  #ifndef FILS_AEAD_H
  #define FILS_AEAD_H
  
@@ -16,12 +16,12 @@ Disable FILS support, since it pulls in crypto hash support
 @@ -1,4 +1,4 @@
 -#if LINUX_VERSION_IS_GEQ(4,3,0)
 +#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- // SPDX-License-Identifier: GPL-2.0-only
  /*
   * FILS AEAD for (Re)Association Request/Response frames
+  * Copyright 2016, Qualcomm Atheros, Inc.
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -570,7 +570,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -550,7 +550,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_MAC_ON_CREATE |
  			   NL80211_FEATURE_USERSPACE_MPM |
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
@@ -29,4 +29,4 @@ Disable FILS support, since it pulls in crypto hash support
 +#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  #endif
- 	wiphy_ext_feature_set(wiphy,
+ 
diff --git a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch b/package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
similarity index 98%
rename from package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
rename to package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
index 0c5f85236e..d138b2c5ac 100644
--- a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
+++ b/package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/aes_cmac.c
 +++ b/net/mac80211/aes_cmac.c
-@@ -19,50 +19,126 @@
+@@ -22,50 +22,126 @@
  #define CMAC_TLEN_256 16 /* CMAC TLen = 128 bits (16 octets) */
  #define AAD_LEN 20
  
@@ -166,7 +166,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
 --- a/net/mac80211/aes_cmac.h
 +++ b/net/mac80211/aes_cmac.h
-@@ -7,14 +7,13 @@
+@@ -10,14 +10,13 @@
  #define AES_CMAC_H
  
  #include <linux/crypto.h>
@@ -188,7 +188,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif /* AES_CMAC_H */
 --- a/net/mac80211/key.h
 +++ b/net/mac80211/key.h
-@@ -91,7 +91,7 @@ struct ieee80211_key {
+@@ -93,7 +93,7 @@ struct ieee80211_key {
  		} ccmp;
  		struct {
  			u8 rx_pn[IEEE80211_CMAC_PN_LEN];
diff --git a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch b/package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch
similarity index 88%
rename from package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
rename to package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch
index a259d5816b..9d185e61e7 100644
--- a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
+++ b/package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/Kconfig
 +++ b/net/mac80211/Kconfig
-@@ -6,7 +6,6 @@ config MAC80211
+@@ -5,7 +5,6 @@ config MAC80211
  	depends on CRYPTO
  	depends on CRYPTO_ARC4
  	depends on CRYPTO_AES
diff --git a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch b/package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
similarity index 93%
rename from package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
rename to package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
index 449179a962..6e9a07a927 100644
--- a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
+++ b/package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4012,6 +4012,12 @@ out:
+@@ -3750,6 +3750,12 @@ out:
  netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
  				       struct net_device *dev)
  {
diff --git a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
similarity index 80%
rename from package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
rename to package/kernel/mac80211/patches/150-disable_addr_notifier.patch
index 39000e4f05..781dd3c1bc 100644
--- a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
+++ b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -313,7 +313,7 @@ void ieee80211_restart_hw(struct ieee802
+@@ -292,7 +292,7 @@ void ieee80211_restart_hw(struct ieee802
  }
  EXPORT_SYMBOL(ieee80211_restart_hw);
  
@@ -9,7 +9,7 @@
  static int ieee80211_ifa_changed(struct notifier_block *nb,
  				 unsigned long data, void *arg)
  {
-@@ -372,7 +372,7 @@ static int ieee80211_ifa_changed(struct
+@@ -351,7 +351,7 @@ static int ieee80211_ifa_changed(struct
  }
  #endif
  
@@ -18,9 +18,9 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1269,14 +1269,14 @@ int ieee80211_register_hw(struct ieee802
- 
- 	rtnl_unlock();
+@@ -1114,14 +1114,14 @@ int ieee80211_register_hw(struct ieee802
+ 	if (result)
+ 		goto fail_flows;
  
 -#ifdef CONFIG_INET
 +#ifdef __disabled__CONFIG_INET
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1285,13 +1285,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1130,13 +1130,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -51,8 +51,8 @@
 +#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
   fail_ifa:
  #endif
- 	rtnl_lock();
-@@ -1320,10 +1320,10 @@ void ieee80211_unregister_hw(struct ieee
+ 	ieee80211_txq_teardown_flows(local);
+@@ -1166,10 +1166,10 @@ void ieee80211_unregister_hw(struct ieee
  	tasklet_kill(&local->tx_pending_tasklet);
  	tasklet_kill(&local->tasklet);
  
diff --git a/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch b/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
new file mode 100644
index 0000000000..357b006bcc
--- /dev/null
+++ b/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
@@ -0,0 +1,237 @@
+From: Thomas Hebb <tommyhebb@gmail.com>
+Subject: [PATCH] ath10k: search all IEs for variant before falling back
+Date: Wed, 21 Feb 2018 11:43:39 -0500
+
+commit f2593cb1b291 ("ath10k: Search SMBIOS for OEM board file
+extension") added a feature to ath10k that allows Board Data File
+(BDF) conflicts between multiple devices that use the same device IDs
+but have different calibration requirements to be resolved by allowing
+a "variant" string to be stored in SMBIOS [and later device tree, added
+by commit d06f26c5c8a4 ("ath10k: search DT for qcom,ath10k-calibration-
+variant")] that gets appended to the ID stored in board-2.bin.
+
+This original patch had a regression, however. Namely that devices with
+a variant present in SMBIOS that didn't need custom BDFs could no longer
+find the default BDF, which has no variant appended. The patch was
+reverted and re-applied with a fix for this issue in commit 1657b8f84ed9
+("search SMBIOS for OEM board file extension").
+
+But the fix to fall back to a default BDF introduced another issue: the
+driver currently parses IEs in board-2.bin one by one, and for each one
+it first checks to see if it matches the ID with the variant appended.
+If it doesn't, it checks to see if it matches the "fallback" ID with no
+variant. If a matching BDF is found at any point during this search, the
+search is terminated and that BDF is used. The issue is that it's very
+possible (and is currently the case for board-2.bin files present in the
+ath10k-firmware repository) for the default BDF to occur in an earlier
+IE than the variant-specific BDF. In this case, the current code will
+happily choose the default BDF even though a better-matching BDF is
+present later in the file.
+
+This patch fixes the issue by first searching the entire file for the ID
+with variant, and searching for the fallback ID only if that search
+fails. It also includes some code cleanup in the area, as
+ath10k_core_fetch_board_data_api_n() no longer does its own string
+mangling to remove the variant from an ID, instead leaving that job to a
+new flag passed to ath10k_core_create_board_name().
+
+I've tested this patch on a QCA4019 and verified that the driver behaves
+correctly for 1) both fallback and variant BDFs present, 2) only fallback
+BDF present, and 3) no matching BDFs present.
+
+Fixes: 1657b8f84ed9 ("ath10k: search SMBIOS for OEM board file extension")
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 134 ++++++++++++++++++---------------
+ 1 file changed, 72 insertions(+), 62 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1132,14 +1132,61 @@ out:
+ 	return ret;
+ }
+ 
++static int ath10k_core_search_bd(struct ath10k *ar,
++				 const char *boardname,
++				 const u8 *data,
++				 size_t len)
++{
++	size_t ie_len;
++	struct ath10k_fw_ie *hdr;
++	int ret = -ENOENT, ie_id;
++
++	while (len > sizeof(struct ath10k_fw_ie)) {
++		hdr = (struct ath10k_fw_ie *)data;
++		ie_id = le32_to_cpu(hdr->id);
++		ie_len = le32_to_cpu(hdr->len);
++
++		len -= sizeof(*hdr);
++		data = hdr->data;
++
++		if (len < ALIGN(ie_len, 4)) {
++			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
++				   ie_id, ie_len, len);
++			return -EINVAL;
++		}
++
++		switch (ie_id) {
++		case ATH10K_BD_IE_BOARD:
++			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
++							    boardname);
++			if (ret == -ENOENT)
++				/* no match found, continue */
++				break;
++
++			/* either found or error, so stop searching */
++			goto out;
++		}
++
++		/* jump over the padding */
++		ie_len = ALIGN(ie_len, 4);
++
++		len -= ie_len;
++		data += ie_len;
++	}
++
++out:
++	/* return result of parse_bd_ie_board() or -ENOENT */
++	return ret;
++}
++
+ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
+ 					      const char *boardname,
++					      const char *fallback_boardname,
+ 					      const char *filename)
+ {
+-	size_t len, magic_len, ie_len;
+-	struct ath10k_fw_ie *hdr;
++	size_t len, magic_len;
+ 	const u8 *data;
+-	int ret, ie_id;
++	int ret;
+ 
+ 	ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
+ 							ar->hw_params.fw.dir,
+@@ -1177,69 +1224,23 @@ static int ath10k_core_fetch_board_data_
+ 	data += magic_len;
+ 	len -= magic_len;
+ 
+-	while (len > sizeof(struct ath10k_fw_ie)) {
+-		hdr = (struct ath10k_fw_ie *)data;
+-		ie_id = le32_to_cpu(hdr->id);
+-		ie_len = le32_to_cpu(hdr->len);
+-
+-		len -= sizeof(*hdr);
+-		data = hdr->data;
+-
+-		if (len < ALIGN(ie_len, 4)) {
+-			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
+-				   ie_id, ie_len, len);
+-			ret = -EINVAL;
+-			goto err;
+-		}
++	/* attempt to find boardname in the IE list */
++	ret = ath10k_core_search_bd(ar, boardname, data, len);
+ 
+-		switch (ie_id) {
+-		case ATH10K_BD_IE_BOARD:
+-			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
+-							    boardname);
+-			if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') {
+-				/* try default bdf if variant was not found */
+-				char *s, *v = ",variant=";
+-				char boardname2[100];
+-
+-				strlcpy(boardname2, boardname,
+-					sizeof(boardname2));
+-
+-				s = strstr(boardname2, v);
+-				if (s)
+-					*s = '\0';  /* strip ",variant=%s" */
+-
+-				ret = ath10k_core_parse_bd_ie_board(ar, data,
+-								    ie_len,
+-								    boardname2);
+-			}
++	/* if we didn't find it and have a fallback name, try that */
++	if (ret == -ENOENT && fallback_boardname)
++		ret = ath10k_core_search_bd(ar, fallback_boardname, data, len);
+ 
+-			if (ret == -ENOENT)
+-				/* no match found, continue */
+-				break;
+-			else if (ret)
+-				/* there was an error, bail out */
+-				goto err;
+-
+-			/* board data found */
+-			goto out;
+-		}
+-
+-		/* jump over the padding */
+-		ie_len = ALIGN(ie_len, 4);
+-
+-		len -= ie_len;
+-		data += ie_len;
+-	}
+-
+-out:
+-	if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) {
++	if (ret == -ENOENT) {
+ 		ath10k_err(ar,
+ 			   "failed to fetch board data for %s from %s/%s\n",
+ 			   boardname, ar->hw_params.fw.dir, filename);
+ 		ret = -ENODATA;
+-		goto err;
+ 	}
+ 
++	if (ret)
++		goto err;
++
+ 	return 0;
+ 
+ err:
+@@ -1248,12 +1249,12 @@ err:
+ }
+ 
+ static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
+-					 size_t name_len)
++					 size_t name_len, bool with_variant)
+ {
+ 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
+ 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
+ 
+-	if (ar->id.bdf_ext[0] != '\0')
++	if (with_variant && ar->id.bdf_ext[0] != '\0')
+ 		scnprintf(variant, sizeof(variant), ",variant=%s",
+ 			  ar->id.bdf_ext);
+ 
+@@ -1279,17 +1280,26 @@ out:
+ 
+ static int ath10k_core_fetch_board_file(struct ath10k *ar)
+ {
+-	char boardname[100];
++	char boardname[100], fallback_boardname[100];
+ 	int ret;
+ 
+-	ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname));
++	ret = ath10k_core_create_board_name(ar, boardname,
++					    sizeof(boardname), true);
+ 	if (ret) {
+ 		ath10k_err(ar, "failed to create board name: %d", ret);
+ 		return ret;
+ 	}
+ 
++	ret = ath10k_core_create_board_name(ar, fallback_boardname,
++					    sizeof(boardname), false);
++	if (ret) {
++		ath10k_err(ar, "failed to create fallback board name: %d", ret);
++		return ret;
++	}
++
+ 	ar->bd_api = 2;
+ 	ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
++						 fallback_boardname,
+ 						 ATH10K_BOARD_API2_FILE);
+ 	if (!ret)
+ 		goto success;
diff --git a/package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/kernel/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
rename to package/kernel/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/210-ap_scan.patch
similarity index 83%
rename from package/kernel/mac80211/patches/subsys/210-ap_scan.patch
rename to package/kernel/mac80211/patches/210-ap_scan.patch
index 7e237a443e..8ade963c9f 100644
--- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2312,7 +2312,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2215,7 +2215,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch b/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
new file mode 100644
index 0000000000..2aeb49dc16
--- /dev/null
+++ b/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
@@ -0,0 +1,72 @@
+From: Brian Norris <briannorris@chromium.org>
+Date: Thu, 19 Oct 2017 11:45:19 -0700
+Subject: [PATCH] ath10k: fix build errors with !CONFIG_PM
+
+Build errors have been reported with CONFIG_PM=n:
+
+drivers/net/wireless/ath/ath10k/pci.c:3416:8: error: implicit
+declaration of function 'ath10k_pci_suspend'
+[-Werror=implicit-function-declaration]
+
+drivers/net/wireless/ath/ath10k/pci.c:3428:8: error: implicit
+declaration of function 'ath10k_pci_resume'
+[-Werror=implicit-function-declaration]
+
+These are caused by the combination of the following two commits:
+
+6af1de2e4ec4 ("ath10k: mark PM functions as __maybe_unused")
+96378bd2c6cd ("ath10k: fix core PCI suspend when WoWLAN is supported but
+disabled")
+
+Both build fine on their own.
+
+But now that ath10k_pci_pm_{suspend,resume}() is compiled
+unconditionally, we should also compile ath10k_pci_{suspend,resume}()
+unconditionally.
+
+And drop the #ifdef around ath10k_pci_hif_{suspend,resume}() too; they
+are trivial (empty), so we're not saving much space by compiling them
+out. And the alternatives would be to sprinkle more __maybe_unused, or
+spread the #ifdef's further.
+
+Build tested with the following combinations:
+CONFIG_PM=y && CONFIG_PM_SLEEP=y
+CONFIG_PM=y && CONFIG_PM_SLEEP=n
+CONFIG_PM=n
+
+Fixes: 96378bd2c6cd ("ath10k: fix core PCI suspend when WoWLAN is supported but disabled")
+Fixes: 096ad2a15fd8 ("Merge branch 'ath-next'")
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+---
+
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -2577,8 +2577,6 @@ void ath10k_pci_hif_power_down(struct at
+ 	 */
+ }
+ 
+-#ifdef CONFIG_PM
+-
+ static int ath10k_pci_hif_suspend(struct ath10k *ar)
+ {
+ 	/* Nothing to do; the important stuff is in the driver suspend. */
+@@ -2627,7 +2625,6 @@ static int ath10k_pci_resume(struct ath1
+ 
+ 	return ret;
+ }
+-#endif
+ 
+ static bool ath10k_pci_validate_cal(void *data, size_t size)
+ {
+@@ -2782,10 +2779,8 @@ static const struct ath10k_hif_ops ath10
+ 	.power_down		= ath10k_pci_hif_power_down,
+ 	.read32			= ath10k_pci_read32,
+ 	.write32		= ath10k_pci_write32,
+-#ifdef CONFIG_PM
+ 	.suspend		= ath10k_pci_hif_suspend,
+ 	.resume			= ath10k_pci_hif_resume,
+-#endif
+ 	.fetch_cal_eeprom	= ath10k_pci_hif_fetch_cal_eeprom,
+ };
+ 
diff --git a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch b/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
new file mode 100644
index 0000000000..ecc5e49120
--- /dev/null
+++ b/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
@@ -0,0 +1,37 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Nov 2017 17:01:44 +0100
+Subject: [PATCH] mac80211: properly free requested-but-not-started TX agg
+ sessions
+
+When deleting a station or otherwise tearing down all aggregation
+sessions, make sure to delete requested but not yet started ones,
+to avoid the following scenario:
+
+ * session is requested, added to tid_start_tx[]
+ * ieee80211_ba_session_work() runs, gets past BLOCK_BA check
+ * ieee80211_sta_tear_down_BA_sessions() runs, locks &sta->ampdu_mlme.mtx,
+   e.g. while deleting the station - deleting all active sessions
+ * ieee80211_ba_session_work() continues since tear down flushes it, and
+   calls ieee80211_tx_ba_session_handle_start() for the new session, arms
+   the timer for it
+ * station deletion continues to __cleanup_single_sta() and frees the
+   session struct, while the timer is armed
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -330,6 +330,11 @@ int ___ieee80211_stop_tx_ba_session(stru
+ 
+ 	spin_lock_bh(&sta->lock);
+ 
++	/* free struct pending for start, if present */
++	tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
++	kfree(tid_tx);
++	sta->ampdu_mlme.tid_start_tx[tid] = NULL;
++
+ 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+ 	if (!tid_tx) {
+ 		spin_unlock_bh(&sta->lock);
diff --git a/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch b/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
new file mode 100644
index 0000000000..839e927880
--- /dev/null
+++ b/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
@@ -0,0 +1,25 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 4 Jan 2018 15:51:53 +0100
+Subject: [PATCH] mac80211: mesh: drop frames appearing to be from us
+
+If there are multiple mesh stations with the same MAC address,
+they will both get confused and start throwing warnings.
+
+Obviously in this case nothing can actually work anyway, so just
+drop frames that look like they're from ourselves early on.
+
+Reported-by: Gui Iribarren <gui@altermundi.net>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc
+ 		}
+ 		return true;
+ 	case NL80211_IFTYPE_MESH_POINT:
++		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
++			return false;
+ 		if (multicast)
+ 			return true;
+ 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch b/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
new file mode 100644
index 0000000000..b8f3be1c8b
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
@@ -0,0 +1,60 @@
+From 2fd3877b5bb7d39782c3205a1dcda02023b8514a Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:31 +0100
+Subject: [PATCH] brcmfmac: handle FWHALT mailbox indication
+
+The firmware uses a mailbox to communicate to the host what is going
+on. In the driver we validate the bit received. Various people seen
+the following message:
+
+ brcmfmac: brcmf_sdio_hostmail: Unknown mailbox data content: 0x40012
+
+Bit 4 is cause of this message, but this actually indicates the firmware
+has halted. Handle this bit by giving a more meaningful error message.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -260,10 +260,11 @@ struct rte_console {
+ #define I_HMB_HOST_INT	I_HMB_SW3	/* Miscellaneous Interrupt */
+ 
+ /* tohostmailboxdata */
+-#define HMB_DATA_NAKHANDLED	1	/* retransmit NAK'd frame */
+-#define HMB_DATA_DEVREADY	2	/* talk to host after enable */
+-#define HMB_DATA_FC		4	/* per prio flowcontrol update flag */
+-#define HMB_DATA_FWREADY	8	/* fw ready for protocol activity */
++#define HMB_DATA_NAKHANDLED	0x0001	/* retransmit NAK'd frame */
++#define HMB_DATA_DEVREADY	0x0002	/* talk to host after enable */
++#define HMB_DATA_FC		0x0004	/* per prio flowcontrol update flag */
++#define HMB_DATA_FWREADY	0x0008	/* fw ready for protocol activity */
++#define HMB_DATA_FWHALT		0x0010	/* firmware halted */
+ 
+ #define HMB_DATA_FCDATA_MASK	0xff000000
+ #define HMB_DATA_FCDATA_SHIFT	24
+@@ -1094,6 +1095,10 @@ static u32 brcmf_sdio_hostmail(struct br
+ 			  offsetof(struct sdpcmd_regs, tosbmailbox));
+ 	bus->sdcnt.f1regdata += 2;
+ 
++	/* dongle indicates the firmware has halted/crashed */
++	if (hmb_data & HMB_DATA_FWHALT)
++		brcmf_err("mailbox indicates firmware halted\n");
++
+ 	/* Dongle recomposed rx frames, accept them again */
+ 	if (hmb_data & HMB_DATA_NAKHANDLED) {
+ 		brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
+@@ -1151,6 +1156,7 @@ static u32 brcmf_sdio_hostmail(struct br
+ 			 HMB_DATA_NAKHANDLED |
+ 			 HMB_DATA_FC |
+ 			 HMB_DATA_FWREADY |
++			 HMB_DATA_FWHALT |
+ 			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
+ 		brcmf_err("Unknown mailbox data content: 0x%02x\n",
+ 			  hmb_data);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch b/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
new file mode 100644
index 0000000000..901663193a
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
@@ -0,0 +1,133 @@
+From 6c219b0088158da839a5be63c5b3d96c145501d2 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:32 +0100
+Subject: [PATCH] brcmfmac: disable packet filtering in promiscuous mode
+
+Disable arp and nd offload to allow all packets sending to host.
+
+Reported-by: Phil Elwell <phil@raspberrypi.org>
+Tested-by: Phil Elwell <phil@raspberrypi.org>
+Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 41 ----------------------
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 38 ++++++++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
+ 3 files changed, 39 insertions(+), 41 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -472,47 +472,6 @@ send_key_to_dongle(struct brcmf_if *ifp,
+ 	return err;
+ }
+ 
+-static s32
+-brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
+-{
+-	s32 err;
+-	u32 mode;
+-
+-	if (enable)
+-		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
+-	else
+-		mode = 0;
+-
+-	/* Try to set and enable ARP offload feature, this may fail, then it  */
+-	/* is simply not supported and err 0 will be returned                 */
+-	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
+-	if (err) {
+-		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
+-			  mode, err);
+-		err = 0;
+-	} else {
+-		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
+-		if (err) {
+-			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
+-				  enable, err);
+-			err = 0;
+-		} else
+-			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
+-				  enable, mode);
+-	}
+-
+-	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
+-	if (err) {
+-		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
+-			  enable, err);
+-		err = 0;
+-	} else
+-		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
+-			  enable, mode);
+-
+-	return err;
+-}
+-
+ static void
+ brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
+ {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -71,6 +71,43 @@ struct brcmf_if *brcmf_get_ifp(struct br
+ 	return ifp;
+ }
+ 
++void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
++{
++	s32 err;
++	u32 mode;
++
++	if (enable)
++		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
++	else
++		mode = 0;
++
++	/* Try to set and enable ARP offload feature, this may fail, then it  */
++	/* is simply not supported and err 0 will be returned                 */
++	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
++	if (err) {
++		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
++			  mode, err);
++	} else {
++		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
++		if (err) {
++			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
++				  enable, err);
++		} else {
++			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
++				  enable, mode);
++		}
++	}
++
++	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
++	if (err) {
++		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
++			  enable, err);
++	} else {
++		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
++			  enable, mode);
++	}
++}
++
+ static void _brcmf_set_multicast_list(struct work_struct *work)
+ {
+ 	struct brcmf_if *ifp;
+@@ -134,6 +171,7 @@ static void _brcmf_set_multicast_list(st
+ 	if (err < 0)
+ 		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
+ 			  err);
++	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
+ }
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -203,6 +203,7 @@ int brcmf_netdev_wait_pend8021x(struct b
+ /* Return pointer to interface name */
+ char *brcmf_ifname(struct brcmf_if *ifp);
+ struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
++void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
+ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
+ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
+ 			      bool is_p2pdev, const char *name, u8 *mac_addr);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
new file mode 100644
index 0000000000..b6f3d0c697
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
@@ -0,0 +1,133 @@
+From 8c6efda22f5f9f73fc948f517424466be01ae84d Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:33 +0100
+Subject: [PATCH] brcmfmac: cleanup brcmf_cfg80211_escan() function
+
+The function brcmf_cfg80211_escan() was always called with a non-null
+request parameter and null pointer for this_ssid parameter. Clean up
+the function removing the dead code path.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 76 ++++------------------
+ 1 file changed, 11 insertions(+), 65 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1072,18 +1072,10 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ 
+ static s32
+ brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
+-		     struct cfg80211_scan_request *request,
+-		     struct cfg80211_ssid *this_ssid)
++		     struct cfg80211_scan_request *request)
+ {
+-	struct brcmf_if *ifp = vif->ifp;
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+-	struct cfg80211_ssid *ssids;
+-	u32 passive_scan;
+-	bool escan_req;
+-	bool spec_scan;
+ 	s32 err;
+-	struct brcmf_ssid_le ssid_le;
+-	u32 SSID_len;
+ 
+ 	brcmf_dbg(SCAN, "START ESCAN\n");
+ 
+@@ -1101,8 +1093,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 			  cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+-	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
+-		brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
++	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
++		brcmf_err("Connecting: status (%lu)\n", vif->sme_state);
+ 		return -EAGAIN;
+ 	}
+ 
+@@ -1110,63 +1102,17 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+ 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+ 
+-	escan_req = false;
+-	if (request) {
+-		/* scan bss */
+-		ssids = request->ssids;
+-		escan_req = true;
+-	} else {
+-		/* scan in ibss */
+-		/* we don't do escan in ibss */
+-		ssids = this_ssid;
+-	}
+-
+ 	cfg->scan_request = request;
+ 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+-	if (escan_req) {
+-		cfg->escan_info.run = brcmf_run_escan;
+-		err = brcmf_p2p_scan_prep(wiphy, request, vif);
+-		if (err)
+-			goto scan_out;
+-
+-		err = brcmf_do_escan(vif->ifp, request);
+-		if (err)
+-			goto scan_out;
+-	} else {
+-		brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
+-			  ssids->ssid, ssids->ssid_len);
+-		memset(&ssid_le, 0, sizeof(ssid_le));
+-		SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
+-		ssid_le.SSID_len = cpu_to_le32(0);
+-		spec_scan = false;
+-		if (SSID_len) {
+-			memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
+-			ssid_le.SSID_len = cpu_to_le32(SSID_len);
+-			spec_scan = true;
+-		} else
+-			brcmf_dbg(SCAN, "Broadcast scan\n");
+-
+-		passive_scan = cfg->active_scan ? 0 : 1;
+-		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
+-					    passive_scan);
+-		if (err) {
+-			brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
+-			goto scan_out;
+-		}
+-		brcmf_scan_config_mpc(ifp, 0);
+-		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
+-					     sizeof(ssid_le));
+-		if (err) {
+-			if (err == -EBUSY)
+-				brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
+-					  ssid_le.SSID);
+-			else
+-				brcmf_err("WLC_SCAN error (%d)\n", err);
+-
+-			brcmf_scan_config_mpc(ifp, 1);
+-			goto scan_out;
+-		}
+-	}
++
++	cfg->escan_info.run = brcmf_run_escan;
++	err = brcmf_p2p_scan_prep(wiphy, request, vif);
++	if (err)
++		goto scan_out;
++
++	err = brcmf_do_escan(vif->ifp, request);
++	if (err)
++		goto scan_out;
+ 
+ 	/* Arm scan timeout timer */
+ 	mod_timer(&cfg->escan_timeout, jiffies +
+@@ -1191,7 +1137,7 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 	if (!check_vif_up(vif))
+ 		return -EIO;
+ 
+-	err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
++	err = brcmf_cfg80211_escan(wiphy, vif, request);
+ 
+ 	if (err)
+ 		brcmf_err("scan error (%d)\n", err);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch b/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
new file mode 100644
index 0000000000..c2e3cba52d
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
@@ -0,0 +1,31 @@
+From df2d8388bc96c0f29d27d121f2a4cd054f8b3900 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:34 +0100
+Subject: [PATCH] brcmfmac: use msecs_to_jiffies() instead of calculation using
+ HZ
+
+Minor cleanup using provided macro to convert milliseconds interval
+to jiffies in brcmf_cfg80211_escan().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1115,8 +1115,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 		goto scan_out;
+ 
+ 	/* Arm scan timeout timer */
+-	mod_timer(&cfg->escan_timeout, jiffies +
+-			BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
++	mod_timer(&cfg->escan_timeout,
++		  jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
+ 
+ 	return 0;
+ 
diff --git a/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
new file mode 100644
index 0000000000..575ffb0183
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
@@ -0,0 +1,83 @@
+From 588378f15cff285ac81c929239ccba01d7f71d50 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:35 +0100
+Subject: [PATCH] brcmfmac: get rid of brcmf_cfg80211_escan() function
+
+The function brcmf_cfg80211_escan() is only called by brcmf_cfg80211_scan()
+so there is no reason to split in two function especially since the latter
+does not do an awful lot.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 34 +++++++---------------
+ 1 file changed, 10 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1071,13 +1071,16 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ }
+ 
+ static s32
+-brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
+-		     struct cfg80211_scan_request *request)
++brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+-	s32 err;
++	struct brcmf_cfg80211_vif *vif;
++	s32 err = 0;
+ 
+-	brcmf_dbg(SCAN, "START ESCAN\n");
++	brcmf_dbg(TRACE, "Enter\n");
++	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
++	if (!check_vif_up(vif))
++		return -EIO;
+ 
+ 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+ 		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
+@@ -1102,6 +1105,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+ 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+ 
++	brcmf_dbg(SCAN, "START ESCAN\n");
++
+ 	cfg->scan_request = request;
+ 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 
+@@ -1121,31 +1126,12 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 	return 0;
+ 
+ scan_out:
++	brcmf_err("scan error (%d)\n", err);
+ 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 	cfg->scan_request = NULL;
+ 	return err;
+ }
+ 
+-static s32
+-brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+-{
+-	struct brcmf_cfg80211_vif *vif;
+-	s32 err = 0;
+-
+-	brcmf_dbg(TRACE, "Enter\n");
+-	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
+-	if (!check_vif_up(vif))
+-		return -EIO;
+-
+-	err = brcmf_cfg80211_escan(wiphy, vif, request);
+-
+-	if (err)
+-		brcmf_err("scan error (%d)\n", err);
+-
+-	brcmf_dbg(TRACE, "Exit\n");
+-	return err;
+-}
+-
+ static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
+ {
+ 	s32 err = 0;
diff --git a/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch b/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
new file mode 100644
index 0000000000..4d4235f4b0
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
@@ -0,0 +1,86 @@
+From bbf35414cd23a9d7230bfd7046e1e2c26020e7eb Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:36 +0100
+Subject: [PATCH] brcmfmac: get rid of struct brcmf_cfg80211_info::active_scan
+ field
+
+The field struct brcmf_cfg80211_info::active_scan is set to true upon
+initializing the driver instance, but it is never changed so simply
+get rid of it.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 +---------
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h |  2 --
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      |  5 +----
+ 3 files changed, 2 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1043,7 +1043,6 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ {
+ 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+ 	s32 err;
+-	u32 passive_scan;
+ 	struct brcmf_scan_results *results;
+ 	struct escan_info *escan = &cfg->escan_info;
+ 
+@@ -1051,13 +1050,7 @@ brcmf_do_escan(struct brcmf_if *ifp, str
+ 	escan->ifp = ifp;
+ 	escan->wiphy = cfg->wiphy;
+ 	escan->escan_state = WL_ESCAN_STATE_SCANNING;
+-	passive_scan = cfg->active_scan ? 0 : 1;
+-	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
+-				    passive_scan);
+-	if (err) {
+-		brcmf_err("error (%d)\n", err);
+-		return err;
+-	}
++
+ 	brcmf_scan_config_mpc(ifp, 0);
+ 	results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
+ 	results->version = 0;
+@@ -5767,7 +5760,6 @@ static s32 wl_init_priv(struct brcmf_cfg
+ 
+ 	cfg->scan_request = NULL;
+ 	cfg->pwr_save = true;
+-	cfg->active_scan = true;	/* we do active scan per default */
+ 	cfg->dongle_up = false;		/* dongle is not up yet */
+ 	err = brcmf_init_priv_mem(cfg);
+ 	if (err)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -283,7 +283,6 @@ struct brcmf_cfg80211_wowl {
+  * @scan_status: scan activity on the dongle.
+  * @pub: common driver information.
+  * @channel: current channel.
+- * @active_scan: current scan mode.
+  * @int_escan_map: bucket map for which internal e-scan is done.
+  * @ibss_starter: indicates this sta is ibss starter.
+  * @pwr_save: indicate whether dongle to support power save mode.
+@@ -316,7 +315,6 @@ struct brcmf_cfg80211_info {
+ 	unsigned long scan_status;
+ 	struct brcmf_pub *pub;
+ 	u32 channel;
+-	bool active_scan;
+ 	u32 int_escan_map;
+ 	bool ibss_starter;
+ 	bool pwr_save;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -692,10 +692,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
+ 
+ 	/* determine the scan engine parameters */
+ 	sparams->bss_type = DOT11_BSSTYPE_ANY;
+-	if (p2p->cfg->active_scan)
+-		sparams->scan_type = 0;
+-	else
+-		sparams->scan_type = 1;
++	sparams->scan_type = BRCMF_SCANTYPE_ACTIVE;
+ 
+ 	eth_broadcast_addr(sparams->bssid);
+ 	sparams->home_time = cpu_to_le32(P2PAPI_SCAN_HOME_TIME_MS);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch b/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
new file mode 100644
index 0000000000..3ad6e79db7
--- /dev/null
+++ b/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
@@ -0,0 +1,55 @@
+From bd99a3013bdc00f8fc7534c657b39616792b4467 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 8 Nov 2017 14:36:37 +0100
+Subject: [PATCH] brcmfmac: move configuration of probe request IEs
+
+The configuration of the IEs for probe requests was done in a P2P
+related function, which is not very obvious. Moving it to
+.scan callback function, ie. brcmf_cfg80211_scan().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      | 6 ++----
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1108,6 +1108,11 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 	if (err)
+ 		goto scan_out;
+ 
++	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
++				    request->ie, request->ie_len);
++	if (err)
++		goto scan_out;
++
+ 	err = brcmf_do_escan(vif->ifp, request);
+ 	if (err)
+ 		goto scan_out;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -881,7 +881,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
+-	int err = 0;
++	int err;
+ 
+ 	if (brcmf_p2p_scan_is_p2p_request(request)) {
+ 		/* find my listen channel */
+@@ -904,9 +904,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
+ 		/* override .run_escan() callback. */
+ 		cfg->escan_info.run = brcmf_p2p_run_escan;
+ 	}
+-	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
+-				    request->ie, request->ie_len);
+-	return err;
++	return 0;
+ }
+ 
+ 
diff --git a/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch b/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
new file mode 100644
index 0000000000..2cd5f73126
--- /dev/null
+++ b/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
@@ -0,0 +1,434 @@
+From fdd0bd88ceaecf729db103ac8836af5805dd2dc1 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Fri, 10 Nov 2017 17:27:15 +0800
+Subject: [PATCH] brcmfmac: add CLM download support
+
+The firmware for brcmfmac devices includes information regarding
+regulatory constraints. For certain devices this information is kept
+separately in a binary form that needs to be downloaded to the device.
+This patch adds support to download this so-called CLM blob file. It
+uses the same naming scheme as the other firmware files with extension
+of .clm_blob.
+
+The CLM blob file is optional. If the file does not exist, the download
+process will be bypassed. It will not affect the driver loading.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  10 ++
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 157 +++++++++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   2 +
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |   2 +
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  31 ++++
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  19 +++
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  19 +++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  18 +++
+ 8 files changed, 258 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -71,6 +71,7 @@ struct brcmf_bus_dcmd {
+  * @wowl_config: specify if dongle is configured for wowl when going to suspend
+  * @get_ramsize: obtain size of device memory.
+  * @get_memdump: obtain device memory dump in provided buffer.
++ * @get_fwname: obtain firmware name.
+  *
+  * This structure provides an abstract interface towards the
+  * bus specific driver. For control messages to common driver
+@@ -87,6 +88,8 @@ struct brcmf_bus_ops {
+ 	void (*wowl_config)(struct device *dev, bool enabled);
+ 	size_t (*get_ramsize)(struct device *dev);
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
++	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
++			  unsigned char *fw_name);
+ };
+ 
+ 
+@@ -224,6 +227,13 @@ int brcmf_bus_get_memdump(struct brcmf_b
+ 	return bus->ops->get_memdump(bus->dev, data, len);
+ }
+ 
++static inline
++int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
++			 unsigned char *fw_name)
++{
++	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
++}
++
+ /*
+  * interface functions from common layer
+  */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -18,6 +18,7 @@
+ #include <linux/string.h>
+ #include <linux/netdevice.h>
+ #include <linux/module.h>
++#include <linux/firmware.h>
+ #include <brcmu_wifi.h>
+ #include <brcmu_utils.h>
+ #include "core.h"
+@@ -28,6 +29,7 @@
+ #include "tracepoint.h"
+ #include "common.h"
+ #include "of.h"
++#include "firmware.h"
+ 
+ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+@@ -104,12 +106,140 @@ void brcmf_c_set_joinpref_default(struct
+ 		brcmf_err("Set join_pref error (%d)\n", err);
+ }
+ 
++static int brcmf_c_download(struct brcmf_if *ifp, u16 flag,
++			    struct brcmf_dload_data_le *dload_buf,
++			    u32 len)
++{
++	s32 err;
++
++	flag |= (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT);
++	dload_buf->flag = cpu_to_le16(flag);
++	dload_buf->dload_type = cpu_to_le16(DL_TYPE_CLM);
++	dload_buf->len = cpu_to_le32(len);
++	dload_buf->crc = cpu_to_le32(0);
++	len = sizeof(*dload_buf) + len - 1;
++
++	err = brcmf_fil_iovar_data_set(ifp, "clmload", dload_buf, len);
++
++	return err;
++}
++
++static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
++{
++	struct brcmf_bus *bus = ifp->drvr->bus_if;
++	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
++	u8 fw_name[BRCMF_FW_NAME_LEN];
++	u8 *ptr;
++	size_t len;
++	s32 err;
++
++	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
++	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
++	if (err) {
++		brcmf_err("get firmware name failed (%d)\n", err);
++		goto done;
++	}
++
++	/* generate CLM blob file name */
++	ptr = strrchr(fw_name, '.');
++	if (!ptr) {
++		err = -ENOENT;
++		goto done;
++	}
++
++	len = ptr - fw_name + 1;
++	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
++		err = -E2BIG;
++	} else {
++		strlcpy(clm_name, fw_name, len);
++		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
++	}
++done:
++	return err;
++}
++
++static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
++{
++	struct device *dev = ifp->drvr->bus_if->dev;
++	struct brcmf_dload_data_le *chunk_buf;
++	const struct firmware *clm = NULL;
++	u8 clm_name[BRCMF_FW_NAME_LEN];
++	u32 chunk_len;
++	u32 datalen;
++	u32 cumulative_len;
++	u16 dl_flag = DL_BEGIN;
++	u32 status;
++	s32 err;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
++	err = brcmf_c_get_clm_name(ifp, clm_name);
++	if (err) {
++		brcmf_err("get CLM blob file name failed (%d)\n", err);
++		return err;
++	}
++
++	err = request_firmware(&clm, clm_name, dev);
++	if (err) {
++		if (err == -ENOENT) {
++			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
++			return 0;
++		}
++		brcmf_err("request CLM blob file failed (%d)\n", err);
++		return err;
++	}
++
++	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
++	if (!chunk_buf) {
++		err = -ENOMEM;
++		goto done;
++	}
++
++	datalen = clm->size;
++	cumulative_len = 0;
++	do {
++		if (datalen > MAX_CHUNK_LEN) {
++			chunk_len = MAX_CHUNK_LEN;
++		} else {
++			chunk_len = datalen;
++			dl_flag |= DL_END;
++		}
++		memcpy(chunk_buf->data, clm->data + cumulative_len, chunk_len);
++
++		err = brcmf_c_download(ifp, dl_flag, chunk_buf, chunk_len);
++
++		dl_flag &= ~DL_BEGIN;
++
++		cumulative_len += chunk_len;
++		datalen -= chunk_len;
++	} while ((datalen > 0) && (err == 0));
++
++	if (err) {
++		brcmf_err("clmload (%zu byte file) failed (%d); ",
++			  clm->size, err);
++		/* Retrieve clmload_status and print */
++		err = brcmf_fil_iovar_int_get(ifp, "clmload_status", &status);
++		if (err)
++			brcmf_err("get clmload_status failed (%d)\n", err);
++		else
++			brcmf_dbg(INFO, "clmload_status=%d\n", status);
++		err = -EIO;
++	}
++
++	kfree(chunk_buf);
++done:
++	release_firmware(clm);
++	return err;
++}
++
+ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ {
+ 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+ 	u8 buf[BRCMF_DCMD_SMLEN];
+ 	struct brcmf_rev_info_le revinfo;
+ 	struct brcmf_rev_info *ri;
++	char *clmver;
+ 	char *ptr;
+ 	s32 err;
+ 
+@@ -148,6 +278,13 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	}
+ 	ri->result = err;
+ 
++	/* Do any CLM downloading */
++	err = brcmf_c_process_clm_blob(ifp);
++	if (err < 0) {
++		brcmf_err("download CLM blob file failed, %d\n", err);
++		goto done;
++	}
++
+ 	/* query for 'ver' to get version info from firmware */
+ 	memset(buf, 0, sizeof(buf));
+ 	strcpy(buf, "ver");
+@@ -167,6 +304,26 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	ptr = strrchr(buf, ' ') + 1;
+ 	strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
+ 
++	/* Query for 'clmver' to get CLM version info from firmware */
++	memset(buf, 0, sizeof(buf));
++	err = brcmf_fil_iovar_data_get(ifp, "clmver", buf, sizeof(buf));
++	if (err) {
++		brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
++	} else {
++		clmver = (char *)buf;
++		/* store CLM version for adding it to revinfo debugfs file */
++		memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
++
++		/* Replace all newline/linefeed characters with space
++		 * character
++		 */
++		ptr = clmver;
++		while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
++			*ptr = ' ';
++
++		brcmf_dbg(INFO, "CLM version = %s\n", clmver);
++	}
++
+ 	/* set mpc */
+ 	err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
+ 	if (err) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1009,6 +1009,8 @@ static int brcmf_revinfo_read(struct seq
+ 	seq_printf(s, "anarev: %u\n", ri->anarev);
+ 	seq_printf(s, "nvramrev: %08x\n", ri->nvramrev);
+ 
++	seq_printf(s, "clmver: %s\n", bus_if->drvr->clmver);
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -141,6 +141,8 @@ struct brcmf_pub {
+ 	struct notifier_block inetaddr_notifier;
+ 	struct notifier_block inet6addr_notifier;
+ 	struct brcmf_mp_device *settings;
++
++	u8 clmver[BRCMF_DCMD_SMLEN];
+ };
+ 
+ /* forward declarations */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -155,6 +155,21 @@
+ #define BRCMF_MFP_CAPABLE		1
+ #define BRCMF_MFP_REQUIRED		2
+ 
++/* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
++ * ioctl. It is relatively small because firmware has small maximum size input
++ * playload restriction for ioctls.
++ */
++#define MAX_CHUNK_LEN			1400
++
++#define DLOAD_HANDLER_VER		1	/* Downloader version */
++#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
++#define DLOAD_FLAG_VER_SHIFT		12	/* Downloader version shift */
++
++#define DL_BEGIN			0x0002
++#define DL_END				0x0004
++
++#define DL_TYPE_CLM			2
++
+ /* join preference types for join_pref iovar */
+ enum brcmf_join_pref_types {
+ 	BRCMF_JOIN_PREF_RSSI = 1,
+@@ -827,6 +842,22 @@ struct brcmf_pno_macaddr_le {
+ };
+ 
+ /**
++ * struct brcmf_dload_data_le - data passing to firmware for downloading
++ * @flag: flags related to download data.
++ * @dload_type: type of download data.
++ * @len: length in bytes of download data.
++ * @crc: crc of download data.
++ * @data: download data.
++ */
++struct brcmf_dload_data_le {
++	__le16 flag;
++	__le16 dload_type;
++	__le32 len;
++	__le32 crc;
++	u8 data[1];
++};
++
++/**
+  * struct brcmf_pno_bssid_le - bssid configuration for PNO scan.
+  *
+  * @bssid: BSS network identifier.
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1350,6 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
+ 	return 0;
+ }
+ 
++static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
++				 u8 *fw_name)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
++	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
++	int ret = 0;
++
++	if (devinfo->fw_name[0] != '\0')
++		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
++	else
++		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
++						brcmf_pcie_fwnames,
++						ARRAY_SIZE(brcmf_pcie_fwnames),
++						fw_name, NULL);
++
++	return ret;
++}
+ 
+ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
+ 	.txdata = brcmf_pcie_tx,
+@@ -1359,6 +1377,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.wowl_config = brcmf_pcie_wowl_config,
+ 	.get_ramsize = brcmf_pcie_get_ramsize,
+ 	.get_memdump = brcmf_pcie_get_memdump,
++	.get_fwname = brcmf_pcie_get_fwname,
+ };
+ 
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3985,6 +3985,24 @@ brcmf_sdio_watchdog(unsigned long data)
+ 	}
+ }
+ 
++static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
++				 u8 *fw_name)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	int ret = 0;
++
++	if (sdiodev->fw_name[0] != '\0')
++		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
++	else
++		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
++						brcmf_sdio_fwnames,
++						ARRAY_SIZE(brcmf_sdio_fwnames),
++						fw_name, NULL);
++
++	return ret;
++}
++
+ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
+ 	.stop = brcmf_sdio_bus_stop,
+ 	.preinit = brcmf_sdio_bus_preinit,
+@@ -3995,6 +4013,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.wowl_config = brcmf_sdio_wowl_config,
+ 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
+ 	.get_memdump = brcmf_sdio_bus_get_memdump,
++	.get_fwname = brcmf_sdio_get_fwname,
+ };
+ 
+ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1128,12 +1128,30 @@ static void brcmf_usb_wowl_config(struct
+ 		device_set_wakeup_enable(devinfo->dev, false);
+ }
+ 
++static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
++				u8 *fw_name)
++{
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++	int ret = 0;
++
++	if (devinfo->fw_name[0] != '\0')
++		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
++	else
++		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
++						brcmf_usb_fwnames,
++						ARRAY_SIZE(brcmf_usb_fwnames),
++						fw_name, NULL);
++
++	return ret;
++}
++
+ static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
+ 	.txdata = brcmf_usb_tx,
+ 	.stop = brcmf_usb_down,
+ 	.txctl = brcmf_usb_tx_ctlpkt,
+ 	.rxctl = brcmf_usb_rx_ctlpkt,
+ 	.wowl_config = brcmf_usb_wowl_config,
++	.get_fwname = brcmf_usb_get_fwname,
+ };
+ 
+ static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
diff --git a/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch b/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
new file mode 100644
index 0000000000..3649bdda49
--- /dev/null
+++ b/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
@@ -0,0 +1,37 @@
+From 5c3de777bdaf48bd0cfb43097c0d0fb85056cab7 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Sat, 25 Nov 2017 21:39:25 +0100
+Subject: [PATCH] brcmfmac: change driver unbind order of the sdio function
+ devices
+
+In the function brcmf_sdio_firmware_callback() the driver is
+unbound from the sdio function devices in the error path.
+However, the order in which it is done resulted in a use-after-free
+issue (see brcmf_ops_sdio_remove() in bcmsdh.c). Hence change
+the order and first unbind sdio function #2 device and then
+unbind sdio function #1 device.
+
+Cc: stable@vger.kernel.org # v4.12.x
+Fixes: 7a51461fc2da ("brcmfmac: unbind all devices upon failure in firmware callback")
+Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4121,8 +4121,8 @@ release:
+ 	sdio_release_host(sdiodev->func[1]);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(dev);
+ 	device_release_driver(&sdiodev->func[2]->dev);
++	device_release_driver(dev);
+ }
+ 
+ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch b/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
new file mode 100644
index 0000000000..7344580d34
--- /dev/null
+++ b/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
@@ -0,0 +1,33 @@
+From 51ef7925e10688c57186d438e784532e063492e4 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 23 Nov 2017 17:57:04 +0200
+Subject: [PATCH] brcmfmac: Avoid build error with make W=1
+
+When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for
+the first run, all next ones are okay.
+
+  CC [M]  drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
+scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed
+
+Seems like something happened with W=1 and wrong kernel doc format.
+As a quick fix remove dubious /** in the code.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2070,7 +2070,7 @@ static int brcmf_sdio_txpkt_hdalign(stru
+ 	return head_pad;
+ }
+ 
+-/**
++/*
+  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+  * bus layer usage.
+  */
diff --git a/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch b/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
new file mode 100644
index 0000000000..ead5e72145
--- /dev/null
+++ b/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
@@ -0,0 +1,40 @@
+From cc124d5cc8d81985c3511892d7a6d546552ff754 Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Tue, 16 Jan 2018 17:26:50 +0800
+Subject: [PATCH] brcmfmac: fix CLM load error for legacy chips when user
+ helper is enabled
+
+For legacy chips without CLM blob files, kernel with user helper function
+returns -EAGAIN when we request_firmware(), and then driver got failed
+when bringing up legacy chips. We expect the CLM blob file for legacy chip
+is not existence in firmware path, but the -ENOENT error is transferred to
+-EAGAIN in firmware_class.c with user helper.
+Because of that, we continue with CLM data currently present in firmware
+if getting error from doing request_firmware().
+
+Cc: stable@vger.kernel.org # v4.15.y
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -182,12 +182,9 @@ static int brcmf_c_process_clm_blob(stru
+ 
+ 	err = request_firmware(&clm, clm_name, dev);
+ 	if (err) {
+-		if (err == -ENOENT) {
+-			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
+-			return 0;
+-		}
+-		brcmf_err("request CLM blob file failed (%d)\n", err);
+-		return err;
++		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
++			   err);
++		return 0;
+ 	}
+ 
+ 	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch b/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
new file mode 100644
index 0000000000..703051fe19
--- /dev/null
+++ b/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
@@ -0,0 +1,103 @@
+From 9df7ddc3ed25b7d3473f117a0680b9418adb5753 Mon Sep 17 00:00:00 2001
+Message-Id: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 27 Nov 2017 18:56:22 +0100
+Subject: [PATCH 1/2] ath9k: move spectral scan support under a separate config
+ symbol
+
+At the moment, spectral scan support, and with it RELAY, is always enabled
+with ATH9K[_HTC]_DEBUGFS. Spectral scan support is currently the only user
+of RELAY in ath9k, and it unconditionally reserves a relay channel.
+
+Having debugfs support in ath9k is often useful even on very small embedded
+routers, where we'd rather like to avoid the code size and RAM usage of the
+relay support.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+---
+ drivers/net/wireless/ath/ath9k/Kconfig           | 14 ++++++++++----
+ drivers/net/wireless/ath/ath9k/Makefile          |  4 ++--
+ drivers/net/wireless/ath/ath9k/common-spectral.h |  4 ++--
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/Kconfig
++++ b/drivers/net/wireless/ath/ath9k/Kconfig
+@@ -64,13 +64,12 @@ config ATH9K_DEBUGFS
+ 	depends on ATH9K && DEBUG_FS
+ 	select MAC80211_DEBUGFS
+ 	select ATH9K_COMMON_DEBUG
+-	depends on RELAY
+ 	---help---
+ 	  Say Y, if you need access to ath9k's statistics for
+ 	  interrupts, rate control, etc.
+ 
+-	  Also required for changing debug message flags at run time.
+-	  As well as access to the FFT/spectral data and TX99.
++	  Also required for changing debug message flags at run time and for
++	  TX99.
+ 
+ config ATH9K_STATION_STATISTICS
+ 	bool "Detailed station statistics"
+@@ -181,7 +180,6 @@ config ATH9K_HTC_DEBUGFS
+ 	bool "Atheros ath9k_htc debugging"
+ 	depends on ATH9K_HTC && DEBUG_FS
+ 	select ATH9K_COMMON_DEBUG
+-	depends on RELAY
+ 	---help---
+ 	  Say Y, if you need access to ath9k_htc's statistics.
+ 	  As well as access to the FFT/spectral data.
+@@ -197,3 +195,11 @@ config ATH9K_HWRNG
+ 
+ 	  Say Y, feeds the entropy directly from the WiFi driver to the input
+ 	  pool.
++
++config ATH9K_COMMON_SPECTRAL
++	bool "Atheros ath9k/ath9k_htc spectral scan support"
++	depends on ATH9K_DEBUGFS || ATH9K_HTC_DEBUGFS
++	depends on RELAY
++	default n
++	---help---
++	  Say Y to enable access to the FFT/spectral data via debugfs.
+--- a/drivers/net/wireless/ath/ath9k/Makefile
++++ b/drivers/net/wireless/ath/ath9k/Makefile
+@@ -61,8 +61,8 @@ ath9k_common-y:=	common.o \
+ 			common-init.o \
+ 			common-beacon.o \
+ 
+-ath9k_common-$(CPTCFG_ATH9K_COMMON_DEBUG) += common-debug.o \
+-					     common-spectral.o
++ath9k_common-$(CPTCFG_ATH9K_COMMON_DEBUG) += common-debug.o
++ath9k_common-$(CPTCFG_ATH9K_COMMON_SPECTRAL) += common-spectral.o
+ 
+ ath9k_htc-y +=	htc_hst.o \
+ 		hif_usb.o \
+--- a/drivers/net/wireless/ath/ath9k/common-spectral.h
++++ b/drivers/net/wireless/ath/ath9k/common-spectral.h
+@@ -151,7 +151,7 @@ static inline u8 spectral_bitmap_weight(
+ 	return bins[0] & 0x3f;
+ }
+ 
+-#ifdef CPTCFG_ATH9K_COMMON_DEBUG
++#ifdef CPTCFG_ATH9K_COMMON_SPECTRAL
+ void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, struct dentry *debugfs_phy);
+ void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv);
+ 
+@@ -183,6 +183,6 @@ static inline int ath_cmn_process_fft(st
+ {
+ 	return 0;
+ }
+-#endif /* CPTCFG_ATH9K_COMMON_DEBUG */
++#endif /* CPTCFG_ATH9K_COMMON_SPECTRAL */
+ 
+ #endif /* SPECTRAL_H */
+--- a/local-symbols
++++ b/local-symbols
+@@ -116,6 +116,7 @@ ATH9K_PCOEM=
+ ATH9K_HTC=
+ ATH9K_HTC_DEBUGFS=
+ ATH9K_HWRNG=
++ATH9K_COMMON_SPECTRAL=
+ CARL9170=
+ CARL9170_LEDS=
+ CARL9170_DEBUGFS=
diff --git a/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch b/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
new file mode 100644
index 0000000000..604a6f1585
--- /dev/null
+++ b/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
@@ -0,0 +1,91 @@
+From 42e01cb9cb109fb0bb4743f6c54d6aa67ac39b61 Mon Sep 17 00:00:00 2001
+Message-Id: <42e01cb9cb109fb0bb4743f6c54d6aa67ac39b61.1515610034.git.mschiffer@universe-factory.net>
+In-Reply-To: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
+References: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 27 Nov 2017 18:56:23 +0100
+Subject: [PATCH 2/2] ath10k: move spectral scan support under a separate
+ config symbol
+
+At the moment, spectral scan support, and with it RELAY, is always enabled
+with ATH10K_DEBUGFS. Spectral scan support is currently the only user of
+RELAY in ath10k, and it unconditionally reserves a relay channel.
+
+Having debugfs support in ath10k is often useful even on very small
+embedded routers, where we'd rather like to avoid the code size and RAM
+usage of the relay support. While ath10k-based devices usually have more
+resources than ath9k-based ones, it makes sense to keep the configuration
+symmetric to ath9k, so the same base kernel without RELAY can be used for
+both ath9k and ath10k hardware.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+---
+ drivers/net/wireless/ath/ath10k/Kconfig    | 9 ++++++++-
+ drivers/net/wireless/ath/ath10k/Makefile   | 2 +-
+ drivers/net/wireless/ath/ath10k/spectral.h | 4 ++--
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/Kconfig
++++ b/drivers/net/wireless/ath/ath10k/Kconfig
+@@ -51,12 +51,19 @@ config ATH10K_DEBUG
+ config ATH10K_DEBUGFS
+ 	bool "Atheros ath10k debugfs support"
+ 	depends on ATH10K && DEBUG_FS
+-	depends on RELAY
+ 	---help---
+ 	  Enabled debugfs support
+ 
+ 	  If unsure, say Y to make it easier to debug problems.
+ 
++config ATH10K_SPECTRAL
++	bool "Atheros ath10k spectral scan support"
++	depends on ATH10K_DEBUGFS
++	depends on RELAY
++	default n
++	---help---
++	  Say Y to enable access to the FFT/spectral data via debugfs.
++
+ config ATH10K_TRACING
+ 	depends on !KERNEL_3_4
+ 	bool "Atheros ath10k tracing support"
+--- a/drivers/net/wireless/ath/ath10k/Makefile
++++ b/drivers/net/wireless/ath/ath10k/Makefile
+@@ -14,7 +14,7 @@ ath10k_core-y += mac.o \
+ 		 p2p.o \
+ 		 swap.o
+ 
+-ath10k_core-$(CPTCFG_ATH10K_DEBUGFS) += spectral.o
++ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) += spectral.o
+ ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
+ ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
+ ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
+--- a/drivers/net/wireless/ath/ath10k/spectral.h
++++ b/drivers/net/wireless/ath/ath10k/spectral.h
+@@ -44,7 +44,7 @@ enum ath10k_spectral_mode {
+ 	SPECTRAL_MANUAL,
+ };
+ 
+-#ifdef CPTCFG_ATH10K_DEBUGFS
++#ifdef CPTCFG_ATH10K_SPECTRAL
+ 
+ int ath10k_spectral_process_fft(struct ath10k *ar,
+ 				struct wmi_phyerr_ev_arg *phyerr,
+@@ -85,6 +85,6 @@ static inline void ath10k_spectral_destr
+ {
+ }
+ 
+-#endif /* CPTCFG_ATH10K_DEBUGFS */
++#endif /* CPTCFG_ATH10K_SPECTRAL */
+ 
+ #endif /* SPECTRAL_H */
+--- a/local-symbols
++++ b/local-symbols
+@@ -140,6 +140,7 @@ ATH10K_SDIO=
+ ATH10K_USB=
+ ATH10K_DEBUG=
+ ATH10K_DEBUGFS=
++ATH10K_SPECTRAL=
+ ATH10K_TRACING=
+ ATH10K_DFS_CERTIFIED=
+ WCN36XX=
diff --git a/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch b/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
new file mode 100644
index 0000000000..b2b2fcf4aa
--- /dev/null
+++ b/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 17 Jan 2018 11:11:17 +0100
+Subject: [PATCH] ath9k: discard undersized packets
+
+Sometimes the hardware will push small packets that trigger a WARN_ON
+in mac80211. Discard them early to avoid this issue.
+
+Reported-by: Stijn Tintel <stijn@linux-ipv6.be>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -826,9 +826,9 @@ static int ath9k_rx_skb_preprocess(struc
+ 	sc->rx.discard_next = false;
+ 
+ 	/*
+-	 * Discard zero-length packets.
++	 * Discard zero-length packets and packets smaller than an ACK
+ 	 */
+-	if (!rx_stats->rs_datalen) {
++	if (rx_stats->rs_datalen < 10) {
+ 		RX_STAT_INC(rx_len_err);
+ 		goto corrupt;
+ 	}
diff --git a/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch b/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
new file mode 100644
index 0000000000..616a82119f
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
@@ -0,0 +1,39 @@
+From 1fd3ae124d5e675f57cf7e3c601fb8f7712e0329 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:38 +0100
+Subject: [PATCH] brcmfmac: Fix parameter order in brcmf_sdiod_f0_writeb()
+
+All the other IO functions are the other way round in this
+driver. Make this one match.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -230,8 +230,8 @@ void brcmf_sdiod_change_state(struct brc
+ 	sdiodev->state = state;
+ }
+ 
+-static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func,
+-					uint regaddr, u8 byte)
++static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
++					uint regaddr)
+ {
+ 	int err_ret;
+ 
+@@ -269,8 +269,8 @@ static int brcmf_sdiod_request_data(stru
+ 			if (fn)
+ 				sdio_writeb(func, *(u8 *)data, addr, &ret);
+ 			else
+-				ret = brcmf_sdiod_f0_writeb(func, addr,
+-							    *(u8 *)data);
++				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
++							    addr);
+ 		} else {
+ 			if (fn)
+ 				*(u8 *)data = sdio_readb(func, addr, &ret);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch b/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
new file mode 100644
index 0000000000..719268f8fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
@@ -0,0 +1,105 @@
+From 1e6f676f43aa4270ebc5cff8e32a55f72362e042 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:39 +0100
+Subject: [PATCH] brcmfmac: Register sizes on hardware are not dependent on
+ compiler types
+
+The 4 IO functions in this patch are incorrect as they use compiler types
+to determine how many bytes to send to the hardware.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -264,7 +264,7 @@ static int brcmf_sdiod_request_data(stru
+ 	func = sdiodev->func[fn];
+ 
+ 	switch (regsz) {
+-	case sizeof(u8):
++	case 1:
+ 		if (write) {
+ 			if (fn)
+ 				sdio_writeb(func, *(u8 *)data, addr, &ret);
+@@ -278,13 +278,13 @@ static int brcmf_sdiod_request_data(stru
+ 				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
+ 		}
+ 		break;
+-	case sizeof(u16):
++	case 2:
+ 		if (write)
+ 			sdio_writew(func, *(u16 *)data, addr, &ret);
+ 		else
+ 			*(u16 *)data = sdio_readw(func, addr, &ret);
+ 		break;
+-	case sizeof(u32):
++	case 4:
+ 		if (write)
+ 			sdio_writel(func, *(u32 *)data, addr, &ret);
+ 		else
+@@ -368,7 +368,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
+ 	for (i = 0; i < 3; i++) {
+ 		err = brcmf_sdiod_regrw_helper(sdiodev,
+ 					       SBSDIO_FUNC1_SBADDRLOW + i,
+-					       sizeof(u8), &addr[i], true);
++					       1, &addr[i], true);
+ 		if (err) {
+ 			brcmf_err("failed at addr: 0x%0x\n",
+ 				  SBSDIO_FUNC1_SBADDRLOW + i);
+@@ -407,7 +407,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+ 					  false);
+ 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
+ 
+@@ -423,10 +423,10 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+ 					  false);
+ 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+@@ -443,7 +443,7 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+ 					  true);
+ 	if (ret)
+ 		*ret = retval;
+@@ -455,10 +455,10 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+-	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
++	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+ 					  true);
+ 
+ done:
+@@ -876,7 +876,7 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
+ 
+ 	/* issue abort cmd52 command through F0 */
+ 	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+-				 sizeof(t_func), &t_func, true);
++				 1, &t_func, true);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch b/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
new file mode 100644
index 0000000000..b04465ae4f
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
@@ -0,0 +1,179 @@
+From 0fcc9fe0048422d66bb906eaa73cc75e11ff7345 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:40 +0100
+Subject: [PATCH] brcmfmac: Split brcmf_sdiod_regrw_helper() up.
+
+This large function is concealing a LOT of obscure logic about
+how the hardware functions. Time to split it up.
+
+This first patch splits the function into two pieces - read and write,
+doing away with the rw flag in the process.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 94 +++++++++++++++++-----
+ 1 file changed, 73 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -302,8 +302,8 @@ static int brcmf_sdiod_request_data(stru
+ 	return ret;
+ }
+ 
+-static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-				   u8 regsz, void *data, bool write)
++static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
++				 u8 regsz, void *data)
+ {
+ 	u8 func;
+ 	s32 retry = 0;
+@@ -324,13 +324,66 @@ static int brcmf_sdiod_regrw_helper(stru
+ 		func = SDIO_FUNC_1;
+ 
+ 	do {
+-		if (!write)
+-			memset(data, 0, regsz);
+ 		/* for retry wait for 1 ms till bus get settled down */
+ 		if (retry)
+ 			usleep_range(1000, 2000);
++
++		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
++					       data, true);
++
++	} while (ret != 0 && ret != -ENOMEDIUM &&
++		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
++
++	if (ret == -ENOMEDIUM) {
++		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++	} else if (ret != 0) {
++		/*
++		 * SleepCSR register access can fail when
++		 * waking up the device so reduce this noise
++		 * in the logs.
++		 */
++		if (addr != SBSDIO_FUNC1_SLEEPCSR)
++			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
++		else
++			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
++	}
++
++	return ret;
++}
++
++static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
++				u8 regsz, void *data)
++{
++	u8 func;
++	s32 retry = 0;
++	int ret;
++
++	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
++		return -ENOMEDIUM;
++
++	/*
++	 * figure out how to read the register based on address range
++	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
++	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
++	 * The rest: function 1 silicon backplane core registers
++	 */
++	if ((addr & ~REG_F0_REG_MASK) == 0)
++		func = SDIO_FUNC_0;
++	else
++		func = SDIO_FUNC_1;
++
++	do {
++		memset(data, 0, regsz);
++
++		/* for retry wait for 1 ms till bus get settled down */
++		if (retry)
++			usleep_range(1000, 2000);
++
+ 		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
+-					       data, write);
++					       data, false);
++
+ 	} while (ret != 0 && ret != -ENOMEDIUM &&
+ 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+ 
+@@ -343,12 +396,13 @@ static int brcmf_sdiod_regrw_helper(stru
+ 		 * in the logs.
+ 		 */
+ 		if (addr != SBSDIO_FUNC1_SLEEPCSR)
+-			brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
+-				  write ? "write" : "read", func, addr, ret);
++			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
+ 		else
+-			brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+-				  write ? "write" : "read", func, addr, ret);
++			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
++				  func, addr, ret);
+ 	}
++
+ 	return ret;
+ }
+ 
+@@ -366,13 +420,11 @@ brcmf_sdiod_set_sbaddr_window(struct brc
+ 	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
+ 
+ 	for (i = 0; i < 3; i++) {
+-		err = brcmf_sdiod_regrw_helper(sdiodev,
+-					       SBSDIO_FUNC1_SBADDRLOW + i,
+-					       1, &addr[i], true);
++		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
++				  &err);
+ 		if (err) {
+ 			brcmf_err("failed at addr: 0x%0x\n",
+ 				  SBSDIO_FUNC1_SBADDRLOW + i);
+-			break;
+ 		}
+ 	}
+ 
+@@ -407,8 +459,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+-					  false);
++	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
+ 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
+ 
+ 	if (ret)
+@@ -426,8 +477,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+-					  false);
++
++	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
++
+ 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+ done:
+@@ -443,8 +495,8 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
+-					  true);
++	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
++
+ 	if (ret)
+ 		*ret = retval;
+ }
+@@ -458,8 +510,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
+ 	if (retval)
+ 		goto done;
+-	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
+-					  true);
++
++	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
+ 
+ done:
+ 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch b/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
new file mode 100644
index 0000000000..1f0488a621
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
@@ -0,0 +1,62 @@
+From b9b0d290bc0c90a5a262bc89c9d995988ea98669 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:41 +0100
+Subject: [PATCH] brcmfmac: Clean up brcmf_sdiod_set_sbaddr_window()
+
+This function sets the address of the IO window used for
+SDIO accesses onto the backplane of the chip.
+
+It currently uses 3 separate masks despite the full mask being
+defined in the code already. Remove the separate masks and clean up.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c   | 17 +++++------------
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h |  3 ---
+ 2 files changed, 5 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -410,23 +410,16 @@ static int
+ brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
+ {
+ 	int err = 0, i;
+-	u8 addr[3];
++	u32 addr;
+ 
+ 	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+ 		return -ENOMEDIUM;
+ 
+-	addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
+-	addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
+-	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
++	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
+ 
+-	for (i = 0; i < 3; i++) {
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
+-				  &err);
+-		if (err) {
+-			brcmf_err("failed at addr: 0x%0x\n",
+-				  SBSDIO_FUNC1_SBADDRLOW + i);
+-		}
+-	}
++	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
++		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
++				  addr & 0xff, &err);
+ 
+ 	return err;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -133,9 +133,6 @@
+ 
+ /* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+ 
+-#define SBSDIO_SBADDRLOW_MASK		0x80	/* Valid bits in SBADDRLOW */
+-#define SBSDIO_SBADDRMID_MASK		0xff	/* Valid bits in SBADDRMID */
+-#define SBSDIO_SBADDRHIGH_MASK		0xffU	/* Valid bits in SBADDRHIGH */
+ /* Address bits from SBADDR regs */
+ #define SBSDIO_SBWINDOW_MASK		0xffff8000
+ 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch b/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
new file mode 100644
index 0000000000..7d50ce923d
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
@@ -0,0 +1,91 @@
+From ea243e9077b3545f20d93884e91c50ac0719685a Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:42 +0100
+Subject: [PATCH] brcmfmac: Remove dead IO code
+
+The value passed to brcmf_sdiod_addrprep() is *always* 4
+remove this parameter and the unused code to handle it.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -425,7 +425,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
+ }
+ 
+ static int
+-brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
++brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
+ {
+ 	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+ 	int err = 0;
+@@ -439,9 +439,7 @@ brcmf_sdiod_addrprep(struct brcmf_sdio_d
+ 	}
+ 
+ 	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
+-
+-	if (width == 4)
+-		*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	return 0;
+ }
+@@ -467,7 +465,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (retval)
+ 		goto done;
+ 
+@@ -500,7 +498,7 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+-	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (retval)
+ 		goto done;
+ 
+@@ -736,7 +734,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (err)
+ 		goto done;
+ 
+@@ -757,7 +755,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+ 		  addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (err)
+ 		goto done;
+ 
+@@ -801,7 +799,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 
+ 	memcpy(mypkt->data, buf, nbytes);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+ 	if (!err)
+ 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
+@@ -821,7 +819,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
++	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 	if (err)
+ 		return err;
+ 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch b/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
new file mode 100644
index 0000000000..fef29fc715
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
@@ -0,0 +1,61 @@
+From 4a3338ba2a7421db2260159cca5a27bd2ee36d00 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:43 +0100
+Subject: [PATCH] brcmfmac: Remove bandaid for SleepCSR
+
+Register access code is not the place for band-aid fixes like this.
+If this is a genuine problem, it should be fixed further up in the driver
+stack.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 28 +---------------------
+ 1 file changed, 1 insertion(+), 27 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -334,21 +334,8 @@ static int brcmf_sdiod_reg_write(struct
+ 	} while (ret != 0 && ret != -ENOMEDIUM &&
+ 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+ 
+-	if (ret == -ENOMEDIUM) {
++	if (ret == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+-	} else if (ret != 0) {
+-		/*
+-		 * SleepCSR register access can fail when
+-		 * waking up the device so reduce this noise
+-		 * in the logs.
+-		 */
+-		if (addr != SBSDIO_FUNC1_SLEEPCSR)
+-			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-		else
+-			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-	}
+ 
+ 	return ret;
+ }
+@@ -389,19 +376,6 @@ static int brcmf_sdiod_reg_read(struct b
+ 
+ 	if (ret == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+-	else if (ret != 0) {
+-		/*
+-		 * SleepCSR register access can fail when
+-		 * waking up the device so reduce this noise
+-		 * in the logs.
+-		 */
+-		if (addr != SBSDIO_FUNC1_SLEEPCSR)
+-			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-		else
+-			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
+-				  func, addr, ret);
+-	}
+ 
+ 	return ret;
+ }
diff --git a/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch b/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
new file mode 100644
index 0000000000..552f9fb443
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
@@ -0,0 +1,344 @@
+From 993a98a42e6e790fd0d2bf7d55a031513c7ba7dc Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:44 +0100
+Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_request_data()
+
+This function is obfuscating how IO works on this chip. Remove it
+and push its logic into brcmf_sdiod_reg_{read,write}().
+
+Handling of -ENOMEDIUM is altered, but as that's pretty much broken anyway
+we can ignore that.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 237 ++++++++-------------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   2 +-
+ 2 files changed, 87 insertions(+), 152 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -230,6 +230,43 @@ void brcmf_sdiod_change_state(struct brc
+ 	sdiodev->state = state;
+ }
+ 
++static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
++					 u32 address)
++{
++	int err = 0, i;
++	u32 addr;
++
++	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
++		return -ENOMEDIUM;
++
++	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
++
++	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
++		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
++				  addr & 0xff, &err);
++
++	return err;
++}
++
++static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
++{
++	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
++	int err = 0;
++
++	if (bar0 != sdiodev->sbwad) {
++		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
++		if (err)
++			return err;
++
++		sdiodev->sbwad = bar0;
++	}
++
++	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
++	return 0;
++}
++
+ static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
+ 					uint regaddr)
+ {
+@@ -249,173 +286,84 @@ static inline int brcmf_sdiod_f0_writeb(
+ 	return err_ret;
+ }
+ 
+-static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
+-				    u32 addr, u8 regsz, void *data, bool write)
+-{
+-	struct sdio_func *func;
+-	int ret = -EINVAL;
+-
+-	brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+-		  write, fn, addr, regsz);
+-
+-	/* only allow byte access on F0 */
+-	if (WARN_ON(regsz > 1 && !fn))
+-		return -EINVAL;
+-	func = sdiodev->func[fn];
+-
+-	switch (regsz) {
+-	case 1:
+-		if (write) {
+-			if (fn)
+-				sdio_writeb(func, *(u8 *)data, addr, &ret);
+-			else
+-				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
+-							    addr);
+-		} else {
+-			if (fn)
+-				*(u8 *)data = sdio_readb(func, addr, &ret);
+-			else
+-				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
+-		}
+-		break;
+-	case 2:
+-		if (write)
+-			sdio_writew(func, *(u16 *)data, addr, &ret);
+-		else
+-			*(u16 *)data = sdio_readw(func, addr, &ret);
+-		break;
+-	case 4:
+-		if (write)
+-			sdio_writel(func, *(u32 *)data, addr, &ret);
+-		else
+-			*(u32 *)data = sdio_readl(func, addr, &ret);
+-		break;
+-	default:
+-		brcmf_err("invalid size: %d\n", regsz);
+-		break;
+-	}
+-
+-	if (ret)
+-		brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+-			  write ? "write" : "read", fn, addr, ret);
+-
+-	return ret;
+-}
+-
+ static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
+ 				 u8 regsz, void *data)
+ {
+-	u8 func;
+-	s32 retry = 0;
+ 	int ret;
+ 
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
+-
+ 	/*
+ 	 * figure out how to read the register based on address range
+ 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+ 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+ 	 * The rest: function 1 silicon backplane core registers
++	 * f0 writes must be bytewise
+ 	 */
+-	if ((addr & ~REG_F0_REG_MASK) == 0)
+-		func = SDIO_FUNC_0;
+-	else
+-		func = SDIO_FUNC_1;
+-
+-	do {
+-		/* for retry wait for 1 ms till bus get settled down */
+-		if (retry)
+-			usleep_range(1000, 2000);
+ 
+-		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
+-					       data, true);
+-
+-	} while (ret != 0 && ret != -ENOMEDIUM &&
+-		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
++	if ((addr & ~REG_F0_REG_MASK) == 0) {
++		if (WARN_ON(regsz > 1))
++			return -EINVAL;
++		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
++					    *(u8 *)data, addr);
++	} else {
++		switch (regsz) {
++		case 1:
++			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
++			break;
++		case 4:
++			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
++			if (ret)
++				goto done;
+ 
+-	if (ret == -ENOMEDIUM)
+-		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
++			break;
++		default:
++			WARN(1, "Invalid reg size\n");
++			ret = -EINVAL;
++			break;
++		}
++	}
+ 
++done:
+ 	return ret;
+ }
+ 
+ static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
+ 				u8 regsz, void *data)
+ {
+-	u8 func;
+-	s32 retry = 0;
+ 	int ret;
+ 
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
+-
+ 	/*
+ 	 * figure out how to read the register based on address range
+ 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+ 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+ 	 * The rest: function 1 silicon backplane core registers
++	 * f0 reads must be bytewise
+ 	 */
+-	if ((addr & ~REG_F0_REG_MASK) == 0)
+-		func = SDIO_FUNC_0;
+-	else
+-		func = SDIO_FUNC_1;
+-
+-	do {
+-		memset(data, 0, regsz);
+-
+-		/* for retry wait for 1 ms till bus get settled down */
+-		if (retry)
+-			usleep_range(1000, 2000);
+-
+-		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
+-					       data, false);
+-
+-	} while (ret != 0 && ret != -ENOMEDIUM &&
+-		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+-
+-	if (ret == -ENOMEDIUM)
+-		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+-
+-	return ret;
+-}
+-
+-static int
+-brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
+-{
+-	int err = 0, i;
+-	u32 addr;
+-
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
+-
+-	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
+-
+-	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
+-				  addr & 0xff, &err);
+-
+-	return err;
+-}
+-
+-static int
+-brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
+-{
+-	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+-	int err = 0;
+-
+-	if (bar0 != sdiodev->sbwad) {
+-		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
+-		if (err)
+-			return err;
++	if ((addr & ~REG_F0_REG_MASK) == 0) {
++		if (WARN_ON(regsz > 1))
++			return -EINVAL;
++		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
++	} else {
++		switch (regsz) {
++		case 1:
++			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
++			break;
++		case 4:
++			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
++			if (ret)
++				goto done;
+ 
+-		sdiodev->sbwad = bar0;
++			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
++			break;
++		default:
++			WARN(1, "Invalid reg size\n");
++			ret = -EINVAL;
++			break;
++		}
+ 	}
+ 
+-	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
+-	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+-
+-	return 0;
++done:
++	return ret;
+ }
+ 
+ u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+@@ -439,15 +387,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+-	if (retval)
+-		goto done;
+-
+ 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
+-
+ 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+-done:
+ 	if (ret)
+ 		*ret = retval;
+ 
+@@ -472,13 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+-	if (retval)
+-		goto done;
+-
+ 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
+ 
+-done:
+ 	if (ret)
+ 		*ret = retval;
+ }
+@@ -886,14 +823,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	return bcmerror;
+ }
+ 
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
+ {
+-	char t_func = (char)fn;
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* issue abort cmd52 command through F0 */
+-	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+-				 1, &t_func, true);
++	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -339,7 +339,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
+ 		      u8 *data, uint size);
+ 
+ /* Issue an abort to the specified function */
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
+ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
+ 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch b/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
new file mode 100644
index 0000000000..bcf59722b2
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
@@ -0,0 +1,28 @@
+From 3508a056a1f45d95c874fc9af8748bf4229432b6 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:45 +0100
+Subject: [PATCH] brcmfmac: Fix asymmetric IO functions.
+
+Unlikely to be a problem, but brcmf_sdiod_regrl() is
+not symmetric with brcmf_sdiod_regrb() in initializing
+the data value on stack. Fix that.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+[arend: reword the commit message a bit]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -383,7 +383,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 
+ u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+ {
+-	u32 data = 0;
++	u32 data;
+ 	int retval;
+ 
+ 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch b/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
new file mode 100644
index 0000000000..9a570450a7
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
@@ -0,0 +1,53 @@
+From 12e3e74e2820e11d91ee44fd3a190cd80d109faa Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:46 +0100
+Subject: [PATCH] brcmfmac: Remove noisy debugging.
+
+If you need debugging this low level, you're doing something wrong.
+Remove these noisy debug statements so the code is more readable.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -371,9 +371,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
+ 	u8 data;
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+ 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
+-	brcmf_dbg(SDIO, "data:0x%02x\n", data);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -386,9 +384,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	u32 data;
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
+ 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
+-	brcmf_dbg(SDIO, "data:0x%08x\n", data);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -401,7 +397,6 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
+ {
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
+ 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
+ 
+ 	if (ret)
+@@ -413,7 +408,6 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ {
+ 	int retval;
+ 
+-	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
+ 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
+ 
+ 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch b/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
new file mode 100644
index 0000000000..dd153fe6cc
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
@@ -0,0 +1,58 @@
+From dd8a2d49e4ed321ab8e7b679499c3a98ccc5ca24 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Mon, 13 Nov 2017 21:35:47 +0100
+Subject: [PATCH] brcmfmac: Rename bcmerror to err
+
+Trivial cleanup of nasty variable name
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -746,7 +746,7 @@ int
+ brcmf_sdiod_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
+ 		  u8 *data, uint size)
+ {
+-	int bcmerror = 0;
++	int err = 0;
+ 	struct sk_buff *pkt;
+ 	u32 sdaddr;
+ 	uint dsize;
+@@ -771,8 +771,8 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	/* Do the transfer(s) */
+ 	while (size) {
+ 		/* Set the backplane window to include the start address */
+-		bcmerror = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
+-		if (bcmerror)
++		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
++		if (err)
+ 			break;
+ 
+ 		brcmf_dbg(SDIO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
+@@ -785,9 +785,9 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 		skb_put(pkt, dsize);
+ 		if (write)
+ 			memcpy(pkt->data, data, dsize);
+-		bcmerror = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write,
+-					      sdaddr, pkt);
+-		if (bcmerror) {
++		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
++					 pkt);
++		if (err) {
+ 			brcmf_err("membytes transfer failed\n");
+ 			break;
+ 		}
+@@ -814,7 +814,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	sdio_release_host(sdiodev->func[1]);
+ 
+-	return bcmerror;
++	return err;
+ }
+ 
+ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
diff --git a/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch b/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
new file mode 100644
index 0000000000..c260b96550
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
@@ -0,0 +1,143 @@
+From 8f13c87ccc495e30de5f58bbda967f6edd5bec53 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:26 +0100
+Subject: [PATCH] brcmfmac: Split brcmf_sdiod_buffrw function up.
+
+This function needs to be split up into separate read / write variants
+for clarity.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 67 +++++++++++++++-------
+ 1 file changed, 45 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -414,8 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
+-			     bool write, u32 addr, struct sk_buff *pkt)
++static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
++				 u32 addr, struct sk_buff *pkt)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+@@ -424,18 +424,36 @@ static int brcmf_sdiod_buffrw(struct brc
+ 	req_sz = pkt->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	if (write)
+-		err = sdio_memcpy_toio(sdiodev->func[fn], addr,
+-				       ((u8 *)(pkt->data)), req_sz);
+-	else if (fn == 1)
+-		err = sdio_memcpy_fromio(sdiodev->func[fn], ((u8 *)(pkt->data)),
+-					 addr, req_sz);
++	if (fn == 1)
++		err = sdio_memcpy_fromio(sdiodev->func[fn],
++					 ((u8 *)(pkt->data)), addr, req_sz);
+ 	else
+ 		/* function 2 read is FIFO operation */
+-		err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
+-				  req_sz);
++		err = sdio_readsb(sdiodev->func[fn],
++				  ((u8 *)(pkt->data)), addr, req_sz);
++
++	if (err == -ENOMEDIUM)
++		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++
++	return err;
++}
++
++static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
++				  u32 addr, struct sk_buff *pkt)
++{
++	unsigned int req_sz;
++	int err;
++
++	/* Single skb use the standard mmc interface */
++	req_sz = pkt->len + 3;
++	req_sz &= (uint)~3;
++
++	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
++			       ((u8 *)(pkt->data)), req_sz);
++
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
++
+ 	return err;
+ }
+ 
+@@ -643,7 +661,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	if (err)
+ 		goto done;
+ 
+-	err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -665,14 +683,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 		goto done;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+-					 pktq->next);
++		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+-					 glom_skb);
++		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++					    glom_skb);
+ 		if (err)
+ 			goto done;
+ 
+@@ -707,8 +725,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	err = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
+-					 mypkt);
++		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 	return err;
+@@ -730,8 +747,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support)
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true,
+-						 addr, skb);
++			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
++						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+@@ -783,10 +800,16 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 		sdaddr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 		skb_put(pkt, dsize);
+-		if (write)
++
++		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
+-					 pkt);
++			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
++						     sdaddr, pkt);
++		} else {
++			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
++						    sdaddr, pkt);
++		}
++
+ 		if (err) {
+ 			brcmf_err("membytes transfer failed\n");
+ 			break;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch b/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
new file mode 100644
index 0000000000..088a6169fd
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
@@ -0,0 +1,34 @@
+From 6e24dd012bfda479d0046f7995058f167e1923bc Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:27 +0100
+Subject: [PATCH] brcmfmac: whitespace fixes in brcmf_sdiod_send_buf()
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: mention function in patch subject]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -714,6 +714,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	int err;
+ 
+ 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
++
+ 	if (!mypkt) {
+ 		brcmf_err("brcmu_pkt_buf_get_skb failed: len %d\n",
+ 			  nbytes);
+@@ -728,8 +729,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+-	return err;
+ 
++	return err;
+ }
+ 
+ int brcmf_sdiod_send_pkt(struct brcmf_sdio_dev *sdiodev,
diff --git a/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch b/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
new file mode 100644
index 0000000000..a44155b61a
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
@@ -0,0 +1,36 @@
+From a7323378dcf1f10a98f47b744e6f65e6fd671d84 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:28 +0100
+Subject: [PATCH] brcmfmac: Clarify if using braces.
+
+Whilst this if () statement is technically correct, it lacks clarity.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -746,16 +746,17 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 	if (err)
+ 		return err;
+ 
+-	if (pktq->qlen == 1 || !sdiodev->sg_support)
++	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+ 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+-	else
++	} else {
+ 		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
+ 					    pktq);
++	}
+ 
+ 	return err;
+ }
diff --git a/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch b/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
new file mode 100644
index 0000000000..7c27e17775
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
@@ -0,0 +1,831 @@
+From 71bd508d7ded8c504ef05d1b4befecfe25e54cb1 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:29 +0100
+Subject: [PATCH] brcmfmac: Rename / replace old IO functions with simpler
+ ones.
+
+Primarily this patch removes:
+
+brcmf_sdiod_f0_writeb()
+brcmf_sdiod_reg_write()
+brcmf_sdiod_reg_read()
+
+Since we no longer use the quirky method of deciding which function to
+address via the address being accessed, take the opportunity to rename
+some IO functions more in line with common kernel code. We also convert
+those that map directly to sdio_{read,write}*() to macros.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 169 +++----------------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 186 ++++++++++-----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  28 +++-
+ 3 files changed, 138 insertions(+), 245 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -137,27 +137,27 @@ int brcmf_sdiod_intr_register(struct brc
+ 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
+ 			/* assign GPIO to SDIO core */
+ 			addr = CORE_CC_REG(SI_ENUM_BASE, gpiocontrol);
+-			gpiocontrol = brcmf_sdiod_regrl(sdiodev, addr, &ret);
++			gpiocontrol = brcmf_sdiod_readl(sdiodev, addr, &ret);
+ 			gpiocontrol |= 0x2;
+-			brcmf_sdiod_regwl(sdiodev, addr, gpiocontrol, &ret);
++			brcmf_sdiod_writel(sdiodev, addr, gpiocontrol, &ret);
+ 
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_SELECT, 0xf,
+-					  &ret);
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_SELECT,
++					   0xf, &ret);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
+ 		}
+ 
+ 		/* must configure SDIO_CCCR_IENx to enable irq */
+-		data = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
++		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
+ 		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+ 
+ 		/* redirect, configure and enable io for interrupt signal */
+ 		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
+ 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
+ 			data |= SDIO_SEPINT_ACT_HI;
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
+-
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
++				     data, &ret);
+ 		sdio_release_host(sdiodev->func[1]);
+ 	} else {
+ 		brcmf_dbg(SDIO, "Entering\n");
+@@ -183,8 +183,8 @@ void brcmf_sdiod_intr_unregister(struct
+ 
+ 		pdata = &sdiodev->settings->bus.sdio;
+ 		sdio_claim_host(sdiodev->func[1]);
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+-		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
++		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+ 		sdio_release_host(sdiodev->func[1]);
+ 
+ 		sdiodev->oob_irq_requested = false;
+@@ -242,8 +242,8 @@ static int brcmf_sdiod_set_sbaddr_window
+ 	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
+ 
+ 	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
+-				  addr & 0xff, &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
++				   addr & 0xff, &err);
+ 
+ 	return err;
+ }
+@@ -267,124 +267,15 @@ static int brcmf_sdiod_addrprep(struct b
+ 	return 0;
+ }
+ 
+-static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
+-					uint regaddr)
+-{
+-	int err_ret;
+-
+-	/*
+-	 * Can only directly write to some F0 registers.
+-	 * Handle CCCR_IENx and CCCR_ABORT command
+-	 * as a special case.
+-	 */
+-	if ((regaddr == SDIO_CCCR_ABORT) ||
+-	    (regaddr == SDIO_CCCR_IENx))
+-		sdio_writeb(func, byte, regaddr, &err_ret);
+-	else
+-		sdio_f0_writeb(func, byte, regaddr, &err_ret);
+-
+-	return err_ret;
+-}
+-
+-static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-				 u8 regsz, void *data)
+-{
+-	int ret;
+-
+-	/*
+-	 * figure out how to read the register based on address range
+-	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+-	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+-	 * The rest: function 1 silicon backplane core registers
+-	 * f0 writes must be bytewise
+-	 */
+-
+-	if ((addr & ~REG_F0_REG_MASK) == 0) {
+-		if (WARN_ON(regsz > 1))
+-			return -EINVAL;
+-		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
+-					    *(u8 *)data, addr);
+-	} else {
+-		switch (regsz) {
+-		case 1:
+-			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
+-			break;
+-		case 4:
+-			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
+-			if (ret)
+-				goto done;
+-
+-			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
+-			break;
+-		default:
+-			WARN(1, "Invalid reg size\n");
+-			ret = -EINVAL;
+-			break;
+-		}
+-	}
+-
+-done:
+-	return ret;
+-}
+-
+-static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-				u8 regsz, void *data)
+-{
+-	int ret;
+-
+-	/*
+-	 * figure out how to read the register based on address range
+-	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+-	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+-	 * The rest: function 1 silicon backplane core registers
+-	 * f0 reads must be bytewise
+-	 */
+-	if ((addr & ~REG_F0_REG_MASK) == 0) {
+-		if (WARN_ON(regsz > 1))
+-			return -EINVAL;
+-		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
+-	} else {
+-		switch (regsz) {
+-		case 1:
+-			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
+-			break;
+-		case 4:
+-			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
+-			if (ret)
+-				goto done;
+-
+-			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
+-			break;
+-		default:
+-			WARN(1, "Invalid reg size\n");
+-			ret = -EINVAL;
+-			break;
+-		}
+-	}
+-
+-done:
+-	return ret;
+-}
+-
+-u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
++u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+ {
+-	u8 data;
++	u32 data = 0;
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
+-
+-	if (ret)
+-		*ret = retval;
+-
+-	return data;
+-}
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+-u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+-{
+-	u32 data;
+-	int retval;
+-
+-	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
++	if (!retval)
++		data = sdio_readl(sdiodev->func[1], addr, &retval);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -392,23 +283,15 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
+ 	return data;
+ }
+ 
+-void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-		      u8 data, int *ret)
++void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr,
++			u32 data, int *ret)
+ {
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
+-
+-	if (ret)
+-		*ret = retval;
+-}
+-
+-void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
+-		      u32 data, int *ret)
+-{
+-	int retval;
++	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
+ 
+-	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
++	if (!retval)
++		sdio_writel(sdiodev->func[1], data, addr, &retval);
+ 
+ 	if (ret)
+ 		*ret = retval;
+@@ -846,8 +729,8 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
+ {
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+-	/* issue abort cmd52 command through F0 */
+-	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
++	/* Issue abort cmd52 command through F0 */
++	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -669,7 +669,7 @@ static int r_sdreg32(struct brcmf_sdio *
+ 	int ret;
+ 
+ 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+-	*regvar = brcmf_sdiod_regrl(bus->sdiodev, core->base + offset, &ret);
++	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
+ 
+ 	return ret;
+ }
+@@ -680,7 +680,7 @@ static int w_sdreg32(struct brcmf_sdio *
+ 	int ret;
+ 
+ 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+-	brcmf_sdiod_regwl(bus->sdiodev, core->base + reg_offset, regval, &ret);
++	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
+ 
+ 	return ret;
+ }
+@@ -697,8 +697,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 
+ 	wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+ 	/* 1st KSO write goes to AOS wake up core if device is asleep  */
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+-			  wr_val, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+ 
+ 	if (on) {
+ 		/* device WAKEUP through KSO:
+@@ -724,7 +723,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 		 * just one write attempt may fail,
+ 		 * read it back until it matches written value
+ 		 */
+-		rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
++		rd_val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+ 					   &err);
+ 		if (!err) {
+ 			if ((rd_val & bmask) == cmp_val)
+@@ -734,9 +733,11 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 		/* bail out upon subsequent access errors */
+ 		if (err && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS))
+ 			break;
++
+ 		udelay(KSO_WAIT_US);
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+-				  wr_val, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val,
++				   &err);
++
+ 	} while (try_cnt++ < MAX_KSO_ATTEMPTS);
+ 
+ 	if (try_cnt > 2)
+@@ -772,15 +773,15 @@ static int brcmf_sdio_htclk(struct brcmf
+ 		clkreq =
+ 		    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+ 
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  clkreq, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   clkreq, &err);
+ 		if (err) {
+ 			brcmf_err("HT Avail request error: %d\n", err);
+ 			return -EBADE;
+ 		}
+ 
+ 		/* Check current status */
+-		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
++		clkctl = brcmf_sdiod_readb(bus->sdiodev,
+ 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 		if (err) {
+ 			brcmf_err("HT Avail read error: %d\n", err);
+@@ -790,35 +791,34 @@ static int brcmf_sdio_htclk(struct brcmf
+ 		/* Go to pending and await interrupt if appropriate */
+ 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+ 			/* Allow only clock-available interrupt */
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			if (err) {
+-				brcmf_err("Devctl error setting CA: %d\n",
+-					  err);
++				brcmf_err("Devctl error setting CA: %d\n", err);
+ 				return -EBADE;
+ 			}
+ 
+ 			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   devctl, &err);
+ 			brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
+ 			bus->clkstate = CLK_PENDING;
+ 
+ 			return 0;
+ 		} else if (bus->clkstate == CLK_PENDING) {
+ 			/* Cancel CA-only interrupt filter */
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   devctl, &err);
+ 		}
+ 
+ 		/* Otherwise, wait here (polling) for HT Avail */
+ 		timeout = jiffies +
+ 			  msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
+ 		while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+-			clkctl = brcmf_sdiod_regrb(bus->sdiodev,
++			clkctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_FUNC1_CHIPCLKCSR,
+ 						   &err);
+ 			if (time_after(jiffies, timeout))
+@@ -852,16 +852,16 @@ static int brcmf_sdio_htclk(struct brcmf
+ 
+ 		if (bus->clkstate == CLK_PENDING) {
+ 			/* Cancel CA-only interrupt filter */
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   devctl, &err);
+ 		}
+ 
+ 		bus->clkstate = CLK_SDONLY;
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  clkreq, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   clkreq, &err);
+ 		brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
+ 		if (err) {
+ 			brcmf_err("Failed access turning clock off: %d\n",
+@@ -951,14 +951,14 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *
+ 
+ 		/* Going to sleep */
+ 		if (sleep) {
+-			clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
++			clkcsr = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_FUNC1_CHIPCLKCSR,
+ 						   &err);
+ 			if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
+ 				brcmf_dbg(SDIO, "no clock, set ALP\n");
+-				brcmf_sdiod_regwb(bus->sdiodev,
+-						  SBSDIO_FUNC1_CHIPCLKCSR,
+-						  SBSDIO_ALP_AVAIL_REQ, &err);
++				brcmf_sdiod_writeb(bus->sdiodev,
++						   SBSDIO_FUNC1_CHIPCLKCSR,
++						   SBSDIO_ALP_AVAIL_REQ, &err);
+ 			}
+ 			err = brcmf_sdio_kso_control(bus, false);
+ 		} else {
+@@ -1178,16 +1178,16 @@ static void brcmf_sdio_rxfail(struct brc
+ 	if (abort)
+ 		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
+ 
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
+-			  SFC_RF_TERM, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
++			   &err);
+ 	bus->sdcnt.f1regdata++;
+ 
+ 	/* Wait until the packet has been flushed (device/FIFO stable) */
+ 	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+-		hi = brcmf_sdiod_regrb(bus->sdiodev,
+-				       SBSDIO_FUNC1_RFRAMEBCHI, &err);
+-		lo = brcmf_sdiod_regrb(bus->sdiodev,
+-				       SBSDIO_FUNC1_RFRAMEBCLO, &err);
++		hi = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCHI,
++				       &err);
++		lo = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCLO,
++				       &err);
+ 		bus->sdcnt.f1regdata += 2;
+ 
+ 		if ((hi == 0) && (lo == 0))
+@@ -1229,12 +1229,12 @@ static void brcmf_sdio_txfail(struct brc
+ 	bus->sdcnt.tx_sderrs++;
+ 
+ 	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+ 	for (i = 0; i < 3; i++) {
+-		hi = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+-		lo = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
++		hi = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
++		lo = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+ 		bus->sdcnt.f1regdata += 2;
+ 		if ((hi == 0) && (lo == 0))
+ 			break;
+@@ -2446,11 +2446,11 @@ static void brcmf_sdio_bus_stop(struct d
+ 		bus->hostintmask = 0;
+ 
+ 		/* Force backplane clocks to assure F2 interrupt propagates */
+-		saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++		saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+ 					    &err);
+ 		if (!err)
+-			brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-					  (saveclk | SBSDIO_FORCE_HT), &err);
++			brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++					   (saveclk | SBSDIO_FORCE_HT), &err);
+ 		if (err)
+ 			brcmf_err("Failed to force clock for F2: err %d\n",
+ 				  err);
+@@ -2509,7 +2509,7 @@ static int brcmf_sdio_intr_rstatus(struc
+ 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
+ 
+-	val = brcmf_sdiod_regrl(bus->sdiodev, addr, &ret);
++	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+ 	bus->sdcnt.f1regdata++;
+ 	if (ret != 0)
+ 		return ret;
+@@ -2519,7 +2519,7 @@ static int brcmf_sdio_intr_rstatus(struc
+ 
+ 	/* Clear interrupts */
+ 	if (val) {
+-		brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
++		brcmf_sdiod_writel(bus->sdiodev, addr, val, &ret);
+ 		bus->sdcnt.f1regdata++;
+ 		atomic_or(val, &bus->intstatus);
+ 	}
+@@ -2545,23 +2545,23 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ #ifdef DEBUG
+ 		/* Check for inconsistent device control */
+-		devctl = brcmf_sdiod_regrb(bus->sdiodev,
+-					   SBSDIO_DEVICE_CTL, &err);
++		devctl = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					   &err);
+ #endif				/* DEBUG */
+ 
+ 		/* Read CSR, if clock on switch to AVAIL, else ignore */
+-		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
++		clkctl = brcmf_sdiod_readb(bus->sdiodev,
+ 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 
+ 		brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
+ 			  devctl, clkctl);
+ 
+ 		if (SBSDIO_HTAV(clkctl)) {
+-			devctl = brcmf_sdiod_regrb(bus->sdiodev,
++			devctl = brcmf_sdiod_readb(bus->sdiodev,
+ 						   SBSDIO_DEVICE_CTL, &err);
+ 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+-			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+-					  devctl, &err);
++			brcmf_sdiod_writeb(bus->sdiodev,
++					   SBSDIO_DEVICE_CTL, devctl, &err);
+ 			bus->clkstate = CLK_AVAIL;
+ 		}
+ 	}
+@@ -3347,31 +3347,31 @@ static void brcmf_sdio_sr_init(struct br
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
++	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
+ 	if (err) {
+ 		brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
+ 		return;
+ 	}
+ 
+ 	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
+ 		return;
+ 	}
+ 
+ 	/* Add CMD14 Support */
+-	brcmf_sdiod_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
+-			  (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
+-			   SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
+-			  &err);
++	brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
++			     (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
++			      SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
++			     &err);
+ 	if (err) {
+ 		brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
+ 		return;
+ 	}
+ 
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-			  SBSDIO_FORCE_HT, &err);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++			   SBSDIO_FORCE_HT, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
+ 		return;
+@@ -3394,7 +3394,7 @@ static int brcmf_sdio_kso_init(struct br
+ 	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
+ 		return 0;
+ 
+-	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
++	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
+ 	if (err) {
+ 		brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
+ 		return err;
+@@ -3403,8 +3403,8 @@ static int brcmf_sdio_kso_init(struct br
+ 	if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+ 		val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
+ 			SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+-		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+-				  val, &err);
++		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
++				   val, &err);
+ 		if (err) {
+ 			brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
+ 			return err;
+@@ -3565,9 +3565,9 @@ static void brcmf_sdio_bus_watchdog(stru
+ 				u8 devpend;
+ 
+ 				sdio_claim_host(bus->sdiodev->func[1]);
+-				devpend = brcmf_sdiod_regrb(bus->sdiodev,
+-							    SDIO_CCCR_INTx,
+-							    NULL);
++				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
++							       SDIO_CCCR_INTx,
++							       NULL);
+ 				sdio_release_host(bus->sdiodev->func[1]);
+ 				intstatus = devpend & (INTR_STATUS_FUNC1 |
+ 						       INTR_STATUS_FUNC2);
+@@ -3705,12 +3705,12 @@ brcmf_sdio_drivestrengthinit(struct brcm
+ 			}
+ 		}
+ 		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
+-		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
+-		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
++		brcmf_sdiod_writel(sdiodev, addr, 1, NULL);
++		cc_data_temp = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 		cc_data_temp &= ~str_mask;
+ 		drivestrength_sel <<= str_shift;
+ 		cc_data_temp |= drivestrength_sel;
+-		brcmf_sdiod_regwl(sdiodev, addr, cc_data_temp, NULL);
++		brcmf_sdiod_writel(sdiodev, addr, cc_data_temp, NULL);
+ 
+ 		brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
+ 			  str_tab[i].strength, drivestrength, cc_data_temp);
+@@ -3725,7 +3725,7 @@ static int brcmf_sdio_buscoreprep(void *
+ 
+ 	/* Try forcing SDIO core to do ALPAvail request only */
+ 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+ 	if (err) {
+ 		brcmf_err("error writing for HT off\n");
+ 		return err;
+@@ -3733,8 +3733,7 @@ static int brcmf_sdio_buscoreprep(void *
+ 
+ 	/* If register supported, wait for ALPAvail and then force ALP */
+ 	/* This may take up to 15 milliseconds */
+-	clkval = brcmf_sdiod_regrb(sdiodev,
+-				   SBSDIO_FUNC1_CHIPCLKCSR, NULL);
++	clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+ 
+ 	if ((clkval & ~SBSDIO_AVBITS) != clkset) {
+ 		brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
+@@ -3742,10 +3741,11 @@ static int brcmf_sdio_buscoreprep(void *
+ 		return -EACCES;
+ 	}
+ 
+-	SPINWAIT(((clkval = brcmf_sdiod_regrb(sdiodev,
+-					      SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+-			!SBSDIO_ALPAV(clkval)),
+-			PMU_MAX_TRANSITION_DLY);
++	SPINWAIT(((clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++					      NULL)),
++		 !SBSDIO_ALPAV(clkval)),
++		 PMU_MAX_TRANSITION_DLY);
++
+ 	if (!SBSDIO_ALPAV(clkval)) {
+ 		brcmf_err("timeout on ALPAV wait, clkval 0x%02x\n",
+ 			  clkval);
+@@ -3753,11 +3753,11 @@ static int brcmf_sdio_buscoreprep(void *
+ 	}
+ 
+ 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+ 	udelay(65);
+ 
+ 	/* Also, disable the extra SDIO pull-ups */
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+ 
+ 	return 0;
+ }
+@@ -3772,7 +3772,7 @@ static void brcmf_sdio_buscore_activate(
+ 	/* clear all interrupts */
+ 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
+ 	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
+-	brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
++	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+ 
+ 	if (rstvec)
+ 		/* Write reset vector to address 0 */
+@@ -3785,7 +3785,7 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	struct brcmf_sdio_dev *sdiodev = ctx;
+ 	u32 val, rev;
+ 
+-	val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
++	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
+ 	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
+ 	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
+@@ -3802,7 +3802,7 @@ static void brcmf_sdio_buscore_write32(v
+ {
+ 	struct brcmf_sdio_dev *sdiodev = ctx;
+ 
+-	brcmf_sdiod_regwl(sdiodev, addr, val, NULL);
++	brcmf_sdiod_writel(sdiodev, addr, val, NULL);
+ }
+ 
+ static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
+@@ -3826,18 +3826,18 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	sdio_claim_host(sdiodev->func[1]);
+ 
+ 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
+-		 brcmf_sdiod_regrl(sdiodev, SI_ENUM_BASE, NULL));
++		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
+ 
+ 	/*
+ 	 * Force PLL off until brcmf_chip_attach()
+ 	 * programs PLL control regs
+ 	 */
+ 
+-	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-			  BRCMF_INIT_CLKCTL1, &err);
++	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, BRCMF_INIT_CLKCTL1,
++			   &err);
+ 	if (!err)
+-		clkctl = brcmf_sdiod_regrb(sdiodev,
+-					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
++		clkctl = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++					   &err);
+ 
+ 	if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
+ 		brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
+@@ -3897,25 +3897,25 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
+ 
+ 	/* Set card control so an SDIO card reset does a WLAN backplane reset */
+-	reg_val = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
++	reg_val = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
+ 	if (err)
+ 		goto fail;
+ 
+ 	reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
+ 
+-	brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
++	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
+ 	if (err)
+ 		goto fail;
+ 
+ 	/* set PMUControl so a backplane reset does PMU state reload */
+ 	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
+-	reg_val = brcmf_sdiod_regrl(sdiodev, reg_addr, &err);
++	reg_val = brcmf_sdiod_readl(sdiodev, reg_addr, &err);
+ 	if (err)
+ 		goto fail;
+ 
+ 	reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
+ 
+-	brcmf_sdiod_regwl(sdiodev, reg_addr, reg_val, &err);
++	brcmf_sdiod_writel(sdiodev, reg_addr, reg_val, &err);
+ 	if (err)
+ 		goto fail;
+ 
+@@ -4055,10 +4055,10 @@ static void brcmf_sdio_firmware_callback
+ 		goto release;
+ 
+ 	/* Force clocks on backplane to be sure F2 interrupt propagates */
+-	saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
++	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 	if (!err) {
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  (saveclk | SBSDIO_FORCE_HT), &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   (saveclk | SBSDIO_FORCE_HT), &err);
+ 	}
+ 	if (err) {
+ 		brcmf_err("Failed to force clock for F2: err %d\n", err);
+@@ -4080,7 +4080,7 @@ static void brcmf_sdio_firmware_callback
+ 		w_sdreg32(bus, bus->hostintmask,
+ 			  offsetof(struct sdpcmd_regs, hostintmask));
+ 
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_WATERMARK, 8, &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+ 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+@@ -4091,8 +4091,8 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdio_sr_init(bus);
+ 	} else {
+ 		/* Restore previous clock setting */
+-		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-				  saveclk, &err);
++		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				   saveclk, &err);
+ 	}
+ 
+ 	if (err == 0) {
+@@ -4225,7 +4225,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	bus->rxflow = false;
+ 
+ 	/* Done with backplane-dependent accesses, can drop clock... */
+-	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
++	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+ 
+ 	sdio_release_host(bus->sdiodev->func[1]);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -50,6 +50,7 @@
+ #define SBSDIO_NUM_FUNCTION		3
+ 
+ /* function 0 vendor specific CCCR registers */
++
+ #define SDIO_CCCR_BRCM_CARDCAP			0xf0
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
+@@ -131,8 +132,6 @@
+ /* with b15, maps to 32-bit SB access */
+ #define SBSDIO_SB_ACCESS_2_4B_FLAG	0x08000
+ 
+-/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+-
+ /* Address bits from SBADDR regs */
+ #define SBSDIO_SBWINDOW_MASK		0xffff8000
+ 
+@@ -293,13 +292,24 @@ struct sdpcmd_regs {
+ int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev);
+ 
+-/* sdio device register access interface */
+-u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+-u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+-void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
+-		       int *ret);
+-void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
+-		       int *ret);
++/* SDIO device register access interface */
++/* Accessors for SDIO Function 0 */
++#define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
++	sdio_readb((sdiodev)->func[0], (addr), (r))
++
++#define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
++	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
++
++/* Accessors for SDIO Function 1 */
++#define brcmf_sdiod_readb(sdiodev, addr, r) \
++	sdio_readb((sdiodev)->func[1], (addr), (r))
++
++#define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
++	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
++
++u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
++void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
++			int *ret);
+ 
+ /* Buffer transfer to/from device (client) core via cmd53.
+  *   fn:       function number
diff --git a/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch b/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
new file mode 100644
index 0000000000..e77d601a81
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
@@ -0,0 +1,59 @@
+From eeef8a5da781e11746347b3cd9f1942be48ebaf0 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:30 +0100
+Subject: [PATCH] brcmfmac: Tidy register definitions a little
+
+Trivial tidy of register definitions.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  4 ++--
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 19 ++++++++++---------
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -153,9 +153,9 @@ int brcmf_sdiod_intr_register(struct brc
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+ 
+ 		/* redirect, configure and enable io for interrupt signal */
+-		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
++		data = SDIO_CCCR_BRCM_SEPINT_MASK | SDIO_CCCR_BRCM_SEPINT_OE;
+ 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
+-			data |= SDIO_SEPINT_ACT_HI;
++			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
+ 				     data, &ret);
+ 		sdio_release_host(sdiodev->func[1]);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -52,16 +52,17 @@
+ /* function 0 vendor specific CCCR registers */
+ 
+ #define SDIO_CCCR_BRCM_CARDCAP			0xf0
+-#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
+-#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
+-#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	0x08
+-#define SDIO_CCCR_BRCM_CARDCTRL		0xf1
+-#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	0x02
+-#define SDIO_CCCR_BRCM_SEPINT			0xf2
++#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	BIT(1)
++#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
++#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
++
++#define SDIO_CCCR_BRCM_CARDCTRL			0xf1
++#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
+ 
+-#define  SDIO_SEPINT_MASK		0x01
+-#define  SDIO_SEPINT_OE			0x02
+-#define  SDIO_SEPINT_ACT_HI		0x04
++#define SDIO_CCCR_BRCM_SEPINT			0xf2
++#define SDIO_CCCR_BRCM_SEPINT_MASK		BIT(0)
++#define SDIO_CCCR_BRCM_SEPINT_OE		BIT(1)
++#define SDIO_CCCR_BRCM_SEPINT_ACT_HI		BIT(2)
+ 
+ /* function 1 miscellaneous registers */
+ 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch b/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
new file mode 100644
index 0000000000..dc598aa471
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
@@ -0,0 +1,190 @@
+From a7c3aa1509e243a09c5b1660c8702d792ca76aed Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:31 +0100
+Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_addrprep()
+
+This function has become trivial enough that it may as well be pushed into
+its callers, which has the side-benefit of clarifying what's going on.
+
+Remove it, and rename brcmf_sdiod_set_sbaddr_window() to
+brcmf_sdiod_set_backplane_window() as it's easier to understand.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 84 ++++++++++++----------
+ 1 file changed, 46 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -230,41 +230,25 @@ void brcmf_sdiod_change_state(struct brc
+ 	sdiodev->state = state;
+ }
+ 
+-static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
+-					 u32 address)
++static int brcmf_sdiod_set_backplane_window(struct brcmf_sdio_dev *sdiodev,
++					    u32 addr)
+ {
++	u32 v, bar0 = addr & SBSDIO_SBWINDOW_MASK;
+ 	int err = 0, i;
+-	u32 addr;
+ 
+-	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
+-		return -ENOMEDIUM;
++	if (bar0 == sdiodev->sbwad)
++		return 0;
+ 
+-	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
++	v = bar0 >> 8;
+ 
+-	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
++	for (i = 0 ; i < 3 && !err ; i++, v >>= 8)
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
+-				   addr & 0xff, &err);
+-
+-	return err;
+-}
+-
+-static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
+-{
+-	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+-	int err = 0;
+-
+-	if (bar0 != sdiodev->sbwad) {
+-		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
+-		if (err)
+-			return err;
++				   v & 0xff, &err);
+ 
++	if (!err)
+ 		sdiodev->sbwad = bar0;
+-	}
+ 
+-	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
+-	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+-
+-	return 0;
++	return err;
+ }
+ 
+ u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+@@ -272,11 +256,16 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
+ 	u32 data = 0;
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
++	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
++	if (retval)
++		goto out;
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	if (!retval)
+-		data = sdio_readl(sdiodev->func[1], addr, &retval);
++	data = sdio_readl(sdiodev->func[1], addr, &retval);
+ 
++out:
+ 	if (ret)
+ 		*ret = retval;
+ 
+@@ -288,11 +277,16 @@ void brcmf_sdiod_writel(struct brcmf_sdi
+ {
+ 	int retval;
+ 
+-	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
++	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
++	if (retval)
++		goto out;
+ 
+-	if (!retval)
+-		sdio_writel(sdiodev->func[1], data, addr, &retval);
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
++	sdio_writel(sdiodev->func[1], data, addr, &retval);
++
++out:
+ 	if (ret)
+ 		*ret = retval;
+ }
+@@ -540,10 +534,13 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+ 		goto done;
+ 
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
+ 	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
+ 
+ done:
+@@ -561,10 +558,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+ 		  addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+ 		goto done;
+ 
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
+ 	if (pktq->qlen == 1)
+ 		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
+ 					    pktq->next);
+@@ -606,7 +606,12 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 
+ 	memcpy(mypkt->data, buf, nbytes);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
++	if (err)
++		return err;
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+ 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
+@@ -625,10 +630,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
+ 
+-	err = brcmf_sdiod_addrprep(sdiodev, &addr);
++	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+ 		return err;
+ 
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+ 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
+@@ -673,7 +681,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	/* Do the transfer(s) */
+ 	while (size) {
+ 		/* Set the backplane window to include the start address */
+-		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
++		err = brcmf_sdiod_set_backplane_window(sdiodev, address);
+ 		if (err)
+ 			break;
+ 
+@@ -716,7 +724,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	dev_kfree_skb(pkt);
+ 
+ 	/* Return the window to backplane enumeration space for core access */
+-	if (brcmf_sdiod_set_sbaddr_window(sdiodev, sdiodev->sbwad))
++	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
+ 		brcmf_err("FAILED to set window back to 0x%x\n",
+ 			  sdiodev->sbwad);
+ 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch b/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
new file mode 100644
index 0000000000..b9410dd7d0
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
@@ -0,0 +1,32 @@
+From c900072bd6faff089aa4fb7b19136a2a0fe3baf0 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:32 +0100
+Subject: [PATCH] brcmfmac: remove unnecessary call to
+ brcmf_sdiod_set_backplane_window()
+
+All functions that might require the window address changing call
+brcmf_sdiod_set_backplane_window() prior to access. Thus resetting
+the window is not required.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+[arend: corrected the driver prefix in the subject]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -723,11 +723,6 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	dev_kfree_skb(pkt);
+ 
+-	/* Return the window to backplane enumeration space for core access */
+-	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
+-		brcmf_err("FAILED to set window back to 0x%x\n",
+-			  sdiodev->sbwad);
+-
+ 	sdio_release_host(sdiodev->func[1]);
+ 
+ 	return err;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch b/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
new file mode 100644
index 0000000000..f9e5df550f
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
@@ -0,0 +1,134 @@
+From e4c05fc3c0a6c79376f72f17d08014477e962ada Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:33 +0100
+Subject: [PATCH] brcmfmac: Cleanup offsetof()
+
+Create a macro to make the code a bit more readable, whilst we're stuck
+with using struct element offsets as register offsets.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: rename macro to SD_REG]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 35 +++++++++-------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -161,6 +161,8 @@ struct rte_console {
+ 
+ #define CORE_BUS_REG(base, field) \
+ 		(base + offsetof(struct sdpcmd_regs, field))
++#define SD_REG(field) \
++		(offsetof(struct sdpcmd_regs, field))
+ 
+ /* SDIO function 1 register CHIPCLKCSR */
+ /* Force ALP request to backplane */
+@@ -1087,12 +1089,10 @@ static u32 brcmf_sdio_hostmail(struct br
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Read mailbox data and ack that we did so */
+-	ret = r_sdreg32(bus, &hmb_data,
+-			offsetof(struct sdpcmd_regs, tohostmailboxdata));
++	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
+ 
+ 	if (ret == 0)
+-		w_sdreg32(bus, SMB_INT_ACK,
+-			  offsetof(struct sdpcmd_regs, tosbmailbox));
++		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
+ 	bus->sdcnt.f1regdata += 2;
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+@@ -1207,8 +1207,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 
+ 	if (rtx) {
+ 		bus->sdcnt.rxrtx++;
+-		err = w_sdreg32(bus, SMB_NAK,
+-				offsetof(struct sdpcmd_regs, tosbmailbox));
++		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
+ 
+ 		bus->sdcnt.f1regdata++;
+ 		if (err == 0)
+@@ -2333,9 +2332,7 @@ static uint brcmf_sdio_sendfromq(struct
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+ 			sdio_claim_host(bus->sdiodev->func[1]);
+-			ret = r_sdreg32(bus, &intstatus,
+-					offsetof(struct sdpcmd_regs,
+-						 intstatus));
++			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
+ 			sdio_release_host(bus->sdiodev->func[1]);
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+@@ -2441,7 +2438,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 		/* Disable and clear interrupts at the chip level also */
+-		w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
++		w_sdreg32(bus, 0, SD_REG(hostintmask));
+ 		local_hostintmask = bus->hostintmask;
+ 		bus->hostintmask = 0;
+ 
+@@ -2460,8 +2457,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+-		w_sdreg32(bus, local_hostintmask,
+-			  offsetof(struct sdpcmd_regs, intstatus));
++		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
+ 
+ 		sdio_release_host(sdiodev->func[1]);
+ 	}
+@@ -2507,7 +2503,7 @@ static int brcmf_sdio_intr_rstatus(struc
+ 	int ret;
+ 
+ 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+-	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
++	addr = buscore->base + SD_REG(intstatus);
+ 
+ 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+ 	bus->sdcnt.f1regdata++;
+@@ -2584,11 +2580,9 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	 */
+ 	if (intstatus & I_HMB_FC_CHANGE) {
+ 		intstatus &= ~I_HMB_FC_CHANGE;
+-		err = w_sdreg32(bus, I_HMB_FC_CHANGE,
+-				offsetof(struct sdpcmd_regs, intstatus));
++		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
+ 
+-		err = r_sdreg32(bus, &newstatus,
+-				offsetof(struct sdpcmd_regs, intstatus));
++		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
+ 		bus->sdcnt.f1regdata += 2;
+ 		atomic_set(&bus->fcstate,
+ 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
+@@ -3771,7 +3765,7 @@ static void brcmf_sdio_buscore_activate(
+ 
+ 	/* clear all interrupts */
+ 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
+-	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
++	reg_addr = core->base + SD_REG(intstatus);
+ 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+ 
+ 	if (rstvec)
+@@ -4067,7 +4061,7 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	/* Enable function 2 (frame transfers) */
+ 	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
+-		  offsetof(struct sdpcmd_regs, tosbmailboxdata));
++		  SD_REG(tosbmailboxdata));
+ 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 
+@@ -4077,8 +4071,7 @@ static void brcmf_sdio_firmware_callback
+ 	if (!err) {
+ 		/* Set up the interrupt mask and enable interrupts */
+ 		bus->hostintmask = HOSTINTMASK;
+-		w_sdreg32(bus, bus->hostintmask,
+-			  offsetof(struct sdpcmd_regs, hostintmask));
++		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
+ 
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
diff --git a/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch b/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
new file mode 100644
index 0000000000..df72a70b3b
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
@@ -0,0 +1,26 @@
+From 5cfe38f1f8d3c6b98e15b8cfde05028a3c79930b Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:34 +0100
+Subject: [PATCH] brcmfmac: Remove unused macro.
+
+This macro is used exactly nowhere in the code. Delete it.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -159,8 +159,6 @@ struct rte_console {
+ /* manfid tuple length, include tuple, link bytes */
+ #define SBSDIO_CIS_MANFID_TUPLE_LEN	6
+ 
+-#define CORE_BUS_REG(base, field) \
+-		(base + offsetof(struct sdpcmd_regs, field))
+ #define SD_REG(field) \
+ 		(offsetof(struct sdpcmd_regs, field))
+ 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch b/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
new file mode 100644
index 0000000000..69fbf5c80f
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
@@ -0,0 +1,128 @@
+From 21a10846d09db3c5e3bdfb0be0fc7aa9fdc7000a Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Fri, 8 Dec 2017 13:10:35 +0100
+Subject: [PATCH] brcmfmac: Remove repeated calls to brcmf_chip_get_core()
+
+There is no need to repeatdly call brcmf_chip_get_core(), which
+traverses a list of cores every time its called (including during
+register access code!).
+
+Call it once, and store a pointer to the core structure. The existing
+code does nto keep track of users of the cores anyway, and even so, this
+will allow for easier refcounting in future.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 25 +++++++++++++---------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -436,6 +436,7 @@ struct brcmf_sdio_count {
+ struct brcmf_sdio {
+ 	struct brcmf_sdio_dev *sdiodev;	/* sdio device handler */
+ 	struct brcmf_chip *ci;	/* Chip info struct */
++	struct brcmf_core *sdio_core; /* sdio core info struct */
+ 
+ 	u32 hostintmask;	/* Copy of Host Interrupt Mask */
+ 	atomic_t intstatus;	/* Intstatus bits (events) pending */
+@@ -665,10 +666,9 @@ static bool data_ok(struct brcmf_sdio *b
+  */
+ static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
+ {
+-	struct brcmf_core *core;
++	struct brcmf_core *core = bus->sdio_core;
+ 	int ret;
+ 
+-	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
+ 
+ 	return ret;
+@@ -676,10 +676,9 @@ static int r_sdreg32(struct brcmf_sdio *
+ 
+ static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
+ {
+-	struct brcmf_core *core;
++	struct brcmf_core *core = bus->sdio_core;
+ 	int ret;
+ 
+-	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
+ 
+ 	return ret;
+@@ -2495,12 +2494,11 @@ static inline void brcmf_sdio_clrintr(st
+ 
+ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
+ {
+-	struct brcmf_core *buscore;
++	struct brcmf_core *buscore = bus->sdio_core;
+ 	u32 addr;
+ 	unsigned long val;
+ 	int ret;
+ 
+-	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
+ 	addr = buscore->base + SD_REG(intstatus);
+ 
+ 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+@@ -3377,13 +3375,14 @@ static void brcmf_sdio_sr_init(struct br
+ /* enable KSO bit */
+ static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
+ {
++	struct brcmf_core *core = bus->sdio_core;
+ 	u8 val;
+ 	int err = 0;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	/* KSO bit added in SDIO core rev 12 */
+-	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
++	if (core->rev < 12)
+ 		return 0;
+ 
+ 	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
+@@ -3412,6 +3411,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ 	struct brcmf_sdio *bus = sdiodev->bus;
++	struct brcmf_core *core = bus->sdio_core;
+ 	uint pad_size;
+ 	u32 value;
+ 	int err;
+@@ -3420,7 +3420,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	 * a device perspective, ie. bus:txglom affects the
+ 	 * bus transfers from device to host.
+ 	 */
+-	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12) {
++	if (core->rev < 12) {
+ 		/* for sdio core rev < 12, disable txgloming */
+ 		value = 0;
+ 		err = brcmf_iovar_data_set(dev, "bus:txglom", &value,
+@@ -3758,11 +3758,10 @@ static void brcmf_sdio_buscore_activate(
+ 					u32 rstvec)
+ {
+ 	struct brcmf_sdio_dev *sdiodev = ctx;
+-	struct brcmf_core *core;
++	struct brcmf_core *core = sdiodev->bus->sdio_core;
+ 	u32 reg_addr;
+ 
+ 	/* clear all interrupts */
+-	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
+ 	reg_addr = core->base + SD_REG(intstatus);
+ 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+ 
+@@ -3843,6 +3842,12 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 		bus->ci = NULL;
+ 		goto fail;
+ 	}
++
++	/* Pick up the SDIO core info struct from chip.c */
++	bus->sdio_core   = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
++	if (!bus->sdio_core)
++		goto fail;
++
+ 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
+ 						   BRCMF_BUSTYPE_SDIO,
+ 						   bus->ci->chip,
diff --git a/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch b/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
new file mode 100644
index 0000000000..731b7eda1b
--- /dev/null
+++ b/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
@@ -0,0 +1,44 @@
+From 7762bb134e3b40e8ee2611365775b7432190a9c7 Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Mon, 11 Dec 2017 15:38:21 +0800
+Subject: [PATCH] brcmfmac: enlarge buffer size of caps to 512 bytes
+
+The buffer size of return of cap iovar is greater than 256 bytes in some
+firmwares. For instance, the return size of cap iovar is 271 bytes in 4373
+13.10.246.79 firmare. It makes feature capability parsing failed because
+caps buffer is default value.
+So we enlarge caps buffer size to 512 bytes and add the error print for
+cap iovar error.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -130,13 +130,19 @@ static void brcmf_feat_iovar_data_set(st
+ 	}
+ }
+ 
++#define MAX_CAPS_BUFFER_SIZE	512
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
+-	char caps[256];
++	char caps[MAX_CAPS_BUFFER_SIZE];
+ 	enum brcmf_feat_id id;
+-	int i;
++	int i, err;
++
++	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
++	if (err) {
++		brcmf_err("could not get firmware cap (%d)\n", err);
++		return;
++	}
+ 
+-	brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
+ 	brcmf_dbg(INFO, "[ %s]\n", caps);
+ 
+ 	for (i = 0; i < ARRAY_SIZE(brcmf_fwcap_map); i++) {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch b/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
new file mode 100644
index 0000000000..291cd5d787
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
@@ -0,0 +1,227 @@
+From 3d110df8f74781354051e4bb1e3e97fa368b2f80 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:07 +0100
+Subject: [PATCH] brcmfmac: Remove {r,w}_sdreg32
+
+Remove yet another IO function from the code and replace with one
+that already exists.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: keep address calculation, ie. (base + offset) in one line]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 88 +++++++++++-----------
+ 1 file changed, 42 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -660,30 +660,6 @@ static bool data_ok(struct brcmf_sdio *b
+ 	       ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
+ }
+ 
+-/*
+- * Reads a register in the SDIO hardware block. This block occupies a series of
+- * adresses on the 32 bit backplane bus.
+- */
+-static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
+-{
+-	struct brcmf_core *core = bus->sdio_core;
+-	int ret;
+-
+-	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
+-
+-	return ret;
+-}
+-
+-static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
+-{
+-	struct brcmf_core *core = bus->sdio_core;
+-	int ret;
+-
+-	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
+-
+-	return ret;
+-}
+-
+ static int
+ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
+ {
+@@ -1078,6 +1054,8 @@ static void brcmf_sdio_get_console_addr(
+ 
+ static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
+ {
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_core *core = bus->sdio_core;
+ 	u32 intstatus = 0;
+ 	u32 hmb_data;
+ 	u8 fcbits;
+@@ -1086,10 +1064,14 @@ static u32 brcmf_sdio_hostmail(struct br
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Read mailbox data and ack that we did so */
+-	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
++	hmb_data = brcmf_sdiod_readl(sdiod,
++				     core->base + SD_REG(tohostmailboxdata),
++				     &ret);
++
++	if (!ret)
++		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
++				   SMB_INT_ACK, &ret);
+ 
+-	if (ret == 0)
+-		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
+ 	bus->sdcnt.f1regdata += 2;
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+@@ -1163,6 +1145,8 @@ static u32 brcmf_sdio_hostmail(struct br
+ 
+ static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
+ {
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_core *core = bus->sdio_core;
+ 	uint retries = 0;
+ 	u16 lastrbc;
+ 	u8 hi, lo;
+@@ -1204,7 +1188,8 @@ static void brcmf_sdio_rxfail(struct brc
+ 
+ 	if (rtx) {
+ 		bus->sdcnt.rxrtx++;
+-		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
++		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
++				   SMB_NAK, &err);
+ 
+ 		bus->sdcnt.f1regdata++;
+ 		if (err == 0)
+@@ -2291,6 +2276,7 @@ static uint brcmf_sdio_sendfromq(struct
+ {
+ 	struct sk_buff *pkt;
+ 	struct sk_buff_head pktq;
++	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
+ 	u32 intstatus = 0;
+ 	int ret = 0, prec_out, i;
+ 	uint cnt = 0;
+@@ -2329,7 +2315,8 @@ static uint brcmf_sdio_sendfromq(struct
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+ 			sdio_claim_host(bus->sdiodev->func[1]);
+-			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
++			intstatus = brcmf_sdiod_readl(bus->sdiodev,
++						      intstat_addr, &ret);
+ 			sdio_release_host(bus->sdiodev->func[1]);
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+@@ -2413,12 +2400,13 @@ static int brcmf_sdio_tx_ctrlframe(struc
+ 
+ static void brcmf_sdio_bus_stop(struct device *dev)
+ {
+-	u32 local_hostintmask;
+-	u8 saveclk;
+-	int err;
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ 	struct brcmf_sdio *bus = sdiodev->bus;
++	struct brcmf_core *core = bus->sdio_core;
++	u32 local_hostintmask;
++	u8 saveclk;
++	int err;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -2435,7 +2423,9 @@ static void brcmf_sdio_bus_stop(struct d
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 		/* Disable and clear interrupts at the chip level also */
+-		w_sdreg32(bus, 0, SD_REG(hostintmask));
++		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(hostintmask),
++				   0, NULL);
++
+ 		local_hostintmask = bus->hostintmask;
+ 		bus->hostintmask = 0;
+ 
+@@ -2454,7 +2444,8 @@ static void brcmf_sdio_bus_stop(struct d
+ 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+-		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
++		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
++				   local_hostintmask, NULL);
+ 
+ 		sdio_release_host(sdiodev->func[1]);
+ 	}
+@@ -2521,7 +2512,9 @@ static int brcmf_sdio_intr_rstatus(struc
+ 
+ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
+ {
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
+ 	u32 newstatus = 0;
++	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
+ 	unsigned long intstatus;
+ 	uint txlimit = bus->txbound;	/* Tx frames to send before resched */
+ 	uint framecnt;			/* Temporary counter of tx/rx frames */
+@@ -2576,9 +2569,10 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	 */
+ 	if (intstatus & I_HMB_FC_CHANGE) {
+ 		intstatus &= ~I_HMB_FC_CHANGE;
+-		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
++		brcmf_sdiod_writel(sdiod, intstat_addr, I_HMB_FC_CHANGE, &err);
++
++		newstatus = brcmf_sdiod_readl(sdiod, intstat_addr, &err);
+ 
+-		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
+ 		bus->sdcnt.f1regdata += 2;
+ 		atomic_set(&bus->fcstate,
+ 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
+@@ -4017,22 +4011,21 @@ static void brcmf_sdio_firmware_callback
+ 					 const struct firmware *code,
+ 					 void *nvram, u32 nvram_len)
+ {
+-	struct brcmf_bus *bus_if;
+-	struct brcmf_sdio_dev *sdiodev;
+-	struct brcmf_sdio *bus;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_core *core = bus->sdio_core;
+ 	u8 saveclk;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+-	bus_if = dev_get_drvdata(dev);
+-	sdiodev = bus_if->bus_priv.sdio;
++
+ 	if (err)
+ 		goto fail;
+ 
+ 	if (!bus_if->drvr)
+ 		return;
+ 
+-	bus = sdiodev->bus;
+-
+ 	/* try to download image and nvram to the dongle */
+ 	bus->alp_only = true;
+ 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+@@ -4063,8 +4056,9 @@ static void brcmf_sdio_firmware_callback
+ 	}
+ 
+ 	/* Enable function 2 (frame transfers) */
+-	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
+-		  SD_REG(tosbmailboxdata));
++	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
++			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
++
+ 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+ 
+ 
+@@ -4074,7 +4068,9 @@ static void brcmf_sdio_firmware_callback
+ 	if (!err) {
+ 		/* Set up the interrupt mask and enable interrupts */
+ 		bus->hostintmask = HOSTINTMASK;
+-		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
++		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
++				   bus->hostintmask, NULL);
++
+ 
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch b/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
new file mode 100644
index 0000000000..e9b5628309
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
@@ -0,0 +1,33 @@
+From dbda7dacb79a377e8ed9d38ce0e4a58b70aa9060 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 19 Dec 2017 13:47:08 +0100
+Subject: [PATCH] brcmfmac: Rename buscore to core for consistency
+
+Avoid confusion with unrelated _buscore labels.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: only do the rename]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2485,12 +2485,12 @@ static inline void brcmf_sdio_clrintr(st
+ 
+ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
+ {
+-	struct brcmf_core *buscore = bus->sdio_core;
++	struct brcmf_core *core = bus->sdio_core;
+ 	u32 addr;
+ 	unsigned long val;
+ 	int ret;
+ 
+-	addr = buscore->base + SD_REG(intstatus);
++	addr = core->base + SD_REG(intstatus);
+ 
+ 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
+ 	bus->sdcnt.f1regdata++;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch b/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
new file mode 100644
index 0000000000..3828c320f4
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
@@ -0,0 +1,82 @@
+From 874bb8e49b7c6368f8ff9f2566c7bd06a2249be0 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:09 +0100
+Subject: [PATCH] brcmfmac: stabilise the value of ->sbwad in use for some xfer
+ routines.
+
+The IO functions operate within the Chipcommon IO window. Explicitly
+set this, rather than relying on the last initialisation IO access to
+leave it set to the right value by chance.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 5 +++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 1 +
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -529,7 +529,7 @@ int brcmf_sdiod_recv_buf(struct brcmf_sd
+ 
+ int brcmf_sdiod_recv_pkt(struct brcmf_sdio_dev *sdiodev, struct sk_buff *pkt)
+ {
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err = 0;
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
+@@ -552,7 +552,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ {
+ 	struct sk_buff *glom_skb = NULL;
+ 	struct sk_buff *skb;
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err = 0;
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+@@ -593,7 +593,7 @@ done:
+ int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
+ {
+ 	struct sk_buff *mypkt;
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err;
+ 
+ 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
+@@ -625,7 +625,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 			 struct sk_buff_head *pktq)
+ {
+ 	struct sk_buff *skb;
+-	u32 addr = sdiodev->sbwad;
++	u32 addr = sdiodev->cc_core->base;
+ 	int err;
+ 
+ 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3842,6 +3842,11 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	if (!bus->sdio_core)
+ 		goto fail;
+ 
++	/* Pick up the CHIPCOMMON core info struct, for bulk IO in bcmsdh.c */
++	sdiodev->cc_core = brcmf_chip_get_core(bus->ci, BCMA_CORE_CHIPCOMMON);
++	if (!sdiodev->cc_core)
++		goto fail;
++
+ 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
+ 						   BRCMF_BUSTYPE_SDIO,
+ 						   bus->ci->chip,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -178,6 +178,7 @@ struct brcmf_sdio_dev {
+ 	struct sdio_func *func[SDIO_MAX_FUNCS];
+ 	u8 num_funcs;			/* Supported funcs on client */
+ 	u32 sbwad;			/* Save backplane window address */
++	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+ 	struct brcmf_sdio *bus;
+ 	struct device *dev;
+ 	struct brcmf_bus *bus_if;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch b/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
new file mode 100644
index 0000000000..86b269a348
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
@@ -0,0 +1,45 @@
+From 508422f3695bf66f7b85fb4723c22f5166003ec6 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:10 +0100
+Subject: [PATCH] brcmfmac: Correctly handle accesses to SDIO func0
+
+Rather than workaround the restrictions on func0 addressing in the
+driver, set MMC_QUIRK_LENIENT_FN0
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 ++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 4 ++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -995,6 +995,10 @@ static int brcmf_ops_sdio_probe(struct s
+ 	brcmf_dbg(SDIO, "Function#: %d\n", func->num);
+ 
+ 	dev = &func->dev;
++
++	/* Set MMC_QUIRK_LENIENT_FN0 for this card */
++	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
++
+ 	/* prohibit ACPI power management for this device */
+ 	brcmf_sdiod_acpi_set_power_manageable(dev, 0);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -297,10 +297,10 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_readb((sdiodev)->func[0], (addr), (r))
++	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch b/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
new file mode 100644
index 0000000000..715b865619
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
@@ -0,0 +1,111 @@
+From 99d7b6fdfc8c24052c92c720330d31ca1332f996 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:11 +0100
+Subject: [PATCH] brcmfmac: Remove func0 from function array
+
+func0 is not provided by the mmc stack as a function when probing.
+Instead providing specific access functions to read/write it.
+
+This prepares for a patch to remove the actual array entry itself.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: rephrased the commit message]
+[arend: removed unrelated comment for which separate patch is warranted]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  5 +----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   |  7 ++++---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 13 ++++++-------
+ 3 files changed, 11 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1022,8 +1022,7 @@ static int brcmf_ops_sdio_probe(struct s
+ 	/* store refs to functions used. mmc_card does
+ 	 * not hold the F0 function pointer.
+ 	 */
+-	sdiodev->func[0] = kmemdup(func, sizeof(*func), GFP_KERNEL);
+-	sdiodev->func[0]->num = 0;
++	sdiodev->func[0] = NULL;
+ 	sdiodev->func[1] = func->card->sdio_func[0];
+ 	sdiodev->func[2] = func;
+ 
+@@ -1049,7 +1048,6 @@ static int brcmf_ops_sdio_probe(struct s
+ fail:
+ 	dev_set_drvdata(&func->dev, NULL);
+ 	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+-	kfree(sdiodev->func[0]);
+ 	kfree(sdiodev);
+ 	kfree(bus_if);
+ 	return err;
+@@ -1082,7 +1080,6 @@ static void brcmf_ops_sdio_remove(struct
+ 		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
+ 
+ 		kfree(bus_if);
+-		kfree(sdiodev->func[0]);
+ 		kfree(sdiodev);
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3771,9 +3771,10 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	u32 val, rev;
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+-	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
+-	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
+-	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
++
++	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
++	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
++	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -21,7 +21,9 @@
+ #include <linux/firmware.h>
+ #include "firmware.h"
+ 
+-#define SDIO_FUNC_0		0
++/* Maximum number of I/O funcs */
++#define NUM_SDIO_FUNCS	3
++
+ #define SDIO_FUNC_1		1
+ #define SDIO_FUNC_2		2
+ 
+@@ -39,9 +41,6 @@
+ #define INTR_STATUS_FUNC1	0x2
+ #define INTR_STATUS_FUNC2	0x4
+ 
+-/* Maximum number of I/O funcs */
+-#define SDIOD_MAX_IOFUNCS	7
+-
+ /* mask of register map */
+ #define REG_F0_REG_MASK		0x7FF
+ #define REG_F1_MISC_MASK	0x1FFFF
+@@ -175,7 +174,7 @@ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
+ struct brcmf_sdio_dev {
+-	struct sdio_func *func[SDIO_MAX_FUNCS];
++	struct sdio_func *func[NUM_SDIO_FUNCS];
+ 	u8 num_funcs;			/* Supported funcs on client */
+ 	u32 sbwad;			/* Save backplane window address */
+ 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+@@ -297,10 +296,10 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
++	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch b/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
new file mode 100644
index 0000000000..71e4894b06
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
@@ -0,0 +1,40 @@
+From bcadaaa097c7ec103fe75f9da41f8fe52693b644 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 19 Dec 2017 13:47:12 +0100
+Subject: [PATCH] brcmfmac: More efficient and slightly easier to read fixup
+ for 4339 chips
+
+Its more efficient to test the register we're interested in first,
+potentially avoiding two more comparisons, and therefore always avoiding
+one comparison per call on all other chips.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+[arend: fix some checkpatch warnings]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3772,15 +3772,16 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
+-	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
+-	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
+-	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
++	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
++	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
++	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+ 			val |= BRCM_CC_4339_CHIP_ID;
+ 		}
+ 	}
++
+ 	return val;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch b/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
new file mode 100644
index 0000000000..4354a7081c
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
@@ -0,0 +1,347 @@
+From 00eb62cfc5f806b003fe5d54c8b5fe9a9665482f Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:13 +0100
+Subject: [PATCH] brcmfmac: Replace function index with function pointer
+
+In preparation for removing the function array, remove all code that
+refers to function by index and replace with pointers to the function
+itself.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[arend: replace BUG() with WARN() macro]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 85 ++++++++++++----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 15 ++--
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  6 +-
+ 3 files changed, 56 insertions(+), 50 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -291,8 +291,9 @@ out:
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
+-				 u32 addr, struct sk_buff *pkt)
++static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
++				 struct sdio_func *func, u32 addr,
++				 struct sk_buff *pkt)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+@@ -301,13 +302,19 @@ static int brcmf_sdiod_buff_read(struct
+ 	req_sz = pkt->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	if (fn == 1)
+-		err = sdio_memcpy_fromio(sdiodev->func[fn],
+-					 ((u8 *)(pkt->data)), addr, req_sz);
+-	else
+-		/* function 2 read is FIFO operation */
+-		err = sdio_readsb(sdiodev->func[fn],
+-				  ((u8 *)(pkt->data)), addr, req_sz);
++	switch (func->num) {
++	case 1:
++		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
++					 req_sz);
++		break;
++	case 2:
++		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
++		break;
++	default:
++		/* bail out as things are really fishy here */
++		WARN(1, "invalid sdio function number: %d\n", func->num);
++		err = -ENOMEDIUM;
++	};
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -315,8 +322,9 @@ static int brcmf_sdiod_buff_read(struct
+ 	return err;
+ }
+ 
+-static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
+-				  u32 addr, struct sk_buff *pkt)
++static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
++				  struct sdio_func *func, u32 addr,
++				  struct sk_buff *pkt)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+@@ -325,8 +333,7 @@ static int brcmf_sdiod_buff_write(struct
+ 	req_sz = pkt->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
+-			       ((u8 *)(pkt->data)), req_sz);
++	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -337,7 +344,7 @@ static int brcmf_sdiod_buff_write(struct
+ /**
+  * brcmf_sdiod_sglist_rw - SDIO interface function for block data access
+  * @sdiodev: brcmfmac sdio device
+- * @fn: SDIO function number
++ * @func: SDIO function
+  * @write: direction flag
+  * @addr: dongle memory address as source/destination
+  * @pkt: skb pointer
+@@ -346,7 +353,8 @@ static int brcmf_sdiod_buff_write(struct
+  * stack for block data access. It assumes that the skb passed down by the
+  * caller has already been padded and aligned.
+  */
+-static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
++static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev,
++				 struct sdio_func *func,
+ 				 bool write, u32 addr,
+ 				 struct sk_buff_head *pktlist)
+ {
+@@ -372,7 +380,7 @@ static int brcmf_sdiod_sglist_rw(struct
+ 		req_sz = 0;
+ 		skb_queue_walk(pktlist, pkt_next)
+ 			req_sz += pkt_next->len;
+-		req_sz = ALIGN(req_sz, sdiodev->func[fn]->cur_blksize);
++		req_sz = ALIGN(req_sz, func->cur_blksize);
+ 		while (req_sz > PAGE_SIZE) {
+ 			pkt_next = brcmu_pkt_buf_get_skb(PAGE_SIZE);
+ 			if (pkt_next == NULL) {
+@@ -391,7 +399,7 @@ static int brcmf_sdiod_sglist_rw(struct
+ 		target_list = &local_list;
+ 	}
+ 
+-	func_blk_sz = sdiodev->func[fn]->cur_blksize;
++	func_blk_sz = func->cur_blksize;
+ 	max_req_sz = sdiodev->max_request_size;
+ 	max_seg_cnt = min_t(unsigned short, sdiodev->max_segment_count,
+ 			    target_list->qlen);
+@@ -408,10 +416,10 @@ static int brcmf_sdiod_sglist_rw(struct
+ 	mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
+ 	mmc_cmd.opcode = SD_IO_RW_EXTENDED;
+ 	mmc_cmd.arg = write ? 1<<31 : 0;	/* write flag  */
+-	mmc_cmd.arg |= (fn & 0x7) << 28;	/* SDIO func num */
+-	mmc_cmd.arg |= 1<<27;			/* block mode */
++	mmc_cmd.arg |= (func->num & 0x7) << 28;	/* SDIO func num */
++	mmc_cmd.arg |= 1 << 27;			/* block mode */
+ 	/* for function 1 the addr will be incremented */
+-	mmc_cmd.arg |= (fn == 1) ? 1<<26 : 0;
++	mmc_cmd.arg |= (func->num == 1) ? 1 << 26 : 0;
+ 	mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+ 	mmc_req.cmd = &mmc_cmd;
+ 	mmc_req.data = &mmc_dat;
+@@ -457,11 +465,11 @@ static int brcmf_sdiod_sglist_rw(struct
+ 		mmc_cmd.arg |= (addr & 0x1FFFF) << 9;	/* address */
+ 		mmc_cmd.arg |= mmc_dat.blocks & 0x1FF;	/* block count */
+ 		/* incrementing addr for function 1 */
+-		if (fn == 1)
++		if (func->num == 1)
+ 			addr += req_sz;
+ 
+-		mmc_set_data_timeout(&mmc_dat, sdiodev->func[fn]->card);
+-		mmc_wait_for_req(sdiodev->func[fn]->card->host, &mmc_req);
++		mmc_set_data_timeout(&mmc_dat, func->card);
++		mmc_wait_for_req(func->card->host, &mmc_req);
+ 
+ 		ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
+ 		if (ret == -ENOMEDIUM) {
+@@ -541,7 +549,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -566,13 +574,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
+ 					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
+ 					    glom_skb);
+ 		if (err)
+ 			goto done;
+@@ -582,8 +590,8 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 			skb_pull(glom_skb, skb->len);
+ 		}
+ 	} else
+-		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
+-					    pktq);
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
++					    addr, pktq);
+ 
+ done:
+ 	brcmu_pkt_buf_free_skb(glom_skb);
+@@ -614,7 +622,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
++		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
++					     mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+@@ -639,14 +648,14 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+ 	} else {
+-		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
+-					    pktq);
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
++					    addr, pktq);
+ 	}
+ 
+ 	return err;
+@@ -696,10 +705,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
+ 						     sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
++			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
+ 						    sdaddr, pkt);
+ 		}
+ 
+@@ -728,12 +737,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	return err;
+ }
+ 
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func)
+ {
+ 	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Issue abort cmd52 command through F0 */
+-	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
++	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, func->num, NULL);
+ 
+ 	brcmf_dbg(SDIO, "Exit\n");
+ 	return 0;
+@@ -1105,7 +1114,7 @@ static int brcmf_ops_sdio_suspend(struct
+ 
+ 	func = container_of(dev, struct sdio_func, dev);
+ 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
+-	if (func->num != SDIO_FUNC_1)
++	if (func->num != 1)
+ 		return 0;
+ 
+ 
+@@ -1134,7 +1143,7 @@ static int brcmf_ops_sdio_resume(struct
+ 	struct sdio_func *func = container_of(dev, struct sdio_func, dev);
+ 
+ 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
+-	if (func->num != SDIO_FUNC_2)
++	if (func->num != 2)
+ 		return 0;
+ 
+ 	brcmf_sdiod_freezer_off(sdiodev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 		  rtx ? ", send NAK" : "");
+ 
+ 	if (abort)
+-		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
++		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
+ 			   &err);
+@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
+ 	brcmf_err("sdio error, abort command and terminate frame\n");
+ 	bus->sdcnt.tx_sderrs++;
+ 
+-	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
++	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
+ 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
+ 	int ntail, ret;
+ 
+ 	sdiodev = bus->sdiodev;
+-	blksize = sdiodev->func[SDIO_FUNC_2]->cur_blksize;
++	blksize = sdiodev->func[2]->cur_blksize;
+ 	/* sg entry alignment should be a divisor of block size */
+ 	WARN_ON(blksize % bus->sgentry_align);
+ 
+@@ -2441,7 +2441,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 
+ 		/* Turn off the bus (F2), free any pending packets */
+ 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
+-		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
++		sdio_disable_func(sdiodev->func[2]);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+ 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
+@@ -4066,8 +4066,7 @@ static void brcmf_sdio_firmware_callback
+ 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
+ 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
+ 
+-	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+-
++	err = sdio_enable_func(sdiodev->func[2]);
+ 
+ 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+ 
+@@ -4082,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+-		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
++		sdio_disable_func(sdiodev->func[2]);
+ 		goto release;
+ 	}
+ 
+@@ -4219,7 +4218,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	sdio_claim_host(bus->sdiodev->func[1]);
+ 
+ 	/* Disable F2 to clear any intermediate frame state on the dongle */
+-	sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
++	sdio_disable_func(bus->sdiodev->func[2]);
+ 
+ 	bus->rxflow = false;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -45,9 +45,6 @@
+ #define REG_F0_REG_MASK		0x7FF
+ #define REG_F1_MISC_MASK	0x1FFFF
+ 
+-/* as of sdiod rev 0, supports 3 functions */
+-#define SBSDIO_NUM_FUNCTION		3
+-
+ /* function 0 vendor specific CCCR registers */
+ 
+ #define SDIO_CCCR_BRCM_CARDCAP			0xf0
+@@ -350,7 +347,8 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
+ 		      u8 *data, uint size);
+ 
+ /* Issue an abort to the specified function */
+-int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
++int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func);
++
+ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
+ 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch b/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
new file mode 100644
index 0000000000..d732c8e58a
--- /dev/null
+++ b/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
@@ -0,0 +1,53 @@
+From 9c3438ed215adba7025268ee1f0b6f7a2af12316 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Tue, 19 Dec 2017 13:47:14 +0100
+Subject: [PATCH] brcmfmac: Clean up interrupt macros
+
+Make it more obvious that this code acually enables interrupts, and
+provide nice definitions for the bits in the register.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 8 +++++---
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -149,7 +149,8 @@ int brcmf_sdiod_intr_register(struct brc
+ 
+ 		/* must configure SDIO_CCCR_IENx to enable irq */
+ 		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
+-		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
++		data |= SDIO_CCCR_IEN_FUNC1 | SDIO_CCCR_IEN_FUNC2 |
++			SDIO_CCCR_IEN_FUNC0;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+ 
+ 		/* redirect, configure and enable io for interrupt signal */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -24,9 +24,6 @@
+ /* Maximum number of I/O funcs */
+ #define NUM_SDIO_FUNCS	3
+ 
+-#define SDIO_FUNC_1		1
+-#define SDIO_FUNC_2		2
+-
+ #define SDIOD_FBR_SIZE		0x100
+ 
+ /* io_en */
+@@ -52,6 +49,11 @@
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
+ #define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
+ 
++/* Interrupt enable bits for each function */
++#define SDIO_CCCR_IEN_FUNC0			BIT(0)
++#define SDIO_CCCR_IEN_FUNC1			BIT(1)
++#define SDIO_CCCR_IEN_FUNC2			BIT(2)
++
+ #define SDIO_CCCR_BRCM_CARDCTRL			0xf1
+ #define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
+ 
diff --git a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
new file mode 100644
index 0000000000..d010d23f01
--- /dev/null
+++ b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
@@ -0,0 +1,27 @@
+From e3720dad99859251a8b0fe2807275a8afcfb560d Mon Sep 17 00:00:00 2001
+From: Double Lo <double.lo@cypress.com>
+Date: Tue, 19 Dec 2017 14:56:44 +0800
+Subject: [PATCH] brcmfmac: Support 43455 save-restore (SR) feature if FW
+ include -sr
+
+This patch will add 43455 into the save-restore(SR) capable chip list, so
+the SR engine will be enabled with 43455 FW which built-in the -sr
+function.
+
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -1338,6 +1338,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 	switch (pub->chip) {
+ 	case BRCM_CC_4354_CHIP_ID:
+ 	case BRCM_CC_4356_CHIP_ID:
++	case BRCM_CC_4345_CHIP_ID:
+ 		/* explicitly check SR engine enable bit */
+ 		pmu_cc3_mask = BIT(2);
+ 		/* fall-through */
diff --git a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
new file mode 100644
index 0000000000..bd9de13d7a
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
@@ -0,0 +1,1043 @@
+From c9aa7a91de740c537dc8c2f9f3d36fc651371b13 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:52 +0100
+Subject: [PATCH] brcmfmac: Remove array of functions
+
+Replace the array of functions with a pair of pointers to the
+relevant functions.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 115 +++++++-------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 168 ++++++++++-----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  15 +-
+ 3 files changed, 146 insertions(+), 152 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -118,7 +118,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 
+ 		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
+ 				  pdata->oob_irq_flags, "brcmf_oob_intr",
+-				  &sdiodev->func[1]->dev);
++				  &sdiodev->func1->dev);
+ 		if (ret != 0) {
+ 			brcmf_err("request_irq failed %d\n", ret);
+ 			return ret;
+@@ -132,7 +132,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 		}
+ 		sdiodev->irq_wake = true;
+ 
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 
+ 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
+ 			/* assign GPIO to SDIO core */
+@@ -159,13 +159,13 @@ int brcmf_sdiod_intr_register(struct brc
+ 			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
+ 				     data, &ret);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 	} else {
+ 		brcmf_dbg(SDIO, "Entering\n");
+-		sdio_claim_host(sdiodev->func[1]);
+-		sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler);
+-		sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
++		sdio_claim_irq(sdiodev->func1, brcmf_sdiod_ib_irqhandler);
++		sdio_claim_irq(sdiodev->func2, brcmf_sdiod_dummy_irqhandler);
++		sdio_release_host(sdiodev->func1);
+ 		sdiodev->sd_irq_requested = true;
+ 	}
+ 
+@@ -183,26 +183,26 @@ void brcmf_sdiod_intr_unregister(struct
+ 		struct brcmfmac_sdio_pd *pdata;
+ 
+ 		pdata = &sdiodev->settings->bus.sdio;
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 
+ 		sdiodev->oob_irq_requested = false;
+ 		if (sdiodev->irq_wake) {
+ 			disable_irq_wake(pdata->oob_irq_nr);
+ 			sdiodev->irq_wake = false;
+ 		}
+-		free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
++		free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev);
+ 		sdiodev->irq_en = false;
+ 		sdiodev->oob_irq_requested = false;
+ 	}
+ 
+ 	if (sdiodev->sd_irq_requested) {
+-		sdio_claim_host(sdiodev->func[1]);
+-		sdio_release_irq(sdiodev->func[2]);
+-		sdio_release_irq(sdiodev->func[1]);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
++		sdio_release_irq(sdiodev->func2);
++		sdio_release_irq(sdiodev->func1);
++		sdio_release_host(sdiodev->func1);
+ 		sdiodev->sd_irq_requested = false;
+ 	}
+ }
+@@ -264,7 +264,7 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	data = sdio_readl(sdiodev->func[1], addr, &retval);
++	data = sdio_readl(sdiodev->func1, addr, &retval);
+ 
+ out:
+ 	if (ret)
+@@ -285,7 +285,7 @@ void brcmf_sdiod_writel(struct brcmf_sdi
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	sdio_writel(sdiodev->func[1], data, addr, &retval);
++	sdio_writel(sdiodev->func1, data, addr, &retval);
+ 
+ out:
+ 	if (ret)
+@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -575,13 +575,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+ 					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+ 					    glom_skb);
+ 		if (err)
+ 			goto done;
+@@ -591,7 +591,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 			skb_pull(glom_skb, skb->len);
+ 		}
+ 	} else
+-		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, false,
+ 					    addr, pktq);
+ 
+ done:
+@@ -623,7 +623,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
+ 					     mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+@@ -649,13 +649,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+ 	} else {
+-		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, true,
+ 					    addr, pktq);
+ 	}
+ 
+@@ -686,7 +686,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	else
+ 		dsize = size;
+ 
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	/* Do the transfer(s) */
+ 	while (size) {
+@@ -706,10 +706,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
+ 						     sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
++			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
+ 						    sdaddr, pkt);
+ 		}
+ 
+@@ -733,7 +733,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	dev_kfree_skb(pkt);
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	return err;
+ }
+@@ -757,7 +757,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
+ 	uint nents;
+ 	int err;
+ 
+-	func = sdiodev->func[2];
++	func = sdiodev->func2;
+ 	host = func->card->host;
+ 	sdiodev->sg_support = host->max_segs > 1;
+ 	max_blocks = min_t(uint, host->max_blk_count, 511u);
+@@ -818,17 +818,17 @@ static int brcmf_sdiod_freezer_on(struct
+ 	brcmf_sdio_trigger_dpc(sdiodev->bus);
+ 	wait_event(sdiodev->freezer->thread_freeze,
+ 		   atomic_read(expect) == sdiodev->freezer->frozen_count);
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	res = brcmf_sdio_sleep(sdiodev->bus, true);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return res;
+ }
+ 
+ static void brcmf_sdiod_freezer_off(struct brcmf_sdio_dev *sdiodev)
+ {
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	brcmf_sdio_sleep(sdiodev->bus, false);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	atomic_set(&sdiodev->freezer->freezing, 0);
+ 	complete_all(&sdiodev->freezer->resumed);
+ }
+@@ -878,19 +878,19 @@ static int brcmf_sdiod_remove(struct brc
+ 	brcmf_sdiod_freezer_detach(sdiodev);
+ 
+ 	/* Disable Function 2 */
+-	sdio_claim_host(sdiodev->func[2]);
+-	sdio_disable_func(sdiodev->func[2]);
+-	sdio_release_host(sdiodev->func[2]);
++	sdio_claim_host(sdiodev->func2);
++	sdio_disable_func(sdiodev->func2);
++	sdio_release_host(sdiodev->func2);
+ 
+ 	/* Disable Function 1 */
+-	sdio_claim_host(sdiodev->func[1]);
+-	sdio_disable_func(sdiodev->func[1]);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
++	sdio_disable_func(sdiodev->func1);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	sg_free_table(&sdiodev->sgtable);
+ 	sdiodev->sbwad = 0;
+ 
+-	pm_runtime_allow(sdiodev->func[1]->card->host->parent);
++	pm_runtime_allow(sdiodev->func1->card->host->parent);
+ 	return 0;
+ }
+ 
+@@ -906,29 +906,27 @@ static int brcmf_sdiod_probe(struct brcm
+ {
+ 	int ret = 0;
+ 
+-	sdiodev->num_funcs = 2;
++	sdio_claim_host(sdiodev->func1);
+ 
+-	sdio_claim_host(sdiodev->func[1]);
+-
+-	ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
++	ret = sdio_set_block_size(sdiodev->func1, SDIO_FUNC1_BLOCKSIZE);
+ 	if (ret) {
+ 		brcmf_err("Failed to set F1 blocksize\n");
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 		goto out;
+ 	}
+-	ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
++	ret = sdio_set_block_size(sdiodev->func2, SDIO_FUNC2_BLOCKSIZE);
+ 	if (ret) {
+ 		brcmf_err("Failed to set F2 blocksize\n");
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 		goto out;
+ 	}
+ 
+ 	/* increase F2 timeout */
+-	sdiodev->func[2]->enable_timeout = SDIO_WAIT_F2RDY;
++	sdiodev->func2->enable_timeout = SDIO_WAIT_F2RDY;
+ 
+ 	/* Enable Function 1 */
+-	ret = sdio_enable_func(sdiodev->func[1]);
+-	sdio_release_host(sdiodev->func[1]);
++	ret = sdio_enable_func(sdiodev->func1);
++	sdio_release_host(sdiodev->func1);
+ 	if (ret) {
+ 		brcmf_err("Failed to enable F1: err=%d\n", ret);
+ 		goto out;
+@@ -944,7 +942,7 @@ static int brcmf_sdiod_probe(struct brcm
+ 		ret = -ENODEV;
+ 		goto out;
+ 	}
+-	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
++	brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
+ out:
+ 	if (ret)
+ 		brcmf_sdiod_remove(sdiodev);
+@@ -1032,16 +1030,15 @@ static int brcmf_ops_sdio_probe(struct s
+ 	/* store refs to functions used. mmc_card does
+ 	 * not hold the F0 function pointer.
+ 	 */
+-	sdiodev->func[0] = NULL;
+-	sdiodev->func[1] = func->card->sdio_func[0];
+-	sdiodev->func[2] = func;
++	sdiodev->func1 = func->card->sdio_func[0];
++	sdiodev->func2 = func;
+ 
+ 	sdiodev->bus_if = bus_if;
+ 	bus_if->bus_priv.sdio = sdiodev;
+ 	bus_if->proto_type = BRCMF_PROTO_BCDC;
+ 	dev_set_drvdata(&func->dev, bus_if);
+-	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
+-	sdiodev->dev = &sdiodev->func[1]->dev;
++	dev_set_drvdata(&sdiodev->func1->dev, bus_if);
++	sdiodev->dev = &sdiodev->func1->dev;
+ 
+ 	brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
+ 
+@@ -1057,7 +1054,7 @@ static int brcmf_ops_sdio_probe(struct s
+ 
+ fail:
+ 	dev_set_drvdata(&func->dev, NULL);
+-	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
++	dev_set_drvdata(&sdiodev->func1->dev, NULL);
+ 	kfree(sdiodev);
+ 	kfree(bus_if);
+ 	return err;
+@@ -1086,8 +1083,8 @@ static void brcmf_ops_sdio_remove(struct
+ 		/* only proceed with rest of cleanup if func 1 */
+ 		brcmf_sdiod_remove(sdiodev);
+ 
+-		dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+-		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
++		dev_set_drvdata(&sdiodev->func1->dev, NULL);
++		dev_set_drvdata(&sdiodev->func2->dev, NULL);
+ 
+ 		kfree(bus_if);
+ 		kfree(sdiodev);
+@@ -1132,7 +1129,7 @@ static int brcmf_ops_sdio_suspend(struct
+ 		else
+ 			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
+ 	}
+-	if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
++	if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags))
+ 		brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
+ 	return 0;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -979,7 +979,7 @@ static int brcmf_sdio_readshared(struct
+ 	struct sdpcm_shared_le sh_le;
+ 	__le32 addr_le;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 	/*
+@@ -1013,7 +1013,7 @@ static int brcmf_sdio_readshared(struct
+ 	if (rv < 0)
+ 		goto fail;
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* Endianness */
+ 	sh->flags = le32_to_cpu(sh_le.flags);
+@@ -1035,7 +1035,7 @@ static int brcmf_sdio_readshared(struct
+ fail:
+ 	brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
+ 		  rv, addr);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 	return rv;
+ }
+ 
+@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 		  rtx ? ", send NAK" : "");
+ 
+ 	if (abort)
+-		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
++		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func2);
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
+ 			   &err);
+@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
+ 	brcmf_err("sdio error, abort command and terminate frame\n");
+ 	bus->sdcnt.tx_sderrs++;
+ 
+-	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
++	brcmf_sdiod_abort(sdiodev, sdiodev->func2);
+ 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+@@ -1565,10 +1565,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 		 * read directly into the chained packet, or allocate a large
+ 		 * packet and and copy into the chain.
+ 		 */
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
+ 						 &bus->glom, dlen);
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		bus->sdcnt.f2rxdata++;
+ 
+ 		/* On failure, kill the superframe */
+@@ -1576,11 +1576,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 			brcmf_err("glom read of %d bytes failed: %d\n",
+ 				  dlen, errcode);
+ 
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true, false);
+ 			bus->sdcnt.rxglomfail++;
+ 			brcmf_sdio_free_glom(bus);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			return 0;
+ 		}
+ 
+@@ -1590,10 +1590,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		rd_new.seq_num = rxseq;
+ 		rd_new.len = dlen;
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
+ 					     BRCMF_SDIO_FT_SUPER);
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		bus->cur_read.len = rd_new.len_nxtfrm << 4;
+ 
+ 		/* Remove superframe header, remember offset */
+@@ -1609,10 +1609,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 			rd_new.len = pnext->len;
+ 			rd_new.seq_num = rxseq++;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
+ 						     BRCMF_SDIO_FT_SUB);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
+ 					   pnext->data, 32, "subframe:\n");
+ 
+@@ -1621,11 +1621,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		if (errcode) {
+ 			/* Terminate frame on error */
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true, false);
+ 			bus->sdcnt.rxglomfail++;
+ 			brcmf_sdio_free_glom(bus);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			bus->cur_read.len = 0;
+ 			return 0;
+ 		}
+@@ -1833,7 +1833,7 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 		rd->len_left = rd->len;
+ 		/* read header first for unknow frame length */
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (!rd->len) {
+ 			ret = brcmf_sdiod_recv_buf(bus->sdiodev,
+ 						   bus->rxhdr, BRCMF_FIRSTREAD);
+@@ -1843,7 +1843,7 @@ static uint brcmf_sdio_readframes(struct
+ 					  ret);
+ 				bus->sdcnt.rx_hdrfail++;
+ 				brcmf_sdio_rxfail(bus, true, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				continue;
+ 			}
+ 
+@@ -1853,7 +1853,7 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				if (!bus->rxpending)
+ 					break;
+ 				else
+@@ -1869,7 +1869,7 @@ static uint brcmf_sdio_readframes(struct
+ 				rd->len_nxtfrm = 0;
+ 				/* treat all packet as event if we don't know */
+ 				rd->channel = SDPCM_EVENT_CHANNEL;
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				continue;
+ 			}
+ 			rd->len_left = rd->len > BRCMF_FIRSTREAD ?
+@@ -1886,7 +1886,7 @@ static uint brcmf_sdio_readframes(struct
+ 			brcmf_err("brcmu_pkt_buf_get_skb failed\n");
+ 			brcmf_sdio_rxfail(bus, false,
+ 					    RETRYCHAN(rd->channel));
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			continue;
+ 		}
+ 		skb_pull(pkt, head_read);
+@@ -1894,16 +1894,16 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 		ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
+ 		bus->sdcnt.f2rxdata++;
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 
+ 		if (ret < 0) {
+ 			brcmf_err("read %d bytes from channel %d failed: %d\n",
+ 				  rd->len, rd->channel, ret);
+ 			brcmu_pkt_buf_free_skb(pkt);
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true,
+ 					    RETRYCHAN(rd->channel));
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			continue;
+ 		}
+ 
+@@ -1914,7 +1914,7 @@ static uint brcmf_sdio_readframes(struct
+ 		} else {
+ 			memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
+ 			rd_new.seq_num = rd->seq_num;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+ 				rd->len = 0;
+@@ -1927,11 +1927,11 @@ static uint brcmf_sdio_readframes(struct
+ 					  roundup(rd_new.len, 16) >> 4);
+ 				rd->len = 0;
+ 				brcmf_sdio_rxfail(bus, true, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				brcmu_pkt_buf_free_skb(pkt);
+ 				continue;
+ 			}
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			rd->len_nxtfrm = rd_new.len_nxtfrm;
+ 			rd->channel = rd_new.channel;
+ 			rd->dat_offset = rd_new.dat_offset;
+@@ -1947,9 +1947,9 @@ static uint brcmf_sdio_readframes(struct
+ 					  rd_new.seq_num);
+ 				/* Force retry w/normal header read */
+ 				rd->len = 0;
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_rxfail(bus, false, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				brcmu_pkt_buf_free_skb(pkt);
+ 				continue;
+ 			}
+@@ -1972,9 +1972,9 @@ static uint brcmf_sdio_readframes(struct
+ 			} else {
+ 				brcmf_err("%s: glom superframe w/o "
+ 					  "descriptor!\n", __func__);
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_rxfail(bus, false, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 			/* prepare the descriptor for the next read */
+ 			rd->len = rd->len_nxtfrm << 4;
+@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
+ 	int ntail, ret;
+ 
+ 	sdiodev = bus->sdiodev;
+-	blksize = sdiodev->func[2]->cur_blksize;
++	blksize = sdiodev->func2->cur_blksize;
+ 	/* sg entry alignment should be a divisor of block size */
+ 	WARN_ON(blksize % bus->sgentry_align);
+ 
+@@ -2251,14 +2251,14 @@ static int brcmf_sdio_txpkt(struct brcmf
+ 	if (ret)
+ 		goto done;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
+ 	bus->sdcnt.f2txdata++;
+ 
+ 	if (ret < 0)
+ 		brcmf_sdio_txfail(bus);
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ done:
+ 	brcmf_sdio_txpkt_postp(bus, pktq);
+@@ -2314,10 +2314,11 @@ static uint brcmf_sdio_sendfromq(struct
+ 		/* In poll mode, need to check for other events */
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			intstatus = brcmf_sdiod_readl(bus->sdiodev,
+ 						      intstat_addr, &ret);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
++
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+ 				break;
+@@ -2417,7 +2418,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 	}
+ 
+ 	if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 
+ 		/* Enable clock for device interrupts */
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+@@ -2441,13 +2442,13 @@ static void brcmf_sdio_bus_stop(struct d
+ 
+ 		/* Turn off the bus (F2), free any pending packets */
+ 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
+-		sdio_disable_func(sdiodev->func[2]);
++		sdio_disable_func(sdiodev->func2);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+ 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
+ 				   local_hostintmask, NULL);
+ 
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 	}
+ 	/* Clear the data packet queues */
+ 	brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
+@@ -2522,7 +2523,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* If waiting for HTAVAIL, check status */
+ 	if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
+@@ -2585,7 +2586,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 		intstatus |= brcmf_sdio_hostmail(bus);
+ 	}
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* Generally don't ask for these, can get CRC errors... */
+ 	if (intstatus & I_WR_OOSYNC) {
+@@ -2628,7 +2629,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
+ 	    data_ok(bus)) {
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+ 						      bus->ctrl_frame_len);
+@@ -2636,7 +2637,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 			wmb();
+ 			bus->ctrl_frame_stat = false;
+ 		}
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		brcmf_sdio_wait_event_wakeup(bus);
+ 	}
+ 	/* Send queued frames (limit 1 if rx may still be pending) */
+@@ -2652,14 +2653,14 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 		brcmf_err("failed backplane access over SDIO, halting operation\n");
+ 		atomic_set(&bus->intstatus, 0);
+ 		if (bus->ctrl_frame_stat) {
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			if (bus->ctrl_frame_stat) {
+ 				bus->ctrl_frame_err = -ENODEV;
+ 				wmb();
+ 				bus->ctrl_frame_stat = false;
+ 				brcmf_sdio_wait_event_wakeup(bus);
+ 			}
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 		}
+ 	} else if (atomic_read(&bus->intstatus) ||
+ 		   atomic_read(&bus->ipend) > 0 ||
+@@ -2874,13 +2875,13 @@ brcmf_sdio_bus_txctl(struct device *dev,
+ 					 CTL_DONE_TIMEOUT);
+ 	ret = 0;
+ 	if (bus->ctrl_frame_stat) {
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			brcmf_dbg(SDIO, "ctrl_frame timeout\n");
+ 			bus->ctrl_frame_stat = false;
+ 			ret = -ETIMEDOUT;
+ 		}
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 	}
+ 	if (!ret) {
+ 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
+@@ -3004,7 +3005,7 @@ static int brcmf_sdio_assert_info(struct
+ 		return 0;
+ 	}
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	if (sh->assert_file_addr != 0) {
+ 		error = brcmf_sdiod_ramrw(bus->sdiodev, false,
+ 					  sh->assert_file_addr, (u8 *)file, 80);
+@@ -3017,7 +3018,7 @@ static int brcmf_sdio_assert_info(struct
+ 		if (error < 0)
+ 			return error;
+ 	}
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	seq_printf(seq, "dongle assert: %s:%d: assert(%s)\n",
+ 		   file, sh->assert_line, expr);
+@@ -3291,7 +3292,7 @@ static int brcmf_sdio_download_firmware(
+ 	int bcmerror;
+ 	u32 rstvec;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+ 
+ 	rstvec = get_unaligned_le32(fw->data);
+@@ -3320,7 +3321,7 @@ static int brcmf_sdio_download_firmware(
+ 
+ err:
+ 	brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 	return bcmerror;
+ }
+ 
+@@ -3435,7 +3436,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (sdiodev->sg_support) {
+ 		bus->txglom = false;
+ 		value = 1;
+-		pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
++		pad_size = bus->sdiodev->func2->cur_blksize << 1;
+ 		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
+ 					   &value, sizeof(u32));
+ 		if (err < 0) {
+@@ -3477,7 +3478,7 @@ static int brcmf_sdio_bus_get_memdump(st
+ 
+ 	address = bus->ci->rambase;
+ 	offset = err = 0;
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	while (offset < mem_size) {
+ 		len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
+ 		      mem_size - offset;
+@@ -3493,7 +3494,7 @@ static int brcmf_sdio_bus_get_memdump(st
+ 	}
+ 
+ done:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return err;
+ }
+ 
+@@ -3550,11 +3551,10 @@ static void brcmf_sdio_bus_watchdog(stru
+ 			if (!bus->dpc_triggered) {
+ 				u8 devpend;
+ 
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
+-							       SDIO_CCCR_INTx,
+-							       NULL);
+-				sdio_release_host(bus->sdiodev->func[1]);
++						  SDIO_CCCR_INTx, NULL);
++				sdio_release_host(bus->sdiodev->func1);
+ 				intstatus = devpend & (INTR_STATUS_FUNC1 |
+ 						       INTR_STATUS_FUNC2);
+ 			}
+@@ -3580,13 +3580,13 @@ static void brcmf_sdio_bus_watchdog(stru
+ 		bus->console.count += jiffies_to_msecs(BRCMF_WD_POLL);
+ 		if (bus->console.count >= bus->console_interval) {
+ 			bus->console.count -= bus->console_interval;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			/* Make sure backplane clock is on */
+ 			brcmf_sdio_bus_sleep(bus, false, false);
+ 			if (brcmf_sdio_readconsole(bus) < 0)
+ 				/* stop on error */
+ 				bus->console_interval = 0;
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 		}
+ 	}
+ #endif				/* DEBUG */
+@@ -3599,11 +3599,11 @@ static void brcmf_sdio_bus_watchdog(stru
+ 			bus->idlecount++;
+ 			if (bus->idlecount > bus->idletime) {
+ 				brcmf_dbg(SDIO, "idle\n");
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_wd_timer(bus, false);
+ 				bus->idlecount = 0;
+ 				brcmf_sdio_bus_sleep(bus, true, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 		} else {
+ 			bus->idlecount = 0;
+@@ -3773,8 +3773,8 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
+ 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
+-	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
+-	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
++	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
++	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+@@ -3810,7 +3810,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	u32 drivestrength;
+ 
+ 	sdiodev = bus->sdiodev;
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
+ 		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
+@@ -3877,8 +3877,8 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
+ 	 * is true or when platform data OOB irq is true).
+ 	 */
+-	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
+-	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
++	if ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_KEEP_POWER) &&
++	    ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_WAKE_SDIO_IRQ) ||
+ 	     (sdiodev->settings->bus.sdio.oob_irq_supported)))
+ 		sdiodev->bus_if->wowl_supported = true;
+ #endif
+@@ -3917,7 +3917,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	if (err)
+ 		goto fail;
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
+ 
+@@ -3938,7 +3938,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	return true;
+ 
+ fail:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return false;
+ }
+ 
+@@ -4044,7 +4044,7 @@ static void brcmf_sdio_firmware_callback
+ 	bus->sdcnt.tickcnt = 0;
+ 	brcmf_sdio_wd_timer(bus, true);
+ 
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+@@ -4066,7 +4066,7 @@ static void brcmf_sdio_firmware_callback
+ 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
+ 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
+ 
+-	err = sdio_enable_func(sdiodev->func[2]);
++	err = sdio_enable_func(sdiodev->func2);
+ 
+ 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+ 
+@@ -4081,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+-		sdio_disable_func(sdiodev->func[2]);
++		sdio_disable_func(sdiodev->func2);
+ 		goto release;
+ 	}
+ 
+@@ -4106,7 +4106,7 @@ static void brcmf_sdio_firmware_callback
+ 	if (err != 0)
+ 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	err = brcmf_bus_started(dev);
+ 	if (err != 0) {
+@@ -4116,10 +4116,10 @@ static void brcmf_sdio_firmware_callback
+ 	return;
+ 
+ release:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(&sdiodev->func[2]->dev);
++	device_release_driver(&sdiodev->func2->dev);
+ 	device_release_driver(dev);
+ }
+ 
+@@ -4146,7 +4146,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 
+ 	/* single-threaded workqueue */
+ 	wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
+-				     dev_name(&sdiodev->func[1]->dev));
++				     dev_name(&sdiodev->func1->dev));
+ 	if (!wq) {
+ 		brcmf_err("insufficient memory to create txworkqueue\n");
+ 		goto fail;
+@@ -4173,7 +4173,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	init_completion(&bus->watchdog_wait);
+ 	bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
+ 					bus, "brcmf_wdog/%s",
+-					dev_name(&sdiodev->func[1]->dev));
++					dev_name(&sdiodev->func1->dev));
+ 	if (IS_ERR(bus->watchdog_tsk)) {
+ 		pr_warn("brcmf_watchdog thread failed to start\n");
+ 		bus->watchdog_tsk = NULL;
+@@ -4199,7 +4199,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	}
+ 
+ 	/* Query the F2 block size, set roundup accordingly */
+-	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
++	bus->blocksize = bus->sdiodev->func2->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+ 
+ 	/* Allocate buffers */
+@@ -4215,17 +4215,17 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 		}
+ 	}
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* Disable F2 to clear any intermediate frame state on the dongle */
+-	sdio_disable_func(bus->sdiodev->func[2]);
++	sdio_disable_func(bus->sdiodev->func2);
+ 
+ 	bus->rxflow = false;
+ 
+ 	/* Done with backplane-dependent accesses, can drop clock... */
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* ...and initialize clock/power states */
+ 	bus->clkstate = CLK_SDONLY;
+@@ -4277,7 +4277,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 
+ 		if (bus->ci) {
+ 			if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_wd_timer(bus, false);
+ 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+ 				/* Leave the device in state where it is
+@@ -4287,7 +4287,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 				msleep(20);
+ 				brcmf_chip_set_passive(bus->ci);
+ 				brcmf_sdio_clkctl(bus, CLK_NONE, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 			brcmf_chip_detach(bus->ci);
+ 		}
+@@ -4334,9 +4334,9 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
+ {
+ 	int ret;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	ret = brcmf_sdio_bus_sleep(bus, sleep, false);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	return ret;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -21,9 +21,6 @@
+ #include <linux/firmware.h>
+ #include "firmware.h"
+ 
+-/* Maximum number of I/O funcs */
+-#define NUM_SDIO_FUNCS	3
+-
+ #define SDIOD_FBR_SIZE		0x100
+ 
+ /* io_en */
+@@ -173,8 +170,8 @@ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
+ struct brcmf_sdio_dev {
+-	struct sdio_func *func[NUM_SDIO_FUNCS];
+-	u8 num_funcs;			/* Supported funcs on client */
++	struct sdio_func *func1;
++	struct sdio_func *func2;
+ 	u32 sbwad;			/* Save backplane window address */
+ 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+ 	struct brcmf_sdio *bus;
+@@ -295,17 +292,17 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
++	sdio_f0_readb((sdiodev)->func1, (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func1, (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
+-	sdio_readb((sdiodev)->func[1], (addr), (r))
++	sdio_readb((sdiodev)->func1, (addr), (r))
+ 
+ #define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
+-	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
++	sdio_writeb((sdiodev)->func1, (v), (addr), (ret))
+ 
+ u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+ void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
diff --git a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
new file mode 100644
index 0000000000..dc78000be1
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
@@ -0,0 +1,31 @@
+From 32adbcaa5df49f1977441f7a4bf180a0bcfe9966 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:53 +0100
+Subject: [PATCH] brcmfmac: add comment block in brcmf_sdio_buscore_read()
+
+In brcmf_sdio_buscore_read() there is some special handling upon
+register access to chipid register of the chipcommon core. Add
+comment explaining why it is done here.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3772,6 +3772,13 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
++	/*
++	 * this is a bit of special handling if reading the chipcommon chipid
++	 * register. The 4339 is a next-gen of the 4335. It uses the same
++	 * SDIO device id as 4335 and the chipid register returns 4335 as well.
++	 * It can be identified as 4339 by looking at the chip revision. It
++	 * is corrected here so the chip.c module has the right info.
++	 */
+ 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
+ 	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
+ 	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
diff --git a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
new file mode 100644
index 0000000000..c587f413d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
@@ -0,0 +1,137 @@
+From 378f6a16043e5d3346301fc618f503e97aea335b Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:54 +0100
+Subject: [PATCH] brcmfmac: rename brcmf_sdiod_buff_{read,write}() functions
+
+Rename functions to brcmf_sdio_skbuff_{read,write}() as we pass an
+skbuff to this function.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 48 +++++++++++-----------
+ 1 file changed, 24 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -292,24 +292,24 @@ out:
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
+-				 struct sdio_func *func, u32 addr,
+-				 struct sk_buff *pkt)
++static int brcmf_sdiod_skbuff_read(struct brcmf_sdio_dev *sdiodev,
++				   struct sdio_func *func, u32 addr,
++				   struct sk_buff *skb)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+ 
+ 	/* Single skb use the standard mmc interface */
+-	req_sz = pkt->len + 3;
++	req_sz = skb->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+ 	switch (func->num) {
+ 	case 1:
+-		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
++		err = sdio_memcpy_fromio(func, ((u8 *)(skb->data)), addr,
+ 					 req_sz);
+ 		break;
+ 	case 2:
+-		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
++		err = sdio_readsb(func, ((u8 *)(skb->data)), addr, req_sz);
+ 		break;
+ 	default:
+ 		/* bail out as things are really fishy here */
+@@ -323,18 +323,18 @@ static int brcmf_sdiod_buff_read(struct
+ 	return err;
+ }
+ 
+-static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
+-				  struct sdio_func *func, u32 addr,
+-				  struct sk_buff *pkt)
++static int brcmf_sdiod_skbuff_write(struct brcmf_sdio_dev *sdiodev,
++				    struct sdio_func *func, u32 addr,
++				    struct sk_buff *skb)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+ 
+ 	/* Single skb use the standard mmc interface */
+-	req_sz = pkt->len + 3;
++	req_sz = skb->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
++	err = sdio_memcpy_toio(func, addr, ((u8 *)(skb->data)), req_sz);
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
++	err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -575,14 +575,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+-					    pktq->next);
++		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
++					      pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+-					    glom_skb);
++		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
++					      glom_skb);
+ 		if (err)
+ 			goto done;
+ 
+@@ -623,8 +623,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
+-					     mypkt);
++		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
++					       mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+@@ -649,8 +649,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
+-						     addr, skb);
++			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2,
++						       addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+@@ -706,11 +706,11 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
+-						     sdaddr, pkt);
++			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func1,
++						       sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
+-						    sdaddr, pkt);
++			err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func1,
++						      sdaddr, pkt);
+ 		}
+ 
+ 		if (err) {
diff --git a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
new file mode 100644
index 0000000000..b60c81a3a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
@@ -0,0 +1,59 @@
+From b7acadaf038740c43515dc1548f43d01cc92823a Mon Sep 17 00:00:00 2001
+From: Himanshu Jha <himanshujha199640@gmail.com>
+Date: Tue, 9 Jan 2018 02:15:31 +0530
+Subject: [PATCH] brcmfmac: Use zeroing memory allocator than allocator/memset
+
+Use dma_zalloc_coherent for allocating zeroed
+memory and remove unnecessary memset function.
+
+Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci
+
+Suggested-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c  | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1251,14 +1251,14 @@ static int brcmf_pcie_init_scratchbuffer
+ 	u64 address;
+ 	u32 addr;
+ 
+-	devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
+-		BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
+-		&devinfo->shared.scratch_dmahandle, GFP_KERNEL);
++	devinfo->shared.scratch =
++		dma_zalloc_coherent(&devinfo->pdev->dev,
++					BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
++					&devinfo->shared.scratch_dmahandle,
++					GFP_KERNEL);
+ 	if (!devinfo->shared.scratch)
+ 		goto fail;
+ 
+-	memset(devinfo->shared.scratch, 0, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
+-
+ 	addr = devinfo->shared.tcm_base_address +
+ 	       BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
+ 	address = (u64)devinfo->shared.scratch_dmahandle;
+@@ -1268,14 +1268,14 @@ static int brcmf_pcie_init_scratchbuffer
+ 	       BRCMF_SHARED_DMA_SCRATCH_LEN_OFFSET;
+ 	brcmf_pcie_write_tcm32(devinfo, addr, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
+ 
+-	devinfo->shared.ringupd = dma_alloc_coherent(&devinfo->pdev->dev,
+-		BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
+-		&devinfo->shared.ringupd_dmahandle, GFP_KERNEL);
++	devinfo->shared.ringupd =
++		dma_zalloc_coherent(&devinfo->pdev->dev,
++					BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
++					&devinfo->shared.ringupd_dmahandle,
++					GFP_KERNEL);
+ 	if (!devinfo->shared.ringupd)
+ 		goto fail;
+ 
+-	memset(devinfo->shared.ringupd, 0, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
+-
+ 	addr = devinfo->shared.tcm_base_address +
+ 	       BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
+ 	address = (u64)devinfo->shared.ringupd_dmahandle;
diff --git a/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch b/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
new file mode 100644
index 0000000000..e955cb3a25
--- /dev/null
+++ b/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
@@ -0,0 +1,26 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 9 Feb 2018 19:46:54 +0100
+Subject: [PATCH] mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple
+ of 4
+
+This ensures that mac80211 allocated management frames are properly
+aligned, which makes copying them more efficient.
+For instance, mt76 uses iowrite32_copy to copy beacon frames to beacon
+template memory on the chip.
+Misaligned 32-bit accesses cause CPU exceptions on MIPS and should be
+avoided.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4145,7 +4145,7 @@ void ieee80211_sta_uapsd_trigger(struct
+  * The TX headroom reserved by mac80211 for its own tx_status functions.
+  * This is enough for the radiotap header.
+  */
+-#define IEEE80211_TX_STATUS_HEADROOM	14
++#define IEEE80211_TX_STATUS_HEADROOM	ALIGN(14, 4)
+ 
+ /**
+  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
diff --git a/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch b/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
new file mode 100644
index 0000000000..a7562996b1
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 09:59:35 +0100
+Subject: [PATCH] mac80211: drop frames with unexpected DS bits from
+ fast-rx to slow path
+
+Fixes rx for 4-addr packets in AP mode
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3928,7 +3928,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
+ 					      IEEE80211_FCTL_TODS)) !=
+ 	    fast_rx->expected_ds_bits)
+-		goto drop;
++		return false;
+ 
+ 	/* assign the key to drop unencrypted frames (later)
+ 	 * and strip the IV/MIC if necessary
diff --git a/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
new file mode 100644
index 0000000000..3f3eb0a5e1
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 10:00:22 +0100
+Subject: [PATCH] mac80211: support AP 4-addr mode fast-rx
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3774,6 +3774,15 @@ void ieee80211_check_fast_rx(struct sta_
+ 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
+ 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
+ 			 !sdata->u.vlan.sta);
++
++		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++		    sdata->u.vlan.sta) {
++			fastrx.expected_ds_bits |=
++				cpu_to_le16(IEEE80211_FCTL_FROMDS);
++			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++			fastrx.internal_forward = 0;
++		}
++
+ 		break;
+ 	default:
+ 		goto clear;
diff --git a/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch b/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
new file mode 100644
index 0000000000..8c4c724ef7
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
@@ -0,0 +1,53 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 10:01:53 +0100
+Subject: [PATCH] mac80211: support fast-rx with incompatible PS
+ capabilities when PS is disabled
+
+When powersave is disabled for the interface, we can do fast-rx anyway.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2658,6 +2658,7 @@ static int ieee80211_set_power_mgmt(stru
+ 
+ 	ieee80211_recalc_ps(local);
+ 	ieee80211_recalc_ps_vif(sdata);
++	ieee80211_check_fast_rx_iface(sdata);
+ 
+ 	return 0;
+ }
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3741,12 +3741,7 @@ void ieee80211_check_fast_rx(struct sta_
+ 		/* 4-addr is harder to deal with, later maybe */
+ 		if (sdata->u.mgd.use_4addr)
+ 			goto clear;
+-		/* software powersave is a huge mess, avoid all of it */
+-		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
+-			goto clear;
+-		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
+-		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
+-			goto clear;
++
+ 		if (sta->sta.tdls) {
+ 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
+ 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
+@@ -3758,6 +3753,16 @@ void ieee80211_check_fast_rx(struct sta_
+ 			fastrx.expected_ds_bits =
+ 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
+ 		}
++
++		if (!sdata->u.mgd.powersave)
++		    break;
++
++		/* software powersave is a huge mess, avoid all of it */
++		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
++			goto clear;
++		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
++		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
++			goto clear;
+ 		break;
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 	case NL80211_IFTYPE_AP:
diff --git a/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
new file mode 100644
index 0000000000..97a5d8beba
--- /dev/null
+++ b/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
@@ -0,0 +1,34 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 23 Feb 2018 10:05:08 +0100
+Subject: [PATCH] mac80211: support station 4-addr mode fast-rx
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3738,10 +3738,6 @@ void ieee80211_check_fast_rx(struct sta_
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_STATION:
+-		/* 4-addr is harder to deal with, later maybe */
+-		if (sdata->u.mgd.use_4addr)
+-			goto clear;
+-
+ 		if (sta->sta.tdls) {
+ 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
+ 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
+@@ -3754,6 +3750,13 @@ void ieee80211_check_fast_rx(struct sta_
+ 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
+ 		}
+ 
++		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
++			fastrx.expected_ds_bits |=
++				cpu_to_le16(IEEE80211_FCTL_TODS);
++			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++		}
++
+ 		if (!sdata->u.mgd.powersave)
+ 		    break;
+ 
diff --git a/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch b/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
new file mode 100644
index 0000000000..3c6d342ff1
--- /dev/null
+++ b/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
@@ -0,0 +1,256 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 26 Feb 2018 22:09:29 +0100
+Subject: [PATCH] mac80211: support A-MSDU in fast-rx
+
+Only works if the IV was stripped from packets. Create a smaller
+variant of ieee80211_rx_h_amsdu, which bypasses checks already done
+within the fast-rx context.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2358,39 +2358,17 @@ ieee80211_deliver_skb(struct ieee80211_r
+ }
+ 
+ static ieee80211_rx_result debug_noinline
+-ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
++__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
+ {
+ 	struct net_device *dev = rx->sdata->dev;
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	__le16 fc = hdr->frame_control;
+ 	struct sk_buff_head frame_list;
+-	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
+ 
+-	if (unlikely(!ieee80211_is_data(fc)))
+-		return RX_CONTINUE;
+-
+-	if (unlikely(!ieee80211_is_data_present(fc)))
+-		return RX_DROP_MONITOR;
+-
+-	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
+-		return RX_CONTINUE;
+-
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+-		switch (rx->sdata->vif.type) {
+-		case NL80211_IFTYPE_AP_VLAN:
+-			if (!rx->sdata->u.vlan.sta)
+-				return RX_DROP_UNUSABLE;
+-			break;
+-		case NL80211_IFTYPE_STATION:
+-			if (!rx->sdata->u.mgd.use_4addr)
+-				return RX_DROP_UNUSABLE;
+-			break;
+-		default:
+-			return RX_DROP_UNUSABLE;
+-		}
+ 		check_da = NULL;
+ 		check_sa = NULL;
+ 	} else switch (rx->sdata->vif.type) {
+@@ -2410,15 +2388,13 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 			break;
+ 	}
+ 
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		return RX_DROP_UNUSABLE;
+-
+ 	skb->dev = dev;
+ 	__skb_queue_head_init(&frame_list);
+ 
+ 	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
+ 					  rx->sdata->vif.addr,
+-					  rx->sdata->vif.type))
++					  rx->sdata->vif.type,
++					  data_offset))
+ 		return RX_DROP_UNUSABLE;
+ 
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+@@ -2440,6 +2416,44 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 	return RX_QUEUED;
+ }
+ 
++static ieee80211_rx_result debug_noinline
++ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
++{
++	struct sk_buff *skb = rx->skb;
++	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	__le16 fc = hdr->frame_control;
++
++	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
++		return RX_CONTINUE;
++
++	if (unlikely(!ieee80211_is_data(fc)))
++		return RX_CONTINUE;
++
++	if (unlikely(!ieee80211_is_data_present(fc)))
++		return RX_DROP_MONITOR;
++
++	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
++		switch (rx->sdata->vif.type) {
++		case NL80211_IFTYPE_AP_VLAN:
++			if (!rx->sdata->u.vlan.sta)
++				return RX_DROP_UNUSABLE;
++			break;
++		case NL80211_IFTYPE_STATION:
++			if (!rx->sdata->u.mgd.use_4addr)
++				return RX_DROP_UNUSABLE;
++			break;
++		default:
++			return RX_DROP_UNUSABLE;
++		}
++	}
++
++	if (is_multicast_ether_addr(hdr->addr1))
++		return RX_DROP_UNUSABLE;
++
++	return __ieee80211_rx_h_amsdu(rx, 0);
++}
++
+ #ifdef CPTCFG_MAC80211_MESH
+ static ieee80211_rx_result
+ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+@@ -3889,7 +3903,8 @@ static bool ieee80211_invoke_fast_rx(str
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct sta_info *sta = rx->sta;
+ 	int orig_len = skb->len;
+-	int snap_offs = ieee80211_hdrlen(hdr->frame_control);
++	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	int snap_offs = hdrlen;
+ 	struct {
+ 		u8 snap[sizeof(rfc1042_header)];
+ 		__be16 proto;
+@@ -3920,10 +3935,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
+ 		return false;
+ 
+-	/* we don't deal with A-MSDU deaggregation here */
+-	if (status->rx_flags & IEEE80211_RX_AMSDU)
+-		return false;
+-
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return false;
+ 
+@@ -3955,21 +3966,24 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
+-	if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+-		goto drop;
+-	payload = (void *)(skb->data + snap_offs);
++	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
++		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
++			goto drop;
+ 
+-	if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
+-		return false;
++		payload = (void *)(skb->data + snap_offs);
+ 
+-	/* Don't handle these here since they require special code.
+-	 * Accept AARP and IPX even though they should come with a
+-	 * bridge-tunnel header - but if we get them this way then
+-	 * there's little point in discarding them.
+-	 */
+-	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
+-		     payload->proto == fast_rx->control_port_protocol))
+-		return false;
++		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
++			return false;
++
++		/* Don't handle these here since they require special code.
++		 * Accept AARP and IPX even though they should come with a
++		 * bridge-tunnel header - but if we get them this way then
++		 * there's little point in discarding them.
++		 */
++		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
++			     payload->proto == fast_rx->control_port_protocol))
++			return false;
++	}
+ 
+ 	/* after this point, don't punt to the slowpath! */
+ 
+@@ -3983,12 +3997,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 	}
+ 
+ 	/* statistics part of ieee80211_rx_h_sta_process() */
+-	stats->last_rx = jiffies;
+-	stats->last_rate = sta_stats_encode_rate(status);
+-
+-	stats->fragments++;
+-	stats->packets++;
+-
+ 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
+ 		stats->last_signal = status->signal;
+ 		if (!fast_rx->uses_rss)
+@@ -4017,6 +4025,20 @@ static bool ieee80211_invoke_fast_rx(str
+ 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
+ 		goto drop;
+ 
++	if (status->rx_flags & IEEE80211_RX_AMSDU) {
++		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
++		    RX_QUEUED)
++			goto drop;
++
++		return true;
++	}
++
++	stats->last_rx = jiffies;
++	stats->last_rate = sta_stats_encode_rate(status);
++
++	stats->fragments++;
++	stats->packets++;
++
+ 	/* do the header conversion - first grab the addresses */
+ 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
+ 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4331,10 +4331,12 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+  *	of it being pushed into the SKB
+  * @addr: the device MAC address
+  * @iftype: the virtual interface type
++ * @data_offset: offset of payload after the 802.11 header
+  * Return: 0 on success. Non-zero on error.
+  */
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+-				  const u8 *addr, enum nl80211_iftype iftype);
++				  const u8 *addr, enum nl80211_iftype iftype,
++				  u8 data_offset);
+ 
+ /**
+  * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
+@@ -4346,7 +4348,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+ 					 enum nl80211_iftype iftype)
+ {
+-	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype);
++	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0);
+ }
+ 
+ /**
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -419,7 +419,8 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+-				  const u8 *addr, enum nl80211_iftype iftype)
++				  const u8 *addr, enum nl80211_iftype iftype,
++				  u8 data_offset)
+ {
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ 	struct {
+@@ -433,7 +434,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return -1;
+ 
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
+ 	if (skb->len < hdrlen + 8)
+ 		return -1;
+ 
diff --git a/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch b/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
new file mode 100644
index 0000000000..394fbfc5b2
--- /dev/null
+++ b/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
@@ -0,0 +1,68 @@
+From 5242a5444e0b6464d7455beb55d936dd192b5e9d Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Mon, 22 Jan 2018 21:46:39 +0100
+Subject: [PATCH] brcmfmac: assure bcdc dcmd api does not return value > 0
+
+The protocol layer api defines callbacks for dongle commands.
+Although not really well documented these should only return an
+error code in case of an error, or 0 upon success. In the bcdc
+protocol it can return value above 0 and we carry a fix in the
+caller of the protocol layer api. This patch makes it adhere to
+the intent of the api as described above.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 6 +++++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 8 +++-----
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -211,6 +211,8 @@ retry:
+ 		memcpy(buf, info, len);
+ 	}
+ 
++	ret = 0;
++
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+ 		ret = le32_to_cpu(msg->status);
+@@ -225,7 +227,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ {
+ 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+ 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+-	int ret = 0;
++	int ret;
+ 	u32 flags, id;
+ 
+ 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+@@ -249,6 +251,8 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 		goto done;
+ 	}
+ 
++	ret = 0;
++
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+ 		ret = le32_to_cpu(msg->status);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -121,11 +121,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 	else
+ 		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
+ 
+-	if (err >= 0)
+-		return 0;
+-
+-	brcmf_dbg(FIL, "Failed: %s (%d)\n",
+-		  brcmf_fil_get_errstr((u32)(-err)), err);
++	if (err)
++		brcmf_dbg(FIL, "Failed: %s (%d)\n",
++			  brcmf_fil_get_errstr((u32)(-err)), err);
+ 
+ 	return err;
+ }
diff --git a/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch b/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
new file mode 100644
index 0000000000..28e3c1a65f
--- /dev/null
+++ b/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
@@ -0,0 +1,186 @@
+From b69c1df47281ad47bd2037a42b98f5c7115b7fd5 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Mon, 22 Jan 2018 21:46:40 +0100
+Subject: [PATCH] brcmfmac: separate firmware errors from i/o errors
+
+When using the firmware api it can fail simply because firmware does
+not like the request or it fails due to issues in the host interface.
+Currently, there is only a single error code which is confusing. So
+adding a parameter to pass the firmware error separately and in case
+of a firmware error always return -EBADE to user-space.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++++++-----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c  | 16 +++++++++++-----
+ .../net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c    | 10 ++++++----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 14 ++++++++------
+ 4 files changed, 31 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -165,7 +165,7 @@ static int brcmf_proto_bcdc_cmplt(struct
+ 
+ static int
+ brcmf_proto_bcdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+-			    void *buf, uint len)
++			    void *buf, uint len, int *fwerr)
+ {
+ 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+ 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+@@ -175,6 +175,7 @@ brcmf_proto_bcdc_query_dcmd(struct brcmf
+ 
+ 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+ 
++	*fwerr = 0;
+ 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, false);
+ 	if (ret < 0) {
+ 		brcmf_err("brcmf_proto_bcdc_msg failed w/status %d\n",
+@@ -215,15 +216,14 @@ retry:
+ 
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+-		ret = le32_to_cpu(msg->status);
+-
++		*fwerr = le32_to_cpu(msg->status);
+ done:
+ 	return ret;
+ }
+ 
+ static int
+ brcmf_proto_bcdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+-			  void *buf, uint len)
++			  void *buf, uint len, int *fwerr)
+ {
+ 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+ 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+@@ -232,6 +232,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 
+ 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+ 
++	*fwerr = 0;
+ 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, true);
+ 	if (ret < 0)
+ 		goto done;
+@@ -255,7 +256,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 
+ 	/* Check the ERROR flag */
+ 	if (flags & BCDC_DCMD_ERROR)
+-		ret = le32_to_cpu(msg->status);
++		*fwerr = le32_to_cpu(msg->status);
+ 
+ done:
+ 	return ret;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -107,7 +107,7 @@ static s32
+ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
+ {
+ 	struct brcmf_pub *drvr = ifp->drvr;
+-	s32 err;
++	s32 err, fwerr;
+ 
+ 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
+ 		brcmf_err("bus is down. we have nothing to do.\n");
+@@ -117,14 +117,20 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 	if (data != NULL)
+ 		len = min_t(uint, len, BRCMF_DCMD_MAXLEN);
+ 	if (set)
+-		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd, data, len);
++		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd,
++					   data, len, &fwerr);
+ 	else
+-		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
++		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd,
++					     data, len, &fwerr);
+ 
+-	if (err)
++	if (err) {
+ 		brcmf_dbg(FIL, "Failed: %s (%d)\n",
+ 			  brcmf_fil_get_errstr((u32)(-err)), err);
+-
++	} else if (fwerr < 0) {
++		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
++			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
++		err = -EBADE;
++	}
+ 	return err;
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -477,7 +477,7 @@ static void brcmf_msgbuf_ioctl_resp_wake
+ 
+ 
+ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
+-				   uint cmd, void *buf, uint len)
++				   uint cmd, void *buf, uint len, int *fwerr)
+ {
+ 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
+ 	struct sk_buff *skb = NULL;
+@@ -485,6 +485,7 @@ static int brcmf_msgbuf_query_dcmd(struc
+ 	int err;
+ 
+ 	brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
++	*fwerr = 0;
+ 	msgbuf->ctl_completed = false;
+ 	err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
+ 	if (err)
+@@ -508,14 +509,15 @@ static int brcmf_msgbuf_query_dcmd(struc
+ 	}
+ 	brcmu_pkt_buf_free_skb(skb);
+ 
+-	return msgbuf->ioctl_resp_status;
++	*fwerr = msgbuf->ioctl_resp_status;
++	return 0;
+ }
+ 
+ 
+ static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
+-				 uint cmd, void *buf, uint len)
++				 uint cmd, void *buf, uint len, int *fwerr)
+ {
+-	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len);
++	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
+ }
+ 
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -30,9 +30,9 @@ struct brcmf_proto {
+ 	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
+ 		       struct sk_buff *skb, struct brcmf_if **ifp);
+ 	int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
+-			  void *buf, uint len);
++			  void *buf, uint len, int *fwerr);
+ 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
+-			uint len);
++			uint len, int *fwerr);
+ 	int (*tx_queue_data)(struct brcmf_pub *drvr, int ifidx,
+ 			     struct sk_buff *skb);
+ 	int (*txdata)(struct brcmf_pub *drvr, int ifidx, u8 offset,
+@@ -71,14 +71,16 @@ static inline int brcmf_proto_hdrpull(st
+ 	return drvr->proto->hdrpull(drvr, do_fws, skb, ifp);
+ }
+ static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
+-					 uint cmd, void *buf, uint len)
++					 uint cmd, void *buf, uint len,
++					 int *fwerr)
+ {
+-	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len);
++	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len,fwerr);
+ }
+ static inline int brcmf_proto_set_dcmd(struct brcmf_pub *drvr, int ifidx,
+-				       uint cmd, void *buf, uint len)
++				       uint cmd, void *buf, uint len,
++				       int *fwerr)
+ {
+-	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len);
++	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
+ }
+ 
+ static inline int brcmf_proto_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
diff --git a/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch b/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
new file mode 100644
index 0000000000..e6486160fc
--- /dev/null
+++ b/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
@@ -0,0 +1,92 @@
+From 933897342d0714ae1c10729cbaeecea0c6178db5 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 28 Feb 2018 21:15:19 +0100
+Subject: [PATCH] brcmfmac: add possibility to obtain firmware error
+
+The feature module needs to evaluate the actual firmware error return
+upon a control command. This adds a flag to struct brcmf_if that the
+caller can set. This flag is checked to determine the error code that
+needs to be returned.
+
+Fixes: b69c1df47281 ("brcmfmac: separate firmware errors from i/o errors")
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 10 ++++++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c    |  3 +++
+ 3 files changed, 15 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -181,6 +181,7 @@ enum brcmf_netif_stop_reason {
+  * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
+  * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
+  * @pend_8021x_wait: used for signalling change in count.
++ * @fwil_fwerr: flag indicating fwil layer should return firmware error codes.
+  */
+ struct brcmf_if {
+ 	struct brcmf_pub *drvr;
+@@ -198,6 +199,7 @@ struct brcmf_if {
+ 	wait_queue_head_t pend_8021x_wait;
+ 	struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
+ 	u8 ipv6addr_idx;
++	bool fwil_fwerr;
+ };
+ 
+ int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -104,6 +104,9 @@ static void brcmf_feat_iovar_int_get(str
+ 	u32 data;
+ 	int err;
+ 
++	/* we need to know firmware error */
++	ifp->fwil_fwerr = true;
++
+ 	err = brcmf_fil_iovar_int_get(ifp, name, &data);
+ 	if (err == 0) {
+ 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
+@@ -112,6 +115,8 @@ static void brcmf_feat_iovar_int_get(str
+ 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
+ 			  brcmf_feat_names[id], err);
+ 	}
++
++	ifp->fwil_fwerr = false;
+ }
+ 
+ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
+@@ -120,6 +125,9 @@ static void brcmf_feat_iovar_data_set(st
+ {
+ 	int err;
+ 
++	/* we need to know firmware error */
++	ifp->fwil_fwerr = true;
++
+ 	err = brcmf_fil_iovar_data_set(ifp, name, data, len);
+ 	if (err != -BRCMF_FW_UNSUPPORTED) {
+ 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
+@@ -128,6 +136,8 @@ static void brcmf_feat_iovar_data_set(st
+ 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
+ 			  brcmf_feat_names[id], err);
+ 	}
++
++	ifp->fwil_fwerr = false;
+ }
+ 
+ #define MAX_CAPS_BUFFER_SIZE	512
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -131,6 +131,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
+ 		err = -EBADE;
+ 	}
++	if (ifp->fwil_fwerr)
++		return fwerr;
++
+ 	return err;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch b/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
new file mode 100644
index 0000000000..20e16ad23f
--- /dev/null
+++ b/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
@@ -0,0 +1,64 @@
+From 455f3e76cfc0d893585a5f358b9ddbe9c1e1e53b Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 28 Feb 2018 21:15:20 +0100
+Subject: [PATCH] brcmfmac: fix P2P_DEVICE ethernet address generation
+
+The firmware has a requirement that the P2P_DEVICE address should
+be different from the address of the primary interface. When not
+specified by user-space, the driver generates the MAC address for
+the P2P_DEVICE interface using the MAC address of the primary
+interface and setting the locally administered bit. However, the MAC
+address of the primary interface may already have that bit set causing
+the creation of the P2P_DEVICE interface to fail with -EBUSY. Fix this
+by using a random address instead to determine the P2P_DEVICE address.
+
+Cc: stable@vger.kernel.org # 3.10.y
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 24 ++++++++++------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct
+  * @dev_addr: optional device address.
+  *
+  * P2P needs mac addresses for P2P device and interface. If no device
+- * address it specified, these are derived from the primary net device, ie.
+- * the permanent ethernet address of the device.
++ * address it specified, these are derived from a random ethernet
++ * address.
+  */
+ static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
+ {
+-	struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+-	bool local_admin = false;
++	bool random_addr = false;
+ 
+-	if (!dev_addr || is_zero_ether_addr(dev_addr)) {
+-		dev_addr = pri_ifp->mac_addr;
+-		local_admin = true;
+-	}
++	if (!dev_addr || is_zero_ether_addr(dev_addr))
++		random_addr = true;
+ 
+-	/* Generate the P2P Device Address.  This consists of the device's
+-	 * primary MAC address with the locally administered bit set.
++	/* Generate the P2P Device Address obtaining a random ethernet
++	 * address with the locally administered bit set.
+ 	 */
+-	memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+-	if (local_admin)
+-		p2p->dev_addr[0] |= 0x02;
++	if (random_addr)
++		eth_random_addr(p2p->dev_addr);
++	else
++		memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+ 
+ 	/* Generate the P2P Interface Address.  If the discovery and connection
+ 	 * BSSCFGs need to simultaneously co-exist, then this address must be
diff --git a/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch b/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
new file mode 100644
index 0000000000..f25dea01d2
--- /dev/null
+++ b/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
@@ -0,0 +1,157 @@
+From 1259055170287a350cad453e9eac139c81609860 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 15 Mar 2018 08:29:09 +0100
+Subject: [PATCH] brcmfmac: drop Inter-Access Point Protocol packets by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Testing brcmfmac with more recent firmwares resulted in AP interfaces
+not working in some specific setups. Debugging resulted in discovering
+support for IAPP in Broadcom's firmwares.
+
+Older firmwares were only generating 802.11f frames. Newer ones like:
+1) 10.10 (TOB) (r663589)
+2) 10.10.122.20 (r683106)
+for 4366b1 and 4366c0 respectively seem to also /respect/ 802.11f frames
+in the Tx path by performing a STA disassociation.
+
+This obsoleted standard and its implementation is something that:
+1) Most people don't need / want to use
+2) Can allow local DoS attacks
+3) Breaks AP interfaces in some specific bridge setups
+
+To solve issues it can cause this commit modifies brcmfmac to drop IAPP
+packets. If affects:
+1) Rx path: driver won't be sending these unwanted packets up.
+2) Tx path: driver will reject packets that would trigger STA
+   disassociation perfromed by a firmware (possible local DoS attack).
+
+It appears there are some Broadcom's clients/users who care about this
+feature despite the drawbacks. They can switch it on using a new module
+param.
+
+This change results in only two more comparisons (check for module param
+and check for Ethernet packet length) for 99.9% of packets. Its overhead
+should be very minimal.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ++
+ .../wireless/broadcom/brcm80211/brcmfmac/common.h  |  1 +
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 57 ++++++++++++++++++++++
+ 3 files changed, 63 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -75,6 +75,10 @@ static int brcmf_roamoff;
+ module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
+ MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
+ 
++static int brcmf_iapp_enable;
++module_param_named(iapp, brcmf_iapp_enable, int, 0);
++MODULE_PARM_DESC(iapp, "Enable partial support for the obsoleted Inter-Access Point Protocol");
++
+ #ifdef DEBUG
+ /* always succeed brcmf_bus_started() */
+ static int brcmf_ignore_probe_fail;
+@@ -441,6 +445,7 @@ struct brcmf_mp_device *brcmf_get_module
+ 	settings->feature_disable = brcmf_feature_disable;
+ 	settings->fcmode = brcmf_fcmode;
+ 	settings->roamoff = !!brcmf_roamoff;
++	settings->iapp = !!brcmf_iapp_enable;
+ #ifdef DEBUG
+ 	settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
+ #endif
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -58,6 +58,7 @@ struct brcmf_mp_device {
+ 	unsigned int	feature_disable;
+ 	int		fcmode;
+ 	bool		roamoff;
++	bool		iapp;
+ 	bool		ignore_probe_fail;
+ 	struct brcmfmac_pd_cc *country_codes;
+ 	union {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -230,6 +230,37 @@ static void brcmf_netdev_set_multicast_l
+ 	schedule_work(&ifp->multicast_work);
+ }
+ 
++/**
++ * brcmf_skb_is_iapp - checks if skb is an IAPP packet
++ *
++ * @skb: skb to check
++ */
++static bool brcmf_skb_is_iapp(struct sk_buff *skb)
++{
++	static const u8 iapp_l2_update_packet[6] __aligned(2) = {
++		0x00, 0x01, 0xaf, 0x81, 0x01, 0x00,
++	};
++	unsigned char *eth_data;
++#if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++	const u16 *a, *b;
++#endif
++
++	if (skb->len - skb->mac_len != 6 ||
++	    !is_multicast_ether_addr(eth_hdr(skb)->h_dest))
++		return false;
++
++	eth_data = skb_mac_header(skb) + ETH_HLEN;
++#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++	return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) |
++		 ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4))));
++#else
++	a = (const u16 *)eth_data;
++	b = (const u16 *)iapp_l2_update_packet;
++
++	return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]));
++#endif
++}
++
+ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+ 					   struct net_device *ndev)
+ {
+@@ -250,6 +281,23 @@ static netdev_tx_t brcmf_netdev_start_xm
+ 		goto done;
+ 	}
+ 
++	/* Some recent Broadcom's firmwares disassociate STA when they receive
++	 * an 802.11f ADD frame. This behavior can lead to a local DoS security
++	 * issue. Attacker may trigger disassociation of any STA by sending a
++	 * proper Ethernet frame to the wireless interface.
++	 *
++	 * Moreover this feature may break AP interfaces in some specific
++	 * setups. This applies e.g. to the bridge with hairpin mode enabled and
++	 * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware
++	 * will get passed back to the wireless interface and cause immediate
++	 * disassociation of a just-connected STA.
++	 */
++	if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
++		dev_kfree_skb(skb);
++		ret = -EINVAL;
++		goto done;
++	}
++
+ 	/* Make sure there's enough writeable headroom */
+ 	if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
+ 		head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
+@@ -325,6 +373,15 @@ void brcmf_txflowblock_if(struct brcmf_i
+ 
+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
+ {
++	/* Most of Broadcom's firmwares send 802.11f ADD frame every time a new
++	 * STA connects to the AP interface. This is an obsoleted standard most
++	 * users don't use, so don't pass these frames up unless requested.
++	 */
++	if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
++		brcmu_pkt_buf_free_skb(skb);
++		return;
++	}
++
+ 	if (skb->pkt_type == PACKET_MULTICAST)
+ 		ifp->ndev->stats.multicast++;
+ 
diff --git a/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch b/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
new file mode 100644
index 0000000000..d45f64ff23
--- /dev/null
+++ b/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
@@ -0,0 +1,29 @@
+From 9b9322db5c5a1917a66c71fe47c3848a9a31227e Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 14 Mar 2018 20:02:59 +0100
+Subject: [PATCH] brcmfmac: Fix check for ISO3166 code
+
+The commit "regulatory: add NUL to request alpha2" increases the length of
+alpha2 to 3. This causes a regression on brcmfmac, because
+brcmf_cfg80211_reg_notifier() expect valid ISO3166 codes in the complete
+array. So fix this accordingly.
+
+Fixes: 657308f73e67 ("regulatory: add NUL to request alpha2")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6803,7 +6803,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 		return;
+ 
+ 	/* ignore non-ISO3166 country codes */
+-	for (i = 0; i < sizeof(req->alpha2); i++)
++	for (i = 0; i < 2; i++)
+ 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+ 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
+ 				  req->alpha2[0], req->alpha2[1]);
diff --git a/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch b/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
new file mode 100644
index 0000000000..f4d9a84b25
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
@@ -0,0 +1,45 @@
+From da472385a29f1fddcac7cfa0499482704310bd16 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:18 +0100
+Subject: [PATCH] brcmfmac: move brcmf_bus_preinit() call just after changing
+ bus state
+
+Moving the brcmf_bus_preinit() call allows the bus code to do some
+required initialization before handling firmware control messages.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 3 ---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 5 +++++
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -369,9 +369,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 
+ 	/* Enable tx beamforming, errors can be ignored (not supported) */
+ 	(void)brcmf_fil_iovar_int_set(ifp, "txbf", 1);
+-
+-	/* do bus specific preinit here */
+-	err = brcmf_bus_preinit(ifp->drvr->bus_if);
+ done:
+ 	return err;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1091,6 +1091,11 @@ int brcmf_bus_started(struct device *dev
+ 	/* signal bus ready */
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
+ 
++	/* do bus specific preinit here */
++	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
++	if (ret < 0)
++		goto fail;
++
+ 	/* Bus is ready, do any initialization */
+ 	ret = brcmf_c_preinit_dcmds(ifp);
+ 	if (ret < 0)
diff --git a/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch b/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
new file mode 100644
index 0000000000..230e891cea
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
@@ -0,0 +1,69 @@
+From 4b5adc736828dc25ca33e263ad8c0b9dcd3bf325 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:19 +0100
+Subject: [PATCH] brcmfmac: move allocation of control rx buffer to
+ brcmf_sdio_bus_preinit()
+
+Allocate the control rx buffer needed for firmware control interface
+during brcmf_sdio_bus_preinit(). This relies on common layer setting
+struct brcmf_bus::maxctl during brcmf_attach(). By moving the allocation
+we can move brcmf_attach() in subsequent change.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 26 ++++++++++------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1707,7 +1707,6 @@ brcmf_sdio_read_control(struct brcmf_sdi
+ 	int sdret;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+-
+ 	if (bus->rxblen)
+ 		buf = vzalloc(bus->rxblen);
+ 	if (!buf)
+@@ -3411,6 +3410,18 @@ static int brcmf_sdio_bus_preinit(struct
+ 	u32 value;
+ 	int err;
+ 
++	/* maxctl provided by common layer */
++	if (WARN_ON(!bus_if->maxctl))
++		return -EINVAL;
++
++	/* Allocate control receive buffer */
++	bus_if->maxctl += bus->roundup;
++	value = roundup((bus_if->maxctl + SDPCM_HDRLEN), ALIGNMENT);
++	value += bus->head_align;
++	bus->rxbuf = kmalloc(value, GFP_ATOMIC);
++	if (bus->rxbuf)
++		bus->rxblen = value;
++
+ 	/* the commands below use the terms tx and rx from
+ 	 * a device perspective, ie. bus:txglom affects the
+ 	 * bus transfers from device to host.
+@@ -4209,19 +4220,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	bus->blocksize = bus->sdiodev->func2->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+ 
+-	/* Allocate buffers */
+-	if (bus->sdiodev->bus_if->maxctl) {
+-		bus->sdiodev->bus_if->maxctl += bus->roundup;
+-		bus->rxblen =
+-		    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
+-			    ALIGNMENT) + bus->head_align;
+-		bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
+-		if (!(bus->rxbuf)) {
+-			brcmf_err("rxbuf allocation failed\n");
+-			goto fail;
+-		}
+-	}
+-
+ 	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* Disable F2 to clear any intermediate frame state on the dongle */
diff --git a/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch b/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
new file mode 100644
index 0000000000..a8b0171cb3
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
@@ -0,0 +1,106 @@
+From 262f2b53f67936b59cc8dfc6f3899ab8905bf1ed Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:20 +0100
+Subject: [PATCH] brcmfmac: call brcmf_attach() just before calling
+ brcmf_bus_started()
+
+Now we can move brcmf_attach() until after the firmware has been downloaded
+to the device. Make the call just before brcmf_bus_started().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  6 ++++
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 34 +++++++++++-----------
+ 2 files changed, 23 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1268,6 +1268,12 @@ void brcmf_bus_change_state(struct brcmf
+ 	int ifidx;
+ 
+ 	brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
++
++	if (!drvr) {
++		brcmf_dbg(INFO, "ignoring transition, bus not attached yet\n");
++		return;
++	}
++
+ 	bus->state = state;
+ 
+ 	if (state == BRCMF_BUS_UP) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4048,9 +4048,6 @@ static void brcmf_sdio_firmware_callback
+ 	if (err)
+ 		goto fail;
+ 
+-	if (!bus_if->drvr)
+-		return;
+-
+ 	/* try to download image and nvram to the dongle */
+ 	bus->alp_only = true;
+ 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+@@ -4126,11 +4123,28 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	sdio_release_host(sdiodev->func1);
+ 
++	/* Assign bus interface call back */
++	sdiodev->bus_if->dev = sdiodev->dev;
++	sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
++	sdiodev->bus_if->chip = bus->ci->chip;
++	sdiodev->bus_if->chiprev = bus->ci->chiprev;
++
++	/* Attach to the common layer, reserve hdr space */
++	err = brcmf_attach(sdiodev->dev, sdiodev->settings);
++	if (err != 0) {
++		brcmf_err("brcmf_attach failed\n");
++		goto fail;
++	}
++
++	brcmf_sdio_debugfs_create(bus);
++
+ 	err = brcmf_bus_started(dev);
+ 	if (err != 0) {
+ 		brcmf_err("dongle is not responding\n");
+ 		goto fail;
+ 	}
++
++	/* ready */
+ 	return;
+ 
+ release:
+@@ -4200,22 +4214,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	bus->dpc_triggered = false;
+ 	bus->dpc_running = false;
+ 
+-	/* Assign bus interface call back */
+-	bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
+-	bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
+-	bus->sdiodev->bus_if->chip = bus->ci->chip;
+-	bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
+-
+ 	/* default sdio bus header length for tx packet */
+ 	bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
+ 
+-	/* Attach to the common layer, reserve hdr space */
+-	ret = brcmf_attach(bus->sdiodev->dev, bus->sdiodev->settings);
+-	if (ret != 0) {
+-		brcmf_err("brcmf_attach failed\n");
+-		goto fail;
+-	}
+-
+ 	/* Query the F2 block size, set roundup accordingly */
+ 	bus->blocksize = bus->sdiodev->func2->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+@@ -4240,7 +4241,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	/* SR state */
+ 	bus->sr_enabled = false;
+ 
+-	brcmf_sdio_debugfs_create(bus);
+ 	brcmf_dbg(INFO, "completed!!\n");
+ 
+ 	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
diff --git a/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch b/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
new file mode 100644
index 0000000000..00c4141cc5
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
@@ -0,0 +1,41 @@
+From a7f4a80c0070b673d4a4ce94b99979ea6d0c6296 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:21 +0100
+Subject: [PATCH] brcmfmac: usb: call brcmf_usb_up() during brcmf_bus_preinit()
+
+By calling brcmf_usb_up() during brcmf_bus_preinit() it does not need
+to be called in brcmf_usb_bus_setup().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1146,8 +1146,9 @@ static int brcmf_usb_get_fwname(struct d
+ }
+ 
+ static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
+-	.txdata = brcmf_usb_tx,
++	.preinit = brcmf_usb_up,
+ 	.stop = brcmf_usb_down,
++	.txdata = brcmf_usb_tx,
+ 	.txctl = brcmf_usb_tx_ctlpkt,
+ 	.rxctl = brcmf_usb_rx_ctlpkt,
+ 	.wowl_config = brcmf_usb_wowl_config,
+@@ -1165,10 +1166,6 @@ static int brcmf_usb_bus_setup(struct br
+ 		return ret;
+ 	}
+ 
+-	ret = brcmf_usb_up(devinfo->dev);
+-	if (ret)
+-		goto fail;
+-
+ 	ret = brcmf_bus_started(devinfo->dev);
+ 	if (ret)
+ 		goto fail;
diff --git a/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch b/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
new file mode 100644
index 0000000000..086b5fadcc
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
@@ -0,0 +1,130 @@
+From 0542503c4c164c65cd1567b0f2b3f887af6c81eb Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:22 +0100
+Subject: [PATCH] brcmfmac: move brcmf_attach() function in core.c
+
+Moving the function in preparation of subsequent patch.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 98 +++++++++++-----------
+ 1 file changed, 49 insertions(+), 49 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -992,55 +992,6 @@ static int brcmf_inet6addr_changed(struc
+ }
+ #endif
+ 
+-int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
+-{
+-	struct brcmf_pub *drvr = NULL;
+-	int ret = 0;
+-	int i;
+-
+-	brcmf_dbg(TRACE, "Enter\n");
+-
+-	/* Allocate primary brcmf_info */
+-	drvr = kzalloc(sizeof(struct brcmf_pub), GFP_ATOMIC);
+-	if (!drvr)
+-		return -ENOMEM;
+-
+-	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
+-		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
+-
+-	mutex_init(&drvr->proto_block);
+-
+-	/* Link to bus module */
+-	drvr->hdrlen = 0;
+-	drvr->bus_if = dev_get_drvdata(dev);
+-	drvr->bus_if->drvr = drvr;
+-	drvr->settings = settings;
+-
+-	/* attach debug facilities */
+-	brcmf_debug_attach(drvr);
+-
+-	/* Attach and link in the protocol */
+-	ret = brcmf_proto_attach(drvr);
+-	if (ret != 0) {
+-		brcmf_err("brcmf_prot_attach failed\n");
+-		goto fail;
+-	}
+-
+-	/* Attach to events important for core code */
+-	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
+-			    brcmf_psm_watchdog_notify);
+-
+-	/* attach firmware event handler */
+-	brcmf_fweh_attach(drvr);
+-
+-	return ret;
+-
+-fail:
+-	brcmf_detach(dev);
+-
+-	return ret;
+-}
+-
+ static int brcmf_revinfo_read(struct seq_file *s, void *data)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(s->private);
+@@ -1170,6 +1121,55 @@ fail:
+ 
+ 	return ret;
+ }
++
++int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
++{
++	struct brcmf_pub *drvr = NULL;
++	int ret = 0;
++	int i;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Allocate primary brcmf_info */
++	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
++	if (!drvr)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
++		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
++
++	mutex_init(&drvr->proto_block);
++
++	/* Link to bus module */
++	drvr->hdrlen = 0;
++	drvr->bus_if = dev_get_drvdata(dev);
++	drvr->bus_if->drvr = drvr;
++	drvr->settings = settings;
++
++	/* attach debug facilities */
++	brcmf_debug_attach(drvr);
++
++	/* Attach and link in the protocol */
++	ret = brcmf_proto_attach(drvr);
++	if (ret != 0) {
++		brcmf_err("brcmf_prot_attach failed\n");
++		goto fail;
++	}
++
++	/* Attach to events important for core code */
++	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
++			    brcmf_psm_watchdog_notify);
++
++	/* attach firmware event handler */
++	brcmf_fweh_attach(drvr);
++
++	return ret;
++
++fail:
++	brcmf_detach(dev);
++
++	return ret;
++}
+ 
+ void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
+ {
diff --git a/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch b/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
new file mode 100644
index 0000000000..6d23ccdac2
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
@@ -0,0 +1,190 @@
+From de2a3027f6f15e2f6558dc4d178282ccc1f054db Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:23 +0100
+Subject: [PATCH] brcmfmac: remove brcmf_bus_started() from bus api
+
+No longer needed to call this in bus layer so make it static and call
+it in the last phase of brcmf_attach() instead.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  1 -
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 14 +++++++----
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 20 +---------------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 10 ++------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 28 ++++------------------
+ 5 files changed, 16 insertions(+), 57 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -253,7 +253,6 @@ void brcmf_dev_reset(struct device *dev)
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+ 
+-int brcmf_bus_started(struct device *dev);
+ s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
+ void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1022,11 +1022,10 @@ static int brcmf_revinfo_read(struct seq
+ 	return 0;
+ }
+ 
+-int brcmf_bus_started(struct device *dev)
++static int brcmf_bus_started(struct brcmf_pub *drvr)
+ {
+ 	int ret = -1;
+-	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_pub *drvr = bus_if->drvr;
++	struct brcmf_bus *bus_if = drvr->bus_if;
+ 	struct brcmf_if *ifp;
+ 	struct brcmf_if *p2p_ifp;
+ 
+@@ -1043,7 +1042,7 @@ int brcmf_bus_started(struct device *dev
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
+ 
+ 	/* do bus specific preinit here */
+-	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
++	ret = brcmf_bus_preinit(bus_if);
+ 	if (ret < 0)
+ 		goto fail;
+ 
+@@ -1163,7 +1162,12 @@ int brcmf_attach(struct device *dev, str
+ 	/* attach firmware event handler */
+ 	brcmf_fweh_attach(drvr);
+ 
+-	return ret;
++	ret = brcmf_bus_started(drvr);
++	if (ret != 0) {
++		brcmf_err("dongle is not responding: err=%d\n", ret);
++		goto fail;
++	}
++	return 0;
+ 
+ fail:
+ 	brcmf_detach(dev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1581,24 +1581,6 @@ static void brcmf_pcie_release_resource(
+ }
+ 
+ 
+-static int brcmf_pcie_attach_bus(struct brcmf_pciedev_info *devinfo)
+-{
+-	int ret;
+-
+-	/* Attach to the common driver interface */
+-	ret = brcmf_attach(&devinfo->pdev->dev, devinfo->settings);
+-	if (ret) {
+-		brcmf_err("brcmf_attach failed\n");
+-	} else {
+-		ret = brcmf_bus_started(&devinfo->pdev->dev);
+-		if (ret)
+-			brcmf_err("dongle is not responding\n");
+-	}
+-
+-	return ret;
+-}
+-
+-
+ static u32 brcmf_pcie_buscore_prep_addr(const struct pci_dev *pdev, u32 addr)
+ {
+ 	u32 ret_addr;
+@@ -1735,7 +1717,7 @@ static void brcmf_pcie_setup(struct devi
+ 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
+ 
+ 	brcmf_pcie_intr_enable(devinfo);
+-	if (brcmf_pcie_attach_bus(devinfo) == 0)
++	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
+ 		return;
+ 
+ 	brcmf_pcie_bus_console_read(devinfo);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3422,6 +3422,8 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (bus->rxbuf)
+ 		bus->rxblen = value;
+ 
++	brcmf_sdio_debugfs_create(bus);
++
+ 	/* the commands below use the terms tx and rx from
+ 	 * a device perspective, ie. bus:txglom affects the
+ 	 * bus transfers from device to host.
+@@ -4136,14 +4138,6 @@ static void brcmf_sdio_firmware_callback
+ 		goto fail;
+ 	}
+ 
+-	brcmf_sdio_debugfs_create(bus);
+-
+-	err = brcmf_bus_started(dev);
+-	if (err != 0) {
+-		brcmf_err("dongle is not responding\n");
+-		goto fail;
+-	}
+-
+ 	/* ready */
+ 	return;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1155,27 +1155,6 @@ static const struct brcmf_bus_ops brcmf_
+ 	.get_fwname = brcmf_usb_get_fwname,
+ };
+ 
+-static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
+-{
+-	int ret;
+-
+-	/* Attach to the common driver interface */
+-	ret = brcmf_attach(devinfo->dev, devinfo->settings);
+-	if (ret) {
+-		brcmf_err("brcmf_attach failed\n");
+-		return ret;
+-	}
+-
+-	ret = brcmf_bus_started(devinfo->dev);
+-	if (ret)
+-		goto fail;
+-
+-	return 0;
+-fail:
+-	brcmf_detach(devinfo->dev);
+-	return ret;
+-}
+-
+ static void brcmf_usb_probe_phase2(struct device *dev, int ret,
+ 				   const struct firmware *fw,
+ 				   void *nvram, u32 nvlen)
+@@ -1203,7 +1182,8 @@ static void brcmf_usb_probe_phase2(struc
+ 	if (ret)
+ 		goto error;
+ 
+-	ret = brcmf_usb_bus_setup(devinfo);
++	/* Attach to the common driver interface */
++	ret = brcmf_attach(devinfo->dev, devinfo->settings);
+ 	if (ret)
+ 		goto error;
+ 
+@@ -1253,7 +1233,7 @@ static int brcmf_usb_probe_cb(struct brc
+ 	}
+ 
+ 	if (!brcmf_usb_dlneeded(devinfo)) {
+-		ret = brcmf_usb_bus_setup(devinfo);
++		ret = brcmf_attach(devinfo->dev, devinfo->settings);
+ 		if (ret)
+ 			goto fail;
+ 		/* we are done */
+@@ -1456,7 +1436,7 @@ static int brcmf_usb_resume(struct usb_i
+ 
+ 	brcmf_dbg(USB, "Enter\n");
+ 	if (!devinfo->wowl_enabled)
+-		return brcmf_usb_bus_setup(devinfo);
++		return brcmf_attach(devinfo->dev, devinfo->settings);
+ 
+ 	devinfo->bus_pub.state = BRCMFMAC_USB_STATE_UP;
+ 	brcmf_usb_rx_fill_all(devinfo);
diff --git a/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch b/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
new file mode 100644
index 0000000000..344826912d
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
@@ -0,0 +1,64 @@
+From d678296bfb9a630d0000222fc21f4ed0d0d65332 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:24 +0100
+Subject: [PATCH] brcmfmac: change log level for some low-level sdio functions
+
+Reducing the number of trace level messages in sdio code giving
+them sdio log level instead.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1706,7 +1706,7 @@ brcmf_sdio_read_control(struct brcmf_sdi
+ 	u8 *buf = NULL, *rbuf;
+ 	int sdret;
+ 
+-	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(SDIO, "Enter\n");
+ 	if (bus->rxblen)
+ 		buf = vzalloc(bus->rxblen);
+ 	if (!buf)
+@@ -1809,7 +1809,7 @@ static uint brcmf_sdio_readframes(struct
+ 	struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
+ 	u8 head_read = 0;
+ 
+-	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Not finished unless we encounter no more frames indication */
+ 	bus->rxpending = true;
+@@ -2344,7 +2344,7 @@ static int brcmf_sdio_tx_ctrlframe(struc
+ 	struct brcmf_sdio_hdrinfo hd_info = {0};
+ 	int ret;
+ 
+-	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	/* Back the pointer to make room for bus header */
+ 	frame -= bus->tx_hdrlen;
+@@ -2520,7 +2520,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	uint framecnt;			/* Temporary counter of tx/rx frames */
+ 	int err = 0;
+ 
+-	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(SDIO, "Enter\n");
+ 
+ 	sdio_claim_host(bus->sdiodev->func1);
+ 
+@@ -2605,7 +2605,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	/* Would be active due to wake-wlan in gSPI */
+ 	if (intstatus & I_CHIPACTIVE) {
+-		brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
++		brcmf_dbg(SDIO, "Dongle reports CHIPACTIVE\n");
+ 		intstatus &= ~I_CHIPACTIVE;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch b/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
new file mode 100644
index 0000000000..39fba211fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
@@ -0,0 +1,126 @@
+From 2d6edad4b2da1991f74e7b02053eeb4a043b887f Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:25 +0100
+Subject: [PATCH] brcmfmac: remove duplicate pointer variable from
+ brcmf_sdio_firmware_callback()
+
+In brcmf_sdio_firmware_callback() two pointer variables were used
+pointing to the same construct. Get rid of sdiodev variable.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 37 +++++++++++-----------
+ 1 file changed, 18 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4039,9 +4039,8 @@ static void brcmf_sdio_firmware_callback
+ 					 void *nvram, u32 nvram_len)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+-	struct brcmf_sdio *bus = sdiodev->bus;
+-	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiod->bus;
+ 	struct brcmf_core *core = bus->sdio_core;
+ 	u8 saveclk;
+ 
+@@ -4061,7 +4060,7 @@ static void brcmf_sdio_firmware_callback
+ 	bus->sdcnt.tickcnt = 0;
+ 	brcmf_sdio_wd_timer(bus, true);
+ 
+-	sdio_claim_host(sdiodev->func1);
++	sdio_claim_host(sdiod->func1);
+ 
+ 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+@@ -4069,9 +4068,9 @@ static void brcmf_sdio_firmware_callback
+ 		goto release;
+ 
+ 	/* Force clocks on backplane to be sure F2 interrupt propagates */
+-	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
++	saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 	if (!err) {
+-		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
+ 				   (saveclk | SBSDIO_FORCE_HT), &err);
+ 	}
+ 	if (err) {
+@@ -4083,7 +4082,7 @@ static void brcmf_sdio_firmware_callback
+ 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
+ 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
+ 
+-	err = sdio_enable_func(sdiodev->func2);
++	err = sdio_enable_func(sdiod->func2);
+ 
+ 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+ 
+@@ -4095,10 +4094,10 @@ static void brcmf_sdio_firmware_callback
+ 				   bus->hostintmask, NULL);
+ 
+ 
+-		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
++		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+-		sdio_disable_func(sdiodev->func2);
++		sdio_disable_func(sdiod->func2);
+ 		goto release;
+ 	}
+ 
+@@ -4106,7 +4105,7 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdio_sr_init(bus);
+ 	} else {
+ 		/* Restore previous clock setting */
+-		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
+ 				   saveclk, &err);
+ 	}
+ 
+@@ -4114,7 +4113,7 @@ static void brcmf_sdio_firmware_callback
+ 		/* Allow full data communication using DPC from now on. */
+ 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
+ 
+-		err = brcmf_sdiod_intr_register(sdiodev);
++		err = brcmf_sdiod_intr_register(sdiod);
+ 		if (err != 0)
+ 			brcmf_err("intr register failed:%d\n", err);
+ 	}
+@@ -4123,16 +4122,16 @@ static void brcmf_sdio_firmware_callback
+ 	if (err != 0)
+ 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
+ 
+-	sdio_release_host(sdiodev->func1);
++	sdio_release_host(sdiod->func1);
+ 
+ 	/* Assign bus interface call back */
+-	sdiodev->bus_if->dev = sdiodev->dev;
+-	sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
+-	sdiodev->bus_if->chip = bus->ci->chip;
+-	sdiodev->bus_if->chiprev = bus->ci->chiprev;
++	sdiod->bus_if->dev = sdiod->dev;
++	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
++	sdiod->bus_if->chip = bus->ci->chip;
++	sdiod->bus_if->chiprev = bus->ci->chiprev;
+ 
+ 	/* Attach to the common layer, reserve hdr space */
+-	err = brcmf_attach(sdiodev->dev, sdiodev->settings);
++	err = brcmf_attach(sdiod->dev, sdiod->settings);
+ 	if (err != 0) {
+ 		brcmf_err("brcmf_attach failed\n");
+ 		goto fail;
+@@ -4142,10 +4141,10 @@ static void brcmf_sdio_firmware_callback
+ 	return;
+ 
+ release:
+-	sdio_release_host(sdiodev->func1);
++	sdio_release_host(sdiod->func1);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(&sdiodev->func2->dev);
++	device_release_driver(&sdiod->func2->dev);
+ 	device_release_driver(dev);
+ }
+ 
diff --git a/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch b/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
new file mode 100644
index 0000000000..b83f2fce8b
--- /dev/null
+++ b/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
@@ -0,0 +1,27 @@
+From 64d1519edc959f5b8f86a66a51c40971c215e4ec Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 19 Feb 2018 13:30:45 +0100
+Subject: [PATCH] brcmfmac: reject too long PSK
+
+nl80211 already allows specifying 48 bytes, but brcmfmac
+only supports 32. Reject keys that are too long.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5125,6 +5125,9 @@ static int brcmf_cfg80211_set_pmk(struct
+ 	if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
+ 		return -EINVAL;
+ 
++	if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
++		return -ERANGE;
++
+ 	return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
+ }
+ 
diff --git a/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch b/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
new file mode 100644
index 0000000000..2e9ec8b963
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
@@ -0,0 +1,31 @@
+From 1170f6d1be6a39e1a115a2c0f50923eb4ce2a7ec Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:20 +0100
+Subject: [PATCH] brcmfmac: do not convert linux error to firmware error string
+
+In case of a linux error brcmf_fil_cmd_data() blurts an error message
+in which the error code is translated to an error string. However, it
+maps it to a firmware error string which should not happen. Simply
+print only the numeric error code and be done with it.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -124,8 +124,7 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 					     data, len, &fwerr);
+ 
+ 	if (err) {
+-		brcmf_dbg(FIL, "Failed: %s (%d)\n",
+-			  brcmf_fil_get_errstr((u32)(-err)), err);
++		brcmf_dbg(FIL, "Failed: error=%d\n", err);
+ 	} else if (fwerr < 0) {
+ 		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
+ 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
diff --git a/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch b/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
new file mode 100644
index 0000000000..790811957a
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
@@ -0,0 +1,203 @@
+From 756a2b390874d274f2f615921318ef0856ff9313 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:21 +0100
+Subject: [PATCH] brcmfmac: use brcmf_chip_name() to store name in revinfo
+
+The chip id can either be four or five digits. For the chip name either
+the hexadecimal value needs to be taken (four digits) or the decimal
+value (five digits). The function brcmf_chip_name() does this conversion
+so use it to store the name in driver revision info.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |  9 +++++----
+ .../wireless/broadcom/brcm80211/brcmfmac/chip.h    |  3 ++-
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 23 ++++++++++++++++------
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 +---------
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  3 +--
+ 5 files changed, 26 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -464,12 +464,12 @@ static void brcmf_chip_ai_resetcore(stru
+ 	ci->ops->read32(ci->ctx, core->wrapbase + BCMA_IOCTL);
+ }
+ 
+-static char *brcmf_chip_name(uint chipid, char *buf, uint len)
++char *brcmf_chip_name(u32 id, u32 rev, char *buf, uint len)
+ {
+ 	const char *fmt;
+ 
+-	fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
+-	snprintf(buf, len, fmt, chipid);
++	fmt = ((id > 0xa000) || (id < 0x4000)) ? "BCM%d/%u" : "BCM%x/%u";
++	snprintf(buf, len, fmt, id, rev);
+ 	return buf;
+ }
+ 
+@@ -924,7 +924,8 @@ static int brcmf_chip_recognition(struct
+ 	ci->pub.chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
+ 	socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+ 
+-	brcmf_chip_name(ci->pub.chip, ci->pub.name, sizeof(ci->pub.name));
++	brcmf_chip_name(ci->pub.chip, ci->pub.chiprev,
++			ci->pub.name, sizeof(ci->pub.name));
+ 	brcmf_dbg(INFO, "found %s chip: BCM%s, rev=%d\n",
+ 		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name,
+ 		  ci->pub.chiprev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
+@@ -45,7 +45,7 @@ struct brcmf_chip {
+ 	u32 rambase;
+ 	u32 ramsize;
+ 	u32 srsize;
+-	char name[8];
++	char name[12];
+ };
+ 
+ /**
+@@ -93,5 +93,6 @@ void brcmf_chip_resetcore(struct brcmf_c
+ void brcmf_chip_set_passive(struct brcmf_chip *ci);
+ bool brcmf_chip_set_active(struct brcmf_chip *ci, u32 rstvec);
+ bool brcmf_chip_sr_capable(struct brcmf_chip *pub);
++char *brcmf_chip_name(u32 chipid, u32 chiprev, char *buf, uint len);
+ 
+ #endif /* BRCMF_AXIDMP_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -30,6 +30,7 @@
+ #include "common.h"
+ #include "of.h"
+ #include "firmware.h"
++#include "chip.h"
+ 
+ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+@@ -131,14 +132,13 @@ static int brcmf_c_download(struct brcmf
+ static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
+ {
+ 	struct brcmf_bus *bus = ifp->drvr->bus_if;
+-	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
+ 	u8 fw_name[BRCMF_FW_NAME_LEN];
+ 	u8 *ptr;
+ 	size_t len;
+ 	s32 err;
+ 
+ 	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
+-	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
++	err = brcmf_bus_get_fwname(bus, bus->chip, bus->chiprev, fw_name);
+ 	if (err) {
+ 		brcmf_err("get firmware name failed (%d)\n", err);
+ 		goto done;
+@@ -238,6 +238,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ {
+ 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+ 	u8 buf[BRCMF_DCMD_SMLEN];
++	struct brcmf_bus *bus;
+ 	struct brcmf_rev_info_le revinfo;
+ 	struct brcmf_rev_info *ri;
+ 	char *clmver;
+@@ -253,16 +254,18 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	}
+ 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+ 
++	bus = ifp->drvr->bus_if;
++	ri = &ifp->drvr->revinfo;
++
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
+ 				     &revinfo, sizeof(revinfo));
+-	ri = &ifp->drvr->revinfo;
+ 	if (err < 0) {
+ 		brcmf_err("retrieving revision info failed, %d\n", err);
++		strlcpy(ri->chipname, "UNKNOWN", sizeof(ri->chipname));
+ 	} else {
+ 		ri->vendorid = le32_to_cpu(revinfo.vendorid);
+ 		ri->deviceid = le32_to_cpu(revinfo.deviceid);
+ 		ri->radiorev = le32_to_cpu(revinfo.radiorev);
+-		ri->chiprev = le32_to_cpu(revinfo.chiprev);
+ 		ri->corerev = le32_to_cpu(revinfo.corerev);
+ 		ri->boardid = le32_to_cpu(revinfo.boardid);
+ 		ri->boardvendor = le32_to_cpu(revinfo.boardvendor);
+@@ -270,15 +273,23 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		ri->driverrev = le32_to_cpu(revinfo.driverrev);
+ 		ri->ucoderev = le32_to_cpu(revinfo.ucoderev);
+ 		ri->bus = le32_to_cpu(revinfo.bus);
+-		ri->chipnum = le32_to_cpu(revinfo.chipnum);
+ 		ri->phytype = le32_to_cpu(revinfo.phytype);
+ 		ri->phyrev = le32_to_cpu(revinfo.phyrev);
+ 		ri->anarev = le32_to_cpu(revinfo.anarev);
+ 		ri->chippkg = le32_to_cpu(revinfo.chippkg);
+ 		ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
++
++		if (!bus->chip) {
++			bus->chip = le32_to_cpu(revinfo.chipnum);
++			bus->chiprev = le32_to_cpu(revinfo.chiprev);
++		}
+ 	}
+ 	ri->result = err;
+ 
++	if (bus->chip)
++		brcmf_chip_name(bus->chip, bus->chiprev,
++				ri->chipname, sizeof(ri->chipname));
++
+ 	/* Do any CLM downloading */
+ 	err = brcmf_c_process_clm_blob(ifp);
+ 	if (err < 0) {
+@@ -299,7 +310,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	strsep(&ptr, "\n");
+ 
+ 	/* Print fw version info */
+-	brcmf_info("Firmware version = %s\n", buf);
++	brcmf_info("Firmware: %s %s\n", ri->chipname, buf);
+ 
+ 	/* locate firmware version number for ethtool */
+ 	ptr = strrchr(buf, ' ') + 1;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1002,8 +1002,7 @@ static int brcmf_revinfo_read(struct seq
+ 	seq_printf(s, "vendorid: 0x%04x\n", ri->vendorid);
+ 	seq_printf(s, "deviceid: 0x%04x\n", ri->deviceid);
+ 	seq_printf(s, "radiorev: %s\n", brcmu_dotrev_str(ri->radiorev, drev));
+-	seq_printf(s, "chipnum: %u (%x)\n", ri->chipnum, ri->chipnum);
+-	seq_printf(s, "chiprev: %u\n", ri->chiprev);
++	seq_printf(s, "chip: %s\n", ri->chipname);
+ 	seq_printf(s, "chippkg: %u\n", ri->chippkg);
+ 	seq_printf(s, "corerev: %u\n", ri->corerev);
+ 	seq_printf(s, "boardid: 0x%04x\n", ri->boardid);
+@@ -1053,13 +1052,6 @@ static int brcmf_bus_started(struct brcm
+ 
+ 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
+ 
+-	/* assure we have chipid before feature attach */
+-	if (!bus_if->chip) {
+-		bus_if->chip = drvr->revinfo.chipnum;
+-		bus_if->chiprev = drvr->revinfo.chiprev;
+-		brcmf_dbg(INFO, "firmware revinfo: chip %x (%d) rev %d\n",
+-			  bus_if->chip, bus_if->chip, bus_if->chiprev);
+-	}
+ 	brcmf_feat_attach(drvr);
+ 
+ 	ret = brcmf_proto_init_done(drvr);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -87,7 +87,6 @@ struct brcmf_rev_info {
+ 	u32 vendorid;
+ 	u32 deviceid;
+ 	u32 radiorev;
+-	u32 chiprev;
+ 	u32 corerev;
+ 	u32 boardid;
+ 	u32 boardvendor;
+@@ -95,7 +94,7 @@ struct brcmf_rev_info {
+ 	u32 driverrev;
+ 	u32 ucoderev;
+ 	u32 bus;
+-	u32 chipnum;
++	char chipname[12];
+ 	u32 phytype;
+ 	u32 phyrev;
+ 	u32 anarev;
diff --git a/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch b/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
new file mode 100644
index 0000000000..e3d06f32cc
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
@@ -0,0 +1,69 @@
+From c88cfa075de356ddf40c668896b2126340f19ba4 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:22 +0100
+Subject: [PATCH] brcmfmac: use brcmf_chip_name() for consistency
+
+When logging the chip id/revision information make use of
+brcmf_chip_name() so it is always the same.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c     | 5 ++---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 7 +++++--
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -926,9 +926,8 @@ static int brcmf_chip_recognition(struct
+ 
+ 	brcmf_chip_name(ci->pub.chip, ci->pub.chiprev,
+ 			ci->pub.name, sizeof(ci->pub.name));
+-	brcmf_dbg(INFO, "found %s chip: BCM%s, rev=%d\n",
+-		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name,
+-		  ci->pub.chiprev);
++	brcmf_dbg(INFO, "found %s chip: %s\n",
++		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name);
+ 
+ 	if (socitype == SOCI_SB) {
+ 		if (ci->pub.chip != BRCM_CC_4329_CHIP_ID) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -25,6 +25,7 @@
+ #include "firmware.h"
+ #include "core.h"
+ #include "common.h"
++#include "chip.h"
+ 
+ #define BRCMF_FW_MAX_NVRAM_SIZE			64000
+ #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
+@@ -567,6 +568,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
+ 			      char nvram_name[BRCMF_FW_NAME_LEN])
+ {
++	char chipname[12];
+ 	u32 i;
+ 	char end;
+ 
+@@ -581,6 +583,8 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 		return -ENODEV;
+ 	}
+ 
++	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
++
+ 	/* check if firmware path is provided by module parameter */
+ 	if (brcmf_mp_global.firmware_path[0] != '\0') {
+ 		strlcpy(fw_name, brcmf_mp_global.firmware_path,
+@@ -601,8 +605,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 	if ((nvram_name) && (mapping_table[i].nvram))
+ 		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
+ 
+-	brcmf_info("using %s for chip %#08x(%d) rev %#08x\n",
+-		   fw_name, chip, chip, chiprev);
++	brcmf_info("using %s for chip %s\n", fw_name, chipname);
+ 
+ 	return 0;
+ }
diff --git a/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch b/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
new file mode 100644
index 0000000000..42adff61b9
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
@@ -0,0 +1,452 @@
+From 856d5a011c86b59f6564be4508912fb1d866adfc Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:23 +0100
+Subject: [PATCH] brcmfmac: allocate struct brcmf_pub instance using
+ wiphy_new()
+
+Rework the driver so the wiphy instance holds the main driver information
+in its private buffer. Previously it held struct brcmf_cfg80211_info
+instance so a bit of reorg was needed. This was done so that the wiphy
+name or its parent device can be shown in debug output.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c  |  2 +-
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 86 ++++++++++------------
+ .../broadcom/brcm80211/brcmfmac/cfg80211.h         | 17 +++--
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  2 +
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 27 +++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
+ .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  2 +-
+ 7 files changed, 76 insertions(+), 61 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
+@@ -462,7 +462,7 @@ static void brcmf_btcoex_dhcp_end(struct
+ int brcmf_btcoex_set_mode(struct brcmf_cfg80211_vif *vif,
+ 			  enum brcmf_btcoex_mode mode, u16 duration)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(vif->wdev.wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
+ 	struct brcmf_btcoex_info *btci = cfg->btcoex;
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -753,7 +753,7 @@ s32 brcmf_notify_escan_complete(struct b
+ static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
+ 				       struct wireless_dev *wdev)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	int ret;
+@@ -786,7 +786,7 @@ err_unarm:
+ static
+ int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
+ 
+ 	if (ndev && ndev == cfg_to_ndev(cfg))
+@@ -831,7 +831,7 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 			 enum nl80211_iftype type,
+ 			 struct vif_params *params)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_vif *vif = ifp->vif;
+ 	s32 infra = 0;
+@@ -2127,17 +2127,15 @@ static s32
+ brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 			    s32 *dbm)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+-	struct net_device *ndev = cfg_to_ndev(cfg);
+-	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
+ 	s32 qdbm = 0;
+ 	s32 err;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+-	if (!check_vif_up(ifp->vif))
++	if (!check_vif_up(vif))
+ 		return -EIO;
+ 
+-	err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
++	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
+ 	if (err) {
+ 		brcmf_err("error (%d)\n", err);
+ 		goto done;
+@@ -3359,7 +3357,7 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 				struct cfg80211_sched_scan_request *req)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 
+ 	brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
+ 		  req->n_match_sets, req->n_ssids);
+@@ -5191,6 +5189,12 @@ static struct cfg80211_ops brcmf_cfg8021
+ 	.del_pmk = brcmf_cfg80211_del_pmk,
+ };
+ 
++struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
++{
++	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
++		       GFP_KERNEL);
++}
++
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+ 					   enum nl80211_iftype type)
+ {
+@@ -5898,7 +5902,7 @@ static void brcmf_update_bw40_channel_fl
+ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
+ 				    u32 bw_cap[])
+ {
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct ieee80211_channel *channel;
+ 	struct wiphy *wiphy;
+@@ -6013,7 +6017,7 @@ fail_pbuf:
+ 
+ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct brcmf_fil_bwcap_le band_bwcap;
+ 	struct brcmf_chanspec_list *list;
+@@ -6198,10 +6202,10 @@ static void brcmf_update_vht_cap(struct
+ 	}
+ }
+ 
+-static int brcmf_setup_wiphybands(struct wiphy *wiphy)
++static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
++	struct wiphy *wiphy;
+ 	u32 nmode = 0;
+ 	u32 vhtmode = 0;
+ 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
+@@ -6795,8 +6799,8 @@ static s32 brcmf_translate_country_code(
+ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
+ 					struct regulatory_request *req)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct brcmf_fil_country_le ccreq;
+ 	s32 err;
+ 	int i;
+@@ -6831,7 +6835,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 		brcmf_err("Firmware rejected country setting\n");
+ 		return;
+ 	}
+-	brcmf_setup_wiphybands(wiphy);
++	brcmf_setup_wiphybands(cfg);
+ }
+ 
+ static void brcmf_free_wiphy(struct wiphy *wiphy)
+@@ -6858,17 +6862,15 @@ static void brcmf_free_wiphy(struct wiph
+ 	if (wiphy->wowlan != &brcmf_wowlan_support)
+ 		kfree(wiphy->wowlan);
+ #endif
+-	wiphy_free(wiphy);
+ }
+ 
+ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+-						  struct device *busdev,
++						  struct cfg80211_ops *ops,
+ 						  bool p2pdev_forced)
+ {
++	struct wiphy *wiphy = drvr->wiphy;
+ 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
+ 	struct brcmf_cfg80211_info *cfg;
+-	struct wiphy *wiphy;
+-	struct cfg80211_ops *ops;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	struct brcmf_if *ifp;
+ 	s32 err = 0;
+@@ -6880,26 +6882,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 		return NULL;
+ 	}
+ 
+-	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
+-	if (!ops)
+-		return NULL;
+-
+-	ifp = netdev_priv(ndev);
+-#ifdef CONFIG_PM
+-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
+-		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
+-#endif
+-	wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
+-	if (!wiphy) {
++	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
++	if (!cfg) {
+ 		brcmf_err("Could not allocate wiphy device\n");
+-		goto ops_out;
++		return NULL;
+ 	}
+-	memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
+-	set_wiphy_dev(wiphy, busdev);
+ 
+-	cfg = wiphy_priv(wiphy);
+ 	cfg->wiphy = wiphy;
+-	cfg->ops = ops;
+ 	cfg->pub = drvr;
+ 	init_vif_event(&cfg->vif_event);
+ 	INIT_LIST_HEAD(&cfg->vif_list);
+@@ -6908,6 +6897,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	if (IS_ERR(vif))
+ 		goto wiphy_out;
+ 
++	ifp = netdev_priv(ndev);
+ 	vif->ifp = ifp;
+ 	vif->wdev.netdev = ndev;
+ 	ndev->ieee80211_ptr = &vif->wdev;
+@@ -6934,6 +6924,11 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	if (err < 0)
+ 		goto priv_out;
+ 
++	/* regulatory notifer below needs access to cfg so
++	 * assign it now.
++	 */
++	drvr->config = cfg;
++
+ 	brcmf_dbg(INFO, "Registering custom regulatory\n");
+ 	wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
+ 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+@@ -6947,13 +6942,17 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 		cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
+ 		*cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+ 	}
++#ifdef CONFIG_PM
++	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
++		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
++#endif
+ 	err = wiphy_register(wiphy);
+ 	if (err < 0) {
+ 		brcmf_err("Could not register wiphy device (%d)\n", err);
+ 		goto priv_out;
+ 	}
+ 
+-	err = brcmf_setup_wiphybands(wiphy);
++	err = brcmf_setup_wiphybands(cfg);
+ 	if (err) {
+ 		brcmf_err("Setting wiphy bands failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+@@ -6970,12 +6969,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 		else
+ 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+ 	}
+-	/* p2p might require that "if-events" get processed by fweh. So
+-	 * activate the already registered event handlers now and activate
+-	 * the rest when initialization has completed. drvr->config needs to
+-	 * be assigned before activating events.
+-	 */
+-	drvr->config = cfg;
++
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+ 		brcmf_err("FWEH activation failed (%d)\n", err);
+@@ -7043,8 +7037,7 @@ priv_out:
+ 	ifp->vif = NULL;
+ wiphy_out:
+ 	brcmf_free_wiphy(wiphy);
+-ops_out:
+-	kfree(ops);
++	kfree(cfg);
+ 	return NULL;
+ }
+ 
+@@ -7059,4 +7052,5 @@ void brcmf_cfg80211_detach(struct brcmf_
+ 	kfree(cfg->ops);
+ 	wl_deinit_priv(cfg);
+ 	brcmf_free_wiphy(cfg->wiphy);
++	kfree(cfg);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -355,20 +355,24 @@ static inline struct wiphy *cfg_to_wiphy
+ 
+ static inline struct brcmf_cfg80211_info *wiphy_to_cfg(struct wiphy *w)
+ {
+-	return (struct brcmf_cfg80211_info *)(wiphy_priv(w));
++	struct brcmf_pub *drvr = wiphy_priv(w);
++	return drvr->config;
+ }
+ 
+ static inline struct brcmf_cfg80211_info *wdev_to_cfg(struct wireless_dev *wd)
+ {
+-	return (struct brcmf_cfg80211_info *)(wdev_priv(wd));
++	return wiphy_to_cfg(wd->wiphy);
++}
++
++static inline struct brcmf_cfg80211_vif *wdev_to_vif(struct wireless_dev *wdev)
++{
++	return container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+ }
+ 
+ static inline
+ struct net_device *cfg_to_ndev(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_cfg80211_vif *vif;
+-	vif = list_first_entry(&cfg->vif_list, struct brcmf_cfg80211_vif, list);
+-	return vif->wdev.netdev;
++	return brcmf_get_ifp(cfg->pub, 0)->ndev;
+ }
+ 
+ static inline struct brcmf_cfg80211_info *ndev_to_cfg(struct net_device *ndev)
+@@ -395,11 +399,12 @@ brcmf_cfg80211_connect_info *cfg_to_conn
+ }
+ 
+ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+-						  struct device *busdev,
++						  struct cfg80211_ops *ops,
+ 						  bool p2pdev_forced);
+ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
+ s32 brcmf_cfg80211_up(struct net_device *ndev);
+ s32 brcmf_cfg80211_down(struct net_device *ndev);
++struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
+ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
+ 
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -252,6 +252,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
+ 		goto done;
+ 	}
++	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
+ 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+ 
+ 	bus = ifp->drvr->bus_if;
+@@ -279,6 +280,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		ri->chippkg = le32_to_cpu(revinfo.chippkg);
+ 		ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
+ 
++		/* use revinfo if not known yet */
+ 		if (!bus->chip) {
+ 			bus->chip = le32_to_cpu(revinfo.chipnum);
+ 			bus->chiprev = le32_to_cpu(revinfo.chiprev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1021,7 +1021,7 @@ static int brcmf_revinfo_read(struct seq
+ 	return 0;
+ }
+ 
+-static int brcmf_bus_started(struct brcmf_pub *drvr)
++static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
+ {
+ 	int ret = -1;
+ 	struct brcmf_bus *bus_if = drvr->bus_if;
+@@ -1060,7 +1060,7 @@ static int brcmf_bus_started(struct brcm
+ 
+ 	brcmf_proto_add_if(drvr, ifp);
+ 
+-	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev,
++	drvr->config = brcmf_cfg80211_attach(drvr, ops,
+ 					     drvr->settings->p2p_enable);
+ 	if (drvr->config == NULL) {
+ 		ret = -ENOMEM;
+@@ -1115,17 +1115,26 @@ fail:
+ 
+ int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
+ {
++	struct wiphy *wiphy;
++	struct cfg80211_ops *ops;
+ 	struct brcmf_pub *drvr = NULL;
+ 	int ret = 0;
+ 	int i;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	/* Allocate primary brcmf_info */
+-	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
+-	if (!drvr)
++	ops = brcmf_cfg80211_get_ops();
++	if (!ops)
+ 		return -ENOMEM;
+ 
++	wiphy = wiphy_new(ops, sizeof(*drvr));
++	if (!wiphy)
++		return -ENOMEM;
++
++	set_wiphy_dev(wiphy, dev);
++	drvr = wiphy_priv(wiphy);
++	drvr->wiphy = wiphy;
++
+ 	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
+ 		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
+ 
+@@ -1154,15 +1163,18 @@ int brcmf_attach(struct device *dev, str
+ 	/* attach firmware event handler */
+ 	brcmf_fweh_attach(drvr);
+ 
+-	ret = brcmf_bus_started(drvr);
++	ret = brcmf_bus_started(drvr, ops);
+ 	if (ret != 0) {
+ 		brcmf_err("dongle is not responding: err=%d\n", ret);
+ 		goto fail;
+ 	}
++
++	drvr->config->ops = ops;
+ 	return 0;
+ 
+ fail:
+ 	brcmf_detach(dev);
++	kfree(ops);
+ 
+ 	return ret;
+ }
+@@ -1220,6 +1232,7 @@ void brcmf_detach(struct device *dev)
+ 		brcmf_remove_interface(drvr->iflist[i], false);
+ 
+ 	brcmf_cfg80211_detach(drvr->config);
++	drvr->config = NULL;
+ 
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
+@@ -1227,7 +1240,7 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_debug_detach(drvr);
+ 	bus_if->drvr = NULL;
+-	kfree(drvr);
++	wiphy_free(drvr->wiphy);
+ }
+ 
+ s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -107,6 +107,7 @@ struct brcmf_pub {
+ 	/* Linkage ponters */
+ 	struct brcmf_bus *bus_if;
+ 	struct brcmf_proto *proto;
++	struct wiphy *wiphy;
+ 	struct brcmf_cfg80211_info *config;
+ 
+ 	/* Internal brcmf items */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2229,7 +2229,7 @@ fail:
+  */
+ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	enum nl80211_iftype iftype;
diff --git a/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch b/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
new file mode 100644
index 0000000000..c5485c390a
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
@@ -0,0 +1,349 @@
+From 34789d0cf682c643862792750a06c31ccf016cbc Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:24 +0100
+Subject: [PATCH] brcmfmac: use wiphy debugfs dir entry
+
+The driver used to create a brcmfmac dir entry at the top level
+debugfs mount point. This moves the debugfs entries into the
+wiphy debugfs dir entry.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c    |  6 ++++
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ---
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 11 +++---
+ .../wireless/broadcom/brcm80211/brcmfmac/debug.c   | 42 ++--------------------
+ .../wireless/broadcom/brcm80211/brcmfmac/debug.h   | 17 ---------
+ .../wireless/broadcom/brcm80211/brcmfmac/feature.c |  3 ++
+ .../wireless/broadcom/brcm80211/brcmfmac/feature.h |  7 ++++
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c         | 11 +++---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.h         |  1 +
+ .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |  8 +++--
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.c   |  3 +-
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.h   |  7 ++++
+ 12 files changed, 47 insertions(+), 74 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -445,6 +445,11 @@ brcmf_proto_bcdc_init_done(struct brcmf_
+ 	return 0;
+ }
+ 
++static void brcmf_proto_bcdc_debugfs_create(struct brcmf_pub *drvr)
++{
++	brcmf_fws_debugfs_create(drvr);
++}
++
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc;
+@@ -472,6 +477,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 	drvr->proto->del_if = brcmf_proto_bcdc_del_if;
+ 	drvr->proto->reset_if = brcmf_proto_bcdc_reset_if;
+ 	drvr->proto->init_done = brcmf_proto_bcdc_init_done;
++	drvr->proto->debugfs_create = brcmf_proto_bcdc_debugfs_create;
+ 	drvr->proto->pd = bcdc;
+ 
+ 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -529,9 +529,6 @@ static int __init brcmfmac_module_init(v
+ {
+ 	int err;
+ 
+-	/* Initialize debug system first */
+-	brcmf_debugfs_init();
+-
+ 	/* Get the platform data (if available) for our devices */
+ 	err = platform_driver_probe(&brcmf_pd, brcmf_common_pd_probe);
+ 	if (err == -ENODEV)
+@@ -543,7 +540,6 @@ static int __init brcmfmac_module_init(v
+ 	/* Continue the initialization by registering the different busses */
+ 	err = brcmf_core_init();
+ 	if (err) {
+-		brcmf_debugfs_exit();
+ 		if (brcmfmac_pdata)
+ 			platform_driver_unregister(&brcmf_pd);
+ 	}
+@@ -556,7 +552,6 @@ static void __exit brcmfmac_module_exit(
+ 	brcmf_core_exit();
+ 	if (brcmfmac_pdata)
+ 		platform_driver_unregister(&brcmf_pd);
+-	brcmf_debugfs_exit();
+ }
+ 
+ module_init(brcmfmac_module_init);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1050,8 +1050,6 @@ static int brcmf_bus_started(struct brcm
+ 	if (ret < 0)
+ 		goto fail;
+ 
+-	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
+-
+ 	brcmf_feat_attach(drvr);
+ 
+ 	ret = brcmf_proto_init_done(drvr);
+@@ -1094,6 +1092,11 @@ static int brcmf_bus_started(struct brcm
+ #endif
+ #endif /* CONFIG_INET */
+ 
++	/* populate debugfs */
++	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
++	brcmf_feat_debugfs_create(drvr);
++	brcmf_proto_debugfs_create(drvr);
++
+ 	return 0;
+ 
+ fail:
+@@ -1146,9 +1149,6 @@ int brcmf_attach(struct device *dev, str
+ 	drvr->bus_if->drvr = drvr;
+ 	drvr->settings = settings;
+ 
+-	/* attach debug facilities */
+-	brcmf_debug_attach(drvr);
+-
+ 	/* Attach and link in the protocol */
+ 	ret = brcmf_proto_attach(drvr);
+ 	if (ret != 0) {
+@@ -1238,7 +1238,6 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_proto_detach(drvr);
+ 
+-	brcmf_debug_detach(drvr);
+ 	bus_if->drvr = NULL;
+ 	wiphy_free(drvr->wiphy);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -25,8 +25,6 @@
+ #include "fweh.h"
+ #include "debug.h"
+ 
+-static struct dentry *root_folder;
+-
+ int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
+ 			       size_t len)
+ {
+@@ -54,44 +52,9 @@ int brcmf_debug_create_memdump(struct br
+ 	return 0;
+ }
+ 
+-void brcmf_debugfs_init(void)
+-{
+-	root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
+-	if (IS_ERR(root_folder))
+-		root_folder = NULL;
+-}
+-
+-void brcmf_debugfs_exit(void)
+-{
+-	if (!root_folder)
+-		return;
+-
+-	debugfs_remove_recursive(root_folder);
+-	root_folder = NULL;
+-}
+-
+-int brcmf_debug_attach(struct brcmf_pub *drvr)
+-{
+-	struct device *dev = drvr->bus_if->dev;
+-
+-	if (!root_folder)
+-		return -ENODEV;
+-
+-	drvr->dbgfs_dir = debugfs_create_dir(dev_name(dev), root_folder);
+-	return PTR_ERR_OR_ZERO(drvr->dbgfs_dir);
+-}
+-
+-void brcmf_debug_detach(struct brcmf_pub *drvr)
+-{
+-	brcmf_fweh_unregister(drvr, BRCMF_E_PSM_WATCHDOG);
+-
+-	if (!IS_ERR_OR_NULL(drvr->dbgfs_dir))
+-		debugfs_remove_recursive(drvr->dbgfs_dir);
+-}
+-
+ struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr)
+ {
+-	return drvr->dbgfs_dir;
++	return drvr->wiphy->debugfsdir;
+ }
+ 
+ int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
+@@ -99,7 +62,8 @@ int brcmf_debugfs_add_entry(struct brcmf
+ {
+ 	struct dentry *e;
+ 
++	WARN(!drvr->wiphy->debugfsdir, "wiphy not (yet) registered\n");
+ 	e = debugfs_create_devm_seqfile(drvr->bus_if->dev, fn,
+-					drvr->dbgfs_dir, read_fn);
++					drvr->wiphy->debugfsdir, read_fn);
+ 	return PTR_ERR_OR_ZERO(e);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -113,29 +113,12 @@ extern int brcmf_msg_level;
+ struct brcmf_bus;
+ struct brcmf_pub;
+ #ifdef DEBUG
+-void brcmf_debugfs_init(void);
+-void brcmf_debugfs_exit(void);
+-int brcmf_debug_attach(struct brcmf_pub *drvr);
+-void brcmf_debug_detach(struct brcmf_pub *drvr);
+ struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
+ int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
+ 			    int (*read_fn)(struct seq_file *seq, void *data));
+ int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
+ 			       size_t len);
+ #else
+-static inline void brcmf_debugfs_init(void)
+-{
+-}
+-static inline void brcmf_debugfs_exit(void)
+-{
+-}
+-static inline int brcmf_debug_attach(struct brcmf_pub *drvr)
+-{
+-	return 0;
+-}
+-static inline void brcmf_debug_detach(struct brcmf_pub *drvr)
+-{
+-}
+ static inline
+ int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
+ 			    int (*read_fn)(struct seq_file *seq, void *data))
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -228,7 +228,10 @@ void brcmf_feat_attach(struct brcmf_pub
+ 		/* no quirks */
+ 		break;
+ 	}
++}
+ 
++void brcmf_feat_debugfs_create(struct brcmf_pub *drvr)
++{
+ 	brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -90,6 +90,13 @@ enum brcmf_feat_quirk {
+ void brcmf_feat_attach(struct brcmf_pub *drvr);
+ 
+ /**
++ * brcmf_feat_debugfs_create() - create debugfs entries.
++ *
++ * @drvr: driver instance.
++ */
++void brcmf_feat_debugfs_create(struct brcmf_pub *drvr);
++
++/**
+  * brcmf_feat_is_enabled() - query feature.
+  *
+  * @ifp: interface instance.
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2399,10 +2399,6 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 	brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
+ 			BRCMF_FWS_PSQ_LEN);
+ 
+-	/* create debugfs file for statistics */
+-	brcmf_debugfs_add_entry(drvr, "fws_stats",
+-				brcmf_debugfs_fws_stats_read);
+-
+ 	brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
+ 		  fws->fw_signals ? "enabled" : "disabled", tlv);
+ 	return fws;
+@@ -2429,6 +2425,13 @@ void brcmf_fws_detach(struct brcmf_fws_i
+ 	kfree(fws);
+ }
+ 
++void brcmf_fws_debugfs_create(struct brcmf_pub *drvr)
++{
++	/* create debugfs file for statistics */
++	brcmf_debugfs_add_entry(drvr, "fws_stats",
++				brcmf_debugfs_fws_stats_read);
++}
++
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws)
+ {
+ 	return !fws->avoid_queueing;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -20,6 +20,7 @@
+ 
+ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
+ void brcmf_fws_detach(struct brcmf_fws_info *fws);
++void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1418,6 +1418,11 @@ static int brcmf_msgbuf_stats_read(struc
+ }
+ #endif
+ 
++static void brcmf_msgbuf_debugfs_create(struct brcmf_pub *drvr)
++{
++	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
++}
++
+ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bus_msgbuf *if_msgbuf;
+@@ -1472,6 +1477,7 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 	drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
+ 	drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
+ 	drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
++	drvr->proto->debugfs_create = brcmf_msgbuf_debugfs_create;
+ 	drvr->proto->pd = msgbuf;
+ 
+ 	init_waitqueue_head(&msgbuf->ioctl_resp_wait);
+@@ -1525,8 +1531,6 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 	spin_lock_init(&msgbuf->flowring_work_lock);
+ 	INIT_LIST_HEAD(&msgbuf->work_queue);
+ 
+-	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
+-
+ 	return 0;
+ 
+ fail:
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -54,7 +54,8 @@ int brcmf_proto_attach(struct brcmf_pub
+ 	if (!proto->tx_queue_data || (proto->hdrpull == NULL) ||
+ 	    (proto->query_dcmd == NULL) || (proto->set_dcmd == NULL) ||
+ 	    (proto->configure_addr_mode == NULL) ||
+-	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL)) {
++	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL) ||
++	    (proto->debugfs_create == NULL)) {
+ 		brcmf_err("Not all proto handlers have been installed\n");
+ 		goto fail;
+ 	}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -48,6 +48,7 @@ struct brcmf_proto {
+ 	void (*del_if)(struct brcmf_if *ifp);
+ 	void (*reset_if)(struct brcmf_if *ifp);
+ 	int (*init_done)(struct brcmf_pub *drvr);
++	void (*debugfs_create)(struct brcmf_pub *drvr);
+ 	void *pd;
+ };
+ 
+@@ -156,4 +157,10 @@ brcmf_proto_init_done(struct brcmf_pub *
+ 	return drvr->proto->init_done(drvr);
+ }
+ 
++static inline void
++brcmf_proto_debugfs_create(struct brcmf_pub *drvr)
++{
++	drvr->proto->debugfs_create(drvr);
++}
++
+ #endif /* BRCMFMAC_PROTO_H */
diff --git a/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch b/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
new file mode 100644
index 0000000000..0b1ae56bc0
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
@@ -0,0 +1,286 @@
+From 41f573dbb534f14e62a4a5411f602c970cad1d77 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:25 +0100
+Subject: [PATCH] brcmfmac: derive firmware filenames from basename mapping
+
+Instead of defining individual filenames for firmware and nvram
+use a basename and derive the names from that.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 31 ++++++---
+ .../broadcom/brcm80211/brcmfmac/firmware.h         | 24 ++-----
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 56 ++++++++---------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 73 +++++++++++-----------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 10 +--
+ 5 files changed, 96 insertions(+), 98 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -563,6 +563,13 @@ int brcmf_fw_get_firmwares(struct device
+ 					   0);
+ }
+ 
++static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
++				   const char *fw_base, const char *extension)
++{
++	strlcat(fw_name, fw_base, BRCMF_FW_NAME_LEN);
++	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
++}
++
+ int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
+ 			      struct brcmf_firmware_mapping mapping_table[],
+ 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
+@@ -587,25 +594,31 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 
+ 	/* check if firmware path is provided by module parameter */
+ 	if (brcmf_mp_global.firmware_path[0] != '\0') {
+-		strlcpy(fw_name, brcmf_mp_global.firmware_path,
+-			BRCMF_FW_NAME_LEN);
+-		if ((nvram_name) && (mapping_table[i].nvram))
++		if (fw_name)
++			strlcpy(fw_name, brcmf_mp_global.firmware_path,
++				BRCMF_FW_NAME_LEN);
++		if (nvram_name)
+ 			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
+ 				BRCMF_FW_NAME_LEN);
+ 
+ 		end = brcmf_mp_global.firmware_path[
+ 				strlen(brcmf_mp_global.firmware_path) - 1];
+ 		if (end != '/') {
+-			strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
+-			if ((nvram_name) && (mapping_table[i].nvram))
++			if (fw_name)
++				strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
++			if (nvram_name)
+ 				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
+ 		}
+ 	}
+-	strlcat(fw_name, mapping_table[i].fw, BRCMF_FW_NAME_LEN);
+-	if ((nvram_name) && (mapping_table[i].nvram))
+-		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
+ 
+-	brcmf_info("using %s for chip %s\n", fw_name, chipname);
++	brcmf_info("using %s for chip %s\n",
++		   mapping_table[i].fw_base, chipname);
++	if (fw_name)
++		brcmf_fw_get_full_name(fw_name,
++				       mapping_table[i].fw_base, ".bin");
++	if (nvram_name)
++		brcmf_fw_get_full_name(nvram_name,
++				       mapping_table[i].fw_base, ".txt");
+ 
+ 	return 0;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+@@ -38,28 +38,16 @@
+ struct brcmf_firmware_mapping {
+ 	u32 chipid;
+ 	u32 revmask;
+-	const char *fw;
+-	const char *nvram;
++	const char *fw_base;
+ };
+ 
+-#define BRCMF_FW_NVRAM_DEF(fw_nvram_name, fw, nvram) \
+-static const char BRCM_ ## fw_nvram_name ## _FIRMWARE_NAME[] = \
+-	BRCMF_FW_DEFAULT_PATH fw; \
+-static const char BRCM_ ## fw_nvram_name ## _NVRAM_NAME[] = \
+-	BRCMF_FW_DEFAULT_PATH nvram; \
+-MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw);
+-
+-#define BRCMF_FW_DEF(fw_name, fw) \
+-static const char BRCM_ ## fw_name ## _FIRMWARE_NAME[] = \
+-	BRCMF_FW_DEFAULT_PATH fw; \
+-MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw) \
+-
+-#define BRCMF_FW_NVRAM_ENTRY(chipid, mask, name) \
+-	{ chipid, mask, \
+-	  BRCM_ ## name ## _FIRMWARE_NAME, BRCM_ ## name ## _NVRAM_NAME }
++#define BRCMF_FW_DEF(fw_name, fw_base) \
++static const char BRCM_ ## fw_name ## _FIRMWARE_BASENAME[] = \
++	BRCMF_FW_DEFAULT_PATH fw_base; \
++MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw_base ".bin")
+ 
+ #define BRCMF_FW_ENTRY(chipid, mask, name) \
+-	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_NAME, NULL }
++	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_BASENAME }
+ 
+ int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
+ 			      struct brcmf_firmware_mapping mapping_table[],
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -46,36 +46,36 @@ enum brcmf_pcie_state {
+ 	BRCMFMAC_PCIE_STATE_UP
+ };
+ 
+-BRCMF_FW_NVRAM_DEF(43602, "brcmfmac43602-pcie.bin", "brcmfmac43602-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4350, "brcmfmac4350-pcie.bin", "brcmfmac4350-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4350C, "brcmfmac4350c2-pcie.bin", "brcmfmac4350c2-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-pcie.bin", "brcmfmac4356-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(43570, "brcmfmac43570-pcie.bin", "brcmfmac43570-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-pcie.bin", "brcmfmac4358-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4365C, "brcmfmac4365c-pcie.bin", "brcmfmac4365c-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4366C, "brcmfmac4366c-pcie.bin", "brcmfmac4366c-pcie.txt");
+-BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
++BRCMF_FW_DEF(43602, "brcmfmac43602-pcie");
++BRCMF_FW_DEF(4350, "brcmfmac4350-pcie");
++BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie");
++BRCMF_FW_DEF(4356, "brcmfmac4356-pcie");
++BRCMF_FW_DEF(43570, "brcmfmac43570-pcie");
++BRCMF_FW_DEF(4358, "brcmfmac4358-pcie");
++BRCMF_FW_DEF(4359, "brcmfmac4359-pcie");
++BRCMF_FW_DEF(4365B, "brcmfmac4365b-pcie");
++BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie");
++BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie");
++BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
++BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
+ 
+ static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
++	BRCMF_FW_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
++	BRCMF_FW_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
++	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
++	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
++	BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
++	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
++	BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
++	BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
++	BRCMF_FW_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
++	BRCMF_FW_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
++	BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
++	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
++	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
++	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
++	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
++	BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
+ };
+ 
+ #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -600,47 +600,44 @@ static const struct sdiod_drive_str sdio
+ 	{4,  0x1}
+ };
+ 
+-BRCMF_FW_NVRAM_DEF(43143, "brcmfmac43143-sdio.bin", "brcmfmac43143-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43241B0, "brcmfmac43241b0-sdio.bin",
+-		   "brcmfmac43241b0-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43241B4, "brcmfmac43241b4-sdio.bin",
+-		   "brcmfmac43241b4-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43241B5, "brcmfmac43241b5-sdio.bin",
+-		   "brcmfmac43241b5-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4329, "brcmfmac4329-sdio.bin", "brcmfmac4329-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4330, "brcmfmac4330-sdio.bin", "brcmfmac4330-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4334, "brcmfmac4334-sdio.bin", "brcmfmac4334-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340-sdio.bin", "brcmfmac43340-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4335, "brcmfmac4335-sdio.bin", "brcmfmac4335-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43362, "brcmfmac43362-sdio.bin", "brcmfmac43362-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4339, "brcmfmac4339-sdio.bin", "brcmfmac4339-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43430A0, "brcmfmac43430a0-sdio.bin", "brcmfmac43430a0-sdio.txt");
++BRCMF_FW_DEF(43143, "brcmfmac43143-sdio");
++BRCMF_FW_DEF(43241B0, "brcmfmac43241b0-sdio");
++BRCMF_FW_DEF(43241B4, "brcmfmac43241b4-sdio");
++BRCMF_FW_DEF(43241B5, "brcmfmac43241b5-sdio");
++BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
++BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
++BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
++BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
++BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
++BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
++BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
++BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-sdio");
+ /* Note the names are not postfixed with a1 for backward compatibility */
+-BRCMF_FW_NVRAM_DEF(43430A1, "brcmfmac43430-sdio.bin", "brcmfmac43430-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-sdio.bin", "brcmfmac4356-sdio.txt");
+-BRCMF_FW_NVRAM_DEF(4373, "brcmfmac4373-sdio.bin", "brcmfmac4373-sdio.txt");
++BRCMF_FW_DEF(43430A1, "brcmfmac43430-sdio");
++BRCMF_FW_DEF(43455, "brcmfmac43455-sdio");
++BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
++BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
++BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
+ 
+ static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+-	BRCMF_FW_NVRAM_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
++	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
++	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
++	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
++	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
++	BRCMF_FW_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
++	BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
++	BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
++	BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
++	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
++	BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
++	BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
++	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
++	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
++	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
++	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
++	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
++	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
++	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
+ };
+ 
+ static void pkt_align(struct sk_buff *p, int len, int align)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -46,11 +46,11 @@
+ #define BRCMF_USB_CBCTL_READ		1
+ #define BRCMF_USB_MAX_PKT_SIZE		1600
+ 
+-BRCMF_FW_DEF(43143, "brcmfmac43143.bin");
+-BRCMF_FW_DEF(43236B, "brcmfmac43236b.bin");
+-BRCMF_FW_DEF(43242A, "brcmfmac43242a.bin");
+-BRCMF_FW_DEF(43569, "brcmfmac43569.bin");
+-BRCMF_FW_DEF(4373, "brcmfmac4373.bin");
++BRCMF_FW_DEF(43143, "brcmfmac43143");
++BRCMF_FW_DEF(43236B, "brcmfmac43236b");
++BRCMF_FW_DEF(43242A, "brcmfmac43242a");
++BRCMF_FW_DEF(43569, "brcmfmac43569");
++BRCMF_FW_DEF(4373, "brcmfmac4373");
+ 
+ static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
diff --git a/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch b/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
new file mode 100644
index 0000000000..a75465a893
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
@@ -0,0 +1,574 @@
+From d09ae51a4b676151edaf572bcd5f272b5532639f Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:26 +0100
+Subject: [PATCH] brcmfmac: pass struct in brcmf_fw_get_firmwares()
+
+Make the function brcmf_fw_get_firmwares() a bit more easy to extend
+using a structure to pass the request parameters.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 175 ++++++++++++++-------
+ .../broadcom/brcm80211/brcmfmac/firmware.h         |  43 +++--
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  38 ++++-
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  32 +++-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  43 ++++-
+ 5 files changed, 245 insertions(+), 86 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -438,18 +438,31 @@ void brcmf_fw_nvram_free(void *nvram)
+ 
+ struct brcmf_fw {
+ 	struct device *dev;
+-	u16 flags;
+-	const struct firmware *code;
+-	const char *nvram_name;
+-	u16 domain_nr;
+-	u16 bus_nr;
+-	void (*done)(struct device *dev, int err, const struct firmware *fw,
+-		     void *nvram_image, u32 nvram_len);
++	struct brcmf_fw_request *req;
++	u32 curpos;
++	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
+ };
+ 
++static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
++
++static void brcmf_fw_free_request(struct brcmf_fw_request *req)
++{
++	struct brcmf_fw_item *item;
++	int i;
++
++	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
++		if (item->type == BRCMF_FW_TYPE_BINARY)
++			release_firmware(item->binary);
++		else if (item->type == BRCMF_FW_TYPE_NVRAM)
++			brcmf_fw_nvram_free(item->nv_data.data);
++	}
++	kfree(req);
++}
++
+ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
++	struct brcmf_fw_item *cur;
+ 	u32 nvram_length = 0;
+ 	void *nvram = NULL;
+ 	u8 *data = NULL;
+@@ -457,83 +470,150 @@ static void brcmf_fw_request_nvram_done(
+ 	bool raw_nvram;
+ 
+ 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
++
++	cur = &fwctx->req->items[fwctx->curpos];
++
+ 	if (fw && fw->data) {
+ 		data = (u8 *)fw->data;
+ 		data_len = fw->size;
+ 		raw_nvram = false;
+ 	} else {
+ 		data = bcm47xx_nvram_get_contents(&data_len);
+-		if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
++		if (!data && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+ 			goto fail;
+ 		raw_nvram = true;
+ 	}
+ 
+ 	if (data)
+ 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
+-					     fwctx->domain_nr, fwctx->bus_nr);
++					     fwctx->req->domain_nr,
++					     fwctx->req->bus_nr);
+ 
+ 	if (raw_nvram)
+ 		bcm47xx_nvram_release_contents(data);
+ 	release_firmware(fw);
+-	if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
++	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+ 		goto fail;
+ 
+-	fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length);
+-	kfree(fwctx);
++	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
++	cur->nv_data.data = nvram;
++	cur->nv_data.len = nvram_length;
+ 	return;
+ 
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+-	release_firmware(fwctx->code);
+-	fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0);
++	fwctx->done(fwctx->dev, -ENOENT, NULL);
++	brcmf_fw_free_request(fwctx->req);
+ 	kfree(fwctx);
+ }
+ 
+-static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
++static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
++{
++	struct brcmf_fw_item *cur;
++	const struct firmware *fw = NULL;
++	int ret;
++
++	cur = &fwctx->req->items[fwctx->curpos];
++
++	brcmf_dbg(TRACE, "%srequest for %s\n", async ? "async " : "",
++		  cur->path);
++
++	if (async)
++		ret = request_firmware_nowait(THIS_MODULE, true, cur->path,
++					      fwctx->dev, GFP_KERNEL, fwctx,
++					      brcmf_fw_request_done);
++	else
++		ret = request_firmware(&fw, cur->path, fwctx->dev);
++
++	if (ret < 0) {
++		brcmf_fw_request_done(NULL, fwctx);
++	} else if (!async && fw) {
++		brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path,
++			  fw ? "" : "not ");
++		if (cur->type == BRCMF_FW_TYPE_BINARY)
++			cur->binary = fw;
++		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
++			brcmf_fw_request_nvram_done(fw, fwctx);
++		else
++			release_firmware(fw);
++
++		return -EAGAIN;
++	}
++	return 0;
++}
++
++static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
++	struct brcmf_fw_item *cur;
+ 	int ret = 0;
+ 
+-	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
+-	if (!fw) {
++	cur = &fwctx->req->items[fwctx->curpos];
++
++	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
++		  fw ? "" : "not ");
++
++	if (fw) {
++		if (cur->type == BRCMF_FW_TYPE_BINARY)
++			cur->binary = fw;
++		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
++			brcmf_fw_request_nvram_done(fw, fwctx);
++		else
++			release_firmware(fw);
++	} else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
++		brcmf_fw_request_nvram_done(NULL, fwctx);
++	} else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
+ 		ret = -ENOENT;
+ 		goto fail;
+ 	}
+-	/* only requested code so done here */
+-	if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM))
+-		goto done;
+-
+-	fwctx->code = fw;
+-	ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
+-				      fwctx->dev, GFP_KERNEL, fwctx,
+-				      brcmf_fw_request_nvram_done);
+ 
+-	/* pass NULL to nvram callback for bcm47xx fallback */
+-	if (ret)
+-		brcmf_fw_request_nvram_done(NULL, fwctx);
++	do {
++		if (++fwctx->curpos == fwctx->req->n_items) {
++			ret = 0;
++			goto done;
++		}
++
++		ret = brcmf_fw_request_next_item(fwctx, false);
++	} while (ret == -EAGAIN);
++
+ 	return;
+ 
+ fail:
+-	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
++	brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
++		  dev_name(fwctx->dev), cur->path);
++	brcmf_fw_free_request(fwctx->req);
++	fwctx->req = NULL;
+ done:
+-	fwctx->done(fwctx->dev, ret, fw, NULL, 0);
++	fwctx->done(fwctx->dev, ret, fwctx->req);
+ 	kfree(fwctx);
+ }
+ 
+-int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
+-				const char *code, const char *nvram,
+-				void (*fw_cb)(struct device *dev, int err,
+-					      const struct firmware *fw,
+-					      void *nvram_image, u32 nvram_len),
+-				u16 domain_nr, u16 bus_nr)
++static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
++{
++	struct brcmf_fw_item *item;
++	int i;
++
++	if (!req->n_items)
++		return false;
++
++	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
++		if (!item->path)
++			return false;
++	}
++	return true;
++}
++
++int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
++			   void (*fw_cb)(struct device *dev, int err,
++					 struct brcmf_fw_request *req))
+ {
+ 	struct brcmf_fw *fwctx;
+ 
+ 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
+-	if (!fw_cb || !code)
++	if (!fw_cb)
+ 		return -EINVAL;
+ 
+-	if ((flags & BRCMF_FW_REQUEST_NVRAM) && !nvram)
++	if (!brcmf_fw_request_is_valid(req))
+ 		return -EINVAL;
+ 
+ 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
+@@ -541,26 +621,11 @@ int brcmf_fw_get_firmwares_pcie(struct d
+ 		return -ENOMEM;
+ 
+ 	fwctx->dev = dev;
+-	fwctx->flags = flags;
++	fwctx->req = req;
+ 	fwctx->done = fw_cb;
+-	if (flags & BRCMF_FW_REQUEST_NVRAM)
+-		fwctx->nvram_name = nvram;
+-	fwctx->domain_nr = domain_nr;
+-	fwctx->bus_nr = bus_nr;
+-
+-	return request_firmware_nowait(THIS_MODULE, true, code, dev,
+-				       GFP_KERNEL, fwctx,
+-				       brcmf_fw_request_code_done);
+-}
+ 
+-int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
+-			   const char *code, const char *nvram,
+-			   void (*fw_cb)(struct device *dev, int err,
+-					 const struct firmware *fw,
+-					 void *nvram_image, u32 nvram_len))
+-{
+-	return brcmf_fw_get_firmwares_pcie(dev, flags, code, nvram, fw_cb, 0,
+-					   0);
++	brcmf_fw_request_next_item(fwctx, true);
++	return 0;
+ }
+ 
+ static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+@@ -16,10 +16,7 @@
+ #ifndef BRCMFMAC_FIRMWARE_H
+ #define BRCMFMAC_FIRMWARE_H
+ 
+-#define BRCMF_FW_REQUEST		0x000F
+-#define  BRCMF_FW_REQUEST_NVRAM		0x0001
+-#define BRCMF_FW_REQ_FLAGS		0x00F0
+-#define  BRCMF_FW_REQ_NV_OPTIONAL	0x0010
++#define BRCMF_FW_REQF_OPTIONAL		0x0001
+ 
+ #define	BRCMF_FW_NAME_LEN		320
+ 
+@@ -54,21 +51,39 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
+ 			      char nvram_name[BRCMF_FW_NAME_LEN]);
+ void brcmf_fw_nvram_free(void *nvram);
++
++enum brcmf_fw_type {
++	BRCMF_FW_TYPE_BINARY,
++	BRCMF_FW_TYPE_NVRAM
++};
++
++struct brcmf_fw_item {
++	const char *path;
++	enum brcmf_fw_type type;
++	u16 flags;
++	union {
++		const struct firmware *binary;
++		struct {
++			void *data;
++			u32 len;
++		} nv_data;
++	};
++};
++
++struct brcmf_fw_request {
++	u16 domain_nr;
++	u16 bus_nr;
++	u32 n_items;
++	struct brcmf_fw_item items[0];
++};
++
+ /*
+  * Request firmware(s) asynchronously. When the asynchronous request
+  * fails it will not use the callback, but call device_release_driver()
+  * instead which will call the driver .remove() callback.
+  */
+-int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
+-				const char *code, const char *nvram,
+-				void (*fw_cb)(struct device *dev, int err,
+-					      const struct firmware *fw,
+-					      void *nvram_image, u32 nvram_len),
+-				u16 domain_nr, u16 bus_nr);
+-int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
+-			   const char *code, const char *nvram,
++int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
+ 			   void (*fw_cb)(struct device *dev, int err,
+-					 const struct firmware *fw,
+-					 void *nvram_image, u32 nvram_len));
++					 struct brcmf_fw_request *req));
+ 
+ #endif /* BRCMFMAC_FIRMWARE_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1651,15 +1651,19 @@ static const struct brcmf_buscore_ops br
+ 	.write32 = brcmf_pcie_buscore_write32,
+ };
+ 
++#define BRCMF_PCIE_FW_CODE	0
++#define BRCMF_PCIE_FW_NVRAM	1
++
+ static void brcmf_pcie_setup(struct device *dev, int ret,
+-			     const struct firmware *fw,
+-			     void *nvram, u32 nvram_len)
++			     struct brcmf_fw_request *fwreq)
+ {
++	const struct firmware *fw;
++	void *nvram;
+ 	struct brcmf_bus *bus;
+ 	struct brcmf_pciedev *pcie_bus_dev;
+ 	struct brcmf_pciedev_info *devinfo;
+ 	struct brcmf_commonring **flowrings;
+-	u32 i;
++	u32 i, nvram_len;
+ 
+ 	/* check firmware loading result */
+ 	if (ret)
+@@ -1670,6 +1674,11 @@ static void brcmf_pcie_setup(struct devi
+ 	devinfo = pcie_bus_dev->devinfo;
+ 	brcmf_pcie_attach(devinfo);
+ 
++	fw = fwreq->items[BRCMF_PCIE_FW_CODE].binary;
++	nvram = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.data;
++	nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len;
++	kfree(fwreq);
++
+ 	/* Some of the firmwares have the size of the memory of the device
+ 	 * defined inside the firmware. This is because part of the memory in
+ 	 * the device is shared and the devision is determined by FW. Parse
+@@ -1730,6 +1739,7 @@ static int
+ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ 	int ret;
++	struct brcmf_fw_request *fwreq;
+ 	struct brcmf_pciedev_info *devinfo;
+ 	struct brcmf_pciedev *pcie_bus_dev;
+ 	struct brcmf_bus *bus;
+@@ -1800,12 +1810,26 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
+ 	if (ret)
+ 		goto fail_bus;
+ 
+-	ret = brcmf_fw_get_firmwares_pcie(bus->dev, BRCMF_FW_REQUEST_NVRAM |
+-						    BRCMF_FW_REQ_NV_OPTIONAL,
+-					  devinfo->fw_name, devinfo->nvram_name,
+-					  brcmf_pcie_setup, domain_nr, bus_nr);
++	fwreq = kzalloc(sizeof(*fwreq) + 2 * sizeof(struct brcmf_fw_item),
++			GFP_KERNEL);
++	if (!fwreq) {
++		ret = -ENOMEM;
++		goto fail_bus;
++	}
++
++	fwreq->items[BRCMF_PCIE_FW_CODE].path = devinfo->fw_name;
++	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++	fwreq->items[BRCMF_PCIE_FW_NVRAM].path = devinfo->nvram_name;
++	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
++	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
++	fwreq->n_items = 2;
++	fwreq->domain_nr = domain_nr;
++	fwreq->bus_nr = bus_nr;
++	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
+ 	if (ret == 0)
+ 		return 0;
++
++	kfree(fwreq);
+ fail_bus:
+ 	kfree(bus->msgbuf);
+ 	kfree(bus);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4031,14 +4031,19 @@ static const struct brcmf_bus_ops brcmf_
+ 	.get_fwname = brcmf_sdio_get_fwname,
+ };
+ 
++#define BRCMF_SDIO_FW_CODE	0
++#define BRCMF_SDIO_FW_NVRAM	1
++
+ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+-					 const struct firmware *code,
+-					 void *nvram, u32 nvram_len)
++					 struct brcmf_fw_request *fwreq)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
+ 	struct brcmf_sdio *bus = sdiod->bus;
+ 	struct brcmf_core *core = bus->sdio_core;
++	const struct firmware *code;
++	void *nvram;
++	u32 nvram_len;
+ 	u8 saveclk;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+@@ -4046,6 +4051,11 @@ static void brcmf_sdio_firmware_callback
+ 	if (err)
+ 		goto fail;
+ 
++	code = fwreq->items[BRCMF_SDIO_FW_CODE].binary;
++	nvram = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.data;
++	nvram_len = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.len;
++	kfree(fwreq);
++
+ 	/* try to download image and nvram to the dongle */
+ 	bus->alp_only = true;
+ 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+@@ -4150,6 +4160,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	int ret;
+ 	struct brcmf_sdio *bus;
+ 	struct workqueue_struct *wq;
++	struct brcmf_fw_request *fwreq;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -4240,11 +4251,24 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	if (ret)
+ 		goto fail;
+ 
+-	ret = brcmf_fw_get_firmwares(sdiodev->dev, BRCMF_FW_REQUEST_NVRAM,
+-				     sdiodev->fw_name, sdiodev->nvram_name,
++	fwreq = kzalloc(sizeof(fwreq) + 2 * sizeof(struct brcmf_fw_item),
++			GFP_KERNEL);
++	if (!fwreq) {
++		ret = -ENOMEM;
++		goto fail;
++	}
++
++	fwreq->items[BRCMF_SDIO_FW_CODE].path = sdiodev->fw_name;
++	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++	fwreq->items[BRCMF_SDIO_FW_NVRAM].path = sdiodev->nvram_name;
++	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
++	fwreq->n_items = 2;
++
++	ret = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
+ 				     brcmf_sdio_firmware_callback);
+ 	if (ret != 0) {
+ 		brcmf_err("async firmware request failed: %d\n", ret);
++		kfree(fwreq);
+ 		goto fail;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1155,18 +1155,23 @@ static const struct brcmf_bus_ops brcmf_
+ 	.get_fwname = brcmf_usb_get_fwname,
+ };
+ 
++#define BRCMF_USB_FW_CODE	0
++
+ static void brcmf_usb_probe_phase2(struct device *dev, int ret,
+-				   const struct firmware *fw,
+-				   void *nvram, u32 nvlen)
++				   struct brcmf_fw_request *fwreq)
+ {
+ 	struct brcmf_bus *bus = dev_get_drvdata(dev);
+ 	struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo;
++	const struct firmware *fw;
+ 
+ 	if (ret)
+ 		goto error;
+ 
+ 	brcmf_dbg(USB, "Start fw downloading\n");
+ 
++	fw = fwreq->items[BRCMF_USB_FW_CODE].binary;
++	kfree(fwreq);
++
+ 	ret = check_file(fw->data);
+ 	if (ret < 0) {
+ 		brcmf_err("invalid firmware\n");
+@@ -1200,6 +1205,7 @@ static int brcmf_usb_probe_cb(struct brc
+ 	struct brcmf_bus *bus = NULL;
+ 	struct brcmf_usbdev *bus_pub = NULL;
+ 	struct device *dev = devinfo->dev;
++	struct brcmf_fw_request *fwreq;
+ 	int ret;
+ 
+ 	brcmf_dbg(USB, "Enter\n");
+@@ -1250,11 +1256,22 @@ static int brcmf_usb_probe_cb(struct brc
+ 	if (ret)
+ 		goto fail;
+ 
++	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
++			GFP_KERNEL);
++	if (!fwreq) {
++		ret = -ENOMEM;
++		goto fail;
++	}
++
++	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
++	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++	fwreq->n_items = 1;
++
+ 	/* request firmware here */
+-	ret = brcmf_fw_get_firmwares(dev, 0, devinfo->fw_name, NULL,
+-				     brcmf_usb_probe_phase2);
++	ret = brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2);
+ 	if (ret) {
+ 		brcmf_err("firmware request failed: %d\n", ret);
++		kfree(fwreq);
+ 		goto fail;
+ 	}
+ 
+@@ -1447,11 +1464,25 @@ static int brcmf_usb_reset_resume(struct
+ {
+ 	struct usb_device *usb = interface_to_usbdev(intf);
+ 	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
++	struct brcmf_fw_request *fwreq;
++	int ret;
+ 
+ 	brcmf_dbg(USB, "Enter\n");
+ 
+-	return brcmf_fw_get_firmwares(&usb->dev, 0, devinfo->fw_name, NULL,
+-				      brcmf_usb_probe_phase2);
++	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
++			GFP_KERNEL);
++	if (!fwreq)
++		return -ENOMEM;
++
++	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
++	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++	fwreq->n_items = 1;
++
++	ret = brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2);
++	if (ret < 0)
++		kfree(fwreq);
++
++	return ret;
+ }
+ 
+ #define BRCMF_USB_DEVICE(dev_id)	\
diff --git a/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch b/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
new file mode 100644
index 0000000000..408154ef0f
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
@@ -0,0 +1,328 @@
+From 2baa3aaee27f137b8db9a9224d0fe9b281d28e34 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:27 +0100
+Subject: [PATCH] brcmfmac: introduce brcmf_fw_alloc_request() function
+
+The function brcmf_fw_alloc_request() takes a list of required files
+and allocated the struct brcmf_fw_request instance accordingly. The
+request can be modified by the caller before being passed to the
+brcmf_fw_request_firmwares() function.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 58 ++++++++++++++++++++++
+ .../broadcom/brcm80211/brcmfmac/firmware.h         | 11 ++++
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 58 ++++++++++++----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 38 ++++++++------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 42 +++++++++-------
+ 5 files changed, 147 insertions(+), 60 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -688,3 +688,61 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 	return 0;
+ }
+ 
++struct brcmf_fw_request *
++brcmf_fw_alloc_request(u32 chip, u32 chiprev,
++		       struct brcmf_firmware_mapping mapping_table[],
++		       u32 table_size, struct brcmf_fw_name *fwnames,
++		       u32 n_fwnames)
++{
++	struct brcmf_fw_request *fwreq;
++	char chipname[12];
++	const char *mp_path;
++	u32 i, j;
++	char end;
++	size_t reqsz;
++
++	for (i = 0; i < table_size; i++) {
++		if (mapping_table[i].chipid == chip &&
++		    mapping_table[i].revmask & BIT(chiprev))
++			break;
++	}
++
++	if (i == table_size) {
++		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
++		return NULL;
++	}
++
++	reqsz = sizeof(*fwreq) + n_fwnames * sizeof(struct brcmf_fw_item);
++	fwreq = kzalloc(reqsz, GFP_KERNEL);
++	if (!fwreq)
++		return NULL;
++
++	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
++
++	brcmf_info("using %s for chip %s\n",
++		   mapping_table[i].fw_base, chipname);
++
++	mp_path = brcmf_mp_global.firmware_path;
++	end = mp_path[strlen(mp_path) - 1];
++	fwreq->n_items = n_fwnames;
++
++	for (j = 0; j < n_fwnames; j++) {
++		fwreq->items[j].path = fwnames[j].path;
++		/* check if firmware path is provided by module parameter */
++		if (brcmf_mp_global.firmware_path[0] != '\0') {
++			strlcpy(fwnames[j].path, mp_path,
++				BRCMF_FW_NAME_LEN);
++
++			if (end != '/') {
++				strlcat(fwnames[j].path, "/",
++					BRCMF_FW_NAME_LEN);
++			}
++		}
++		brcmf_fw_get_full_name(fwnames[j].path,
++				       mapping_table[i].fw_base,
++				       fwnames[j].extension);
++		fwreq->items[j].path = fwnames[j].path;
++	}
++
++	return fwreq;
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+@@ -77,6 +77,17 @@ struct brcmf_fw_request {
+ 	struct brcmf_fw_item items[0];
+ };
+ 
++struct brcmf_fw_name {
++	const char *extension;
++	char *path;
++};
++
++struct brcmf_fw_request *
++brcmf_fw_alloc_request(u32 chip, u32 chiprev,
++		       struct brcmf_firmware_mapping mapping_table[],
++		       u32 table_size, struct brcmf_fw_name *fwnames,
++		       u32 n_fwnames);
++
+ /*
+  * Request firmware(s) asynchronously. When the asynchronous request
+  * fails it will not use the callback, but call device_release_driver()
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1735,6 +1735,31 @@ fail:
+ 	device_release_driver(dev);
+ }
+ 
++static struct brcmf_fw_request *
++brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo)
++{
++	struct brcmf_fw_request *fwreq;
++	struct brcmf_fw_name fwnames[] = {
++		{ ".bin", devinfo->fw_name },
++		{ ".txt", devinfo->nvram_name },
++	};
++
++	fwreq = brcmf_fw_alloc_request(devinfo->ci->chip, devinfo->ci->chiprev,
++				       brcmf_pcie_fwnames,
++				       ARRAY_SIZE(brcmf_pcie_fwnames),
++				       fwnames, ARRAY_SIZE(fwnames));
++	if (!fwreq)
++		return NULL;
++
++	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
++	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
++	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
++	fwreq->bus_nr = devinfo->pdev->bus->number;
++
++	return fwreq;
++}
++
+ static int
+ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+@@ -1743,13 +1768,8 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
+ 	struct brcmf_pciedev_info *devinfo;
+ 	struct brcmf_pciedev *pcie_bus_dev;
+ 	struct brcmf_bus *bus;
+-	u16 domain_nr;
+-	u16 bus_nr;
+ 
+-	domain_nr = pci_domain_nr(pdev->bus) + 1;
+-	bus_nr = pdev->bus->number;
+-	brcmf_dbg(PCIE, "Enter %x:%x (%d/%d)\n", pdev->vendor, pdev->device,
+-		  domain_nr, bus_nr);
++	brcmf_dbg(PCIE, "Enter %x:%x\n", pdev->vendor, pdev->device);
+ 
+ 	ret = -ENOMEM;
+ 	devinfo = kzalloc(sizeof(*devinfo), GFP_KERNEL);
+@@ -1803,33 +1823,19 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
+ 	bus->wowl_supported = pci_pme_capable(pdev, PCI_D3hot);
+ 	dev_set_drvdata(&pdev->dev, bus);
+ 
+-	ret = brcmf_fw_map_chip_to_name(devinfo->ci->chip, devinfo->ci->chiprev,
+-					brcmf_pcie_fwnames,
+-					ARRAY_SIZE(brcmf_pcie_fwnames),
+-					devinfo->fw_name, devinfo->nvram_name);
+-	if (ret)
+-		goto fail_bus;
+-
+-	fwreq = kzalloc(sizeof(*fwreq) + 2 * sizeof(struct brcmf_fw_item),
+-			GFP_KERNEL);
++	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
+ 	if (!fwreq) {
+ 		ret = -ENOMEM;
+ 		goto fail_bus;
+ 	}
+ 
+-	fwreq->items[BRCMF_PCIE_FW_CODE].path = devinfo->fw_name;
+-	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+-	fwreq->items[BRCMF_PCIE_FW_NVRAM].path = devinfo->nvram_name;
+-	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
+-	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
+-	fwreq->n_items = 2;
+-	fwreq->domain_nr = domain_nr;
+-	fwreq->bus_nr = bus_nr;
+ 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
+-	if (ret == 0)
+-		return 0;
++	if (ret < 0) {
++		kfree(fwreq);
++		goto fail_bus;
++	}
++	return 0;
+ 
+-	kfree(fwreq);
+ fail_bus:
+ 	kfree(bus->msgbuf);
+ 	kfree(bus);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4155,6 +4155,28 @@ fail:
+ 	device_release_driver(dev);
+ }
+ 
++static struct brcmf_fw_request *
++brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
++{
++	struct brcmf_fw_request *fwreq;
++	struct brcmf_fw_name fwnames[] = {
++		{ ".bin", bus->sdiodev->fw_name },
++		{ ".txt", bus->sdiodev->nvram_name },
++	};
++
++	fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
++				       brcmf_sdio_fwnames,
++				       ARRAY_SIZE(brcmf_sdio_fwnames),
++				       fwnames, ARRAY_SIZE(fwnames));
++	if (!fwreq)
++		return NULL;
++
++	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
++
++	return fwreq;
++}
++
+ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+ {
+ 	int ret;
+@@ -4244,26 +4266,12 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 
+ 	brcmf_dbg(INFO, "completed!!\n");
+ 
+-	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
+-					brcmf_sdio_fwnames,
+-					ARRAY_SIZE(brcmf_sdio_fwnames),
+-					sdiodev->fw_name, sdiodev->nvram_name);
+-	if (ret)
+-		goto fail;
+-
+-	fwreq = kzalloc(sizeof(fwreq) + 2 * sizeof(struct brcmf_fw_item),
+-			GFP_KERNEL);
++	fwreq = brcmf_sdio_prepare_fw_request(bus);
+ 	if (!fwreq) {
+ 		ret = -ENOMEM;
+ 		goto fail;
+ 	}
+ 
+-	fwreq->items[BRCMF_SDIO_FW_CODE].path = sdiodev->fw_name;
+-	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+-	fwreq->items[BRCMF_SDIO_FW_NVRAM].path = sdiodev->nvram_name;
+-	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
+-	fwreq->n_items = 2;
+-
+ 	ret = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
+ 				     brcmf_sdio_firmware_callback);
+ 	if (ret != 0) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1200,6 +1200,27 @@ error:
+ 	device_release_driver(dev);
+ }
+ 
++static struct brcmf_fw_request *
++brcmf_usb_prepare_fw_request(struct brcmf_usbdev_info *devinfo)
++{
++	struct brcmf_fw_request *fwreq;
++	struct brcmf_fw_name fwnames[] = {
++		{ ".bin", devinfo->fw_name },
++	};
++
++	fwreq = brcmf_fw_alloc_request(devinfo->bus_pub.devid,
++				       devinfo->bus_pub.chiprev,
++				       brcmf_usb_fwnames,
++				       ARRAY_SIZE(brcmf_usb_fwnames),
++				       fwnames, ARRAY_SIZE(fwnames));
++	if (!fwreq)
++		return NULL;
++
++	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
++
++	return fwreq;
++}
++
+ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
+ {
+ 	struct brcmf_bus *bus = NULL;
+@@ -1249,24 +1270,12 @@ static int brcmf_usb_probe_cb(struct brc
+ 	bus->chip = bus_pub->devid;
+ 	bus->chiprev = bus_pub->chiprev;
+ 
+-	ret = brcmf_fw_map_chip_to_name(bus_pub->devid, bus_pub->chiprev,
+-					brcmf_usb_fwnames,
+-					ARRAY_SIZE(brcmf_usb_fwnames),
+-					devinfo->fw_name, NULL);
+-	if (ret)
+-		goto fail;
+-
+-	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
+-			GFP_KERNEL);
++	fwreq = brcmf_usb_prepare_fw_request(devinfo);
+ 	if (!fwreq) {
+ 		ret = -ENOMEM;
+ 		goto fail;
+ 	}
+ 
+-	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
+-	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+-	fwreq->n_items = 1;
+-
+ 	/* request firmware here */
+ 	ret = brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2);
+ 	if (ret) {
+@@ -1469,15 +1478,10 @@ static int brcmf_usb_reset_resume(struct
+ 
+ 	brcmf_dbg(USB, "Enter\n");
+ 
+-	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
+-			GFP_KERNEL);
++	fwreq = brcmf_usb_prepare_fw_request(devinfo);
+ 	if (!fwreq)
+ 		return -ENOMEM;
+ 
+-	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
+-	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+-	fwreq->n_items = 1;
+-
+ 	ret = brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2);
+ 	if (ret < 0)
+ 		kfree(fwreq);
diff --git a/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch b/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
new file mode 100644
index 0000000000..391229a865
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
@@ -0,0 +1,231 @@
+From bf7a7b37f6ef5090a2bae7e7ae23cd26b741cca4 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:28 +0100
+Subject: [PATCH] brcmfmac: add extension to .get_fwname() callbacks
+
+This changes the bus layer api by having the caller provide an
+extension. With this the callback can use brcmf_fw_alloc_request()
+to get the needed firmware name.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  6 +--
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 43 +++-------------------
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 27 +++++++-------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 26 +++++++------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 27 ++++++++------
+ 5 files changed, 51 insertions(+), 78 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -88,7 +88,7 @@ struct brcmf_bus_ops {
+ 	void (*wowl_config)(struct device *dev, bool enabled);
+ 	size_t (*get_ramsize)(struct device *dev);
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
+-	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
++	int (*get_fwname)(struct device *dev, const char *ext,
+ 			  unsigned char *fw_name);
+ };
+ 
+@@ -228,10 +228,10 @@ int brcmf_bus_get_memdump(struct brcmf_b
+ }
+ 
+ static inline
+-int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
++int brcmf_bus_get_fwname(struct brcmf_bus *bus, const char *ext,
+ 			 unsigned char *fw_name)
+ {
+-	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
++	return bus->ops->get_fwname(bus->dev, ext, fw_name);
+ }
+ 
+ /*
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -129,42 +129,9 @@ static int brcmf_c_download(struct brcmf
+ 	return err;
+ }
+ 
+-static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
+-{
+-	struct brcmf_bus *bus = ifp->drvr->bus_if;
+-	u8 fw_name[BRCMF_FW_NAME_LEN];
+-	u8 *ptr;
+-	size_t len;
+-	s32 err;
+-
+-	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
+-	err = brcmf_bus_get_fwname(bus, bus->chip, bus->chiprev, fw_name);
+-	if (err) {
+-		brcmf_err("get firmware name failed (%d)\n", err);
+-		goto done;
+-	}
+-
+-	/* generate CLM blob file name */
+-	ptr = strrchr(fw_name, '.');
+-	if (!ptr) {
+-		err = -ENOENT;
+-		goto done;
+-	}
+-
+-	len = ptr - fw_name + 1;
+-	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
+-		err = -E2BIG;
+-	} else {
+-		strlcpy(clm_name, fw_name, len);
+-		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
+-	}
+-done:
+-	return err;
+-}
+-
+ static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
+ {
+-	struct device *dev = ifp->drvr->bus_if->dev;
++	struct brcmf_bus *bus = ifp->drvr->bus_if;
+ 	struct brcmf_dload_data_le *chunk_buf;
+ 	const struct firmware *clm = NULL;
+ 	u8 clm_name[BRCMF_FW_NAME_LEN];
+@@ -177,16 +144,16 @@ static int brcmf_c_process_clm_blob(stru
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
+-	err = brcmf_c_get_clm_name(ifp, clm_name);
++	memset(clm_name, 0, sizeof(clm_name));
++	err = brcmf_bus_get_fwname(bus, ".clm_blob", clm_name);
+ 	if (err) {
+ 		brcmf_err("get CLM blob file name failed (%d)\n", err);
+ 		return err;
+ 	}
+ 
+-	err = request_firmware(&clm, clm_name, dev);
++	err = request_firmware(&clm, clm_name, bus->dev);
+ 	if (err) {
+-		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
++		brcmf_info("no clm_blob available (err=%d), device may have limited channels available\n",
+ 			   err);
+ 		return 0;
+ 	}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1350,23 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
+ 	return 0;
+ }
+ 
+-static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
+-				 u8 *fw_name)
++static
++int brcmf_pcie_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
+-	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
+-	int ret = 0;
++	struct brcmf_fw_request *fwreq;
++	struct brcmf_fw_name fwnames[] = {
++		{ ext, fw_name },
++	};
+ 
+-	if (devinfo->fw_name[0] != '\0')
+-		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
+-	else
+-		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
+-						brcmf_pcie_fwnames,
+-						ARRAY_SIZE(brcmf_pcie_fwnames),
+-						fw_name, NULL);
++	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
++				       brcmf_pcie_fwnames,
++				       ARRAY_SIZE(brcmf_pcie_fwnames),
++				       fwnames, ARRAY_SIZE(fwnames));
++	if (!fwreq)
++		return -ENOMEM;
+ 
+-	return ret;
++	kfree(fwreq);
++	return 0;
+ }
+ 
+ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4000,22 +4000,24 @@ brcmf_sdio_watchdog(unsigned long data)
+ 	}
+ }
+ 
+-static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
+-				 u8 *fw_name)
++static
++int brcmf_sdio_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+-	int ret = 0;
++	struct brcmf_fw_request *fwreq;
++	struct brcmf_fw_name fwnames[] = {
++		{ ext, fw_name },
++	};
+ 
+-	if (sdiodev->fw_name[0] != '\0')
+-		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
+-	else
+-		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
+-						brcmf_sdio_fwnames,
+-						ARRAY_SIZE(brcmf_sdio_fwnames),
+-						fw_name, NULL);
++	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
++				       brcmf_sdio_fwnames,
++				       ARRAY_SIZE(brcmf_sdio_fwnames),
++				       fwnames, ARRAY_SIZE(fwnames));
++	if (!fwreq)
++		return -ENOMEM;
+ 
+-	return ret;
++	kfree(fwreq);
++	return 0;
+ }
+ 
+ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1128,21 +1128,24 @@ static void brcmf_usb_wowl_config(struct
+ 		device_set_wakeup_enable(devinfo->dev, false);
+ }
+ 
+-static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
+-				u8 *fw_name)
++static
++int brcmf_usb_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
+ {
+-	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
+-	int ret = 0;
++	struct brcmf_bus *bus = dev_get_drvdata(dev);
++	struct brcmf_fw_request *fwreq;
++	struct brcmf_fw_name fwnames[] = {
++		{ ext, fw_name },
++	};
+ 
+-	if (devinfo->fw_name[0] != '\0')
+-		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
+-	else
+-		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
+-						brcmf_usb_fwnames,
+-						ARRAY_SIZE(brcmf_usb_fwnames),
+-						fw_name, NULL);
++	fwreq = brcmf_fw_alloc_request(bus->chip, bus->chiprev,
++				       brcmf_usb_fwnames,
++				       ARRAY_SIZE(brcmf_usb_fwnames),
++				       fwnames, ARRAY_SIZE(fwnames));
++	if (!fwreq)
++		return -ENOMEM;
+ 
+-	return ret;
++	kfree(fwreq);
++	return 0;
+ }
+ 
+ static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
diff --git a/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch b/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
new file mode 100644
index 0000000000..becf7cf3fb
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
@@ -0,0 +1,92 @@
+From 18c2b20e276e04476a3350b4a92c1dfad725d45d Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:29 +0100
+Subject: [PATCH] brcmfmac: get rid of brcmf_fw_map_chip_to_name()
+
+The function is no longer used so removing it.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 53 ----------------------
+ .../broadcom/brcm80211/brcmfmac/firmware.h         |  4 --
+ 2 files changed, 57 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -635,59 +635,6 @@ static void brcmf_fw_get_full_name(char
+ 	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
+ }
+ 
+-int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
+-			      struct brcmf_firmware_mapping mapping_table[],
+-			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
+-			      char nvram_name[BRCMF_FW_NAME_LEN])
+-{
+-	char chipname[12];
+-	u32 i;
+-	char end;
+-
+-	for (i = 0; i < table_size; i++) {
+-		if (mapping_table[i].chipid == chip &&
+-		    mapping_table[i].revmask & BIT(chiprev))
+-			break;
+-	}
+-
+-	if (i == table_size) {
+-		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
+-		return -ENODEV;
+-	}
+-
+-	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
+-
+-	/* check if firmware path is provided by module parameter */
+-	if (brcmf_mp_global.firmware_path[0] != '\0') {
+-		if (fw_name)
+-			strlcpy(fw_name, brcmf_mp_global.firmware_path,
+-				BRCMF_FW_NAME_LEN);
+-		if (nvram_name)
+-			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
+-				BRCMF_FW_NAME_LEN);
+-
+-		end = brcmf_mp_global.firmware_path[
+-				strlen(brcmf_mp_global.firmware_path) - 1];
+-		if (end != '/') {
+-			if (fw_name)
+-				strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
+-			if (nvram_name)
+-				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
+-		}
+-	}
+-
+-	brcmf_info("using %s for chip %s\n",
+-		   mapping_table[i].fw_base, chipname);
+-	if (fw_name)
+-		brcmf_fw_get_full_name(fw_name,
+-				       mapping_table[i].fw_base, ".bin");
+-	if (nvram_name)
+-		brcmf_fw_get_full_name(nvram_name,
+-				       mapping_table[i].fw_base, ".txt");
+-
+-	return 0;
+-}
+-
+ struct brcmf_fw_request *
+ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+ 		       struct brcmf_firmware_mapping mapping_table[],
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+@@ -46,10 +46,6 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw
+ #define BRCMF_FW_ENTRY(chipid, mask, name) \
+ 	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_BASENAME }
+ 
+-int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
+-			      struct brcmf_firmware_mapping mapping_table[],
+-			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
+-			      char nvram_name[BRCMF_FW_NAME_LEN]);
+ void brcmf_fw_nvram_free(void *nvram);
+ 
+ enum brcmf_fw_type {
diff --git a/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch b/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
new file mode 100644
index 0000000000..d831f44fcd
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
@@ -0,0 +1,44 @@
+From bf291b7247e53f52a4236c0b55a5df046d6177df Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:30 +0100
+Subject: [PATCH] brcmfmac: get rid of brcmf_fw_get_full_name()
+
+The function was pretty minimal and now it is called only from one
+place so just get rid of it.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c    | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -628,13 +628,6 @@ int brcmf_fw_get_firmwares(struct device
+ 	return 0;
+ }
+ 
+-static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
+-				   const char *fw_base, const char *extension)
+-{
+-	strlcat(fw_name, fw_base, BRCMF_FW_NAME_LEN);
+-	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
+-}
+-
+ struct brcmf_fw_request *
+ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+ 		       struct brcmf_firmware_mapping mapping_table[],
+@@ -685,9 +678,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 					BRCMF_FW_NAME_LEN);
+ 			}
+ 		}
+-		brcmf_fw_get_full_name(fwnames[j].path,
+-				       mapping_table[i].fw_base,
+-				       fwnames[j].extension);
++		strlcat(fwnames[j].path, mapping_table[i].fw_base,
++			BRCMF_FW_NAME_LEN);
++		strlcat(fwnames[j].path, fwnames[j].extension,
++			BRCMF_FW_NAME_LEN);
+ 		fwreq->items[j].path = fwnames[j].path;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch b/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
new file mode 100644
index 0000000000..1c9c99599f
--- /dev/null
+++ b/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
@@ -0,0 +1,23 @@
+From 48eaee3f272a5bfe6986d07c51f6975d3c2f74d1 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:31 +0100
+Subject: [PATCH] brcmfmac: add kerneldoc for struct brcmf_bus::msgbuf
+
+This field did not have kerneldoc description so adding it now.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -140,6 +140,7 @@ struct brcmf_bus_stats {
+  * @always_use_fws_queue: bus wants use queue also when fwsignal is inactive.
+  * @wowl_supported: is wowl supported by bus driver.
+  * @chiprev: revision of the dongle chip.
++ * @msgbuf: msgbuf protocol parameters provided by bus layer.
+  */
+ struct brcmf_bus {
+ 	union {
diff --git a/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch b/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
new file mode 100644
index 0000000000..cd2279dd65
--- /dev/null
+++ b/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
@@ -0,0 +1,81 @@
+From 0b5c0305e57ca940713bcb2b202fd2b412c62f31 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 3 Apr 2018 10:18:15 +0200
+Subject: [PATCH] brcmfmac: fix firmware request processing if nvram load fails
+
+When nvram loading fails a double free occurred. Fix this and reorg the
+code a little.
+
+Fixes: d09ae51a4b67 ("brcmfmac: pass struct in brcmf_fw_get_firmwares()")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 36 ++++++++++++----------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -459,7 +459,7 @@ static void brcmf_fw_free_request(struct
+ 	kfree(req);
+ }
+ 
+-static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
++static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
+ 	struct brcmf_fw_item *cur;
+@@ -498,13 +498,10 @@ static void brcmf_fw_request_nvram_done(
+ 	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
+ 	cur->nv_data.data = nvram;
+ 	cur->nv_data.len = nvram_length;
+-	return;
++	return 0;
+ 
+ fail:
+-	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+-	fwctx->done(fwctx->dev, -ENOENT, NULL);
+-	brcmf_fw_free_request(fwctx->req);
+-	kfree(fwctx);
++	return -ENOENT;
+ }
+ 
+ static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
+@@ -553,20 +550,27 @@ static void brcmf_fw_request_done(const
+ 	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
+ 		  fw ? "" : "not ");
+ 
+-	if (fw) {
+-		if (cur->type == BRCMF_FW_TYPE_BINARY)
+-			cur->binary = fw;
+-		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
+-			brcmf_fw_request_nvram_done(fw, fwctx);
+-		else
+-			release_firmware(fw);
+-	} else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
+-		brcmf_fw_request_nvram_done(NULL, fwctx);
+-	} else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
++	if (!fw)
+ 		ret = -ENOENT;
++
++	switch (cur->type) {
++	case BRCMF_FW_TYPE_NVRAM:
++		ret = brcmf_fw_request_nvram_done(fw, fwctx);
++		break;
++	case BRCMF_FW_TYPE_BINARY:
++		cur->binary = fw;
++		break;
++	default:
++		/* something fishy here so bail out early */
++		brcmf_err("unknown fw type: %d\n", cur->type);
++		release_firmware(fw);
++		ret = -EINVAL;
+ 		goto fail;
+ 	}
+ 
++	if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
++		goto fail;
++
+ 	do {
+ 		if (++fwctx->curpos == fwctx->req->n_items) {
+ 			ret = 0;
diff --git a/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch b/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
new file mode 100644
index 0000000000..e31d69826d
--- /dev/null
+++ b/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
@@ -0,0 +1,48 @@
+From 1f589e2510d5df1192dca7c089103a2cbd028101 Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Tue, 3 Apr 2018 10:21:56 +0200
+Subject: [PATCH] brcmfmac: add support for BCM4366E chipset
+
+BCM4366E is a wireless chipset with a BCM43664 ChipCommon. It's
+supported by the same firmware as 4366c0.
+
+Signed-off-by: Dan Haab <dan.haab@luxul.com>
+[arend: rebase patch and remove unnecessary definition]
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c       | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c       | 1 +
+ drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
+ 3 files changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -689,6 +689,7 @@ static u32 brcmf_chip_tcm_rambase(struct
+ 	case BRCM_CC_43525_CHIP_ID:
+ 	case BRCM_CC_4365_CHIP_ID:
+ 	case BRCM_CC_4366_CHIP_ID:
++	case BRCM_CC_43664_CHIP_ID:
+ 		return 0x200000;
+ 	case CY_CC_4373_CHIP_ID:
+ 		return 0x160000;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -75,6 +75,7 @@ static struct brcmf_firmware_mapping brc
+ 	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
++	BRCMF_FW_ENTRY(BRCM_CC_43664_CHIP_ID, 0xFFFFFFF0, 4366C),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
+ };
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -57,6 +57,7 @@
+ #define BRCM_CC_43602_CHIP_ID		43602
+ #define BRCM_CC_4365_CHIP_ID		0x4365
+ #define BRCM_CC_4366_CHIP_ID		0x4366
++#define BRCM_CC_43664_CHIP_ID		43664
+ #define BRCM_CC_4371_CHIP_ID		0x4371
+ #define CY_CC_4373_CHIP_ID		0x4373
+ 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch b/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
new file mode 100644
index 0000000000..909000cc59
--- /dev/null
+++ b/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
@@ -0,0 +1,34 @@
+From cb746e47837ad0f35c8ae28e9aacc8eb07916d2a Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 26 Apr 2018 12:16:47 +0200
+Subject: [PATCH] brcmfmac: check p2pdev mac address uniqueness
+
+The mac address for p2pdev must be different from the primary interface
+due to firmware requirement. Add an explicit check for this requirement
+if user-space provides a mac address.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2073,6 +2073,13 @@ static struct wireless_dev *brcmf_p2p_cr
+ 	}
+ 
+ 	pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
++
++	/* firmware requires unique mac address for p2pdev interface */
++	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
++		brcmf_err("discovery vif must be different from primary interface\n");
++		return ERR_PTR(-EINVAL);
++	}
++
+ 	brcmf_p2p_generate_bss_mac(p2p, addr);
+ 	brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
+ 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch b/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
new file mode 100644
index 0000000000..4f59507cab
--- /dev/null
+++ b/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
@@ -0,0 +1,76 @@
+From 7742fce4c007141617dab9bcb90034b3c0fe2347 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Thu, 26 Apr 2018 12:18:35 +0200
+Subject: [PATCH] brcmfmac: reports boottime_ns while informing bss
+
+Provides a timestamp in bss information so user space can see when the
+bss info was updated. Since tsf is not available from the dongle events
+boottime is reported instead.
+
+Reported-by: Dmitry Shmidt <dimitrysh@google.com>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 26 +++++++++++-----------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2728,7 +2728,6 @@ static s32 brcmf_inform_single_bss(struc
+ 				   struct brcmf_bss_info_le *bi)
+ {
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+-	struct ieee80211_channel *notify_channel;
+ 	struct cfg80211_bss *bss;
+ 	struct ieee80211_supported_band *band;
+ 	struct brcmu_chan ch;
+@@ -2738,7 +2737,7 @@ static s32 brcmf_inform_single_bss(struc
+ 	u16 notify_interval;
+ 	u8 *notify_ie;
+ 	size_t notify_ielen;
+-	s32 notify_signal;
++	struct cfg80211_inform_bss bss_data = { 0 };
+ 
+ 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
+ 		brcmf_err("Bss info is larger than buffer. Discarding\n");
+@@ -2758,27 +2757,28 @@ static s32 brcmf_inform_single_bss(struc
+ 		band = wiphy->bands[NL80211_BAND_5GHZ];
+ 
+ 	freq = ieee80211_channel_to_frequency(channel, band->band);
+-	notify_channel = ieee80211_get_channel(wiphy, freq);
++	bss_data.chan = ieee80211_get_channel(wiphy, freq);
++	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
++	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
+ 
+ 	notify_capability = le16_to_cpu(bi->capability);
+ 	notify_interval = le16_to_cpu(bi->beacon_period);
+ 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
+ 	notify_ielen = le32_to_cpu(bi->ie_length);
+-	notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
++	bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
+ 
+ 	brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
+ 	brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
+ 	brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
+ 	brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
+-	brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
++	brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
+ 
+-	bss = cfg80211_inform_bss(wiphy, notify_channel,
+-				  CFG80211_BSS_FTYPE_UNKNOWN,
+-				  (const u8 *)bi->BSSID,
+-				  0, notify_capability,
+-				  notify_interval, notify_ie,
+-				  notify_ielen, notify_signal,
+-				  GFP_KERNEL);
++	bss = cfg80211_inform_bss_data(wiphy, &bss_data,
++				       CFG80211_BSS_FTYPE_UNKNOWN,
++				       (const u8 *)bi->BSSID,
++				       0, notify_capability,
++				       notify_interval, notify_ie,
++				       notify_ielen, GFP_KERNEL);
+ 
+ 	if (!bss)
+ 		return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch b/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
new file mode 100644
index 0000000000..2d60c0d9ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
@@ -0,0 +1,43 @@
+From aed14219067ab96e5eeb7730e9bceed10d9be989 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Thu, 26 Apr 2018 12:16:48 +0200
+Subject: [PATCH] brcmfmac: use nl80211_band directly to get ieee80211 channel
+
+The enum nl80211_band used to retrieve wiphy->bands is the same as
+wiphy->bands->band which is checked by wiphy_register(). So it can be used
+directly as parameter of ieee80211_channel_to_frequency().
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2729,7 +2729,7 @@ static s32 brcmf_inform_single_bss(struc
+ {
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct cfg80211_bss *bss;
+-	struct ieee80211_supported_band *band;
++	enum nl80211_band band;
+ 	struct brcmu_chan ch;
+ 	u16 channel;
+ 	u32 freq;
+@@ -2752,11 +2752,11 @@ static s32 brcmf_inform_single_bss(struc
+ 	channel = bi->ctl_ch;
+ 
+ 	if (channel <= CH_MAX_2G_CHANNEL)
+-		band = wiphy->bands[NL80211_BAND_2GHZ];
++		band = NL80211_BAND_2GHZ;
+ 	else
+-		band = wiphy->bands[NL80211_BAND_5GHZ];
++		band = NL80211_BAND_5GHZ;
+ 
+-	freq = ieee80211_channel_to_frequency(channel, band->band);
++	freq = ieee80211_channel_to_frequency(channel, band);
+ 	bss_data.chan = ieee80211_get_channel(wiphy, freq);
+ 	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
+ 	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
diff --git a/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch b/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
new file mode 100644
index 0000000000..df2648374a
--- /dev/null
+++ b/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
@@ -0,0 +1,76 @@
+From ff68c9f9c06d1fd437c8f90fc05ca28c47f7d85e Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 26 Apr 2018 12:16:49 +0200
+Subject: [PATCH] brcmfmac: constify firmware mapping tables
+
+The information in the firmware mapping does not need to be modified
+so it can be static const.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c     | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c     | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c      | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -634,7 +634,7 @@ int brcmf_fw_get_firmwares(struct device
+ 
+ struct brcmf_fw_request *
+ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+-		       struct brcmf_firmware_mapping mapping_table[],
++		       const struct brcmf_firmware_mapping mapping_table[],
+ 		       u32 table_size, struct brcmf_fw_name *fwnames,
+ 		       u32 n_fwnames)
+ {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+@@ -80,7 +80,7 @@ struct brcmf_fw_name {
+ 
+ struct brcmf_fw_request *
+ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+-		       struct brcmf_firmware_mapping mapping_table[],
++		       const struct brcmf_firmware_mapping mapping_table[],
+ 		       u32 table_size, struct brcmf_fw_name *fwnames,
+ 		       u32 n_fwnames);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -59,7 +59,7 @@ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"
+ BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
+ BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
+ 
+-static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
++static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -619,7 +619,7 @@ BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
+ BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
+ BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
+ 
+-static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
++static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -52,7 +52,7 @@ BRCMF_FW_DEF(43242A, "brcmfmac43242a");
+ BRCMF_FW_DEF(43569, "brcmfmac43569");
+ BRCMF_FW_DEF(4373, "brcmfmac4373");
+ 
+-static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
++static const struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43235_CHIP_ID, 0x00000008, 43236B),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43236_CHIP_ID, 0x00000008, 43236B),
diff --git a/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch b/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
new file mode 100644
index 0000000000..e3d4441f7f
--- /dev/null
+++ b/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
@@ -0,0 +1,74 @@
+From 84ad327d18debe19b8d509059b61db445d048b02 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Thu, 26 Apr 2018 12:16:50 +0200
+Subject: [PATCH] brcmfmac: add hostready indication
+
+A hostready signal is introduced to inform firmware through mailbox
+doorbell1 when common ring initialized or D3 exited.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -105,7 +105,8 @@ static const struct brcmf_firmware_mappi
+ #define BRCMF_PCIE_PCIE2REG_MAILBOXMASK		0x4C
+ #define BRCMF_PCIE_PCIE2REG_CONFIGADDR		0x120
+ #define BRCMF_PCIE_PCIE2REG_CONFIGDATA		0x124
+-#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX		0x140
++#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_0	0x140
++#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_1	0x144
+ 
+ #define BRCMF_PCIE2_INTA			0x01
+ #define BRCMF_PCIE2_INTB			0x02
+@@ -140,6 +141,7 @@ static const struct brcmf_firmware_mappi
+ #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
+ #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
+ #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
++#define BRCMF_PCIE_SHARED_HOSTRDY_DB1		0x10000000
+ 
+ #define BRCMF_PCIE_FLAGS_HTOD_SPLIT		0x4000
+ #define BRCMF_PCIE_FLAGS_DTOH_SPLIT		0x8000
+@@ -782,6 +784,12 @@ static void brcmf_pcie_intr_enable(struc
+ 			       BRCMF_PCIE_MB_INT_FN0_1);
+ }
+ 
++static void brcmf_pcie_hostready(struct brcmf_pciedev_info *devinfo)
++{
++	if (devinfo->shared.flags & BRCMF_PCIE_SHARED_HOSTRDY_DB1)
++		brcmf_pcie_write_reg32(devinfo,
++				       BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_1, 1);
++}
+ 
+ static irqreturn_t brcmf_pcie_quick_check_isr(int irq, void *arg)
+ {
+@@ -924,7 +932,7 @@ static int brcmf_pcie_ring_mb_ring_bell(
+ 
+ 	brcmf_dbg(PCIE, "RING !\n");
+ 	/* Any arbitrary value will do, lets use 1 */
+-	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
++	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_0, 1);
+ 
+ 	return 0;
+ }
+@@ -1728,6 +1736,7 @@ static void brcmf_pcie_setup(struct devi
+ 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
+ 
+ 	brcmf_pcie_intr_enable(devinfo);
++	brcmf_pcie_hostready(devinfo);
+ 	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
+ 		return;
+ 
+@@ -1950,6 +1959,7 @@ static int brcmf_pcie_pm_leave_D3(struct
+ 		brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
+ 		brcmf_bus_change_state(bus, BRCMF_BUS_UP);
+ 		brcmf_pcie_intr_enable(devinfo);
++		brcmf_pcie_hostready(devinfo);
+ 		return 0;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch b/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
new file mode 100644
index 0000000000..8750037d85
--- /dev/null
+++ b/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
@@ -0,0 +1,97 @@
+From f56324baf329bc9362a52ad77a4a1a0f3356d1bc Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Thu, 26 Apr 2018 12:16:51 +0200
+Subject: [PATCH] brcmfmac: coarse support for PCIe shared structure rev7
+
+Revision 7 of PCIe dongle interface increases the item size of tx and rx
+complete rings to accommodate extra payload for new feature. This patch
+simply bump up the size of these two rings without adding the support
+for utilizing the new space. This makes brcmfmac compatible with rev7
+firmware.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h  |  6 ++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 23 ++++++++++++++++++----
+ 2 files changed, 23 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
+@@ -27,8 +27,10 @@
+ #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE	40
+ #define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE	32
+ #define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE	24
+-#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE		16
+-#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		32
++#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7	16
++#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE		24
++#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7	32
++#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		40
+ #define BRCMF_H2D_TXFLOWRING_ITEMSIZE			48
+ 
+ struct msgbuf_buf_addr {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -136,8 +136,9 @@ static const struct brcmf_firmware_mappi
+ 						 BRCMF_PCIE_MB_INT_D2H3_DB0 | \
+ 						 BRCMF_PCIE_MB_INT_D2H3_DB1)
+ 
++#define BRCMF_PCIE_SHARED_VERSION_7		7
+ #define BRCMF_PCIE_MIN_SHARED_VERSION		5
+-#define BRCMF_PCIE_MAX_SHARED_VERSION		6
++#define BRCMF_PCIE_MAX_SHARED_VERSION		BRCMF_PCIE_SHARED_VERSION_7
+ #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
+ #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
+ #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
+@@ -318,6 +319,14 @@ static const u32 brcmf_ring_max_item[BRC
+ 	BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM
+ };
+ 
++static const u32 brcmf_ring_itemsize_pre_v7[BRCMF_NROF_COMMON_MSGRINGS] = {
++	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
++	BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
++	BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE,
++	BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7,
++	BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7
++};
++
+ static const u32 brcmf_ring_itemsize[BRCMF_NROF_COMMON_MSGRINGS] = {
+ 	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
+ 	BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
+@@ -1007,8 +1016,14 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
+ 	struct brcmf_pcie_ringbuf *ring;
+ 	u32 size;
+ 	u32 addr;
++	const u32 *ring_itemsize_array;
++
++	if (devinfo->shared.version < BRCMF_PCIE_SHARED_VERSION_7)
++		ring_itemsize_array = brcmf_ring_itemsize_pre_v7;
++	else
++		ring_itemsize_array = brcmf_ring_itemsize;
+ 
+-	size = brcmf_ring_max_item[ring_id] * brcmf_ring_itemsize[ring_id];
++	size = brcmf_ring_max_item[ring_id] * ring_itemsize_array[ring_id];
+ 	dma_buf = brcmf_pcie_init_dmabuffer_for_device(devinfo, size,
+ 			tcm_ring_phys_addr + BRCMF_RING_MEM_BASE_ADDR_OFFSET,
+ 			&dma_handle);
+@@ -1018,7 +1033,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
+ 	addr = tcm_ring_phys_addr + BRCMF_RING_MAX_ITEM_OFFSET;
+ 	brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_max_item[ring_id]);
+ 	addr = tcm_ring_phys_addr + BRCMF_RING_LEN_ITEMS_OFFSET;
+-	brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_itemsize[ring_id]);
++	brcmf_pcie_write_tcm16(devinfo, addr, ring_itemsize_array[ring_id]);
+ 
+ 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
+ 	if (!ring) {
+@@ -1027,7 +1042,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
+ 		return NULL;
+ 	}
+ 	brcmf_commonring_config(&ring->commonring, brcmf_ring_max_item[ring_id],
+-				brcmf_ring_itemsize[ring_id], dma_buf);
++				ring_itemsize_array[ring_id], dma_buf);
+ 	ring->dma_handle = dma_handle;
+ 	ring->devinfo = devinfo;
+ 	brcmf_commonring_register_cb(&ring->commonring,
diff --git a/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch b/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
new file mode 100644
index 0000000000..13f169be9f
--- /dev/null
+++ b/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
@@ -0,0 +1,45 @@
+From 9c4a121e82634aa000a702c98cd6f05b27d6e186 Mon Sep 17 00:00:00 2001
+From: Sean Lanigan <sean@lano.id.au>
+Date: Fri, 4 May 2018 16:48:23 +1000
+Subject: [PATCH] brcmfmac: Add support for bcm43364 wireless chipset
+
+Add support for the BCM43364 chipset via an SDIO interface, as used in
+e.g. the Murata 1FX module.
+
+The BCM43364 uses the same firmware as the BCM43430 (which is already
+included), the only difference is the omission of Bluetooth.
+
+However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS
+of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't
+load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place
+triggers the brcmfmac driver to load, and then correctly use the
+firmware file 'brcmfmac43430-sdio.bin'.
+
+Signed-off-by: Sean Lanigan <sean@lano.id.au>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
+ include/linux/mmc/sdio_ids.h                              | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -963,6 +963,7 @@ static const struct sdio_device_id brcmf
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
++ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -34,6 +34,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
+ #define SDIO_DEVICE_ID_BROADCOM_4339		0x4339
+ #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
++#define SDIO_DEVICE_ID_BROADCOM_43364		0xa9a4
+ #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
+ #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
+ #define SDIO_DEVICE_ID_BROADCOM_43455		0xa9bf
diff --git a/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch b/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
new file mode 100644
index 0000000000..de41e1c453
--- /dev/null
+++ b/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
@@ -0,0 +1,34 @@
+From 1204aa17f3b4f63e67ac9b7c9afa9496485969c5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 10 May 2018 15:21:39 +0200
+Subject: [PATCH] brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+brcmfmac is a FullMAC driver and it implements/uses cfg80211 interface
+for stations management. At the same time it doesn't receive or pass up
+management frames.
+
+This flag indicates that authenticator doesn't have to subscribe to or
+handle management frames. Some authenticators (e.g. hostapd) were
+working with brcmfmac thanks to some extra assumptions. This commit
+clears up the situation.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6513,6 +6513,7 @@ static int brcmf_setup_wiphy(struct wiph
+ 
+ 	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+ 			WIPHY_FLAG_PS_ON_BY_DEFAULT |
++			WIPHY_FLAG_HAVE_AP_SME |
+ 			WIPHY_FLAG_OFFCHAN_TX |
+ 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
diff --git a/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch b/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
new file mode 100644
index 0000000000..2436bb8a8a
--- /dev/null
+++ b/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
@@ -0,0 +1,29 @@
+From 763ece85f45a6b93268e25a0abf02922f911dab4 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Tue, 15 May 2018 11:14:44 +0200
+Subject: [PATCH] brcmfmac: fix initialization of struct cfg80211_inform_bss
+ variable
+
+This patch fixes a sparse warning "Using plain integer as NULL pointer"
+about cfg80211_inform_bss structure initialization.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2737,7 +2737,7 @@ static s32 brcmf_inform_single_bss(struc
+ 	u16 notify_interval;
+ 	u8 *notify_ie;
+ 	size_t notify_ielen;
+-	struct cfg80211_inform_bss bss_data = { 0 };
++	struct cfg80211_inform_bss bss_data = {};
+ 
+ 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
+ 		brcmf_err("Bss info is larger than buffer. Discarding\n");
diff --git a/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch b/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
new file mode 100644
index 0000000000..f350d1e819
--- /dev/null
+++ b/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
@@ -0,0 +1,75 @@
+From 88001968245c42c26416476bf0ef960442371605 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 14 May 2018 08:48:20 +0200
+Subject: [PATCH] brcmfmac: add debugfs entry for reading firmware capabilities
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows reading all capabilities as reported by a firmware. They are
+printed using native (raw) names, just like developers like it the most.
+It's how firmware reports support for various features, e.g. supported
+modes, supported standards, power saving details, max BSS-es.
+
+Access to all that info is useful for trying new firmwares, comparing
+them and debugging features AKA bugs.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 36 ++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -165,6 +165,41 @@ static void brcmf_feat_firmware_capabili
+ 	}
+ }
+ 
++/**
++ * brcmf_feat_fwcap_debugfs_read() - expose firmware capabilities to debugfs.
++ *
++ * @seq: sequence for debugfs entry.
++ * @data: raw data pointer.
++ */
++static int brcmf_feat_fwcap_debugfs_read(struct seq_file *seq, void *data)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
++	struct brcmf_if *ifp = brcmf_get_ifp(bus_if->drvr, 0);
++	char caps[MAX_CAPS_BUFFER_SIZE + 1] = { };
++	char *tmp;
++	int err;
++
++	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
++	if (err) {
++		brcmf_err("could not get firmware cap (%d)\n", err);
++		return err;
++	}
++
++	/* Put every capability in a new line */
++	for (tmp = caps; *tmp; tmp++) {
++		if (*tmp == ' ')
++			*tmp = '\n';
++	}
++
++	/* Usually there is a space at the end of capabilities string */
++	seq_printf(seq, "%s", caps);
++	/* So make sure we don't print two line breaks */
++	if (tmp > caps && *(tmp - 1) != '\n')
++		seq_printf(seq, "\n");
++
++	return 0;
++}
++
+ void brcmf_feat_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+@@ -233,6 +268,7 @@ void brcmf_feat_attach(struct brcmf_pub
+ void brcmf_feat_debugfs_create(struct brcmf_pub *drvr)
+ {
+ 	brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
++	brcmf_debugfs_add_entry(drvr, "fwcap", brcmf_feat_fwcap_debugfs_read);
+ }
+ 
+ bool brcmf_feat_is_enabled(struct brcmf_if *ifp, enum brcmf_feat_id id)
diff --git a/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch b/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
new file mode 100644
index 0000000000..f353a60b87
--- /dev/null
+++ b/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
@@ -0,0 +1,52 @@
+From f8793c26fe586659d6da3fa277e63961a69d314b Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 16 May 2018 14:11:58 +0200
+Subject: [PATCH] brcmfmac: move ALLFFMAC variable in flowring module
+
+The only user of ALLFFMAC is the flowring module so no need to
+expose it in a header file.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c   | 2 --
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h   | 2 --
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 2 ++
+ 3 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -36,8 +36,6 @@ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+ MODULE_LICENSE("Dual BSD/GPL");
+ 
+-const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+-
+ #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME	40
+ #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME	40
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -19,8 +19,6 @@
+ #include <linux/platform_data/brcmfmac.h>
+ #include "fwil_types.h"
+ 
+-extern const u8 ALLFFMAC[ETH_ALEN];
+-
+ #define BRCMF_FW_ALTPATH_LEN			256
+ 
+ /* Definitions for the module global and device specific settings are defined
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
+@@ -46,6 +46,8 @@ static const u8 brcmf_flowring_prio2fifo
+ 	3
+ };
+ 
++static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
++
+ 
+ static bool
+ brcmf_flowring_is_tdls_mac(struct brcmf_flowring *flow, u8 mac[ETH_ALEN])
diff --git a/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch b/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
new file mode 100644
index 0000000000..86533b95b6
--- /dev/null
+++ b/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
@@ -0,0 +1,76 @@
+From 8e072168f75ebce85b96cbcefea2b10ddbd5913f Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 16 May 2018 14:11:59 +0200
+Subject: [PATCH] brcmfmac: add support for sysfs initiated coredump
+
+The driver already supports device coredump initiated by firmware
+event. Since commit 3c47d19ff4dc ("drivers: base: add coredump driver
+ops") it is also possible to initiate it from user-space through
+sysfs. This patch adds support for SDIO and PCIe devices.
+
+[rafal@milecki.pl: use LINUX_VERSION_CODE]
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h    | 2 ++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 8 ++++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c   | 1 +
+ 4 files changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1165,6 +1165,9 @@ static struct sdio_driver brcmf_sdmmc_dr
+ #ifdef CONFIG_PM_SLEEP
+ 		.pm = &brcmf_sdio_pm_ops,
+ #endif	/* CONFIG_PM_SLEEP */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
++		.coredump = brcmf_dev_coredump,
++#endif
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -250,6 +250,8 @@ int brcmf_attach(struct device *dev, str
+ void brcmf_detach(struct device *dev);
+ /* Indication from bus module that dongle should be reset */
+ void brcmf_dev_reset(struct device *dev);
++/* Request from bus module to initiate a coredump */
++void brcmf_dev_coredump(struct device *dev);
+ 
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1201,6 +1201,14 @@ void brcmf_dev_reset(struct device *dev)
+ 		brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
+ }
+ 
++void brcmf_dev_coredump(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++
++	if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0)
++		brcmf_dbg(TRACE, "failed to create coredump\n");
++}
++
+ void brcmf_detach(struct device *dev)
+ {
+ 	s32 i;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2044,6 +2044,9 @@ static struct pci_driver brcmf_pciedrvr
+ #ifdef CONFIG_PM
+ 	.driver.pm = &brcmf_pciedrvr_pm,
+ #endif
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
++	.driver.coredump = brcmf_dev_coredump,
++#endif
+ };
+ 
+ 
diff --git a/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch b/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
new file mode 100644
index 0000000000..455009ef1d
--- /dev/null
+++ b/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
@@ -0,0 +1,32 @@
+From d2af9b566554e01f9ad67b330ce569dbc130e5d3 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 16 May 2018 14:12:01 +0200
+Subject: [PATCH] brcmfmac: validate user provided data for memdump before
+ copying
+
+In patch "brcmfmac: add support for sysfs initiated coredump", a new
+scenario of brcmf_debug_create_memdump was added in which the user of
+the function might not necessarily provide prefix data. Hence the
+function should not assume the data is always valid and should perform a
+check before copying.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -40,7 +40,8 @@ int brcmf_debug_create_memdump(struct br
+ 	if (!dump)
+ 		return -ENOMEM;
+ 
+-	memcpy(dump, data, len);
++	if (data && len > 0)
++		memcpy(dump, data, len);
+ 	err = brcmf_bus_get_memdump(bus, dump + len, ramsize);
+ 	if (err) {
+ 		vfree(dump);
diff --git a/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch b/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
new file mode 100644
index 0000000000..b94e06fa44
--- /dev/null
+++ b/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
@@ -0,0 +1,38 @@
+From 8a3ab2f38f1669e3be6433a1f6b82a077b38c4c7 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 16 May 2018 14:12:02 +0200
+Subject: [PATCH] brcmfmac: trigger memory dump upon firmware halt signal
+
+PCIe dongle firmware signals a halt/trap through mailbox interrupt.
+Trigger a memory dump upon receiving such signal could help to provide
+useful information for issue debug.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -182,6 +182,7 @@ static const struct brcmf_firmware_mappi
+ #define BRCMF_D2H_DEV_D3_ACK			0x00000001
+ #define BRCMF_D2H_DEV_DS_ENTER_REQ		0x00000002
+ #define BRCMF_D2H_DEV_DS_EXIT_NOTE		0x00000004
++#define BRCMF_D2H_DEV_FWHALT			0x10000000
+ 
+ #define BRCMF_H2D_HOST_D3_INFORM		0x00000001
+ #define BRCMF_H2D_HOST_DS_ACK			0x00000002
+@@ -717,6 +718,10 @@ static void brcmf_pcie_handle_mb_data(st
+ 		devinfo->mbdata_completed = true;
+ 		wake_up(&devinfo->mbdata_resp_wait);
+ 	}
++	if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) {
++		brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n");
++		brcmf_dev_coredump(&devinfo->pdev->dev);
++	}
+ }
+ 
+ 
diff --git a/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch b/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
new file mode 100644
index 0000000000..045e20acfb
--- /dev/null
+++ b/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
@@ -0,0 +1,30 @@
+From b8248236e92790ac635caeb4156e46ea2417e037 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 16 May 2018 14:12:03 +0200
+Subject: [PATCH] brcmfmac: trigger memory dump on SDIO firmware halt message
+
+Attempt to dump dongle memory for debug upon receiving firmware halt
+message through dongle to host mail box interrupt.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1072,8 +1072,10 @@ static u32 brcmf_sdio_hostmail(struct br
+ 	bus->sdcnt.f1regdata += 2;
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+-	if (hmb_data & HMB_DATA_FWHALT)
++	if (hmb_data & HMB_DATA_FWHALT) {
+ 		brcmf_err("mailbox indicates firmware halted\n");
++		brcmf_dev_coredump(&sdiod->func1->dev);
++	}
+ 
+ 	/* Dongle recomposed rx frames, accept them again */
+ 	if (hmb_data & HMB_DATA_NAKHANDLED) {
diff --git a/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch b/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
new file mode 100644
index 0000000000..a478b675cc
--- /dev/null
+++ b/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
@@ -0,0 +1,70 @@
+From 373c83a801f15b1e3d02d855fad89112bd4ccbe0 Mon Sep 17 00:00:00 2001
+From: Michael Trimarchi <michael@amarulasolutions.com>
+Date: Wed, 30 May 2018 11:06:34 +0200
+Subject: [PATCH] brcmfmac: stop watchdog before detach and free everything
+
+Using built-in in kernel image without a firmware in filesystem
+or in the kernel image can lead to a kernel NULL pointer deference.
+Watchdog need to be stopped in brcmf_sdio_remove
+
+The system is going down NOW!
+[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
+Sent SIGTERM to all processes
+[ 1348.121412] Mem abort info:
+[ 1348.126962]   ESR = 0x96000004
+[ 1348.130023]   Exception class = DABT (current EL), IL = 32 bits
+[ 1348.135948]   SET = 0, FnV = 0
+[ 1348.138997]   EA = 0, S1PTW = 0
+[ 1348.142154] Data abort info:
+[ 1348.145045]   ISV = 0, ISS = 0x00000004
+[ 1348.148884]   CM = 0, WnR = 0
+[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
+[ 1348.158475] [00000000000002f8] pgd=0000000000000000
+[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 1348.168927] Modules linked in: ipv6
+[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
+[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
+[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
+[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
+[ 1348.200253] sp : ffff00000b85be30
+[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
+[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
+[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
+[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
+[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
+[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
+[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
+[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
+[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
+[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
+[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
+[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
+[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
+[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
+[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
+
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4297,6 +4297,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (bus) {
++		/* Stop watchdog task */
++		if (bus->watchdog_tsk) {
++			send_sig(SIGTERM, bus->watchdog_tsk, 1);
++			kthread_stop(bus->watchdog_tsk);
++			bus->watchdog_tsk = NULL;
++		}
++
+ 		/* De-register interrupt handler */
+ 		brcmf_sdiod_intr_unregister(bus->sdiodev);
+ 
diff --git a/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch b/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
new file mode 100644
index 0000000000..2e265a2f37
--- /dev/null
+++ b/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
@@ -0,0 +1,41 @@
+From 299b6365a3b7cf7f5ea1c945a420e9ee4841d6f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 22 Jul 2018 23:46:25 +0200
+Subject: [PATCH] brcmfmac: fix regression in parsing NVRAM for multiple
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+NVRAM is designed to work with Broadcom's SDK Linux kernel which fakes
+PCI domain 0 for all internal MMIO devices. Since official Linux kernel
+uses platform devices for that purpose there is a mismatch in numbering
+PCI domains.
+
+There used to be a fix for that problem but it was accidentally dropped
+during the last firmware loading rework. That resulted in brcmfmac not
+being able to extract device specific NVRAM content and all kind of
+calibration problems.
+
+Reported-by: Aditya Xavier <adityaxavier@gmail.com>
+Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function")
+Cc: stable@vger.kernel.org # v4.17+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brc
+ 	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+ 	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
+ 	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
+-	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
++	/* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
++	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
+ 	fwreq->bus_nr = devinfo->pdev->bus->number;
+ 
+ 	return fwreq;
diff --git a/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch b/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
new file mode 100644
index 0000000000..b0eec163f1
--- /dev/null
+++ b/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
@@ -0,0 +1,59 @@
+From 01f69dfafdbe7deff58b58053bc3a4a75c6a570c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 24 Jun 2018 21:44:35 +0200
+Subject: [PATCH] brcmfmac: detect firmware support for monitor interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Many/most of firmwares support creating monitor interface but only the
+most recent ones explicitly /announce/ it using a "monitor" entry in the
+list of capabilities.
+
+Check for that entry and store internally info about monitor mode
+support using a new feature flag. Once we sort out all details of
+handling monitor interface it will be used when reporting available
+interfaces to the cfg80211.
+
+Later some fallback detecion method may be added for older firmwares.
+For now just stick to the "monitor" capability which should be 100%
+reliable.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h | 4 +++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -48,6 +48,7 @@ static const struct brcmf_feat_fwcap brc
+ 	{ BRCMF_FEAT_MBSS, "mbss" },
+ 	{ BRCMF_FEAT_MCHAN, "mchan" },
+ 	{ BRCMF_FEAT_P2P, "p2p" },
++	{ BRCMF_FEAT_MONITOR, "monitor" },
+ };
+ 
+ #ifdef DEBUG
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -33,6 +33,7 @@
+  * MFP: 802.11w Management Frame Protection.
+  * GSCAN: enhanced scan offload feature.
+  * FWSUP: Firmware supplicant.
++ * MONITOR: firmware can pass monitor packets to host.
+  */
+ #define BRCMF_FEAT_LIST \
+ 	BRCMF_FEAT_DEF(MBSS) \
+@@ -48,7 +49,8 @@
+ 	BRCMF_FEAT_DEF(WOWL_ARP_ND) \
+ 	BRCMF_FEAT_DEF(MFP) \
+ 	BRCMF_FEAT_DEF(GSCAN) \
+-	BRCMF_FEAT_DEF(FWSUP)
++	BRCMF_FEAT_DEF(FWSUP) \
++	BRCMF_FEAT_DEF(MONITOR)
+ 
+ /*
+  * Quirks:
diff --git a/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch b/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
new file mode 100644
index 0000000000..e733468bc3
--- /dev/null
+++ b/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
@@ -0,0 +1,51 @@
+From e63410ac65e0ead2040bbd3927c116889edf87e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 24 Jun 2018 21:44:36 +0200
+Subject: [PATCH] brcmfmac: detect firmware support for radiotap monitor frames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Depending on used build-time options some firmwares may already include
+radiotap header in passed monitor frames. Add a new feature flag to
+store info about it. It's needed for proper handling of received frames
+before passing them up.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h | 4 +++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -49,6 +49,7 @@ static const struct brcmf_feat_fwcap brc
+ 	{ BRCMF_FEAT_MCHAN, "mchan" },
+ 	{ BRCMF_FEAT_P2P, "p2p" },
+ 	{ BRCMF_FEAT_MONITOR, "monitor" },
++	{ BRCMF_FEAT_MONITOR_FMT_RADIOTAP, "rtap" },
+ };
+ 
+ #ifdef DEBUG
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -34,6 +34,7 @@
+  * GSCAN: enhanced scan offload feature.
+  * FWSUP: Firmware supplicant.
+  * MONITOR: firmware can pass monitor packets to host.
++ * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
+  */
+ #define BRCMF_FEAT_LIST \
+ 	BRCMF_FEAT_DEF(MBSS) \
+@@ -50,7 +51,8 @@
+ 	BRCMF_FEAT_DEF(MFP) \
+ 	BRCMF_FEAT_DEF(GSCAN) \
+ 	BRCMF_FEAT_DEF(FWSUP) \
+-	BRCMF_FEAT_DEF(MONITOR)
++	BRCMF_FEAT_DEF(MONITOR) \
++	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP)
+ 
+ /*
+  * Quirks:
diff --git a/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch b/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
new file mode 100644
index 0000000000..d640bcfecc
--- /dev/null
+++ b/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
@@ -0,0 +1,137 @@
+From a8d7631858aff156b72f807ee7cc062048e63836 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 24 Jun 2018 21:44:37 +0200
+Subject: [PATCH] brcmfmac: handle msgbuf packets marked with monitor mode flag
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New Broadcom firmwares mark monitor mode packets using a newly defined
+bit in the flags field. Use it to filter them out and pass to the
+monitor interface. These defines were found in bcmmsgbuf.h from SDK.
+
+As not every firmware generates radiotap header this commit introduces
+BRCMF_FEAT_MONITOR_FMT_RADIOTAP flag. It has to be has based on firmware
+capabilities. If not present brcmf_netif_mon_rx() will assume packet is
+a raw 802.11 frame and will prepend it with an empty radiotap header.
+
+This new code is limited to the msgbuf protocol at this point. Adding
+support for SDIO/USB devices will require some extra work (possibly a
+new firmware release).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 25 ++++++++++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
+ .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  | 18 ++++++++++++++++
+ 3 files changed, 45 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -21,6 +21,7 @@
+ #include <net/cfg80211.h>
+ #include <net/rtnetlink.h>
+ #include <net/addrconf.h>
++#include <net/ieee80211_radiotap.h>
+ #include <net/ipv6.h>
+ #include <brcmu_utils.h>
+ #include <brcmu_wifi.h>
+@@ -404,6 +405,30 @@ void brcmf_netif_rx(struct brcmf_if *ifp
+ 		netif_rx_ni(skb);
+ }
+ 
++void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb)
++{
++	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
++		/* Do nothing */
++	} else {
++		struct ieee80211_radiotap_header *radiotap;
++
++		/* TODO: use RX status to fill some radiotap data */
++		radiotap = skb_push(skb, sizeof(*radiotap));
++		memset(radiotap, 0, sizeof(*radiotap));
++		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
++
++		/* TODO: 4 bytes with receive status? */
++		skb->len -= 4;
++	}
++
++	skb->dev = ifp->ndev;
++	skb_reset_mac_header(skb);
++	skb->pkt_type = PACKET_OTHERHOST;
++	skb->protocol = htons(ETH_P_802_2);
++
++	brcmf_netif_rx(ifp, skb);
++}
++
+ static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
+ 			    struct brcmf_if **ifp)
+ {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -121,6 +121,7 @@ struct brcmf_pub {
+ 
+ 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
+ 	s32 if2bss[BRCMF_MAX_IFS];
++	struct brcmf_if *mon_if;
+ 
+ 	struct mutex proto_block;
+ 	unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
+@@ -216,6 +217,7 @@ void brcmf_txflowblock_if(struct brcmf_i
+ 			  enum brcmf_netif_stop_reason reason, bool state);
+ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
++void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb);
+ void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
+ int __init brcmf_core_init(void);
+ void __exit brcmf_core_exit(void);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -69,6 +69,8 @@
+ #define BRCMF_MSGBUF_MAX_EVENTBUF_POST		8
+ 
+ #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3	0x01
++#define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11	0x02
++#define BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK	0x07
+ #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT	5
+ 
+ #define BRCMF_MSGBUF_TX_FLUSH_CNT1		32
+@@ -1128,6 +1130,7 @@ brcmf_msgbuf_process_rx_complete(struct
+ 	struct sk_buff *skb;
+ 	u16 data_offset;
+ 	u16 buflen;
++	u16 flags;
+ 	u32 idx;
+ 	struct brcmf_if *ifp;
+ 
+@@ -1137,6 +1140,7 @@ brcmf_msgbuf_process_rx_complete(struct
+ 	data_offset = le16_to_cpu(rx_complete->data_offset);
+ 	buflen = le16_to_cpu(rx_complete->data_len);
+ 	idx = le32_to_cpu(rx_complete->msg.request_id);
++	flags = le16_to_cpu(rx_complete->flags);
+ 
+ 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
+ 				     msgbuf->rx_pktids, idx);
+@@ -1150,6 +1154,20 @@ brcmf_msgbuf_process_rx_complete(struct
+ 
+ 	skb_trim(skb, buflen);
+ 
++	if ((flags & BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK) ==
++	    BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11) {
++		ifp = msgbuf->drvr->mon_if;
++
++		if (!ifp) {
++			brcmf_err("Received unexpected monitor pkt\n");
++			brcmu_pkt_buf_free_skb(skb);
++			return;
++		}
++
++		brcmf_netif_mon_rx(ifp, skb);
++		return;
++	}
++
+ 	ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
+ 	if (!ifp || !ifp->ndev) {
+ 		brcmf_err("Received pkt for invalid ifidx %d\n",
diff --git a/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch b/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
new file mode 100644
index 0000000000..050370de46
--- /dev/null
+++ b/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
@@ -0,0 +1,60 @@
+From 4b4a8d808c58fc0defc32a26b2fea35d66692c45 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 28 Jun 2018 08:16:13 +0200
+Subject: [PATCH] brcmfmac: define more bits for the flags of struct
+ brcmf_sta_info_le
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+That struct is passed by a firmware when querying for STA info. Flags
+are used to indicate what info could be obtained.
+
+These new defines may allow passing more info to the cfg80211 in the
+future. They had been obtained from Broadcom's SDK file wlioctl_defs.h
+used by DD-WRT.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 29 ++++++++++++++++++----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -32,11 +32,30 @@
+ #define	BRCMF_BSS_INFO_VERSION	109 /* curr ver of brcmf_bss_info_le struct */
+ #define BRCMF_BSS_RSSI_ON_CHANNEL	0x0002
+ 
+-#define BRCMF_STA_WME              0x00000002      /* WMM association */
+-#define BRCMF_STA_AUTHE            0x00000008      /* Authenticated */
+-#define BRCMF_STA_ASSOC            0x00000010      /* Associated */
+-#define BRCMF_STA_AUTHO            0x00000020      /* Authorized */
+-#define BRCMF_STA_SCBSTATS         0x00004000      /* Per STA debug stats */
++#define BRCMF_STA_BRCM			0x00000001	/* Running a Broadcom driver */
++#define BRCMF_STA_WME			0x00000002	/* WMM association */
++#define BRCMF_STA_NONERP		0x00000004	/* No ERP */
++#define BRCMF_STA_AUTHE			0x00000008	/* Authenticated */
++#define BRCMF_STA_ASSOC			0x00000010	/* Associated */
++#define BRCMF_STA_AUTHO			0x00000020	/* Authorized */
++#define BRCMF_STA_WDS			0x00000040	/* Wireless Distribution System */
++#define BRCMF_STA_WDS_LINKUP		0x00000080	/* WDS traffic/probes flowing properly */
++#define BRCMF_STA_PS			0x00000100	/* STA is in power save mode from AP's viewpoint */
++#define BRCMF_STA_APSD_BE		0x00000200	/* APSD delv/trigger for AC_BE is default enabled */
++#define BRCMF_STA_APSD_BK		0x00000400	/* APSD delv/trigger for AC_BK is default enabled */
++#define BRCMF_STA_APSD_VI		0x00000800	/* APSD delv/trigger for AC_VI is default enabled */
++#define BRCMF_STA_APSD_VO		0x00001000	/* APSD delv/trigger for AC_VO is default enabled */
++#define BRCMF_STA_N_CAP			0x00002000	/* STA 802.11n capable */
++#define BRCMF_STA_SCBSTATS		0x00004000	/* Per STA debug stats */
++#define BRCMF_STA_AMPDU_CAP		0x00008000	/* STA AMPDU capable */
++#define BRCMF_STA_AMSDU_CAP		0x00010000	/* STA AMSDU capable */
++#define BRCMF_STA_MIMO_PS		0x00020000	/* mimo ps mode is enabled */
++#define BRCMF_STA_MIMO_RTS		0x00040000	/* send rts in mimo ps mode */
++#define BRCMF_STA_RIFS_CAP		0x00080000	/* rifs enabled */
++#define BRCMF_STA_VHT_CAP		0x00100000	/* STA VHT(11ac) capable */
++#define BRCMF_STA_WPS			0x00200000	/* WPS state */
++#define BRCMF_STA_DWDS_CAP		0x01000000	/* DWDS CAP */
++#define BRCMF_STA_DWDS			0x02000000	/* DWDS active */
+ 
+ /* size of brcmf_scan_params not including variable length array */
+ #define BRCMF_SCAN_PARAMS_FIXED_SIZE	64
diff --git a/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch b/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
new file mode 100644
index 0000000000..e0fd8d9ea5
--- /dev/null
+++ b/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
@@ -0,0 +1,75 @@
+From 07b1ae46874949252625c96f309f96ca0f337020 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 28 Jun 2018 12:36:23 +0200
+Subject: [PATCH] brcmfmac: update STA info struct to the v5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+That struct is used when querying firmware for the STA. It seem is has
+been changing during the time. Luckily its format seems to be backward
+compatible starting with v2 (the only breakage was v1 -> v2).
+
+The version that was supported by brcmfmac so far was v4. It was what
+43602a1 and 4366b1 firmwares (7.35.177.56 and 10.10.69.3309 accordingly)
+were using. It also seems to be used by early 4366c0 firmwares
+(10.10.69.6908 and 10.10.69.69017).
+
+The problem appears when switching to the 10.10.122.20 firmware. It uses
+v5 and instead of falling back to v4 when submitted buffer isn't big
+enough it fallbacks to the v3.
+
+To receive all v4 specific info with the newest firmware we have to
+submit a struct (buffer) that matches v5.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h  | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -174,6 +174,8 @@
+ #define BRCMF_MFP_CAPABLE		1
+ #define BRCMF_MFP_REQUIRED		2
+ 
++#define BRCMF_VHT_CAP_MCS_MAP_NSS_MAX	8
++
+ /* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
+  * ioctl. It is relatively small because firmware has small maximum size input
+  * playload restriction for ioctls.
+@@ -550,6 +552,8 @@ struct brcmf_sta_info_le {
+ 						/* w/hi bit set if basic */
+ 	__le32 in;		/* seconds elapsed since associated */
+ 	__le32 listen_interval_inms; /* Min Listen interval in ms for STA */
++
++	/* Fields valid for ver >= 3 */
+ 	__le32 tx_pkts;	/* # of packets transmitted */
+ 	__le32 tx_failures;	/* # of packets failed */
+ 	__le32 rx_ucast_pkts;	/* # of unicast packets received */
+@@ -558,6 +562,8 @@ struct brcmf_sta_info_le {
+ 	__le32 rx_rate;	/* Rate of last successful rx frame */
+ 	__le32 rx_decrypt_succeeds;	/* # of packet decrypted successfully */
+ 	__le32 rx_decrypt_failures;	/* # of packet decrypted failed */
++
++	/* Fields valid for ver >= 4 */
+ 	__le32 tx_tot_pkts;    /* # of tx pkts (ucast + mcast) */
+ 	__le32 rx_tot_pkts;    /* # of data packets recvd (uni + mcast) */
+ 	__le32 tx_mcast_pkts;  /* # of mcast pkts txed */
+@@ -594,6 +600,14 @@ struct brcmf_sta_info_le {
+ 						*/
+ 	__le32 rx_pkts_retried;        /* # rx with retry bit set */
+ 	__le32 tx_rate_fallback;       /* lowest fallback TX rate */
++
++	/* Fields valid for ver >= 5 */
++	struct {
++		__le32 count;					/* # rates in this set */
++		u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
++		u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
++		__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
++	} rateset_adv;
+ };
+ 
+ struct brcmf_chanspec_list {
diff --git a/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch b/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
new file mode 100644
index 0000000000..6ebcdfdf29
--- /dev/null
+++ b/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
@@ -0,0 +1,84 @@
+From 1e591c56a65fbbcd5754a4210a0ef0402d5e5f33 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 9 Jul 2018 06:55:43 +0200
+Subject: [PATCH] brcmfmac: specify some features per firmware version
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some features supported by firmware aren't advertised and there is no
+way for a driver to query them. This includes e.g. monitor mode details.
+
+Most firmwares support monitor interface but only the latest ones
+/announce/ it with a "monitor" flag in the "cap" iovar. There isn't any
+reliable detection method for older firmwares (BRCMF_C_MONITOR was tried
+but "it only indicates the core part of the stack supports").
+
+Similarly support for tagging monitor frames and building radiotap
+headers can't be reliably detected for all firmwares.
+
+This commit adds table that allows mapping features to firmware version.
+It adds mappings for 43602a1 and 4366b1 firmwares from
+linux-firmware.git. Both were confirmed to be passing monitor frames.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 38 ++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -93,6 +93,42 @@ static int brcmf_feat_debugfs_read(struc
+ }
+ #endif /* DEBUG */
+ 
++struct brcmf_feat_fwfeat {
++	const char * const fwid;
++	u32 feat_flags;
++};
++
++static const struct brcmf_feat_fwfeat brcmf_feat_fwfeat_map[] = {
++	/* brcmfmac43602-pcie.ap.bin from linux-firmware.git commit ea1178515b88 */
++	{ "01-6cb8e269", BIT(BRCMF_FEAT_MONITOR) },
++	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 52442afee990 */
++	{ "01-c47a91a4", BIT(BRCMF_FEAT_MONITOR) },
++};
++
++static void brcmf_feat_firmware_overrides(struct brcmf_pub *drv)
++{
++	const struct brcmf_feat_fwfeat *e;
++	u32 feat_flags = 0;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(brcmf_feat_fwfeat_map); i++) {
++		e = &brcmf_feat_fwfeat_map[i];
++		if (!strcmp(e->fwid, drv->fwver)) {
++			feat_flags = e->feat_flags;
++			break;
++		}
++	}
++
++	if (!feat_flags)
++		return;
++
++	for (i = 0; i < BRCMF_FEAT_LAST; i++)
++		if (feat_flags & BIT(i))
++			brcmf_dbg(INFO, "enabling firmware feature: %s\n",
++				  brcmf_feat_names[i]);
++	drv->feat_flags |= feat_flags;
++}
++
+ /**
+  * brcmf_feat_iovar_int_get() - determine feature through iovar query.
+  *
+@@ -253,6 +289,8 @@ void brcmf_feat_attach(struct brcmf_pub
+ 	}
+ 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa");
+ 
++	brcmf_feat_firmware_overrides(drvr);
++
+ 	/* set chip related quirks */
+ 	switch (drvr->bus_if->chip) {
+ 	case BRCM_CC_43236_CHIP_ID:
diff --git a/package/kernel/mac80211/patches/342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch b/package/kernel/mac80211/patches/342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
new file mode 100644
index 0000000000..d0d9b20373
--- /dev/null
+++ b/package/kernel/mac80211/patches/342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
@@ -0,0 +1,25 @@
+From 2fef681a4cf7994c882190fd2417b95f30510afb Mon Sep 17 00:00:00 2001
+From: Jia-Shyr Chuang <saint.chuang@cypress.com>
+Date: Wed, 15 Aug 2018 04:23:09 -0500
+Subject: [PATCH] brcmfmac: add CYW89342 mini-PCIe device
+
+CYW89342 is a 2x2 MIMO, 802.11a/b/g/n/ac for WLAN. It is a member of
+4355/4359 family.
+
+Signed-off-by: Jia-Shyr Chuang <saint.chuang@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2017,6 +2017,7 @@ static const struct dev_pm_ops brcmf_pci
+ 
+ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
++	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
diff --git a/package/kernel/mac80211/patches/344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch b/package/kernel/mac80211/patches/344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch
new file mode 100644
index 0000000000..8267b37864
--- /dev/null
+++ b/package/kernel/mac80211/patches/344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch
@@ -0,0 +1,38 @@
+From cb18e2e9ec71d42409a51b83546686c609780dde Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Wed, 22 Aug 2018 15:22:15 +0200
+Subject: [PATCH] brcmfmac: fix wrong strnchr usage
+
+strnchr takes arguments in the order of its name: string, max bytes to
+read, character to search for. Here we're passing '\n' aka 10 as the
+buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka
+256 (aka '\0', since it's implicitly converted to char) within those 10
+bytes.
+
+Just interchanging the last two arguments would still leave a bug,
+because if we've been successful once, there are not sizeof(buf)
+characters left after the new value of p.
+
+Since clmver is immediately afterwards passed as a %s argument, I assume
+that it is actually a properly nul-terminated string. For that case, we
+have strreplace().
+
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		/* Replace all newline/linefeed characters with space
+ 		 * character
+ 		 */
+-		ptr = clmver;
+-		while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
+-			*ptr = ' ';
++		strreplace(clmver, '\n', ' ');
+ 
+ 		brcmf_dbg(INFO, "CLM version = %s\n", clmver);
+ 	}
diff --git a/package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch b/package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
new file mode 100644
index 0000000000..6e96578990
--- /dev/null
+++ b/package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
@@ -0,0 +1,117 @@
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 5 Sep 2018 09:48:58 +0200
+Subject: [PATCH] brcmfmac: fix for proper support of 160MHz bandwidth
+
+Decoding of firmware channel information was not complete for 160MHz
+support. This resulted in the following warning:
+
+  WARNING: CPU: 2 PID: 2222 at .../broadcom/brcm80211/brcmutil/d11.c:196
+	brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
+  Modules linked in: brcmfmac(O) brcmutil(O) sha256_generic cfg80211 ...
+  CPU: 2 PID: 2222 Comm: kworker/2:0 Tainted: G           O
+  4.17.0-wt-testing-x64-00002-gf1bed50 #1
+  Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
+  Workqueue: events request_firmware_work_func
+  RIP: 0010:brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
+  RSP: 0018:ffffc90000047bd0 EFLAGS: 00010206
+  RAX: 000000000000e832 RBX: ffff8801146fe910 RCX: ffff8801146fd3c0
+  RDX: 0000000000002800 RSI: 0000000000000070 RDI: ffffc90000047c30
+  RBP: ffffc90000047bd0 R08: 0000000000000000 R09: ffffffffa0798c80
+  R10: ffff88012bca55e0 R11: ffff880110a4ea00 R12: ffff8801146f8000
+  R13: ffffc90000047c30 R14: ffff8801146fe930 R15: ffff8801138e02e0
+  FS:  0000000000000000(0000) GS:ffff88012bc80000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 00007f18ce8b8070 CR3: 000000000200a003 CR4: 00000000000206e0
+  Call Trace:
+   brcmf_setup_wiphybands+0x212/0x780 [brcmfmac]
+   brcmf_cfg80211_attach+0xae2/0x11a0 [brcmfmac]
+   brcmf_attach+0x1fc/0x4b0 [brcmfmac]
+   ? __kmalloc+0x13c/0x1c0
+   brcmf_pcie_setup+0x99b/0xe00 [brcmfmac]
+   brcmf_fw_request_done+0x16a/0x1f0 [brcmfmac]
+   request_firmware_work_func+0x36/0x60
+   process_one_work+0x146/0x350
+   worker_thread+0x4a/0x3b0
+   kthread+0x102/0x140
+   ? process_one_work+0x350/0x350
+   ? kthread_bind+0x20/0x20
+   ret_from_fork+0x35/0x40
+  Code: 66 90 0f b7 07 55 48 89 e5 89 c2 88 47 02 88 47 03 66 81 e2 00 38
+	66 81 fa 00 18 74 6e 66 81 fa 00 20 74 39 66 81 fa 00 10 74 14 <0f>
+	0b 66 25 00 c0 74 20 66 3d 00 c0 75 20 c6 47 04 01 5d c3 66
+  ---[ end trace 550c46682415b26d ]---
+  brcmfmac: brcmf_construct_chaninfo: Ignoring unexpected firmware channel 50
+
+This patch adds the missing stuff to properly handle this.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+---
+ .../net/wireless/broadcom/brcm80211/brcmutil/d11.c | 34 +++++++++++++++++++++-
+ .../broadcom/brcm80211/include/brcmu_wifi.h        |  2 ++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw b
+ 		return BRCMU_CHSPEC_D11AC_BW_40;
+ 	case BRCMU_CHAN_BW_80:
+ 		return BRCMU_CHSPEC_D11AC_BW_80;
++	case BRCMU_CHAN_BW_160:
++		return BRCMU_CHSPEC_D11AC_BW_160;
+ 	default:
+ 		WARN_ON(1);
+ 	}
+@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct
+ 			break;
+ 		}
+ 		break;
+-	case BRCMU_CHSPEC_D11AC_BW_8080:
+ 	case BRCMU_CHSPEC_D11AC_BW_160:
++		switch (ch->sb) {
++		case BRCMU_CHAN_SB_LLL:
++			ch->control_ch_num -= CH_70MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_LLU:
++			ch->control_ch_num -= CH_50MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_LUL:
++			ch->control_ch_num -= CH_30MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_LUU:
++			ch->control_ch_num -= CH_10MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_ULL:
++			ch->control_ch_num += CH_10MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_ULU:
++			ch->control_ch_num += CH_30MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_UUL:
++			ch->control_ch_num += CH_50MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_UUU:
++			ch->control_ch_num += CH_70MHZ_APART;
++			break;
++		default:
++			WARN_ON_ONCE(1);
++			break;
++		}
++		break;
++	case BRCMU_CHSPEC_D11AC_BW_8080:
+ 	default:
+ 		WARN_ON_ONCE(1);
+ 		break;
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+@@ -29,6 +29,8 @@
+ #define CH_UPPER_SB			0x01
+ #define CH_LOWER_SB			0x02
+ #define CH_EWA_VALID			0x04
++#define CH_70MHZ_APART			14
++#define CH_50MHZ_APART			10
+ #define CH_30MHZ_APART			6
+ #define CH_20MHZ_APART			4
+ #define CH_10MHZ_APART			2
diff --git a/package/kernel/mac80211/patches/345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch b/package/kernel/mac80211/patches/345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
new file mode 100644
index 0000000000..11fb4bce45
--- /dev/null
+++ b/package/kernel/mac80211/patches/345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
@@ -0,0 +1,28 @@
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 5 Sep 2018 09:48:59 +0200
+Subject: [PATCH] brcmfmac: increase buffer for obtaining firmware capabilities
+
+When obtaining the firmware capability a buffer is provided of 512
+bytes. However, if all features in firmware are supported the buffer
+needs to be 565 bytes as otherwise truncated information is retrieved
+from firmware. Increasing the buffer to 768 bytes on stack.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -178,7 +178,7 @@ static void brcmf_feat_iovar_data_set(st
+ 	ifp->fwil_fwerr = false;
+ }
+ 
+-#define MAX_CAPS_BUFFER_SIZE	512
++#define MAX_CAPS_BUFFER_SIZE	768
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
+ 	char caps[MAX_CAPS_BUFFER_SIZE];
diff --git a/package/kernel/mac80211/patches/346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch b/package/kernel/mac80211/patches/346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch
new file mode 100644
index 0000000000..192ed1a770
--- /dev/null
+++ b/package/kernel/mac80211/patches/346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch
@@ -0,0 +1,57 @@
+From a8254fa4ba60b85829b6e5ede6564f81cd70d59f Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 11 Sep 2018 11:24:04 +0800
+Subject: [PATCH] brcmfmac: remove set but not used variables 'sfdoff' and
+ 'pad_size'
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c: In function 'brcmf_sdio_rxglom':
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1466:11: warning:
+ variable 'sfdoff' set but not used [-Wunused-but-set-variable]
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c: In function 'brcmf_sdio_bus_preinit':
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:3408:7: warning:
+ variable 'pad_size' set but not used [-Wunused-but-set-variable]
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1463,7 +1463,7 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 	struct sk_buff *pfirst, *pnext;
+ 
+ 	int errcode;
+-	u8 doff, sfdoff;
++	u8 doff;
+ 
+ 	struct brcmf_sdio_hdrinfo rd_new;
+ 
+@@ -1597,7 +1597,6 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		/* Remove superframe header, remember offset */
+ 		skb_pull(pfirst, rd_new.dat_offset);
+-		sfdoff = rd_new.dat_offset;
+ 		num = 0;
+ 
+ 		/* Validate all the subframe headers */
+@@ -3405,7 +3404,6 @@ static int brcmf_sdio_bus_preinit(struct
+ 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ 	struct brcmf_sdio *bus = sdiodev->bus;
+ 	struct brcmf_core *core = bus->sdio_core;
+-	uint pad_size;
+ 	u32 value;
+ 	int err;
+ 
+@@ -3448,7 +3446,6 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (sdiodev->sg_support) {
+ 		bus->txglom = false;
+ 		value = 1;
+-		pad_size = bus->sdiodev->func2->cur_blksize << 1;
+ 		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
+ 					   &value, sizeof(u32));
+ 		if (err < 0) {
diff --git a/package/kernel/mac80211/patches/347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch b/package/kernel/mac80211/patches/347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch
new file mode 100644
index 0000000000..a71c1aee03
--- /dev/null
+++ b/package/kernel/mac80211/patches/347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch
@@ -0,0 +1,67 @@
+From edb6d6885bef82d1eac432dbeca9fbf4ec349d7e Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Thu, 27 Sep 2018 14:59:44 +0000
+Subject: [PATCH] brcmfmac: reduce timeout for action frame scan
+
+Finding a common channel to send an action frame out is required for
+some action types. Since a loop with several scan retry is used to find
+the channel, a short wait time could be considered for each attempt.
+This patch reduces the wait time from 1500 to 450 msec for each action
+frame scan.
+
+This patch fixes the WFA p2p certification 5.1.20 failure caused by the
+long action frame send time.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -74,7 +74,7 @@
+ #define P2P_AF_MAX_WAIT_TIME		msecs_to_jiffies(2000)
+ #define P2P_INVALID_CHANNEL		-1
+ #define P2P_CHANNEL_SYNC_RETRY		5
+-#define P2P_AF_FRM_SCAN_MAX_WAIT	msecs_to_jiffies(1500)
++#define P2P_AF_FRM_SCAN_MAX_WAIT	msecs_to_jiffies(450)
+ #define P2P_DEFAULT_SLEEP_TIME_VSDB	200
+ 
+ /* WiFi P2P Public Action Frame OUI Subtypes */
+@@ -1134,7 +1134,6 @@ static s32 brcmf_p2p_af_searching_channe
+ {
+ 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+ 	struct brcmf_cfg80211_vif *pri_vif;
+-	unsigned long duration;
+ 	s32 retry;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+@@ -1150,7 +1149,6 @@ static s32 brcmf_p2p_af_searching_channe
+ 	 * pending action frame tx is cancelled.
+ 	 */
+ 	retry = 0;
+-	duration = msecs_to_jiffies(P2P_AF_FRM_SCAN_MAX_WAIT);
+ 	while ((retry < P2P_CHANNEL_SYNC_RETRY) &&
+ 	       (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)) {
+ 		afx_hdl->is_listen = false;
+@@ -1158,7 +1156,8 @@ static s32 brcmf_p2p_af_searching_channe
+ 			  retry);
+ 		/* search peer on peer's listen channel */
+ 		schedule_work(&afx_hdl->afx_work);
+-		wait_for_completion_timeout(&afx_hdl->act_frm_scan, duration);
++		wait_for_completion_timeout(&afx_hdl->act_frm_scan,
++					    P2P_AF_FRM_SCAN_MAX_WAIT);
+ 		if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+ 		    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+ 			       &p2p->status)))
+@@ -1171,7 +1170,7 @@ static s32 brcmf_p2p_af_searching_channe
+ 			afx_hdl->is_listen = true;
+ 			schedule_work(&afx_hdl->afx_work);
+ 			wait_for_completion_timeout(&afx_hdl->act_frm_scan,
+-						    duration);
++						    P2P_AF_FRM_SCAN_MAX_WAIT);
+ 		}
+ 		if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+ 		    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
diff --git a/package/kernel/mac80211/patches/347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch b/package/kernel/mac80211/patches/347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
new file mode 100644
index 0000000000..ef2d0934fc
--- /dev/null
+++ b/package/kernel/mac80211/patches/347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
@@ -0,0 +1,79 @@
+From fbf07000960d9c8a13fdc17c6de0230d681c7543 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Thu, 27 Sep 2018 14:59:49 +0000
+Subject: [PATCH] brcmfmac: fix full timeout waiting for action frame
+ on-channel tx
+
+The driver sends an action frame down and waits for a completion signal
+triggered by the received BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE event
+to continue the process. However, the action frame could be transmitted
+either on the current channel or on an off channel. For the on-channel
+case, only BRCMF_E_ACTION_FRAME_COMPLETE event will be received when
+the frame is transmitted, which make the driver always wait a full
+timeout duration. This patch has the completion signal be triggered by
+receiving the BRCMF_E_ACTION_FRAME_COMPLETE event for the on-channel
+case.
+
+This change fixes WFA p2p certification 5.1.19 failure.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 17 +++++++++++++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h |  2 ++
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -1457,10 +1457,12 @@ int brcmf_p2p_notify_action_tx_complete(
+ 		return 0;
+ 
+ 	if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) {
+-		if (e->status == BRCMF_E_STATUS_SUCCESS)
++		if (e->status == BRCMF_E_STATUS_SUCCESS) {
+ 			set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
+ 				&p2p->status);
+-		else {
++			if (!p2p->wait_for_offchan_complete)
++				complete(&p2p->send_af_done);
++		} else {
+ 			set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+ 			/* If there is no ack, we don't need to wait for
+ 			 * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event
+@@ -1511,6 +1513,17 @@ static s32 brcmf_p2p_tx_action_frame(str
+ 	p2p->af_sent_channel = le32_to_cpu(af_params->channel);
+ 	p2p->af_tx_sent_jiffies = jiffies;
+ 
++	if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) &&
++	    p2p->af_sent_channel ==
++	    ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq))
++		p2p->wait_for_offchan_complete = false;
++	else
++		p2p->wait_for_offchan_complete = true;
++
++	brcmf_dbg(TRACE, "Waiting for %s tx completion event\n",
++		  (p2p->wait_for_offchan_complete) ?
++		   "off-channel" : "on-channel");
++
+ 	timeout = wait_for_completion_timeout(&p2p->send_af_done,
+ 					      P2P_AF_MAX_WAIT_TIME);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+@@ -124,6 +124,7 @@ struct afx_hdl {
+  * @gon_req_action: about to send go negotiation requets frame.
+  * @block_gon_req_tx: drop tx go negotiation requets frame.
+  * @p2pdev_dynamically: is p2p device if created by module param or supplicant.
++ * @wait_for_offchan_complete: wait for off-channel tx completion event.
+  */
+ struct brcmf_p2p_info {
+ 	struct brcmf_cfg80211_info *cfg;
+@@ -144,6 +145,7 @@ struct brcmf_p2p_info {
+ 	bool gon_req_action;
+ 	bool block_gon_req_tx;
+ 	bool p2pdev_dynamically;
++	bool wait_for_offchan_complete;
+ };
+ 
+ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced);
diff --git a/package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch b/package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
new file mode 100644
index 0000000000..154664c854
--- /dev/null
+++ b/package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
@@ -0,0 +1,41 @@
+From 3401d42c7ea2d064d15c66698ff8eb96553179ce Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 26 Oct 2018 12:50:39 +0200
+Subject: [PATCH] brcmutil: really fix decoding channel info for 160 MHz
+ bandwidth
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Previous commit /adding/ support for 160 MHz chanspecs was incomplete.
+It didn't set bandwidth info and didn't extract control channel info. As
+the result it was also using uninitialized "sb" var.
+
+This change has been tested for two chanspecs found to be reported by
+some devices/firmwares:
+1) 60/160 (0xee32)
+   Before: chnum:50 control_ch_num:36
+    After: chnum:50 control_ch_num:60
+2) 120/160 (0xed72)
+   Before: chnum:114 control_ch_num:100
+    After: chnum:114 control_ch_num:120
+
+Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct
+ 		}
+ 		break;
+ 	case BRCMU_CHSPEC_D11AC_BW_160:
++		ch->bw = BRCMU_CHAN_BW_160;
++		ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
++					 BRCMU_CHSPEC_D11AC_SB_SHIFT);
+ 		switch (ch->sb) {
+ 		case BRCMU_CHAN_SB_LLL:
+ 			ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch b/package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch
new file mode 100644
index 0000000000..699ea6e481
--- /dev/null
+++ b/package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch
@@ -0,0 +1,34 @@
+From 8eefb59de817125eeedde2a2cc1e4ac3660062f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 8 Nov 2018 16:08:29 +0100
+Subject: [PATCH] brcmfmac: fix reporting support for 160 MHz channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Driver can report IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ so it's
+important to provide valid & complete info about supported bands for
+each channel. By default no support for 160 MHz should be assumed unless
+firmware reports it for a given channel later.
+
+This fixes info passed to the userspace. Without that change userspace
+could try to use invalid channel and fail to start an interface.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Cc: stable@vger.kernel.org
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5992,7 +5992,8 @@ static int brcmf_construct_chaninfo(stru
+ 			 * for subsequent chanspecs.
+ 			 */
+ 			channel->flags = IEEE80211_CHAN_NO_HT40 |
+-					 IEEE80211_CHAN_NO_80MHZ;
++					 IEEE80211_CHAN_NO_80MHZ |
++					 IEEE80211_CHAN_NO_160MHZ;
+ 			ch.bw = BRCMU_CHAN_BW_20;
+ 			cfg->d11inf.encchspec(&ch);
+ 			chaninfo = ch.chspec;
diff --git a/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
index cadbf6809c..a7bcfa549b 100644
--- a/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
+++ b/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1421,8 +1421,12 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1394,8 +1394,12 @@ static bool ath9k_hw_set_reset(struct at
  	if (!AR_SREV_9100(ah))
  		REG_WRITE(ah, AR_RC, 0);
  
diff --git a/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch b/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
rename to package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
index ac9e112f51..5eb69b898d 100644
--- a/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
+++ b/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1298,39 +1298,56 @@ void ath9k_hw_get_delta_slope_vals(struc
+@@ -1271,39 +1271,56 @@ void ath9k_hw_get_delta_slope_vals(struc
  	*coef_exponent = coef_exp - 16;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -1383,24 +1400,24 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1356,24 +1373,24 @@ static bool ath9k_hw_set_reset(struct at
  			rst_flags |= AR_RTC_RC_MAC_COLD;
  	}
  
diff --git a/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch b/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
new file mode 100644
index 0000000000..dfe9aae268
--- /dev/null
+++ b/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 11 Jul 2016 12:07:40 +0200
+Subject: [PATCH] ath9k_hw: set spectral scan enable bit on trigger for
+ AR9003+
+
+AR9002 code and QCA AR9003+ code do the same.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1800,6 +1800,8 @@ static void ar9003_hw_spectral_scan_conf
+ 
+ static void ar9003_hw_spectral_scan_trigger(struct ath_hw *ah)
+ {
++	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
++		    AR_PHY_SPECTRAL_SCAN_ENABLE);
+ 	/* Activate spectral scan */
+ 	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+ 		    AR_PHY_SPECTRAL_SCAN_ACTIVE);
diff --git a/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch b/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
new file mode 100644
index 0000000000..22f5154146
--- /dev/null
+++ b/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
@@ -0,0 +1,27 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 27 Dec 2016 23:16:23 +0100
+Subject: [PATCH] ath9k: don't run periodic and nf calibation at the same
+ time
+
+The checks already prevents periodic cal from being started while noise
+floor calibration runs. It is missing checks for the other way around.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+@@ -676,10 +676,10 @@ static int ar9002_hw_calibrate(struct at
+ 			return 0;
+ 
+ 		ah->cal_list_curr = currCal = currCal->calNext;
+-		if (currCal->calState == CAL_WAITING) {
++		if (currCal->calState == CAL_WAITING)
+ 			ath9k_hw_reset_calibration(ah, currCal);
+-			return 0;
+-		}
++
++		return 0;
+ 	}
+ 
+ 	/* Do NF cal only at longer intervals */
diff --git a/package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch b/package/kernel/mac80211/patches/355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
new file mode 100644
index 0000000000..eca15a516e
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
@@ -0,0 +1,102 @@
+From a1a3b762163868ad07a4499a73df324f40d5ab0b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:00:58 +0200
+Subject: [PATCH] brcmfmac: Remove firmware-loading code duplication
+
+brcmf_fw_request_next_item and brcmf_fw_request_done both have identical
+code to complete the fw-request depending on the item-type.
+
+This commit adds a new brcmf_fw_complete_request helper removing this code
+duplication.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 62 +++++++++++-----------
+ 1 file changed, 31 insertions(+), 31 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -504,6 +504,34 @@ fail:
+ 	return -ENOENT;
+ }
+ 
++static int brcmf_fw_complete_request(const struct firmware *fw,
++				     struct brcmf_fw *fwctx)
++{
++	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
++	int ret = 0;
++
++	brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
++
++	switch (cur->type) {
++	case BRCMF_FW_TYPE_NVRAM:
++		ret = brcmf_fw_request_nvram_done(fw, fwctx);
++		break;
++	case BRCMF_FW_TYPE_BINARY:
++		if (fw)
++			cur->binary = fw;
++		else
++			ret = -ENOENT;
++		break;
++	default:
++		/* something fishy here so bail out early */
++		brcmf_err("unknown fw type: %d\n", cur->type);
++		release_firmware(fw);
++		ret = -EINVAL;
++	}
++
++	return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
++}
++
+ static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
+ {
+ 	struct brcmf_fw_item *cur;
+@@ -525,15 +553,7 @@ static int brcmf_fw_request_next_item(st
+ 	if (ret < 0) {
+ 		brcmf_fw_request_done(NULL, fwctx);
+ 	} else if (!async && fw) {
+-		brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path,
+-			  fw ? "" : "not ");
+-		if (cur->type == BRCMF_FW_TYPE_BINARY)
+-			cur->binary = fw;
+-		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
+-			brcmf_fw_request_nvram_done(fw, fwctx);
+-		else
+-			release_firmware(fw);
+-
++		brcmf_fw_complete_request(fw, fwctx);
+ 		return -EAGAIN;
+ 	}
+ 	return 0;
+@@ -547,28 +567,8 @@ static void brcmf_fw_request_done(const
+ 
+ 	cur = &fwctx->req->items[fwctx->curpos];
+ 
+-	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
+-		  fw ? "" : "not ");
+-
+-	if (!fw)
+-		ret = -ENOENT;
+-
+-	switch (cur->type) {
+-	case BRCMF_FW_TYPE_NVRAM:
+-		ret = brcmf_fw_request_nvram_done(fw, fwctx);
+-		break;
+-	case BRCMF_FW_TYPE_BINARY:
+-		cur->binary = fw;
+-		break;
+-	default:
+-		/* something fishy here so bail out early */
+-		brcmf_err("unknown fw type: %d\n", cur->type);
+-		release_firmware(fw);
+-		ret = -EINVAL;
+-		goto fail;
+-	}
+-
+-	if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
++	ret = brcmf_fw_complete_request(fw, fwctx);
++	if (ret < 0)
+ 		goto fail;
+ 
+ 	do {
diff --git a/package/kernel/mac80211/patches/355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch b/package/kernel/mac80211/patches/355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch
new file mode 100644
index 0000000000..1a4a1ec348
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch
@@ -0,0 +1,127 @@
+From 5b587496dc63595b71265d986ce69728c2724370 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:00:59 +0200
+Subject: [PATCH] brcmfmac: Remove recursion from firmware load error handling
+
+Before this commit brcmf_fw_request_done would call
+brcmf_fw_request_next_item to load the next item, which on an error would
+call brcmf_fw_request_done, which if the error is recoverable (*) will
+then continue calling brcmf_fw_request_next_item for the next item again
+which on an error will call brcmf_fw_request_done again...
+
+This does not blow up because we only have a limited number of items so
+we never recurse too deep. But the recursion is still quite ugly and
+frankly is giving me a headache, so lets fix this.
+
+This commit fixes this by removing brcmf_fw_request_next_item and by
+making brcmf_fw_get_firmwares and brcmf_fw_request_done directly call
+firmware_request_nowait resp. firmware_request themselves.
+
+*) brcmf_fw_request_nvram_done fallback path succeeds or
+   BRCMF_FW_REQF_OPTIONAL is set
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 65 +++++++---------------
+ 1 file changed, 19 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -532,33 +532,6 @@ static int brcmf_fw_complete_request(con
+ 	return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
+ }
+ 
+-static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
+-{
+-	struct brcmf_fw_item *cur;
+-	const struct firmware *fw = NULL;
+-	int ret;
+-
+-	cur = &fwctx->req->items[fwctx->curpos];
+-
+-	brcmf_dbg(TRACE, "%srequest for %s\n", async ? "async " : "",
+-		  cur->path);
+-
+-	if (async)
+-		ret = request_firmware_nowait(THIS_MODULE, true, cur->path,
+-					      fwctx->dev, GFP_KERNEL, fwctx,
+-					      brcmf_fw_request_done);
+-	else
+-		ret = request_firmware(&fw, cur->path, fwctx->dev);
+-
+-	if (ret < 0) {
+-		brcmf_fw_request_done(NULL, fwctx);
+-	} else if (!async && fw) {
+-		brcmf_fw_complete_request(fw, fwctx);
+-		return -EAGAIN;
+-	}
+-	return 0;
+-}
+-
+ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
+@@ -568,26 +541,19 @@ static void brcmf_fw_request_done(const
+ 	cur = &fwctx->req->items[fwctx->curpos];
+ 
+ 	ret = brcmf_fw_complete_request(fw, fwctx);
+-	if (ret < 0)
+-		goto fail;
+ 
+-	do {
+-		if (++fwctx->curpos == fwctx->req->n_items) {
+-			ret = 0;
+-			goto done;
+-		}
+-
+-		ret = brcmf_fw_request_next_item(fwctx, false);
+-	} while (ret == -EAGAIN);
+-
+-	return;
+-
+-fail:
+-	brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
+-		  dev_name(fwctx->dev), cur->path);
+-	brcmf_fw_free_request(fwctx->req);
+-	fwctx->req = NULL;
+-done:
++	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
++		cur = &fwctx->req->items[fwctx->curpos];
++		request_firmware(&fw, cur->path, fwctx->dev);
++		ret = brcmf_fw_complete_request(fw, ctx);
++	}
++
++	if (ret) {
++		brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
++			  dev_name(fwctx->dev), cur->path);
++		brcmf_fw_free_request(fwctx->req);
++		fwctx->req = NULL;
++	}
+ 	fwctx->done(fwctx->dev, ret, fwctx->req);
+ 	kfree(fwctx);
+ }
+@@ -611,7 +577,9 @@ int brcmf_fw_get_firmwares(struct device
+ 			   void (*fw_cb)(struct device *dev, int err,
+ 					 struct brcmf_fw_request *req))
+ {
++	struct brcmf_fw_item *first = &req->items[0];
+ 	struct brcmf_fw *fwctx;
++	int ret;
+ 
+ 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
+ 	if (!fw_cb)
+@@ -628,7 +596,12 @@ int brcmf_fw_get_firmwares(struct device
+ 	fwctx->req = req;
+ 	fwctx->done = fw_cb;
+ 
+-	brcmf_fw_request_next_item(fwctx, true);
++	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
++				      fwctx->dev, GFP_KERNEL, fwctx,
++				      brcmf_fw_request_done);
++	if (ret < 0)
++		brcmf_fw_request_done(NULL, fwctx);
++
+ 	return 0;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch b/package/kernel/mac80211/patches/355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch
new file mode 100644
index 0000000000..727dcbe85a
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch
@@ -0,0 +1,77 @@
+From eae8e50669e15002b195177212a6e25afbe7cf4d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:01:00 +0200
+Subject: [PATCH] brcmfmac: Add support for first trying to get a board
+ specific nvram file
+
+The nvram files which some brcmfmac chips need are board-specific. To be
+able to distribute these as part of linux-firmware, so that devices with
+such a wifi chip will work OOTB, multiple (one per board) versions must
+co-exist under /lib/firmware.
+
+This commit adds support for callers of the brcmfmac/firmware.c code to
+pass in a board_type parameter through the request structure.
+
+If that parameter is set then the code will first try to load
+chipmodel.board_type.txt before falling back to the old chipmodel.txt name.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 27 +++++++++++++++++++++-
+ .../broadcom/brcm80211/brcmfmac/firmware.h         |  1 +
+ 2 files changed, 27 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -532,6 +532,31 @@ static int brcmf_fw_complete_request(con
+ 	return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
+ }
+ 
++static int brcmf_fw_request_firmware(const struct firmware **fw,
++				     struct brcmf_fw *fwctx)
++{
++	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
++	int ret;
++
++	/* nvram files are board-specific, first try a board-specific path */
++	if (cur->type == BRCMF_FW_TYPE_NVRAM && fwctx->req->board_type) {
++		char alt_path[BRCMF_FW_NAME_LEN];
++
++		strlcpy(alt_path, cur->path, BRCMF_FW_NAME_LEN);
++		/* strip .txt at the end */
++		alt_path[strlen(alt_path) - 4] = 0;
++		strlcat(alt_path, ".", BRCMF_FW_NAME_LEN);
++		strlcat(alt_path, fwctx->req->board_type, BRCMF_FW_NAME_LEN);
++		strlcat(alt_path, ".txt", BRCMF_FW_NAME_LEN);
++
++		ret = request_firmware(fw, alt_path, fwctx->dev);
++		if (ret == 0)
++			return ret;
++	}
++
++	return request_firmware(fw, cur->path, fwctx->dev);
++}
++
+ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
+@@ -544,7 +569,7 @@ static void brcmf_fw_request_done(const
+ 
+ 	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
+ 		cur = &fwctx->req->items[fwctx->curpos];
+-		request_firmware(&fw, cur->path, fwctx->dev);
++		brcmf_fw_request_firmware(&fw, fwctx);
+ 		ret = brcmf_fw_complete_request(fw, ctx);
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+@@ -70,6 +70,7 @@ struct brcmf_fw_request {
+ 	u16 domain_nr;
+ 	u16 bus_nr;
+ 	u32 n_items;
++	const char *board_type;
+ 	struct brcmf_fw_item items[0];
+ };
+ 
diff --git a/package/kernel/mac80211/patches/355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch b/package/kernel/mac80211/patches/355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch
new file mode 100644
index 0000000000..a33ceaa21e
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch
@@ -0,0 +1,77 @@
+From 0ad4b55b2f29784f93875e6231bf57cd233624a2 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:01:01 +0200
+Subject: [PATCH] brcmfmac: Set board_type used for nvram file selection to
+ machine-compatible
+
+For of/devicetree using machines, set the board_type used for nvram file
+selection to the first string listed in the top-level's node compatible
+string, aka the machine-compatible as used by of_machine_is_compatible().
+
+The board_type setting is used to load the board-specific nvram file with
+a board-specific name so that we can ship files for each supported board
+in linux-firmware.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h |  1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c     | 11 ++++++++++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c   |  1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   |  1 +
+ 4 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -59,6 +59,7 @@ struct brcmf_mp_device {
+ 	bool		iapp;
+ 	bool		ignore_probe_fail;
+ 	struct brcmfmac_pd_cc *country_codes;
++	const char	*board_type;
+ 	union {
+ 		struct brcmfmac_sdio_pd sdio;
+ 	} bus;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+@@ -27,11 +27,20 @@ void brcmf_of_probe(struct device *dev,
+ 		    struct brcmf_mp_device *settings)
+ {
+ 	struct brcmfmac_sdio_pd *sdio = &settings->bus.sdio;
+-	struct device_node *np = dev->of_node;
++	struct device_node *root, *np = dev->of_node;
++	struct property *prop;
+ 	int irq;
+ 	u32 irqf;
+ 	u32 val;
+ 
++	/* Set board-type to the first string of the machine compatible prop */
++	root = of_find_node_by_path("/");
++	if (root) {
++		prop = of_find_property(root, "compatible", NULL);
++		settings->board_type = of_prop_next_string(prop, NULL);
++		of_node_put(root);
++	}
++
+ 	if (!np || bus_type != BRCMF_BUSTYPE_SDIO ||
+ 	    !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
+ 		return;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1785,6 +1785,7 @@ brcmf_pcie_prepare_fw_request(struct brc
+ 	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+ 	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
+ 	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
++	fwreq->board_type = devinfo->settings->board_type;
+ 	/* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
+ 	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
+ 	fwreq->bus_nr = devinfo->pdev->bus->number;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4174,6 +4174,7 @@ brcmf_sdio_prepare_fw_request(struct brc
+ 
+ 	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
+ 	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
++	fwreq->board_type = bus->sdiodev->settings->board_type;
+ 
+ 	return fwreq;
+ }
diff --git a/package/kernel/mac80211/patches/355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch b/package/kernel/mac80211/patches/355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch
new file mode 100644
index 0000000000..25426e3f10
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch
@@ -0,0 +1,179 @@
+From bd1e82bb420adf4ad7cd468d8a482cde622dd69d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:01:02 +0200
+Subject: [PATCH] brcmfmac: Set board_type from DMI on x86 based machines
+
+For x86 based machines, set the board_type used for nvram file selection
+based on the DMI sys-vendor and product-name strings.
+
+Since on some models these strings are too generic, this commit also adds
+a quirk table overriding the strings for models listed in that table.
+
+The board_type setting is used to load the board-specific nvram file with
+a board-specific name so that we can ship files for each supported board
+in linux-firmware.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/Makefile  |   2 +
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  |   3 +-
+ .../wireless/broadcom/brcm80211/brcmfmac/common.h  |   7 ++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 116 +++++++++++++++++++++
+ 4 files changed, 127 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
+@@ -54,3 +54,5 @@ brcmfmac-$(CPTCFG_BRCM_TRACING) += \
+ 		tracepoint.o
+ brcmfmac-$(CONFIG_OF) += \
+ 		of.o
++brcmfmac-$(CONFIG_DMI) += \
++		dmi.o
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -448,8 +448,9 @@ struct brcmf_mp_device *brcmf_get_module
+ 		}
+ 	}
+ 	if (!found) {
+-		/* No platform data for this device, try OF (Open Firwmare) */
++		/* No platform data for this device, try OF and DMI data */
+ 		brcmf_of_probe(dev, bus_type, settings);
++		brcmf_dmi_probe(settings, chip, chiprev);
+ 	}
+ 	return settings;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -75,4 +75,11 @@ void brcmf_release_module_param(struct b
+ /* Sets dongle media info (drv_version, mac address). */
+ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
+ 
++#ifdef CONFIG_DMI
++void brcmf_dmi_probe(struct brcmf_mp_device *settings, u32 chip, u32 chiprev);
++#else
++static inline void
++brcmf_dmi_probe(struct brcmf_mp_device *settings, u32 chip, u32 chiprev) {}
++#endif
++
+ #endif /* BRCMFMAC_COMMON_H */
+--- /dev/null
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -0,0 +1,116 @@
++/*
++ * Copyright 2018 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/dmi.h>
++#include <linux/mod_devicetable.h>
++#include "core.h"
++#include "common.h"
++#include "brcm_hw_ids.h"
++
++/* The DMI data never changes so we can use a static buf for this */
++static char dmi_board_type[128];
++
++struct brcmf_dmi_data {
++	u32 chip;
++	u32 chiprev;
++	const char *board_type;
++};
++
++/* NOTE: Please keep all entries sorted alphabetically */
++
++static const struct brcmf_dmi_data gpd_win_pocket_data = {
++	BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
++};
++
++static const struct brcmf_dmi_data jumper_ezpad_mini3_data = {
++	BRCM_CC_43430_CHIP_ID, 0, "jumper-ezpad-mini3"
++};
++
++static const struct brcmf_dmi_data meegopad_t08_data = {
++	BRCM_CC_43340_CHIP_ID, 2, "meegopad-t08"
++};
++
++static const struct dmi_system_id dmi_platform_data[] = {
++	{
++		/* Match for the GPDwin which unfortunately uses somewhat
++		 * generic dmi strings, which is why we test for 4 strings.
++		 * Comparing against 23 other byt/cht boards, board_vendor
++		 * and board_name are unique to the GPDwin, where as only one
++		 * other board has the same board_serial and 3 others have
++		 * the same default product_name. Also the GPDwin is the
++		 * only device to have both board_ and product_name not set.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++			DMI_MATCH(DMI_BOARD_NAME, "Default string"),
++			DMI_MATCH(DMI_BOARD_SERIAL, "Default string"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Default string"),
++		},
++		.driver_data = (void *)&gpd_win_pocket_data,
++	},
++	{
++		/* Jumper EZpad mini3 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"),
++			/* jumperx.T87.KFBNEEA02 with the version-nr dropped */
++			DMI_MATCH(DMI_BIOS_VERSION, "jumperx.T87.KFBNEEA"),
++		},
++		.driver_data = (void *)&jumper_ezpad_mini3_data,
++	},
++	{
++		/* Meegopad T08 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Default string"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Default string"),
++			DMI_MATCH(DMI_BOARD_NAME, "T3 MRD"),
++			DMI_MATCH(DMI_BOARD_VERSION, "V1.1"),
++		},
++		.driver_data = (void *)&meegopad_t08_data,
++	},
++	{}
++};
++
++void brcmf_dmi_probe(struct brcmf_mp_device *settings, u32 chip, u32 chiprev)
++{
++	const struct dmi_system_id *match;
++	const struct brcmf_dmi_data *data;
++	const char *sys_vendor;
++	const char *product_name;
++
++	/* Some models have DMI strings which are too generic, e.g.
++	 * "Default string", we use a quirk table for these.
++	 */
++	for (match = dmi_first_match(dmi_platform_data);
++	     match;
++	     match = dmi_first_match(match + 1)) {
++		data = match->driver_data;
++
++		if (data->chip == chip && data->chiprev == chiprev) {
++			settings->board_type = data->board_type;
++			return;
++		}
++	}
++
++	/* Not found in the quirk-table, use sys_vendor-product_name */
++	sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
++	product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
++	if (sys_vendor && product_name) {
++		snprintf(dmi_board_type, sizeof(dmi_board_type), "%s-%s",
++			 sys_vendor, product_name);
++		settings->board_type = dmi_board_type;
++	}
++}
diff --git a/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch b/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
new file mode 100644
index 0000000000..211e9e4a9f
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
@@ -0,0 +1,41 @@
+From 55e491edbf14b2da5419c2a319ea3b1d6368d9a2 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:01:03 +0200
+Subject: [PATCH] brcmfmac: Cleanup brcmf_fw_request_done()
+
+The "cur" variable is now only used for a debug print and we already
+print the same info from brcmf_fw_complete_request(), so the debug print
+does not provide any extra info and we can remove it.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -560,22 +560,16 @@ static int brcmf_fw_request_firmware(con
+ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
+-	struct brcmf_fw_item *cur;
+-	int ret = 0;
+-
+-	cur = &fwctx->req->items[fwctx->curpos];
++	int ret;
+ 
+ 	ret = brcmf_fw_complete_request(fw, fwctx);
+ 
+ 	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
+-		cur = &fwctx->req->items[fwctx->curpos];
+ 		brcmf_fw_request_firmware(&fw, fwctx);
+ 		ret = brcmf_fw_complete_request(fw, ctx);
+ 	}
+ 
+ 	if (ret) {
+-		brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
+-			  dev_name(fwctx->dev), cur->path);
+ 		brcmf_fw_free_request(fwctx->req);
+ 		fwctx->req = NULL;
+ 	}
diff --git a/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 82%
rename from package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 38b5c51302..35d07430eb 100644
--- a/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,17 +8,17 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2963,7 +2963,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2935,7 +2935,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
 -	int chan_pwr, new_pwr;
 +	int chan_pwr, new_pwr, max_gain;
 +	int ant_gain, ant_reduction = 0;
- 	u16 ctl = NO_CTL;
  
  	if (!chan)
-@@ -2975,9 +2976,14 @@ void ath9k_hw_apply_txpower(struct ath_h
+ 		return;
+@@ -2943,10 +2944,15 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
@@ -28,7 +28,8 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 +	if (ant_gain > max_gain)
 +		ant_reduction = ant_gain - max_gain;
  
- 	ah->eep_ops->set_txpower(ah, chan, ctl,
+ 	ah->eep_ops->set_txpower(ah, chan,
+ 				 ath9k_regd_get_ctl(reg, chan),
 -				 get_antenna_gain(ah, chan), new_pwr, test);
 +				 ant_reduction, new_pwr, test);
  }
diff --git a/package/kernel/mac80211/patches/subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
similarity index 78%
rename from package/kernel/mac80211/patches/subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
rename to package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
index e88163eb5d..83c613434d 100644
--- a/package/kernel/mac80211/patches/subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
+++ b/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
@@ -2,16 +2,16 @@ From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 Date: Fri, 19 Feb 2016 11:01:49 +0100
 Subject: [PATCH] mac80211: add hdrlen to ieee80211_tx_data
 
-This is preparation for adding support for inserting padding between the
-802.11 header and LLC data
+Add hdrlen to ieee80211_tx_data and use this
+when wep/ccmd/tkip. This is preparation for
+aligned4 code.
 
 Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -176,6 +176,7 @@ struct ieee80211_tx_data {
+@@ -177,6 +177,7 @@ struct ieee80211_tx_data {
  	struct ieee80211_tx_rate rate;
  
  	unsigned int flags;
@@ -39,7 +39,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* internal error, why isn't DONTFRAG set? */
  	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
  		return TX_DROP;
-@@ -1174,6 +1172,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1175,6 +1173,8 @@ ieee80211_tx_prepare(struct ieee80211_su
  
  	hdr = (struct ieee80211_hdr *) skb->data;
  
@@ -48,34 +48,25 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (likely(sta)) {
  		if (!IS_ERR(sta))
  			tx->sta = sta;
-@@ -3577,6 +3577,7 @@ begin:
+@@ -3468,6 +3468,7 @@ begin:
  	tx.local = local;
  	tx.skb = skb;
  	tx.sdata = vif_to_sdata(info->control.vif);
-+	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
  
  	if (txq->sta)
  		tx.sta = container_of(txq->sta, struct sta_info, sta);
-@@ -3603,7 +3604,7 @@ begin:
- 
- 		if (tx.key &&
- 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
--			pn_offs = ieee80211_hdrlen(hdr->frame_control);
-+			pn_offs = tx.hdrlen;
- 
- 		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
- 					   tx.key, skb);
-@@ -4058,6 +4059,7 @@ ieee80211_build_data_template(struct iee
+@@ -3796,6 +3797,7 @@ ieee80211_build_data_template(struct iee
  	hdr = (void *)skb->data;
  	tx.sta = sta_info_get(sdata, hdr->addr1);
  	tx.skb = skb;
-+	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx.hdrlen = ieee80211_padded_hdrlen(&tx.local->hw, hdr->frame_control);
  
  	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
  		rcu_read_unlock();
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1538,6 +1538,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1232,6 +1232,7 @@ void ieee80211_send_auth(struct ieee8021
  	struct ieee80211_local *local = sdata->local;
  	struct sk_buff *skb;
  	struct ieee80211_mgmt *mgmt;
@@ -83,7 +74,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int err;
  
  	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
-@@ -1561,8 +1562,10 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1255,8 +1256,10 @@ void ieee80211_send_auth(struct ieee8021
  		skb_put_data(skb, extra, extra_len);
  
  	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
@@ -97,7 +88,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/mac80211/wep.c
 +++ b/net/mac80211/wep.c
-@@ -86,11 +86,11 @@ static void ieee80211_wep_get_iv(struct
+@@ -89,11 +89,11 @@ static void ieee80211_wep_get_iv(struct
  
  static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
  				struct sk_buff *skb,
@@ -110,7 +101,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	u8 *newhdr;
  
  	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
-@@ -98,7 +98,6 @@ static u8 *ieee80211_wep_add_iv(struct i
+@@ -101,7 +101,6 @@ static u8 *ieee80211_wep_add_iv(struct i
  	if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
  		return NULL;
  
@@ -118,7 +109,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	newhdr = skb_push(skb, IEEE80211_WEP_IV_LEN);
  	memmove(newhdr, newhdr + IEEE80211_WEP_IV_LEN, hdrlen);
  
-@@ -157,6 +156,7 @@ int ieee80211_wep_encrypt_data(struct cr
+@@ -160,6 +159,7 @@ int ieee80211_wep_encrypt_data(struct cr
   */
  int ieee80211_wep_encrypt(struct ieee80211_local *local,
  			  struct sk_buff *skb,
@@ -126,7 +117,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			  const u8 *key, int keylen, int keyidx)
  {
  	u8 *iv;
-@@ -166,7 +166,7 @@ int ieee80211_wep_encrypt(struct ieee802
+@@ -169,7 +169,7 @@ int ieee80211_wep_encrypt(struct ieee802
  	if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN))
  		return -1;
  
@@ -135,7 +126,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!iv)
  		return -1;
  
-@@ -304,13 +304,14 @@ static int wep_encrypt_skb(struct ieee80
+@@ -307,13 +307,14 @@ static int wep_encrypt_skb(struct ieee80
  	struct ieee80211_key_conf *hw_key = info->control.hw_key;
  
  	if (!hw_key) {
@@ -154,7 +145,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			return -1;
 --- a/net/mac80211/wep.h
 +++ b/net/mac80211/wep.h
-@@ -19,6 +19,7 @@ int ieee80211_wep_encrypt_data(struct cr
+@@ -22,6 +22,7 @@ int ieee80211_wep_encrypt_data(struct cr
  				size_t klen, u8 *data, size_t data_len);
  int ieee80211_wep_encrypt(struct ieee80211_local *local,
  			  struct sk_buff *skb,
@@ -164,7 +155,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			       size_t klen, u8 *data, size_t data_len);
 --- a/net/mac80211/wpa.c
 +++ b/net/mac80211/wpa.c
-@@ -41,7 +41,7 @@ ieee80211_tx_h_michael_mic_add(struct ie
+@@ -44,7 +44,7 @@ ieee80211_tx_h_michael_mic_add(struct ie
  	    skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
  		return TX_CONTINUE;
  
@@ -173,7 +164,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (skb->len < hdrlen)
  		return TX_DROP;
  
-@@ -192,7 +192,6 @@ mic_fail_no_key:
+@@ -187,7 +187,6 @@ mic_fail_no_key:
  
  static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
  {
@@ -181,7 +172,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	unsigned int hdrlen;
-@@ -207,7 +206,7 @@ static int tkip_encrypt_skb(struct ieee8
+@@ -202,7 +201,7 @@ static int tkip_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -190,7 +181,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -425,7 +424,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -420,7 +419,7 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -199,7 +190,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -657,7 +656,7 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -653,7 +652,7 @@ static int gcmp_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -208,7 +199,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -797,7 +796,6 @@ static ieee80211_tx_result
+@@ -793,7 +792,6 @@ static ieee80211_tx_result
  ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
  			    struct sk_buff *skb)
  {
@@ -216,7 +207,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	int hdrlen;
-@@ -813,8 +811,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
+@@ -809,8 +807,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
  		     pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
  		return TX_DROP;
  
diff --git a/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
new file mode 100644
index 0000000000..a9f01b368d
--- /dev/null
+++ b/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
@@ -0,0 +1,233 @@
+From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+Date: Fri, 19 Feb 2016 11:01:50 +0100
+Subject: [PATCH] mac80211: add NEED_ALIGNED4_SKBS hw flag
+
+HW/driver should set NEED_ALIGNED4_SKBS flag in case
+require aligned skbs to four-byte boundaries.
+This affect only TX direction.
+
+Padding is added after ieee80211_hdr, before IV/LLC.
+
+Before we have to do memmove(hdrlen) twice in the
+dirver. Once before we pass this to HW and next
+in tx completion (to be sure monitor will report
+this tx frame correctly).
+
+With this patch we can skip this memmove() and save CPU.
+
+Currently this was tested with ath9k, both hw/sw crypt for
+wep/tkip/ccmp.
+
+Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2059,6 +2059,9 @@ struct ieee80211_txq {
+  * @IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA: Hardware supports buffer STA on
+  *	TDLS links.
+  *
++ * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
++ *	Padding will be added after ieee80211_hdr, before IV/LLC.
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2102,6 +2105,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_REPORTS_LOW_ACK,
+ 	IEEE80211_HW_SUPPORTS_TX_FRAG,
+ 	IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA,
++	IEEE80211_HW_NEEDS_ALIGNED4_SKBS,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -212,6 +212,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(REPORTS_LOW_ACK),
+ 	FLAG(SUPPORTS_TX_FRAG),
+ 	FLAG(SUPPORTS_TDLS_BUFFER_STA),
++	FLAG(NEEDS_ALIGNED4_SKBS),
+ #undef FLAG
+ };
+ 
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1548,6 +1548,29 @@ ieee80211_vif_get_num_mcast_if(struct ie
+ 	return -1;
+ }
+ 
++static inline unsigned int
++ieee80211_hdr_padsize(struct ieee80211_hw *hw, unsigned int hdrlen)
++{
++	/*
++	 * While hdrlen is already aligned to two-byte boundaries,
++	 * simple check with & 2 will return correct padsize.
++	 */
++	if (ieee80211_hw_check(hw, NEEDS_ALIGNED4_SKBS))
++		return hdrlen & 2;
++	return 0;
++}
++
++static inline unsigned int
++ieee80211_padded_hdrlen(struct ieee80211_hw *hw, __le16 fc)
++{
++	unsigned int hdrlen;
++
++	hdrlen = ieee80211_hdrlen(fc);
++	hdrlen += ieee80211_hdr_padsize(hw, hdrlen);
++
++	return hdrlen;
++}
++
+ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
+ 				     struct ieee80211_rx_status *status,
+ 				     unsigned int mpdu_len,
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -300,7 +300,7 @@ struct ieee80211_fast_tx {
+ 	u8 hdr_len;
+ 	u8 sa_offs, da_offs, pn_offs;
+ 	u8 band;
+-	u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
++	u8 hdr[30 + 2 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
+ 	       sizeof(rfc1042_header)] __aligned(2);
+ 
+ 	struct rcu_head rcu_head;
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -642,9 +642,22 @@ void ieee80211_tx_monitor(struct ieee802
+ 	struct sk_buff *skb2;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct net_device *prev_dev = NULL;
++	unsigned int hdrlen, padsize;
+ 	int rtap_len;
+ 
++	/* Remove padding if was added */
++	if (ieee80211_hw_check(&local->hw, NEEDS_ALIGNED4_SKBS)) {
++		hdrlen = ieee80211_hdrlen(hdr->frame_control);
++		padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
++
++		if (padsize && skb->len > hdrlen + padsize) {
++			memmove(skb->data + padsize, skb->data, hdrlen);
++			skb_pull(skb, padsize);
++		}
++	}
++
+ 	/* send frame to monitor interfaces now */
+ 	rtap_len = ieee80211_tx_radiotap_len(info);
+ 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -201,10 +201,12 @@ void ieee80211_get_tkip_p2k(struct ieee8
+ {
+ 	struct ieee80211_key *key = (struct ieee80211_key *)
+ 			container_of(keyconf, struct ieee80211_key, conf);
++	struct ieee80211_hw *hw = &key->local->hw;
+ 	const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
+ 	struct tkip_ctx *ctx = &key->u.tkip.tx;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+-	const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
++	const u8 *data = (u8 *)hdr + ieee80211_padded_hdrlen(hw,
++							hdr->frame_control);
+ 	u32 iv32 = get_unaligned_le32(&data[4]);
+ 	u16 iv16 = data[2] | (data[0] << 8);
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1172,8 +1172,7 @@ ieee80211_tx_prepare(struct ieee80211_su
+ 	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+-
+-	tx->hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx->hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
+ 
+ 	if (likely(sta)) {
+ 		if (!IS_ERR(sta))
+@@ -2184,7 +2183,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
+ 		goto fail;
+ 
+ 	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
+ 
+ 	if (skb->len < len_rthdr + hdrlen)
+ 		goto fail;
+@@ -2402,7 +2401,7 @@ static struct sk_buff *ieee80211_build_h
+ 	struct ieee80211_chanctx_conf *chanctx_conf;
+ 	struct ieee80211_sub_if_data *ap_sdata;
+ 	enum nl80211_band band;
+-	int ret;
++	int padsize, ret;
+ 
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+@@ -2622,6 +2621,9 @@ static struct sk_buff *ieee80211_build_h
+ 		hdrlen += 2;
+ 	}
+ 
++	/* Check aligned4 skb required */
++	padsize = ieee80211_hdr_padsize(&sdata->local->hw, hdrlen);
++
+ 	/*
+ 	 * Drop unicast frames to unauthorised stations unless they are
+ 	 * EAPOL frames from the local station.
+@@ -2702,6 +2704,7 @@ static struct sk_buff *ieee80211_build_h
+ 
+ 	skb_pull(skb, skip_header_bytes);
+ 	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
++	head_need += padsize;
+ 
+ 	/*
+ 	 * So we need to modify the skb header and hence need a copy of
+@@ -2734,6 +2737,9 @@ static struct sk_buff *ieee80211_build_h
+ 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
+ #endif
+ 
++	if (padsize)
++		memset(skb_push(skb, padsize), 0, padsize);
++
+ 	if (ieee80211_is_data_qos(fc)) {
+ 		__le16 *qos_control;
+ 
+@@ -2909,6 +2915,9 @@ void ieee80211_check_fast_xmit(struct st
+ 		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+ 	}
+ 
++	/* Check aligned4 skb required */
++	build.hdr_len += ieee80211_hdr_padsize(&local->hw, build.hdr_len);
++
+ 	/* We store the key here so there's no point in using rcu_dereference()
+ 	 * but that's fine because the code that changes the pointers will call
+ 	 * this function after doing so. For a single CPU that would be enough,
+@@ -3495,7 +3504,7 @@ begin:
+ 
+ 		if (tx.key &&
+ 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
+-			pn_offs = ieee80211_hdrlen(hdr->frame_control);
++			pn_offs = tx.hdrlen;
+ 
+ 		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
+ 					   tx.key, skb);
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1230,6 +1230,7 @@ void ieee80211_send_auth(struct ieee8021
+ 			 u32 tx_flags)
+ {
+ 	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_hw *hw = &local->hw;
+ 	struct sk_buff *skb;
+ 	struct ieee80211_mgmt *mgmt;
+ 	unsigned int hdrlen;
+@@ -1256,7 +1257,7 @@ void ieee80211_send_auth(struct ieee8021
+ 		skb_put_data(skb, extra, extra_len);
+ 
+ 	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
+-		hdrlen = ieee80211_hdrlen(mgmt->frame_control);
++		hdrlen = ieee80211_padded_hdrlen(hw, mgmt->frame_control);
+ 		mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+ 		err = ieee80211_wep_encrypt(local, skb, hdrlen, key,
+ 					    key_len, key_idx);
diff --git a/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch b/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
new file mode 100644
index 0000000000..609b15b832
--- /dev/null
+++ b/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
@@ -0,0 +1,82 @@
+From: Chaitanya T K <chaitanya.mgit@gmail.com>
+Date: Mon, 27 Jun 2016 15:23:26 +0530
+Subject: [PATCH] mac80211: minstrel: Enable STBC and LDPC for VHT Rates
+
+If peer support reception of STBC and LDPC, enable them for better
+performance.
+
+Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
+---
+
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -1556,6 +1556,7 @@ struct ieee80211_vht_operation {
+ #define IEEE80211_VHT_CAP_RXSTBC_3				0x00000300
+ #define IEEE80211_VHT_CAP_RXSTBC_4				0x00000400
+ #define IEEE80211_VHT_CAP_RXSTBC_MASK				0x00000700
++#define IEEE80211_VHT_CAP_RXSTBC_SHIFT				8
+ #define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE			0x00000800
+ #define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE			0x00001000
+ #define IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT                  13
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1130,7 +1130,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 	struct minstrel_ht_sta *mi = &msp->ht;
+ 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+-	u16 sta_cap = sta->ht_cap.cap;
++	u16 ht_cap = sta->ht_cap.cap;
+ 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+ 	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
+ 	int use_vht;
+@@ -1138,6 +1138,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	int ack_dur;
+ 	int stbc;
+ 	int i;
++	bool ldpc = false;
+ 
+ 	/* fall back to the old minstrel for legacy stations */
+ 	if (!sta->ht_cap.ht_supported)
+@@ -1175,16 +1176,24 @@ minstrel_ht_update_caps(void *priv, stru
+ 	}
+ 	mi->sample_tries = 4;
+ 
+-	/* TODO tx_flags for vht - ATM the RC API is not fine-grained enough */
+ 	if (!use_vht) {
+-		stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
++		stbc = (ht_cap & IEEE80211_HT_CAP_RX_STBC) >>
+ 			IEEE80211_HT_CAP_RX_STBC_SHIFT;
+-		mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
+ 
+-		if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
+-			mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
++		if (ht_cap & IEEE80211_HT_CAP_LDPC_CODING)
++			ldpc = true;
++	} else {
++		stbc = (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK) >>
++			IEEE80211_VHT_CAP_RXSTBC_SHIFT;
++
++		if (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC)
++			ldpc = true;
+ 	}
+ 
++	mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
++	if (ldpc)
++		mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
++
+ 	for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
+ 		u32 gflags = minstrel_mcs_groups[i].flags;
+ 		int bw, nss;
+@@ -1197,10 +1206,10 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 		if (gflags & IEEE80211_TX_RC_SHORT_GI) {
+ 			if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+-				if (!(sta_cap & IEEE80211_HT_CAP_SGI_40))
++				if (!(ht_cap & IEEE80211_HT_CAP_SGI_40))
+ 					continue;
+ 			} else {
+-				if (!(sta_cap & IEEE80211_HT_CAP_SGI_20))
++				if (!(ht_cap & IEEE80211_HT_CAP_SGI_20))
+ 					continue;
+ 			}
+ 		}
diff --git a/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch b/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
new file mode 100644
index 0000000000..d651e6ce30
--- /dev/null
+++ b/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
@@ -0,0 +1,50 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 28 Aug 2016 13:13:01 +0200
+Subject: [PATCH] ath9k: fix moredata bit in PS buffered frame release
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1659,6 +1659,22 @@ void ath_tx_aggr_wakeup(struct ath_softc
+ 	}
+ }
+ 
++
++static void
++ath9k_set_moredata(struct ath_softc *sc, struct ath_buf *bf, bool val)
++{
++	struct ieee80211_hdr *hdr;
++	u16 mask = cpu_to_le16(IEEE80211_FCTL_MOREDATA);
++	u16 mask_val = mask * val;
++
++	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
++	if ((hdr->frame_control & mask) != mask_val) {
++		hdr->frame_control = (hdr->frame_control & ~mask) | mask_val;
++		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
++			sizeof(*hdr), DMA_TO_DEVICE);
++	}
++}
++
+ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
+ 				   struct ieee80211_sta *sta,
+ 				   u16 tids, int nframes,
+@@ -1689,6 +1705,7 @@ void ath9k_release_buffered_frames(struc
+ 			if (!bf)
+ 				break;
+ 
++			ath9k_set_moredata(sc, bf, true);
+ 			list_add_tail(&bf->list, &bf_q);
+ 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 			if (bf_isampdu(bf)) {
+@@ -1712,6 +1729,9 @@ void ath9k_release_buffered_frames(struc
+ 	if (list_empty(&bf_q))
+ 		return;
+ 
++	if (!more_data)
++		ath9k_set_moredata(sc, bf_tail, false);
++
+ 	info = IEEE80211_SKB_CB(bf_tail->bf_mpdu);
+ 	info->flags |= IEEE80211_TX_STATUS_EOSP;
+ 
diff --git a/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch b/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
new file mode 100644
index 0000000000..319de2a767
--- /dev/null
+++ b/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 28 Aug 2016 13:13:42 +0200
+Subject: [PATCH] ath9k: clear potentially stale EOSP status bit in
+ intermediate queues
+
+Prevents spurious ieee80211_sta_eosp calls.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -969,7 +969,8 @@ ath_tx_get_tid_subframe(struct ath_softc
+ 		bf->bf_lastbf = bf;
+ 
+ 		tx_info = IEEE80211_SKB_CB(skb);
+-		tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
++		tx_info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
++				    IEEE80211_TX_STATUS_EOSP);
+ 
+ 		/*
+ 		 * No aggregation session is running, but there may be frames
diff --git a/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch b/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
new file mode 100644
index 0000000000..80a3074a4d
--- /dev/null
+++ b/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 28 Aug 2016 13:23:27 +0200
+Subject: [PATCH] ath9k: report tx status on EOSP
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee802
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_sta *sta = info->status.status_driver_data[0];
+ 
+-	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
++	if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
++			   IEEE80211_TX_STATUS_EOSP)) {
+ 		ieee80211_tx_status(hw, skb);
+ 		return;
+ 	}
diff --git a/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch b/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
new file mode 100644
index 0000000000..e25e92dda9
--- /dev/null
+++ b/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
@@ -0,0 +1,114 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 30 Aug 2016 12:44:08 +0200
+Subject: [PATCH] ath9k: fix block-ack window tracking issues
+
+Ensure that a buffer gets tracked as part of the block-ack window as
+soon as it's dequeued from the tid for the first time. Ensure that
+double calls to ath_tx_addto_baw (e.g. on retransmission) don't cause
+any issues.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -62,7 +62,7 @@ static void ath_tx_rc_status(struct ath_
+ 			     struct ath_tx_status *ts, int nframes, int nbad,
+ 			     int txok);
+ static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
+-			      int seqno);
++			      struct ath_buf *bf);
+ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
+ 					   struct ath_txq *txq,
+ 					   struct ath_atx_tid *tid,
+@@ -296,7 +296,7 @@ static void ath_tx_flush_tid(struct ath_
+ 		}
+ 
+ 		if (fi->baw_tracked) {
+-			ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
++			ath_tx_update_baw(sc, tid, bf);
+ 			sendbar = true;
+ 		}
+ 
+@@ -312,10 +312,15 @@ static void ath_tx_flush_tid(struct ath_
+ }
+ 
+ static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
+-			      int seqno)
++			      struct ath_buf *bf)
+ {
++	struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
++	u16 seqno = bf->bf_state.seqno;
+ 	int index, cindex;
+ 
++	if (!fi->baw_tracked)
++		return;
++
+ 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
+ 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
+ 
+@@ -336,6 +341,9 @@ static void ath_tx_addto_baw(struct ath_
+ 	u16 seqno = bf->bf_state.seqno;
+ 	int index, cindex;
+ 
++	if (fi->baw_tracked)
++		return;
++
+ 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
+ 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
+ 	__set_bit(cindex, tid->tx_buf);
+@@ -612,7 +620,7 @@ static void ath_tx_complete_aggr(struct
+ 			 * complete the acked-ones/xretried ones; update
+ 			 * block-ack window
+ 			 */
+-			ath_tx_update_baw(sc, tid, seqno);
++			ath_tx_update_baw(sc, tid, bf);
+ 
+ 			if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
+ 				memcpy(tx_info->control.rates, rates, sizeof(rates));
+@@ -642,7 +650,7 @@ static void ath_tx_complete_aggr(struct
+ 				 * run out of tx buf.
+ 				 */
+ 				if (!tbf) {
+-					ath_tx_update_baw(sc, tid, seqno);
++					ath_tx_update_baw(sc, tid, bf);
+ 
+ 					ath_tx_complete_buf(sc, bf, txq,
+ 							    &bf_head, NULL, ts,
+@@ -1011,11 +1019,14 @@ ath_tx_get_tid_subframe(struct ath_softc
+ 
+ 			INIT_LIST_HEAD(&bf_head);
+ 			list_add(&bf->list, &bf_head);
+-			ath_tx_update_baw(sc, tid, seqno);
++			ath_tx_update_baw(sc, tid, bf);
+ 			ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
+ 			continue;
+ 		}
+ 
++		if (bf_isampdu(bf))
++			ath_tx_addto_baw(sc, tid, bf);
++
+ 		return bf;
+ 	}
+ 
+@@ -1073,8 +1084,6 @@ ath_tx_form_aggr(struct ath_softc *sc, s
+ 		bf->bf_next = NULL;
+ 
+ 		/* link buffers of this frame to the aggregate */
+-		if (!fi->baw_tracked)
+-			ath_tx_addto_baw(sc, tid, bf);
+ 		bf->bf_state.ndelim = ndelim;
+ 
+ 		list_add_tail(&bf->list, bf_q);
+@@ -1710,10 +1719,8 @@ void ath9k_release_buffered_frames(struc
+ 			ath9k_set_moredata(sc, bf, true);
+ 			list_add_tail(&bf->list, &bf_q);
+ 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
+-			if (bf_isampdu(bf)) {
+-				ath_tx_addto_baw(sc, tid, bf);
++			if (bf_isampdu(bf))
+ 				bf->bf_state.bf_type &= ~BUF_AGGR;
+-			}
+ 			if (bf_tail)
+ 				bf_tail->bf_next = bf;
+ 
diff --git a/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch b/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
new file mode 100644
index 0000000000..67cbe92e59
--- /dev/null
+++ b/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
@@ -0,0 +1,47 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 22 Mar 2017 20:37:04 +0100
+Subject: [PATCH] ath9k_hw: fix channel maximum power level test
+
+The tx power applied by set_txpower is limited by the CTL (conformance
+test limit) entries in the EEPROM. These can change based on the user
+configured regulatory domain.
+Depending on the EEPROM data this can cause the tx power to become too
+limited, if the original regdomain CTLs impose lowr limits than the CTLs
+of the user configured regdomain.
+
+To fix this issue, set the initial channel limits without any CTL
+restrictions and only apply the CTL at run time when setting the channel
+and the real tx power.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -2937,10 +2937,14 @@ void ath9k_hw_apply_txpower(struct ath_h
+ 	struct ieee80211_channel *channel;
+ 	int chan_pwr, new_pwr, max_gain;
+ 	int ant_gain, ant_reduction = 0;
++	u16 ctl = NO_CTL;
+ 
+ 	if (!chan)
+ 		return;
+ 
++	if (!test)
++		ctl = ath9k_regd_get_ctl(reg, chan);
++
+ 	channel = chan->chan;
+ 	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
+ 	new_pwr = min_t(int, chan_pwr, reg->power_limit);
+@@ -2950,9 +2954,7 @@ void ath9k_hw_apply_txpower(struct ath_h
+ 	if (ant_gain > max_gain)
+ 		ant_reduction = ant_gain - max_gain;
+ 
+-	ah->eep_ops->set_txpower(ah, chan,
+-				 ath9k_regd_get_ctl(reg, chan),
+-				 ant_reduction, new_pwr, test);
++	ah->eep_ops->set_txpower(ah, chan, ctl, ant_reduction, new_pwr, test);
+ }
+ 
+ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
diff --git a/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
similarity index 59%
rename from package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
rename to package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
index 4b458f74ab..78083517bc 100644
--- a/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
+++ b/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
@@ -3,7 +3,7 @@ Date: Wed, 19 Jul 2017 08:49:31 +0200
 Subject: [PATCH] ath9k: adjust tx power reduction for US regulatory
  domain
 
-FCC regulatory rules allow for up to 6 dBi antenna gain. Account for
+FCC regulatory rules allow for up to 3 dBi antenna gain. Account for
 this in the EEPROM based tx power reduction code.
 
 Signed-off-by: Felix Fietkau <nbd@nbd.name>
@@ -11,14 +11,14 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2982,6 +2982,10 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2954,6 +2954,10 @@ void ath9k_hw_apply_txpower(struct ath_h
  	if (ant_gain > max_gain)
  		ant_reduction = ant_gain - max_gain;
  
-+	/* FCC allows maximum antenna gain of 6 dBi */
++	/* FCC allows maximum antenna gain of 3 dBi */
 +	if (reg->region == NL80211_DFS_FCC)
-+		ant_reduction = max_t(int, ant_reduction - 12, 0);
++		ant_reduction = max_t(int, ant_reduction - 6, 0);
 +
- 	ah->eep_ops->set_txpower(ah, chan, ctl,
- 				 ant_reduction, new_pwr, test);
+ 	ah->eep_ops->set_txpower(ah, chan, ctl, ant_reduction, new_pwr, test);
  }
+ 
diff --git a/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch b/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
new file mode 100644
index 0000000000..0f3120d671
--- /dev/null
+++ b/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 23 Jul 2017 14:58:22 +0200
+Subject: [PATCH] ath9k: fix more-data flag for buffered multicast
+ packets
+
+The flag needs to be cleared for the last packet in the list, not the
+first one. Fixes some issues with multicast packet loss for powersave
+clients connected to an ath9k AP.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2436,7 +2436,6 @@ void ath_tx_cabq(struct ieee80211_hw *hw
+ 		.txq = sc->beacon.cabq
+ 	};
+ 	struct ath_tx_info info = {};
+-	struct ieee80211_hdr *hdr;
+ 	struct ath_buf *bf_tail = NULL;
+ 	struct ath_buf *bf;
+ 	LIST_HEAD(bf_q);
+@@ -2480,15 +2479,10 @@ void ath_tx_cabq(struct ieee80211_hw *hw
+ 	if (list_empty(&bf_q))
+ 		return;
+ 
+-	bf = list_first_entry(&bf_q, struct ath_buf, list);
+-	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
+-
+-	if (hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_MOREDATA)) {
+-		hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+-		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+-			sizeof(*hdr), DMA_TO_DEVICE);
+-	}
++	bf = list_last_entry(&bf_q, struct ath_buf, list);
++	ath9k_set_moredata(sc, bf, false);
+ 
++	bf = list_first_entry(&bf_q, struct ath_buf, list);
+ 	ath_txq_lock(sc, txctl.txq);
+ 	ath_tx_fill_desc(sc, bf, txctl.txq, 0);
+ 	ath_tx_txqaddbuf(sc, txctl.txq, &bf_q, false);
diff --git a/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch b/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
new file mode 100644
index 0000000000..56d86c1525
--- /dev/null
+++ b/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
@@ -0,0 +1,27 @@
+From: dave taht <dave@taht.net>
+Date: Wed, 5 Oct 2016 20:09:15 -0700
+Subject: [PATCH] Revert "ath10k: disable wake_tx_queue for older
+ devices"
+
+This reverts commit 4ca1807815aa6801aaced7fdefa9edacc2521767
+in the hope that we've fixed all the performance problems now.
+---
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -8319,15 +8319,6 @@ int ath10k_mac_register(struct ath10k *a
+ 			ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
+ 	}
+ 
+-	/* Current wake_tx_queue implementation imposes a significant
+-	 * performance penalty in some setups. The tx scheduling code needs
+-	 * more work anyway so disable the wake_tx_queue unless firmware
+-	 * supports the pull-push mechanism.
+-	 */
+-	if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL,
+-		      ar->running_fw->fw_file.fw_features))
+-		ar->ops->wake_tx_queue = NULL;
+-
+ 	ret = ath10k_mac_init_rd(ar);
+ 	if (ret) {
+ 		ath10k_err(ar, "failed to derive regdom: %d\n", ret);
diff --git a/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch b/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
new file mode 100644
index 0000000000..5d5329f27e
--- /dev/null
+++ b/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
@@ -0,0 +1,61 @@
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Wed, 1 Nov 2017 21:01:57 +0100
+Subject: [PATCH] ath10k: fix recent bandwidth conversion bug
+
+The commit "cfg80211: make RATE_INFO_BW_20 the default" changed
+the index of RATE_INFO_BW_20, but the updates to ath10k missed
+the special bandwidth calculation case in
+ath10k_update_per_peer_tx_stats().
+
+Fixes: 842be75c77cb ("cfg80211: make RATE_INFO_BW_20 the default")
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Patchwork-Id: 10037035
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+---
+
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -592,6 +592,9 @@ struct amsdu_subframe_hdr {
+ 
+ #define GROUP_ID_IS_SU_MIMO(x) ((x) == 0 || (x) == 63)
+ 
++static const u8 ath10k_bw_to_mac80211[] = { RATE_INFO_BW_20, RATE_INFO_BW_40,
++	RATE_INFO_BW_80, RATE_INFO_BW_160 };
++
+ static void ath10k_htt_rx_h_rates(struct ath10k *ar,
+ 				  struct ieee80211_rx_status *status,
+ 				  struct htt_rx_desc *rxd)
+@@ -694,23 +697,7 @@ static void ath10k_htt_rx_h_rates(struct
+ 		if (sgi)
+ 			status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
+ 
+-		switch (bw) {
+-		/* 20MHZ */
+-		case 0:
+-			break;
+-		/* 40MHZ */
+-		case 1:
+-			status->bw = RATE_INFO_BW_40;
+-			break;
+-		/* 80MHZ */
+-		case 2:
+-			status->bw = RATE_INFO_BW_80;
+-			break;
+-		case 3:
+-			status->bw = RATE_INFO_BW_160;
+-			break;
+-		}
+-
++		status->bw = ath10k_bw_to_mac80211[bw];
+ 		status->encoding = RX_ENC_VHT;
+ 		break;
+ 	default:
+@@ -2297,7 +2284,7 @@ ath10k_update_per_peer_tx_stats(struct a
+ 		arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+ 
+ 	arsta->txrate.nss = txrate.nss;
+-	arsta->txrate.bw = txrate.bw + RATE_INFO_BW_20;
++	arsta->txrate.bw = ath10k_bw_to_mac80211[txrate.bw];
+ }
+ 
+ static void ath10k_htt_fetch_peer_stats(struct ath10k *ar,
diff --git a/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch b/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
new file mode 100644
index 0000000000..bc4174e4c2
--- /dev/null
+++ b/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
@@ -0,0 +1,55 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 30 Jan 2018 13:17:38 +0100
+Subject: [PATCH] cfg80211: use only 1Mbps for basic rates in mesh
+
+Mesh used to use the mandatory rates as basic rates, but we got
+the calculation of mandatory rates wrong until some time ago.
+Fix this this broke interoperability with older versions since
+now more basic rates are required, and thus the MBSS isn't the
+same and the network stops working.
+
+Fix this by simply using only 1Mbps as the basic rate in 2.4GHz.
+Since the changed mandatory rates only affected 2.4GHz, this is
+all we need to make it work again.
+
+Reported-and-tested-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Fixes: 1bd773c077de ("wireless: set correct mandatory rate flags")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/wireless/mesh.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/mesh.c
++++ b/net/wireless/mesh.c
+@@ -169,9 +169,28 @@ int __cfg80211_join_mesh(struct cfg80211
+ 		enum nl80211_bss_scan_width scan_width;
+ 		struct ieee80211_supported_band *sband =
+ 				rdev->wiphy.bands[setup->chandef.chan->band];
+-		scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
+-		setup->basic_rates = ieee80211_mandatory_rates(sband,
+-							       scan_width);
++
++		if (setup->chandef.chan->band == NL80211_BAND_2GHZ) {
++			int i;
++
++			/*
++			 * Older versions selected the mandatory rates for
++			 * 2.4 GHz as well, but were broken in that only
++			 * 1 Mbps was regarded as a mandatory rate. Keep
++			 * using just 1 Mbps as the default basic rate for
++			 * mesh to be interoperable with older versions.
++			 */
++			for (i = 0; i < sband->n_bitrates; i++) {
++				if (sband->bitrates[i].bitrate == 10) {
++					setup->basic_rates = BIT(i);
++					break;
++				}
++			}
++		} else {
++			scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
++			setup->basic_rates = ieee80211_mandatory_rates(sband,
++								       scan_width);
++		}
+ 	}
+ 
+ 	err = cfg80211_chandef_dfs_required(&rdev->wiphy,
diff --git a/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch b/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
new file mode 100644
index 0000000000..14cf6641d8
--- /dev/null
+++ b/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
@@ -0,0 +1,150 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:41:51 +0100
+Subject: [PATCH] mac80211: minstrel: remove unnecessary debugfs cleanup
+ code
+
+debugfs entries are cleaned up by debugfs_remove_recursive already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -689,8 +689,8 @@ minstrel_alloc(struct ieee80211_hw *hw,
+ 
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	mp->fixed_rate_idx = (u32) -1;
+-	mp->dbg_fixed_rate = debugfs_create_u32("fixed_rate_idx",
+-			S_IRUGO | S_IWUGO, debugfsdir, &mp->fixed_rate_idx);
++	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
++			   &mp->fixed_rate_idx);
+ #endif
+ 
+ 	minstrel_init_cck_rates(mp);
+@@ -701,9 +701,6 @@ minstrel_alloc(struct ieee80211_hw *hw,
+ static void
+ minstrel_free(void *priv)
+ {
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	debugfs_remove(((struct minstrel_priv *)priv)->dbg_fixed_rate);
+-#endif
+ 	kfree(priv);
+ }
+ 
+@@ -735,7 +732,6 @@ const struct rate_control_ops mac80211_m
+ 	.free_sta = minstrel_free_sta,
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	.add_sta_debugfs = minstrel_add_sta_debugfs,
+-	.remove_sta_debugfs = minstrel_remove_sta_debugfs,
+ #endif
+ 	.get_expected_throughput = minstrel_get_expected_throughput,
+ };
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -109,11 +109,6 @@ struct minstrel_sta_info {
+ 
+ 	/* sampling table */
+ 	u8 *sample_table;
+-
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	struct dentry *dbg_stats;
+-	struct dentry *dbg_stats_csv;
+-#endif
+ };
+ 
+ struct minstrel_priv {
+@@ -137,7 +132,6 @@ struct minstrel_priv {
+ 	 *   - setting will be applied on next update
+ 	 */
+ 	u32 fixed_rate_idx;
+-	struct dentry *dbg_fixed_rate;
+ #endif
+ };
+ 
+@@ -156,7 +150,6 @@ minstrel_get_ewmsd10(struct minstrel_rat
+ 
+ extern const struct rate_control_ops mac80211_minstrel;
+ void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+-void minstrel_remove_sta_debugfs(void *priv, void *priv_sta);
+ 
+ /* Recalculate success probabilities and counters for a given rate using EWMA */
+ void minstrel_calc_rate_stats(struct minstrel_rate_stats *mrs);
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -214,19 +214,7 @@ minstrel_add_sta_debugfs(void *priv, voi
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+ 
+-	mi->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, mi,
+-			&minstrel_stat_fops);
+-
+-	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO, dir,
+-			mi, &minstrel_stat_csv_fops);
+-}
+-
+-void
+-minstrel_remove_sta_debugfs(void *priv, void *priv_sta)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	debugfs_remove(mi->dbg_stats);
+-
+-	debugfs_remove(mi->dbg_stats_csv);
++	debugfs_create_file("rc_stats", S_IRUGO, dir, mi, &minstrel_stat_fops);
++	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, mi,
++			    &minstrel_stat_csv_fops);
+ }
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1393,7 +1393,6 @@ static const struct rate_control_ops mac
+ 	.free = minstrel_ht_free,
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+ 	.add_sta_debugfs = minstrel_ht_add_sta_debugfs,
+-	.remove_sta_debugfs = minstrel_ht_remove_sta_debugfs,
+ #endif
+ 	.get_expected_throughput = minstrel_ht_get_expected_throughput,
+ };
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -110,17 +110,12 @@ struct minstrel_ht_sta_priv {
+ 		struct minstrel_ht_sta ht;
+ 		struct minstrel_sta_info legacy;
+ 	};
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	struct dentry *dbg_stats;
+-	struct dentry *dbg_stats_csv;
+-#endif
+ 	void *ratelist;
+ 	void *sample_table;
+ 	bool is_ht;
+ };
+ 
+ void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+-void minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta);
+ int minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
+ 			   int prob_ewma);
+ 
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -303,17 +303,8 @@ minstrel_ht_add_sta_debugfs(void *priv,
+ {
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 
+-	msp->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
+-			&minstrel_ht_stat_fops);
+-	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO,
+-			     dir, msp, &minstrel_ht_stat_csv_fops);
+-}
+-
+-void
+-minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta)
+-{
+-	struct minstrel_ht_sta_priv *msp = priv_sta;
+-
+-	debugfs_remove(msp->dbg_stats);
+-	debugfs_remove(msp->dbg_stats_csv);
++	debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
++			    &minstrel_ht_stat_fops);
++	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, msp,
++			    &minstrel_ht_stat_csv_fops);
+ }
diff --git a/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
new file mode 100644
index 0000000000..a2bdfd81a0
--- /dev/null
+++ b/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
@@ -0,0 +1,576 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:43:30 +0100
+Subject: [PATCH] mac80211: minstrel: merge with minstrel_ht, always enable
+ VHT support
+
+Legacy-only devices are not very common and the overhead of the extra
+code for HT and VHT rates is not big enough to justify all those extra
+lines of code to make it optional.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -25,20 +25,6 @@ config MAC80211_RC_MINSTREL
+ 	---help---
+ 	  This option enables the 'minstrel' TX rate control algorithm
+ 
+-config MAC80211_RC_MINSTREL_HT
+-	bool "Minstrel 802.11n support" if EXPERT
+-	depends on MAC80211_RC_MINSTREL
+-	default y
+-	---help---
+-	  This option enables the 'minstrel_ht' TX rate control algorithm
+-
+-config MAC80211_RC_MINSTREL_VHT
+-	bool "Minstrel 802.11ac support" if EXPERT
+-	depends on MAC80211_RC_MINSTREL_HT
+-	default n
+-	---help---
+-	  This option enables VHT in the 'minstrel_ht' TX rate control algorithm
+-
+ choice
+ 	prompt "Default rate control algorithm"
+ 	depends on MAC80211_HAS_RC
+@@ -60,8 +46,7 @@ endchoice
+ 
+ config MAC80211_RC_DEFAULT
+ 	string
+-	default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL && MAC80211_RC_MINSTREL_HT
+-	default "minstrel" if MAC80211_RC_DEFAULT_MINSTREL
++	default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL
+ 	default ""
+ 
+ endif
+--- a/net/mac80211/Makefile
++++ b/net/mac80211/Makefile
+@@ -50,13 +50,14 @@ mac80211-$(CONFIG_PM) += pm.o
+ 
+ CFLAGS_trace.o := -I$(src)
+ 
+-rc80211_minstrel-y := rc80211_minstrel.o
+-rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += rc80211_minstrel_debugfs.o
++rc80211_minstrel-y := \
++	rc80211_minstrel.o \
++	rc80211_minstrel_ht.o
+ 
+-rc80211_minstrel_ht-y := rc80211_minstrel_ht.o
+-rc80211_minstrel_ht-$(CPTCFG_MAC80211_DEBUGFS) += rc80211_minstrel_ht_debugfs.o
++rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += \
++	rc80211_minstrel_debugfs.o \
++	rc80211_minstrel_ht_debugfs.o
+ 
+ mac80211-$(CPTCFG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
+-mac80211-$(CPTCFG_MAC80211_RC_MINSTREL_HT) += $(rc80211_minstrel_ht-y)
+ 
+ ccflags-y += -DDEBUG
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1252,18 +1252,12 @@ static int __init ieee80211_init(void)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = rc80211_minstrel_ht_init();
+-	if (ret)
+-		goto err_minstrel;
+-
+ 	ret = ieee80211_iface_init();
+ 	if (ret)
+ 		goto err_netdev;
+ 
+ 	return 0;
+  err_netdev:
+-	rc80211_minstrel_ht_exit();
+- err_minstrel:
+ 	rc80211_minstrel_exit();
+ 
+ 	return ret;
+@@ -1271,7 +1265,6 @@ static int __init ieee80211_init(void)
+ 
+ static void __exit ieee80211_exit(void)
+ {
+-	rc80211_minstrel_ht_exit();
+ 	rc80211_minstrel_exit();
+ 
+ 	ieee80211s_stop();
+--- a/net/mac80211/rate.h
++++ b/net/mac80211/rate.h
+@@ -95,18 +95,5 @@ static inline void rc80211_minstrel_exit
+ }
+ #endif
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_HT
+-int rc80211_minstrel_ht_init(void);
+-void rc80211_minstrel_ht_exit(void);
+-#else
+-static inline int rc80211_minstrel_ht_init(void)
+-{
+-	return 0;
+-}
+-static inline void rc80211_minstrel_ht_exit(void)
+-{
+-}
+-#endif
+-
+ 
+ #endif /* IEEE80211_RATE_H */
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -572,138 +572,6 @@ minstrel_rate_init(void *priv, struct ie
+ 	minstrel_update_rates(mp, mi);
+ }
+ 
+-static void *
+-minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
+-{
+-	struct ieee80211_supported_band *sband;
+-	struct minstrel_sta_info *mi;
+-	struct minstrel_priv *mp = priv;
+-	struct ieee80211_hw *hw = mp->hw;
+-	int max_rates = 0;
+-	int i;
+-
+-	mi = kzalloc(sizeof(struct minstrel_sta_info), gfp);
+-	if (!mi)
+-		return NULL;
+-
+-	for (i = 0; i < NUM_NL80211_BANDS; i++) {
+-		sband = hw->wiphy->bands[i];
+-		if (sband && sband->n_bitrates > max_rates)
+-			max_rates = sband->n_bitrates;
+-	}
+-
+-	mi->r = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+-	if (!mi->r)
+-		goto error;
+-
+-	mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+-	if (!mi->sample_table)
+-		goto error1;
+-
+-	mi->last_stats_update = jiffies;
+-	return mi;
+-
+-error1:
+-	kfree(mi->r);
+-error:
+-	kfree(mi);
+-	return NULL;
+-}
+-
+-static void
+-minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	kfree(mi->sample_table);
+-	kfree(mi->r);
+-	kfree(mi);
+-}
+-
+-static void
+-minstrel_init_cck_rates(struct minstrel_priv *mp)
+-{
+-	static const int bitrates[4] = { 10, 20, 55, 110 };
+-	struct ieee80211_supported_band *sband;
+-	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
+-	int i, j;
+-
+-	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
+-	if (!sband)
+-		return;
+-
+-	for (i = 0, j = 0; i < sband->n_bitrates; i++) {
+-		struct ieee80211_rate *rate = &sband->bitrates[i];
+-
+-		if (rate->flags & IEEE80211_RATE_ERP_G)
+-			continue;
+-
+-		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+-			continue;
+-
+-		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
+-			if (rate->bitrate != bitrates[j])
+-				continue;
+-
+-			mp->cck_rates[j] = i;
+-			break;
+-		}
+-	}
+-}
+-
+-static void *
+-minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+-{
+-	struct minstrel_priv *mp;
+-
+-	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
+-	if (!mp)
+-		return NULL;
+-
+-	/* contention window settings
+-	 * Just an approximation. Using the per-queue values would complicate
+-	 * the calculations and is probably unnecessary */
+-	mp->cw_min = 15;
+-	mp->cw_max = 1023;
+-
+-	/* number of packets (in %) to use for sampling other rates
+-	 * sample less often for non-mrr packets, because the overhead
+-	 * is much higher than with mrr */
+-	mp->lookaround_rate = 5;
+-	mp->lookaround_rate_mrr = 10;
+-
+-	/* maximum time that the hw is allowed to stay in one MRR segment */
+-	mp->segment_size = 6000;
+-
+-	if (hw->max_rate_tries > 0)
+-		mp->max_retry = hw->max_rate_tries;
+-	else
+-		/* safe default, does not necessarily have to match hw properties */
+-		mp->max_retry = 7;
+-
+-	if (hw->max_rates >= 4)
+-		mp->has_mrr = true;
+-
+-	mp->hw = hw;
+-	mp->update_interval = 100;
+-
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	mp->fixed_rate_idx = (u32) -1;
+-	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
+-			   &mp->fixed_rate_idx);
+-#endif
+-
+-	minstrel_init_cck_rates(mp);
+-
+-	return mp;
+-}
+-
+-static void
+-minstrel_free(void *priv)
+-{
+-	kfree(priv);
+-}
+-
+ static u32 minstrel_get_expected_throughput(void *priv_sta)
+ {
+ 	struct minstrel_sta_info *mi = priv_sta;
+@@ -722,29 +590,8 @@ static u32 minstrel_get_expected_through
+ }
+ 
+ const struct rate_control_ops mac80211_minstrel = {
+-	.name = "minstrel",
+ 	.tx_status_ext = minstrel_tx_status,
+ 	.get_rate = minstrel_get_rate,
+ 	.rate_init = minstrel_rate_init,
+-	.alloc = minstrel_alloc,
+-	.free = minstrel_free,
+-	.alloc_sta = minstrel_alloc_sta,
+-	.free_sta = minstrel_free_sta,
+-#ifdef CPTCFG_MAC80211_DEBUGFS
+-	.add_sta_debugfs = minstrel_add_sta_debugfs,
+-#endif
+ 	.get_expected_throughput = minstrel_get_expected_throughput,
+ };
+-
+-int __init
+-rc80211_minstrel_init(void)
+-{
+-	return ieee80211_rate_control_register(&mac80211_minstrel);
+-}
+-
+-void
+-rc80211_minstrel_exit(void)
+-{
+-	ieee80211_rate_control_unregister(&mac80211_minstrel);
+-}
+-
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -158,7 +158,5 @@ int minstrel_get_tp_avg(struct minstrel_
+ /* debugfs */
+ int minstrel_stats_open(struct inode *inode, struct file *file);
+ int minstrel_stats_csv_open(struct inode *inode, struct file *file);
+-ssize_t minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos);
+-int minstrel_stats_release(struct inode *inode, struct file *file);
+ 
+ #endif
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -54,22 +54,6 @@
+ #include <net/mac80211.h>
+ #include "rc80211_minstrel.h"
+ 
+-ssize_t
+-minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
+-{
+-	struct minstrel_debugfs_info *ms;
+-
+-	ms = file->private_data;
+-	return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
+-}
+-
+-int
+-minstrel_stats_release(struct inode *inode, struct file *file)
+-{
+-	kfree(file->private_data);
+-	return 0;
+-}
+-
+ int
+ minstrel_stats_open(struct inode *inode, struct file *file)
+ {
+@@ -135,14 +119,6 @@ minstrel_stats_open(struct inode *inode,
+ 	return 0;
+ }
+ 
+-static const struct file_operations minstrel_stat_fops = {
+-	.owner = THIS_MODULE,
+-	.open = minstrel_stats_open,
+-	.read = minstrel_stats_read,
+-	.release = minstrel_stats_release,
+-	.llseek = default_llseek,
+-};
+-
+ int
+ minstrel_stats_csv_open(struct inode *inode, struct file *file)
+ {
+@@ -200,21 +176,3 @@ minstrel_stats_csv_open(struct inode *in
+ 
+ 	return 0;
+ }
+-
+-static const struct file_operations minstrel_stat_csv_fops = {
+-	.owner = THIS_MODULE,
+-	.open = minstrel_stats_csv_open,
+-	.read = minstrel_stats_read,
+-	.release = minstrel_stats_release,
+-	.llseek = default_llseek,
+-};
+-
+-void
+-minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir)
+-{
+-	struct minstrel_sta_info *mi = priv_sta;
+-
+-	debugfs_create_file("rc_stats", S_IRUGO, dir, mi, &minstrel_stat_fops);
+-	debugfs_create_file("rc_stats_csv", S_IRUGO, dir, mi,
+-			    &minstrel_stat_csv_fops);
+-}
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -137,12 +137,10 @@
+ 		}					\
+ 	}
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ static bool minstrel_vht_only = true;
+ module_param(minstrel_vht_only, bool, 0644);
+ MODULE_PARM_DESC(minstrel_vht_only,
+ 		 "Use only VHT rates when VHT is supported by sta.");
+-#endif
+ 
+ /*
+  * To enable sufficiently targeted rate sampling, MCS rates are divided into
+@@ -171,7 +169,6 @@ const struct mcs_group minstrel_mcs_grou
+ 
+ 	CCK_GROUP,
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 	VHT_GROUP(1, 0, BW_20),
+ 	VHT_GROUP(2, 0, BW_20),
+ 	VHT_GROUP(3, 0, BW_20),
+@@ -195,7 +192,6 @@ const struct mcs_group minstrel_mcs_grou
+ 	VHT_GROUP(1, 1, BW_80),
+ 	VHT_GROUP(2, 1, BW_80),
+ 	VHT_GROUP(3, 1, BW_80),
+-#endif
+ };
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
+@@ -1146,12 +1142,10 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 	BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 	if (vht_cap->vht_supported)
+ 		use_vht = vht_cap->vht_mcs.tx_mcs_map != cpu_to_le16(~0);
+ 	else
+-#endif
+-	use_vht = 0;
++		use_vht = 0;
+ 
+ 	msp->is_ht = true;
+ 	memset(mi, 0, sizeof(*mi));
+@@ -1226,10 +1220,9 @@ minstrel_ht_update_caps(void *priv, stru
+ 
+ 		/* HT rate */
+ 		if (gflags & IEEE80211_TX_RC_MCS) {
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ 			if (use_vht && minstrel_vht_only)
+ 				continue;
+-#endif
++
+ 			mi->supported[i] = mcs->rx_mask[nss - 1];
+ 			if (mi->supported[i])
+ 				n_supported++;
+@@ -1349,16 +1342,88 @@ minstrel_ht_free_sta(void *priv, struct
+ 	kfree(msp);
+ }
+ 
++static void
++minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
++{
++	static const int bitrates[4] = { 10, 20, 55, 110 };
++	struct ieee80211_supported_band *sband;
++	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
++	int i, j;
++
++	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
++	if (!sband)
++		return;
++
++	for (i = 0, j = 0; i < sband->n_bitrates; i++) {
++		struct ieee80211_rate *rate = &sband->bitrates[i];
++
++		if (rate->flags & IEEE80211_RATE_ERP_G)
++			continue;
++
++		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
++			continue;
++
++		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
++			if (rate->bitrate != bitrates[j])
++				continue;
++
++			mp->cck_rates[j] = i;
++			break;
++		}
++	}
++}
++
+ static void *
+ minstrel_ht_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+ {
+-	return mac80211_minstrel.alloc(hw, debugfsdir);
++	struct minstrel_priv *mp;
++
++	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
++	if (!mp)
++		return NULL;
++
++	/* contention window settings
++	 * Just an approximation. Using the per-queue values would complicate
++	 * the calculations and is probably unnecessary */
++	mp->cw_min = 15;
++	mp->cw_max = 1023;
++
++	/* number of packets (in %) to use for sampling other rates
++	 * sample less often for non-mrr packets, because the overhead
++	 * is much higher than with mrr */
++	mp->lookaround_rate = 5;
++	mp->lookaround_rate_mrr = 10;
++
++	/* maximum time that the hw is allowed to stay in one MRR segment */
++	mp->segment_size = 6000;
++
++	if (hw->max_rate_tries > 0)
++		mp->max_retry = hw->max_rate_tries;
++	else
++		/* safe default, does not necessarily have to match hw properties */
++		mp->max_retry = 7;
++
++	if (hw->max_rates >= 4)
++		mp->has_mrr = true;
++
++	mp->hw = hw;
++	mp->update_interval = 100;
++
++#ifdef CPTCFG_MAC80211_DEBUGFS
++	mp->fixed_rate_idx = (u32) -1;
++	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
++			   &mp->fixed_rate_idx);
++#endif
++
++	minstrel_ht_init_cck_rates(mp);
++
++	return mp;
+ }
+ 
+ static void
+ minstrel_ht_free(void *priv)
+ {
+-	mac80211_minstrel.free(priv);
++	kfree(priv);
+ }
+ 
+ static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
+@@ -1417,14 +1482,14 @@ static void __init init_sample_table(voi
+ }
+ 
+ int __init
+-rc80211_minstrel_ht_init(void)
++rc80211_minstrel_init(void)
+ {
+ 	init_sample_table();
+ 	return ieee80211_rate_control_register(&mac80211_minstrel_ht);
+ }
+ 
+ void
+-rc80211_minstrel_ht_exit(void)
++rc80211_minstrel_exit(void)
+ {
+ 	ieee80211_rate_control_unregister(&mac80211_minstrel_ht);
+ }
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -15,11 +15,7 @@
+  */
+ #define MINSTREL_MAX_STREAMS		3
+ #define MINSTREL_HT_STREAM_GROUPS	4 /* BW(=2) * SGI(=2) */
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ #define MINSTREL_VHT_STREAM_GROUPS	6 /* BW(=3) * SGI(=2) */
+-#else
+-#define MINSTREL_VHT_STREAM_GROUPS	0
+-#endif
+ 
+ #define MINSTREL_HT_GROUPS_NB	(MINSTREL_MAX_STREAMS *		\
+ 				 MINSTREL_HT_STREAM_GROUPS)
+@@ -34,11 +30,7 @@
+ #define MINSTREL_CCK_GROUP	(MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
+ #define MINSTREL_VHT_GROUP_0	(MINSTREL_CCK_GROUP + 1)
+ 
+-#ifdef CPTCFG_MAC80211_RC_MINSTREL_VHT
+ #define MCS_GROUP_RATES		10
+-#else
+-#define MCS_GROUP_RATES		8
+-#endif
+ 
+ struct mcs_group {
+ 	u32 flags;
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -15,6 +15,22 @@
+ #include "rc80211_minstrel.h"
+ #include "rc80211_minstrel_ht.h"
+ 
++static ssize_t
++minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
++{
++	struct minstrel_debugfs_info *ms;
++
++	ms = file->private_data;
++	return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
++}
++
++static int
++minstrel_stats_release(struct inode *inode, struct file *file)
++{
++	kfree(file->private_data);
++	return 0;
++}
++
+ static char *
+ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
+ {
diff --git a/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch b/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
new file mode 100644
index 0000000000..02a0ca0a52
--- /dev/null
+++ b/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
@@ -0,0 +1,368 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 12:45:47 +0100
+Subject: [PATCH] mac80211: minstrel: reduce minstrel_mcs_groups size
+
+By storing a shift value for all duration values of a group, we can
+reduce precision by a neglegible amount to make it fit into a u16 value.
+This improves cache footprint and reduces size:
+
+Before:
+   text    data     bss     dec     hex filename
+  10024     116       0   10140    279c rc80211_minstrel_ht.o
+
+After:
+   text    data     bss     dec     hex filename
+   9368     116       0    9484    250c rc80211_minstrel_ht.o
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -52,22 +52,23 @@
+ 	_streams - 1
+ 
+ /* MCS rate information for an MCS group */
+-#define MCS_GROUP(_streams, _sgi, _ht40)				\
++#define MCS_GROUP(_streams, _sgi, _ht40, _s)				\
+ 	[GROUP_IDX(_streams, _sgi, _ht40)] = {				\
+ 	.streams = _streams,						\
++	.shift = _s,							\
+ 	.flags =							\
+ 		IEEE80211_TX_RC_MCS |					\
+ 		(_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |			\
+ 		(_ht40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),		\
+ 	.duration = {							\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78),		\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234),	\
+-		MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260)		\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234) >> _s,	\
++		MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260) >> _s	\
+ 	}								\
+ }
+ 
+@@ -80,9 +81,10 @@
+ #define BW2VBPS(_bw, r3, r2, r1)					\
+ 	(_bw == BW_80 ? r3 : _bw == BW_40 ? r2 : r1)
+ 
+-#define VHT_GROUP(_streams, _sgi, _bw)					\
++#define VHT_GROUP(_streams, _sgi, _bw, _s)				\
+ 	[VHT_GROUP_IDX(_streams, _sgi, _bw)] = {			\
+ 	.streams = _streams,						\
++	.shift = _s,							\
+ 	.flags =							\
+ 		IEEE80211_TX_RC_VHT_MCS |				\
+ 		(_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |			\
+@@ -90,25 +92,25 @@
+ 		 _bw == BW_40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),	\
+ 	.duration = {							\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  117,  54,  26)),		\
++			     BW2VBPS(_bw,  117,  54,  26)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  234, 108,  52)),		\
++			     BW2VBPS(_bw,  234, 108,  52)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  351, 162,  78)),		\
++			     BW2VBPS(_bw,  351, 162,  78)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  468, 216, 104)),		\
++			     BW2VBPS(_bw,  468, 216, 104)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  702, 324, 156)),		\
++			     BW2VBPS(_bw,  702, 324, 156)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw,  936, 432, 208)),		\
++			     BW2VBPS(_bw,  936, 432, 208)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1053, 486, 234)),		\
++			     BW2VBPS(_bw, 1053, 486, 234)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1170, 540, 260)),		\
++			     BW2VBPS(_bw, 1170, 540, 260)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1404, 648, 312)),		\
++			     BW2VBPS(_bw, 1404, 648, 312)) >> _s,	\
+ 		MCS_DURATION(_streams, _sgi,				\
+-			     BW2VBPS(_bw, 1560, 720, 346))		\
++			     BW2VBPS(_bw, 1560, 720, 346)) >> _s	\
+ 	}								\
+ }
+ 
+@@ -121,19 +123,20 @@
+ 	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
+ 	 CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
+ 
+-#define CCK_DURATION_LIST(_short)			\
+-	CCK_ACK_DURATION(10, _short),			\
+-	CCK_ACK_DURATION(20, _short),			\
+-	CCK_ACK_DURATION(55, _short),			\
+-	CCK_ACK_DURATION(110, _short)
++#define CCK_DURATION_LIST(_short, _s)			\
++	CCK_ACK_DURATION(10, _short) >> _s,		\
++	CCK_ACK_DURATION(20, _short) >> _s,		\
++	CCK_ACK_DURATION(55, _short) >> _s,		\
++	CCK_ACK_DURATION(110, _short) >> _s
+ 
+-#define CCK_GROUP					\
++#define CCK_GROUP(_s)					\
+ 	[MINSTREL_CCK_GROUP] = {			\
+ 		.streams = 0,				\
+ 		.flags = 0,				\
++		.shift = _s,				\
+ 		.duration = {				\
+-			CCK_DURATION_LIST(false),	\
+-			CCK_DURATION_LIST(true)		\
++			CCK_DURATION_LIST(false, _s),	\
++			CCK_DURATION_LIST(true, _s)	\
+ 		}					\
+ 	}
+ 
+@@ -151,47 +154,47 @@ MODULE_PARM_DESC(minstrel_vht_only,
+  * BW -> SGI -> #streams
+  */
+ const struct mcs_group minstrel_mcs_groups[] = {
+-	MCS_GROUP(1, 0, BW_20),
+-	MCS_GROUP(2, 0, BW_20),
+-	MCS_GROUP(3, 0, BW_20),
+-
+-	MCS_GROUP(1, 1, BW_20),
+-	MCS_GROUP(2, 1, BW_20),
+-	MCS_GROUP(3, 1, BW_20),
+-
+-	MCS_GROUP(1, 0, BW_40),
+-	MCS_GROUP(2, 0, BW_40),
+-	MCS_GROUP(3, 0, BW_40),
+-
+-	MCS_GROUP(1, 1, BW_40),
+-	MCS_GROUP(2, 1, BW_40),
+-	MCS_GROUP(3, 1, BW_40),
+-
+-	CCK_GROUP,
+-
+-	VHT_GROUP(1, 0, BW_20),
+-	VHT_GROUP(2, 0, BW_20),
+-	VHT_GROUP(3, 0, BW_20),
+-
+-	VHT_GROUP(1, 1, BW_20),
+-	VHT_GROUP(2, 1, BW_20),
+-	VHT_GROUP(3, 1, BW_20),
+-
+-	VHT_GROUP(1, 0, BW_40),
+-	VHT_GROUP(2, 0, BW_40),
+-	VHT_GROUP(3, 0, BW_40),
+-
+-	VHT_GROUP(1, 1, BW_40),
+-	VHT_GROUP(2, 1, BW_40),
+-	VHT_GROUP(3, 1, BW_40),
+-
+-	VHT_GROUP(1, 0, BW_80),
+-	VHT_GROUP(2, 0, BW_80),
+-	VHT_GROUP(3, 0, BW_80),
+-
+-	VHT_GROUP(1, 1, BW_80),
+-	VHT_GROUP(2, 1, BW_80),
+-	VHT_GROUP(3, 1, BW_80),
++	MCS_GROUP(1, 0, BW_20, 5),
++	MCS_GROUP(2, 0, BW_20, 4),
++	MCS_GROUP(3, 0, BW_20, 4),
++
++	MCS_GROUP(1, 1, BW_20, 5),
++	MCS_GROUP(2, 1, BW_20, 4),
++	MCS_GROUP(3, 1, BW_20, 4),
++
++	MCS_GROUP(1, 0, BW_40, 4),
++	MCS_GROUP(2, 0, BW_40, 4),
++	MCS_GROUP(3, 0, BW_40, 4),
++
++	MCS_GROUP(1, 1, BW_40, 4),
++	MCS_GROUP(2, 1, BW_40, 4),
++	MCS_GROUP(3, 1, BW_40, 4),
++
++	CCK_GROUP(8),
++
++	VHT_GROUP(1, 0, BW_20, 5),
++	VHT_GROUP(2, 0, BW_20, 4),
++	VHT_GROUP(3, 0, BW_20, 4),
++
++	VHT_GROUP(1, 1, BW_20, 5),
++	VHT_GROUP(2, 1, BW_20, 4),
++	VHT_GROUP(3, 1, BW_20, 4),
++
++	VHT_GROUP(1, 0, BW_40, 4),
++	VHT_GROUP(2, 0, BW_40, 4),
++	VHT_GROUP(3, 0, BW_40, 4),
++
++	VHT_GROUP(1, 1, BW_40, 4),
++	VHT_GROUP(2, 1, BW_40, 4),
++	VHT_GROUP(3, 1, BW_40, 4),
++
++	VHT_GROUP(1, 0, BW_80, 4),
++	VHT_GROUP(2, 0, BW_80, 4),
++	VHT_GROUP(3, 0, BW_80, 4),
++
++	VHT_GROUP(1, 1, BW_80, 4),
++	VHT_GROUP(2, 1, BW_80, 4),
++	VHT_GROUP(3, 1, BW_80, 4),
+ };
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
+@@ -307,7 +310,8 @@ minstrel_ht_get_tp_avg(struct minstrel_h
+ 	if (group != MINSTREL_CCK_GROUP)
+ 		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+ 
+-	nsecs += minstrel_mcs_groups[group].duration[rate];
++	nsecs += minstrel_mcs_groups[group].duration[rate] <<
++		 minstrel_mcs_groups[group].shift;
+ 
+ 	/*
+ 	 * For the throughput calculation, limit the probability value to 90% to
+@@ -755,12 +759,19 @@ minstrel_ht_tx_status(void *priv, struct
+ 		minstrel_ht_update_rates(mp, mi);
+ }
+ 
++static inline int
++minstrel_get_duration(int index)
++{
++	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
++	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
++	return duration << group->shift;
++}
++
+ static void
+ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                          int index)
+ {
+ 	struct minstrel_rate_stats *mrs;
+-	const struct mcs_group *group;
+ 	unsigned int tx_time, tx_time_rtscts, tx_time_data;
+ 	unsigned int cw = mp->cw_min;
+ 	unsigned int ctime = 0;
+@@ -779,8 +790,7 @@ minstrel_calc_retransmit(struct minstrel
+ 	mrs->retry_count_rtscts = 2;
+ 	mrs->retry_updated = true;
+ 
+-	group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+-	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len / 1000;
++	tx_time_data = minstrel_get_duration(index) * ampdu_len / 1000;
+ 
+ 	/* Contention time for first 2 tries */
+ 	ctime = (t_slot * cw) >> 1;
+@@ -874,20 +884,24 @@ minstrel_ht_get_max_amsdu_len(struct min
+ 	int group = mi->max_prob_rate / MCS_GROUP_RATES;
+ 	const struct mcs_group *g = &minstrel_mcs_groups[group];
+ 	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
++	unsigned int duration;
+ 
+ 	/* Disable A-MSDU if max_prob_rate is bad */
+ 	if (mi->groups[group].rates[rate].prob_ewma < MINSTREL_FRAC(50, 100))
+ 		return 1;
+ 
++	duration = g->duration[rate];
++	duration <<= g->shift;
++
+ 	/* If the rate is slower than single-stream MCS1, make A-MSDU limit small */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 52))
++	if (duration > MCS_DURATION(1, 0, 52))
+ 		return 500;
+ 
+ 	/*
+ 	 * If the rate is slower than single-stream MCS4, limit A-MSDU to usual
+ 	 * data packet size
+ 	 */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 104))
++	if (duration > MCS_DURATION(1, 0, 104))
+ 		return 1600;
+ 
+ 	/*
+@@ -895,7 +909,7 @@ minstrel_ht_get_max_amsdu_len(struct min
+ 	 * rate success probability is less than 75%, limit A-MSDU to twice the usual
+ 	 * data packet size
+ 	 */
+-	if (g->duration[rate] > MCS_DURATION(1, 0, 260) ||
++	if (duration > MCS_DURATION(1, 0, 260) ||
+ 	    (minstrel_ht_get_prob_ewma(mi, mi->max_tp_rate[0]) <
+ 	     MINSTREL_FRAC(75, 100)))
+ 		return 3200;
+@@ -942,13 +956,6 @@ minstrel_ht_update_rates(struct minstrel
+ 	rate_control_set_rates(mp->hw, mi->sta, rates);
+ }
+ 
+-static inline int
+-minstrel_get_duration(int index)
+-{
+-	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+-	return group->duration[index % MCS_GROUP_RATES];
+-}
+-
+ static int
+ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+ {
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -33,9 +33,10 @@
+ #define MCS_GROUP_RATES		10
+ 
+ struct mcs_group {
+-	u32 flags;
+-	unsigned int streams;
+-	unsigned int duration[MCS_GROUP_RATES];
++	u16 flags;
++	u8 streams;
++	u8 shift;
++	u16 duration[MCS_GROUP_RATES];
+ };
+ 
+ extern const struct mcs_group minstrel_mcs_groups[];
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -58,6 +58,7 @@ minstrel_ht_stats_dump(struct minstrel_h
+ 		static const int bitrates[4] = { 10, 20, 55, 110 };
+ 		int idx = i * MCS_GROUP_RATES + j;
+ 		unsigned int prob_ewmsd;
++		unsigned int duration;
+ 
+ 		if (!(mi->supported[i] & BIT(j)))
+ 			continue;
+@@ -95,7 +96,9 @@ minstrel_ht_stats_dump(struct minstrel_h
+ 		p += sprintf(p, "  %3u  ", idx);
+ 
+ 		/* tx_time[rate(i)] in usec */
+-		tx_time = DIV_ROUND_CLOSEST(mg->duration[j], 1000);
++		duration = mg->duration[j];
++		duration <<= mg->shift;
++		tx_time = DIV_ROUND_CLOSEST(duration, 1000);
+ 		p += sprintf(p, "%6u  ", tx_time);
+ 
+ 		tp_max = minstrel_ht_get_tp_avg(mi, i, j, MINSTREL_FRAC(100, 100));
+@@ -204,6 +207,7 @@ minstrel_ht_stats_csv_dump(struct minstr
+ 		static const int bitrates[4] = { 10, 20, 55, 110 };
+ 		int idx = i * MCS_GROUP_RATES + j;
+ 		unsigned int prob_ewmsd;
++		unsigned int duration;
+ 
+ 		if (!(mi->supported[i] & BIT(j)))
+ 			continue;
+@@ -238,7 +242,10 @@ minstrel_ht_stats_csv_dump(struct minstr
+ 		}
+ 
+ 		p += sprintf(p, "%u,", idx);
+-		tx_time = DIV_ROUND_CLOSEST(mg->duration[j], 1000);
++
++		duration = mg->duration[j];
++		duration <<= mg->shift;
++		tx_time = DIV_ROUND_CLOSEST(duration, 1000);
+ 		p += sprintf(p, "%u,", tx_time);
+ 
+ 		tp_max = minstrel_ht_get_tp_avg(mi, i, j, MINSTREL_FRAC(100, 100));
diff --git a/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch b/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
new file mode 100644
index 0000000000..502d8c7768
--- /dev/null
+++ b/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
@@ -0,0 +1,31 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 10 Feb 2018 13:43:07 +0100
+Subject: [PATCH] mac80211: minstrel: fix using short preamble CCK rates on
+ HT clients
+
+mi->supported[MINSTREL_CCK_GROUP] needs to be updated
+
+Fixes: 782dda00ab8e ("mac80211: minstrel_ht: move short preamble check out of get_rate")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1135,7 +1135,6 @@ minstrel_ht_update_caps(void *priv, stru
+ 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+ 	u16 ht_cap = sta->ht_cap.cap;
+ 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+-	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
+ 	int use_vht;
+ 	int n_supported = 0;
+ 	int ack_dur;
+@@ -1267,8 +1266,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	if (!n_supported)
+ 		goto use_legacy;
+ 
+-	if (test_sta_flag(sinfo, WLAN_STA_SHORT_PREAMBLE))
+-		mi->cck_supported_short |= mi->cck_supported_short << 4;
++	mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
+ 
+ 	/* create an initial rate table with the lowest supported rates */
+ 	minstrel_ht_update_stats(mp, mi);
diff --git a/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch b/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
new file mode 100644
index 0000000000..0b599b73ac
--- /dev/null
+++ b/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
@@ -0,0 +1,43 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Fri, 2 Feb 2018 11:36:45 +0100
+Subject: [PATCH] ath9k: Protect queue draining by rcu_read_lock()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When ath9k was switched over to use the mac80211 intermediate queues,
+node cleanup now drains the mac80211 queues. However, this call path is
+not protected by rcu_read_lock() as it was previously entirely internal
+to the driver which uses its own locking.
+
+This leads to a possible rcu_dereference() without holding
+rcu_read_lock(); but only if a station is cleaned up while having
+packets queued on the TXQ. Fix this by adding the rcu_read_lock() to the
+caller in ath9k.
+
+Fixes: 50f08edf9809 ("ath9k: Switch to using mac80211 intermediate software queues.")
+Cc: stable@vger.kernel.org
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2915,6 +2915,8 @@ void ath_tx_node_cleanup(struct ath_soft
+ 	struct ath_txq *txq;
+ 	int tidno;
+ 
++	rcu_read_lock();
++
+ 	for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
+ 		tid = ath_node_to_tid(an, tidno);
+ 		txq = tid->txq;
+@@ -2932,6 +2934,8 @@ void ath_tx_node_cleanup(struct ath_soft
+ 		if (!an->sta)
+ 			break; /* just one multicast ath_atx_tid */
+ 	}
++
++	rcu_read_unlock();
+ }
+ 
+ #ifdef CPTCFG_ATH9K_TX99
diff --git a/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch b/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
new file mode 100644
index 0000000000..f0ffcd9655
--- /dev/null
+++ b/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
@@ -0,0 +1,20 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Mar 2018 13:27:54 +0100
+Subject: [PATCH] mac80211: minstrel: fix CCK rate group streams value
+
+Fixes a harmless underflow issue when CCK rates are actively being used
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -131,7 +131,7 @@
+ 
+ #define CCK_GROUP(_s)					\
+ 	[MINSTREL_CCK_GROUP] = {			\
+-		.streams = 0,				\
++		.streams = 1,				\
+ 		.flags = 0,				\
+ 		.shift = _s,				\
+ 		.duration = {				\
diff --git a/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch b/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
new file mode 100644
index 0000000000..e0049c36eb
--- /dev/null
+++ b/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Mar 2018 13:28:48 +0100
+Subject: [PATCH] mac80211: minstrel: fix sampling/reporting of CCK rates
+ in HT mode
+
+Long/short preamble selection cannot be sampled separately, since it
+depends on the BSS state. Because of that, sampling attempts to
+currently not used preamble modes are not counted in the statistics,
+which leads to CCK rates being sampled too often.
+
+Fix statistics accounting for long/short preamble by increasing the
+index where necessary.
+Fix excessive CCK rate sampling by dropping unsupported sample attempts.
+
+This improves throughput on 2.4 GHz channels
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -281,7 +281,8 @@ minstrel_ht_get_stats(struct minstrel_pr
+ 				break;
+ 
+ 		/* short preamble */
+-		if (!(mi->supported[group] & BIT(idx)))
++		if ((mi->supported[group] & BIT(idx + 4)) &&
++		    (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
+ 			idx += 4;
+ 	}
+ 	return &mi->groups[group].rates[idx];
+@@ -1080,18 +1081,23 @@ minstrel_ht_get_rate(void *priv, struct
+ 		return;
+ 
+ 	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++	sample_idx %= MCS_GROUP_RATES;
++
++	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
++	    (sample_idx >= 4) != txrc->short_preamble)
++		return;
++
+ 	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ 	rate->count = 1;
+ 
+-	if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
++	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
+ 		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+ 		rate->idx = mp->cck_rates[idx];
+ 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
+ 		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
+ 				       sample_group->streams);
+ 	} else {
+-		rate->idx = sample_idx % MCS_GROUP_RATES +
+-			    (sample_group->streams - 1) * 8;
++		rate->idx = sample_idx + (sample_group->streams - 1) * 8;
+ 	}
+ 
+ 	rate->flags = sample_group->flags;
diff --git a/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch b/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
new file mode 100644
index 0000000000..414cb137de
--- /dev/null
+++ b/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
@@ -0,0 +1,40 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 3 Mar 2018 18:48:58 +0100
+Subject: [PATCH] mac80211: minstrel: do not sample rates 3 times slower than
+ max_prob_rate
+
+These rates are highly unlikely to be used quickly, even if the link
+deteriorates rapidly. This improves throughput in cases where CCK rates
+are not reliable enough to be skipped entirely during sampling.
+Sampling these rates regularly can cost a lot of airtime.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -1004,10 +1004,13 @@ minstrel_get_sample_rate(struct minstrel
+ 		return -1;
+ 
+ 	/*
+-	 * Do not sample if the probability is already higher than 95%
+-	 * to avoid wasting airtime.
++	 * Do not sample if the probability is already higher than 95%,
++	 * or if the rate is 3 times slower than the current max probability
++	 * rate, to avoid wasting airtime.
+ 	 */
+-	if (mrs->prob_ewma > MINSTREL_FRAC(95, 100))
++	sample_dur = minstrel_get_duration(sample_idx);
++	if (mrs->prob_ewma > MINSTREL_FRAC(95, 100) ||
++	    minstrel_get_duration(mi->max_prob_rate) * 3 < sample_dur)
+ 		return -1;
+ 
+ 	/*
+@@ -1017,7 +1020,6 @@ minstrel_get_sample_rate(struct minstrel
+ 
+ 	cur_max_tp_streams = minstrel_mcs_groups[tp_rate1 /
+ 		MCS_GROUP_RATES].streams;
+-	sample_dur = minstrel_get_duration(sample_idx);
+ 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
+ 	    (cur_max_tp_streams - 1 <
+ 	     minstrel_mcs_groups[sample_group].streams ||
diff --git a/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
new file mode 100644
index 0000000000..c64457a17f
--- /dev/null
+++ b/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Mar 2018 21:00:56 +0100
+Subject: [PATCH] mac80211: fix memory accounting with A-MSDU aggregation
+
+fq uses skb->truesize for memory usage tracking. Increments/decrements
+are done on enqueue/dequeue.
+When A-MSDU aggregation is performed on tx side, the packet is
+aggregated with the last packet in the queue belonging to the same flow.
+There are multiple bugs here:
+- The truesize field of the aggregated packet isn't updated, so memory
+usage is underestimated
+- fq->memory_usage isn't adjusted.
+
+Because of the combination of both bugs, this only causes tx issues in
+rare cases, mainly when the A-MSDU head needs to be reallocated.
+
+Fix this by adjusting both truesize of the A-MSDU head and adding the
+truesize delta to fq->memory_usage.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3171,6 +3171,7 @@ static bool ieee80211_amsdu_aggregate(st
+ 	u8 max_subframes = sta->sta.max_amsdu_subframes;
+ 	int max_frags = local->hw.max_tx_fragments;
+ 	int max_amsdu_len = sta->sta.max_amsdu_len;
++	int orig_truesize;
+ 	__be16 len;
+ 	void *data;
+ 	bool ret = false;
+@@ -3201,12 +3202,13 @@ static bool ieee80211_amsdu_aggregate(st
+ 	flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
+ 	head = skb_peek_tail(&flow->queue);
+ 	if (!head)
+-		goto out;
++		goto unlock;
+ 
++	orig_truesize = head->truesize;
+ 	orig_len = head->len;
+ 
+ 	if (skb->len + head->len > max_amsdu_len)
+-		goto out;
++		goto unlock;
+ 
+ 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+ 		goto out;
+@@ -3249,6 +3251,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	fq_recalc_backlog(fq, tin, flow);
+ 
+ out:
++	fq->memory_usage += head->truesize - orig_truesize;
++
++unlock:
+ 	spin_unlock_bh(&fq->lock);
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch b/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
new file mode 100644
index 0000000000..37323c1f7d
--- /dev/null
+++ b/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
@@ -0,0 +1,42 @@
+From 4f717a2589be649afddbbd3ac58b67ebfa7426f7 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Wed, 6 Jun 2018 10:18:31 +0200
+Subject: [PATCH v2] cfg80211: initialize sinfo in cfg80211_get_station
+
+Most of the implementations behind cfg80211_get_station will not initialize
+sinfo to zero before manipulating it. For example, the member "filled",
+which indicates the filled in parts of this struct, is often only modified
+by enabling certain bits in the bitfield while keeping the remaining bits
+in their original state. A caller without a preinitialized sinfo.filled can
+then no longer decide which parts of sinfo were filled in by
+cfg80211_get_station (or actually the underlying implementations).
+
+cfg80211_get_station must therefore take care that sinfo is initialized to
+zero. Otherwise, the caller may tries to read information which was not
+filled in and which must therefore also be considered uninitialized. In
+batadv_v_elp_get_throughput's case, an invalid "random" expected throughput
+may be stored for this neighbor and thus the B.A.T.M.A.N V algorithm may
+switch to non-optimal neighbors for certain destinations.
+
+Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
+Reported-by: Thomas Lauer <holminateur@gmail.com>
+Reported-by: Marcel Schmidt <ff.z-casparistrasse@mailbox.org>
+Cc: b.a.t.m.a.n@lists.open-mesh.org
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+
+Forwarded: https://patchwork.kernel.org/patch/10449857/
+---
+ net/wireless/util.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1749,6 +1749,8 @@ int cfg80211_get_station(struct net_devi
+ 	if (!rdev->ops->get_station)
+ 		return -EOPNOTSUPP;
+ 
++	memset(sinfo, 0, sizeof(*sinfo));
++
+ 	return rdev_get_station(rdev, dev, mac_addr, sinfo);
+ }
+ EXPORT_SYMBOL(cfg80211_get_station);
diff --git a/package/kernel/mac80211/patches/380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch b/package/kernel/mac80211/patches/380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch
new file mode 100644
index 0000000000..c1aea25cba
--- /dev/null
+++ b/package/kernel/mac80211/patches/380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch
@@ -0,0 +1,34 @@
+From e966a79c2f761a696dec9cfb0e2d4aa977bf78cb Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 16 Oct 2018 18:43:42 +0100
+Subject: [PATCH] brcmfmac: fix spelling mistake "Retreiving" -> "Retrieving"
+
+Trivial fix to spelling mistake in brcmf_err error message.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -214,7 +214,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
+ 				       sizeof(ifp->mac_addr));
+ 	if (err < 0) {
+-		brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
++		brcmf_err("Retrieving cur_etheraddr failed, %d\n", err);
+ 		goto done;
+ 	}
+ 	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
+@@ -269,7 +269,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	strcpy(buf, "ver");
+ 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+ 	if (err < 0) {
+-		brcmf_err("Retreiving version information failed, %d\n",
++		brcmf_err("Retrieving version information failed, %d\n",
+ 			  err);
+ 		goto done;
+ 	}
diff --git a/package/kernel/mac80211/patches/380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch b/package/kernel/mac80211/patches/380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch
new file mode 100644
index 0000000000..566336cbc3
--- /dev/null
+++ b/package/kernel/mac80211/patches/380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch
@@ -0,0 +1,83 @@
+From ae5848cb4511bbbfe0306fcdbe5d9a95cd9546a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 26 Oct 2018 13:22:32 +0200
+Subject: [PATCH] brcmutil: print invalid chanspec when WARN-ing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On one of my devices I got WARNINGs when brcmfmac tried to decode
+chanspec. I couldn't tell if it was some unsupported format or just a
+malformed value passed by a firmware.
+
+Print chanspec value so it's possible to debug a possible problem.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -128,7 +128,7 @@ static void brcmu_d11n_decchspec(struct
+ 		}
+ 		break;
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ 
+@@ -140,7 +140,7 @@ static void brcmu_d11n_decchspec(struct
+ 		ch->band = BRCMU_CHAN_BAND_2G;
+ 		break;
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ }
+@@ -167,7 +167,7 @@ static void brcmu_d11ac_decchspec(struct
+ 			ch->sb = BRCMU_CHAN_SB_U;
+ 			ch->control_ch_num += CH_10MHZ_APART;
+ 		} else {
+-			WARN_ON_ONCE(1);
++			WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		}
+ 		break;
+ 	case BRCMU_CHSPEC_D11AC_BW_80:
+@@ -188,7 +188,7 @@ static void brcmu_d11ac_decchspec(struct
+ 			ch->control_ch_num += CH_30MHZ_APART;
+ 			break;
+ 		default:
+-			WARN_ON_ONCE(1);
++			WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 			break;
+ 		}
+ 		break;
+@@ -222,13 +222,13 @@ static void brcmu_d11ac_decchspec(struct
+ 			ch->control_ch_num += CH_70MHZ_APART;
+ 			break;
+ 		default:
+-			WARN_ON_ONCE(1);
++			WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 			break;
+ 		}
+ 		break;
+ 	case BRCMU_CHSPEC_D11AC_BW_8080:
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ 
+@@ -240,7 +240,7 @@ static void brcmu_d11ac_decchspec(struct
+ 		ch->band = BRCMU_CHAN_BAND_2G;
+ 		break;
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ }
diff --git a/package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch b/package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch
new file mode 100644
index 0000000000..271994dae6
--- /dev/null
+++ b/package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch
@@ -0,0 +1,78 @@
+From a4dad0334732f62c67058037d9edb17945bec598 Mon Sep 17 00:00:00 2001
+From: Dan Haab <riproute@gmail.com>
+Date: Fri, 9 Nov 2018 09:38:55 -0700
+Subject: [PATCH] brcmfmac: support STA info struct v7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The newest firmwares provide STA info using v7 of the struct. As v7
+isn't backward compatible, a union is needed.
+
+Even though brcmfmac does not use any of the new info it's important to
+provide the proper struct buffer. Without this change new firmwares will
+fallback to the very limited v3 instead of something in between such as
+v4.
+
+Signed-off-by: Dan Haab <dan.haab@luxul.com>
+Reviewed-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 40 ++++++++++++++++++----
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -176,6 +176,8 @@
+ 
+ #define BRCMF_VHT_CAP_MCS_MAP_NSS_MAX	8
+ 
++#define BRCMF_HE_CAP_MCS_MAP_NSS_MAX	8
++
+ /* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
+  * ioctl. It is relatively small because firmware has small maximum size input
+  * playload restriction for ioctls.
+@@ -601,13 +603,37 @@ struct brcmf_sta_info_le {
+ 	__le32 rx_pkts_retried;        /* # rx with retry bit set */
+ 	__le32 tx_rate_fallback;       /* lowest fallback TX rate */
+ 
+-	/* Fields valid for ver >= 5 */
+-	struct {
+-		__le32 count;					/* # rates in this set */
+-		u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
+-		u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
+-		__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
+-	} rateset_adv;
++	union {
++		struct {
++			struct {
++				__le32 count;					/* # rates in this set */
++				u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
++				u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
++				__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
++			} rateset_adv;
++		} v5;
++
++		struct {
++			__le32 rx_dur_total;	/* total user RX duration (estimated) */
++			__le16 chanspec;	/** chanspec this sta is on */
++			__le16 pad_1;
++			struct {
++				__le16 version;					/* version */
++				__le16 len;					/* length */
++				__le32 count;					/* # rates in this set */
++				u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
++				u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
++				__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
++				__le16 he_mcs[BRCMF_HE_CAP_MCS_MAP_NSS_MAX];	/* supported he mcs index bit map per nss */
++			} rateset_adv;		/* rateset along with mcs index bitmap */
++			__le16 wpauth;		/* authentication type */
++			u8 algo;		/* crypto algorithm */
++			u8 pad_2;
++			__le32 tx_rspec;	/* Rate of last successful tx frame */
++			__le32 rx_rspec;	/* Rate of last successful rx frame */
++			__le32 wnm_cap;		/* wnm capabilities */
++		} v7;
++	};
+ };
+ 
+ struct brcmf_chanspec_list {
diff --git a/package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch b/package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
new file mode 100644
index 0000000000..26347e6e0e
--- /dev/null
+++ b/package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
@@ -0,0 +1,110 @@
+From b72c51a58e6d63ef673ac96b8ab5bc98799c5f7b Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Sat, 24 Nov 2018 17:57:05 -0500
+Subject: [PATCH] brcmfmac: Fix out of bounds memory access during fw load
+
+I ended up tracking down some rather nasty issues with f2fs (and other
+filesystem modules) constantly crashing on my kernel down to a
+combination of out of bounds memory accesses, one of which was coming
+from brcmfmac during module load:
+
+[   30.891382] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2
+[   30.894437] ==================================================================
+[   30.901581] BUG: KASAN: global-out-of-bounds in brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac]
+[   30.909935] Read of size 1 at addr ffff2000024865df by task kworker/6:2/387
+[   30.916805]
+[   30.918261] CPU: 6 PID: 387 Comm: kworker/6:2 Tainted: G           O      4.20.0-rc3Lyude-Test+ #19
+[   30.927251] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018
+[   30.935964] Workqueue: events brcmf_driver_register [brcmfmac]
+[   30.941641] Call trace:
+[   30.944058]  dump_backtrace+0x0/0x3e8
+[   30.947676]  show_stack+0x14/0x20
+[   30.950968]  dump_stack+0x130/0x1c4
+[   30.954406]  print_address_description+0x60/0x25c
+[   30.959066]  kasan_report+0x1b4/0x368
+[   30.962683]  __asan_report_load1_noabort+0x18/0x20
+[   30.967547]  brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac]
+[   30.967639]  brcmf_sdio_probe+0x163c/0x2050 [brcmfmac]
+[   30.978035]  brcmf_ops_sdio_probe+0x598/0xa08 [brcmfmac]
+[   30.983254]  sdio_bus_probe+0x190/0x398
+[   30.983270]  really_probe+0x2a0/0xa70
+[   30.983296]  driver_probe_device+0x1b4/0x2d8
+[   30.994901]  __driver_attach+0x200/0x280
+[   30.994914]  bus_for_each_dev+0x10c/0x1a8
+[   30.994925]  driver_attach+0x38/0x50
+[   30.994935]  bus_add_driver+0x330/0x608
+[   30.994953]  driver_register+0x140/0x388
+[   31.013965]  sdio_register_driver+0x74/0xa0
+[   31.014076]  brcmf_sdio_register+0x14/0x60 [brcmfmac]
+[   31.023177]  brcmf_driver_register+0xc/0x18 [brcmfmac]
+[   31.023209]  process_one_work+0x654/0x1080
+[   31.032266]  worker_thread+0x4f0/0x1308
+[   31.032286]  kthread+0x2a8/0x320
+[   31.039254]  ret_from_fork+0x10/0x1c
+[   31.039269]
+[   31.044226] The buggy address belongs to the variable:
+[   31.044351]  brcmf_firmware_path+0x11f/0xfffffffffffd3b40 [brcmfmac]
+[   31.055601]
+[   31.057031] Memory state around the buggy address:
+[   31.061800]  ffff200002486480: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
+[   31.068983]  ffff200002486500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[   31.068993] >ffff200002486580: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
+[   31.068999]                                                     ^
+[   31.069017]  ffff200002486600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[   31.096521]  ffff200002486680: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
+[   31.096528] ==================================================================
+[   31.096533] Disabling lock debugging due to kernel taint
+
+It appears that when trying to determine the length of the string in the
+alternate firmware path, we make the mistake of not handling the case
+where the firmware path is empty correctly. Since strlen(mp_path) can
+return 0, we'll end up accessing mp_path[-1] when the firmware_path
+isn't provided through the module arguments.
+
+So, fix this by just setting the end char to '\0' by default, and only
+changing it if we have a non-zero length. Additionally, use strnlen()
+with BRCMF_FW_ALTPATH_LEN instead of strlen() just to be extra safe.
+
+Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function")
+Cc: Hante Meuleman <hante.meuleman@broadcom.com>
+Cc: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Cc: Franky Lin <franky.lin@broadcom.com>
+Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Cc: Himanshu Jha <himanshujha199640@gmail.com>
+Cc: Dan Haab <dhaab@luxul.com>
+Cc: Jia-Shyr Chuang <saint.chuang@cypress.com>
+Cc: Ian Molton <ian@mnementh.co.uk>
+Cc: <stable@vger.kernel.org> # v4.17+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c   | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -633,8 +633,9 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 	struct brcmf_fw_request *fwreq;
+ 	char chipname[12];
+ 	const char *mp_path;
++	size_t mp_path_len;
+ 	u32 i, j;
+-	char end;
++	char end = '\0';
+ 	size_t reqsz;
+ 
+ 	for (i = 0; i < table_size; i++) {
+@@ -659,7 +660,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 		   mapping_table[i].fw_base, chipname);
+ 
+ 	mp_path = brcmf_mp_global.firmware_path;
+-	end = mp_path[strlen(mp_path) - 1];
++	mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
++	if (mp_path_len)
++		end = mp_path[mp_path_len - 1];
++
+ 	fwreq->n_items = n_fwnames;
+ 
+ 	for (j = 0; j < n_fwnames; j++) {
diff --git a/package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch b/package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch
new file mode 100644
index 0000000000..b6a1a17b93
--- /dev/null
+++ b/package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch
@@ -0,0 +1,68 @@
+From 8c892df41500469729e0d662816300196e4f463d Mon Sep 17 00:00:00 2001
+From: Stijn Tintel <stijn@linux-ipv6.be>
+Date: Tue, 4 Dec 2018 20:29:05 +0200
+Subject: [PATCH] brcmfmac: fix roamoff=1 modparam
+
+When the update_connect_param callback is set, nl80211 expects the flag
+WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is
+only set when modparam roamoff=0, while the callback is set
+unconditionally. Since commit 7f9a3e150ec7 this causes a warning in
+wiphy_register, which breaks brcmfmac.
+
+Disable the update_connect_param callback when roamoff=0 to fix this.
+
+Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS")
+Cc: Stable <stable@vger.kernel.org> # 4.19+
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   | 11 +++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h   |  2 +-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c   |  2 +-
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5189,10 +5189,17 @@ static struct cfg80211_ops brcmf_cfg8021
+ 	.del_pmk = brcmf_cfg80211_del_pmk,
+ };
+ 
+-struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
++struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
+ {
+-	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
++	struct cfg80211_ops *ops;
++
++	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
+ 		       GFP_KERNEL);
++
++	if (ops && settings->roamoff)
++		ops->update_connect_params = NULL;
++
++	return ops;
+ }
+ 
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -404,7 +404,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
+ s32 brcmf_cfg80211_up(struct net_device *ndev);
+ s32 brcmf_cfg80211_down(struct net_device *ndev);
+-struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
++struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings);
+ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
+ 
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1151,7 +1151,7 @@ int brcmf_attach(struct device *dev, str
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	ops = brcmf_cfg80211_get_ops();
++	ops = brcmf_cfg80211_get_ops(settings);
+ 	if (!ops)
+ 		return -ENOMEM;
+ 
diff --git a/package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch b/package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch
new file mode 100644
index 0000000000..ceb12c17d3
--- /dev/null
+++ b/package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch
@@ -0,0 +1,41 @@
+From 861cb5eb467f5e38dce1aabe4e8db379255bd89b Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 12 Dec 2018 20:20:06 +0100
+Subject: [PATCH] brcmfmac: Fix access point mode
+
+Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with
+hostapd (device_ap_sme=1 use_monitor=0):
+
+brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
+
+So add the missing mgmt_stypes for AP mode to fix this.
+
+Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6303,6 +6303,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
+ 		.tx = 0xffff,
+ 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+ 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
++	},
++	[NL80211_IFTYPE_AP] = {
++		.tx = 0xffff,
++		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
++		      BIT(IEEE80211_STYPE_AUTH >> 4) |
++		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
++		      BIT(IEEE80211_STYPE_ACTION >> 4)
+ 	}
+ };
+ 
diff --git a/package/kernel/mac80211/patches/381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch b/package/kernel/mac80211/patches/381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch
new file mode 100644
index 0000000000..f83f38f274
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch
@@ -0,0 +1,104 @@
+From 5cc898fbcb352b764f8d51c16e10e2eb0056173d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 6 Feb 2019 12:28:15 +0100
+Subject: [PATCH] brcmfmac: modify __brcmf_err() to take bus as a parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far __brcmf_err() was using pr_err() which didn't allow identifying
+device that was affected by an error. It's crucial for systems with more
+than 1 device supported by brcmfmac (a common case for home routers).
+
+This change allows passing struct brcmf_bus to the __brcmf_err(). That
+struct has been agreed to be the most common one. It allows accessing
+struct device easily & using dev_err() printing helper.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/common.c    | 7 +++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h | 8 +++++---
+ .../wireless/broadcom/brcm80211/brcmfmac/tracepoint.c    | 9 +++++++--
+ 3 files changed, 17 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -350,7 +350,7 @@ done:
+ }
+ 
+ #ifndef CPTCFG_BRCM_TRACING
+-void __brcmf_err(const char *func, const char *fmt, ...)
++void __brcmf_err(struct brcmf_bus *bus, const char *func, const char *fmt, ...)
+ {
+ 	struct va_format vaf;
+ 	va_list args;
+@@ -359,7 +359,10 @@ void __brcmf_err(const char *func, const
+ 
+ 	vaf.fmt = fmt;
+ 	vaf.va = &args;
+-	pr_err("%s: %pV", func, &vaf);
++	if (bus)
++		dev_err(bus->dev, "%s: %pV", func, &vaf);
++	else
++		pr_err("%s: %pV", func, &vaf);
+ 
+ 	va_end(args);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -45,8 +45,10 @@
+ #undef pr_fmt
+ #define pr_fmt(fmt)		KBUILD_MODNAME ": " fmt
+ 
+-__printf(2, 3)
+-void __brcmf_err(const char *func, const char *fmt, ...);
++struct brcmf_bus;
++
++__printf(3, 4)
++void __brcmf_err(struct brcmf_bus *bus, const char *func, const char *fmt, ...);
+ /* Macro for error messages. When debugging / tracing the driver all error
+  * messages are important to us.
+  */
+@@ -55,7 +57,7 @@ void __brcmf_err(const char *func, const
+ 		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
+ 		    IS_ENABLED(CPTCFG_BRCM_TRACING) ||			\
+ 		    net_ratelimit())					\
+-			__brcmf_err(__func__, fmt, ##__VA_ARGS__);	\
++			__brcmf_err(NULL, __func__, fmt, ##__VA_ARGS__);\
+ 	} while (0)
+ 
+ #if defined(DEBUG) || defined(CPTCFG_BRCM_TRACING)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
+@@ -14,14 +14,16 @@
+  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <linux/device.h>
+ #include <linux/module.h> /* bug in tracepoint.h, it should include this */
+ 
+ #ifndef __CHECKER__
+ #define CREATE_TRACE_POINTS
++#include "bus.h"
+ #include "tracepoint.h"
+ #include "debug.h"
+ 
+-void __brcmf_err(const char *func, const char *fmt, ...)
++void __brcmf_err(struct brcmf_bus *bus, const char *func, const char *fmt, ...)
+ {
+ 	struct va_format vaf = {
+ 		.fmt = fmt,
+@@ -30,7 +32,10 @@ void __brcmf_err(const char *func, const
+ 
+ 	va_start(args, fmt);
+ 	vaf.va = &args;
+-	pr_err("%s: %pV", func, &vaf);
++	if (bus)
++		dev_err(bus->dev, "%s: %pV", func, &vaf);
++	else
++		pr_err("%s: %pV", func, &vaf);
+ 	trace_brcmf_err(func, &vaf);
+ 	va_end(args);
+ }
diff --git a/package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch b/package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
new file mode 100644
index 0000000000..da529a5bb9
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
@@ -0,0 +1,266 @@
+From 8602e62441aba276cafd68034b72162fbc5ca0a6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 6 Feb 2019 12:28:16 +0100
+Subject: [PATCH] brcmfmac: pass bus to the __brcmf_err() in pcie.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This enables dev_err() usage (instead of pr_err()) in the __brcmf_err().
+It makes error messages more meaningful and is important for debugging
+errors/bugs on systems with multiple brcmfmac supported devices.
+
+All bus files should follow & get updated similarly (soon).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/debug.h       |  2 +
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 59 +++++++++++--------
+ 2 files changed, 38 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -52,6 +52,7 @@ void __brcmf_err(struct brcmf_bus *bus,
+ /* Macro for error messages. When debugging / tracing the driver all error
+  * messages are important to us.
+  */
++#ifndef brcmf_err
+ #define brcmf_err(fmt, ...)						\
+ 	do {								\
+ 		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
+@@ -59,6 +60,7 @@ void __brcmf_err(struct brcmf_bus *bus,
+ 		    net_ratelimit())					\
+ 			__brcmf_err(NULL, __func__, fmt, ##__VA_ARGS__);\
+ 	} while (0)
++#endif
+ 
+ #if defined(DEBUG) || defined(CPTCFG_BRCM_TRACING)
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -30,6 +30,15 @@
+ #include <brcmu_wifi.h>
+ #include <brcm_hw_ids.h>
+ 
++/* Custom brcmf_err() that takes bus arg and passes it further */
++#define brcmf_err(bus, fmt, ...)					\
++	do {								\
++		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
++		    IS_ENABLED(CPTCFG_BRCM_TRACING) ||			\
++		    net_ratelimit())					\
++			__brcmf_err(bus, __func__, fmt, ##__VA_ARGS__);	\
++	} while (0)
++
+ #include "debug.h"
+ #include "bus.h"
+ #include "commonring.h"
+@@ -531,6 +540,7 @@ static void
+ brcmf_pcie_select_core(struct brcmf_pciedev_info *devinfo, u16 coreid)
+ {
+ 	const struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	struct brcmf_core *core;
+ 	u32 bar0_win;
+ 
+@@ -548,7 +558,7 @@ brcmf_pcie_select_core(struct brcmf_pcie
+ 			}
+ 		}
+ 	} else {
+-		brcmf_err("Unsupported core selected %x\n", coreid);
++		brcmf_err(bus, "Unsupported core selected %x\n", coreid);
+ 	}
+ }
+ 
+@@ -848,9 +858,8 @@ static irqreturn_t brcmf_pcie_isr_thread
+ 
+ static int brcmf_pcie_request_irq(struct brcmf_pciedev_info *devinfo)
+ {
+-	struct pci_dev *pdev;
+-
+-	pdev = devinfo->pdev;
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 
+ 	brcmf_pcie_intr_disable(devinfo);
+ 
+@@ -861,7 +870,7 @@ static int brcmf_pcie_request_irq(struct
+ 				 brcmf_pcie_isr_thread, IRQF_SHARED,
+ 				 "brcmf_pcie_intr", devinfo)) {
+ 		pci_disable_msi(pdev);
+-		brcmf_err("Failed to request IRQ %d\n", pdev->irq);
++		brcmf_err(bus, "Failed to request IRQ %d\n", pdev->irq);
+ 		return -EIO;
+ 	}
+ 	devinfo->irq_allocated = true;
+@@ -871,15 +880,14 @@ static int brcmf_pcie_request_irq(struct
+ 
+ static void brcmf_pcie_release_irq(struct brcmf_pciedev_info *devinfo)
+ {
+-	struct pci_dev *pdev;
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	u32 status;
+ 	u32 count;
+ 
+ 	if (!devinfo->irq_allocated)
+ 		return;
+ 
+-	pdev = devinfo->pdev;
+-
+ 	brcmf_pcie_intr_disable(devinfo);
+ 	free_irq(pdev->irq, devinfo);
+ 	pci_disable_msi(pdev);
+@@ -891,7 +899,7 @@ static void brcmf_pcie_release_irq(struc
+ 		count++;
+ 	}
+ 	if (devinfo->in_irq)
+-		brcmf_err("Still in IRQ (processing) !!!\n");
++		brcmf_err(bus, "Still in IRQ (processing) !!!\n");
+ 
+ 	status = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT);
+ 	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT, status);
+@@ -1102,6 +1110,7 @@ static void brcmf_pcie_release_ringbuffe
+ 
+ static int brcmf_pcie_init_ringbuffers(struct brcmf_pciedev_info *devinfo)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	struct brcmf_pcie_ringbuf *ring;
+ 	struct brcmf_pcie_ringbuf *rings;
+ 	u32 d2h_w_idx_ptr;
+@@ -1254,7 +1263,7 @@ static int brcmf_pcie_init_ringbuffers(s
+ 	return 0;
+ 
+ fail:
+-	brcmf_err("Allocating ring buffers failed\n");
++	brcmf_err(bus, "Allocating ring buffers failed\n");
+ 	brcmf_pcie_release_ringbuffers(devinfo);
+ 	return -ENOMEM;
+ }
+@@ -1277,6 +1286,7 @@ brcmf_pcie_release_scratchbuffers(struct
+ 
+ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	u64 address;
+ 	u32 addr;
+ 
+@@ -1316,7 +1326,7 @@ static int brcmf_pcie_init_scratchbuffer
+ 	return 0;
+ 
+ fail:
+-	brcmf_err("Allocating scratch buffers failed\n");
++	brcmf_err(bus, "Allocating scratch buffers failed\n");
+ 	brcmf_pcie_release_scratchbuffers(devinfo);
+ 	return -ENOMEM;
+ }
+@@ -1437,6 +1447,7 @@ static int
+ brcmf_pcie_init_share_ram_info(struct brcmf_pciedev_info *devinfo,
+ 			       u32 sharedram_addr)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	struct brcmf_pcie_shared_info *shared;
+ 	u32 addr;
+ 
+@@ -1448,7 +1459,8 @@ brcmf_pcie_init_share_ram_info(struct br
+ 	brcmf_dbg(PCIE, "PCIe protocol version %d\n", shared->version);
+ 	if ((shared->version > BRCMF_PCIE_MAX_SHARED_VERSION) ||
+ 	    (shared->version < BRCMF_PCIE_MIN_SHARED_VERSION)) {
+-		brcmf_err("Unsupported PCIE version %d\n", shared->version);
++		brcmf_err(bus, "Unsupported PCIE version %d\n",
++			  shared->version);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -1490,6 +1502,7 @@ static int brcmf_pcie_download_fw_nvram(
+ 					const struct firmware *fw, void *nvram,
+ 					u32 nvram_len)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	u32 sharedram_addr;
+ 	u32 sharedram_addr_written;
+ 	u32 loop_counter;
+@@ -1544,7 +1557,7 @@ static int brcmf_pcie_download_fw_nvram(
+ 		loop_counter--;
+ 	}
+ 	if (sharedram_addr == sharedram_addr_written) {
+-		brcmf_err("FW failed to initialize\n");
++		brcmf_err(bus, "FW failed to initialize\n");
+ 		return -ENODEV;
+ 	}
+ 	brcmf_dbg(PCIE, "Shared RAM addr: 0x%08x\n", sharedram_addr);
+@@ -1555,16 +1568,15 @@ static int brcmf_pcie_download_fw_nvram(
+ 
+ static int brcmf_pcie_get_resource(struct brcmf_pciedev_info *devinfo)
+ {
+-	struct pci_dev *pdev;
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	int err;
+ 	phys_addr_t  bar0_addr, bar1_addr;
+ 	ulong bar1_size;
+ 
+-	pdev = devinfo->pdev;
+-
+ 	err = pci_enable_device(pdev);
+ 	if (err) {
+-		brcmf_err("pci_enable_device failed err=%d\n", err);
++		brcmf_err(bus, "pci_enable_device failed err=%d\n", err);
+ 		return err;
+ 	}
+ 
+@@ -1577,7 +1589,7 @@ static int brcmf_pcie_get_resource(struc
+ 	/* read Bar-1 mapped memory range */
+ 	bar1_size = pci_resource_len(pdev, 2);
+ 	if ((bar1_size == 0) || (bar1_addr == 0)) {
+-		brcmf_err("BAR1 Not enabled, device size=%ld, addr=%#016llx\n",
++		brcmf_err(bus, "BAR1 Not enabled, device size=%ld, addr=%#016llx\n",
+ 			  bar1_size, (unsigned long long)bar1_addr);
+ 		return -EINVAL;
+ 	}
+@@ -1586,7 +1598,7 @@ static int brcmf_pcie_get_resource(struc
+ 	devinfo->tcm = ioremap_nocache(bar1_addr, bar1_size);
+ 
+ 	if (!devinfo->regs || !devinfo->tcm) {
+-		brcmf_err("ioremap() failed (%p,%p)\n", devinfo->regs,
++		brcmf_err(bus, "ioremap() failed (%p,%p)\n", devinfo->regs,
+ 			  devinfo->tcm);
+ 		return -EINVAL;
+ 	}
+@@ -1873,7 +1885,7 @@ fail_bus:
+ 	kfree(bus->msgbuf);
+ 	kfree(bus);
+ fail:
+-	brcmf_err("failed %x:%x\n", pdev->vendor, pdev->device);
++	brcmf_err(NULL, "failed %x:%x\n", pdev->vendor, pdev->device);
+ 	brcmf_pcie_release_resource(devinfo);
+ 	if (devinfo->ci)
+ 		brcmf_chip_detach(devinfo->ci);
+@@ -1947,7 +1959,7 @@ static int brcmf_pcie_pm_enter_D3(struct
+ 	wait_event_timeout(devinfo->mbdata_resp_wait, devinfo->mbdata_completed,
+ 			   BRCMF_PCIE_MBDATA_TIMEOUT);
+ 	if (!devinfo->mbdata_completed) {
+-		brcmf_err("Timeout on response for entering D3 substate\n");
++		brcmf_err(bus, "Timeout on response for entering D3 substate\n");
+ 		brcmf_bus_change_state(bus, BRCMF_BUS_UP);
+ 		return -EIO;
+ 	}
+@@ -1993,7 +2005,7 @@ cleanup:
+ 
+ 	err = brcmf_pcie_probe(pdev, NULL);
+ 	if (err)
+-		brcmf_err("probe after resume failed, err=%d\n", err);
++		brcmf_err(bus, "probe after resume failed, err=%d\n", err);
+ 
+ 	return err;
+ }
+@@ -2065,7 +2077,8 @@ void brcmf_pcie_register(void)
+ 	brcmf_dbg(PCIE, "Enter\n");
+ 	err = pci_register_driver(&brcmf_pciedrvr);
+ 	if (err)
+-		brcmf_err("PCIE driver registration failed, err=%d\n", err);
++		brcmf_err(NULL, "PCIE driver registration failed, err=%d\n",
++			  err);
+ }
+ 
+ 
diff --git a/package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch b/package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
new file mode 100644
index 0000000000..d767fbb65e
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
@@ -0,0 +1,2008 @@
+From 3ef005b82e2ad68107fc5814eaa743d171a6c362 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 16 Jan 2019 07:28:54 +0100
+Subject: [PATCH] brcmfmac: add bphy_err() and use it in the cfg80211.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This new macro uses wiphy_err() which:
+1) Should be the best choice with wiphy already created
+2) Uses dev_err() which allows identifying error-affected device
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 497 ++++++++++--------
+ .../broadcom/brcm80211/brcmfmac/debug.h       |   9 +
+ 2 files changed, 282 insertions(+), 224 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -457,6 +457,7 @@ static void convert_key_from_CPU(struct
+ static int
+ send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	int err;
+ 	struct brcmf_wsec_key_le key_le;
+ 
+@@ -468,7 +469,7 @@ send_key_to_dongle(struct brcmf_if *ifp,
+ 					sizeof(key_le));
+ 
+ 	if (err)
+-		brcmf_err("wsec_key error (%d)\n", err);
++		bphy_err(wiphy, "wsec_key error (%d)\n", err);
+ 	return err;
+ }
+ 
+@@ -508,6 +509,7 @@ static int brcmf_get_first_free_bsscfgid
+ 
+ static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_mbss_ssid_le mbss_ssid_le;
+ 	int bsscfgidx;
+ 	int err;
+@@ -524,7 +526,7 @@ static int brcmf_cfg80211_request_ap_if(
+ 	err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
+ 					sizeof(mbss_ssid_le));
+ 	if (err < 0)
+-		brcmf_err("setting ssid failed %d\n", err);
++		bphy_err(wiphy, "setting ssid failed %d\n", err);
+ 
+ 	return err;
+ }
+@@ -567,7 +569,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ 					    BRCMF_VIF_EVENT_TIMEOUT);
+ 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
+ 	if (!err) {
+-		brcmf_err("timeout occurred\n");
++		bphy_err(wiphy, "timeout occurred\n");
+ 		err = -EIO;
+ 		goto fail;
+ 	}
+@@ -575,7 +577,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ 	/* interface created in firmware */
+ 	ifp = vif->ifp;
+ 	if (!ifp) {
+-		brcmf_err("no if pointer provided\n");
++		bphy_err(wiphy, "no if pointer provided\n");
+ 		err = -ENOENT;
+ 		goto fail;
+ 	}
+@@ -583,7 +585,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ 	strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
+ 	err = brcmf_net_attach(ifp, true);
+ 	if (err) {
+-		brcmf_err("Registering netdevice failed\n");
++		bphy_err(wiphy, "Registering netdevice failed\n");
+ 		free_netdev(ifp->ndev);
+ 		goto fail;
+ 	}
+@@ -620,7 +622,7 @@ static struct wireless_dev *brcmf_cfg802
+ 	brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
+ 	err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
+ 	if (err) {
+-		brcmf_err("iface validation failed: err=%d\n", err);
++		bphy_err(wiphy, "iface validation failed: err=%d\n", err);
+ 		return ERR_PTR(err);
+ 	}
+ 	switch (type) {
+@@ -645,8 +647,8 @@ static struct wireless_dev *brcmf_cfg802
+ 	}
+ 
+ 	if (IS_ERR(wdev))
+-		brcmf_err("add iface %s type %d failed: err=%d\n",
+-			  name, type, (int)PTR_ERR(wdev));
++		bphy_err(wiphy, "add iface %s type %d failed: err=%d\n", name,
++			 type, (int)PTR_ERR(wdev));
+ 	else
+ 		brcmf_cfg80211_update_proto_addr_mode(wdev);
+ 
+@@ -661,12 +663,13 @@ static void brcmf_scan_config_mpc(struct
+ 
+ void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err = 0;
+ 
+ 	if (check_vif_up(ifp->vif)) {
+ 		err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
+ 		if (err) {
+-			brcmf_err("fail to set mpc\n");
++			bphy_err(wiphy, "fail to set mpc\n");
+ 			return;
+ 		}
+ 		brcmf_dbg(INFO, "MPC : %d\n", mpc);
+@@ -677,6 +680,7 @@ s32 brcmf_notify_escan_complete(struct b
+ 				struct brcmf_if *ifp, bool aborted,
+ 				bool fw_abort)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_scan_params_le params_le;
+ 	struct cfg80211_scan_request *scan_request;
+ 	u64 reqid;
+@@ -711,7 +715,7 @@ s32 brcmf_notify_escan_complete(struct b
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
+ 					     &params_le, sizeof(params_le));
+ 		if (err)
+-			brcmf_err("Scan abort failed\n");
++			bphy_err(wiphy, "Scan abort failed\n");
+ 	}
+ 
+ 	brcmf_scan_config_mpc(ifp, 1);
+@@ -763,7 +767,7 @@ static int brcmf_cfg80211_del_ap_iface(s
+ 
+ 	err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
+ 	if (err) {
+-		brcmf_err("interface_remove failed %d\n", err);
++		bphy_err(wiphy, "interface_remove failed %d\n", err);
+ 		goto err_unarm;
+ 	}
+ 
+@@ -771,7 +775,7 @@ static int brcmf_cfg80211_del_ap_iface(s
+ 	ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
+ 					    BRCMF_VIF_EVENT_TIMEOUT);
+ 	if (!ret) {
+-		brcmf_err("timeout occurred\n");
++		bphy_err(wiphy, "timeout occurred\n");
+ 		err = -EIO;
+ 		goto err_unarm;
+ 	}
+@@ -873,14 +877,14 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 	}
+ 	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
+ 	if (err) {
+-		brcmf_err("iface validation failed: err=%d\n", err);
++		bphy_err(wiphy, "iface validation failed: err=%d\n", err);
+ 		return err;
+ 	}
+ 	switch (type) {
+ 	case NL80211_IFTYPE_MONITOR:
+ 	case NL80211_IFTYPE_WDS:
+-		brcmf_err("type (%d) : currently we do not support this type\n",
+-			  type);
++		bphy_err(wiphy, "type (%d) : currently we do not support this type\n",
++			 type);
+ 		return -EOPNOTSUPP;
+ 	case NL80211_IFTYPE_ADHOC:
+ 		infra = 0;
+@@ -908,7 +912,7 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 	} else {
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
+ 		if (err) {
+-			brcmf_err("WLC_SET_INFRA error (%d)\n", err);
++			bphy_err(wiphy, "WLC_SET_INFRA error (%d)\n", err);
+ 			err = -EAGAIN;
+ 			goto done;
+ 		}
+@@ -999,6 +1003,7 @@ static s32
+ brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
+ 		struct cfg80211_scan_request *request)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
+ 			  offsetof(struct brcmf_escan_params_le, params_le);
+ 	struct brcmf_escan_params_le *params;
+@@ -1030,7 +1035,7 @@ brcmf_run_escan(struct brcmf_cfg80211_in
+ 		if (err == -EBUSY)
+ 			brcmf_dbg(INFO, "system busy : escan canceled\n");
+ 		else
+-			brcmf_err("error (%d)\n", err);
++			bphy_err(wiphy, "error (%d)\n", err);
+ 	}
+ 
+ 	kfree(params);
+@@ -1076,21 +1081,22 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 		return -EIO;
+ 
+ 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+-		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
++		bphy_err(wiphy, "Scanning already: status (%lu)\n",
++			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 	if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
+-		brcmf_err("Scanning being aborted: status (%lu)\n",
+-			  cfg->scan_status);
++		bphy_err(wiphy, "Scanning being aborted: status (%lu)\n",
++			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
+-		brcmf_err("Scanning suppressed: status (%lu)\n",
+-			  cfg->scan_status);
++		bphy_err(wiphy, "Scanning suppressed: status (%lu)\n",
++			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
+-		brcmf_err("Connecting: status (%lu)\n", vif->sme_state);
++		bphy_err(wiphy, "Connecting: status (%lu)\n", vif->sme_state);
+ 		return -EAGAIN;
+ 	}
+ 
+@@ -1124,7 +1130,7 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 	return 0;
+ 
+ scan_out:
+-	brcmf_err("scan error (%d)\n", err);
++	bphy_err(wiphy, "scan error (%d)\n", err);
+ 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 	cfg->scan_request = NULL;
+ 	return err;
+@@ -1132,36 +1138,41 @@ scan_out:
+ 
+ static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err = 0;
+ 
+-	err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
+-				      rts_threshold);
++	err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
+ 	if (err)
+-		brcmf_err("Error (%d)\n", err);
++		bphy_err(wiphy, "Error (%d)\n", err);
+ 
+ 	return err;
+ }
+ 
+ static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err = 0;
+ 
+-	err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
++	err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
+ 				      frag_threshold);
+ 	if (err)
+-		brcmf_err("Error (%d)\n", err);
++		bphy_err(wiphy, "Error (%d)\n", err);
+ 
+ 	return err;
+ }
+ 
+ static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err = 0;
+ 	u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
+ 
+-	err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
++	err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
+ 	if (err) {
+-		brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
++		bphy_err(wiphy, "cmd (%d) , error (%d)\n", cmd, err);
+ 		return err;
+ 	}
+ 	return err;
+@@ -1237,6 +1248,7 @@ static u16 brcmf_map_fw_linkdown_reason(
+ 
+ static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_wsec_pmk_le pmk;
+ 	int i, err;
+ 
+@@ -1250,8 +1262,8 @@ static int brcmf_set_pmk(struct brcmf_if
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
+ 				     &pmk, sizeof(pmk));
+ 	if (err < 0)
+-		brcmf_err("failed to change PSK in firmware (len=%u)\n",
+-			  pmk_len);
++		bphy_err(wiphy, "failed to change PSK in firmware (len=%u)\n",
++			 pmk_len);
+ 
+ 	return err;
+ }
+@@ -1259,6 +1271,7 @@ static int brcmf_set_pmk(struct brcmf_if
+ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	s32 err = 0;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+@@ -1268,7 +1281,7 @@ static void brcmf_link_down(struct brcmf
+ 		err = brcmf_fil_cmd_data_set(vif->ifp,
+ 					     BRCMF_C_DISASSOC, NULL, 0);
+ 		if (err) {
+-			brcmf_err("WLC_DISASSOC failed (%d)\n", err);
++			bphy_err(wiphy, "WLC_DISASSOC failed (%d)\n", err);
+ 		}
+ 		if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
+ 		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
+@@ -1356,7 +1369,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 
+ 	err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
+ 	if (err) {
+-		brcmf_err("wsec failed (%d)\n", err);
++		bphy_err(wiphy, "wsec failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1368,7 +1381,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
+ 	if (err) {
+-		brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
++		bphy_err(wiphy, "WLC_SET_BCNPRD failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1413,7 +1426,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
+ 					    target_channel);
+ 		if (err) {
+-			brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
++			bphy_err(wiphy, "WLC_SET_CHANNEL failed (%d)\n", err);
+ 			goto done;
+ 		}
+ 	} else
+@@ -1425,7 +1438,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 				     &join_params, join_params_size);
+ 	if (err) {
+-		brcmf_err("WLC_SET_SSID failed (%d)\n", err);
++		bphy_err(wiphy, "WLC_SET_SSID failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1461,6 +1474,8 @@ brcmf_cfg80211_leave_ibss(struct wiphy *
+ static s32 brcmf_set_wpa_version(struct net_device *ndev,
+ 				 struct cfg80211_connect_params *sme)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 val = 0;
+@@ -1473,9 +1488,9 @@ static s32 brcmf_set_wpa_version(struct
+ 	else
+ 		val = WPA_AUTH_DISABLED;
+ 	brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
+-	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
++	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
+ 	if (err) {
+-		brcmf_err("set wpa_auth failed (%d)\n", err);
++		bphy_err(wiphy, "set wpa_auth failed (%d)\n", err);
+ 		return err;
+ 	}
+ 	sec = &profile->sec;
+@@ -1486,6 +1501,8 @@ static s32 brcmf_set_wpa_version(struct
+ static s32 brcmf_set_auth_type(struct net_device *ndev,
+ 			       struct cfg80211_connect_params *sme)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 val = 0;
+@@ -1506,9 +1523,9 @@ static s32 brcmf_set_auth_type(struct ne
+ 		break;
+ 	}
+ 
+-	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
++	err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
+ 	if (err) {
+-		brcmf_err("set auth failed (%d)\n", err);
++		bphy_err(wiphy, "set auth failed (%d)\n", err);
+ 		return err;
+ 	}
+ 	sec = &profile->sec;
+@@ -1520,6 +1537,8 @@ static s32
+ brcmf_set_wsec_mode(struct net_device *ndev,
+ 		    struct cfg80211_connect_params *sme)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 pval = 0;
+@@ -1543,8 +1562,8 @@ brcmf_set_wsec_mode(struct net_device *n
+ 			pval = AES_ENABLED;
+ 			break;
+ 		default:
+-			brcmf_err("invalid cipher pairwise (%d)\n",
+-				  sme->crypto.ciphers_pairwise[0]);
++			bphy_err(wiphy, "invalid cipher pairwise (%d)\n",
++				 sme->crypto.ciphers_pairwise[0]);
+ 			return -EINVAL;
+ 		}
+ 	}
+@@ -1564,8 +1583,8 @@ brcmf_set_wsec_mode(struct net_device *n
+ 			gval = AES_ENABLED;
+ 			break;
+ 		default:
+-			brcmf_err("invalid cipher group (%d)\n",
+-				  sme->crypto.cipher_group);
++			bphy_err(wiphy, "invalid cipher group (%d)\n",
++				 sme->crypto.cipher_group);
+ 			return -EINVAL;
+ 		}
+ 	}
+@@ -1578,9 +1597,9 @@ brcmf_set_wsec_mode(struct net_device *n
+ 		pval = AES_ENABLED;
+ 
+ 	wsec = pval | gval;
+-	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
++	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err) {
+-		brcmf_err("error (%d)\n", err);
++		bphy_err(wiphy, "error (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -1595,6 +1614,7 @@ static s32
+ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
+ 	s32 val;
+ 	s32 err;
+@@ -1613,7 +1633,7 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 
+ 	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
+ 	if (err) {
+-		brcmf_err("could not get wpa_auth (%d)\n", err);
++		bphy_err(wiphy, "could not get wpa_auth (%d)\n", err);
+ 		return err;
+ 	}
+ 	if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+@@ -1627,8 +1647,8 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 			val = WPA_AUTH_PSK;
+ 			break;
+ 		default:
+-			brcmf_err("invalid cipher group (%d)\n",
+-				  sme->crypto.cipher_group);
++			bphy_err(wiphy, "invalid cipher group (%d)\n",
++				 sme->crypto.cipher_group);
+ 			return -EINVAL;
+ 		}
+ 	} else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
+@@ -1650,8 +1670,8 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 			val = WPA2_AUTH_PSK;
+ 			break;
+ 		default:
+-			brcmf_err("invalid cipher group (%d)\n",
+-				  sme->crypto.cipher_group);
++			bphy_err(wiphy, "invalid cipher group (%d)\n",
++				 sme->crypto.cipher_group);
+ 			return -EINVAL;
+ 		}
+ 	}
+@@ -1697,7 +1717,7 @@ skip_mfp_config:
+ 	brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
+ 	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
+ 	if (err) {
+-		brcmf_err("could not set wpa_auth (%d)\n", err);
++		bphy_err(wiphy, "could not set wpa_auth (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -1708,6 +1728,8 @@ static s32
+ brcmf_set_sharedkey(struct net_device *ndev,
+ 		    struct cfg80211_connect_params *sme)
+ {
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
+ 	struct brcmf_cfg80211_security *sec;
+ 	struct brcmf_wsec_key key;
+@@ -1734,7 +1756,7 @@ brcmf_set_sharedkey(struct net_device *n
+ 	key.len = (u32) sme->key_len;
+ 	key.index = (u32) sme->key_idx;
+ 	if (key.len > sizeof(key.data)) {
+-		brcmf_err("Too long key length (%u)\n", key.len);
++		bphy_err(wiphy, "Too long key length (%u)\n", key.len);
+ 		return -EINVAL;
+ 	}
+ 	memcpy(key.data, sme->key, key.len);
+@@ -1747,24 +1769,24 @@ brcmf_set_sharedkey(struct net_device *n
+ 		key.algo = CRYPTO_ALGO_WEP128;
+ 		break;
+ 	default:
+-		brcmf_err("Invalid algorithm (%d)\n",
+-			  sme->crypto.ciphers_pairwise[0]);
++		bphy_err(wiphy, "Invalid algorithm (%d)\n",
++			 sme->crypto.ciphers_pairwise[0]);
+ 		return -EINVAL;
+ 	}
+ 	/* Set the new key/index */
+ 	brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
+ 		  key.len, key.index, key.algo);
+ 	brcmf_dbg(CONN, "key \"%s\"\n", key.data);
+-	err = send_key_to_dongle(netdev_priv(ndev), &key);
++	err = send_key_to_dongle(ifp, &key);
+ 	if (err)
+ 		return err;
+ 
+ 	if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
+ 		brcmf_dbg(CONN, "set auth_type to shared key\n");
+ 		val = WL_AUTH_SHARED_KEY;	/* shared key */
+-		err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
++		err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
+ 		if (err)
+-			brcmf_err("set auth failed (%d)\n", err);
++			bphy_err(wiphy, "set auth failed (%d)\n", err);
+ 	}
+ 	return err;
+ }
+@@ -1784,6 +1806,7 @@ enum nl80211_auth_type brcmf_war_auth_ty
+ static void brcmf_set_join_pref(struct brcmf_if *ifp,
+ 				struct cfg80211_bss_selection *bss_select)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_join_pref_params join_pref_params[2];
+ 	enum nl80211_band band;
+ 	int err, i = 0;
+@@ -1822,7 +1845,7 @@ static void brcmf_set_join_pref(struct b
+ 	err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+ 				       sizeof(join_pref_params));
+ 	if (err)
+-		brcmf_err("Set join_pref error (%d)\n", err);
++		bphy_err(wiphy, "Set join_pref error (%d)\n", err);
+ }
+ 
+ static s32
+@@ -1849,7 +1872,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 		return -EIO;
+ 
+ 	if (!sme->ssid) {
+-		brcmf_err("Invalid ssid\n");
++		bphy_err(wiphy, "Invalid ssid\n");
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+@@ -1878,7 +1901,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
+ 				    sme->ie, sme->ie_len);
+ 	if (err)
+-		brcmf_err("Set Assoc REQ IE Failed\n");
++		bphy_err(wiphy, "Set Assoc REQ IE Failed\n");
+ 	else
+ 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
+ 
+@@ -1899,32 +1922,32 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 
+ 	err = brcmf_set_wpa_version(ndev, sme);
+ 	if (err) {
+-		brcmf_err("wl_set_wpa_version failed (%d)\n", err);
++		bphy_err(wiphy, "wl_set_wpa_version failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
+ 	err = brcmf_set_auth_type(ndev, sme);
+ 	if (err) {
+-		brcmf_err("wl_set_auth_type failed (%d)\n", err);
++		bphy_err(wiphy, "wl_set_auth_type failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	err = brcmf_set_wsec_mode(ndev, sme);
+ 	if (err) {
+-		brcmf_err("wl_set_set_cipher failed (%d)\n", err);
++		bphy_err(wiphy, "wl_set_set_cipher failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	err = brcmf_set_key_mgmt(ndev, sme);
+ 	if (err) {
+-		brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
++		bphy_err(wiphy, "wl_set_key_mgmt failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	err = brcmf_set_sharedkey(ndev, sme);
+ 	if (err) {
+-		brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
++		bphy_err(wiphy, "brcmf_set_sharedkey failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1941,7 +1964,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 		/* enable firmware supplicant for this interface */
+ 		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
+ 		if (err < 0) {
+-			brcmf_err("failed to enable fw supplicant\n");
++			bphy_err(wiphy, "failed to enable fw supplicant\n");
+ 			goto done;
+ 		}
+ 	}
+@@ -2036,7 +2059,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 				     &join_params, join_params_size);
+ 	if (err)
+-		brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
++		bphy_err(wiphy, "BRCMF_C_SET_SSID failed (%d)\n", err);
+ 
+ done:
+ 	if (err)
+@@ -2067,7 +2090,7 @@ brcmf_cfg80211_disconnect(struct wiphy *
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
+ 				     &scbval, sizeof(scbval));
+ 	if (err)
+-		brcmf_err("error (%d)\n", err);
++		bphy_err(wiphy, "error (%d)\n", err);
+ 
+ 	brcmf_dbg(TRACE, "Exit\n");
+ 	return err;
+@@ -2094,7 +2117,7 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 	case NL80211_TX_POWER_LIMITED:
+ 	case NL80211_TX_POWER_FIXED:
+ 		if (mbm < 0) {
+-			brcmf_err("TX_POWER_FIXED - dbm is negative\n");
++			bphy_err(wiphy, "TX_POWER_FIXED - dbm is negative\n");
+ 			err = -EINVAL;
+ 			goto done;
+ 		}
+@@ -2104,7 +2127,7 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 		qdbm |= WL_TXPWR_OVERRIDE;
+ 		break;
+ 	default:
+-		brcmf_err("Unsupported type %d\n", type);
++		bphy_err(wiphy, "Unsupported type %d\n", type);
+ 		err = -EINVAL;
+ 		goto done;
+ 	}
+@@ -2112,11 +2135,11 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 	disable = WL_RADIO_SW_DISABLE << 16;
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
+ 	if (err)
+-		brcmf_err("WLC_SET_RADIO error (%d)\n", err);
++		bphy_err(wiphy, "WLC_SET_RADIO error (%d)\n", err);
+ 
+ 	err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
+ 	if (err)
+-		brcmf_err("qtxpower error (%d)\n", err);
++		bphy_err(wiphy, "qtxpower error (%d)\n", err);
+ 
+ done:
+ 	brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
+@@ -2137,7 +2160,7 @@ brcmf_cfg80211_get_tx_power(struct wiphy
+ 
+ 	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
+ 	if (err) {
+-		brcmf_err("error (%d)\n", err);
++		bphy_err(wiphy, "error (%d)\n", err);
+ 		goto done;
+ 	}
+ 	*dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
+@@ -2163,7 +2186,7 @@ brcmf_cfg80211_config_default_key(struct
+ 
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		brcmf_err("WLC_GET_WSEC error (%d)\n", err);
++		bphy_err(wiphy, "WLC_GET_WSEC error (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -2173,7 +2196,7 @@ brcmf_cfg80211_config_default_key(struct
+ 		err = brcmf_fil_cmd_int_set(ifp,
+ 					    BRCMF_C_SET_KEY_PRIMARY, index);
+ 		if (err)
+-			brcmf_err("error (%d)\n", err);
++			bphy_err(wiphy, "error (%d)\n", err);
+ 	}
+ done:
+ 	brcmf_dbg(TRACE, "Exit\n");
+@@ -2237,7 +2260,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 
+ 	if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
+ 		/* we ignore this key index in this case */
+-		brcmf_err("invalid key index (%d)\n", key_idx);
++		bphy_err(wiphy, "invalid key index (%d)\n", key_idx);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2246,7 +2269,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 					      mac_addr);
+ 
+ 	if (params->key_len > sizeof(key->data)) {
+-		brcmf_err("Too long key length (%u)\n", params->key_len);
++		bphy_err(wiphy, "Too long key length (%u)\n", params->key_len);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2300,7 +2323,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
+ 		break;
+ 	default:
+-		brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
++		bphy_err(wiphy, "Invalid cipher (0x%x)\n", params->cipher);
+ 		err = -EINVAL;
+ 		goto done;
+ 	}
+@@ -2311,13 +2334,13 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		brcmf_err("get wsec error (%d)\n", err);
++		bphy_err(wiphy, "get wsec error (%d)\n", err);
+ 		goto done;
+ 	}
+ 	wsec |= val;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err) {
+-		brcmf_err("set wsec error (%d)\n", err);
++		bphy_err(wiphy, "set wsec error (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -2348,7 +2371,7 @@ brcmf_cfg80211_get_key(struct wiphy *wip
+ 
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		brcmf_err("WLC_GET_WSEC error (%d)\n", err);
++		bphy_err(wiphy, "WLC_GET_WSEC error (%d)\n", err);
+ 		/* Ignore this error, may happen during DISASSOC */
+ 		err = -EAGAIN;
+ 		goto done;
+@@ -2369,7 +2392,7 @@ brcmf_cfg80211_get_key(struct wiphy *wip
+ 		params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+ 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
+ 	} else  {
+-		brcmf_err("Invalid algo (0x%x)\n", wsec);
++		bphy_err(wiphy, "Invalid algo (0x%x)\n", wsec);
+ 		err = -EINVAL;
+ 		goto done;
+ 	}
+@@ -2399,6 +2422,7 @@ brcmf_cfg80211_config_default_mgmt_key(s
+ static void
+ brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err;
+ 	u8 key_idx;
+ 	struct brcmf_wsec_key *key;
+@@ -2415,18 +2439,18 @@ brcmf_cfg80211_reconfigure_wep(struct br
+ 
+ 	err = send_key_to_dongle(ifp, key);
+ 	if (err) {
+-		brcmf_err("Setting WEP key failed (%d)\n", err);
++		bphy_err(wiphy, "Setting WEP key failed (%d)\n", err);
+ 		return;
+ 	}
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		brcmf_err("get wsec error (%d)\n", err);
++		bphy_err(wiphy, "get wsec error (%d)\n", err);
+ 		return;
+ 	}
+ 	wsec |= WEP_ENABLED;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err)
+-		brcmf_err("set wsec error (%d)\n", err);
++		bphy_err(wiphy, "set wsec error (%d)\n", err);
+ }
+ 
+ static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
+@@ -2452,6 +2476,7 @@ static void brcmf_convert_sta_flags(u32
+ 
+ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct {
+ 		__le32 len;
+ 		struct brcmf_bss_info_le bss_le;
+@@ -2467,7 +2492,7 @@ static void brcmf_fill_bss_param(struct
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
+ 				     WL_BSS_INFO_MAX);
+ 	if (err) {
+-		brcmf_err("Failed to get bss info (%d)\n", err);
++		bphy_err(wiphy, "Failed to get bss info (%d)\n", err);
+ 		goto out_kfree;
+ 	}
+ 	si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
+@@ -2489,6 +2514,7 @@ static s32
+ brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
+ 				struct station_info *sinfo)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_scb_val_le scbval;
+ 	struct brcmf_pktcnt_le pktcnt;
+ 	s32 err;
+@@ -2498,7 +2524,7 @@ brcmf_cfg80211_get_station_ibss(struct b
+ 	/* Get the current tx rate */
+ 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
+ 	if (err < 0) {
+-		brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
++		bphy_err(wiphy, "BRCMF_C_GET_RATE error (%d)\n", err);
+ 		return err;
+ 	}
+ 	sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+@@ -2508,7 +2534,7 @@ brcmf_cfg80211_get_station_ibss(struct b
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
+ 				     sizeof(scbval));
+ 	if (err) {
+-		brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
++		bphy_err(wiphy, "BRCMF_C_GET_RSSI error (%d)\n", err);
+ 		return err;
+ 	}
+ 	rssi = le32_to_cpu(scbval.val);
+@@ -2518,7 +2544,7 @@ brcmf_cfg80211_get_station_ibss(struct b
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
+ 				     sizeof(pktcnt));
+ 	if (err) {
+-		brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
++		bphy_err(wiphy, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
+ 		return err;
+ 	}
+ 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
+@@ -2566,7 +2592,7 @@ brcmf_cfg80211_get_station(struct wiphy
+ 					       &sta_info_le,
+ 					       sizeof(sta_info_le));
+ 		if (err < 0) {
+-			brcmf_err("GET STA INFO failed, %d\n", err);
++			bphy_err(wiphy, "GET STA INFO failed, %d\n", err);
+ 			goto done;
+ 		}
+ 	}
+@@ -2635,7 +2661,8 @@ brcmf_cfg80211_get_station(struct wiphy
+ 			err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
+ 						     &scb_val, sizeof(scb_val));
+ 			if (err) {
+-				brcmf_err("Could not get rssi (%d)\n", err);
++				bphy_err(wiphy, "Could not get rssi (%d)\n",
++					 err);
+ 				goto done;
+ 			} else {
+ 				rssi = le32_to_cpu(scb_val.val);
+@@ -2666,8 +2693,8 @@ brcmf_cfg80211_dump_station(struct wiphy
+ 					     &cfg->assoclist,
+ 					     sizeof(cfg->assoclist));
+ 		if (err) {
+-			brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
+-				  err);
++			bphy_err(wiphy, "BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
++				 err);
+ 			cfg->assoclist.count = 0;
+ 			return -EOPNOTSUPP;
+ 		}
+@@ -2715,9 +2742,9 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
+ 	if (err) {
+ 		if (err == -ENODEV)
+-			brcmf_err("net_device is not ready yet\n");
++			bphy_err(wiphy, "net_device is not ready yet\n");
+ 		else
+-			brcmf_err("error (%d)\n", err);
++			bphy_err(wiphy, "error (%d)\n", err);
+ 	}
+ done:
+ 	brcmf_dbg(TRACE, "Exit\n");
+@@ -2740,7 +2767,7 @@ static s32 brcmf_inform_single_bss(struc
+ 	struct cfg80211_inform_bss bss_data = {};
+ 
+ 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
+-		brcmf_err("Bss info is larger than buffer. Discarding\n");
++		bphy_err(wiphy, "Bss info is larger than buffer. Discarding\n");
+ 		return 0;
+ 	}
+ 
+@@ -2799,6 +2826,7 @@ next_bss_le(struct brcmf_scan_results *l
+ 
+ static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_scan_results *bss_list;
+ 	struct brcmf_bss_info_le *bi = NULL;	/* must be initialized */
+ 	s32 err = 0;
+@@ -2807,8 +2835,8 @@ static s32 brcmf_inform_bss(struct brcmf
+ 	bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
+ 	if (bss_list->count != 0 &&
+ 	    bss_list->version != BRCMF_BSS_INFO_VERSION) {
+-		brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
+-			  bss_list->version);
++		bphy_err(wiphy, "Version %d != WL_BSS_INFO_VERSION\n",
++			 bss_list->version);
+ 		return -EOPNOTSUPP;
+ 	}
+ 	brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
+@@ -2852,7 +2880,7 @@ static s32 brcmf_inform_ibss(struct brcm
+ 	err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
+ 				     buf, WL_BSS_INFO_MAX);
+ 	if (err) {
+-		brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
++		bphy_err(wiphy, "WLC_GET_BSS_INFO failed: %d\n", err);
+ 		goto CleanUp;
+ 	}
+ 
+@@ -2906,6 +2934,7 @@ CleanUp:
+ static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
+ 				 struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_bss_info_le *bi;
+ 	const struct brcmf_tlv *tim;
+ 	u16 beacon_interval;
+@@ -2922,7 +2951,7 @@ static s32 brcmf_update_bss_info(struct
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
+ 				     cfg->extra_buf, WL_EXTRA_BUF_MAX);
+ 	if (err) {
+-		brcmf_err("Could not get bss info %d\n", err);
++		bphy_err(wiphy, "Could not get bss info %d\n", err);
+ 		goto update_bss_info_out;
+ 	}
+ 
+@@ -2947,7 +2976,7 @@ static s32 brcmf_update_bss_info(struct
+ 		u32 var;
+ 		err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
+ 		if (err) {
+-			brcmf_err("wl dtim_assoc failed (%d)\n", err);
++			bphy_err(wiphy, "wl dtim_assoc failed (%d)\n", err);
+ 			goto update_bss_info_out;
+ 		}
+ 		dtim_period = (u8)var;
+@@ -2985,9 +3014,10 @@ static void brcmf_escan_timeout(unsigned
+ {
+ 	struct brcmf_cfg80211_info *cfg =
+ 			(struct brcmf_cfg80211_info *)data;
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 
+ 	if (cfg->int_escan_map || cfg->scan_request) {
+-		brcmf_err("timer expired\n");
++		bphy_err(wiphy, "timer expired\n");
+ 		schedule_work(&cfg->escan_timeout_work);
+ 	}
+ }
+@@ -3036,6 +3066,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 			     const struct brcmf_event_msg *e, void *data)
+ {
+ 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	s32 status;
+ 	struct brcmf_escan_result_le *escan_result_le;
+ 	u32 escan_buflen;
+@@ -3052,32 +3083,33 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		goto exit;
+ 
+ 	if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+-		brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
++		bphy_err(wiphy, "scan not ready, bsscfgidx=%d\n",
++			 ifp->bsscfgidx);
+ 		return -EPERM;
+ 	}
+ 
+ 	if (status == BRCMF_E_STATUS_PARTIAL) {
+ 		brcmf_dbg(SCAN, "ESCAN Partial result\n");
+ 		if (e->datalen < sizeof(*escan_result_le)) {
+-			brcmf_err("invalid event data length\n");
++			bphy_err(wiphy, "invalid event data length\n");
+ 			goto exit;
+ 		}
+ 		escan_result_le = (struct brcmf_escan_result_le *) data;
+ 		if (!escan_result_le) {
+-			brcmf_err("Invalid escan result (NULL pointer)\n");
++			bphy_err(wiphy, "Invalid escan result (NULL pointer)\n");
+ 			goto exit;
+ 		}
+ 		escan_buflen = le32_to_cpu(escan_result_le->buflen);
+ 		if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+ 		    escan_buflen > e->datalen ||
+ 		    escan_buflen < sizeof(*escan_result_le)) {
+-			brcmf_err("Invalid escan buffer length: %d\n",
+-				  escan_buflen);
++			bphy_err(wiphy, "Invalid escan buffer length: %d\n",
++				 escan_buflen);
+ 			goto exit;
+ 		}
+ 		if (le16_to_cpu(escan_result_le->bss_count) != 1) {
+-			brcmf_err("Invalid bss_count %d: ignoring\n",
+-				  escan_result_le->bss_count);
++			bphy_err(wiphy, "Invalid bss_count %d: ignoring\n",
++				 escan_result_le->bss_count);
+ 			goto exit;
+ 		}
+ 		bss_info_le = &escan_result_le->bss_info_le;
+@@ -3092,8 +3124,8 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 
+ 		bi_length = le32_to_cpu(bss_info_le->length);
+ 		if (bi_length != escan_buflen -	WL_ESCAN_RESULTS_FIXED_SIZE) {
+-			brcmf_err("Ignoring invalid bss_info length: %d\n",
+-				  bi_length);
++			bphy_err(wiphy, "Ignoring invalid bss_info length: %d\n",
++				 bi_length);
+ 			goto exit;
+ 		}
+ 
+@@ -3101,7 +3133,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 					BIT(NL80211_IFTYPE_ADHOC))) {
+ 			if (le16_to_cpu(bss_info_le->capability) &
+ 						WLAN_CAPABILITY_IBSS) {
+-				brcmf_err("Ignoring IBSS result\n");
++				bphy_err(wiphy, "Ignoring IBSS result\n");
+ 				goto exit;
+ 			}
+ 		}
+@@ -3109,7 +3141,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		list = (struct brcmf_scan_results *)
+ 				cfg->escan_info.escan_buf;
+ 		if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
+-			brcmf_err("Buffer is too small: ignoring\n");
++			bphy_err(wiphy, "Buffer is too small: ignoring\n");
+ 			goto exit;
+ 		}
+ 
+@@ -3302,14 +3334,14 @@ brcmf_notify_sched_scan_results(struct b
+ 	WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
+ 	brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
+ 	if (!result_count) {
+-		brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
++		bphy_err(wiphy, "FALSE PNO Event. (pfn_count == 0)\n");
+ 		goto out_err;
+ 	}
+ 
+ 	netinfo_start = brcmf_get_netinfo_array(pfn_result);
+ 	datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
+ 	if (datalen < result_count * sizeof(*netinfo)) {
+-		brcmf_err("insufficient event data\n");
++		bphy_err(wiphy, "insufficient event data\n");
+ 		goto out_err;
+ 	}
+ 
+@@ -3363,8 +3395,8 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 		  req->n_match_sets, req->n_ssids);
+ 
+ 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
+-		brcmf_err("Scanning suppressed: status=%lu\n",
+-			  cfg->scan_status);
++		bphy_err(wiphy, "Scanning suppressed: status=%lu\n",
++			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 
+@@ -3443,6 +3475,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+ 		      void *data)
+ {
+ 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_pno_scanresults_le *pfn_result;
+ 	struct brcmf_pno_net_info_le *netinfo;
+ 
+@@ -3461,8 +3494,8 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+ 	}
+ 
+ 	if (le32_to_cpu(pfn_result->count) < 1) {
+-		brcmf_err("Invalid result count, expected 1 (%d)\n",
+-			  le32_to_cpu(pfn_result->count));
++		bphy_err(wiphy, "Invalid result count, expected 1 (%d)\n",
++			 le32_to_cpu(pfn_result->count));
+ 		return -EINVAL;
+ 	}
+ 
+@@ -3499,7 +3532,7 @@ static void brcmf_report_wowl_wakeind(st
+ 	err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
+ 				       sizeof(wake_ind_le));
+ 	if (err) {
+-		brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
++		bphy_err(wiphy, "Get wowl_wakeind failed, err = %d\n", err);
+ 		return;
+ 	}
+ 
+@@ -3540,7 +3573,7 @@ static void brcmf_report_wowl_wakeind(st
+ 				cfg->wowl.nd_data_completed,
+ 				BRCMF_ND_INFO_TIMEOUT);
+ 			if (!timeout)
+-				brcmf_err("No result for wowl net detect\n");
++				bphy_err(wiphy, "No result for wowl net detect\n");
+ 			else
+ 				wakeup_data.net_detect = cfg->wowl.nd_info;
+ 		}
+@@ -3748,7 +3781,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
+ 			cfg->pmk_list.npmk = cpu_to_le32(npmk);
+ 		}
+ 	} else {
+-		brcmf_err("Too many PMKSA entries cached %d\n", npmk);
++		bphy_err(wiphy, "Too many PMKSA entries cached %d\n", npmk);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -3794,7 +3827,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
+ 		memset(&pmk[i], 0, sizeof(*pmk));
+ 		cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
+ 	} else {
+-		brcmf_err("Cache entry not found\n");
++		bphy_err(wiphy, "Cache entry not found\n");
+ 		return -EINVAL;
+ 	}
+ 
+@@ -3826,19 +3859,20 @@ brcmf_cfg80211_flush_pmksa(struct wiphy
+ 
+ static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err;
+ 	s32 wpa_val;
+ 
+ 	/* set auth */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
+ 	if (err < 0) {
+-		brcmf_err("auth error %d\n", err);
++		bphy_err(wiphy, "auth error %d\n", err);
+ 		return err;
+ 	}
+ 	/* set wsec */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
+ 	if (err < 0) {
+-		brcmf_err("wsec error %d\n", err);
++		bphy_err(wiphy, "wsec error %d\n", err);
+ 		return err;
+ 	}
+ 	/* set upper-layer auth */
+@@ -3848,7 +3882,7 @@ static s32 brcmf_configure_opensecurity(
+ 		wpa_val = WPA_AUTH_DISABLED;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
+ 	if (err < 0) {
+-		brcmf_err("wpa_auth error %d\n", err);
++		bphy_err(wiphy, "wpa_auth error %d\n", err);
+ 		return err;
+ 	}
+ 
+@@ -3868,6 +3902,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 		      const struct brcmf_vs_tlv *wpa_ie,
+ 		      bool is_rsn_ie)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	u32 auth = 0; /* d11 open authentication */
+ 	u16 count;
+ 	s32 err = 0;
+@@ -3898,13 +3933,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* check for multicast cipher suite */
+ 	if (offset + WPA_IE_MIN_OUI_LEN > len) {
+ 		err = -EINVAL;
+-		brcmf_err("no multicast cipher suite\n");
++		bphy_err(wiphy, "no multicast cipher suite\n");
+ 		goto exit;
+ 	}
+ 
+ 	if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+ 		err = -EINVAL;
+-		brcmf_err("ivalid OUI\n");
++		bphy_err(wiphy, "ivalid OUI\n");
+ 		goto exit;
+ 	}
+ 	offset += TLV_OUI_LEN;
+@@ -3926,7 +3961,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 		break;
+ 	default:
+ 		err = -EINVAL;
+-		brcmf_err("Invalid multi cast cipher info\n");
++		bphy_err(wiphy, "Invalid multi cast cipher info\n");
+ 		goto exit;
+ 	}
+ 
+@@ -3937,13 +3972,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* Check for unicast suite(s) */
+ 	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
+ 		err = -EINVAL;
+-		brcmf_err("no unicast cipher suite\n");
++		bphy_err(wiphy, "no unicast cipher suite\n");
+ 		goto exit;
+ 	}
+ 	for (i = 0; i < count; i++) {
+ 		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+ 			err = -EINVAL;
+-			brcmf_err("ivalid OUI\n");
++			bphy_err(wiphy, "ivalid OUI\n");
+ 			goto exit;
+ 		}
+ 		offset += TLV_OUI_LEN;
+@@ -3961,7 +3996,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 			pval |= AES_ENABLED;
+ 			break;
+ 		default:
+-			brcmf_err("Invalid unicast security info\n");
++			bphy_err(wiphy, "Invalid unicast security info\n");
+ 		}
+ 		offset++;
+ 	}
+@@ -3971,13 +4006,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* Check for auth key management suite(s) */
+ 	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
+ 		err = -EINVAL;
+-		brcmf_err("no auth key mgmt suite\n");
++		bphy_err(wiphy, "no auth key mgmt suite\n");
+ 		goto exit;
+ 	}
+ 	for (i = 0; i < count; i++) {
+ 		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+ 			err = -EINVAL;
+-			brcmf_err("ivalid OUI\n");
++			bphy_err(wiphy, "ivalid OUI\n");
+ 			goto exit;
+ 		}
+ 		offset += TLV_OUI_LEN;
+@@ -4005,7 +4040,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 			wpa_auth |= WPA2_AUTH_1X_SHA256;
+ 			break;
+ 		default:
+-			brcmf_err("Invalid key mgmt info\n");
++			bphy_err(wiphy, "Invalid key mgmt info\n");
+ 		}
+ 		offset++;
+ 	}
+@@ -4047,7 +4082,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 		err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
+ 					       wme_bss_disable);
+ 		if (err < 0) {
+-			brcmf_err("wme_bss_disable error %d\n", err);
++			bphy_err(wiphy, "wme_bss_disable error %d\n", err);
+ 			goto exit;
+ 		}
+ 
+@@ -4061,7 +4096,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 							&data[offset],
+ 							WPA_IE_MIN_OUI_LEN);
+ 			if (err < 0) {
+-				brcmf_err("bip error %d\n", err);
++				bphy_err(wiphy, "bip error %d\n", err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4072,13 +4107,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* set auth */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
+ 	if (err < 0) {
+-		brcmf_err("auth error %d\n", err);
++		bphy_err(wiphy, "auth error %d\n", err);
+ 		goto exit;
+ 	}
+ 	/* set wsec */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err < 0) {
+-		brcmf_err("wsec error %d\n", err);
++		bphy_err(wiphy, "wsec error %d\n", err);
+ 		goto exit;
+ 	}
+ 	/* Configure MFP, this needs to go after wsec otherwise the wsec command
+@@ -4087,14 +4122,14 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
+ 		err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
+ 		if (err < 0) {
+-			brcmf_err("mfp error %d\n", err);
++			bphy_err(wiphy, "mfp error %d\n", err);
+ 			goto exit;
+ 		}
+ 	}
+ 	/* set upper-layer auth */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
+ 	if (err < 0) {
+-		brcmf_err("wpa_auth error %d\n", err);
++		bphy_err(wiphy, "wpa_auth error %d\n", err);
+ 		goto exit;
+ 	}
+ 
+@@ -4181,6 +4216,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 			  const u8 *vndr_ie_buf, u32 vndr_ie_len)
+ {
+ 	struct brcmf_if *ifp;
++	struct wiphy *wiphy;
+ 	struct vif_saved_ie *saved_ie;
+ 	s32 err = 0;
+ 	u8  *iovar_ie_buf;
+@@ -4201,6 +4237,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 	if (!vif)
+ 		return -ENODEV;
+ 	ifp = vif->ifp;
++	wiphy = ifp->drvr->wiphy;
+ 	saved_ie = &vif->saved_ie;
+ 
+ 	brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
+@@ -4232,13 +4269,13 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 		break;
+ 	default:
+ 		err = -EPERM;
+-		brcmf_err("not suitable type\n");
++		bphy_err(wiphy, "not suitable type\n");
+ 		goto exit;
+ 	}
+ 
+ 	if (vndr_ie_len > mgmt_ie_buf_len) {
+ 		err = -ENOMEM;
+-		brcmf_err("extra IE size too big\n");
++		bphy_err(wiphy, "extra IE size too big\n");
+ 		goto exit;
+ 	}
+ 
+@@ -4299,8 +4336,8 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 			/* verify remained buf size before copy data */
+ 			if (remained_buf_len < (vndrie_info->vndrie.len +
+ 							VNDR_IE_VSIE_OFFSET)) {
+-				brcmf_err("no space in mgmt_ie_buf: len left %d",
+-					  remained_buf_len);
++				bphy_err(wiphy, "no space in mgmt_ie_buf: len left %d",
++					 remained_buf_len);
+ 				break;
+ 			}
+ 			remained_buf_len -= (vndrie_info->ie_len +
+@@ -4331,7 +4368,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 		err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
+ 						 total_ie_buf_len);
+ 		if (err)
+-			brcmf_err("vndr ie set error : %d\n", err);
++			bphy_err(wiphy, "vndr ie set error : %d\n", err);
+ 	}
+ 
+ exit:
+@@ -4359,13 +4396,14 @@ static s32
+ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
+ 			struct cfg80211_beacon_data *beacon)
+ {
++	struct wiphy *wiphy = vif->ifp->drvr->wiphy;
+ 	s32 err;
+ 
+ 	/* Set Beacon IEs to FW */
+ 	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
+ 				    beacon->tail, beacon->tail_len);
+ 	if (err) {
+-		brcmf_err("Set Beacon IE Failed\n");
++		bphy_err(wiphy, "Set Beacon IE Failed\n");
+ 		return err;
+ 	}
+ 	brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
+@@ -4375,7 +4413,7 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg
+ 				    beacon->proberesp_ies,
+ 				    beacon->proberesp_ies_len);
+ 	if (err)
+-		brcmf_err("Set Probe Resp IE Failed\n");
++		bphy_err(wiphy, "Set Probe Resp IE Failed\n");
+ 	else
+ 		brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
+ 
+@@ -4484,7 +4522,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+ 						    is_11d);
+ 			if (err < 0) {
+-				brcmf_err("Regulatory Set Error, %d\n", err);
++				bphy_err(wiphy, "Regulatory Set Error, %d\n",
++					 err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4492,8 +4531,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
+ 						    settings->beacon_interval);
+ 			if (err < 0) {
+-				brcmf_err("Beacon Interval Set Error, %d\n",
+-					  err);
++				bphy_err(wiphy, "Beacon Interval Set Error, %d\n",
++					 err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4501,7 +4540,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
+ 						    settings->dtim_period);
+ 			if (err < 0) {
+-				brcmf_err("DTIM Interval Set Error, %d\n", err);
++				bphy_err(wiphy, "DTIM Interval Set Error, %d\n",
++					 err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4511,7 +4551,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		     !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
+ 			if (err < 0) {
+-				brcmf_err("BRCMF_C_DOWN error %d\n", err);
++				bphy_err(wiphy, "BRCMF_C_DOWN error %d\n",
++					 err);
+ 				goto exit;
+ 			}
+ 			brcmf_fil_iovar_int_set(ifp, "apsta", 0);
+@@ -4519,7 +4560,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
+ 		if (err < 0) {
+-			brcmf_err("SET INFRA error %d\n", err);
++			bphy_err(wiphy, "SET INFRA error %d\n", err);
+ 			goto exit;
+ 		}
+ 	} else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
+@@ -4535,7 +4576,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
+ 		if (err < 0) {
+-			brcmf_err("setting AP mode failed %d\n", err);
++			bphy_err(wiphy, "setting AP mode failed %d\n",
++				 err);
+ 			goto exit;
+ 		}
+ 		if (!mbss) {
+@@ -4544,14 +4586,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			 */
+ 			err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
+ 			if (err < 0) {
+-				brcmf_err("Set Channel failed: chspec=%d, %d\n",
+-					  chanspec, err);
++				bphy_err(wiphy, "Set Channel failed: chspec=%d, %d\n",
++					 chanspec, err);
+ 				goto exit;
+ 			}
+ 		}
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
+ 		if (err < 0) {
+-			brcmf_err("BRCMF_C_UP error (%d)\n", err);
++			bphy_err(wiphy, "BRCMF_C_UP error (%d)\n", err);
+ 			goto exit;
+ 		}
+ 		/* On DOWN the firmware removes the WEP keys, reconfigure
+@@ -4566,14 +4608,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 					     &join_params, sizeof(join_params));
+ 		if (err < 0) {
+-			brcmf_err("SET SSID error (%d)\n", err);
++			bphy_err(wiphy, "SET SSID error (%d)\n", err);
+ 			goto exit;
+ 		}
+ 
+ 		if (settings->hidden_ssid) {
+ 			err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
+ 			if (err) {
+-				brcmf_err("closednet error (%d)\n", err);
++				bphy_err(wiphy, "closednet error (%d)\n", err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4582,14 +4624,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 	} else if (dev_role == NL80211_IFTYPE_P2P_GO) {
+ 		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
+ 		if (err < 0) {
+-			brcmf_err("Set Channel failed: chspec=%d, %d\n",
+-				  chanspec, err);
++			bphy_err(wiphy, "Set Channel failed: chspec=%d, %d\n",
++				 chanspec, err);
+ 			goto exit;
+ 		}
+ 		err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
+ 						sizeof(ssid_le));
+ 		if (err < 0) {
+-			brcmf_err("setting ssid failed %d\n", err);
++			bphy_err(wiphy, "setting ssid failed %d\n", err);
+ 			goto exit;
+ 		}
+ 		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
+@@ -4597,7 +4639,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+ 					       sizeof(bss_enable));
+ 		if (err < 0) {
+-			brcmf_err("bss_enable config failed %d\n", err);
++			bphy_err(wiphy, "bss_enable config failed %d\n", err);
+ 			goto exit;
+ 		}
+ 
+@@ -4645,13 +4687,13 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 					     &join_params, sizeof(join_params));
+ 		if (err < 0)
+-			brcmf_err("SET SSID error (%d)\n", err);
++			bphy_err(wiphy, "SET SSID error (%d)\n", err);
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
+ 		if (err < 0)
+-			brcmf_err("BRCMF_C_DOWN error %d\n", err);
++			bphy_err(wiphy, "BRCMF_C_DOWN error %d\n", err);
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
+ 		if (err < 0)
+-			brcmf_err("setting AP mode failed %d\n", err);
++			bphy_err(wiphy, "setting AP mode failed %d\n", err);
+ 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
+ 			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
+ 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+@@ -4659,7 +4701,7 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		/* Bring device back up so it can be used again */
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
+ 		if (err < 0)
+-			brcmf_err("BRCMF_C_UP error %d\n", err);
++			bphy_err(wiphy, "BRCMF_C_UP error %d\n", err);
+ 
+ 		brcmf_vif_clear_mgmt_ies(ifp->vif);
+ 	} else {
+@@ -4668,7 +4710,7 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+ 					       sizeof(bss_enable));
+ 		if (err < 0)
+-			brcmf_err("bss_enable config failed %d\n", err);
++			bphy_err(wiphy, "bss_enable config failed %d\n", err);
+ 	}
+ 	brcmf_set_mpc(ifp, 1);
+ 	brcmf_configure_arp_nd_offload(ifp, true);
+@@ -4716,7 +4758,8 @@ brcmf_cfg80211_del_station(struct wiphy
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
+ 				     &scbval, sizeof(scbval));
+ 	if (err)
+-		brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
++		bphy_err(wiphy, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
++			 err);
+ 
+ 	brcmf_dbg(TRACE, "Exit\n");
+ 	return err;
+@@ -4746,7 +4789,7 @@ brcmf_cfg80211_change_station(struct wip
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
+ 					     (void *)mac, ETH_ALEN);
+ 	if (err < 0)
+-		brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
++		bphy_err(wiphy, "Setting SCB (de-)authorize failed, %d\n", err);
+ 
+ 	return err;
+ }
+@@ -4796,7 +4839,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ 	mgmt = (const struct ieee80211_mgmt *)buf;
+ 
+ 	if (!ieee80211_is_mgmt(mgmt->frame_control)) {
+-		brcmf_err("Driver only allows MGMT packet type\n");
++		bphy_err(wiphy, "Driver only allows MGMT packet type\n");
+ 		return -EPERM;
+ 	}
+ 
+@@ -4827,13 +4870,13 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ 					GFP_KERNEL);
+ 	} else if (ieee80211_is_action(mgmt->frame_control)) {
+ 		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
+-			brcmf_err("invalid action frame length\n");
++			bphy_err(wiphy, "invalid action frame length\n");
+ 			err = -EINVAL;
+ 			goto exit;
+ 		}
+ 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
+ 		if (af_params == NULL) {
+-			brcmf_err("unable to allocate frame\n");
++			bphy_err(wiphy, "unable to allocate frame\n");
+ 			err = -ENOMEM;
+ 			goto exit;
+ 		}
+@@ -4891,7 +4934,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
+ 
+ 	vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+ 	if (vif == NULL) {
+-		brcmf_err("No p2p device available for probe response\n");
++		bphy_err(wiphy, "No p2p device available for probe response\n");
+ 		err = -ENODEV;
+ 		goto exit;
+ 	}
+@@ -4919,7 +4962,7 @@ static int brcmf_cfg80211_get_channel(st
+ 
+ 	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
+ 	if (err) {
+-		brcmf_err("chanspec failed (%d)\n", err);
++		bphy_err(wiphy, "chanspec failed (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -5058,7 +5101,7 @@ static int brcmf_cfg80211_tdls_oper(stru
+ 	ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
+ 				       &info, sizeof(info));
+ 	if (ret < 0)
+-		brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
++		bphy_err(wiphy, "tdls_endpoint iovar failed: ret=%d\n", ret);
+ 
+ 	return ret;
+ }
+@@ -5079,7 +5122,7 @@ brcmf_cfg80211_update_conn_params(struct
+ 	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
+ 				    sme->ie, sme->ie_len);
+ 	if (err)
+-		brcmf_err("Set Assoc REQ IE Failed\n");
++		bphy_err(wiphy, "Set Assoc REQ IE Failed\n");
+ 	else
+ 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
+ 
+@@ -5105,7 +5148,7 @@ brcmf_cfg80211_set_rekey_data(struct wip
+ 	ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
+ 				       sizeof(gtk_le));
+ 	if (ret < 0)
+-		brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
++		bphy_err(wiphy, "gtk_key_info iovar failed: ret=%d\n", ret);
+ 
+ 	return ret;
+ }
+@@ -5337,6 +5380,7 @@ static void brcmf_clear_assoc_ies(struct
+ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
+ 			       struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
+ 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
+ 	u32 req_len;
+@@ -5348,7 +5392,7 @@ static s32 brcmf_get_assoc_ies(struct br
+ 	err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
+ 				       cfg->extra_buf, WL_ASSOC_INFO_MAX);
+ 	if (err) {
+-		brcmf_err("could not get assoc info (%d)\n", err);
++		bphy_err(wiphy, "could not get assoc info (%d)\n", err);
+ 		return err;
+ 	}
+ 	assoc_info =
+@@ -5360,7 +5404,7 @@ static s32 brcmf_get_assoc_ies(struct br
+ 					       cfg->extra_buf,
+ 					       WL_ASSOC_INFO_MAX);
+ 		if (err) {
+-			brcmf_err("could not get assoc req (%d)\n", err);
++			bphy_err(wiphy, "could not get assoc req (%d)\n", err);
+ 			return err;
+ 		}
+ 		conn_info->req_ie_len = req_len;
+@@ -5376,7 +5420,7 @@ static s32 brcmf_get_assoc_ies(struct br
+ 					       cfg->extra_buf,
+ 					       WL_ASSOC_INFO_MAX);
+ 		if (err) {
+-			brcmf_err("could not get assoc resp (%d)\n", err);
++			bphy_err(wiphy, "could not get assoc resp (%d)\n", err);
+ 			return err;
+ 		}
+ 		conn_info->resp_ie_len = resp_len;
+@@ -5503,6 +5547,7 @@ brcmf_notify_connect_status_ap(struct br
+ 			       struct net_device *ndev,
+ 			       const struct brcmf_event_msg *e, void *data)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	static int generation;
+ 	u32 event = e->event_code;
+ 	u32 reason = e->reason;
+@@ -5521,7 +5566,7 @@ brcmf_notify_connect_status_ap(struct br
+ 	    (reason == BRCMF_E_STATUS_SUCCESS)) {
+ 		memset(&sinfo, 0, sizeof(sinfo));
+ 		if (!data) {
+-			brcmf_err("No IEs present in ASSOC/REASSOC_IND");
++			bphy_err(wiphy, "No IEs present in ASSOC/REASSOC_IND\n");
+ 			return -EINVAL;
+ 		}
+ 		sinfo.assoc_req_ies = data;
+@@ -5806,6 +5851,7 @@ static void init_vif_event(struct brcmf_
+ 
+ static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err;
+ 	u32 bcn_timeout;
+ 	__le32 roamtrigger[2];
+@@ -5818,7 +5864,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
+ 	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
+ 	if (err) {
+-		brcmf_err("bcn_timeout error (%d)\n", err);
++		bphy_err(wiphy, "bcn_timeout error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5830,7 +5876,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 	err = brcmf_fil_iovar_int_set(ifp, "roam_off",
+ 				      ifp->drvr->settings->roamoff);
+ 	if (err) {
+-		brcmf_err("roam_off error (%d)\n", err);
++		bphy_err(wiphy, "roam_off error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5839,7 +5885,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
+ 				     (void *)roamtrigger, sizeof(roamtrigger));
+ 	if (err) {
+-		brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
++		bphy_err(wiphy, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5848,7 +5894,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
+ 				     (void *)roam_delta, sizeof(roam_delta));
+ 	if (err) {
+-		brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
++		bphy_err(wiphy, "WLC_SET_ROAM_DELTA error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5859,25 +5905,26 @@ roam_setup_done:
+ static s32
+ brcmf_dongle_scantime(struct brcmf_if *ifp)
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	s32 err = 0;
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+ 				    BRCMF_SCAN_CHANNEL_TIME);
+ 	if (err) {
+-		brcmf_err("Scan assoc time error (%d)\n", err);
++		bphy_err(wiphy, "Scan assoc time error (%d)\n", err);
+ 		goto dongle_scantime_out;
+ 	}
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+ 				    BRCMF_SCAN_UNASSOC_TIME);
+ 	if (err) {
+-		brcmf_err("Scan unassoc time error (%d)\n", err);
++		bphy_err(wiphy, "Scan unassoc time error (%d)\n", err);
+ 		goto dongle_scantime_out;
+ 	}
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
+ 				    BRCMF_SCAN_PASSIVE_TIME);
+ 	if (err) {
+-		brcmf_err("Scan passive time error (%d)\n", err);
++		bphy_err(wiphy, "Scan passive time error (%d)\n", err);
+ 		goto dongle_scantime_out;
+ 	}
+ 
+@@ -5909,10 +5956,10 @@ static void brcmf_update_bw40_channel_fl
+ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
+ 				    u32 bw_cap[])
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct ieee80211_channel *channel;
+-	struct wiphy *wiphy;
+ 	struct brcmf_chanspec_list *list;
+ 	struct brcmu_chan ch;
+ 	int err;
+@@ -5931,11 +5978,10 @@ static int brcmf_construct_chaninfo(stru
+ 	err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
+ 				       BRCMF_DCMD_MEDLEN);
+ 	if (err) {
+-		brcmf_err("get chanspecs error (%d)\n", err);
++		bphy_err(wiphy, "get chanspecs error (%d)\n", err);
+ 		goto fail_pbuf;
+ 	}
+ 
+-	wiphy = cfg_to_wiphy(cfg);
+ 	band = wiphy->bands[NL80211_BAND_2GHZ];
+ 	if (band)
+ 		for (i = 0; i < band->n_channels; i++)
+@@ -5955,7 +6001,8 @@ static int brcmf_construct_chaninfo(stru
+ 		} else if (ch.band == BRCMU_CHAN_BAND_5G) {
+ 			band = wiphy->bands[NL80211_BAND_5GHZ];
+ 		} else {
+-			brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
++			bphy_err(wiphy, "Invalid channel Spec. 0x%x.\n",
++				 ch.chspec);
+ 			continue;
+ 		}
+ 		if (!band)
+@@ -5978,8 +6025,8 @@ static int brcmf_construct_chaninfo(stru
+ 			/* It seems firmware supports some channel we never
+ 			 * considered. Something new in IEEE standard?
+ 			 */
+-			brcmf_err("Ignoring unexpected firmware channel %d\n",
+-				  ch.control_ch_num);
++			bphy_err(wiphy, "Ignoring unexpected firmware channel %d\n",
++				 ch.control_ch_num);
+ 			continue;
+ 		}
+ 
+@@ -6025,6 +6072,7 @@ fail_pbuf:
+ 
+ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct brcmf_fil_bwcap_le band_bwcap;
+@@ -6071,7 +6119,7 @@ static int brcmf_enable_bw40_2g(struct b
+ 		err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
+ 					       BRCMF_DCMD_MEDLEN);
+ 		if (err) {
+-			brcmf_err("get chanspecs error (%d)\n", err);
++			bphy_err(wiphy, "get chanspecs error (%d)\n", err);
+ 			kfree(pbuf);
+ 			return err;
+ 		}
+@@ -6102,6 +6150,7 @@ static int brcmf_enable_bw40_2g(struct b
+ 
+ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
+ {
++	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	u32 band, mimo_bwcap;
+ 	int err;
+ 
+@@ -6137,7 +6186,7 @@ static void brcmf_get_bwcap(struct brcmf
+ 		bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
+ 		break;
+ 	default:
+-		brcmf_err("invalid mimo_bw_cap value\n");
++		bphy_err(wiphy, "invalid mimo_bw_cap value\n");
+ 	}
+ }
+ 
+@@ -6213,7 +6262,7 @@ static void brcmf_update_vht_cap(struct
+ static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
+ {
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+-	struct wiphy *wiphy;
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	u32 nmode = 0;
+ 	u32 vhtmode = 0;
+ 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
+@@ -6229,7 +6278,7 @@ static int brcmf_setup_wiphybands(struct
+ 	(void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
+ 	err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
+ 	if (err) {
+-		brcmf_err("nmode error (%d)\n", err);
++		bphy_err(wiphy, "nmode error (%d)\n", err);
+ 	} else {
+ 		brcmf_get_bwcap(ifp, bw_cap);
+ 	}
+@@ -6239,7 +6288,7 @@ static int brcmf_setup_wiphybands(struct
+ 
+ 	err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
+ 	if (err) {
+-		brcmf_err("rxchain error (%d)\n", err);
++		bphy_err(wiphy, "rxchain error (%d)\n", err);
+ 		nchain = 1;
+ 	} else {
+ 		for (nchain = 0; rxchain; nchain++)
+@@ -6249,7 +6298,7 @@ static int brcmf_setup_wiphybands(struct
+ 
+ 	err = brcmf_construct_chaninfo(cfg, bw_cap);
+ 	if (err) {
+-		brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
++		bphy_err(wiphy, "brcmf_construct_chaninfo failed (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -6261,7 +6310,6 @@ static int brcmf_setup_wiphybands(struct
+ 					      &txbf_bfr_cap);
+ 	}
+ 
+-	wiphy = cfg_to_wiphy(cfg);
+ 	for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
+ 		band = wiphy->bands[i];
+ 		if (band == NULL)
+@@ -6462,7 +6510,7 @@ static void brcmf_wiphy_wowl_params(stru
+ 	wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
+ 		       GFP_KERNEL);
+ 	if (!wowl) {
+-		brcmf_err("only support basic wowlan features\n");
++		bphy_err(wiphy, "only support basic wowlan features\n");
+ 		wiphy->wowlan = &brcmf_wowlan_support;
+ 		return;
+ 	}
+@@ -6559,7 +6607,7 @@ static int brcmf_setup_wiphy(struct wiph
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
+ 				     sizeof(bandlist));
+ 	if (err) {
+-		brcmf_err("could not obtain band info: err=%d\n", err);
++		bphy_err(wiphy, "could not obtain band info: err=%d\n", err);
+ 		return err;
+ 	}
+ 	/* first entry in bandlist is number of bands */
+@@ -6831,8 +6879,8 @@ static void brcmf_cfg80211_reg_notifier(
+ 	/* ignore non-ISO3166 country codes */
+ 	for (i = 0; i < 2; i++)
+ 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+-			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
+-				  req->alpha2[0], req->alpha2[1]);
++			bphy_err(wiphy, "not an ISO3166 code (0x%02x 0x%02x)\n",
++				 req->alpha2[0], req->alpha2[1]);
+ 			return;
+ 		}
+ 
+@@ -6841,7 +6889,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 
+ 	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
+ 	if (err) {
+-		brcmf_err("Country code iovar returned err = %d\n", err);
++		bphy_err(wiphy, "Country code iovar returned err = %d\n", err);
+ 		return;
+ 	}
+ 
+@@ -6851,7 +6899,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 
+ 	err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
+ 	if (err) {
+-		brcmf_err("Firmware rejected country setting\n");
++		bphy_err(wiphy, "Firmware rejected country setting\n");
+ 		return;
+ 	}
+ 	brcmf_setup_wiphybands(cfg);
+@@ -6897,13 +6945,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	u16 *cap = NULL;
+ 
+ 	if (!ndev) {
+-		brcmf_err("ndev is invalid\n");
++		bphy_err(wiphy, "ndev is invalid\n");
+ 		return NULL;
+ 	}
+ 
+ 	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
+ 	if (!cfg) {
+-		brcmf_err("Could not allocate wiphy device\n");
++		bphy_err(wiphy, "Could not allocate wiphy device\n");
+ 		return NULL;
+ 	}
+ 
+@@ -6924,7 +6972,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 
+ 	err = wl_init_priv(cfg);
+ 	if (err) {
+-		brcmf_err("Failed to init iwm_priv (%d)\n", err);
++		bphy_err(wiphy, "Failed to init iwm_priv (%d)\n", err);
+ 		brcmf_free_vif(vif);
+ 		goto wiphy_out;
+ 	}
+@@ -6933,7 +6981,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	/* determine d11 io type before wiphy setup */
+ 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
+ 	if (err) {
+-		brcmf_err("Failed to get D11 version (%d)\n", err);
++		bphy_err(wiphy, "Failed to get D11 version (%d)\n", err);
+ 		goto priv_out;
+ 	}
+ 	cfg->d11inf.io_type = (u8)io_type;
+@@ -6967,13 +7015,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ #endif
+ 	err = wiphy_register(wiphy);
+ 	if (err < 0) {
+-		brcmf_err("Could not register wiphy device (%d)\n", err);
++		bphy_err(wiphy, "Could not register wiphy device (%d)\n", err);
+ 		goto priv_out;
+ 	}
+ 
+ 	err = brcmf_setup_wiphybands(cfg);
+ 	if (err) {
+-		brcmf_err("Setting wiphy bands failed (%d)\n", err);
++		bphy_err(wiphy, "Setting wiphy bands failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 
+@@ -6991,24 +7039,24 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+-		brcmf_err("FWEH activation failed (%d)\n", err);
++		bphy_err(wiphy, "FWEH activation failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 
+ 	err = brcmf_p2p_attach(cfg, p2pdev_forced);
+ 	if (err) {
+-		brcmf_err("P2P initialisation failed (%d)\n", err);
++		bphy_err(wiphy, "P2P initialisation failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 	err = brcmf_btcoex_attach(cfg);
+ 	if (err) {
+-		brcmf_err("BT-coex initialisation failed (%d)\n", err);
++		bphy_err(wiphy, "BT-coex initialisation failed (%d)\n", err);
+ 		brcmf_p2p_detach(&cfg->p2p);
+ 		goto wiphy_unreg_out;
+ 	}
+ 	err = brcmf_pno_attach(cfg);
+ 	if (err) {
+-		brcmf_err("PNO initialisation failed (%d)\n", err);
++		bphy_err(wiphy, "PNO initialisation failed (%d)\n", err);
+ 		brcmf_btcoex_detach(cfg);
+ 		brcmf_p2p_detach(&cfg->p2p);
+ 		goto wiphy_unreg_out;
+@@ -7028,7 +7076,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	/* (re-) activate FWEH event handling */
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+-		brcmf_err("FWEH activation failed (%d)\n", err);
++		bphy_err(wiphy, "FWEH activation failed (%d)\n", err);
+ 		goto detach;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -62,6 +62,15 @@ void __brcmf_err(struct brcmf_bus *bus,
+ 	} while (0)
+ #endif
+ 
++#define bphy_err(wiphy, fmt, ...)					\
++	do {								\
++		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
++		    IS_ENABLED(CPTCFG_BRCM_TRACING) ||			\
++		    net_ratelimit())					\
++			wiphy_err(wiphy, "%s: " fmt, __func__,		\
++				  ##__VA_ARGS__);			\
++	} while (0)
++
+ #if defined(DEBUG) || defined(CPTCFG_BRCM_TRACING)
+ 
+ /* For debug/tracing purposes treat info messages as errors */
diff --git a/package/kernel/mac80211/patches/381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch b/package/kernel/mac80211/patches/381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch
new file mode 100644
index 0000000000..c93bcf0ce9
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch
@@ -0,0 +1,143 @@
+From e665988be29ccea3584528967b432a5cfd801ca4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 8 Feb 2019 07:42:30 +0100
+Subject: [PATCH] brcmfmac: support monitor frames with the hardware/ucode
+ header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far there were two monitor frame formats:
+1) 802.11 frames (with frame (sub)type & all addresses)
+2) 802.11 frames with the radiotap header
+
+Testing the latest FullMAC firmwares for 4366b1/4366c0 resulted in
+discovering a new format being used. It seems (almost?) identical to the
+one known from ucode used in SoftMAC devices which is most likely the
+same codebase anyway.
+
+While new firmwares will /announce/ radiotap header support using the
+"rtap" fw capability string it seems no string was added for the new
+ucode header format.
+
+All above means that:
+1) We need new format support when dealing with a received frame
+2) A new feature bit & mapping quirks have to be added manually
+
+As for now only an empty radiotap is being created. Adding support for
+extracting some info (band, channel, signal, etc.) is planned for the
+future.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/core.c        | 55 +++++++++++++++++++
+ .../broadcom/brcm80211/brcmfmac/feature.c     |  4 ++
+ .../broadcom/brcm80211/brcmfmac/feature.h     |  4 +-
+ 3 files changed, 62 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -43,6 +43,36 @@
+ 
+ #define BRCMF_BSSIDX_INVALID			-1
+ 
++#define	RXS_PBPRES				BIT(2)
++
++#define	D11_PHY_HDR_LEN				6
++
++struct d11rxhdr_le {
++	__le16 RxFrameSize;
++	u16 PAD;
++	__le16 PhyRxStatus_0;
++	__le16 PhyRxStatus_1;
++	__le16 PhyRxStatus_2;
++	__le16 PhyRxStatus_3;
++	__le16 PhyRxStatus_4;
++	__le16 PhyRxStatus_5;
++	__le16 RxStatus1;
++	__le16 RxStatus2;
++	__le16 RxTSFTime;
++	__le16 RxChan;
++	u8 unknown[12];
++} __packed;
++
++struct wlc_d11rxhdr {
++	struct d11rxhdr_le rxhdr;
++	__le32 tsf_l;
++	s8 rssi;
++	s8 rxpwr0;
++	s8 rxpwr1;
++	s8 do_rssi_ma;
++	s8 rxpwr[4];
++} __packed;
++
+ char *brcmf_ifname(struct brcmf_if *ifp)
+ {
+ 	if (!ifp)
+@@ -409,6 +439,31 @@ void brcmf_netif_mon_rx(struct brcmf_if
+ {
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
+ 		/* Do nothing */
++	} else if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR)) {
++		struct wlc_d11rxhdr *wlc_rxhdr = (struct wlc_d11rxhdr *)skb->data;
++		struct ieee80211_radiotap_header *radiotap;
++		unsigned int offset;
++		u16 RxStatus1;
++
++		RxStatus1 = le16_to_cpu(wlc_rxhdr->rxhdr.RxStatus1);
++
++		offset = sizeof(struct wlc_d11rxhdr);
++		/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU
++		 * subframes
++		 */
++		if (RxStatus1 & RXS_PBPRES)
++			offset += 2;
++		offset += D11_PHY_HDR_LEN;
++
++		skb_pull(skb, offset);
++
++		/* TODO: use RX header to fill some radiotap data */
++		radiotap = skb_push(skb, sizeof(*radiotap));
++		memset(radiotap, 0, sizeof(*radiotap));
++		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
++
++		/* TODO: 4 bytes with receive status? */
++		skb->len -= 4;
+ 	} else {
+ 		struct ieee80211_radiotap_header *radiotap;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -103,6 +103,10 @@ static const struct brcmf_feat_fwfeat br
+ 	{ "01-6cb8e269", BIT(BRCMF_FEAT_MONITOR) },
+ 	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 52442afee990 */
+ 	{ "01-c47a91a4", BIT(BRCMF_FEAT_MONITOR) },
++	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 211de1679a68 */
++	{ "01-801fb449", BIT(BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR) },
++	/* brcmfmac4366c-pcie.bin from linux-firmware.git commit 211de1679a68 */
++	{ "01-d2cbb8fd", BIT(BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR) },
+ };
+ 
+ static void brcmf_feat_firmware_overrides(struct brcmf_pub *drv)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -35,6 +35,7 @@
+  * FWSUP: Firmware supplicant.
+  * MONITOR: firmware can pass monitor packets to host.
+  * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
++ * MONITOR_FMT_HW_RX_HDR: firmware provides monitor packets with hw/ucode header
+  */
+ #define BRCMF_FEAT_LIST \
+ 	BRCMF_FEAT_DEF(MBSS) \
+@@ -52,7 +53,8 @@
+ 	BRCMF_FEAT_DEF(GSCAN) \
+ 	BRCMF_FEAT_DEF(FWSUP) \
+ 	BRCMF_FEAT_DEF(MONITOR) \
+-	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP)
++	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP) \
++	BRCMF_FEAT_DEF(MONITOR_FMT_HW_RX_HDR)
+ 
+ /*
+  * Quirks:
diff --git a/package/kernel/mac80211/patches/381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch b/package/kernel/mac80211/patches/381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch
new file mode 100644
index 0000000000..b41b9cebf4
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch
@@ -0,0 +1,67 @@
+From c988b78244df8216902e20de536434e2f474a37e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 8 Feb 2019 15:24:39 +0100
+Subject: [PATCH] brcmfmac: print firmware reported ring status errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Firmware is capable of reporting ring status. It's used e.g. to signal
+some problem with a specific ring setup. This patch adds support for
+printing ring & error number which may be useful for debugging setup
+issues.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 25 +++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -134,6 +134,14 @@ struct msgbuf_completion_hdr {
+ 	__le16				flow_ring_id;
+ };
+ 
++/* Data struct for the MSGBUF_TYPE_RING_STATUS */
++struct msgbuf_ring_status {
++	struct msgbuf_common_hdr	msg;
++	struct msgbuf_completion_hdr	compl_hdr;
++	__le16				write_idx;
++	__le32				rsvd0[5];
++};
++
+ struct msgbuf_rx_event {
+ 	struct msgbuf_common_hdr	msg;
+ 	struct msgbuf_completion_hdr	compl_hdr;
+@@ -1180,6 +1188,19 @@ brcmf_msgbuf_process_rx_complete(struct
+ 	brcmf_netif_rx(ifp, skb);
+ }
+ 
++static void brcmf_msgbuf_process_ring_status(struct brcmf_msgbuf *msgbuf,
++					     void *buf)
++{
++	struct msgbuf_ring_status *ring_status = buf;
++	int err;
++
++	err = le16_to_cpu(ring_status->compl_hdr.status);
++	if (err) {
++		int ring = le16_to_cpu(ring_status->compl_hdr.flow_ring_id);
++
++		brcmf_err("Firmware reported ring %d error: %d\n", ring, err);
++	}
++}
+ 
+ static void
+ brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
+@@ -1241,6 +1262,10 @@ static void brcmf_msgbuf_process_msgtype
+ 
+ 	msg = (struct msgbuf_common_hdr *)buf;
+ 	switch (msg->msgtype) {
++	case MSGBUF_TYPE_RING_STATUS:
++		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RING_STATUS\n");
++		brcmf_msgbuf_process_ring_status(msgbuf, buf);
++		break;
+ 	case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
+ 		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
+ 		brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);
diff --git a/package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch b/package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
new file mode 100644
index 0000000000..dd4fa742be
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
@@ -0,0 +1,42 @@
+From f4e183293b871c96c0220dcc549d5ca4c72628ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 11 Feb 2019 23:04:53 +0100
+Subject: [PATCH] brcmfmac: improve code handling bandwidth of firmware
+ reported channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1) Use switch to simplify/improve the code & avoid some duplication
+2) Add warning for unsupported values
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6036,11 +6036,18 @@ static int brcmf_construct_chaninfo(stru
+ 		/* assuming the chanspecs order is HT20,
+ 		 * HT40 upper, HT40 lower, and VHT80.
+ 		 */
+-		if (ch.bw == BRCMU_CHAN_BW_80) {
++		switch (ch.bw) {
++		case BRCMU_CHAN_BW_80:
+ 			channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
+-		} else if (ch.bw == BRCMU_CHAN_BW_40) {
++			break;
++		case BRCMU_CHAN_BW_40:
+ 			brcmf_update_bw40_channel_flag(channel, &ch);
+-		} else {
++			break;
++		default:
++			wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
++				   ch.bw);
++			/* fall through */
++		case BRCMU_CHAN_BW_20:
+ 			/* enable the channel and disable other bandwidths
+ 			 * for now as mentioned order assure they are enabled
+ 			 * for subsequent chanspecs.
diff --git a/package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch b/package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
new file mode 100644
index 0000000000..92a7567b16
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
@@ -0,0 +1,30 @@
+From 30519cbe339a45bd11a57ca8ece07f4f6a1cda2e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 11 Feb 2019 23:04:54 +0100
+Subject: [PATCH] brcmfmac: support firmware reporting 160 MHz channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far 160 MHz channels were treated as 20 MHz ones which was breaking
+support for 40/80 MHz due to the brcmf_construct_chaninfo() logic and
+its assumptions.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6037,6 +6037,9 @@ static int brcmf_construct_chaninfo(stru
+ 		 * HT40 upper, HT40 lower, and VHT80.
+ 		 */
+ 		switch (ch.bw) {
++		case BRCMU_CHAN_BW_160:
++			channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
++			break;
+ 		case BRCMU_CHAN_BW_80:
+ 			channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
+ 			break;
diff --git a/package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch b/package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
new file mode 100644
index 0000000000..9e5cb07e6b
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
@@ -0,0 +1,2272 @@
+From 16e646768396339b3d354985b99bcd3f1f195a7d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 15 Feb 2019 15:45:54 +0100
+Subject: [PATCH] brcmfmac: rework bphy_err() to take struct brcmf_pub argument
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This macro will be used in more places not just the cfg80211.c. It makes
+sense to pass some common struct to it as "struct wiphy" is mostly
+referenced in cfg80211 code only.
+
+A very common one (used above the bus abstraction layer) is struct
+brcmf_pub. Many functions already keep reference to it which will make
+using bphy_err() simpler. It should also allow extending that macro's
+logic if it's ever needed.
+
+This improves code recently added in the commit 3ef005b82e2a ("brcmfmac:
+add bphy_err() and use it in the cfg80211.c").
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 510 ++++++++++--------
+ .../broadcom/brcm80211/brcmfmac/debug.h       |   4 +-
+ 2 files changed, 281 insertions(+), 233 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -457,7 +457,7 @@ static void convert_key_from_CPU(struct
+ static int
+ send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int err;
+ 	struct brcmf_wsec_key_le key_le;
+ 
+@@ -469,7 +469,7 @@ send_key_to_dongle(struct brcmf_if *ifp,
+ 					sizeof(key_le));
+ 
+ 	if (err)
+-		bphy_err(wiphy, "wsec_key error (%d)\n", err);
++		bphy_err(drvr, "wsec_key error (%d)\n", err);
+ 	return err;
+ }
+ 
+@@ -509,7 +509,7 @@ static int brcmf_get_first_free_bsscfgid
+ 
+ static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_mbss_ssid_le mbss_ssid_le;
+ 	int bsscfgidx;
+ 	int err;
+@@ -526,7 +526,7 @@ static int brcmf_cfg80211_request_ap_if(
+ 	err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
+ 					sizeof(mbss_ssid_le));
+ 	if (err < 0)
+-		bphy_err(wiphy, "setting ssid failed %d\n", err);
++		bphy_err(drvr, "setting ssid failed %d\n", err);
+ 
+ 	return err;
+ }
+@@ -544,6 +544,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	int err;
+ 
+@@ -569,7 +570,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ 					    BRCMF_VIF_EVENT_TIMEOUT);
+ 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
+ 	if (!err) {
+-		bphy_err(wiphy, "timeout occurred\n");
++		bphy_err(drvr, "timeout occurred\n");
+ 		err = -EIO;
+ 		goto fail;
+ 	}
+@@ -577,7 +578,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ 	/* interface created in firmware */
+ 	ifp = vif->ifp;
+ 	if (!ifp) {
+-		bphy_err(wiphy, "no if pointer provided\n");
++		bphy_err(drvr, "no if pointer provided\n");
+ 		err = -ENOENT;
+ 		goto fail;
+ 	}
+@@ -585,7 +586,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+ 	strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
+ 	err = brcmf_net_attach(ifp, true);
+ 	if (err) {
+-		bphy_err(wiphy, "Registering netdevice failed\n");
++		bphy_err(drvr, "Registering netdevice failed\n");
+ 		free_netdev(ifp->ndev);
+ 		goto fail;
+ 	}
+@@ -616,13 +617,15 @@ static struct wireless_dev *brcmf_cfg802
+ 						     enum nl80211_iftype type,
+ 						     struct vif_params *params)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct wireless_dev *wdev;
+ 	int err;
+ 
+ 	brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
+ 	err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
+ 	if (err) {
+-		bphy_err(wiphy, "iface validation failed: err=%d\n", err);
++		bphy_err(drvr, "iface validation failed: err=%d\n", err);
+ 		return ERR_PTR(err);
+ 	}
+ 	switch (type) {
+@@ -647,7 +650,7 @@ static struct wireless_dev *brcmf_cfg802
+ 	}
+ 
+ 	if (IS_ERR(wdev))
+-		bphy_err(wiphy, "add iface %s type %d failed: err=%d\n", name,
++		bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
+ 			 type, (int)PTR_ERR(wdev));
+ 	else
+ 		brcmf_cfg80211_update_proto_addr_mode(wdev);
+@@ -663,13 +666,13 @@ static void brcmf_scan_config_mpc(struct
+ 
+ void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err = 0;
+ 
+ 	if (check_vif_up(ifp->vif)) {
+ 		err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
+ 		if (err) {
+-			bphy_err(wiphy, "fail to set mpc\n");
++			bphy_err(drvr, "fail to set mpc\n");
+ 			return;
+ 		}
+ 		brcmf_dbg(INFO, "MPC : %d\n", mpc);
+@@ -680,7 +683,7 @@ s32 brcmf_notify_escan_complete(struct b
+ 				struct brcmf_if *ifp, bool aborted,
+ 				bool fw_abort)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_scan_params_le params_le;
+ 	struct cfg80211_scan_request *scan_request;
+ 	u64 reqid;
+@@ -715,7 +718,7 @@ s32 brcmf_notify_escan_complete(struct b
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
+ 					     &params_le, sizeof(params_le));
+ 		if (err)
+-			bphy_err(wiphy, "Scan abort failed\n");
++			bphy_err(drvr, "Scan abort failed\n");
+ 	}
+ 
+ 	brcmf_scan_config_mpc(ifp, 1);
+@@ -760,6 +763,7 @@ static int brcmf_cfg80211_del_ap_iface(s
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	int ret;
+ 	int err;
+ 
+@@ -767,7 +771,7 @@ static int brcmf_cfg80211_del_ap_iface(s
+ 
+ 	err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
+ 	if (err) {
+-		bphy_err(wiphy, "interface_remove failed %d\n", err);
++		bphy_err(drvr, "interface_remove failed %d\n", err);
+ 		goto err_unarm;
+ 	}
+ 
+@@ -775,7 +779,7 @@ static int brcmf_cfg80211_del_ap_iface(s
+ 	ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
+ 					    BRCMF_VIF_EVENT_TIMEOUT);
+ 	if (!ret) {
+-		bphy_err(wiphy, "timeout occurred\n");
++		bphy_err(drvr, "timeout occurred\n");
+ 		err = -EIO;
+ 		goto err_unarm;
+ 	}
+@@ -838,6 +842,7 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_vif *vif = ifp->vif;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 infra = 0;
+ 	s32 ap = 0;
+ 	s32 err = 0;
+@@ -877,13 +882,13 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 	}
+ 	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
+ 	if (err) {
+-		bphy_err(wiphy, "iface validation failed: err=%d\n", err);
++		bphy_err(drvr, "iface validation failed: err=%d\n", err);
+ 		return err;
+ 	}
+ 	switch (type) {
+ 	case NL80211_IFTYPE_MONITOR:
+ 	case NL80211_IFTYPE_WDS:
+-		bphy_err(wiphy, "type (%d) : currently we do not support this type\n",
++		bphy_err(drvr, "type (%d) : currently we do not support this type\n",
+ 			 type);
+ 		return -EOPNOTSUPP;
+ 	case NL80211_IFTYPE_ADHOC:
+@@ -912,7 +917,7 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 	} else {
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
+ 		if (err) {
+-			bphy_err(wiphy, "WLC_SET_INFRA error (%d)\n", err);
++			bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
+ 			err = -EAGAIN;
+ 			goto done;
+ 		}
+@@ -1003,7 +1008,7 @@ static s32
+ brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
+ 		struct cfg80211_scan_request *request)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
+ 			  offsetof(struct brcmf_escan_params_le, params_le);
+ 	struct brcmf_escan_params_le *params;
+@@ -1035,7 +1040,7 @@ brcmf_run_escan(struct brcmf_cfg80211_in
+ 		if (err == -EBUSY)
+ 			brcmf_dbg(INFO, "system busy : escan canceled\n");
+ 		else
+-			bphy_err(wiphy, "error (%d)\n", err);
++			bphy_err(drvr, "error (%d)\n", err);
+ 	}
+ 
+ 	kfree(params);
+@@ -1072,6 +1077,7 @@ static s32
+ brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	s32 err = 0;
+ 
+@@ -1081,22 +1087,22 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 		return -EIO;
+ 
+ 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+-		bphy_err(wiphy, "Scanning already: status (%lu)\n",
++		bphy_err(drvr, "Scanning already: status (%lu)\n",
+ 			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 	if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
+-		bphy_err(wiphy, "Scanning being aborted: status (%lu)\n",
++		bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
+ 			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
+-		bphy_err(wiphy, "Scanning suppressed: status (%lu)\n",
++		bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
+ 			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+ 	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
+-		bphy_err(wiphy, "Connecting: status (%lu)\n", vif->sme_state);
++		bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
+ 		return -EAGAIN;
+ 	}
+ 
+@@ -1130,7 +1136,7 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
+ 	return 0;
+ 
+ scan_out:
+-	bphy_err(wiphy, "scan error (%d)\n", err);
++	bphy_err(drvr, "scan error (%d)\n", err);
+ 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 	cfg->scan_request = NULL;
+ 	return err;
+@@ -1139,12 +1145,12 @@ scan_out:
+ static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err = 0;
+ 
+ 	err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
+ 	if (err)
+-		bphy_err(wiphy, "Error (%d)\n", err);
++		bphy_err(drvr, "Error (%d)\n", err);
+ 
+ 	return err;
+ }
+@@ -1152,13 +1158,13 @@ static s32 brcmf_set_rts(struct net_devi
+ static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err = 0;
+ 
+ 	err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
+ 				      frag_threshold);
+ 	if (err)
+-		bphy_err(wiphy, "Error (%d)\n", err);
++		bphy_err(drvr, "Error (%d)\n", err);
+ 
+ 	return err;
+ }
+@@ -1166,13 +1172,13 @@ static s32 brcmf_set_frag(struct net_dev
+ static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err = 0;
+ 	u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
+ 	if (err) {
+-		bphy_err(wiphy, "cmd (%d) , error (%d)\n", cmd, err);
++		bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
+ 		return err;
+ 	}
+ 	return err;
+@@ -1248,7 +1254,7 @@ static u16 brcmf_map_fw_linkdown_reason(
+ 
+ static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_wsec_pmk_le pmk;
+ 	int i, err;
+ 
+@@ -1262,7 +1268,7 @@ static int brcmf_set_pmk(struct brcmf_if
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
+ 				     &pmk, sizeof(pmk));
+ 	if (err < 0)
+-		bphy_err(wiphy, "failed to change PSK in firmware (len=%u)\n",
++		bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
+ 			 pmk_len);
+ 
+ 	return err;
+@@ -1271,7 +1277,7 @@ static int brcmf_set_pmk(struct brcmf_if
+ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err = 0;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+@@ -1281,7 +1287,7 @@ static void brcmf_link_down(struct brcmf
+ 		err = brcmf_fil_cmd_data_set(vif->ifp,
+ 					     BRCMF_C_DISASSOC, NULL, 0);
+ 		if (err) {
+-			bphy_err(wiphy, "WLC_DISASSOC failed (%d)\n", err);
++			bphy_err(drvr, "WLC_DISASSOC failed (%d)\n", err);
+ 		}
+ 		if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
+ 		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
+@@ -1305,6 +1311,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_join_params join_params;
+ 	size_t join_params_size = 0;
+ 	s32 err = 0;
+@@ -1369,7 +1376,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 
+ 	err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "wsec failed (%d)\n", err);
++		bphy_err(drvr, "wsec failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1381,7 +1388,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_SET_BCNPRD failed (%d)\n", err);
++		bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1426,7 +1433,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
+ 					    target_channel);
+ 		if (err) {
+-			bphy_err(wiphy, "WLC_SET_CHANNEL failed (%d)\n", err);
++			bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
+ 			goto done;
+ 		}
+ 	} else
+@@ -1438,7 +1445,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *w
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 				     &join_params, join_params_size);
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_SET_SSID failed (%d)\n", err);
++		bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1475,8 +1482,8 @@ static s32 brcmf_set_wpa_version(struct
+ 				 struct cfg80211_connect_params *sme)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 val = 0;
+ 	s32 err = 0;
+@@ -1490,7 +1497,7 @@ static s32 brcmf_set_wpa_version(struct
+ 	brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
+ 	if (err) {
+-		bphy_err(wiphy, "set wpa_auth failed (%d)\n", err);
++		bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
+ 		return err;
+ 	}
+ 	sec = &profile->sec;
+@@ -1502,8 +1509,8 @@ static s32 brcmf_set_auth_type(struct ne
+ 			       struct cfg80211_connect_params *sme)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 val = 0;
+ 	s32 err = 0;
+@@ -1525,7 +1532,7 @@ static s32 brcmf_set_auth_type(struct ne
+ 
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
+ 	if (err) {
+-		bphy_err(wiphy, "set auth failed (%d)\n", err);
++		bphy_err(drvr, "set auth failed (%d)\n", err);
+ 		return err;
+ 	}
+ 	sec = &profile->sec;
+@@ -1538,8 +1545,8 @@ brcmf_set_wsec_mode(struct net_device *n
+ 		    struct cfg80211_connect_params *sme)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 pval = 0;
+ 	s32 gval = 0;
+@@ -1562,7 +1569,7 @@ brcmf_set_wsec_mode(struct net_device *n
+ 			pval = AES_ENABLED;
+ 			break;
+ 		default:
+-			bphy_err(wiphy, "invalid cipher pairwise (%d)\n",
++			bphy_err(drvr, "invalid cipher pairwise (%d)\n",
+ 				 sme->crypto.ciphers_pairwise[0]);
+ 			return -EINVAL;
+ 		}
+@@ -1583,7 +1590,7 @@ brcmf_set_wsec_mode(struct net_device *n
+ 			gval = AES_ENABLED;
+ 			break;
+ 		default:
+-			bphy_err(wiphy, "invalid cipher group (%d)\n",
++			bphy_err(drvr, "invalid cipher group (%d)\n",
+ 				 sme->crypto.cipher_group);
+ 			return -EINVAL;
+ 		}
+@@ -1599,7 +1606,7 @@ brcmf_set_wsec_mode(struct net_device *n
+ 	wsec = pval | gval;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "error (%d)\n", err);
++		bphy_err(drvr, "error (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -1614,8 +1621,8 @@ static s32
+ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
+ 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 val;
+ 	s32 err;
+ 	const struct brcmf_tlv *rsn_ie;
+@@ -1633,7 +1640,7 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 
+ 	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
+ 	if (err) {
+-		bphy_err(wiphy, "could not get wpa_auth (%d)\n", err);
++		bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
+ 		return err;
+ 	}
+ 	if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+@@ -1647,7 +1654,7 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 			val = WPA_AUTH_PSK;
+ 			break;
+ 		default:
+-			bphy_err(wiphy, "invalid cipher group (%d)\n",
++			bphy_err(drvr, "invalid cipher group (%d)\n",
+ 				 sme->crypto.cipher_group);
+ 			return -EINVAL;
+ 		}
+@@ -1670,7 +1677,7 @@ brcmf_set_key_mgmt(struct net_device *nd
+ 			val = WPA2_AUTH_PSK;
+ 			break;
+ 		default:
+-			bphy_err(wiphy, "invalid cipher group (%d)\n",
++			bphy_err(drvr, "invalid cipher group (%d)\n",
+ 				 sme->crypto.cipher_group);
+ 			return -EINVAL;
+ 		}
+@@ -1717,7 +1724,7 @@ skip_mfp_config:
+ 	brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
+ 	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
+ 	if (err) {
+-		bphy_err(wiphy, "could not set wpa_auth (%d)\n", err);
++		bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -1729,7 +1736,7 @@ brcmf_set_sharedkey(struct net_device *n
+ 		    struct cfg80211_connect_params *sme)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
+ 	struct brcmf_cfg80211_security *sec;
+ 	struct brcmf_wsec_key key;
+@@ -1756,7 +1763,7 @@ brcmf_set_sharedkey(struct net_device *n
+ 	key.len = (u32) sme->key_len;
+ 	key.index = (u32) sme->key_idx;
+ 	if (key.len > sizeof(key.data)) {
+-		bphy_err(wiphy, "Too long key length (%u)\n", key.len);
++		bphy_err(drvr, "Too long key length (%u)\n", key.len);
+ 		return -EINVAL;
+ 	}
+ 	memcpy(key.data, sme->key, key.len);
+@@ -1769,7 +1776,7 @@ brcmf_set_sharedkey(struct net_device *n
+ 		key.algo = CRYPTO_ALGO_WEP128;
+ 		break;
+ 	default:
+-		bphy_err(wiphy, "Invalid algorithm (%d)\n",
++		bphy_err(drvr, "Invalid algorithm (%d)\n",
+ 			 sme->crypto.ciphers_pairwise[0]);
+ 		return -EINVAL;
+ 	}
+@@ -1786,7 +1793,7 @@ brcmf_set_sharedkey(struct net_device *n
+ 		val = WL_AUTH_SHARED_KEY;	/* shared key */
+ 		err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
+ 		if (err)
+-			bphy_err(wiphy, "set auth failed (%d)\n", err);
++			bphy_err(drvr, "set auth failed (%d)\n", err);
+ 	}
+ 	return err;
+ }
+@@ -1806,7 +1813,7 @@ enum nl80211_auth_type brcmf_war_auth_ty
+ static void brcmf_set_join_pref(struct brcmf_if *ifp,
+ 				struct cfg80211_bss_selection *bss_select)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_join_pref_params join_pref_params[2];
+ 	enum nl80211_band band;
+ 	int err, i = 0;
+@@ -1845,7 +1852,7 @@ static void brcmf_set_join_pref(struct b
+ 	err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+ 				       sizeof(join_pref_params));
+ 	if (err)
+-		bphy_err(wiphy, "Set join_pref error (%d)\n", err);
++		bphy_err(drvr, "Set join_pref error (%d)\n", err);
+ }
+ 
+ static s32
+@@ -1856,6 +1863,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
+ 	struct ieee80211_channel *chan = sme->channel;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_join_params join_params;
+ 	size_t join_params_size;
+ 	const struct brcmf_tlv *rsn_ie;
+@@ -1872,7 +1880,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 		return -EIO;
+ 
+ 	if (!sme->ssid) {
+-		bphy_err(wiphy, "Invalid ssid\n");
++		bphy_err(drvr, "Invalid ssid\n");
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+@@ -1901,7 +1909,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
+ 				    sme->ie, sme->ie_len);
+ 	if (err)
+-		bphy_err(wiphy, "Set Assoc REQ IE Failed\n");
++		bphy_err(drvr, "Set Assoc REQ IE Failed\n");
+ 	else
+ 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
+ 
+@@ -1922,32 +1930,32 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 
+ 	err = brcmf_set_wpa_version(ndev, sme);
+ 	if (err) {
+-		bphy_err(wiphy, "wl_set_wpa_version failed (%d)\n", err);
++		bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
+ 	err = brcmf_set_auth_type(ndev, sme);
+ 	if (err) {
+-		bphy_err(wiphy, "wl_set_auth_type failed (%d)\n", err);
++		bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	err = brcmf_set_wsec_mode(ndev, sme);
+ 	if (err) {
+-		bphy_err(wiphy, "wl_set_set_cipher failed (%d)\n", err);
++		bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	err = brcmf_set_key_mgmt(ndev, sme);
+ 	if (err) {
+-		bphy_err(wiphy, "wl_set_key_mgmt failed (%d)\n", err);
++		bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+ 	err = brcmf_set_sharedkey(ndev, sme);
+ 	if (err) {
+-		bphy_err(wiphy, "brcmf_set_sharedkey failed (%d)\n", err);
++		bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -1964,7 +1972,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 		/* enable firmware supplicant for this interface */
+ 		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "failed to enable fw supplicant\n");
++			bphy_err(drvr, "failed to enable fw supplicant\n");
+ 			goto done;
+ 		}
+ 	}
+@@ -2059,7 +2067,7 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 				     &join_params, join_params_size);
+ 	if (err)
+-		bphy_err(wiphy, "BRCMF_C_SET_SSID failed (%d)\n", err);
++		bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
+ 
+ done:
+ 	if (err)
+@@ -2072,8 +2080,10 @@ static s32
+ brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
+ 		       u16 reason_code)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_scb_val_le scbval;
+ 	s32 err = 0;
+ 
+@@ -2090,7 +2100,7 @@ brcmf_cfg80211_disconnect(struct wiphy *
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
+ 				     &scbval, sizeof(scbval));
+ 	if (err)
+-		bphy_err(wiphy, "error (%d)\n", err);
++		bphy_err(drvr, "error (%d)\n", err);
+ 
+ 	brcmf_dbg(TRACE, "Exit\n");
+ 	return err;
+@@ -2103,6 +2113,7 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = cfg_to_ndev(cfg);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err;
+ 	s32 disable;
+ 	u32 qdbm = 127;
+@@ -2117,7 +2128,7 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 	case NL80211_TX_POWER_LIMITED:
+ 	case NL80211_TX_POWER_FIXED:
+ 		if (mbm < 0) {
+-			bphy_err(wiphy, "TX_POWER_FIXED - dbm is negative\n");
++			bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
+ 			err = -EINVAL;
+ 			goto done;
+ 		}
+@@ -2127,7 +2138,7 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 		qdbm |= WL_TXPWR_OVERRIDE;
+ 		break;
+ 	default:
+-		bphy_err(wiphy, "Unsupported type %d\n", type);
++		bphy_err(drvr, "Unsupported type %d\n", type);
+ 		err = -EINVAL;
+ 		goto done;
+ 	}
+@@ -2135,11 +2146,11 @@ brcmf_cfg80211_set_tx_power(struct wiphy
+ 	disable = WL_RADIO_SW_DISABLE << 16;
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
+ 	if (err)
+-		bphy_err(wiphy, "WLC_SET_RADIO error (%d)\n", err);
++		bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
+ 
+ 	err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
+ 	if (err)
+-		bphy_err(wiphy, "qtxpower error (%d)\n", err);
++		bphy_err(drvr, "qtxpower error (%d)\n", err);
+ 
+ done:
+ 	brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
+@@ -2150,7 +2161,9 @@ static s32
+ brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 			    s32 *dbm)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 qdbm = 0;
+ 	s32 err;
+ 
+@@ -2160,7 +2173,7 @@ brcmf_cfg80211_get_tx_power(struct wiphy
+ 
+ 	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
+ 	if (err) {
+-		bphy_err(wiphy, "error (%d)\n", err);
++		bphy_err(drvr, "error (%d)\n", err);
+ 		goto done;
+ 	}
+ 	*dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
+@@ -2175,6 +2188,7 @@ brcmf_cfg80211_config_default_key(struct
+ 				  u8 key_idx, bool unicast, bool multicast)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	u32 index;
+ 	u32 wsec;
+ 	s32 err = 0;
+@@ -2186,7 +2200,7 @@ brcmf_cfg80211_config_default_key(struct
+ 
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_GET_WSEC error (%d)\n", err);
++		bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -2196,7 +2210,7 @@ brcmf_cfg80211_config_default_key(struct
+ 		err = brcmf_fil_cmd_int_set(ifp,
+ 					    BRCMF_C_SET_KEY_PRIMARY, index);
+ 		if (err)
+-			bphy_err(wiphy, "error (%d)\n", err);
++			bphy_err(drvr, "error (%d)\n", err);
+ 	}
+ done:
+ 	brcmf_dbg(TRACE, "Exit\n");
+@@ -2245,7 +2259,9 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 		       u8 key_idx, bool pairwise, const u8 *mac_addr,
+ 		       struct key_params *params)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_wsec_key *key;
+ 	s32 val;
+ 	s32 wsec;
+@@ -2260,7 +2276,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 
+ 	if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
+ 		/* we ignore this key index in this case */
+-		bphy_err(wiphy, "invalid key index (%d)\n", key_idx);
++		bphy_err(drvr, "invalid key index (%d)\n", key_idx);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2269,7 +2285,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 					      mac_addr);
+ 
+ 	if (params->key_len > sizeof(key->data)) {
+-		bphy_err(wiphy, "Too long key length (%u)\n", params->key_len);
++		bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2323,7 +2339,7 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
+ 		break;
+ 	default:
+-		bphy_err(wiphy, "Invalid cipher (0x%x)\n", params->cipher);
++		bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
+ 		err = -EINVAL;
+ 		goto done;
+ 	}
+@@ -2334,13 +2350,13 @@ brcmf_cfg80211_add_key(struct wiphy *wip
+ 
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "get wsec error (%d)\n", err);
++		bphy_err(drvr, "get wsec error (%d)\n", err);
+ 		goto done;
+ 	}
+ 	wsec |= val;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "set wsec error (%d)\n", err);
++		bphy_err(drvr, "set wsec error (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -2355,9 +2371,11 @@ brcmf_cfg80211_get_key(struct wiphy *wip
+ 		       void (*callback)(void *cookie,
+ 					struct key_params *params))
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct key_params params;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_security *sec;
+ 	s32 wsec;
+ 	s32 err = 0;
+@@ -2371,7 +2389,7 @@ brcmf_cfg80211_get_key(struct wiphy *wip
+ 
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_GET_WSEC error (%d)\n", err);
++		bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
+ 		/* Ignore this error, may happen during DISASSOC */
+ 		err = -EAGAIN;
+ 		goto done;
+@@ -2392,7 +2410,7 @@ brcmf_cfg80211_get_key(struct wiphy *wip
+ 		params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+ 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
+ 	} else  {
+-		bphy_err(wiphy, "Invalid algo (0x%x)\n", wsec);
++		bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
+ 		err = -EINVAL;
+ 		goto done;
+ 	}
+@@ -2422,7 +2440,7 @@ brcmf_cfg80211_config_default_mgmt_key(s
+ static void
+ brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err;
+ 	u8 key_idx;
+ 	struct brcmf_wsec_key *key;
+@@ -2439,18 +2457,18 @@ brcmf_cfg80211_reconfigure_wep(struct br
+ 
+ 	err = send_key_to_dongle(ifp, key);
+ 	if (err) {
+-		bphy_err(wiphy, "Setting WEP key failed (%d)\n", err);
++		bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
+ 		return;
+ 	}
+ 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+ 	if (err) {
+-		bphy_err(wiphy, "get wsec error (%d)\n", err);
++		bphy_err(drvr, "get wsec error (%d)\n", err);
+ 		return;
+ 	}
+ 	wsec |= WEP_ENABLED;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err)
+-		bphy_err(wiphy, "set wsec error (%d)\n", err);
++		bphy_err(drvr, "set wsec error (%d)\n", err);
+ }
+ 
+ static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
+@@ -2476,7 +2494,7 @@ static void brcmf_convert_sta_flags(u32
+ 
+ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct {
+ 		__le32 len;
+ 		struct brcmf_bss_info_le bss_le;
+@@ -2492,7 +2510,7 @@ static void brcmf_fill_bss_param(struct
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
+ 				     WL_BSS_INFO_MAX);
+ 	if (err) {
+-		bphy_err(wiphy, "Failed to get bss info (%d)\n", err);
++		bphy_err(drvr, "Failed to get bss info (%d)\n", err);
+ 		goto out_kfree;
+ 	}
+ 	si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
+@@ -2514,7 +2532,7 @@ static s32
+ brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
+ 				struct station_info *sinfo)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_scb_val_le scbval;
+ 	struct brcmf_pktcnt_le pktcnt;
+ 	s32 err;
+@@ -2524,7 +2542,7 @@ brcmf_cfg80211_get_station_ibss(struct b
+ 	/* Get the current tx rate */
+ 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "BRCMF_C_GET_RATE error (%d)\n", err);
++		bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
+ 		return err;
+ 	}
+ 	sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+@@ -2534,7 +2552,7 @@ brcmf_cfg80211_get_station_ibss(struct b
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
+ 				     sizeof(scbval));
+ 	if (err) {
+-		bphy_err(wiphy, "BRCMF_C_GET_RSSI error (%d)\n", err);
++		bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
+ 		return err;
+ 	}
+ 	rssi = le32_to_cpu(scbval.val);
+@@ -2544,7 +2562,7 @@ brcmf_cfg80211_get_station_ibss(struct b
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
+ 				     sizeof(pktcnt));
+ 	if (err) {
+-		bphy_err(wiphy, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
++		bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
+ 		return err;
+ 	}
+ 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
+@@ -2563,7 +2581,9 @@ static s32
+ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
+ 			   const u8 *mac, struct station_info *sinfo)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_scb_val_le scb_val;
+ 	s32 err = 0;
+ 	struct brcmf_sta_info_le sta_info_le;
+@@ -2592,7 +2612,7 @@ brcmf_cfg80211_get_station(struct wiphy
+ 					       &sta_info_le,
+ 					       sizeof(sta_info_le));
+ 		if (err < 0) {
+-			bphy_err(wiphy, "GET STA INFO failed, %d\n", err);
++			bphy_err(drvr, "GET STA INFO failed, %d\n", err);
+ 			goto done;
+ 		}
+ 	}
+@@ -2661,7 +2681,7 @@ brcmf_cfg80211_get_station(struct wiphy
+ 			err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
+ 						     &scb_val, sizeof(scb_val));
+ 			if (err) {
+-				bphy_err(wiphy, "Could not get rssi (%d)\n",
++				bphy_err(drvr, "Could not get rssi (%d)\n",
+ 					 err);
+ 				goto done;
+ 			} else {
+@@ -2683,6 +2703,7 @@ brcmf_cfg80211_dump_station(struct wiphy
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err;
+ 
+ 	brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
+@@ -2693,7 +2714,7 @@ brcmf_cfg80211_dump_station(struct wiphy
+ 					     &cfg->assoclist,
+ 					     sizeof(cfg->assoclist));
+ 		if (err) {
+-			bphy_err(wiphy, "BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
++			bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
+ 				 err);
+ 			cfg->assoclist.count = 0;
+ 			return -EOPNOTSUPP;
+@@ -2714,6 +2735,7 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 	s32 err = 0;
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -2742,9 +2764,9 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
+ 	if (err) {
+ 		if (err == -ENODEV)
+-			bphy_err(wiphy, "net_device is not ready yet\n");
++			bphy_err(drvr, "net_device is not ready yet\n");
+ 		else
+-			bphy_err(wiphy, "error (%d)\n", err);
++			bphy_err(drvr, "error (%d)\n", err);
+ 	}
+ done:
+ 	brcmf_dbg(TRACE, "Exit\n");
+@@ -2755,6 +2777,7 @@ static s32 brcmf_inform_single_bss(struc
+ 				   struct brcmf_bss_info_le *bi)
+ {
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct cfg80211_bss *bss;
+ 	enum nl80211_band band;
+ 	struct brcmu_chan ch;
+@@ -2767,7 +2790,7 @@ static s32 brcmf_inform_single_bss(struc
+ 	struct cfg80211_inform_bss bss_data = {};
+ 
+ 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
+-		bphy_err(wiphy, "Bss info is larger than buffer. Discarding\n");
++		bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
+ 		return 0;
+ 	}
+ 
+@@ -2826,7 +2849,7 @@ next_bss_le(struct brcmf_scan_results *l
+ 
+ static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_scan_results *bss_list;
+ 	struct brcmf_bss_info_le *bi = NULL;	/* must be initialized */
+ 	s32 err = 0;
+@@ -2835,7 +2858,7 @@ static s32 brcmf_inform_bss(struct brcmf
+ 	bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
+ 	if (bss_list->count != 0 &&
+ 	    bss_list->version != BRCMF_BSS_INFO_VERSION) {
+-		bphy_err(wiphy, "Version %d != WL_BSS_INFO_VERSION\n",
++		bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
+ 			 bss_list->version);
+ 		return -EOPNOTSUPP;
+ 	}
+@@ -2853,6 +2876,7 @@ static s32 brcmf_inform_ibss(struct brcm
+ 			     struct net_device *ndev, const u8 *bssid)
+ {
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct ieee80211_channel *notify_channel;
+ 	struct brcmf_bss_info_le *bi = NULL;
+ 	struct ieee80211_supported_band *band;
+@@ -2880,7 +2904,7 @@ static s32 brcmf_inform_ibss(struct brcm
+ 	err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
+ 				     buf, WL_BSS_INFO_MAX);
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_GET_BSS_INFO failed: %d\n", err);
++		bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
+ 		goto CleanUp;
+ 	}
+ 
+@@ -2934,7 +2958,7 @@ CleanUp:
+ static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
+ 				 struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_bss_info_le *bi;
+ 	const struct brcmf_tlv *tim;
+ 	u16 beacon_interval;
+@@ -2951,7 +2975,7 @@ static s32 brcmf_update_bss_info(struct
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
+ 				     cfg->extra_buf, WL_EXTRA_BUF_MAX);
+ 	if (err) {
+-		bphy_err(wiphy, "Could not get bss info %d\n", err);
++		bphy_err(drvr, "Could not get bss info %d\n", err);
+ 		goto update_bss_info_out;
+ 	}
+ 
+@@ -2976,7 +3000,7 @@ static s32 brcmf_update_bss_info(struct
+ 		u32 var;
+ 		err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
+ 		if (err) {
+-			bphy_err(wiphy, "wl dtim_assoc failed (%d)\n", err);
++			bphy_err(drvr, "wl dtim_assoc failed (%d)\n", err);
+ 			goto update_bss_info_out;
+ 		}
+ 		dtim_period = (u8)var;
+@@ -3014,10 +3038,10 @@ static void brcmf_escan_timeout(unsigned
+ {
+ 	struct brcmf_cfg80211_info *cfg =
+ 			(struct brcmf_cfg80211_info *)data;
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 
+ 	if (cfg->int_escan_map || cfg->scan_request) {
+-		bphy_err(wiphy, "timer expired\n");
++		bphy_err(drvr, "timer expired\n");
+ 		schedule_work(&cfg->escan_timeout_work);
+ 	}
+ }
+@@ -3065,8 +3089,8 @@ static s32
+ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
+ 			     const struct brcmf_event_msg *e, void *data)
+ {
+-	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_cfg80211_info *cfg = drvr->config;
+ 	s32 status;
+ 	struct brcmf_escan_result_le *escan_result_le;
+ 	u32 escan_buflen;
+@@ -3083,7 +3107,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		goto exit;
+ 
+ 	if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+-		bphy_err(wiphy, "scan not ready, bsscfgidx=%d\n",
++		bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
+ 			 ifp->bsscfgidx);
+ 		return -EPERM;
+ 	}
+@@ -3091,24 +3115,24 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 	if (status == BRCMF_E_STATUS_PARTIAL) {
+ 		brcmf_dbg(SCAN, "ESCAN Partial result\n");
+ 		if (e->datalen < sizeof(*escan_result_le)) {
+-			bphy_err(wiphy, "invalid event data length\n");
++			bphy_err(drvr, "invalid event data length\n");
+ 			goto exit;
+ 		}
+ 		escan_result_le = (struct brcmf_escan_result_le *) data;
+ 		if (!escan_result_le) {
+-			bphy_err(wiphy, "Invalid escan result (NULL pointer)\n");
++			bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
+ 			goto exit;
+ 		}
+ 		escan_buflen = le32_to_cpu(escan_result_le->buflen);
+ 		if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+ 		    escan_buflen > e->datalen ||
+ 		    escan_buflen < sizeof(*escan_result_le)) {
+-			bphy_err(wiphy, "Invalid escan buffer length: %d\n",
++			bphy_err(drvr, "Invalid escan buffer length: %d\n",
+ 				 escan_buflen);
+ 			goto exit;
+ 		}
+ 		if (le16_to_cpu(escan_result_le->bss_count) != 1) {
+-			bphy_err(wiphy, "Invalid bss_count %d: ignoring\n",
++			bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
+ 				 escan_result_le->bss_count);
+ 			goto exit;
+ 		}
+@@ -3124,7 +3148,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 
+ 		bi_length = le32_to_cpu(bss_info_le->length);
+ 		if (bi_length != escan_buflen -	WL_ESCAN_RESULTS_FIXED_SIZE) {
+-			bphy_err(wiphy, "Ignoring invalid bss_info length: %d\n",
++			bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
+ 				 bi_length);
+ 			goto exit;
+ 		}
+@@ -3133,7 +3157,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 					BIT(NL80211_IFTYPE_ADHOC))) {
+ 			if (le16_to_cpu(bss_info_le->capability) &
+ 						WLAN_CAPABILITY_IBSS) {
+-				bphy_err(wiphy, "Ignoring IBSS result\n");
++				bphy_err(drvr, "Ignoring IBSS result\n");
+ 				goto exit;
+ 			}
+ 		}
+@@ -3141,7 +3165,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		list = (struct brcmf_scan_results *)
+ 				cfg->escan_info.escan_buf;
+ 		if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
+-			bphy_err(wiphy, "Buffer is too small: ignoring\n");
++			bphy_err(drvr, "Buffer is too small: ignoring\n");
+ 			goto exit;
+ 		}
+ 
+@@ -3301,7 +3325,8 @@ static s32
+ brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
+ 				const struct brcmf_event_msg *e, void *data)
+ {
+-	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_cfg80211_info *cfg = drvr->config;
+ 	struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
+ 	struct cfg80211_scan_request *request = NULL;
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+@@ -3334,14 +3359,14 @@ brcmf_notify_sched_scan_results(struct b
+ 	WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
+ 	brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
+ 	if (!result_count) {
+-		bphy_err(wiphy, "FALSE PNO Event. (pfn_count == 0)\n");
++		bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
+ 		goto out_err;
+ 	}
+ 
+ 	netinfo_start = brcmf_get_netinfo_array(pfn_result);
+ 	datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
+ 	if (datalen < result_count * sizeof(*netinfo)) {
+-		bphy_err(wiphy, "insufficient event data\n");
++		bphy_err(drvr, "insufficient event data\n");
+ 		goto out_err;
+ 	}
+ 
+@@ -3388,14 +3413,15 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 				struct net_device *ndev,
+ 				struct cfg80211_sched_scan_request *req)
+ {
+-	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 
+ 	brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
+ 		  req->n_match_sets, req->n_ssids);
+ 
+ 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
+-		bphy_err(wiphy, "Scanning suppressed: status=%lu\n",
++		bphy_err(drvr, "Scanning suppressed: status=%lu\n",
+ 			 cfg->scan_status);
+ 		return -EAGAIN;
+ 	}
+@@ -3474,8 +3500,8 @@ static s32
+ brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
+ 		      void *data)
+ {
+-	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_cfg80211_info *cfg = drvr->config;
+ 	struct brcmf_pno_scanresults_le *pfn_result;
+ 	struct brcmf_pno_net_info_le *netinfo;
+ 
+@@ -3494,7 +3520,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+ 	}
+ 
+ 	if (le32_to_cpu(pfn_result->count) < 1) {
+-		bphy_err(wiphy, "Invalid result count, expected 1 (%d)\n",
++		bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
+ 			 le32_to_cpu(pfn_result->count));
+ 		return -EINVAL;
+ 	}
+@@ -3522,6 +3548,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+ static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_wowl_wakeind_le wake_ind_le;
+ 	struct cfg80211_wowlan_wakeup wakeup_data;
+ 	struct cfg80211_wowlan_wakeup *wakeup;
+@@ -3532,7 +3559,7 @@ static void brcmf_report_wowl_wakeind(st
+ 	err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
+ 				       sizeof(wake_ind_le));
+ 	if (err) {
+-		bphy_err(wiphy, "Get wowl_wakeind failed, err = %d\n", err);
++		bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
+ 		return;
+ 	}
+ 
+@@ -3573,7 +3600,7 @@ static void brcmf_report_wowl_wakeind(st
+ 				cfg->wowl.nd_data_completed,
+ 				BRCMF_ND_INFO_TIMEOUT);
+ 			if (!timeout)
+-				bphy_err(wiphy, "No result for wowl net detect\n");
++				bphy_err(drvr, "No result for wowl net detect\n");
+ 			else
+ 				wakeup_data.net_detect = cfg->wowl.nd_info;
+ 		}
+@@ -3762,6 +3789,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err;
+ 	u32 npmk, i;
+ 
+@@ -3781,7 +3809,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
+ 			cfg->pmk_list.npmk = cpu_to_le32(npmk);
+ 		}
+ 	} else {
+-		bphy_err(wiphy, "Too many PMKSA entries cached %d\n", npmk);
++		bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -3804,6 +3832,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err;
+ 	u32 npmk, i;
+ 
+@@ -3827,7 +3856,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
+ 		memset(&pmk[i], 0, sizeof(*pmk));
+ 		cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
+ 	} else {
+-		bphy_err(wiphy, "Cache entry not found\n");
++		bphy_err(drvr, "Cache entry not found\n");
+ 		return -EINVAL;
+ 	}
+ 
+@@ -3859,20 +3888,20 @@ brcmf_cfg80211_flush_pmksa(struct wiphy
+ 
+ static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err;
+ 	s32 wpa_val;
+ 
+ 	/* set auth */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "auth error %d\n", err);
++		bphy_err(drvr, "auth error %d\n", err);
+ 		return err;
+ 	}
+ 	/* set wsec */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "wsec error %d\n", err);
++		bphy_err(drvr, "wsec error %d\n", err);
+ 		return err;
+ 	}
+ 	/* set upper-layer auth */
+@@ -3882,7 +3911,7 @@ static s32 brcmf_configure_opensecurity(
+ 		wpa_val = WPA_AUTH_DISABLED;
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "wpa_auth error %d\n", err);
++		bphy_err(drvr, "wpa_auth error %d\n", err);
+ 		return err;
+ 	}
+ 
+@@ -3902,7 +3931,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 		      const struct brcmf_vs_tlv *wpa_ie,
+ 		      bool is_rsn_ie)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	u32 auth = 0; /* d11 open authentication */
+ 	u16 count;
+ 	s32 err = 0;
+@@ -3933,13 +3962,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* check for multicast cipher suite */
+ 	if (offset + WPA_IE_MIN_OUI_LEN > len) {
+ 		err = -EINVAL;
+-		bphy_err(wiphy, "no multicast cipher suite\n");
++		bphy_err(drvr, "no multicast cipher suite\n");
+ 		goto exit;
+ 	}
+ 
+ 	if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+ 		err = -EINVAL;
+-		bphy_err(wiphy, "ivalid OUI\n");
++		bphy_err(drvr, "ivalid OUI\n");
+ 		goto exit;
+ 	}
+ 	offset += TLV_OUI_LEN;
+@@ -3961,7 +3990,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 		break;
+ 	default:
+ 		err = -EINVAL;
+-		bphy_err(wiphy, "Invalid multi cast cipher info\n");
++		bphy_err(drvr, "Invalid multi cast cipher info\n");
+ 		goto exit;
+ 	}
+ 
+@@ -3972,13 +4001,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* Check for unicast suite(s) */
+ 	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
+ 		err = -EINVAL;
+-		bphy_err(wiphy, "no unicast cipher suite\n");
++		bphy_err(drvr, "no unicast cipher suite\n");
+ 		goto exit;
+ 	}
+ 	for (i = 0; i < count; i++) {
+ 		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+ 			err = -EINVAL;
+-			bphy_err(wiphy, "ivalid OUI\n");
++			bphy_err(drvr, "ivalid OUI\n");
+ 			goto exit;
+ 		}
+ 		offset += TLV_OUI_LEN;
+@@ -3996,7 +4025,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 			pval |= AES_ENABLED;
+ 			break;
+ 		default:
+-			bphy_err(wiphy, "Invalid unicast security info\n");
++			bphy_err(drvr, "Invalid unicast security info\n");
+ 		}
+ 		offset++;
+ 	}
+@@ -4006,13 +4035,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* Check for auth key management suite(s) */
+ 	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
+ 		err = -EINVAL;
+-		bphy_err(wiphy, "no auth key mgmt suite\n");
++		bphy_err(drvr, "no auth key mgmt suite\n");
+ 		goto exit;
+ 	}
+ 	for (i = 0; i < count; i++) {
+ 		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+ 			err = -EINVAL;
+-			bphy_err(wiphy, "ivalid OUI\n");
++			bphy_err(drvr, "ivalid OUI\n");
+ 			goto exit;
+ 		}
+ 		offset += TLV_OUI_LEN;
+@@ -4040,7 +4069,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 			wpa_auth |= WPA2_AUTH_1X_SHA256;
+ 			break;
+ 		default:
+-			bphy_err(wiphy, "Invalid key mgmt info\n");
++			bphy_err(drvr, "Invalid key mgmt info\n");
+ 		}
+ 		offset++;
+ 	}
+@@ -4082,7 +4111,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 		err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
+ 					       wme_bss_disable);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "wme_bss_disable error %d\n", err);
++			bphy_err(drvr, "wme_bss_disable error %d\n", err);
+ 			goto exit;
+ 		}
+ 
+@@ -4096,7 +4125,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 							&data[offset],
+ 							WPA_IE_MIN_OUI_LEN);
+ 			if (err < 0) {
+-				bphy_err(wiphy, "bip error %d\n", err);
++				bphy_err(drvr, "bip error %d\n", err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4107,13 +4136,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	/* set auth */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "auth error %d\n", err);
++		bphy_err(drvr, "auth error %d\n", err);
+ 		goto exit;
+ 	}
+ 	/* set wsec */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "wsec error %d\n", err);
++		bphy_err(drvr, "wsec error %d\n", err);
+ 		goto exit;
+ 	}
+ 	/* Configure MFP, this needs to go after wsec otherwise the wsec command
+@@ -4122,14 +4151,14 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
+ 		err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "mfp error %d\n", err);
++			bphy_err(drvr, "mfp error %d\n", err);
+ 			goto exit;
+ 		}
+ 	}
+ 	/* set upper-layer auth */
+ 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "wpa_auth error %d\n", err);
++		bphy_err(drvr, "wpa_auth error %d\n", err);
+ 		goto exit;
+ 	}
+ 
+@@ -4215,8 +4244,8 @@ brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8
+ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
+ 			  const u8 *vndr_ie_buf, u32 vndr_ie_len)
+ {
++	struct brcmf_pub *drvr;
+ 	struct brcmf_if *ifp;
+-	struct wiphy *wiphy;
+ 	struct vif_saved_ie *saved_ie;
+ 	s32 err = 0;
+ 	u8  *iovar_ie_buf;
+@@ -4237,7 +4266,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 	if (!vif)
+ 		return -ENODEV;
+ 	ifp = vif->ifp;
+-	wiphy = ifp->drvr->wiphy;
++	drvr = ifp->drvr;
+ 	saved_ie = &vif->saved_ie;
+ 
+ 	brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
+@@ -4269,13 +4298,13 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 		break;
+ 	default:
+ 		err = -EPERM;
+-		bphy_err(wiphy, "not suitable type\n");
++		bphy_err(drvr, "not suitable type\n");
+ 		goto exit;
+ 	}
+ 
+ 	if (vndr_ie_len > mgmt_ie_buf_len) {
+ 		err = -ENOMEM;
+-		bphy_err(wiphy, "extra IE size too big\n");
++		bphy_err(drvr, "extra IE size too big\n");
+ 		goto exit;
+ 	}
+ 
+@@ -4336,7 +4365,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 			/* verify remained buf size before copy data */
+ 			if (remained_buf_len < (vndrie_info->vndrie.len +
+ 							VNDR_IE_VSIE_OFFSET)) {
+-				bphy_err(wiphy, "no space in mgmt_ie_buf: len left %d",
++				bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
+ 					 remained_buf_len);
+ 				break;
+ 			}
+@@ -4368,7 +4397,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+ 		err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
+ 						 total_ie_buf_len);
+ 		if (err)
+-			bphy_err(wiphy, "vndr ie set error : %d\n", err);
++			bphy_err(drvr, "vndr ie set error : %d\n", err);
+ 	}
+ 
+ exit:
+@@ -4396,14 +4425,14 @@ static s32
+ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
+ 			struct cfg80211_beacon_data *beacon)
+ {
+-	struct wiphy *wiphy = vif->ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = vif->ifp->drvr;
+ 	s32 err;
+ 
+ 	/* Set Beacon IEs to FW */
+ 	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
+ 				    beacon->tail, beacon->tail_len);
+ 	if (err) {
+-		bphy_err(wiphy, "Set Beacon IE Failed\n");
++		bphy_err(drvr, "Set Beacon IE Failed\n");
+ 		return err;
+ 	}
+ 	brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
+@@ -4413,7 +4442,7 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg
+ 				    beacon->proberesp_ies,
+ 				    beacon->proberesp_ies_len);
+ 	if (err)
+-		bphy_err(wiphy, "Set Probe Resp IE Failed\n");
++		bphy_err(drvr, "Set Probe Resp IE Failed\n");
+ 	else
+ 		brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
+ 
+@@ -4427,6 +4456,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 	s32 ie_offset;
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	const struct brcmf_tlv *ssid_ie;
+ 	const struct brcmf_tlv *country_ie;
+ 	struct brcmf_ssid_le ssid_le;
+@@ -4522,7 +4552,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+ 						    is_11d);
+ 			if (err < 0) {
+-				bphy_err(wiphy, "Regulatory Set Error, %d\n",
++				bphy_err(drvr, "Regulatory Set Error, %d\n",
+ 					 err);
+ 				goto exit;
+ 			}
+@@ -4531,7 +4561,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
+ 						    settings->beacon_interval);
+ 			if (err < 0) {
+-				bphy_err(wiphy, "Beacon Interval Set Error, %d\n",
++				bphy_err(drvr, "Beacon Interval Set Error, %d\n",
+ 					 err);
+ 				goto exit;
+ 			}
+@@ -4540,7 +4570,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
+ 						    settings->dtim_period);
+ 			if (err < 0) {
+-				bphy_err(wiphy, "DTIM Interval Set Error, %d\n",
++				bphy_err(drvr, "DTIM Interval Set Error, %d\n",
+ 					 err);
+ 				goto exit;
+ 			}
+@@ -4551,7 +4581,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		     !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
+ 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
+ 			if (err < 0) {
+-				bphy_err(wiphy, "BRCMF_C_DOWN error %d\n",
++				bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
+ 					 err);
+ 				goto exit;
+ 			}
+@@ -4560,7 +4590,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "SET INFRA error %d\n", err);
++			bphy_err(drvr, "SET INFRA error %d\n", err);
+ 			goto exit;
+ 		}
+ 	} else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
+@@ -4576,7 +4606,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "setting AP mode failed %d\n",
++			bphy_err(drvr, "setting AP mode failed %d\n",
+ 				 err);
+ 			goto exit;
+ 		}
+@@ -4586,14 +4616,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 			 */
+ 			err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
+ 			if (err < 0) {
+-				bphy_err(wiphy, "Set Channel failed: chspec=%d, %d\n",
++				bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
+ 					 chanspec, err);
+ 				goto exit;
+ 			}
+ 		}
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "BRCMF_C_UP error (%d)\n", err);
++			bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
+ 			goto exit;
+ 		}
+ 		/* On DOWN the firmware removes the WEP keys, reconfigure
+@@ -4608,14 +4638,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 					     &join_params, sizeof(join_params));
+ 		if (err < 0) {
+-			bphy_err(wiphy, "SET SSID error (%d)\n", err);
++			bphy_err(drvr, "SET SSID error (%d)\n", err);
+ 			goto exit;
+ 		}
+ 
+ 		if (settings->hidden_ssid) {
+ 			err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
+ 			if (err) {
+-				bphy_err(wiphy, "closednet error (%d)\n", err);
++				bphy_err(drvr, "closednet error (%d)\n", err);
+ 				goto exit;
+ 			}
+ 		}
+@@ -4624,14 +4654,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 	} else if (dev_role == NL80211_IFTYPE_P2P_GO) {
+ 		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
+ 		if (err < 0) {
+-			bphy_err(wiphy, "Set Channel failed: chspec=%d, %d\n",
++			bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
+ 				 chanspec, err);
+ 			goto exit;
+ 		}
+ 		err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
+ 						sizeof(ssid_le));
+ 		if (err < 0) {
+-			bphy_err(wiphy, "setting ssid failed %d\n", err);
++			bphy_err(drvr, "setting ssid failed %d\n", err);
+ 			goto exit;
+ 		}
+ 		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
+@@ -4639,7 +4669,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+ 					       sizeof(bss_enable));
+ 		if (err < 0) {
+-			bphy_err(wiphy, "bss_enable config failed %d\n", err);
++			bphy_err(drvr, "bss_enable config failed %d\n", err);
+ 			goto exit;
+ 		}
+ 
+@@ -4662,7 +4692,9 @@ exit:
+ 
+ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err;
+ 	struct brcmf_fil_bss_enable_le bss_enable;
+ 	struct brcmf_join_params join_params;
+@@ -4687,13 +4719,13 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+ 					     &join_params, sizeof(join_params));
+ 		if (err < 0)
+-			bphy_err(wiphy, "SET SSID error (%d)\n", err);
++			bphy_err(drvr, "SET SSID error (%d)\n", err);
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
+ 		if (err < 0)
+-			bphy_err(wiphy, "BRCMF_C_DOWN error %d\n", err);
++			bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
+ 		if (err < 0)
+-			bphy_err(wiphy, "setting AP mode failed %d\n", err);
++			bphy_err(drvr, "setting AP mode failed %d\n", err);
+ 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
+ 			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
+ 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+@@ -4701,7 +4733,7 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		/* Bring device back up so it can be used again */
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
+ 		if (err < 0)
+-			bphy_err(wiphy, "BRCMF_C_UP error %d\n", err);
++			bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
+ 
+ 		brcmf_vif_clear_mgmt_ies(ifp->vif);
+ 	} else {
+@@ -4710,7 +4742,7 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+ 					       sizeof(bss_enable));
+ 		if (err < 0)
+-			bphy_err(wiphy, "bss_enable config failed %d\n", err);
++			bphy_err(drvr, "bss_enable config failed %d\n", err);
+ 	}
+ 	brcmf_set_mpc(ifp, 1);
+ 	brcmf_configure_arp_nd_offload(ifp, true);
+@@ -4739,6 +4771,7 @@ brcmf_cfg80211_del_station(struct wiphy
+ 			   struct station_del_parameters *params)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_scb_val_le scbval;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	s32 err;
+@@ -4758,7 +4791,7 @@ brcmf_cfg80211_del_station(struct wiphy
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
+ 				     &scbval, sizeof(scbval));
+ 	if (err)
+-		bphy_err(wiphy, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
++		bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
+ 			 err);
+ 
+ 	brcmf_dbg(TRACE, "Exit\n");
+@@ -4769,6 +4802,8 @@ static int
+ brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
+ 			      const u8 *mac, struct station_parameters *params)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	s32 err;
+ 
+@@ -4789,7 +4824,7 @@ brcmf_cfg80211_change_station(struct wip
+ 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
+ 					     (void *)mac, ETH_ALEN);
+ 	if (err < 0)
+-		bphy_err(wiphy, "Setting SCB (de-)authorize failed, %d\n", err);
++		bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
+ 
+ 	return err;
+ }
+@@ -4819,6 +4854,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct ieee80211_channel *chan = params->chan;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	const u8 *buf = params->buf;
+ 	size_t len = params->len;
+ 	const struct ieee80211_mgmt *mgmt;
+@@ -4839,7 +4875,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ 	mgmt = (const struct ieee80211_mgmt *)buf;
+ 
+ 	if (!ieee80211_is_mgmt(mgmt->frame_control)) {
+-		bphy_err(wiphy, "Driver only allows MGMT packet type\n");
++		bphy_err(drvr, "Driver only allows MGMT packet type\n");
+ 		return -EPERM;
+ 	}
+ 
+@@ -4870,13 +4906,13 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+ 					GFP_KERNEL);
+ 	} else if (ieee80211_is_action(mgmt->frame_control)) {
+ 		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
+-			bphy_err(wiphy, "invalid action frame length\n");
++			bphy_err(drvr, "invalid action frame length\n");
+ 			err = -EINVAL;
+ 			goto exit;
+ 		}
+ 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
+ 		if (af_params == NULL) {
+-			bphy_err(wiphy, "unable to allocate frame\n");
++			bphy_err(drvr, "unable to allocate frame\n");
+ 			err = -ENOMEM;
+ 			goto exit;
+ 		}
+@@ -4927,6 +4963,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
+ 					u64 cookie)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	int err = 0;
+ 
+@@ -4934,7 +4971,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
+ 
+ 	vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+ 	if (vif == NULL) {
+-		bphy_err(wiphy, "No p2p device available for probe response\n");
++		bphy_err(drvr, "No p2p device available for probe response\n");
+ 		err = -ENODEV;
+ 		goto exit;
+ 	}
+@@ -4949,6 +4986,7 @@ static int brcmf_cfg80211_get_channel(st
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_if *ifp;
+ 	struct brcmu_chan ch;
+ 	enum nl80211_band band = 0;
+@@ -4962,7 +5000,7 @@ static int brcmf_cfg80211_get_channel(st
+ 
+ 	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
+ 	if (err) {
+-		bphy_err(wiphy, "chanspec failed (%d)\n", err);
++		bphy_err(drvr, "chanspec failed (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -5084,6 +5122,8 @@ static int brcmf_cfg80211_tdls_oper(stru
+ 				    struct net_device *ndev, const u8 *peer,
+ 				    enum nl80211_tdls_operation oper)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_if *ifp;
+ 	struct brcmf_tdls_iovar_le info;
+ 	int ret = 0;
+@@ -5101,7 +5141,7 @@ static int brcmf_cfg80211_tdls_oper(stru
+ 	ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
+ 				       &info, sizeof(info));
+ 	if (ret < 0)
+-		bphy_err(wiphy, "tdls_endpoint iovar failed: ret=%d\n", ret);
++		bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
+ 
+ 	return ret;
+ }
+@@ -5112,6 +5152,8 @@ brcmf_cfg80211_update_conn_params(struct
+ 				  struct cfg80211_connect_params *sme,
+ 				  u32 changed)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_if *ifp;
+ 	int err;
+ 
+@@ -5122,7 +5164,7 @@ brcmf_cfg80211_update_conn_params(struct
+ 	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
+ 				    sme->ie, sme->ie_len);
+ 	if (err)
+-		bphy_err(wiphy, "Set Assoc REQ IE Failed\n");
++		bphy_err(drvr, "Set Assoc REQ IE Failed\n");
+ 	else
+ 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
+ 
+@@ -5134,6 +5176,8 @@ static int
+ brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
+ 			      struct cfg80211_gtk_rekey_data *gtk)
+ {
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_gtk_keyinfo_le gtk_le;
+ 	int ret;
+@@ -5148,7 +5192,7 @@ brcmf_cfg80211_set_rekey_data(struct wip
+ 	ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
+ 				       sizeof(gtk_le));
+ 	if (ret < 0)
+-		bphy_err(wiphy, "gtk_key_info iovar failed: ret=%d\n", ret);
++		bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
+ 
+ 	return ret;
+ }
+@@ -5380,7 +5424,7 @@ static void brcmf_clear_assoc_ies(struct
+ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
+ 			       struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
+ 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
+ 	u32 req_len;
+@@ -5392,7 +5436,7 @@ static s32 brcmf_get_assoc_ies(struct br
+ 	err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
+ 				       cfg->extra_buf, WL_ASSOC_INFO_MAX);
+ 	if (err) {
+-		bphy_err(wiphy, "could not get assoc info (%d)\n", err);
++		bphy_err(drvr, "could not get assoc info (%d)\n", err);
+ 		return err;
+ 	}
+ 	assoc_info =
+@@ -5404,7 +5448,7 @@ static s32 brcmf_get_assoc_ies(struct br
+ 					       cfg->extra_buf,
+ 					       WL_ASSOC_INFO_MAX);
+ 		if (err) {
+-			bphy_err(wiphy, "could not get assoc req (%d)\n", err);
++			bphy_err(drvr, "could not get assoc req (%d)\n", err);
+ 			return err;
+ 		}
+ 		conn_info->req_ie_len = req_len;
+@@ -5420,7 +5464,7 @@ static s32 brcmf_get_assoc_ies(struct br
+ 					       cfg->extra_buf,
+ 					       WL_ASSOC_INFO_MAX);
+ 		if (err) {
+-			bphy_err(wiphy, "could not get assoc resp (%d)\n", err);
++			bphy_err(drvr, "could not get assoc resp (%d)\n", err);
+ 			return err;
+ 		}
+ 		conn_info->resp_ie_len = resp_len;
+@@ -5547,7 +5591,7 @@ brcmf_notify_connect_status_ap(struct br
+ 			       struct net_device *ndev,
+ 			       const struct brcmf_event_msg *e, void *data)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	static int generation;
+ 	u32 event = e->event_code;
+ 	u32 reason = e->reason;
+@@ -5566,7 +5610,7 @@ brcmf_notify_connect_status_ap(struct br
+ 	    (reason == BRCMF_E_STATUS_SUCCESS)) {
+ 		memset(&sinfo, 0, sizeof(sinfo));
+ 		if (!data) {
+-			bphy_err(wiphy, "No IEs present in ASSOC/REASSOC_IND\n");
++			bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
+ 			return -EINVAL;
+ 		}
+ 		sinfo.assoc_req_ies = data;
+@@ -5851,7 +5895,7 @@ static void init_vif_event(struct brcmf_
+ 
+ static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err;
+ 	u32 bcn_timeout;
+ 	__le32 roamtrigger[2];
+@@ -5864,7 +5908,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
+ 	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
+ 	if (err) {
+-		bphy_err(wiphy, "bcn_timeout error (%d)\n", err);
++		bphy_err(drvr, "bcn_timeout error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5876,7 +5920,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 	err = brcmf_fil_iovar_int_set(ifp, "roam_off",
+ 				      ifp->drvr->settings->roamoff);
+ 	if (err) {
+-		bphy_err(wiphy, "roam_off error (%d)\n", err);
++		bphy_err(drvr, "roam_off error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5885,7 +5929,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
+ 				     (void *)roamtrigger, sizeof(roamtrigger));
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
++		bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5894,7 +5938,7 @@ static s32 brcmf_dongle_roam(struct brcm
+ 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
+ 				     (void *)roam_delta, sizeof(roam_delta));
+ 	if (err) {
+-		bphy_err(wiphy, "WLC_SET_ROAM_DELTA error (%d)\n", err);
++		bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
+ 		goto roam_setup_done;
+ 	}
+ 
+@@ -5905,26 +5949,26 @@ roam_setup_done:
+ static s32
+ brcmf_dongle_scantime(struct brcmf_if *ifp)
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 err = 0;
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+ 				    BRCMF_SCAN_CHANNEL_TIME);
+ 	if (err) {
+-		bphy_err(wiphy, "Scan assoc time error (%d)\n", err);
++		bphy_err(drvr, "Scan assoc time error (%d)\n", err);
+ 		goto dongle_scantime_out;
+ 	}
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+ 				    BRCMF_SCAN_UNASSOC_TIME);
+ 	if (err) {
+-		bphy_err(wiphy, "Scan unassoc time error (%d)\n", err);
++		bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
+ 		goto dongle_scantime_out;
+ 	}
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
+ 				    BRCMF_SCAN_PASSIVE_TIME);
+ 	if (err) {
+-		bphy_err(wiphy, "Scan passive time error (%d)\n", err);
++		bphy_err(drvr, "Scan passive time error (%d)\n", err);
+ 		goto dongle_scantime_out;
+ 	}
+ 
+@@ -5957,7 +6001,8 @@ static int brcmf_construct_chaninfo(stru
+ 				    u32 bw_cap[])
+ {
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+-	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
++	struct brcmf_pub *drvr = cfg->pub;
++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct ieee80211_channel *channel;
+ 	struct brcmf_chanspec_list *list;
+@@ -5978,7 +6023,7 @@ static int brcmf_construct_chaninfo(stru
+ 	err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
+ 				       BRCMF_DCMD_MEDLEN);
+ 	if (err) {
+-		bphy_err(wiphy, "get chanspecs error (%d)\n", err);
++		bphy_err(drvr, "get chanspecs error (%d)\n", err);
+ 		goto fail_pbuf;
+ 	}
+ 
+@@ -6001,7 +6046,7 @@ static int brcmf_construct_chaninfo(stru
+ 		} else if (ch.band == BRCMU_CHAN_BAND_5G) {
+ 			band = wiphy->bands[NL80211_BAND_5GHZ];
+ 		} else {
+-			bphy_err(wiphy, "Invalid channel Spec. 0x%x.\n",
++			bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
+ 				 ch.chspec);
+ 			continue;
+ 		}
+@@ -6025,7 +6070,7 @@ static int brcmf_construct_chaninfo(stru
+ 			/* It seems firmware supports some channel we never
+ 			 * considered. Something new in IEEE standard?
+ 			 */
+-			bphy_err(wiphy, "Ignoring unexpected firmware channel %d\n",
++			bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
+ 				 ch.control_ch_num);
+ 			continue;
+ 		}
+@@ -6082,8 +6127,8 @@ fail_pbuf:
+ 
+ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+-	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
++	struct brcmf_pub *drvr = cfg->pub;
++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct brcmf_fil_bwcap_le band_bwcap;
+ 	struct brcmf_chanspec_list *list;
+@@ -6129,7 +6174,7 @@ static int brcmf_enable_bw40_2g(struct b
+ 		err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
+ 					       BRCMF_DCMD_MEDLEN);
+ 		if (err) {
+-			bphy_err(wiphy, "get chanspecs error (%d)\n", err);
++			bphy_err(drvr, "get chanspecs error (%d)\n", err);
+ 			kfree(pbuf);
+ 			return err;
+ 		}
+@@ -6160,7 +6205,7 @@ static int brcmf_enable_bw40_2g(struct b
+ 
+ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
+ {
+-	struct wiphy *wiphy = ifp->drvr->wiphy;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	u32 band, mimo_bwcap;
+ 	int err;
+ 
+@@ -6196,7 +6241,7 @@ static void brcmf_get_bwcap(struct brcmf
+ 		bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
+ 		break;
+ 	default:
+-		bphy_err(wiphy, "invalid mimo_bw_cap value\n");
++		bphy_err(drvr, "invalid mimo_bw_cap value\n");
+ 	}
+ }
+ 
+@@ -6271,7 +6316,8 @@ static void brcmf_update_vht_cap(struct
+ 
+ static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
++	struct brcmf_pub *drvr = cfg->pub;
++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	u32 nmode = 0;
+ 	u32 vhtmode = 0;
+@@ -6288,7 +6334,7 @@ static int brcmf_setup_wiphybands(struct
+ 	(void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
+ 	err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
+ 	if (err) {
+-		bphy_err(wiphy, "nmode error (%d)\n", err);
++		bphy_err(drvr, "nmode error (%d)\n", err);
+ 	} else {
+ 		brcmf_get_bwcap(ifp, bw_cap);
+ 	}
+@@ -6298,7 +6344,7 @@ static int brcmf_setup_wiphybands(struct
+ 
+ 	err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
+ 	if (err) {
+-		bphy_err(wiphy, "rxchain error (%d)\n", err);
++		bphy_err(drvr, "rxchain error (%d)\n", err);
+ 		nchain = 1;
+ 	} else {
+ 		for (nchain = 0; rxchain; nchain++)
+@@ -6308,7 +6354,7 @@ static int brcmf_setup_wiphybands(struct
+ 
+ 	err = brcmf_construct_chaninfo(cfg, bw_cap);
+ 	if (err) {
+-		bphy_err(wiphy, "brcmf_construct_chaninfo failed (%d)\n", err);
++		bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -6515,12 +6561,13 @@ static void brcmf_wiphy_wowl_params(stru
+ {
+ #ifdef CONFIG_PM
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct wiphy_wowlan_support *wowl;
+ 
+ 	wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
+ 		       GFP_KERNEL);
+ 	if (!wowl) {
+-		bphy_err(wiphy, "only support basic wowlan features\n");
++		bphy_err(drvr, "only support basic wowlan features\n");
+ 		wiphy->wowlan = &brcmf_wowlan_support;
+ 		return;
+ 	}
+@@ -6617,7 +6664,7 @@ static int brcmf_setup_wiphy(struct wiph
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
+ 				     sizeof(bandlist));
+ 	if (err) {
+-		bphy_err(wiphy, "could not obtain band info: err=%d\n", err);
++		bphy_err(drvr, "could not obtain band info: err=%d\n", err);
+ 		return err;
+ 	}
+ 	/* first entry in bandlist is number of bands */
+@@ -6878,6 +6925,7 @@ static void brcmf_cfg80211_reg_notifier(
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_fil_country_le ccreq;
+ 	s32 err;
+ 	int i;
+@@ -6889,7 +6937,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 	/* ignore non-ISO3166 country codes */
+ 	for (i = 0; i < 2; i++)
+ 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+-			bphy_err(wiphy, "not an ISO3166 code (0x%02x 0x%02x)\n",
++			bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
+ 				 req->alpha2[0], req->alpha2[1]);
+ 			return;
+ 		}
+@@ -6899,7 +6947,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 
+ 	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
+ 	if (err) {
+-		bphy_err(wiphy, "Country code iovar returned err = %d\n", err);
++		bphy_err(drvr, "Country code iovar returned err = %d\n", err);
+ 		return;
+ 	}
+ 
+@@ -6909,7 +6957,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 
+ 	err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
+ 	if (err) {
+-		bphy_err(wiphy, "Firmware rejected country setting\n");
++		bphy_err(drvr, "Firmware rejected country setting\n");
+ 		return;
+ 	}
+ 	brcmf_setup_wiphybands(cfg);
+@@ -6955,13 +7003,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	u16 *cap = NULL;
+ 
+ 	if (!ndev) {
+-		bphy_err(wiphy, "ndev is invalid\n");
++		bphy_err(drvr, "ndev is invalid\n");
+ 		return NULL;
+ 	}
+ 
+ 	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
+ 	if (!cfg) {
+-		bphy_err(wiphy, "Could not allocate wiphy device\n");
++		bphy_err(drvr, "Could not allocate wiphy device\n");
+ 		return NULL;
+ 	}
+ 
+@@ -6982,7 +7030,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 
+ 	err = wl_init_priv(cfg);
+ 	if (err) {
+-		bphy_err(wiphy, "Failed to init iwm_priv (%d)\n", err);
++		bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
+ 		brcmf_free_vif(vif);
+ 		goto wiphy_out;
+ 	}
+@@ -6991,7 +7039,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	/* determine d11 io type before wiphy setup */
+ 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
+ 	if (err) {
+-		bphy_err(wiphy, "Failed to get D11 version (%d)\n", err);
++		bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
+ 		goto priv_out;
+ 	}
+ 	cfg->d11inf.io_type = (u8)io_type;
+@@ -7025,13 +7073,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ #endif
+ 	err = wiphy_register(wiphy);
+ 	if (err < 0) {
+-		bphy_err(wiphy, "Could not register wiphy device (%d)\n", err);
++		bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
+ 		goto priv_out;
+ 	}
+ 
+ 	err = brcmf_setup_wiphybands(cfg);
+ 	if (err) {
+-		bphy_err(wiphy, "Setting wiphy bands failed (%d)\n", err);
++		bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 
+@@ -7049,24 +7097,24 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+-		bphy_err(wiphy, "FWEH activation failed (%d)\n", err);
++		bphy_err(drvr, "FWEH activation failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 
+ 	err = brcmf_p2p_attach(cfg, p2pdev_forced);
+ 	if (err) {
+-		bphy_err(wiphy, "P2P initialisation failed (%d)\n", err);
++		bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 	err = brcmf_btcoex_attach(cfg);
+ 	if (err) {
+-		bphy_err(wiphy, "BT-coex initialisation failed (%d)\n", err);
++		bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
+ 		brcmf_p2p_detach(&cfg->p2p);
+ 		goto wiphy_unreg_out;
+ 	}
+ 	err = brcmf_pno_attach(cfg);
+ 	if (err) {
+-		bphy_err(wiphy, "PNO initialisation failed (%d)\n", err);
++		bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
+ 		brcmf_btcoex_detach(cfg);
+ 		brcmf_p2p_detach(&cfg->p2p);
+ 		goto wiphy_unreg_out;
+@@ -7086,7 +7134,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	/* (re-) activate FWEH event handling */
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+-		bphy_err(wiphy, "FWEH activation failed (%d)\n", err);
++		bphy_err(drvr, "FWEH activation failed (%d)\n", err);
+ 		goto detach;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -62,12 +62,12 @@ void __brcmf_err(struct brcmf_bus *bus,
+ 	} while (0)
+ #endif
+ 
+-#define bphy_err(wiphy, fmt, ...)					\
++#define bphy_err(drvr, fmt, ...)					\
+ 	do {								\
+ 		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
+ 		    IS_ENABLED(CPTCFG_BRCM_TRACING) ||			\
+ 		    net_ratelimit())					\
+-			wiphy_err(wiphy, "%s: " fmt, __func__,		\
++			wiphy_err((drvr)->wiphy, "%s: " fmt, __func__,	\
+ 				  ##__VA_ARGS__);			\
+ 	} while (0)
+ 
diff --git a/package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch b/package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
new file mode 100644
index 0000000000..2841b2cffb
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
@@ -0,0 +1,1704 @@
+From dcb1471bc6d0541d636c7ecd9239573304842884 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 19 Feb 2019 23:42:19 +0100
+Subject: [PATCH] brcmfmac: use bphy_err() in all wiphy-related code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This recently added macro provides more meaningful error messages thanks
+to identifying a specific wiphy. It's especially important on systems
+with few cards supported by the same (brcmfmac) driver.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bcdc.c        | 22 ++---
+ .../broadcom/brcm80211/brcmfmac/common.c      | 39 ++++----
+ .../broadcom/brcm80211/brcmfmac/core.c        | 74 ++++++++--------
+ .../broadcom/brcm80211/brcmfmac/feature.c     |  8 +-
+ .../broadcom/brcm80211/brcmfmac/fweh.c        | 25 +++---
+ .../broadcom/brcm80211/brcmfmac/fwil.c        | 10 +--
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 38 ++++----
+ .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 65 ++++++++------
+ .../broadcom/brcm80211/brcmfmac/p2p.c         | 88 +++++++++++--------
+ .../broadcom/brcm80211/brcmfmac/pno.c         | 22 +++--
+ .../broadcom/brcm80211/brcmfmac/proto.c       |  6 +-
+ 11 files changed, 224 insertions(+), 173 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -178,8 +178,8 @@ brcmf_proto_bcdc_query_dcmd(struct brcmf
+ 	*fwerr = 0;
+ 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, false);
+ 	if (ret < 0) {
+-		brcmf_err("brcmf_proto_bcdc_msg failed w/status %d\n",
+-			  ret);
++		bphy_err(drvr, "brcmf_proto_bcdc_msg failed w/status %d\n",
++			 ret);
+ 		goto done;
+ 	}
+ 
+@@ -195,9 +195,9 @@ retry:
+ 	if ((id < bcdc->reqid) && (++retries < RETRIES))
+ 		goto retry;
+ 	if (id != bcdc->reqid) {
+-		brcmf_err("%s: unexpected request id %d (expected %d)\n",
+-			  brcmf_ifname(brcmf_get_ifp(drvr, ifidx)), id,
+-			  bcdc->reqid);
++		bphy_err(drvr, "%s: unexpected request id %d (expected %d)\n",
++			 brcmf_ifname(brcmf_get_ifp(drvr, ifidx)), id,
++			 bcdc->reqid);
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+@@ -245,9 +245,9 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
+ 	id = (flags & BCDC_DCMD_ID_MASK) >> BCDC_DCMD_ID_SHIFT;
+ 
+ 	if (id != bcdc->reqid) {
+-		brcmf_err("%s: unexpected request id %d (expected %d)\n",
+-			  brcmf_ifname(brcmf_get_ifp(drvr, ifidx)), id,
+-			  bcdc->reqid);
++		bphy_err(drvr, "%s: unexpected request id %d (expected %d)\n",
++			 brcmf_ifname(brcmf_get_ifp(drvr, ifidx)), id,
++			 bcdc->reqid);
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+@@ -312,8 +312,8 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
+ 	}
+ 	if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
+ 	    BCDC_PROTO_VER) {
+-		brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
+-			  brcmf_ifname(tmp_if), h->flags);
++		bphy_err(drvr, "%s: non-BCDC packet received, flags 0x%x\n",
++			 brcmf_ifname(tmp_if), h->flags);
+ 		return -EBADE;
+ 	}
+ 
+@@ -460,7 +460,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 
+ 	/* ensure that the msg buf directly follows the cdc msg struct */
+ 	if ((unsigned long)(&bcdc->msg + 1) != (unsigned long)bcdc->buf) {
+-		brcmf_err("struct brcmf_proto_bcdc is not correctly defined\n");
++		bphy_err(drvr, "struct brcmf_proto_bcdc is not correctly defined\n");
+ 		goto fail;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -90,6 +90,7 @@ struct brcmf_mp_global_t brcmf_mp_global
+ 
+ void brcmf_c_set_joinpref_default(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_join_pref_params join_pref_params[2];
+ 	int err;
+ 
+@@ -106,7 +107,7 @@ void brcmf_c_set_joinpref_default(struct
+ 	err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+ 				       sizeof(join_pref_params));
+ 	if (err)
+-		brcmf_err("Set join_pref error (%d)\n", err);
++		bphy_err(drvr, "Set join_pref error (%d)\n", err);
+ }
+ 
+ static int brcmf_c_download(struct brcmf_if *ifp, u16 flag,
+@@ -129,7 +130,8 @@ static int brcmf_c_download(struct brcmf
+ 
+ static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
+ {
+-	struct brcmf_bus *bus = ifp->drvr->bus_if;
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_bus *bus = drvr->bus_if;
+ 	struct brcmf_dload_data_le *chunk_buf;
+ 	const struct firmware *clm = NULL;
+ 	u8 clm_name[BRCMF_FW_NAME_LEN];
+@@ -145,7 +147,7 @@ static int brcmf_c_process_clm_blob(stru
+ 	memset(clm_name, 0, sizeof(clm_name));
+ 	err = brcmf_bus_get_fwname(bus, ".clm_blob", clm_name);
+ 	if (err) {
+-		brcmf_err("get CLM blob file name failed (%d)\n", err);
++		bphy_err(drvr, "get CLM blob file name failed (%d)\n", err);
+ 		return err;
+ 	}
+ 
+@@ -182,12 +184,12 @@ static int brcmf_c_process_clm_blob(stru
+ 	} while ((datalen > 0) && (err == 0));
+ 
+ 	if (err) {
+-		brcmf_err("clmload (%zu byte file) failed (%d); ",
+-			  clm->size, err);
++		bphy_err(drvr, "clmload (%zu byte file) failed (%d)\n",
++			 clm->size, err);
+ 		/* Retrieve clmload_status and print */
+ 		err = brcmf_fil_iovar_int_get(ifp, "clmload_status", &status);
+ 		if (err)
+-			brcmf_err("get clmload_status failed (%d)\n", err);
++			bphy_err(drvr, "get clmload_status failed (%d)\n", err);
+ 		else
+ 			brcmf_dbg(INFO, "clmload_status=%d\n", status);
+ 		err = -EIO;
+@@ -201,6 +203,7 @@ done:
+ 
+ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+ 	u8 buf[BRCMF_DCMD_SMLEN];
+ 	struct brcmf_bus *bus;
+@@ -214,7 +217,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
+ 				       sizeof(ifp->mac_addr));
+ 	if (err < 0) {
+-		brcmf_err("Retrieving cur_etheraddr failed, %d\n", err);
++		bphy_err(drvr, "Retrieving cur_etheraddr failed, %d\n", err);
+ 		goto done;
+ 	}
+ 	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
+@@ -226,7 +229,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
+ 				     &revinfo, sizeof(revinfo));
+ 	if (err < 0) {
+-		brcmf_err("retrieving revision info failed, %d\n", err);
++		bphy_err(drvr, "retrieving revision info failed, %d\n", err);
+ 		strlcpy(ri->chipname, "UNKNOWN", sizeof(ri->chipname));
+ 	} else {
+ 		ri->vendorid = le32_to_cpu(revinfo.vendorid);
+@@ -260,7 +263,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	/* Do any CLM downloading */
+ 	err = brcmf_c_process_clm_blob(ifp);
+ 	if (err < 0) {
+-		brcmf_err("download CLM blob file failed, %d\n", err);
++		bphy_err(drvr, "download CLM blob file failed, %d\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -269,8 +272,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	strcpy(buf, "ver");
+ 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+ 	if (err < 0) {
+-		brcmf_err("Retrieving version information failed, %d\n",
+-			  err);
++		bphy_err(drvr, "Retrieving version information failed, %d\n",
++			 err);
+ 		goto done;
+ 	}
+ 	ptr = (char *)buf;
+@@ -304,7 +307,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	/* set mpc */
+ 	err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
+ 	if (err) {
+-		brcmf_err("failed setting mpc\n");
++		bphy_err(drvr, "failed setting mpc\n");
+ 		goto done;
+ 	}
+ 
+@@ -314,14 +317,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
+ 				       BRCMF_EVENTING_MASK_LEN);
+ 	if (err) {
+-		brcmf_err("Get event_msgs error (%d)\n", err);
++		bphy_err(drvr, "Get event_msgs error (%d)\n", err);
+ 		goto done;
+ 	}
+ 	setbit(eventmask, BRCMF_E_IF);
+ 	err = brcmf_fil_iovar_data_set(ifp, "event_msgs", eventmask,
+ 				       BRCMF_EVENTING_MASK_LEN);
+ 	if (err) {
+-		brcmf_err("Set event_msgs error (%d)\n", err);
++		bphy_err(drvr, "Set event_msgs error (%d)\n", err);
+ 		goto done;
+ 	}
+ 
+@@ -329,8 +332,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+ 				    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
+ 	if (err) {
+-		brcmf_err("BRCMF_C_SET_SCAN_CHANNEL_TIME error (%d)\n",
+-			  err);
++		bphy_err(drvr, "BRCMF_C_SET_SCAN_CHANNEL_TIME error (%d)\n",
++			 err);
+ 		goto done;
+ 	}
+ 
+@@ -338,8 +341,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+ 				    BRCMF_DEFAULT_SCAN_UNASSOC_TIME);
+ 	if (err) {
+-		brcmf_err("BRCMF_C_SET_SCAN_UNASSOC_TIME error (%d)\n",
+-			  err);
++		bphy_err(drvr, "BRCMF_C_SET_SCAN_UNASSOC_TIME error (%d)\n",
++			 err);
+ 		goto done;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -90,7 +90,7 @@ struct brcmf_if *brcmf_get_ifp(struct br
+ 	s32 bsscfgidx;
+ 
+ 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
+-		brcmf_err("ifidx %d out of range\n", ifidx);
++		bphy_err(drvr, "ifidx %d out of range\n", ifidx);
+ 		return NULL;
+ 	}
+ 
+@@ -141,7 +141,9 @@ void brcmf_configure_arp_nd_offload(stru
+ 
+ static void _brcmf_set_multicast_list(struct work_struct *work)
+ {
+-	struct brcmf_if *ifp;
++	struct brcmf_if *ifp = container_of(work, struct brcmf_if,
++					    multicast_work);
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct net_device *ndev;
+ 	struct netdev_hw_addr *ha;
+ 	u32 cmd_value, cnt;
+@@ -150,8 +152,6 @@ static void _brcmf_set_multicast_list(st
+ 	u32 buflen;
+ 	s32 err;
+ 
+-	ifp = container_of(work, struct brcmf_if, multicast_work);
+-
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
+ 
+ 	ndev = ifp->ndev;
+@@ -181,7 +181,7 @@ static void _brcmf_set_multicast_list(st
+ 
+ 	err = brcmf_fil_iovar_data_set(ifp, "mcast_list", buf, buflen);
+ 	if (err < 0) {
+-		brcmf_err("Setting mcast_list failed, %d\n", err);
++		bphy_err(drvr, "Setting mcast_list failed, %d\n", err);
+ 		cmd_value = cnt ? true : cmd_value;
+ 	}
+ 
+@@ -194,25 +194,25 @@ static void _brcmf_set_multicast_list(st
+ 	 */
+ 	err = brcmf_fil_iovar_int_set(ifp, "allmulti", cmd_value);
+ 	if (err < 0)
+-		brcmf_err("Setting allmulti failed, %d\n", err);
++		bphy_err(drvr, "Setting allmulti failed, %d\n", err);
+ 
+ 	/*Finally, pick up the PROMISC flag */
+ 	cmd_value = (ndev->flags & IFF_PROMISC) ? true : false;
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PROMISC, cmd_value);
+ 	if (err < 0)
+-		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
+-			  err);
++		bphy_err(drvr, "Setting BRCMF_C_SET_PROMISC failed, %d\n",
++			 err);
+ 	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
+ }
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+ static void _brcmf_update_ndtable(struct work_struct *work)
+ {
+-	struct brcmf_if *ifp;
++	struct brcmf_if *ifp = container_of(work, struct brcmf_if,
++					    ndoffload_work);
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int i, ret;
+ 
+-	ifp = container_of(work, struct brcmf_if, ndoffload_work);
+-
+ 	/* clear the table in firmware */
+ 	ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip_clear", NULL, 0);
+ 	if (ret) {
+@@ -225,7 +225,7 @@ static void _brcmf_update_ndtable(struct
+ 					       &ifp->ipv6_addr_tbl[i],
+ 					       sizeof(struct in6_addr));
+ 		if (ret)
+-			brcmf_err("add nd ip err %d\n", ret);
++			bphy_err(drvr, "add nd ip err %d\n", ret);
+ 	}
+ }
+ #else
+@@ -238,6 +238,7 @@ static int brcmf_netdev_set_mac_address(
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct sockaddr *sa = (struct sockaddr *)addr;
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int err;
+ 
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
+@@ -245,7 +246,7 @@ static int brcmf_netdev_set_mac_address(
+ 	err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", sa->sa_data,
+ 				       ETH_ALEN);
+ 	if (err < 0) {
+-		brcmf_err("Setting cur_etheraddr failed, %d\n", err);
++		bphy_err(drvr, "Setting cur_etheraddr failed, %d\n", err);
+ 	} else {
+ 		brcmf_dbg(TRACE, "updated to %pM\n", sa->sa_data);
+ 		memcpy(ifp->mac_addr, sa->sa_data, ETH_ALEN);
+@@ -305,7 +306,7 @@ static netdev_tx_t brcmf_netdev_start_xm
+ 
+ 	/* Can the device send data? */
+ 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
+-		brcmf_err("xmit rejected state=%d\n", drvr->bus_if->state);
++		bphy_err(drvr, "xmit rejected state=%d\n", drvr->bus_if->state);
+ 		netif_stop_queue(ndev);
+ 		dev_kfree_skb(skb);
+ 		ret = -ENODEV;
+@@ -339,8 +340,8 @@ static netdev_tx_t brcmf_netdev_start_xm
+ 		ret = pskb_expand_head(skb, ALIGN(head_delta, NET_SKB_PAD), 0,
+ 				       GFP_ATOMIC);
+ 		if (ret < 0) {
+-			brcmf_err("%s: failed to expand headroom\n",
+-				  brcmf_ifname(ifp));
++			bphy_err(drvr, "%s: failed to expand headroom\n",
++				 brcmf_ifname(ifp));
+ 			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
+ 			goto done;
+ 		}
+@@ -606,7 +607,7 @@ static int brcmf_netdev_open(struct net_
+ 
+ 	/* If bus is not ready, can't continue */
+ 	if (bus_if->state != BRCMF_BUS_UP) {
+-		brcmf_err("failed bus is not ready\n");
++		bphy_err(drvr, "failed bus is not ready\n");
+ 		return -EAGAIN;
+ 	}
+ 
+@@ -620,7 +621,7 @@ static int brcmf_netdev_open(struct net_
+ 		ndev->features &= ~NETIF_F_IP_CSUM;
+ 
+ 	if (brcmf_cfg80211_up(ndev)) {
+-		brcmf_err("failed to bring up cfg80211\n");
++		bphy_err(drvr, "failed to bring up cfg80211\n");
+ 		return -EIO;
+ 	}
+ 
+@@ -682,7 +683,7 @@ int brcmf_net_attach(struct brcmf_if *if
+ 	else
+ 		err = register_netdev(ndev);
+ 	if (err != 0) {
+-		brcmf_err("couldn't register the net device\n");
++		bphy_err(drvr, "couldn't register the net device\n");
+ 		goto fail;
+ 	}
+ 
+@@ -759,6 +760,7 @@ static const struct net_device_ops brcmf
+ 
+ static int brcmf_net_p2p_attach(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct net_device *ndev;
+ 
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
+@@ -771,7 +773,7 @@ static int brcmf_net_p2p_attach(struct b
+ 	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
+ 
+ 	if (register_netdev(ndev) != 0) {
+-		brcmf_err("couldn't register the p2p net device\n");
++		bphy_err(drvr, "couldn't register the p2p net device\n");
+ 		goto fail;
+ 	}
+ 
+@@ -800,8 +802,8 @@ struct brcmf_if *brcmf_add_if(struct brc
+ 	 */
+ 	if (ifp) {
+ 		if (ifidx) {
+-			brcmf_err("ERROR: netdev:%s already exists\n",
+-				  ifp->ndev->name);
++			bphy_err(drvr, "ERROR: netdev:%s already exists\n",
++				 ifp->ndev->name);
+ 			netif_stop_queue(ifp->ndev);
+ 			brcmf_net_detach(ifp->ndev, false);
+ 			drvr->iflist[bsscfgidx] = NULL;
+@@ -863,7 +865,7 @@ static void brcmf_del_if(struct brcmf_pu
+ 	ifp = drvr->iflist[bsscfgidx];
+ 	drvr->iflist[bsscfgidx] = NULL;
+ 	if (!ifp) {
+-		brcmf_err("Null interface, bsscfgidx=%d\n", bsscfgidx);
++		bphy_err(drvr, "Null interface, bsscfgidx=%d\n", bsscfgidx);
+ 		return;
+ 	}
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
+@@ -913,16 +915,17 @@ static int brcmf_psm_watchdog_notify(str
+ 				     const struct brcmf_event_msg *evtmsg,
+ 				     void *data)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int err;
+ 
+ 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
+ 
+-	brcmf_err("PSM's watchdog has fired!\n");
++	bphy_err(drvr, "PSM's watchdog has fired!\n");
+ 
+ 	err = brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
+ 					 evtmsg->datalen);
+ 	if (err)
+-		brcmf_err("Failed to get memory dump, %d\n", err);
++		bphy_err(drvr, "Failed to get memory dump, %d\n", err);
+ 
+ 	return err;
+ }
+@@ -966,7 +969,7 @@ static int brcmf_inetaddr_changed(struct
+ 	ret = brcmf_fil_iovar_data_get(ifp, "arp_hostip", addr_table,
+ 				       sizeof(addr_table));
+ 	if (ret) {
+-		brcmf_err("fail to get arp ip table err:%d\n", ret);
++		bphy_err(drvr, "fail to get arp ip table err:%d\n", ret);
+ 		return NOTIFY_OK;
+ 	}
+ 
+@@ -983,7 +986,7 @@ static int brcmf_inetaddr_changed(struct
+ 			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
+ 				&ifa->ifa_address, sizeof(ifa->ifa_address));
+ 			if (ret)
+-				brcmf_err("add arp ip err %d\n", ret);
++				bphy_err(drvr, "add arp ip err %d\n", ret);
+ 		}
+ 		break;
+ 	case NETDEV_DOWN:
+@@ -995,8 +998,8 @@ static int brcmf_inetaddr_changed(struct
+ 			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear",
+ 						       NULL, 0);
+ 			if (ret) {
+-				brcmf_err("fail to clear arp ip table err:%d\n",
+-					  ret);
++				bphy_err(drvr, "fail to clear arp ip table err:%d\n",
++					 ret);
+ 				return NOTIFY_OK;
+ 			}
+ 			for (i = 0; i < ARPOL_MAX_ENTRIES; i++) {
+@@ -1006,8 +1009,8 @@ static int brcmf_inetaddr_changed(struct
+ 							       &addr_table[i],
+ 							       sizeof(addr_table[i]));
+ 				if (ret)
+-					brcmf_err("add arp ip err %d\n",
+-						  ret);
++					bphy_err(drvr, "add arp ip err %d\n",
++						 ret);
+ 			}
+ 		}
+ 		break;
+@@ -1180,7 +1183,7 @@ static int brcmf_bus_started(struct brcm
+ 	return 0;
+ 
+ fail:
+-	brcmf_err("failed: %d\n", ret);
++	bphy_err(drvr, "failed: %d\n", ret);
+ 	if (drvr->config) {
+ 		brcmf_cfg80211_detach(drvr->config);
+ 		drvr->config = NULL;
+@@ -1232,7 +1235,7 @@ int brcmf_attach(struct device *dev, str
+ 	/* Attach and link in the protocol */
+ 	ret = brcmf_proto_attach(drvr);
+ 	if (ret != 0) {
+-		brcmf_err("brcmf_prot_attach failed\n");
++		bphy_err(drvr, "brcmf_prot_attach failed\n");
+ 		goto fail;
+ 	}
+ 
+@@ -1245,7 +1248,7 @@ int brcmf_attach(struct device *dev, str
+ 
+ 	ret = brcmf_bus_started(drvr, ops);
+ 	if (ret != 0) {
+-		brcmf_err("dongle is not responding: err=%d\n", ret);
++		bphy_err(drvr, "dongle is not responding: err=%d\n", ret);
+ 		goto fail;
+ 	}
+ 
+@@ -1345,6 +1348,7 @@ static int brcmf_get_pend_8021x_cnt(stru
+ 
+ int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int err;
+ 
+ 	err = wait_event_timeout(ifp->pend_8021x_wait,
+@@ -1352,7 +1356,7 @@ int brcmf_netdev_wait_pend8021x(struct b
+ 				 MAX_WAIT_FOR_8021X_TX);
+ 
+ 	if (!err)
+-		brcmf_err("Timed out waiting for no pending 802.1x packets\n");
++		bphy_err(drvr, "Timed out waiting for no pending 802.1x packets\n");
+ 
+ 	return !err;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -185,13 +185,14 @@ static void brcmf_feat_iovar_data_set(st
+ #define MAX_CAPS_BUFFER_SIZE	768
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	char caps[MAX_CAPS_BUFFER_SIZE];
+ 	enum brcmf_feat_id id;
+ 	int i, err;
+ 
+ 	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
+ 	if (err) {
+-		brcmf_err("could not get firmware cap (%d)\n", err);
++		bphy_err(drvr, "could not get firmware cap (%d)\n", err);
+ 		return;
+ 	}
+ 
+@@ -216,14 +217,15 @@ static void brcmf_feat_firmware_capabili
+ static int brcmf_feat_fwcap_debugfs_read(struct seq_file *seq, void *data)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
+-	struct brcmf_if *ifp = brcmf_get_ifp(bus_if->drvr, 0);
++	struct brcmf_pub *drvr = bus_if->drvr;
++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+ 	char caps[MAX_CAPS_BUFFER_SIZE + 1] = { };
+ 	char *tmp;
+ 	int err;
+ 
+ 	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
+ 	if (err) {
+-		brcmf_err("could not get firmware cap (%d)\n", err);
++		bphy_err(drvr, "could not get firmware cap (%d)\n", err);
+ 		return err;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -102,7 +102,8 @@ static void brcmf_fweh_queue_event(struc
+ 	schedule_work(&fweh->event_work);
+ }
+ 
+-static int brcmf_fweh_call_event_handler(struct brcmf_if *ifp,
++static int brcmf_fweh_call_event_handler(struct brcmf_pub *drvr,
++					 struct brcmf_if *ifp,
+ 					 enum brcmf_fweh_event_code code,
+ 					 struct brcmf_event_msg *emsg,
+ 					 void *data)
+@@ -117,9 +118,9 @@ static int brcmf_fweh_call_event_handler
+ 		if (fweh->evt_handler[code])
+ 			err = fweh->evt_handler[code](ifp, emsg, data);
+ 		else
+-			brcmf_err("unhandled event %d ignored\n", code);
++			bphy_err(drvr, "unhandled event %d ignored\n", code);
+ 	} else {
+-		brcmf_err("no interface object\n");
++		bphy_err(drvr, "no interface object\n");
+ 	}
+ 	return err;
+ }
+@@ -158,7 +159,7 @@ static void brcmf_fweh_handle_if_event(s
+ 		return;
+ 	}
+ 	if (ifevent->ifidx >= BRCMF_MAX_IFS) {
+-		brcmf_err("invalid interface index: %u\n", ifevent->ifidx);
++		bphy_err(drvr, "invalid interface index: %u\n", ifevent->ifidx);
+ 		return;
+ 	}
+ 
+@@ -181,7 +182,8 @@ static void brcmf_fweh_handle_if_event(s
+ 	if (ifp && ifevent->action == BRCMF_E_IF_CHANGE)
+ 		brcmf_proto_reset_if(drvr, ifp);
+ 
+-	err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
++	err = brcmf_fweh_call_event_handler(drvr, ifp, emsg->event_code, emsg,
++					    data);
+ 
+ 	if (ifp && ifevent->action == BRCMF_E_IF_DEL) {
+ 		bool armed = brcmf_cfg80211_vif_event_armed(drvr->config);
+@@ -268,11 +270,11 @@ static void brcmf_fweh_event_worker(stru
+ 			ifp = drvr->iflist[0];
+ 		else
+ 			ifp = drvr->iflist[emsg.bsscfgidx];
+-		err = brcmf_fweh_call_event_handler(ifp, event->code, &emsg,
+-						    event->data);
++		err = brcmf_fweh_call_event_handler(drvr, ifp, event->code,
++						    &emsg, event->data);
+ 		if (err) {
+-			brcmf_err("event handler failed (%d)\n",
+-				  event->code);
++			bphy_err(drvr, "event handler failed (%d)\n",
++				 event->code);
+ 			err = 0;
+ 		}
+ event_free:
+@@ -339,7 +341,7 @@ int brcmf_fweh_register(struct brcmf_pub
+ 			brcmf_fweh_handler_t handler)
+ {
+ 	if (drvr->fweh.evt_handler[code]) {
+-		brcmf_err("event code %d already registered\n", code);
++		bphy_err(drvr, "event code %d already registered\n", code);
+ 		return -ENOSPC;
+ 	}
+ 	drvr->fweh.evt_handler[code] = handler;
+@@ -369,6 +371,7 @@ void brcmf_fweh_unregister(struct brcmf_
+  */
+ int brcmf_fweh_activate_events(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int i, err;
+ 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+ 
+@@ -388,7 +391,7 @@ int brcmf_fweh_activate_events(struct br
+ 	err = brcmf_fil_iovar_data_set(ifp, "event_msgs",
+ 				       eventmask, BRCMF_EVENTING_MASK_LEN);
+ 	if (err)
+-		brcmf_err("Set event_msgs error (%d)\n", err);
++		bphy_err(drvr, "Set event_msgs error (%d)\n", err);
+ 
+ 	return err;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+@@ -110,7 +110,7 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
+ 	s32 err, fwerr;
+ 
+ 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
+-		brcmf_err("bus is down. we have nothing to do.\n");
++		bphy_err(drvr, "bus is down. we have nothing to do.\n");
+ 		return -EIO;
+ 	}
+ 
+@@ -242,7 +242,7 @@ brcmf_fil_iovar_data_set(struct brcmf_if
+ 					 buflen, true);
+ 	} else {
+ 		err = -EPERM;
+-		brcmf_err("Creating iovar failed\n");
++		bphy_err(drvr, "Creating iovar failed\n");
+ 	}
+ 
+ 	mutex_unlock(&drvr->proto_block);
+@@ -268,7 +268,7 @@ brcmf_fil_iovar_data_get(struct brcmf_if
+ 			memcpy(data, drvr->proto_buf, len);
+ 	} else {
+ 		err = -EPERM;
+-		brcmf_err("Creating iovar failed\n");
++		bphy_err(drvr, "Creating iovar failed\n");
+ 	}
+ 
+ 	brcmf_dbg(FIL, "ifidx=%d, name=%s, len=%d\n", ifp->ifidx, name, len);
+@@ -366,7 +366,7 @@ brcmf_fil_bsscfg_data_set(struct brcmf_i
+ 					 buflen, true);
+ 	} else {
+ 		err = -EPERM;
+-		brcmf_err("Creating bsscfg failed\n");
++		bphy_err(drvr, "Creating bsscfg failed\n");
+ 	}
+ 
+ 	mutex_unlock(&drvr->proto_block);
+@@ -392,7 +392,7 @@ brcmf_fil_bsscfg_data_get(struct brcmf_i
+ 			memcpy(data, drvr->proto_buf, len);
+ 	} else {
+ 		err = -EPERM;
+-		brcmf_err("Creating bsscfg failed\n");
++		bphy_err(drvr, "Creating bsscfg failed\n");
+ 	}
+ 	brcmf_dbg(FIL, "ifidx=%d, bsscfgidx=%d, name=%s, len=%d\n", ifp->ifidx,
+ 		  ifp->bsscfgidx, name, len);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -1251,6 +1251,7 @@ static int brcmf_fws_enq(struct brcmf_fw
+ 			 enum brcmf_fws_skb_state state, int fifo,
+ 			 struct sk_buff *p)
+ {
++	struct brcmf_pub *drvr = fws->drvr;
+ 	int prec = 2 * fifo;
+ 	u32 *qfull_stat = &fws->stats.delayq_full_error;
+ 	struct brcmf_fws_mac_descriptor *entry;
+@@ -1263,7 +1264,7 @@ static int brcmf_fws_enq(struct brcmf_fw
+ 
+ 	entry = brcmf_skbcb(p)->mac;
+ 	if (entry == NULL) {
+-		brcmf_err("no mac descriptor found for skb %p\n", p);
++		bphy_err(drvr, "no mac descriptor found for skb %p\n", p);
+ 		return -ENOENT;
+ 	}
+ 
+@@ -1453,6 +1454,7 @@ static int
+ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
+ 		      u32 genbit, u16 seq)
+ {
++	struct brcmf_pub *drvr = fws->drvr;
+ 	u32 fifo;
+ 	int ret;
+ 	bool remove_from_hanger = true;
+@@ -1476,12 +1478,12 @@ brcmf_fws_txs_process(struct brcmf_fws_i
+ 	else if (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)
+ 		fws->stats.txs_host_tossed++;
+ 	else
+-		brcmf_err("unexpected txstatus\n");
++		bphy_err(drvr, "unexpected txstatus\n");
+ 
+ 	ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+ 				      remove_from_hanger);
+ 	if (ret != 0) {
+-		brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
++		bphy_err(drvr, "no packet in hanger slot: hslot=%d\n", hslot);
+ 		return ret;
+ 	}
+ 
+@@ -1587,12 +1589,13 @@ static int brcmf_fws_notify_credit_map(s
+ 				       const struct brcmf_event_msg *e,
+ 				       void *data)
+ {
+-	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_fws_info *fws = drvr_to_fws(drvr);
+ 	int i;
+ 	u8 *credits = data;
+ 
+ 	if (e->datalen < BRCMF_FWS_FIFO_COUNT) {
+-		brcmf_err("event payload too small (%d)\n", e->datalen);
++		bphy_err(drvr, "event payload too small (%d)\n", e->datalen);
+ 		return -EINVAL;
+ 	}
+ 	if (fws->creditmap_received)
+@@ -1654,6 +1657,7 @@ static void brcmf_rxreorder_get_skb_list
+ 
+ void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *pkt)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	u8 *reorder_data;
+ 	u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
+ 	struct brcmf_ampdu_rx_reorder *rfi;
+@@ -1668,7 +1672,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
+ 
+ 	/* validate flags and flow id */
+ 	if (flags == 0xFF) {
+-		brcmf_err("invalid flags...so ignore this packet\n");
++		bphy_err(drvr, "invalid flags...so ignore this packet\n");
+ 		brcmf_netif_rx(ifp, pkt);
+ 		return;
+ 	}
+@@ -1705,7 +1709,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
+ 			  flow_id, max_idx);
+ 		rfi = kzalloc(buf_size, GFP_ATOMIC);
+ 		if (rfi == NULL) {
+-			brcmf_err("failed to alloc buffer\n");
++			bphy_err(drvr, "failed to alloc buffer\n");
+ 			brcmf_netif_rx(ifp, pkt);
+ 			return;
+ 		}
+@@ -1970,6 +1974,7 @@ static u8 brcmf_fws_precommit_skb(struct
+ static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
+ 				   struct sk_buff *skb, int fifo)
+ {
++	struct brcmf_pub *drvr = fws->drvr;
+ 	struct brcmf_fws_mac_descriptor *entry;
+ 	struct sk_buff *pktout;
+ 	int qidx, hslot;
+@@ -1983,11 +1988,11 @@ static void brcmf_fws_rollback_toq(struc
+ 
+ 		pktout = brcmu_pktq_penq_head(&entry->psq, qidx, skb);
+ 		if (pktout == NULL) {
+-			brcmf_err("%s queue %d full\n", entry->name, qidx);
++			bphy_err(drvr, "%s queue %d full\n", entry->name, qidx);
+ 			rc = -ENOSPC;
+ 		}
+ 	} else {
+-		brcmf_err("%s entry removed\n", entry->name);
++		bphy_err(drvr, "%s entry removed\n", entry->name);
+ 		rc = -ENOENT;
+ 	}
+ 
+@@ -2092,7 +2097,8 @@ static int brcmf_fws_assign_htod(struct
+ 
+ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
+ {
+-	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_fws_info *fws = drvr_to_fws(drvr);
+ 	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
+ 	struct ethhdr *eh = (struct ethhdr *)(skb->data);
+ 	int fifo = BRCMF_FWS_FIFO_BCMC;
+@@ -2120,7 +2126,7 @@ int brcmf_fws_process_skb(struct brcmf_i
+ 		brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
+ 		brcmf_fws_schedule_deq(fws);
+ 	} else {
+-		brcmf_err("drop skb: no hanger slot\n");
++		bphy_err(drvr, "drop skb: no hanger slot\n");
+ 		brcmf_txfinalize(ifp, skb, false);
+ 		rc = -ENOMEM;
+ 	}
+@@ -2338,7 +2344,7 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 
+ 	fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
+ 	if (fws->fws_wq == NULL) {
+-		brcmf_err("workqueue creation failed\n");
++		bphy_err(drvr, "workqueue creation failed\n");
+ 		rc = -EBADF;
+ 		goto fail;
+ 	}
+@@ -2354,13 +2360,13 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 	rc = brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
+ 				 brcmf_fws_notify_credit_map);
+ 	if (rc < 0) {
+-		brcmf_err("register credit map handler failed\n");
++		bphy_err(drvr, "register credit map handler failed\n");
+ 		goto fail;
+ 	}
+ 	rc = brcmf_fweh_register(drvr, BRCMF_E_BCMC_CREDIT_SUPPORT,
+ 				 brcmf_fws_notify_bcmc_credit_support);
+ 	if (rc < 0) {
+-		brcmf_err("register bcmc credit handler failed\n");
++		bphy_err(drvr, "register bcmc credit handler failed\n");
+ 		brcmf_fweh_unregister(drvr, BRCMF_E_FIFO_CREDIT_MAP);
+ 		goto fail;
+ 	}
+@@ -2372,7 +2378,7 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 	fws->fw_signals = true;
+ 	ifp = brcmf_get_ifp(drvr, 0);
+ 	if (brcmf_fil_iovar_int_set(ifp, "tlv", tlv)) {
+-		brcmf_err("failed to set bdcv2 tlv signaling\n");
++		bphy_err(drvr, "failed to set bdcv2 tlv signaling\n");
+ 		fws->fcmode = BRCMF_FWS_FCMODE_NONE;
+ 		fws->fw_signals = false;
+ 	}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -439,7 +439,7 @@ static int brcmf_msgbuf_tx_ioctl(struct
+ 	brcmf_commonring_lock(commonring);
+ 	ret_ptr = brcmf_commonring_reserve_for_write(commonring);
+ 	if (!ret_ptr) {
+-		brcmf_err("Failed to reserve space in commonring\n");
++		bphy_err(drvr, "Failed to reserve space in commonring\n");
+ 		brcmf_commonring_unlock(commonring);
+ 		return -ENOMEM;
+ 	}
+@@ -503,7 +503,7 @@ static int brcmf_msgbuf_query_dcmd(struc
+ 
+ 	timeout = brcmf_msgbuf_ioctl_resp_wait(msgbuf);
+ 	if (!timeout) {
+-		brcmf_err("Timeout on response for query command\n");
++		bphy_err(drvr, "Timeout on response for query command\n");
+ 		return -EIO;
+ 	}
+ 
+@@ -580,6 +580,7 @@ static u32
+ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
+ 				    struct brcmf_msgbuf_work_item *work)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct msgbuf_tx_flowring_create_req *create;
+ 	struct brcmf_commonring *commonring;
+ 	void *ret_ptr;
+@@ -595,7 +596,7 @@ brcmf_msgbuf_flowring_create_worker(stru
+ 				     &msgbuf->flowring_dma_handle[flowid],
+ 				     GFP_KERNEL);
+ 	if (!dma_buf) {
+-		brcmf_err("dma_alloc_coherent failed\n");
++		bphy_err(drvr, "dma_alloc_coherent failed\n");
+ 		brcmf_flowring_delete(msgbuf->flow, flowid);
+ 		return BRCMF_FLOWRING_INVALID_ID;
+ 	}
+@@ -608,7 +609,7 @@ brcmf_msgbuf_flowring_create_worker(stru
+ 	brcmf_commonring_lock(commonring);
+ 	ret_ptr = brcmf_commonring_reserve_for_write(commonring);
+ 	if (!ret_ptr) {
+-		brcmf_err("Failed to reserve space in commonring\n");
++		bphy_err(drvr, "Failed to reserve space in commonring\n");
+ 		brcmf_commonring_unlock(commonring);
+ 		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
+ 		return BRCMF_FLOWRING_INVALID_ID;
+@@ -635,7 +636,7 @@ brcmf_msgbuf_flowring_create_worker(stru
+ 	err = brcmf_commonring_write_complete(commonring);
+ 	brcmf_commonring_unlock(commonring);
+ 	if (err) {
+-		brcmf_err("Failed to write commonring\n");
++		bphy_err(drvr, "Failed to write commonring\n");
+ 		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
+ 		return BRCMF_FLOWRING_INVALID_ID;
+ 	}
+@@ -694,6 +695,7 @@ static u32 brcmf_msgbuf_flowring_create(
+ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
+ {
+ 	struct brcmf_flowring *flow = msgbuf->flow;
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct brcmf_commonring *commonring;
+ 	void *ret_ptr;
+ 	u32 count;
+@@ -713,8 +715,8 @@ static void brcmf_msgbuf_txflow(struct b
+ 	while (brcmf_flowring_qlen(flow, flowid)) {
+ 		skb = brcmf_flowring_dequeue(flow, flowid);
+ 		if (skb == NULL) {
+-			brcmf_err("No SKB, but qlen %d\n",
+-				  brcmf_flowring_qlen(flow, flowid));
++			bphy_err(drvr, "No SKB, but qlen %d\n",
++				 brcmf_flowring_qlen(flow, flowid));
+ 			break;
+ 		}
+ 		skb_orphan(skb);
+@@ -722,7 +724,7 @@ static void brcmf_msgbuf_txflow(struct b
+ 					     msgbuf->tx_pktids, skb, ETH_HLEN,
+ 					     &physaddr, &pktid)) {
+ 			brcmf_flowring_reinsert(flow, flowid, skb);
+-			brcmf_err("No PKTID available !!\n");
++			bphy_err(drvr, "No PKTID available !!\n");
+ 			break;
+ 		}
+ 		ret_ptr = brcmf_commonring_reserve_for_write(commonring);
+@@ -893,6 +895,7 @@ brcmf_msgbuf_process_txstatus(struct brc
+ 
+ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct brcmf_commonring *commonring;
+ 	void *ret_ptr;
+ 	struct sk_buff *skb;
+@@ -920,7 +923,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(
+ 		skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
+ 
+ 		if (skb == NULL) {
+-			brcmf_err("Failed to alloc SKB\n");
++			bphy_err(drvr, "Failed to alloc SKB\n");
+ 			brcmf_commonring_write_cancel(commonring, alloced - i);
+ 			break;
+ 		}
+@@ -930,7 +933,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(
+ 					     msgbuf->rx_pktids, skb, 0,
+ 					     &physaddr, &pktid)) {
+ 			dev_kfree_skb_any(skb);
+-			brcmf_err("No PKTID available !!\n");
++			bphy_err(drvr, "No PKTID available !!\n");
+ 			brcmf_commonring_write_cancel(commonring, alloced - i);
+ 			break;
+ 		}
+@@ -1000,6 +1003,7 @@ static u32
+ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
+ 			     u32 count)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct brcmf_commonring *commonring;
+ 	void *ret_ptr;
+ 	struct sk_buff *skb;
+@@ -1017,7 +1021,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcm
+ 							      count,
+ 							      &alloced);
+ 	if (!ret_ptr) {
+-		brcmf_err("Failed to reserve space in commonring\n");
++		bphy_err(drvr, "Failed to reserve space in commonring\n");
+ 		brcmf_commonring_unlock(commonring);
+ 		return 0;
+ 	}
+@@ -1029,7 +1033,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcm
+ 		skb = brcmu_pkt_buf_get_skb(BRCMF_MSGBUF_MAX_PKT_SIZE);
+ 
+ 		if (skb == NULL) {
+-			brcmf_err("Failed to alloc SKB\n");
++			bphy_err(drvr, "Failed to alloc SKB\n");
+ 			brcmf_commonring_write_cancel(commonring, alloced - i);
+ 			break;
+ 		}
+@@ -1039,7 +1043,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcm
+ 					     msgbuf->rx_pktids, skb, 0,
+ 					     &physaddr, &pktid)) {
+ 			dev_kfree_skb_any(skb);
+-			brcmf_err("No PKTID available !!\n");
++			bphy_err(drvr, "No PKTID available !!\n");
+ 			brcmf_commonring_write_cancel(commonring, alloced - i);
+ 			break;
+ 		}
+@@ -1091,6 +1095,7 @@ static void brcmf_msgbuf_rxbuf_event_pos
+ 
+ static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct msgbuf_rx_event *event;
+ 	u32 idx;
+ 	u16 buflen;
+@@ -1117,8 +1122,8 @@ static void brcmf_msgbuf_process_event(s
+ 
+ 	ifp = brcmf_get_ifp(msgbuf->drvr, event->msg.ifidx);
+ 	if (!ifp || !ifp->ndev) {
+-		brcmf_err("Received pkt for invalid ifidx %d\n",
+-			  event->msg.ifidx);
++		bphy_err(drvr, "Received pkt for invalid ifidx %d\n",
++			 event->msg.ifidx);
+ 		goto exit;
+ 	}
+ 
+@@ -1134,6 +1139,7 @@ exit:
+ static void
+ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct msgbuf_rx_complete *rx_complete;
+ 	struct sk_buff *skb;
+ 	u16 data_offset;
+@@ -1167,7 +1173,7 @@ brcmf_msgbuf_process_rx_complete(struct
+ 		ifp = msgbuf->drvr->mon_if;
+ 
+ 		if (!ifp) {
+-			brcmf_err("Received unexpected monitor pkt\n");
++			bphy_err(drvr, "Received unexpected monitor pkt\n");
+ 			brcmu_pkt_buf_free_skb(skb);
+ 			return;
+ 		}
+@@ -1178,8 +1184,8 @@ brcmf_msgbuf_process_rx_complete(struct
+ 
+ 	ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
+ 	if (!ifp || !ifp->ndev) {
+-		brcmf_err("Received pkt for invalid ifidx %d\n",
+-			  rx_complete->msg.ifidx);
++		bphy_err(drvr, "Received pkt for invalid ifidx %d\n",
++			 rx_complete->msg.ifidx);
+ 		brcmu_pkt_buf_free_skb(skb);
+ 		return;
+ 	}
+@@ -1192,13 +1198,15 @@ static void brcmf_msgbuf_process_ring_st
+ 					     void *buf)
+ {
+ 	struct msgbuf_ring_status *ring_status = buf;
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	int err;
+ 
+ 	err = le16_to_cpu(ring_status->compl_hdr.status);
+ 	if (err) {
+ 		int ring = le16_to_cpu(ring_status->compl_hdr.flow_ring_id);
+ 
+-		brcmf_err("Firmware reported ring %d error: %d\n", ring, err);
++		bphy_err(drvr, "Firmware reported ring %d error: %d\n", ring,
++			 err);
+ 	}
+ }
+ 
+@@ -1206,6 +1214,7 @@ static void
+ brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
+ 					       void *buf)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct msgbuf_flowring_create_resp *flowring_create_resp;
+ 	u16 status;
+ 	u16 flowid;
+@@ -1217,7 +1226,7 @@ brcmf_msgbuf_process_flow_ring_create_re
+ 	status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
+ 
+ 	if (status) {
+-		brcmf_err("Flowring creation failed, code %d\n", status);
++		bphy_err(drvr, "Flowring creation failed, code %d\n", status);
+ 		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
+ 		return;
+ 	}
+@@ -1234,6 +1243,7 @@ static void
+ brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
+ 					       void *buf)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct msgbuf_flowring_delete_resp *flowring_delete_resp;
+ 	u16 status;
+ 	u16 flowid;
+@@ -1245,7 +1255,7 @@ brcmf_msgbuf_process_flow_ring_delete_re
+ 	status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
+ 
+ 	if (status) {
+-		brcmf_err("Flowring deletion failed, code %d\n", status);
++		bphy_err(drvr, "Flowring deletion failed, code %d\n", status);
+ 		brcmf_flowring_delete(msgbuf->flow, flowid);
+ 		return;
+ 	}
+@@ -1258,6 +1268,7 @@ brcmf_msgbuf_process_flow_ring_delete_re
+ 
+ static void brcmf_msgbuf_process_msgtype(struct brcmf_msgbuf *msgbuf, void *buf)
+ {
++	struct brcmf_pub *drvr = msgbuf->drvr;
+ 	struct msgbuf_common_hdr *msg;
+ 
+ 	msg = (struct msgbuf_common_hdr *)buf;
+@@ -1294,7 +1305,7 @@ static void brcmf_msgbuf_process_msgtype
+ 		brcmf_msgbuf_process_rx_complete(msgbuf, buf);
+ 		break;
+ 	default:
+-		brcmf_err("Unsupported msgtype %d\n", msg->msgtype);
++		bphy_err(drvr, "Unsupported msgtype %d\n", msg->msgtype);
+ 		break;
+ 	}
+ }
+@@ -1377,7 +1388,7 @@ void brcmf_msgbuf_delete_flowring(struct
+ 	brcmf_commonring_lock(commonring);
+ 	ret_ptr = brcmf_commonring_reserve_for_write(commonring);
+ 	if (!ret_ptr) {
+-		brcmf_err("FW unaware, flowring will be removed !!\n");
++		bphy_err(drvr, "FW unaware, flowring will be removed !!\n");
+ 		brcmf_commonring_unlock(commonring);
+ 		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
+ 		return;
+@@ -1401,7 +1412,7 @@ void brcmf_msgbuf_delete_flowring(struct
+ 	err = brcmf_commonring_write_complete(commonring);
+ 	brcmf_commonring_unlock(commonring);
+ 	if (err) {
+-		brcmf_err("Failed to submit RING_DELETE, flowring will be removed\n");
++		bphy_err(drvr, "Failed to submit RING_DELETE, flowring will be removed\n");
+ 		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
+ 	}
+ }
+@@ -1476,8 +1487,8 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 	if_msgbuf = drvr->bus_if->msgbuf;
+ 
+ 	if (if_msgbuf->max_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
+-		brcmf_err("driver not configured for this many flowrings %d\n",
+-			  if_msgbuf->max_flowrings);
++		bphy_err(drvr, "driver not configured for this many flowrings %d\n",
++			 if_msgbuf->max_flowrings);
+ 		if_msgbuf->max_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
+ 	}
+ 
+@@ -1487,7 +1498,7 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 
+ 	msgbuf->txflow_wq = create_singlethread_workqueue("msgbuf_txflow");
+ 	if (msgbuf->txflow_wq == NULL) {
+-		brcmf_err("workqueue creation failed\n");
++		bphy_err(drvr, "workqueue creation failed\n");
+ 		goto fail;
+ 	}
+ 	INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -434,6 +434,7 @@ static void brcmf_p2p_print_actframe(boo
+  */
+ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	s32 ret = 0;
+ 
+ 	brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
+@@ -450,7 +451,7 @@ static int brcmf_p2p_set_firmware(struct
+ 	ret = brcmf_fil_iovar_data_set(ifp, "p2p_da_override", p2p_mac,
+ 				       ETH_ALEN);
+ 	if (ret)
+-		brcmf_err("failed to update device address ret %d\n", ret);
++		bphy_err(drvr, "failed to update device address ret %d\n", ret);
+ 
+ 	return ret;
+ }
+@@ -570,13 +571,14 @@ static s32 brcmf_p2p_deinit_discovery(st
+  */
+ static int brcmf_p2p_enable_discovery(struct brcmf_p2p_info *p2p)
+ {
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	s32 ret = 0;
+ 
+ 	brcmf_dbg(TRACE, "enter\n");
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+ 	if (!vif) {
+-		brcmf_err("P2P config device not available\n");
++		bphy_err(drvr, "P2P config device not available\n");
+ 		ret = -EPERM;
+ 		goto exit;
+ 	}
+@@ -590,13 +592,13 @@ static int brcmf_p2p_enable_discovery(st
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+ 	ret = brcmf_fil_iovar_int_set(vif->ifp, "p2p_disc", 1);
+ 	if (ret < 0) {
+-		brcmf_err("set p2p_disc error\n");
++		bphy_err(drvr, "set p2p_disc error\n");
+ 		goto exit;
+ 	}
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+ 	ret = brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_SCAN, 0, 0);
+ 	if (ret < 0) {
+-		brcmf_err("unable to set WL_P2P_DISC_ST_SCAN\n");
++		bphy_err(drvr, "unable to set WL_P2P_DISC_ST_SCAN\n");
+ 		goto exit;
+ 	}
+ 
+@@ -608,7 +610,7 @@ static int brcmf_p2p_enable_discovery(st
+ 	 */
+ 	ret = brcmf_fil_bsscfg_int_set(vif->ifp, "wsec", AES_ENABLED);
+ 	if (ret < 0) {
+-		brcmf_err("wsec error %d\n", ret);
++		bphy_err(drvr, "wsec error %d\n", ret);
+ 		goto exit;
+ 	}
+ 
+@@ -630,6 +632,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
+ 			   u16 chanspecs[], s32 search_state,
+ 			   enum p2p_bss_type bss_type)
+ {
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	s32 ret = 0;
+ 	s32 memsize = offsetof(struct brcmf_p2p_scan_le,
+ 			       eparams.params_le.channel_list);
+@@ -648,7 +651,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
+ 
+ 	vif = p2p->bss_idx[bss_type].vif;
+ 	if (vif == NULL) {
+-		brcmf_err("no vif for bss type %d\n", bss_type);
++		bphy_err(drvr, "no vif for bss type %d\n", bss_type);
+ 		ret = -EINVAL;
+ 		goto exit;
+ 	}
+@@ -676,7 +679,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
+ 		       BRCMF_P2P_WILDCARD_SSID_LEN);
+ 		break;
+ 	default:
+-		brcmf_err(" invalid search state %d\n", search_state);
++		bphy_err(drvr, " invalid search state %d\n", search_state);
+ 		ret = -EINVAL;
+ 		goto exit;
+ 	}
+@@ -760,6 +763,7 @@ static s32 brcmf_p2p_run_escan(struct br
+ 			       struct cfg80211_scan_request *request)
+ {
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	s32 err = 0;
+ 	s32 search_state = WL_P2P_DISC_ST_SCAN;
+ 	struct brcmf_cfg80211_vif *vif;
+@@ -822,7 +826,7 @@ static s32 brcmf_p2p_run_escan(struct br
+ 	}
+ exit:
+ 	if (err)
+-		brcmf_err("error (%d)\n", err);
++		bphy_err(drvr, "error (%d)\n", err);
+ 	return err;
+ }
+ 
+@@ -917,19 +921,20 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
+ static s32
+ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
+ {
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	struct brcmu_chan ch;
+ 	s32 err = 0;
+ 
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+ 	if (!vif) {
+-		brcmf_err("Discovery is not set, so we have nothing to do\n");
++		bphy_err(drvr, "Discovery is not set, so we have nothing to do\n");
+ 		err = -EPERM;
+ 		goto exit;
+ 	}
+ 
+ 	if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status)) {
+-		brcmf_err("Previous LISTEN is not completed yet\n");
++		bphy_err(drvr, "Previous LISTEN is not completed yet\n");
+ 		/* WAR: prevent cookie mismatch in wpa_supplicant return OK */
+ 		goto exit;
+ 	}
+@@ -1046,6 +1051,7 @@ void brcmf_p2p_cancel_remain_on_channel(
+  */
+ static s32 brcmf_p2p_act_frm_search(struct brcmf_p2p_info *p2p, u16 channel)
+ {
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	s32 err;
+ 	u32 channel_cnt;
+ 	u16 *default_chan_list;
+@@ -1061,7 +1067,7 @@ static s32 brcmf_p2p_act_frm_search(stru
+ 	default_chan_list = kzalloc(channel_cnt * sizeof(*default_chan_list),
+ 				    GFP_KERNEL);
+ 	if (default_chan_list == NULL) {
+-		brcmf_err("channel list allocation failed\n");
++		bphy_err(drvr, "channel list allocation failed\n");
+ 		err = -ENOMEM;
+ 		goto exit;
+ 	}
+@@ -1103,6 +1109,7 @@ static void brcmf_p2p_afx_handler(struct
+ 	struct brcmf_p2p_info *p2p = container_of(afx_hdl,
+ 						  struct brcmf_p2p_info,
+ 						  afx_hdl);
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	s32 err;
+ 
+ 	if (!afx_hdl->is_active)
+@@ -1116,7 +1123,7 @@ static void brcmf_p2p_afx_handler(struct
+ 		err = brcmf_p2p_act_frm_search(p2p, afx_hdl->peer_listen_chan);
+ 
+ 	if (err) {
+-		brcmf_err("ERROR occurred! value is (%d)\n", err);
++		bphy_err(drvr, "ERROR occurred! value is (%d)\n", err);
+ 		if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+ 			     &p2p->status))
+ 			complete(&afx_hdl->act_frm_scan);
+@@ -1338,7 +1345,8 @@ int brcmf_p2p_notify_action_frame_rx(str
+ 				     const struct brcmf_event_msg *e,
+ 				     void *data)
+ {
+-	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_cfg80211_info *cfg = drvr->config;
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
+ 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+ 	struct wireless_dev *wdev;
+@@ -1409,7 +1417,7 @@ int brcmf_p2p_notify_action_frame_rx(str
+ 	mgmt_frame = kzalloc(offsetof(struct ieee80211_mgmt, u) +
+ 			     mgmt_frame_len, GFP_KERNEL);
+ 	if (!mgmt_frame) {
+-		brcmf_err("No memory available for action frame\n");
++		bphy_err(drvr, "No memory available for action frame\n");
+ 		return -ENOMEM;
+ 	}
+ 	memcpy(mgmt_frame->da, ifp->mac_addr, ETH_ALEN);
+@@ -1492,6 +1500,7 @@ int brcmf_p2p_notify_action_tx_complete(
+ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+ 				     struct brcmf_fil_af_params_le *af_params)
+ {
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	s32 err = 0;
+ 	s32 timeout = 0;
+@@ -1506,7 +1515,7 @@ static s32 brcmf_p2p_tx_action_frame(str
+ 	err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
+ 					sizeof(*af_params));
+ 	if (err) {
+-		brcmf_err(" sending action frame has failed\n");
++		bphy_err(drvr, " sending action frame has failed\n");
+ 		goto exit;
+ 	}
+ 
+@@ -1556,6 +1565,7 @@ static s32 brcmf_p2p_pub_af_tx(struct br
+ 			       struct brcmf_config_af_params *config_af_params)
+ {
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_fil_action_frame_le *action_frame;
+ 	struct brcmf_p2p_pub_act_frame *act_frm;
+ 	s32 err = 0;
+@@ -1634,8 +1644,8 @@ static s32 brcmf_p2p_pub_af_tx(struct br
+ 		config_af_params->extra_listen = false;
+ 		break;
+ 	default:
+-		brcmf_err("Unknown p2p pub act frame subtype: %d\n",
+-			  act_frm->subtype);
++		bphy_err(drvr, "Unknown p2p pub act frame subtype: %d\n",
++			 act_frm->subtype);
+ 		err = -EINVAL;
+ 	}
+ 	return err;
+@@ -1657,6 +1667,7 @@ bool brcmf_p2p_send_action_frame(struct
+ 	struct brcmf_fil_action_frame_le *action_frame;
+ 	struct brcmf_config_af_params config_af_params;
+ 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	u16 action_frame_len;
+ 	bool ack = false;
+ 	u8 category;
+@@ -1692,7 +1703,7 @@ bool brcmf_p2p_send_action_frame(struct
+ 		if (brcmf_p2p_pub_af_tx(cfg, af_params, &config_af_params)) {
+ 			/* Just send unknown subtype frame with */
+ 			/* default parameters.                  */
+-			brcmf_err("P2P Public action frame, unknown subtype.\n");
++			bphy_err(drvr, "P2P Public action frame, unknown subtype.\n");
+ 		}
+ 	} else if (brcmf_p2p_is_gas_action(action_frame->data,
+ 					   action_frame_len)) {
+@@ -1714,7 +1725,7 @@ bool brcmf_p2p_send_action_frame(struct
+ 			af_params->dwell_time =
+ 				cpu_to_le32(P2P_AF_MIN_DWELL_TIME);
+ 		} else {
+-			brcmf_err("Unknown action type: %d\n", action);
++			bphy_err(drvr, "Unknown action type: %d\n", action);
+ 			goto exit;
+ 		}
+ 	} else if (brcmf_p2p_is_p2p_action(action_frame->data,
+@@ -1722,8 +1733,8 @@ bool brcmf_p2p_send_action_frame(struct
+ 		/* do not configure anything. it will be */
+ 		/* sent with a default configuration     */
+ 	} else {
+-		brcmf_err("Unknown Frame: category 0x%x, action 0x%x\n",
+-			  category, action);
++		bphy_err(drvr, "Unknown Frame: category 0x%x, action 0x%x\n",
++			 category, action);
+ 		return false;
+ 	}
+ 
+@@ -1761,7 +1772,7 @@ bool brcmf_p2p_send_action_frame(struct
+ 
+ 		if (brcmf_p2p_af_searching_channel(p2p) ==
+ 							P2P_INVALID_CHANNEL) {
+-			brcmf_err("Couldn't find peer's channel.\n");
++			bphy_err(drvr, "Couldn't find peer's channel.\n");
+ 			goto exit;
+ 		}
+ 
+@@ -1783,7 +1794,8 @@ bool brcmf_p2p_send_action_frame(struct
+ 		tx_retry++;
+ 	}
+ 	if (ack == false) {
+-		brcmf_err("Failed to send Action Frame(retry %d)\n", tx_retry);
++		bphy_err(drvr, "Failed to send Action Frame(retry %d)\n",
++			 tx_retry);
+ 		clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+ 	}
+ 
+@@ -1965,6 +1977,7 @@ int brcmf_p2p_ifchange(struct brcmf_cfg8
+ 		       enum brcmf_fil_p2p_if_types if_type)
+ {
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	struct brcmf_fil_p2p_if_le if_request;
+ 	s32 err;
+@@ -1974,13 +1987,13 @@ int brcmf_p2p_ifchange(struct brcmf_cfg8
+ 
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+ 	if (!vif) {
+-		brcmf_err("vif for P2PAPI_BSSCFG_PRIMARY does not exist\n");
++		bphy_err(drvr, "vif for P2PAPI_BSSCFG_PRIMARY does not exist\n");
+ 		return -EPERM;
+ 	}
+ 	brcmf_notify_escan_complete(cfg, vif->ifp, true, true);
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
+ 	if (!vif) {
+-		brcmf_err("vif for P2PAPI_BSSCFG_CONNECTION does not exist\n");
++		bphy_err(drvr, "vif for P2PAPI_BSSCFG_CONNECTION does not exist\n");
+ 		return -EPERM;
+ 	}
+ 	brcmf_set_mpc(vif->ifp, 0);
+@@ -1998,7 +2011,7 @@ int brcmf_p2p_ifchange(struct brcmf_cfg8
+ 	err = brcmf_fil_iovar_data_set(vif->ifp, "p2p_ifupd", &if_request,
+ 				       sizeof(if_request));
+ 	if (err) {
+-		brcmf_err("p2p_ifupd FAILED, err=%d\n", err);
++		bphy_err(drvr, "p2p_ifupd FAILED, err=%d\n", err);
+ 		brcmf_cfg80211_arm_vif_event(cfg, NULL);
+ 		return err;
+ 	}
+@@ -2006,7 +2019,7 @@ int brcmf_p2p_ifchange(struct brcmf_cfg8
+ 					    BRCMF_VIF_EVENT_TIMEOUT);
+ 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
+ 	if (!err)  {
+-		brcmf_err("No BRCMF_E_IF_CHANGE event received\n");
++		bphy_err(drvr, "No BRCMF_E_IF_CHANGE event received\n");
+ 		return -EIO;
+ 	}
+ 
+@@ -2069,6 +2082,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ 						    struct wiphy *wiphy,
+ 						    u8 *addr)
+ {
++	struct brcmf_pub *drvr = p2p->cfg->pub;
+ 	struct brcmf_cfg80211_vif *p2p_vif;
+ 	struct brcmf_if *p2p_ifp;
+ 	struct brcmf_if *pri_ifp;
+@@ -2080,7 +2094,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ 
+ 	p2p_vif = brcmf_alloc_vif(p2p->cfg, NL80211_IFTYPE_P2P_DEVICE);
+ 	if (IS_ERR(p2p_vif)) {
+-		brcmf_err("could not create discovery vif\n");
++		bphy_err(drvr, "could not create discovery vif\n");
+ 		return (struct wireless_dev *)p2p_vif;
+ 	}
+ 
+@@ -2088,7 +2102,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ 
+ 	/* firmware requires unique mac address for p2pdev interface */
+ 	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
+-		brcmf_err("discovery vif must be different from primary interface\n");
++		bphy_err(drvr, "discovery vif must be different from primary interface\n");
+ 		return ERR_PTR(-EINVAL);
+ 	}
+ 
+@@ -2101,7 +2115,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ 	/* Initialize P2P Discovery in the firmware */
+ 	err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
+ 	if (err < 0) {
+-		brcmf_err("set p2p_disc error\n");
++		bphy_err(drvr, "set p2p_disc error\n");
+ 		brcmf_fweh_p2pdev_setup(pri_ifp, false);
+ 		brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
+ 		goto fail;
+@@ -2113,7 +2127,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ 	brcmf_cfg80211_arm_vif_event(p2p->cfg, NULL);
+ 	brcmf_fweh_p2pdev_setup(pri_ifp, false);
+ 	if (!err) {
+-		brcmf_err("timeout occurred\n");
++		bphy_err(drvr, "timeout occurred\n");
+ 		err = -EIO;
+ 		goto fail;
+ 	}
+@@ -2127,7 +2141,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ 	/* verify bsscfg index for P2P discovery */
+ 	err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bsscfgidx);
+ 	if (err < 0) {
+-		brcmf_err("retrieving discover bsscfg index failed\n");
++		bphy_err(drvr, "retrieving discover bsscfg index failed\n");
+ 		goto fail;
+ 	}
+ 
+@@ -2161,6 +2175,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	enum brcmf_fil_p2p_if_types iftype;
+ 	int err;
+@@ -2201,7 +2216,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
+ 					    BRCMF_VIF_EVENT_TIMEOUT);
+ 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
+ 	if (!err) {
+-		brcmf_err("timeout occurred\n");
++		bphy_err(drvr, "timeout occurred\n");
+ 		err = -EIO;
+ 		goto fail;
+ 	}
+@@ -2209,7 +2224,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
+ 	/* interface created in firmware */
+ 	ifp = vif->ifp;
+ 	if (!ifp) {
+-		brcmf_err("no if pointer provided\n");
++		bphy_err(drvr, "no if pointer provided\n");
+ 		err = -ENOENT;
+ 		goto fail;
+ 	}
+@@ -2220,7 +2235,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
+ #endif /* >= 3.17.0 */
+ 	err = brcmf_net_attach(ifp, true);
+ 	if (err) {
+-		brcmf_err("Registering netdevice failed\n");
++		bphy_err(drvr, "Registering netdevice failed\n");
+ 		free_netdev(ifp->ndev);
+ 		goto fail;
+ 	}
+@@ -2375,6 +2390,7 @@ void brcmf_p2p_stop_device(struct wiphy
+  */
+ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced)
+ {
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_p2p_info *p2p;
+ 	struct brcmf_if *pri_ifp;
+ 	s32 err = 0;
+@@ -2389,7 +2405,7 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
+ 	if (p2pdev_forced) {
+ 		err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
+ 		if (IS_ERR(err_ptr)) {
+-			brcmf_err("P2P device creation failed.\n");
++			bphy_err(drvr, "P2P device creation failed.\n");
+ 			err = PTR_ERR(err_ptr);
+ 		}
+ 	} else {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -109,6 +109,7 @@ static int brcmf_pno_channel_config(stru
+ static int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
+ 			    u32 mscan, u32 bestn)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_pno_param_le pfn_param;
+ 	u16 flags;
+ 	u32 pfnmem;
+@@ -132,13 +133,13 @@ static int brcmf_pno_config(struct brcmf
+ 		/* set bestn in firmware */
+ 		err = brcmf_fil_iovar_int_set(ifp, "pfnmem", pfnmem);
+ 		if (err < 0) {
+-			brcmf_err("failed to set pfnmem\n");
++			bphy_err(drvr, "failed to set pfnmem\n");
+ 			goto exit;
+ 		}
+ 		/* get max mscan which the firmware supports */
+ 		err = brcmf_fil_iovar_int_get(ifp, "pfnmem", &pfnmem);
+ 		if (err < 0) {
+-			brcmf_err("failed to get pfnmem\n");
++			bphy_err(drvr, "failed to get pfnmem\n");
+ 			goto exit;
+ 		}
+ 		mscan = min_t(u32, mscan, pfnmem);
+@@ -152,7 +153,7 @@ static int brcmf_pno_config(struct brcmf
+ 	err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
+ 				       sizeof(pfn_param));
+ 	if (err)
+-		brcmf_err("pfn_set failed, err=%d\n", err);
++		bphy_err(drvr, "pfn_set failed, err=%d\n", err);
+ 
+ exit:
+ 	return err;
+@@ -160,6 +161,7 @@ exit:
+ 
+ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_pno_macaddr_le pfn_mac;
+ 	u8 *mac_addr = NULL;
+ 	u8 *mac_mask = NULL;
+@@ -194,7 +196,7 @@ static int brcmf_pno_set_random(struct b
+ 	err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
+ 				       sizeof(pfn_mac));
+ 	if (err)
+-		brcmf_err("pfn_macaddr failed, err=%d\n", err);
++		bphy_err(drvr, "pfn_macaddr failed, err=%d\n", err);
+ 
+ 	return err;
+ }
+@@ -202,6 +204,7 @@ static int brcmf_pno_set_random(struct b
+ static int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct cfg80211_ssid *ssid,
+ 			      bool active)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_pno_net_param_le pfn;
+ 	int err;
+ 
+@@ -218,12 +221,13 @@ static int brcmf_pno_add_ssid(struct brc
+ 	brcmf_dbg(SCAN, "adding ssid=%.32s (active=%d)\n", ssid->ssid, active);
+ 	err = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn, sizeof(pfn));
+ 	if (err < 0)
+-		brcmf_err("adding failed: err=%d\n", err);
++		bphy_err(drvr, "adding failed: err=%d\n", err);
+ 	return err;
+ }
+ 
+ static int brcmf_pno_add_bssid(struct brcmf_if *ifp, const u8 *bssid)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_pno_bssid_le bssid_cfg;
+ 	int err;
+ 
+@@ -234,7 +238,7 @@ static int brcmf_pno_add_bssid(struct br
+ 	err = brcmf_fil_iovar_data_set(ifp, "pfn_add_bssid", &bssid_cfg,
+ 				       sizeof(bssid_cfg));
+ 	if (err < 0)
+-		brcmf_err("adding failed: err=%d\n", err);
++		bphy_err(drvr, "adding failed: err=%d\n", err);
+ 	return err;
+ }
+ 
+@@ -258,6 +262,7 @@ static bool brcmf_is_ssid_active(struct
+ 
+ static int brcmf_pno_clean(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	int ret;
+ 
+ 	/* Disable pfn */
+@@ -267,7 +272,7 @@ static int brcmf_pno_clean(struct brcmf_
+ 		ret = brcmf_fil_iovar_data_set(ifp, "pfnclear", NULL, 0);
+ 	}
+ 	if (ret < 0)
+-		brcmf_err("failed code %d\n", ret);
++		bphy_err(drvr, "failed code %d\n", ret);
+ 
+ 	return ret;
+ }
+@@ -392,6 +397,7 @@ static int brcmf_pno_config_networks(str
+ 
+ static int brcmf_pno_config_sched_scans(struct brcmf_if *ifp)
+ {
++	struct brcmf_pub *drvr = ifp->drvr;
+ 	struct brcmf_pno_info *pi;
+ 	struct brcmf_gscan_config *gscan_cfg;
+ 	struct brcmf_gscan_bucket_config *buckets;
+@@ -416,7 +422,7 @@ static int brcmf_pno_config_sched_scans(
+ 	/* clean up everything */
+ 	err = brcmf_pno_clean(ifp);
+ 	if  (err < 0) {
+-		brcmf_err("failed error=%d\n", err);
++		bphy_err(drvr, "failed error=%d\n", err);
+ 		goto free_gscan;
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -47,8 +47,8 @@ int brcmf_proto_attach(struct brcmf_pub
+ 		if (brcmf_proto_msgbuf_attach(drvr))
+ 			goto fail;
+ 	} else {
+-		brcmf_err("Unsupported proto type %d\n",
+-			  drvr->bus_if->proto_type);
++		bphy_err(drvr, "Unsupported proto type %d\n",
++			 drvr->bus_if->proto_type);
+ 		goto fail;
+ 	}
+ 	if (!proto->tx_queue_data || (proto->hdrpull == NULL) ||
+@@ -56,7 +56,7 @@ int brcmf_proto_attach(struct brcmf_pub
+ 	    (proto->configure_addr_mode == NULL) ||
+ 	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL) ||
+ 	    (proto->debugfs_create == NULL)) {
+-		brcmf_err("Not all proto handlers have been installed\n");
++		bphy_err(drvr, "Not all proto handlers have been installed\n");
+ 		goto fail;
+ 	}
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch b/package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch
new file mode 100644
index 0000000000..323e93354c
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch
@@ -0,0 +1,38 @@
+From e0a8ef4d7b4315bc4c1641fb3f3a7dfdfa6627b8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 20 Feb 2019 11:30:47 +0100
+Subject: [PATCH] brcmfmac: add basic validation of shared RAM address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While experimenting with firmware loading I ended up in a state of
+firmware reporting shared RAM address 0x04000001. It was causing:
+[   94.448015] Unable to handle kernel paging request at virtual address cd680001
+due to reading out of the mapped memory.
+
+This patch adds some basic validation to avoid kernel crashes due to the
+unexpected firmware behavior.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1560,6 +1560,12 @@ static int brcmf_pcie_download_fw_nvram(
+ 		brcmf_err(bus, "FW failed to initialize\n");
+ 		return -ENODEV;
+ 	}
++	if (sharedram_addr < devinfo->ci->rambase ||
++	    sharedram_addr >= devinfo->ci->rambase + devinfo->ci->ramsize) {
++		brcmf_err(bus, "Invalid shared RAM address 0x%08x\n",
++			  sharedram_addr);
++		return -ENODEV;
++	}
+ 	brcmf_dbg(PCIE, "Shared RAM addr: 0x%08x\n", sharedram_addr);
+ 
+ 	return (brcmf_pcie_init_share_ram_info(devinfo, sharedram_addr));
diff --git a/package/kernel/mac80211/patches/381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch b/package/kernel/mac80211/patches/381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch
new file mode 100644
index 0000000000..10834db608
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch
@@ -0,0 +1,29 @@
+From 0c7051610c577b60b01b3b5aec14d6765e177b0d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 21 Feb 2019 11:33:24 +0100
+Subject: [PATCH] brcmfmac: fix size of the struct msgbuf_ring_status
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This updates host struct to match the in-firmawre definition. It's a
+cosmetic change as it only applies to the reserved struct space.
+
+Fixes: c988b78244df ("brcmfmac: print firmware reported ring status errors")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -139,7 +139,7 @@ struct msgbuf_ring_status {
+ 	struct msgbuf_common_hdr	msg;
+ 	struct msgbuf_completion_hdr	compl_hdr;
+ 	__le16				write_idx;
+-	__le32				rsvd0[5];
++	__le16				rsvd0[5];
+ };
+ 
+ struct msgbuf_rx_event {
diff --git a/package/kernel/mac80211/patches/381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch b/package/kernel/mac80211/patches/381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch
new file mode 100644
index 0000000000..313d501e82
--- /dev/null
+++ b/package/kernel/mac80211/patches/381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch
@@ -0,0 +1,69 @@
+From c91377495192cda096e52dc09c266b0d05f16d86 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 21 Feb 2019 11:33:25 +0100
+Subject: [PATCH] brcmfmac: print firmware reported general status errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Firmware may report general errors using a special message type. Add
+basic support for it by simply decoding & printing an error number.
+
+A sample situation in which firmware reports a buf error:
+CONSOLE: 027084.733 no host response IOCTL buffer available..so fail the request
+will now produce a "Firmware reported general error: 9" on the host.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -134,6 +134,14 @@ struct msgbuf_completion_hdr {
+ 	__le16				flow_ring_id;
+ };
+ 
++/* Data struct for the MSGBUF_TYPE_GEN_STATUS */
++struct msgbuf_gen_status {
++	struct msgbuf_common_hdr	msg;
++	struct msgbuf_completion_hdr	compl_hdr;
++	__le16				write_idx;
++	__le32				rsvd0[3];
++};
++
+ /* Data struct for the MSGBUF_TYPE_RING_STATUS */
+ struct msgbuf_ring_status {
+ 	struct msgbuf_common_hdr	msg;
+@@ -1194,6 +1202,18 @@ brcmf_msgbuf_process_rx_complete(struct
+ 	brcmf_netif_rx(ifp, skb);
+ }
+ 
++static void brcmf_msgbuf_process_gen_status(struct brcmf_msgbuf *msgbuf,
++					    void *buf)
++{
++	struct msgbuf_gen_status *gen_status = buf;
++	struct brcmf_pub *drvr = msgbuf->drvr;
++	int err;
++
++	err = le16_to_cpu(gen_status->compl_hdr.status);
++	if (err)
++		bphy_err(drvr, "Firmware reported general error: %d\n", err);
++}
++
+ static void brcmf_msgbuf_process_ring_status(struct brcmf_msgbuf *msgbuf,
+ 					     void *buf)
+ {
+@@ -1273,6 +1293,10 @@ static void brcmf_msgbuf_process_msgtype
+ 
+ 	msg = (struct msgbuf_common_hdr *)buf;
+ 	switch (msg->msgtype) {
++	case MSGBUF_TYPE_GEN_STATUS:
++		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_GEN_STATUS\n");
++		brcmf_msgbuf_process_gen_status(msgbuf, buf);
++		break;
+ 	case MSGBUF_TYPE_RING_STATUS:
+ 		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RING_STATUS\n");
+ 		brcmf_msgbuf_process_ring_status(msgbuf, buf);
diff --git a/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch b/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
new file mode 100644
index 0000000000..ad282f9892
--- /dev/null
+++ b/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
@@ -0,0 +1,38 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Mon, 13 Aug 2018 14:16:25 +0200
+Subject: [PATCH] mac80211: Run TXQ teardown code before de-registering
+ interfaces
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The TXQ teardown code can reference the vif data structures that are
+stored in the netdev private memory area if there are still packets on
+the queue when it is being freed. Since the TXQ teardown code is run
+after the netdevs are freed, this can lead to a use-after-free. Fix this
+by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Tested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1172,6 +1172,7 @@ void ieee80211_unregister_hw(struct ieee
+ #if IS_ENABLED(__disabled__CONFIG_IPV6)
+ 	unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
++	ieee80211_txq_teardown_flows(local);
+ 
+ 	rtnl_lock();
+ 
+@@ -1200,7 +1201,6 @@ void ieee80211_unregister_hw(struct ieee
+ 	skb_queue_purge(&local->skb_queue);
+ 	skb_queue_purge(&local->skb_queue_unreliable);
+ 	skb_queue_purge(&local->skb_queue_tdls_chsw);
+-	ieee80211_txq_teardown_flows(local);
+ 
+ 	destroy_workqueue(local->workqueue);
+ 	wiphy_unregister(local->hw.wiphy);
diff --git a/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch b/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
new file mode 100644
index 0000000000..e7b279af55
--- /dev/null
+++ b/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
@@ -0,0 +1,28 @@
+From: Yuan-Chi Pang <fu3mo6goo@gmail.com>
+Date: Wed, 29 Aug 2018 09:30:08 +0800
+Subject: [PATCH] mac80211: mesh: fix HWMP sequence numbering to follow
+ standard
+
+IEEE 802.11-2016 14.10.8.3 HWMP sequence numbering says:
+If it is a target mesh STA, it shall update its own HWMP SN to
+maximum (current HWMP SN, target HWMP SN in the PREQ element) + 1
+immediately before it generates a PREP element in response to a
+PREQ element.
+
+Signed-off-by: Yuan-Chi Pang <fu3mo6goo@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(stru
+ 		forward = false;
+ 		reply = true;
+ 		target_metric = 0;
++
++		if (SN_GT(target_sn, ifmsh->sn))
++			ifmsh->sn = target_sn;
++
+ 		if (time_after(jiffies, ifmsh->last_sn_update +
+ 					net_traversal_jiffies(sdata)) ||
+ 		    time_before(jiffies, ifmsh->last_sn_update)) {
diff --git a/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch b/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
new file mode 100644
index 0000000000..66993839ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
@@ -0,0 +1,102 @@
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Wed, 29 Aug 2018 08:57:02 +0200
+Subject: [PATCH] mac80211: avoid kernel panic when building AMSDU from
+ non-linear SKB
+
+When building building AMSDU from non-linear SKB, we hit a
+kernel panic when trying to push the padding to the tail.
+Instead, put the padding at the head of the next subframe.
+This also fixes the A-MSDU subframes to not have the padding
+accounted in the length field and not have pad at all for
+the last subframe, both required by the spec.
+
+Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Reviewed-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3064,27 +3064,18 @@ void ieee80211_clear_fast_xmit(struct st
+ }
+ 
+ static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
+-					struct sk_buff *skb, int headroom,
+-					int *subframe_len)
++					struct sk_buff *skb, int headroom)
+ {
+-	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
+-	int padding = (4 - amsdu_len) & 3;
+-
+-	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
++	if (skb_headroom(skb) < headroom) {
+ 		I802_DEBUG_INC(local->tx_expand_skb_head);
+ 
+-		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
++		if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
+ 			wiphy_debug(local->hw.wiphy,
+ 				    "failed to reallocate TX buffer\n");
+ 			return false;
+ 		}
+ 	}
+ 
+-	if (padding) {
+-		*subframe_len += padding;
+-		skb_put_zero(skb, padding);
+-	}
+-
+ 	return true;
+ }
+ 
+@@ -3108,8 +3099,7 @@ static bool ieee80211_amsdu_prepare_head
+ 	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
+ 		return true;
+ 
+-	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
+-					 &subframe_len))
++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
+ 		return false;
+ 
+ 	data = skb_push(skb, sizeof(*amsdu_hdr));
+@@ -3176,7 +3166,8 @@ static bool ieee80211_amsdu_aggregate(st
+ 	void *data;
+ 	bool ret = false;
+ 	unsigned int orig_len;
+-	int n = 1, nfrags;
++	int n = 1, nfrags, pad = 0;
++	u16 hdrlen;
+ 
+ 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
+ 		return false;
+@@ -3228,8 +3219,19 @@ static bool ieee80211_amsdu_aggregate(st
+ 	if (max_frags && nfrags > max_frags)
+ 		goto out;
+ 
+-	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
+-					 &subframe_len))
++	/*
++	 * Pad out the previous subframe to a multiple of 4 by adding the
++	 * padding to the next one, that's being added. Note that head->len
++	 * is the length of the full A-MSDU, but that works since each time
++	 * we add a new subframe we pad out the previous one to a multiple
++	 * of 4 and thus it no longer matters in the next round.
++	 */
++	hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
++	if ((head->len - hdrlen) & 3)
++		pad = 4 - ((head->len - hdrlen) & 3);
++
++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
++						     2 + pad))
+ 		goto out;
+ 
+ 	ret = true;
+@@ -3241,6 +3243,8 @@ static bool ieee80211_amsdu_aggregate(st
+ 	memcpy(data, &len, 2);
+ 	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
+ 
++	memset(skb_push(skb, pad), 0, pad);
++
+ 	head->len += skb->len;
+ 	head->data_len += skb->len;
+ 	*frag_tail = skb;
diff --git a/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch b/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
new file mode 100644
index 0000000000..f4b14506a6
--- /dev/null
+++ b/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
@@ -0,0 +1,27 @@
+From: Arunk Khandavalli <akhandav@codeaurora.org>
+Date: Thu, 30 Aug 2018 00:40:16 +0300
+Subject: [PATCH] cfg80211: nl80211_update_ft_ies() to validate
+ NL80211_ATTR_IE
+
+nl80211_update_ft_ies() tried to validate NL80211_ATTR_IE with
+is_valid_ie_attr() before dereferencing it, but that helper function
+returns true in case of NULL pointer (i.e., attribute not included).
+This can result to dereferencing a NULL pointer. Fix that by explicitly
+checking that NL80211_ATTR_IE is included.
+
+Fixes: 355199e02b83 ("cfg80211: Extend support for IEEE 802.11r Fast BSS Transition")
+Signed-off-by: Arunk Khandavalli <akhandav@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11763,6 +11763,7 @@ static int nl80211_update_ft_ies(struct
+ 		return -EOPNOTSUPP;
+ 
+ 	if (!info->attrs[NL80211_ATTR_MDID] ||
++	    !info->attrs[NL80211_ATTR_IE] ||
+ 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+ 		return -EINVAL;
+ 
diff --git a/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch b/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
new file mode 100644
index 0000000000..1d88902251
--- /dev/null
+++ b/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
@@ -0,0 +1,37 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Wed, 29 Aug 2018 21:03:25 +0200
+Subject: [PATCH] mac80211: do not convert to A-MSDU if frag/subframe
+ limited
+
+Do not start to aggregate packets in a A-MSDU frame (converting the
+first subframe to A-MSDU, adding the header) if max_tx_fragments or
+max_amsdu_subframes limits are already exceeded by it. In particular,
+this happens when drivers set the limit to 1 to avoid A-MSDUs at all.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+[reword commit message to be more precise]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3201,9 +3201,6 @@ static bool ieee80211_amsdu_aggregate(st
+ 	if (skb->len + head->len > max_amsdu_len)
+ 		goto unlock;
+ 
+-	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+-		goto out;
+-
+ 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
+ 	nfrags += 1 + skb_shinfo(head)->nr_frags;
+ 	frag_tail = &skb_shinfo(head)->frag_list;
+@@ -3219,6 +3216,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	if (max_frags && nfrags > max_frags)
+ 		goto out;
+ 
++	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
++		goto out;
++
+ 	/*
+ 	 * Pad out the previous subframe to a multiple of 4 by adding the
+ 	 * padding to the next one, that's being added. Note that head->len
diff --git a/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch b/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
new file mode 100644
index 0000000000..47942116bc
--- /dev/null
+++ b/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
@@ -0,0 +1,51 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 30 Aug 2018 10:55:49 +0200
+Subject: [PATCH] mac80211: always account for A-MSDU header changes
+
+In the error path of changing the SKB headroom of the second
+A-MSDU subframe, we would not account for the already-changed
+length of the first frame that just got converted to be in
+A-MSDU format and thus is a bit longer now.
+
+Fix this by doing the necessary accounting.
+
+It would be possible to reorder the operations, but that would
+make the code more complex (to calculate the necessary pad),
+and the headroom expansion should not fail frequently enough
+to make that worthwhile.
+
+Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3232,7 +3232,7 @@ static bool ieee80211_amsdu_aggregate(st
+ 
+ 	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
+ 						     2 + pad))
+-		goto out;
++		goto out_recalc;
+ 
+ 	ret = true;
+ 	data = skb_push(skb, ETH_ALEN + 2);
+@@ -3249,11 +3249,13 @@ static bool ieee80211_amsdu_aggregate(st
+ 	head->data_len += skb->len;
+ 	*frag_tail = skb;
+ 
+-	flow->backlog += head->len - orig_len;
+-	tin->backlog_bytes += head->len - orig_len;
+-
+-	fq_recalc_backlog(fq, tin, flow);
++out_recalc:
++	if (head->len != orig_len) {
++		flow->backlog += head->len - orig_len;
++		tin->backlog_bytes += head->len - orig_len;
+ 
++		fq_recalc_backlog(fq, tin, flow);
++	}
+ out:
+ 	fq->memory_usage += head->truesize - orig_truesize;
+ 
diff --git a/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch b/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
new file mode 100644
index 0000000000..455fa29831
--- /dev/null
+++ b/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
@@ -0,0 +1,26 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 31 Aug 2018 01:04:13 +0200
+Subject: [PATCH] mac80211: fix an off-by-one issue in A-MSDU
+ max_subframe computation
+
+Initialize 'n' to 2 in order to take into account also the first
+packet in the estimation of max_subframe limit for a given A-MSDU
+since frag_tail pointer is NULL when ieee80211_amsdu_aggregate
+routine analyzes the second frame.
+
+Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3166,7 +3166,7 @@ static bool ieee80211_amsdu_aggregate(st
+ 	void *data;
+ 	bool ret = false;
+ 	unsigned int orig_len;
+-	int n = 1, nfrags, pad = 0;
++	int n = 2, nfrags, pad = 0;
+ 	u16 hdrlen;
+ 
+ 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
diff --git a/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch b/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
new file mode 100644
index 0000000000..8437aad6a6
--- /dev/null
+++ b/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
@@ -0,0 +1,33 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 31 Aug 2018 11:10:55 +0300
+Subject: [PATCH] cfg80211: fix a type issue in
+ ieee80211_chandef_to_operating_class()
+
+The "chandef->center_freq1" variable is a u32 but "freq" is a u16 so we
+are truncating away the high bits.  I noticed this bug because in commit
+9cf0a0b4b64a ("cfg80211: Add support for 60GHz band channels 5 and 6")
+we made "freq <= 56160 + 2160 * 6" a valid requency when before it was
+only "freq <= 56160 + 2160 * 4" that was valid.  It introduces a static
+checker warning:
+
+    net/wireless/util.c:1571 ieee80211_chandef_to_operating_class()
+    warn: always true condition '(freq <= 56160 + 2160 * 6) => (0-u16max <= 69120)'
+
+But really we probably shouldn't have been truncating the high bits
+away to begin with.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1377,7 +1377,7 @@ bool ieee80211_chandef_to_operating_clas
+ 					  u8 *op_class)
+ {
+ 	u8 vht_opclass;
+-	u16 freq = chandef->center_freq1;
++	u32 freq = chandef->center_freq1;
+ 
+ 	if (freq >= 2412 && freq <= 2472) {
+ 		if (chandef->width > NL80211_CHAN_WIDTH_40)
diff --git a/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch b/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
new file mode 100644
index 0000000000..db2aa0443f
--- /dev/null
+++ b/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
@@ -0,0 +1,86 @@
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 31 Aug 2018 11:31:06 +0300
+Subject: [PATCH] mac80211: fix a race between restart and CSA flows
+
+We hit a problem with iwlwifi that was caused by a bug in
+mac80211. A bug in iwlwifi caused the firwmare to crash in
+certain cases in channel switch. Because of that bug,
+drv_pre_channel_switch would fail and trigger the restart
+flow.
+Now we had the hw restart worker which runs on the system's
+workqueue and the csa_connection_drop_work worker that runs
+on mac80211's workqueue that can run together. This is
+obviously problematic since the restart work wants to
+reconfigure the connection, while the csa_connection_drop_work
+worker does the exact opposite: it tries to disconnect.
+
+Fix this by cancelling the csa_connection_drop_work worker
+in the restart worker.
+
+Note that this can sound racy: we could have:
+
+driver   iface_work   CSA_work   restart_work
++++++++++++++++++++++++++++++++++++++++++++++
+              |
+ <--drv_cs ---|
+<FW CRASH!>
+-CS FAILED-->
+              |                       |
+              |                 cancel_work(CSA)
+           schedule                   |
+           CSA work                   |
+                         |            |
+                        Race between those 2
+
+But this is not possible because we flush the workqueue
+in the restart worker before we cancel the CSA worker.
+That would be bullet proof if we could guarantee that
+we schedule the CSA worker only from the iface_work
+which runs on the workqueue (and not on the system's
+workqueue), but unfortunately we do have an instance
+in which we schedule the CSA work outside the context
+of the workqueue (ieee80211_chswitch_done).
+
+Note also that we should probably cancel other workers
+like beacon_connection_loss_work and possibly others
+for different types of interfaces, at the very least,
+IBSS should suffer from the exact same problem, but for
+now, do the minimum to fix the actual bug that was actually
+experienced and reproduced.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -255,8 +255,27 @@ static void ieee80211_restart_work(struc
+ 
+ 	flush_work(&local->radar_detected_work);
+ 	rtnl_lock();
+-	list_for_each_entry(sdata, &local->interfaces, list)
++	list_for_each_entry(sdata, &local->interfaces, list) {
++		/*
++		 * XXX: there may be more work for other vif types and even
++		 * for station mode: a good thing would be to run most of
++		 * the iface type's dependent _stop (ieee80211_mg_stop,
++		 * ieee80211_ibss_stop) etc...
++		 * For now, fix only the specific bug that was seen: race
++		 * between csa_connection_drop_work and us.
++		 */
++		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
++			/*
++			 * This worker is scheduled from the iface worker that
++			 * runs on mac80211's workqueue, so we can't be
++			 * scheduling this worker after the cancel right here.
++			 * The exception is ieee80211_chswitch_done.
++			 * Then we can have a race...
++			 */
++			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
++		}
+ 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
++	}
+ 	ieee80211_scan_cancel(local);
+ 
+ 	/* make sure any new ROC will consider local->in_reconfig */
diff --git a/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch b/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
new file mode 100644
index 0000000000..aa8db32e72
--- /dev/null
+++ b/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
@@ -0,0 +1,96 @@
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Fri, 31 Aug 2018 11:31:10 +0300
+Subject: [PATCH] mac80211: Fix station bandwidth setting after channel
+ switch
+
+When performing a channel switch flow for a managed interface, the
+flow did not update the bandwidth of the AP station and the rate
+scale algorithm. In case of a channel width downgrade, this would
+result with the rate scale algorithm using a bandwidth that does not
+match the interface channel configuration.
+
+Fix this by updating the AP station bandwidth and rate scaling algorithm
+before the actual channel change in case of a bandwidth downgrade, or
+after the actual channel change in case of a bandwidth upgrade.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -975,6 +975,10 @@ static void ieee80211_chswitch_work(stru
+ 	 */
+ 
+ 	if (sdata->reserved_chanctx) {
++		struct ieee80211_supported_band *sband = NULL;
++		struct sta_info *mgd_sta = NULL;
++		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
++
+ 		/*
+ 		 * with multi-vif csa driver may call ieee80211_csa_finish()
+ 		 * many times while waiting for other interfaces to use their
+@@ -983,6 +987,48 @@ static void ieee80211_chswitch_work(stru
+ 		if (sdata->reserved_ready)
+ 			goto out;
+ 
++		if (sdata->vif.bss_conf.chandef.width !=
++		    sdata->csa_chandef.width) {
++			/*
++			 * For managed interface, we need to also update the AP
++			 * station bandwidth and align the rate scale algorithm
++			 * on the bandwidth change. Here we only consider the
++			 * bandwidth of the new channel definition (as channel
++			 * switch flow does not have the full HT/VHT/HE
++			 * information), assuming that if additional changes are
++			 * required they would be done as part of the processing
++			 * of the next beacon from the AP.
++			 */
++			switch (sdata->csa_chandef.width) {
++			case NL80211_CHAN_WIDTH_20_NOHT:
++			case NL80211_CHAN_WIDTH_20:
++			default:
++				bw = IEEE80211_STA_RX_BW_20;
++				break;
++			case NL80211_CHAN_WIDTH_40:
++				bw = IEEE80211_STA_RX_BW_40;
++				break;
++			case NL80211_CHAN_WIDTH_80:
++				bw = IEEE80211_STA_RX_BW_80;
++				break;
++			case NL80211_CHAN_WIDTH_80P80:
++			case NL80211_CHAN_WIDTH_160:
++				bw = IEEE80211_STA_RX_BW_160;
++				break;
++			}
++
++			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
++			sband =
++				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
++		}
++
++		if (sdata->vif.bss_conf.chandef.width >
++		    sdata->csa_chandef.width) {
++			mgd_sta->sta.bandwidth = bw;
++			rate_control_rate_update(local, sband, mgd_sta,
++						 IEEE80211_RC_BW_CHANGED);
++		}
++
+ 		ret = ieee80211_vif_use_reserved_context(sdata);
+ 		if (ret) {
+ 			sdata_info(sdata,
+@@ -993,6 +1039,13 @@ static void ieee80211_chswitch_work(stru
+ 			goto out;
+ 		}
+ 
++		if (sdata->vif.bss_conf.chandef.width <
++		    sdata->csa_chandef.width) {
++			mgd_sta->sta.bandwidth = bw;
++			rate_control_rate_update(local, sband, mgd_sta,
++						 IEEE80211_RC_BW_CHANGED);
++		}
++
+ 		goto out;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch b/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
new file mode 100644
index 0000000000..74dd3d3775
--- /dev/null
+++ b/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
@@ -0,0 +1,78 @@
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 31 Aug 2018 11:31:12 +0300
+Subject: [PATCH] mac80211: don't Tx a deauth frame if the AP forbade Tx
+
+If the driver fails to properly prepare for the channel
+switch, mac80211 will disconnect. If the CSA IE had mode
+set to 1, it means that the clients are not allowed to send
+any Tx on the current channel, and that includes the
+deauthentication frame.
+
+Make sure that we don't send the deauthentication frame in
+this case.
+
+In iwlwifi, this caused a failure to flush queues since the
+firmware already closed the queues after having parsed the
+CSA IE. Then mac80211 would wait until the deauthentication
+frame would go out (drv_flush(drop=false)) and that would
+never happen.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1267,6 +1267,16 @@ ieee80211_sta_process_chanswitch(struct
+ 					 cbss->beacon_interval));
+ 	return;
+  drop_connection:
++	/*
++	 * This is just so that the disconnect flow will know that
++	 * we were trying to switch channel and failed. In case the
++	 * mode is 1 (we are not allowed to Tx), we will know not to
++	 * send a deauthentication frame. Those two fields will be
++	 * reset when the disconnection worker runs.
++	 */
++	sdata->vif.csa_active = true;
++	sdata->csa_block_tx = csa_ie.mode;
++
+ 	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
+ 	mutex_unlock(&local->chanctx_mtx);
+ 	mutex_unlock(&local->mtx);
+@@ -2437,6 +2447,7 @@ static void __ieee80211_disconnect(struc
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++	bool tx;
+ 
+ 	sdata_lock(sdata);
+ 	if (!ifmgd->associated) {
+@@ -2444,6 +2455,8 @@ static void __ieee80211_disconnect(struc
+ 		return;
+ 	}
+ 
++	tx = !sdata->csa_block_tx;
++
+ 	/* AP is probably out of range (or not reachable for another reason) so
+ 	 * remove the bss struct for that AP.
+ 	 */
+@@ -2451,7 +2464,7 @@ static void __ieee80211_disconnect(struc
+ 
+ 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+ 			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+-			       true, frame_buf);
++			       tx, frame_buf);
+ 	mutex_lock(&local->mtx);
+ 	sdata->vif.csa_active = false;
+ 	ifmgd->csa_waiting_bcn = false;
+@@ -2462,7 +2475,7 @@ static void __ieee80211_disconnect(struc
+ 	}
+ 	mutex_unlock(&local->mtx);
+ 
+-	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
++	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
+ 				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+ 
+ 	sdata_unlock(sdata);
diff --git a/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch b/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
new file mode 100644
index 0000000000..fb5b282d1d
--- /dev/null
+++ b/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
@@ -0,0 +1,74 @@
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 31 Aug 2018 11:31:13 +0300
+Subject: [PATCH] mac80211: shorten the IBSS debug messages
+
+When tracing is enabled, all the debug messages are recorded and must
+not exceed MAX_MSG_LEN (100) columns. Longer debug messages grant the
+user with:
+
+WARNING: CPU: 3 PID: 32642 at /tmp/wifi-core-20180806094828/src/iwlwifi-stack-dev/net/mac80211/./trace_msg.h:32 trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
+Workqueue: phy1 ieee80211_iface_work [mac80211]
+ RIP: 0010:trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
+ Call Trace:
+  __sdata_dbg+0xbd/0x120 [mac80211]
+  ieee80211_ibss_rx_queued_mgmt+0x15f/0x510 [mac80211]
+  ieee80211_iface_work+0x21d/0x320 [mac80211]
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibs
+ 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
+ 		return;
+ 
+-	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
+-		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
++	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
+ 	sta_info_destroy_addr(sdata, mgmt->sa);
+ }
+ 
+@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(
+ 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+ 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+ 
+-	ibss_dbg(sdata,
+-		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
+-		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
++	ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++	ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
++		 mgmt->bssid, auth_transaction);
+ 
+ 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
+ 		return;
+@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct
+ 		rx_timestamp = drv_get_tsf(local, sdata);
+ 	}
+ 
+-	ibss_dbg(sdata,
+-		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
++	ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
+ 		 mgmt->sa, mgmt->bssid,
+-		 (unsigned long long)rx_timestamp,
++		 (unsigned long long)rx_timestamp);
++	ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
+ 		 (unsigned long long)beacon_timestamp,
+ 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
+ 		 jiffies);
+@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(
+ 
+ 	tx_last_beacon = drv_tx_last_beacon(local);
+ 
+-	ibss_dbg(sdata,
+-		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
+-		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
++	ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++	ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
++		 mgmt->bssid, tx_last_beacon);
+ 
+ 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
+ 		return;
diff --git a/package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch b/package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
new file mode 100644
index 0000000000..c5c6586652
--- /dev/null
+++ b/package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
@@ -0,0 +1,26 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 22 Sep 2018 15:05:59 +0200
+Subject: [PATCH] mac80211: allocate TXQs for active monitor interfaces
+
+Monitor mode interfaces with the active flag are passed down to the driver.
+Drivers using TXQ expect that all interfaces have allocated TXQs before
+they get added.
+
+Fixes: 79af1f866193d ("mac80211: avoid allocating TXQs that won't be used")
+Cc: stable@vger.kernel.org
+Reported-by: Catrinel Catrinescu <cc@80211.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1816,7 +1816,8 @@ int ieee80211_if_add(struct ieee80211_lo
+ 
+ 		if (local->ops->wake_tx_queue &&
+ 		    type != NL80211_IFTYPE_AP_VLAN &&
+-		    type != NL80211_IFTYPE_MONITOR)
++		    (type != NL80211_IFTYPE_MONITOR ||
++		     (params->flags & MONITOR_FLAG_ACTIVE)))
+ 			txq_size += sizeof(struct txq_info) +
+ 				    local->hw.txq_data_size;
+ 
diff --git a/package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch b/package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
new file mode 100644
index 0000000000..a42668d069
--- /dev/null
+++ b/package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 29 Sep 2018 15:55:44 +0200
+Subject: [PATCH] mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode
+ keys
+
+key->sta is only valid after ieee80211_key_link, which is called later
+in this function. Because of that, the IEEE80211_KEY_FLAG_RX_MGMT is
+never set when management frame protection is enabled.
+
+Fixes: e548c49e6dc6b ("mac80211: add key flag for management keys")
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -426,7 +426,7 @@ static int ieee80211_add_key(struct wiph
+ 	case NL80211_IFTYPE_AP:
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 		/* Keys without a station are used for TX only */
+-		if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))
++		if (sta && test_sta_flag(sta, WLAN_STA_MFP))
+ 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
diff --git a/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch b/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
new file mode 100644
index 0000000000..4819dfc648
--- /dev/null
+++ b/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
@@ -0,0 +1,31 @@
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Thu, 11 Oct 2018 14:21:21 +0200
+Subject: [PATCH] mac80211: free skb fraglist before freeing the skb
+
+mac80211 uses the frag list to build AMSDU. When freeing
+the skb, it may not be really freed, since someone is still
+holding a reference to it.
+In that case, when TCP skb is being retransmitted, the
+pointer to the frag list is being reused, while the data
+in there is no longer valid.
+Since we will never get frag list from the network stack,
+as mac80211 doesn't advertise the capability, we can safely
+free and nullify it before releasing the SKB.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -550,6 +550,11 @@ static void ieee80211_report_used_skb(st
+ 	}
+ 
+ 	ieee80211_led_tx(local);
++
++	if (skb_has_frag_list(skb)) {
++		kfree_skb_list(skb_shinfo(skb)->frag_list);
++		skb_shinfo(skb)->frag_list = NULL;
++	}
+ }
+ 
+ /*
diff --git a/package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch b/package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch
new file mode 100644
index 0000000000..0269da126d
--- /dev/null
+++ b/package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch
@@ -0,0 +1,26 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 13 Nov 2018 20:29:03 +0100
+Subject: [PATCH] mac80211: ignore tx status for PS stations in
+ ieee80211_tx_status_ext
+
+Make it behave like regular ieee80211_tx_status calls, except for the lack of
+filtered frame processing.
+This fixes spurious low-ack triggered disconnections with powersave clients
+connected to an AP.
+
+Fixes: f027c2aca0cf4 ("mac80211: add ieee80211_tx_status_noskb")
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -976,6 +976,8 @@ void ieee80211_tx_status_ext(struct ieee
+ 			/* Track when last TDLS packet was ACKed */
+ 			if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
+ 				sta->status_stats.last_tdls_pkt_time = jiffies;
++		} else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
++			return;
+ 		} else {
+ 			ieee80211_lost_packet(sta, info);
+ 		}
diff --git a/package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch b/package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch
new file mode 100644
index 0000000000..c85e5c6612
--- /dev/null
+++ b/package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch
@@ -0,0 +1,272 @@
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Wed, 11 Jul 2018 00:12:53 +0530
+Subject: [PATCH] mac80211: add stop/start logic for software TXQs
+
+Sometimes, it is required to stop the transmissions momentarily and
+resume it later; stopping the txqs becomes very critical in scenarios where
+the packet transmission has to be ceased completely. For example, during
+the hardware restart, during off channel operations,
+when initiating CSA(upon detecting a radar on the DFS channel), etc.
+
+The TX queue stop/start logic in mac80211 works well in stopping the TX
+when drivers make use of netdev queues, i.e, when Qdiscs in network layer
+take care of traffic scheduling. Since the devices implementing
+wake_tx_queue can run without Qdiscs, packets will be handed to mac80211
+directly without queueing them in the netdev queues.
+
+Also, mac80211 does not invoke any of the
+netif_stop_*/netif_wake_* APIs if wake_tx_queue is implemented.
+Since the queues are not stopped in this case, transmissions can continue
+and this will impact negatively on the operation of the wireless device.
+
+For example,
+During hardware restart, we stop the netdev queues so that packets are
+not sent to the driver. Since ath10k implements wake_tx_queue,
+TX queues will not be stopped and packets might reach the hardware while
+it is restarting; this can make hardware unresponsive and the only
+possible option for recovery is to reboot the entire system.
+
+There is another problem to this, it is observed that the packets
+were sent on the DFS channel for a prolonged duration after radar
+detection impacting the channel closing time.
+
+We can still invoke netif stop/wake APIs when wake_tx_queue is implemented
+but this could lead to packet drops in network layer; adding stop/start
+logic for software TXQs in mac80211 instead makes more sense; the change
+proposed adds the same in mac80211.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1453,6 +1453,8 @@ enum ieee80211_vif_flags {
+  * @drv_priv: data area for driver use, will always be aligned to
+  *	sizeof(void \*).
+  * @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
++ * @txqs_stopped: per AC flag to indicate that intermediate TXQs are stopped,
++ *	protected by fq->lock.
+  */
+ struct ieee80211_vif {
+ 	enum nl80211_iftype type;
+@@ -1477,6 +1479,8 @@ struct ieee80211_vif {
+ 
+ 	unsigned int probe_req_reg;
+ 
++	bool txqs_stopped[IEEE80211_NUM_ACS];
++
+ 	/* must be last */
+ 	u8 drv_priv[0] __aligned(sizeof(void *));
+ };
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -816,6 +816,7 @@ enum txq_info_flags {
+ 	IEEE80211_TXQ_STOP,
+ 	IEEE80211_TXQ_AMPDU,
+ 	IEEE80211_TXQ_NO_AMSDU,
++	IEEE80211_TXQ_STOP_NETIF_TX,
+ };
+ 
+ /**
+@@ -1223,6 +1224,7 @@ struct ieee80211_local {
+ 
+ 	struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
+ 	struct tasklet_struct tx_pending_tasklet;
++	struct tasklet_struct wake_txqs_tasklet;
+ 
+ 	atomic_t agg_queue_stop[IEEE80211_MAX_QUEUES];
+ 
+@@ -2037,6 +2039,7 @@ void ieee80211_txq_purge(struct ieee8021
+ 			 struct txq_info *txqi);
+ void ieee80211_txq_remove_vlan(struct ieee80211_local *local,
+ 			       struct ieee80211_sub_if_data *sdata);
++void ieee80211_wake_txqs(unsigned long data);
+ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
+ 			 u16 transaction, u16 auth_alg, u16 status,
+ 			 const u8 *extra, size_t extra_len, const u8 *bssid,
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -671,6 +671,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
+ 		     (unsigned long)local);
+ 
++	if (ops->wake_tx_queue)
++		tasklet_init(&local->wake_txqs_tasklet, ieee80211_wake_txqs,
++			     (unsigned long)local);
++
+ 	tasklet_init(&local->tasklet,
+ 		     ieee80211_tasklet_handler,
+ 		     (unsigned long) local);
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3463,13 +3463,19 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ 	struct ieee80211_tx_info *info;
+ 	struct ieee80211_tx_data tx;
+ 	ieee80211_tx_result r;
+-	struct ieee80211_vif *vif;
++	struct ieee80211_vif *vif = txq->vif;
+ 
+ 	spin_lock_bh(&fq->lock);
+ 
+-	if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
++	if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ||
++	    test_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags))
+ 		goto out;
+ 
++	if (vif->txqs_stopped[ieee80211_ac_from_tid(txq->tid)]) {
++		set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags);
++		goto out;
++	}
++
+ 	/* Make sure fragments stay together. */
+ 	skb = __skb_dequeue(&txqi->frags);
+ 	if (skb)
+@@ -3565,6 +3571,7 @@ begin:
+ 	}
+ 
+ 	IEEE80211_SKB_CB(skb)->control.vif = vif;
++
+ out:
+ 	spin_unlock_bh(&fq->lock);
+ 
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -239,6 +239,99 @@ __le16 ieee80211_ctstoself_duration(stru
+ }
+ EXPORT_SYMBOL(ieee80211_ctstoself_duration);
+ 
++static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_vif *vif = &sdata->vif;
++	struct fq *fq = &local->fq;
++	struct ps_data *ps = NULL;
++	struct txq_info *txqi;
++	struct sta_info *sta;
++	int i;
++
++	spin_lock_bh(&fq->lock);
++
++	if (sdata->vif.type == NL80211_IFTYPE_AP)
++		ps = &sdata->bss->ps;
++
++	sdata->vif.txqs_stopped[ac] = false;
++
++	list_for_each_entry_rcu(sta, &local->sta_list, list) {
++		if (sdata != sta->sdata)
++			continue;
++
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++			struct ieee80211_txq *txq = sta->sta.txq[i];
++
++			txqi = to_txq_info(txq);
++
++			if (ac != txq->ac)
++				continue;
++
++			if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX,
++						&txqi->flags))
++				continue;
++
++			spin_unlock_bh(&fq->lock);
++			drv_wake_tx_queue(local, txqi);
++			spin_lock_bh(&fq->lock);
++		}
++	}
++
++	if (!vif->txq)
++		goto out;
++
++	txqi = to_txq_info(vif->txq);
++
++	if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags) ||
++	    (ps && atomic_read(&ps->num_sta_ps)) || ac != vif->txq->ac)
++		goto out;
++
++	spin_unlock_bh(&fq->lock);
++
++	drv_wake_tx_queue(local, txqi);
++	return;
++out:
++	spin_unlock_bh(&fq->lock);
++}
++
++void ieee80211_wake_txqs(unsigned long data)
++{
++	struct ieee80211_local *local = (struct ieee80211_local *)data;
++	struct ieee80211_sub_if_data *sdata;
++	int n_acs = IEEE80211_NUM_ACS;
++	unsigned long flags;
++	int i;
++
++	rcu_read_lock();
++	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
++
++	if (local->hw.queues < IEEE80211_NUM_ACS)
++		n_acs = 1;
++
++	for (i = 0; i < local->hw.queues; i++) {
++		if (local->queue_stop_reasons[i])
++			continue;
++
++		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++		list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++			int ac;
++
++			for (ac = 0; ac < n_acs; ac++) {
++				int ac_queue = sdata->vif.hw_queue[ac];
++
++				if (ac_queue == i ||
++				    sdata->vif.cab_queue == i)
++					__ieee80211_wake_txqs(sdata, ac);
++			}
++		}
++		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
++	}
++
++	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++	rcu_read_unlock();
++}
++
+ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
+ {
+ 	struct ieee80211_sub_if_data *sdata;
+@@ -307,6 +400,9 @@ static void __ieee80211_wake_queue(struc
+ 		rcu_read_unlock();
+ 	} else
+ 		tasklet_schedule(&local->tx_pending_tasklet);
++
++	if (local->ops->wake_tx_queue)
++		tasklet_schedule(&local->wake_txqs_tasklet);
+ }
+ 
+ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+@@ -350,9 +446,6 @@ static void __ieee80211_stop_queue(struc
+ 	if (__test_and_set_bit(reason, &local->queue_stop_reasons[queue]))
+ 		return;
+ 
+-	if (local->ops->wake_tx_queue)
+-		return;
+-
+ 	if (local->hw.queues < IEEE80211_NUM_ACS)
+ 		n_acs = 1;
+ 
+@@ -365,8 +458,15 @@ static void __ieee80211_stop_queue(struc
+ 
+ 		for (ac = 0; ac < n_acs; ac++) {
+ 			if (sdata->vif.hw_queue[ac] == queue ||
+-			    sdata->vif.cab_queue == queue)
+-				netif_stop_subqueue(sdata->dev, ac);
++			    sdata->vif.cab_queue == queue) {
++				if (!local->ops->wake_tx_queue) {
++					netif_stop_subqueue(sdata->dev, ac);
++					continue;
++				}
++				spin_lock(&local->fq.lock);
++				sdata->vif.txqs_stopped[ac] = true;
++				spin_unlock(&local->fq.lock);
++			}
+ 		}
+ 	}
+ 	rcu_read_unlock();
diff --git a/package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch b/package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
new file mode 100644
index 0000000000..302646066d
--- /dev/null
+++ b/package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
@@ -0,0 +1,33 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 1 Mar 2019 14:42:56 +0100
+Subject: [PATCH] mac80211: do not call driver wake_tx_queue op during reconfig
+
+There are several scenarios in which mac80211 can call drv_wake_tx_queue
+after ieee80211_restart_hw has been called and has not yet completed.
+Driver private structs are considered uninitialized until mac80211 has
+uploaded the vifs, stations and keys again, so using private tx queue
+data during that time is not safe.
+
+The driver can also not rely on drv_reconfig_complete to figure out when
+it is safe to accept drv_wake_tx_queue calls again, because it is only
+called after all tx queues are woken again.
+
+To fix this, bail out early in drv_wake_tx_queue if local->in_reconfig
+is set.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1162,6 +1162,9 @@ static inline void drv_wake_tx_queue(str
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
+ 
++	if (local->in_reconfig)
++		return;
++
+ 	if (!check_sdata_in_driver(sdata))
+ 		return;
+ 
diff --git a/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch b/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
rename to package/kernel/mac80211/patches/400-ath_move_debug_code.patch
index e7df0e14be..ed65053d77 100644
--- a/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
+++ b/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/Makefile
 +++ b/drivers/net/wireless/ath/Makefile
-@@ -14,10 +14,10 @@ ath-objs :=	main.o \
+@@ -13,10 +13,10 @@ ath-objs :=	main.o \
  		regd.o \
  		hw.o \
  		key.o \
@@ -14,7 +14,7 @@
  CFLAGS_trace.o := -I$(src)
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -316,14 +316,7 @@ void _ath_dbg(struct ath_common *common,
+@@ -318,14 +318,7 @@ void _ath_dbg(struct ath_common *common,
  #endif /* CPTCFG_ATH_DEBUG */
  
  /** Returns string describing opmode, or NULL if unknown mode. */
diff --git a/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch b/package/kernel/mac80211/patches/401-ath9k_blink_default.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
rename to package/kernel/mac80211/patches/401-ath9k_blink_default.patch
index 3eb57bb1cf..7405e594fe 100644
--- a/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
+++ b/package/kernel/mac80211/patches/401-ath9k_blink_default.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -48,7 +48,7 @@ int ath9k_modparam_nohwcrypt;
+@@ -47,7 +47,7 @@ int ath9k_modparam_nohwcrypt;
  module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
  MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
  
diff --git a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
rename to package/kernel/mac80211/patches/402-ath_regd_optional.patch
index cae3c5c0dd..8fa56f40a4 100644
--- a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
@@ -70,7 +70,7 @@
  
 --- a/drivers/net/wireless/ath/Kconfig
 +++ b/drivers/net/wireless/ath/Kconfig
-@@ -24,6 +24,9 @@ config WLAN_VENDOR_ATH
+@@ -23,6 +23,9 @@ config WLAN_VENDOR_ATH
  
  if WLAN_VENDOR_ATH
  
@@ -82,7 +82,7 @@
  	---help---
 --- a/local-symbols
 +++ b/local-symbols
-@@ -83,6 +83,7 @@ ADM8211=
+@@ -87,6 +87,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/ath/403-world_regd_fixup.patch b/package/kernel/mac80211/patches/403-world_regd_fixup.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/403-world_regd_fixup.patch
rename to package/kernel/mac80211/patches/403-world_regd_fixup.patch
diff --git a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
new file mode 100644
index 0000000000..00be2ef98d
--- /dev/null
+++ b/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
@@ -0,0 +1,19 @@
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2860,6 +2860,8 @@ void regulatory_hint_country_ie(struct w
+ 	enum environment_cap env = ENVIRON_ANY;
+ 	struct regulatory_request *request = NULL, *lr;
+ 
++	return;
++
+ 	/* IE len must be evenly divisible by 2 */
+ 	if (country_ie_len & 0x01)
+ 		return;
+@@ -3066,6 +3068,7 @@ static void restore_regulatory_settings(
+ 
+ void regulatory_hint_disconnect(void)
+ {
++	return;
+ 	pr_debug("All devices are disconnected, going to restore regulatory settings\n");
+ 	restore_regulatory_settings(false);
+ }
diff --git a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch b/package/kernel/mac80211/patches/405-ath_regd_us.patch
similarity index 72%
rename from package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
rename to package/kernel/mac80211/patches/405-ath_regd_us.patch
index 088833199d..cc55877809 100644
--- a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
+++ b/package/kernel/mac80211/patches/405-ath_regd_us.patch
@@ -8,19 +8,19 @@
  	FRANCE_RES = 0x31,
  	FCC3_FCCA = 0x3A,
  	FCC3_WORLD = 0x3B,
-@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -167,6 +168,7 @@ static struct reg_dmn_pair_mapping regDo
  	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC3_FCCA, CTL_FCC, CTL_FCC},
 +	{FCC3_FCCA_2, CTL_FCC, CTL_FCC},
  	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
- 	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC4_FCCA, CTL_FCC, CTL_FCC},
-@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
+ 	{FCC5_FCCA, CTL_FCC, CTL_FCC},
+@@ -463,6 +465,7 @@ static struct country_code_to_enum_rd al
  	{CTRY_UAE, NULL1_WORLD, "AE"},
  	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
  	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
 +	{CTRY_UNITED_STATES, FCC3_FCCA_2, "US"},
- 	{CTRY_UNITED_STATES2, FCC3_FCCA, "US"},
- 	{CTRY_UNITED_STATES3, FCC3_FCCA, "US"},
  	/* This "PS" is for US public safety actually... to support this we
+ 	 * would need to assign new special alpha2 to CRDA db as with the world
+ 	 * regdomain and use another alpha2 */
diff --git a/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
rename to package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
diff --git a/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
similarity index 83%
rename from package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
index bdf784968f..86f96e8e97 100644
--- a/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -831,6 +831,7 @@ static const struct ieee80211_iface_limi
+@@ -777,6 +777,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
index 9dbe047c9a..2a5ab3d428 100644
--- a/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
@@ -18,7 +18,7 @@
  		goto end;
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -1964,7 +1964,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
+@@ -1965,7 +1965,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
  	}
  
  	if ((ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs +
@@ -27,7 +27,7 @@
  			ah->opmode == NL80211_IFTYPE_MESH_POINT) {
  		u64 tsf = ath5k_hw_get_tsf64(ah);
  		u32 tsftu = TSF_TO_TU(tsf);
-@@ -2050,7 +2050,7 @@ ath5k_beacon_update_timers(struct ath5k_
+@@ -2051,7 +2051,7 @@ ath5k_beacon_update_timers(struct ath5k_
  
  	intval = ah->bintval & AR5K_BEACON_PERIOD;
  	if (ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs
@@ -36,7 +36,7 @@
  		intval /= ATH_BCBUF;	/* staggered multi-bss beacons */
  		if (intval < 15)
  			ATH5K_WARN(ah, "intval %u is too low, min 15\n",
-@@ -2516,6 +2516,7 @@ static const struct ieee80211_iface_limi
+@@ -2518,6 +2518,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_MESH_POINT) |
  #endif
  				 BIT(NL80211_IFTYPE_AP) },
diff --git a/package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch b/package/kernel/mac80211/patches/420-ath5k_disable_fast_cc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
rename to package/kernel/mac80211/patches/420-ath5k_disable_fast_cc.patch
diff --git a/package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch b/package/kernel/mac80211/patches/430-add_ath5k_platform.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
rename to package/kernel/mac80211/patches/430-add_ath5k_platform.patch
diff --git a/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch b/package/kernel/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
rename to package/kernel/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
diff --git a/package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch b/package/kernel/mac80211/patches/432-ath5k_add_pciids.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
rename to package/kernel/mac80211/patches/432-ath5k_add_pciids.patch
diff --git a/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
rename to package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
index 57d3363274..3ae01a5c35 100644
--- a/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
+++ b/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
@@ -109,15 +109,16 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
  
  /* debugfs: queues etc */
  
-@@ -1016,6 +1107,8 @@ ath5k_debug_init_device(struct ath5k_hw
- 	debugfs_create_file("queue", 0600, phydir, ah, &fops_queue);
- 	debugfs_create_bool("32khz_clock", 0600, phydir,
- 			    &ah->ah_use_32khz_clock);
+@@ -1012,6 +1103,9 @@ ath5k_debug_init_device(struct ath5k_hw
+ 	debugfs_create_file("beacon", S_IWUSR | S_IRUSR, phydir, ah,
+ 			    &fops_beacon);
+ 
 +	debugfs_create_file("bwmode", S_IWUSR | S_IRUSR, phydir, ah,
 +			    &fops_bwmode);
- }
++
+ 	debugfs_create_file("reset", S_IWUSR, phydir, ah, &fops_reset);
  
- /* functions used in other places */
+ 	debugfs_create_file("antenna", S_IWUSR | S_IRUSR, phydir, ah,
 --- a/drivers/net/wireless/ath/ath5k/ath5k.h
 +++ b/drivers/net/wireless/ath/ath5k/ath5k.h
 @@ -1372,6 +1372,7 @@ struct ath5k_hw {
diff --git a/package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch b/package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
new file mode 100644
index 0000000000..9efe00c9b5
--- /dev/null
+++ b/package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
@@ -0,0 +1,32 @@
+From c9692820710f57c826b2e43a6fb1e4cd307508b0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 26 Feb 2019 14:11:16 +0100
+Subject: [PATCH] brcmfmac: support repeated brcmf_fw_alloc_request() calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+During a normal brcmfmac lifetime brcmf_fw_alloc_request() is called
+once only during the probe. It's safe to assume provided array is clear.
+
+Further brcmfmac improvements may require calling it multiple times
+though. This patch allows it by fixing invalid firmware paths like:
+brcm/brcmfmac4366c-pcie.binbrcm/brcmfmac4366c-pcie.bin
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -668,6 +668,7 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 
+ 	for (j = 0; j < n_fwnames; j++) {
+ 		fwreq->items[j].path = fwnames[j].path;
++		fwnames[j].path[0] = '\0';
+ 		/* check if firmware path is provided by module parameter */
+ 		if (brcmf_mp_global.firmware_path[0] != '\0') {
+ 			strlcpy(fwnames[j].path, mp_path,
diff --git a/package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch b/package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
new file mode 100644
index 0000000000..d29a767b5f
--- /dev/null
+++ b/package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
@@ -0,0 +1,79 @@
+From a2ec87ddbf1637f854ffcfff9d12d392fa30758b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 26 Feb 2019 14:11:18 +0100
+Subject: [PATCH] brcmfmac: add a function designated for handling firmware
+ fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This improves handling PCIe firmware halts by printing a clear error
+message and replaces a similar code in the SDIO bus support.
+
+It will also allow further improvements like trying to recover from a
+firmware crash.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  2 ++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 ++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  2 +-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  4 ++--
+ 4 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -252,6 +252,8 @@ void brcmf_detach(struct device *dev);
+ void brcmf_dev_reset(struct device *dev);
+ /* Request from bus module to initiate a coredump */
+ void brcmf_dev_coredump(struct device *dev);
++/* Indication that firmware has halted or crashed */
++void brcmf_fw_crashed(struct device *dev);
+ 
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1292,6 +1292,16 @@ void brcmf_dev_coredump(struct device *d
+ 		brcmf_dbg(TRACE, "failed to create coredump\n");
+ }
+ 
++void brcmf_fw_crashed(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	bphy_err(drvr, "Firmware has halted or crashed\n");
++
++	brcmf_dev_coredump(dev);
++}
++
+ void brcmf_detach(struct device *dev)
+ {
+ 	s32 i;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -730,7 +730,7 @@ static void brcmf_pcie_handle_mb_data(st
+ 	}
+ 	if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) {
+ 		brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n");
+-		brcmf_dev_coredump(&devinfo->pdev->dev);
++		brcmf_fw_crashed(&devinfo->pdev->dev);
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1073,8 +1073,8 @@ static u32 brcmf_sdio_hostmail(struct br
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+ 	if (hmb_data & HMB_DATA_FWHALT) {
+-		brcmf_err("mailbox indicates firmware halted\n");
+-		brcmf_dev_coredump(&sdiod->func1->dev);
++		brcmf_dbg(SDIO, "mailbox indicates firmware halted\n");
++		brcmf_fw_crashed(&sdiod->func1->dev);
+ 	}
+ 
+ 	/* Dongle recomposed rx frames, accept them again */
diff --git a/package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch b/package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
new file mode 100644
index 0000000000..0f2fc42954
--- /dev/null
+++ b/package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
@@ -0,0 +1,153 @@
+From 4684997d9eea29380000e062755aa6d368d789a3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 26 Feb 2019 14:11:19 +0100
+Subject: [PATCH] brcmfmac: reset PCIe bus on a firmware crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This includes bus reset & reloading a firmware. It should be sufficient
+for a user space to (setup and) use a wireless device again.
+
+Support for reset on USB & SDIO can be added later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bus.h         | 10 ++++++
+ .../broadcom/brcm80211/brcmfmac/core.c        | 12 +++++++
+ .../broadcom/brcm80211/brcmfmac/core.h        |  2 ++
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 35 +++++++++++++++++++
+ 4 files changed, 59 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
+ 	int (*get_fwname)(struct device *dev, const char *ext,
+ 			  unsigned char *fw_name);
++	int (*reset)(struct device *dev);
+ };
+ 
+ 
+@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bu
+ 	return bus->ops->get_fwname(bus->dev, ext, fw_name);
+ }
+ 
++static inline
++int brcmf_bus_reset(struct brcmf_bus *bus)
++{
++	if (!bus->ops->reset)
++		return -EOPNOTSUPP;
++
++	return bus->ops->reset(bus->dev);
++}
++
+ /*
+  * interface functions from common layer
+  */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1104,6 +1104,14 @@ static int brcmf_revinfo_read(struct seq
+ 	return 0;
+ }
+ 
++static void brcmf_core_bus_reset(struct work_struct *work)
++{
++	struct brcmf_pub *drvr = container_of(work, struct brcmf_pub,
++					      bus_reset);
++
++	brcmf_bus_reset(drvr->bus_if);
++}
++
+ static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
+ {
+ 	int ret = -1;
+@@ -1175,6 +1183,8 @@ static int brcmf_bus_started(struct brcm
+ #endif
+ #endif /* CONFIG_INET */
+ 
++	INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset);
++
+ 	/* populate debugfs */
+ 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
+ 	brcmf_feat_debugfs_create(drvr);
+@@ -1300,6 +1310,8 @@ void brcmf_fw_crashed(struct device *dev
+ 	bphy_err(drvr, "Firmware has halted or crashed\n");
+ 
+ 	brcmf_dev_coredump(dev);
++
++	schedule_work(&drvr->bus_reset);
+ }
+ 
+ void brcmf_detach(struct device *dev)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -143,6 +143,8 @@ struct brcmf_pub {
+ 	struct notifier_block inet6addr_notifier;
+ 	struct brcmf_mp_device *settings;
+ 
++	struct work_struct bus_reset;
++
+ 	u8 clmver[BRCMF_DCMD_SMLEN];
+ };
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -345,6 +345,10 @@ static const u32 brcmf_ring_itemsize[BRC
+ 	BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE
+ };
+ 
++static void brcmf_pcie_setup(struct device *dev, int ret,
++			     struct brcmf_fw_request *fwreq);
++static struct brcmf_fw_request *
++brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo);
+ 
+ static u32
+ brcmf_pcie_read_reg32(struct brcmf_pciedev_info *devinfo, u32 reg_offset)
+@@ -1409,6 +1413,36 @@ int brcmf_pcie_get_fwname(struct device
+ 	return 0;
+ }
+ 
++static int brcmf_pcie_reset(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
++	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
++	struct brcmf_fw_request *fwreq;
++	int err;
++
++	brcmf_detach(dev);
++
++	brcmf_pcie_release_irq(devinfo);
++	brcmf_pcie_release_scratchbuffers(devinfo);
++	brcmf_pcie_release_ringbuffers(devinfo);
++	brcmf_pcie_reset_device(devinfo);
++
++	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
++	if (!fwreq) {
++		dev_err(dev, "Failed to prepare FW request\n");
++		return -ENOMEM;
++	}
++
++	err = brcmf_fw_get_firmwares(dev, fwreq, brcmf_pcie_setup);
++	if (err) {
++		dev_err(dev, "Failed to prepare FW request\n");
++		kfree(fwreq);
++	}
++
++	return err;
++}
++
+ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
+ 	.txdata = brcmf_pcie_tx,
+ 	.stop = brcmf_pcie_down,
+@@ -1418,6 +1452,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.get_ramsize = brcmf_pcie_get_ramsize,
+ 	.get_memdump = brcmf_pcie_get_memdump,
+ 	.get_fwname = brcmf_pcie_get_fwname,
++	.reset = brcmf_pcie_reset,
+ };
+ 
+ 
diff --git a/package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch b/package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
new file mode 100644
index 0000000000..620a58533c
--- /dev/null
+++ b/package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
@@ -0,0 +1,124 @@
+From c80d26e81ef1802f30364b4ad1955c1443a592b9 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Mon, 4 Mar 2019 15:42:49 +0000
+Subject: [PATCH] brcmfmac: fix WARNING during USB disconnect in case of
+ unempty psq
+
+brcmu_pkt_buf_free_skb emits WARNING when attempting to free a sk_buff
+which is part of any queue. After USB disconnect this may have happened
+when brcmf_fws_hanger_cleanup() is called as per-interface psq was never
+cleaned when removing the interface.
+Change brcmf_fws_macdesc_cleanup() in a way that it removes the
+corresponding packets from hanger table (to avoid double-free when
+brcmf_fws_hanger_cleanup() is called) and add a call to clean-up the
+interface specific packet queue.
+
+Below is a WARNING during USB disconnect with Raspberry Pi WiFi dongle
+running in AP mode. This was reproducible when the interface was
+transmitting during the disconnect and is fixed with this commit.
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 1171 at drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49 brcmu_pkt_buf_free_skb+0x3c/0x40
+Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether cdc_acm smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core
+CPU: 0 PID: 1171 Comm: kworker/0:0 Not tainted 4.19.23-00075-gde33ed8 #99
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Workqueue: usb_hub_wq hub_event
+[<8010ff84>] (unwind_backtrace) from [<8010bb64>] (show_stack+0x10/0x14)
+[<8010bb64>] (show_stack) from [<80840278>] (dump_stack+0x88/0x9c)
+[<80840278>] (dump_stack) from [<8011f5ec>] (__warn+0xfc/0x114)
+[<8011f5ec>] (__warn) from [<8011f71c>] (warn_slowpath_null+0x40/0x48)
+[<8011f71c>] (warn_slowpath_null) from [<805a476c>] (brcmu_pkt_buf_free_skb+0x3c/0x40)
+[<805a476c>] (brcmu_pkt_buf_free_skb) from [<805bb6c4>] (brcmf_fws_cleanup+0x1e4/0x22c)
+[<805bb6c4>] (brcmf_fws_cleanup) from [<805bc854>] (brcmf_fws_del_interface+0x58/0x68)
+[<805bc854>] (brcmf_fws_del_interface) from [<805b66ac>] (brcmf_remove_interface+0x40/0x150)
+[<805b66ac>] (brcmf_remove_interface) from [<805b6870>] (brcmf_detach+0x6c/0xb0)
+[<805b6870>] (brcmf_detach) from [<805bdbb8>] (brcmf_usb_disconnect+0x30/0x4c)
+[<805bdbb8>] (brcmf_usb_disconnect) from [<805e5d64>] (usb_unbind_interface+0x5c/0x1e0)
+[<805e5d64>] (usb_unbind_interface) from [<804aab10>] (device_release_driver_internal+0x154/0x1ec)
+[<804aab10>] (device_release_driver_internal) from [<804a97f4>] (bus_remove_device+0xcc/0xf8)
+[<804a97f4>] (bus_remove_device) from [<804a6fc0>] (device_del+0x118/0x308)
+[<804a6fc0>] (device_del) from [<805e488c>] (usb_disable_device+0xa0/0x1c8)
+[<805e488c>] (usb_disable_device) from [<805dcf98>] (usb_disconnect+0x70/0x1d8)
+[<805dcf98>] (usb_disconnect) from [<805ddd84>] (hub_event+0x464/0xf50)
+[<805ddd84>] (hub_event) from [<80135a70>] (process_one_work+0x138/0x3f8)
+[<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554)
+[<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154)
+[<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c)
+Exception stack(0xecf8dfb0 to 0xecf8dff8)
+dfa0:                                     00000000 00000000 00000000 00000000
+dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
+---[ end trace 38d234018e9e2a90 ]---
+------------[ cut here ]------------
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 42 +++++++++++--------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -579,24 +579,6 @@ static bool brcmf_fws_ifidx_match(struct
+ 	return ifidx == *(int *)arg;
+ }
+ 
+-static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+-				int ifidx)
+-{
+-	bool (*matchfn)(struct sk_buff *, void *) = NULL;
+-	struct sk_buff *skb;
+-	int prec;
+-
+-	if (ifidx != -1)
+-		matchfn = brcmf_fws_ifidx_match;
+-	for (prec = 0; prec < q->num_prec; prec++) {
+-		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+-		while (skb) {
+-			brcmu_pkt_buf_free_skb(skb);
+-			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+-		}
+-	}
+-}
+-
+ static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
+ {
+ 	int i;
+@@ -668,6 +650,28 @@ static inline int brcmf_fws_hanger_poppk
+ 	return 0;
+ }
+ 
++static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
++				int ifidx)
++{
++	bool (*matchfn)(struct sk_buff *, void *) = NULL;
++	struct sk_buff *skb;
++	int prec;
++	u32 hslot;
++
++	if (ifidx != -1)
++		matchfn = brcmf_fws_ifidx_match;
++	for (prec = 0; prec < q->num_prec; prec++) {
++		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
++		while (skb) {
++			hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
++			brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
++						true);
++			brcmu_pkt_buf_free_skb(skb);
++			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
++		}
++	}
++}
++
+ static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
+ 					    u32 slot_id)
+ {
+@@ -2174,6 +2178,8 @@ void brcmf_fws_del_interface(struct brcm
+ 	brcmf_fws_lock(fws);
+ 	ifp->fws_desc = NULL;
+ 	brcmf_dbg(TRACE, "deleting %s\n", entry->name);
++	brcmf_fws_macdesc_cleanup(fws, &fws->desc.iface[ifp->ifidx],
++				  ifp->ifidx);
+ 	brcmf_fws_macdesc_deinit(entry);
+ 	brcmf_fws_cleanup(fws, ifp->ifidx);
+ 	brcmf_fws_unlock(fws);
diff --git a/package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch b/package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
new file mode 100644
index 0000000000..71b9487892
--- /dev/null
+++ b/package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
@@ -0,0 +1,217 @@
+From 5cdb0ef6144f47440850553579aa923c20a63f23 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Mon, 4 Mar 2019 15:42:52 +0000
+Subject: [PATCH] brcmfmac: fix NULL pointer derefence during USB disconnect
+
+In case USB disconnect happens at the moment transmitting workqueue is in
+progress the underlying interface may be gone causing a NULL pointer
+dereference. Add synchronization of the workqueue destruction with the
+detach implementation in core so that the transmitting workqueue is stopped
+during detach before the interfaces are removed.
+
+Fix following Oops:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+pgd = 9e6a802d
+[00000008] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle
+xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
+iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether
+usb_serial_simple usbserial cdc_acm brcmfmac brcmutil smsc95xx usbnet
+ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base
+libcomposite configfs udc_core
+CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 4.19.23-00076-g03740aa-dirty #102
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Workqueue: brcmf_fws_wq brcmf_fws_dequeue_worker [brcmfmac]
+PC is at brcmf_txfinalize+0x34/0x90 [brcmfmac]
+LR is at brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac]
+pc : [<7f0dee64>]    lr : [<7f0e4140>]    psr: 60010093
+sp : ee8abef0  ip : 00000000  fp : edf38000
+r10: ffffffed  r9 : edf38970  r8 : edf38004
+r7 : edf3e970  r6 : 00000000  r5 : ede69000  r4 : 00000000
+r3 : 00000a97  r2 : 00000000  r1 : 0000888e  r0 : ede69000
+Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
+Control: 10c5387d  Table: 7d03c04a  DAC: 00000051
+Process kworker/u8:0 (pid: 7, stack limit = 0x24ec3e04)
+Stack: (0xee8abef0 to 0xee8ac000)
+bee0:                                     ede69000 00000000 ed56c3e0 7f0e4140
+bf00: 00000001 00000000 edf38004 edf3e99c ed56c3e0 80d03d00 edfea43a edf3e970
+bf20: ee809880 ee804200 ee971100 00000000 edf3e974 00000000 ee804200 80135a70
+bf40: 80d03d00 ee804218 ee809880 ee809894 ee804200 80d03d00 ee804218 ee8aa000
+bf60: 00000088 80135d5c 00000000 ee829f00 ee829dc0 00000000 ee809880 80135d30
+bf80: ee829f1c ee873eac 00000000 8013b1a0 ee829dc0 8013b07c 00000000 00000000
+bfa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000
+bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
+[<7f0dee64>] (brcmf_txfinalize [brcmfmac]) from [<7f0e4140>] (brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac])
+[<7f0e4140>] (brcmf_fws_dequeue_worker [brcmfmac]) from [<80135a70>] (process_one_work+0x138/0x3f8)
+[<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554)
+[<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154)
+[<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c)
+Exception stack(0xee8abfb0 to 0xee8abff8)
+bfa0:                                     00000000 00000000 00000000 00000000
+bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
+Code: e1530001 0a000007 e3560000 e1a00005 (05942008)
+---[ end trace 079239dd31c86e90 ]---
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 +++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  |  6 ++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  4 +++-
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++++++++++----
+ .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 ++-
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.h |  3 ++-
+ 7 files changed, 40 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -490,11 +490,18 @@ fail:
+ 	return -ENOMEM;
+ }
+ 
+-void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
++void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
++{
++	struct brcmf_bcdc *bcdc = drvr->proto->pd;
++
++	brcmf_fws_detach_pre_delif(bcdc->fws);
++}
++
++void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc = drvr->proto->pd;
+ 
+ 	drvr->proto->pd = NULL;
+-	brcmf_fws_detach(bcdc->fws);
++	brcmf_fws_detach_post_delif(bcdc->fws);
+ 	kfree(bcdc);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -18,14 +18,16 @@
+ 
+ #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
+ void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
+ 				 bool success);
+ struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+-static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
++static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
++static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
+ #endif
+ 
+ #endif /* BRCMFMAC_BCDC_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1340,6 +1340,8 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+ 
++	brcmf_proto_detach_pre_delif(drvr);
++
+ 	/* make sure primary interface removed last */
+ 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
+ 		brcmf_remove_interface(drvr->iflist[i], false);
+@@ -1349,7 +1351,7 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
+-	brcmf_proto_detach(drvr);
++	brcmf_proto_detach_post_delif(drvr);
+ 
+ 	bus_if->drvr = NULL;
+ 	wiphy_free(drvr->wiphy);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2416,17 +2416,25 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 	return fws;
+ 
+ fail:
+-	brcmf_fws_detach(fws);
++	brcmf_fws_detach_pre_delif(fws);
++	brcmf_fws_detach_post_delif(fws);
+ 	return ERR_PTR(rc);
+ }
+ 
+-void brcmf_fws_detach(struct brcmf_fws_info *fws)
++void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
+ {
+ 	if (!fws)
+ 		return;
+-
+-	if (fws->fws_wq)
++	if (fws->fws_wq) {
+ 		destroy_workqueue(fws->fws_wq);
++		fws->fws_wq = NULL;
++	}
++}
++
++void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
++{
++	if (!fws)
++		return;
+ 
+ 	/* cleanup */
+ 	brcmf_fws_lock(fws);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -19,7 +19,8 @@
+ #define FWSIGNAL_H_
+ 
+ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
+-void brcmf_fws_detach(struct brcmf_fws_info *fws);
++void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
++void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
+ void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -67,16 +67,22 @@ fail:
+ 	return -ENOMEM;
+ }
+ 
+-void brcmf_proto_detach(struct brcmf_pub *drvr)
++void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
+ {
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (drvr->proto) {
+ 		if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
+-			brcmf_proto_bcdc_detach(drvr);
++			brcmf_proto_bcdc_detach_post_delif(drvr);
+ 		else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
+ 			brcmf_proto_msgbuf_detach(drvr);
+ 		kfree(drvr->proto);
+ 		drvr->proto = NULL;
+ 	}
+ }
++
++void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
++{
++	if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
++		brcmf_proto_bcdc_detach_pre_delif(drvr);
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -54,7 +54,8 @@ struct brcmf_proto {
+ 
+ 
+ int brcmf_proto_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_detach(struct brcmf_pub *drvr);
++void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
++void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
+ 
+ static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
+ 				      struct sk_buff *skb,
diff --git a/package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch b/package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
new file mode 100644
index 0000000000..a6d5c34007
--- /dev/null
+++ b/package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
@@ -0,0 +1,84 @@
+From db3b9e2e1d58080d0754bdf9293dabf8c6491b67 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Fri, 8 Mar 2019 15:25:04 +0000
+Subject: [PATCH] brcmfmac: fix race during disconnect when USB completion is
+ in progress
+
+It was observed that rarely during USB disconnect happening shortly after
+connect (before full initialization completes) usb_hub_wq would wait
+forever for the dev_init_lock to be unlocked. dev_init_lock would remain
+locked though because of infinite wait during usb_kill_urb:
+
+[ 2730.656472] kworker/0:2     D    0   260      2 0x00000000
+[ 2730.660700] Workqueue: events request_firmware_work_func
+[ 2730.664807] [<809dca20>] (__schedule) from [<809dd164>] (schedule+0x4c/0xac)
+[ 2730.670587] [<809dd164>] (schedule) from [<8069af44>] (usb_kill_urb+0xdc/0x114)
+[ 2730.676815] [<8069af44>] (usb_kill_urb) from [<7f258b50>] (brcmf_usb_free_q+0x34/0xa8 [brcmfmac])
+[ 2730.684833] [<7f258b50>] (brcmf_usb_free_q [brcmfmac]) from [<7f2517d4>] (brcmf_detach+0xa0/0xb8 [brcmfmac])
+[ 2730.693557] [<7f2517d4>] (brcmf_detach [brcmfmac]) from [<7f251a34>] (brcmf_attach+0xac/0x3d8 [brcmfmac])
+[ 2730.702094] [<7f251a34>] (brcmf_attach [brcmfmac]) from [<7f2587ac>] (brcmf_usb_probe_phase2+0x468/0x4a0 [brcmfmac])
+[ 2730.711601] [<7f2587ac>] (brcmf_usb_probe_phase2 [brcmfmac]) from [<7f252888>] (brcmf_fw_request_done+0x194/0x220 [brcmfmac])
+[ 2730.721795] [<7f252888>] (brcmf_fw_request_done [brcmfmac]) from [<805748e4>] (request_firmware_work_func+0x4c/0x88)
+[ 2730.731125] [<805748e4>] (request_firmware_work_func) from [<80141474>] (process_one_work+0x228/0x808)
+[ 2730.739223] [<80141474>] (process_one_work) from [<80141a80>] (worker_thread+0x2c/0x564)
+[ 2730.746105] [<80141a80>] (worker_thread) from [<80147bcc>] (kthread+0x13c/0x16c)
+[ 2730.752227] [<80147bcc>] (kthread) from [<801010b4>] (ret_from_fork+0x14/0x20)
+
+[ 2733.099695] kworker/0:3     D    0  1065      2 0x00000000
+[ 2733.103926] Workqueue: usb_hub_wq hub_event
+[ 2733.106914] [<809dca20>] (__schedule) from [<809dd164>] (schedule+0x4c/0xac)
+[ 2733.112693] [<809dd164>] (schedule) from [<809e2a8c>] (schedule_timeout+0x214/0x3e4)
+[ 2733.119621] [<809e2a8c>] (schedule_timeout) from [<809dde2c>] (wait_for_common+0xc4/0x1c0)
+[ 2733.126810] [<809dde2c>] (wait_for_common) from [<7f258d00>] (brcmf_usb_disconnect+0x1c/0x4c [brcmfmac])
+[ 2733.135206] [<7f258d00>] (brcmf_usb_disconnect [brcmfmac]) from [<8069e0c8>] (usb_unbind_interface+0x5c/0x1e4)
+[ 2733.143943] [<8069e0c8>] (usb_unbind_interface) from [<8056d3e8>] (device_release_driver_internal+0x164/0x1fc)
+[ 2733.152769] [<8056d3e8>] (device_release_driver_internal) from [<8056c078>] (bus_remove_device+0xd0/0xfc)
+[ 2733.161138] [<8056c078>] (bus_remove_device) from [<8056977c>] (device_del+0x11c/0x310)
+[ 2733.167939] [<8056977c>] (device_del) from [<8069cba8>] (usb_disable_device+0xa0/0x1cc)
+[ 2733.174743] [<8069cba8>] (usb_disable_device) from [<8069507c>] (usb_disconnect+0x74/0x1dc)
+[ 2733.181823] [<8069507c>] (usb_disconnect) from [<80695e88>] (hub_event+0x478/0xf88)
+[ 2733.188278] [<80695e88>] (hub_event) from [<80141474>] (process_one_work+0x228/0x808)
+[ 2733.194905] [<80141474>] (process_one_work) from [<80141a80>] (worker_thread+0x2c/0x564)
+[ 2733.201724] [<80141a80>] (worker_thread) from [<80147bcc>] (kthread+0x13c/0x16c)
+[ 2733.207913] [<80147bcc>] (kthread) from [<801010b4>] (ret_from_fork+0x14/0x20)
+
+It was traced down to a case where usb_kill_urb would be called on an URB
+structure containing more or less random data, including large number in
+its use_count. During the debugging it appeared that in brcmf_usb_free_q()
+the traversal over URBs' lists is not synchronized with operations on those
+lists in brcmf_usb_rx_complete() leading to handling
+brcmf_usbdev_info structure (holding lists' head) as lists' element and in
+result causing above problem.
+
+Fix it by walking through all URBs during brcmf_cancel_all_urbs using the
+arrays of requests instead of linked lists.
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -684,12 +684,18 @@ static int brcmf_usb_up(struct device *d
+ 
+ static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
+ {
++	int i;
++
+ 	if (devinfo->ctl_urb)
+ 		usb_kill_urb(devinfo->ctl_urb);
+ 	if (devinfo->bulk_urb)
+ 		usb_kill_urb(devinfo->bulk_urb);
+-	brcmf_usb_free_q(&devinfo->tx_postq, true);
+-	brcmf_usb_free_q(&devinfo->rx_postq, true);
++	if (devinfo->tx_reqs)
++		for (i = 0; i < devinfo->bus_pub.ntxq; i++)
++			usb_kill_urb(devinfo->tx_reqs[i].urb);
++	if (devinfo->rx_reqs)
++		for (i = 0; i < devinfo->bus_pub.nrxq; i++)
++			usb_kill_urb(devinfo->rx_reqs[i].urb);
+ }
+ 
+ static void brcmf_usb_down(struct device *dev)
diff --git a/package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch b/package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
new file mode 100644
index 0000000000..80ad31ece6
--- /dev/null
+++ b/package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
@@ -0,0 +1,54 @@
+From 2b78e5f5223666d403d4fdb30af4ad65c8da3cdb Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Fri, 8 Mar 2019 15:25:06 +0000
+Subject: [PATCH] brcmfmac: remove pending parameter from brcmf_usb_free_q
+
+brcmf_usb_free_q is no longer called with pending=true thus this boolean
+parameter is no longer needed.
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/usb.c    | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -445,9 +445,10 @@ fail:
+ 
+ }
+ 
+-static void brcmf_usb_free_q(struct list_head *q, bool pending)
++static void brcmf_usb_free_q(struct list_head *q)
+ {
+ 	struct brcmf_usbreq *req, *next;
++
+ 	int i = 0;
+ 	list_for_each_entry_safe(req, next, q, list) {
+ 		if (!req->urb) {
+@@ -455,12 +456,8 @@ static void brcmf_usb_free_q(struct list
+ 			break;
+ 		}
+ 		i++;
+-		if (pending) {
+-			usb_kill_urb(req->urb);
+-		} else {
+-			usb_free_urb(req->urb);
+-			list_del_init(&req->list);
+-		}
++		usb_free_urb(req->urb);
++		list_del_init(&req->list);
+ 	}
+ }
+ 
+@@ -1031,8 +1028,8 @@ static void brcmf_usb_detach(struct brcm
+ 	brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
+ 
+ 	/* free the URBS */
+-	brcmf_usb_free_q(&devinfo->rx_freeq, false);
+-	brcmf_usb_free_q(&devinfo->tx_freeq, false);
++	brcmf_usb_free_q(&devinfo->rx_freeq);
++	brcmf_usb_free_q(&devinfo->tx_freeq);
+ 
+ 	usb_free_urb(devinfo->ctl_urb);
+ 	usb_free_urb(devinfo->bulk_urb);
diff --git a/package/kernel/mac80211/patches/452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch b/package/kernel/mac80211/patches/452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch
new file mode 100644
index 0000000000..4c8d073914
--- /dev/null
+++ b/package/kernel/mac80211/patches/452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch
@@ -0,0 +1,29 @@
+From 504f06725d015954a0fcafdf1d90a6795ca8f769 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Fri, 8 Mar 2019 15:25:09 +0000
+Subject: [PATCH] brcmfmac: remove unused variable i from brcmf_usb_free_q
+
+Variable i is not used so remove it.
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -449,13 +449,11 @@ static void brcmf_usb_free_q(struct list
+ {
+ 	struct brcmf_usbreq *req, *next;
+ 
+-	int i = 0;
+ 	list_for_each_entry_safe(req, next, q, list) {
+ 		if (!req->urb) {
+ 			brcmf_err("bad req\n");
+ 			break;
+ 		}
+-		i++;
+ 		usb_free_urb(req->urb);
+ 		list_del_init(&req->list);
+ 	}
diff --git a/package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch b/package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
new file mode 100644
index 0000000000..5e34e1aca3
--- /dev/null
+++ b/package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
@@ -0,0 +1,123 @@
+From 24d413a31afaee9bbbf79226052c386b01780ce2 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Wed, 13 Mar 2019 09:52:01 +0000
+Subject: [PATCH] brcmfmac: fix Oops when bringing up interface during USB
+ disconnect
+
+Fix a race which leads to an Oops with NULL pointer dereference.  The
+dereference is in brcmf_config_dongle() when cfg_to_ndev() attempts to get
+net_device structure of interface with index 0 via if2bss mapping. This
+shouldn't fail because of check for bus being ready in brcmf_netdev_open(),
+but it's not synchronised with USB disconnect and there is a race: after
+the check the bus can be marked down and the mapping for interface 0 may be
+gone.
+
+Solve this by modifying disconnect handling so that the removal of mapping
+of ifidx to brcmf_if structure happens after netdev removal (which is
+synchronous with brcmf_netdev_open() thanks to rtln being locked in
+devinet_ioctl()). This assures brcmf_netdev_open() returns before the
+mapping is removed during disconnect.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+pgd = bcae2612
+[00000008] *pgd=8be73831
+Internal error: Oops: 17 [#1] PREEMPT SMP ARM
+Modules linked in: brcmfmac brcmutil nf_log_ipv4 nf_log_common xt_LOG xt_limit
+iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6
+nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis
+u_ether usb_serial_simple usbserial cdc_acm smsc95xx usbnet ci_hdrc_imx ci_hdrc
+usbmisc_imx ulpi 8250_exar 8250_pci 8250 8250_base libcomposite configfs
+udc_core [last unloaded: brcmutil]
+CPU: 2 PID: 24478 Comm: ifconfig Not tainted 4.19.23-00078-ga62866d-dirty #115
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+PC is at brcmf_cfg80211_up+0x94/0x29c [brcmfmac]
+LR is at brcmf_cfg80211_up+0x8c/0x29c [brcmfmac]
+pc : [<7f26a91c>]    lr : [<7f26a914>]    psr: a0070013
+sp : eca99d28  ip : 00000000  fp : ee9c6c00
+r10: 00000036  r9 : 00000000  r8 : ece4002c
+r7 : edb5b800  r6 : 00000000  r5 : 80f08448  r4 : edb5b968
+r3 : ffffffff  r2 : 00000000  r1 : 00000002  r0 : 00000000
+Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
+Control: 10c5387d  Table: 7ca0c04a  DAC: 00000051
+Process ifconfig (pid: 24478, stack limit = 0xd9e85a0e)
+Stack: (0xeca99d28 to 0xeca9a000)
+9d20:                   00000000 80f873b0 0000000d 80f08448 eca99d68 50d45f32
+9d40: 7f27de94 ece40000 80f08448 80f08448 7f27de94 ece4002c 00000000 00000036
+9d60: ee9c6c00 7f27262c 00001002 50d45f32 ece40000 00000000 80f08448 80772008
+9d80: 00000001 00001043 00001002 ece40000 00000000 50d45f32 ece40000 00000001
+9da0: 80f08448 00001043 00001002 807723d0 00000000 50d45f32 80f08448 eca99e58
+9dc0: 80f87113 50d45f32 80f08448 ece40000 ece40138 00001002 80f08448 00000000
+9de0: 00000000 80772434 edbd5380 eca99e58 edbd5380 80f08448 ee9c6c0c 80805f70
+9e00: 00000000 ede08e00 00008914 ece40000 00000014 ee9c6c0c 600c0013 00001043
+9e20: 0208a8c0 ffffffff 00000000 50d45f32 eca98000 80f08448 7ee9fc38 00008914
+9e40: 80f68e40 00000051 eca98000 00000036 00000003 80808b9c 6e616c77 00000030
+9e60: 00000000 00000000 00001043 0208a8c0 ffffffff 00000000 80f08448 00000000
+9e80: 00000000 816d8b20 600c0013 00000001 ede09320 801763d4 00000000 50d45f32
+9ea0: eca98000 80f08448 7ee9fc38 50d45f32 00008914 80f08448 7ee9fc38 80f68e40
+9ec0: ed531540 8074721c 00000800 00000001 00000000 6e616c77 00000030 00000000
+9ee0: 00000000 00001002 0208a8c0 ffffffff 00000000 50d45f32 80f08448 7ee9fc38
+9f00: ed531560 ec8fc900 80285a6c 80285138 edb910c0 00000000 ecd91008 ede08e00
+9f20: 80f08448 00000000 00000000 816d8b20 600c0013 00000001 ede09320 801763d4
+9f40: 00000000 50d45f32 00021000 edb91118 edb910c0 80f08448 01b29000 edb91118
+9f60: eca99f7c 50d45f32 00021000 ec8fc900 00000003 ec8fc900 00008914 7ee9fc38
+9f80: eca98000 00000036 00000003 80285a6c 00086364 7ee9fe1c 000000c3 00000036
+9fa0: 801011c4 80101000 00086364 7ee9fe1c 00000003 00008914 7ee9fc38 00086364
+9fc0: 00086364 7ee9fe1c 000000c3 00000036 0008630c 7ee9fe1c 7ee9fc38 00000003
+9fe0: 000a42b8 7ee9fbd4 00019914 76e09acc 600c0010 00000003 00000000 00000000
+[<7f26a91c>] (brcmf_cfg80211_up [brcmfmac]) from [<7f27262c>] (brcmf_netdev_open+0x74/0xe8 [brcmfmac])
+[<7f27262c>] (brcmf_netdev_open [brcmfmac]) from [<80772008>] (__dev_open+0xcc/0x150)
+[<80772008>] (__dev_open) from [<807723d0>] (__dev_change_flags+0x168/0x1b4)
+[<807723d0>] (__dev_change_flags) from [<80772434>] (dev_change_flags+0x18/0x48)
+[<80772434>] (dev_change_flags) from [<80805f70>] (devinet_ioctl+0x67c/0x79c)
+[<80805f70>] (devinet_ioctl) from [<80808b9c>] (inet_ioctl+0x210/0x3d4)
+[<80808b9c>] (inet_ioctl) from [<8074721c>] (sock_ioctl+0x350/0x524)
+[<8074721c>] (sock_ioctl) from [<80285138>] (do_vfs_ioctl+0xb0/0x9b0)
+[<80285138>] (do_vfs_ioctl) from [<80285a6c>] (ksys_ioctl+0x34/0x5c)
+[<80285a6c>] (ksys_ioctl) from [<80101000>] (ret_fast_syscall+0x0/0x28)
+Exception stack(0xeca99fa8 to 0xeca99ff0)
+9fa0:                   00086364 7ee9fe1c 00000003 00008914 7ee9fc38 00086364
+9fc0: 00086364 7ee9fe1c 000000c3 00000036 0008630c 7ee9fe1c 7ee9fc38 00000003
+9fe0: 000a42b8 7ee9fbd4 00019914 76e09acc
+Code: e5970328 eb002021 e1a02006 e3a01002 (e5909008)
+---[ end trace 5cbac2333f3ac5df ]---
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -861,17 +861,17 @@ static void brcmf_del_if(struct brcmf_pu
+ 			 bool rtnl_locked)
+ {
+ 	struct brcmf_if *ifp;
++	int ifidx;
+ 
+ 	ifp = drvr->iflist[bsscfgidx];
+-	drvr->iflist[bsscfgidx] = NULL;
+ 	if (!ifp) {
+ 		bphy_err(drvr, "Null interface, bsscfgidx=%d\n", bsscfgidx);
+ 		return;
+ 	}
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
+ 		  ifp->ifidx);
+-	if (drvr->if2bss[ifp->ifidx] == bsscfgidx)
+-		drvr->if2bss[ifp->ifidx] = BRCMF_BSSIDX_INVALID;
++	ifidx = ifp->ifidx;
++
+ 	if (ifp->ndev) {
+ 		if (bsscfgidx == 0) {
+ 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
+@@ -899,6 +899,10 @@ static void brcmf_del_if(struct brcmf_pu
+ 		brcmf_p2p_ifp_removed(ifp, rtnl_locked);
+ 		kfree(ifp);
+ 	}
++
++	drvr->iflist[bsscfgidx] = NULL;
++	if (drvr->if2bss[ifidx] == bsscfgidx)
++		drvr->if2bss[ifidx] = BRCMF_BSSIDX_INVALID;
+ }
+ 
+ void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)
diff --git a/package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch b/package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
new file mode 100644
index 0000000000..2f72b72cc2
--- /dev/null
+++ b/package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
@@ -0,0 +1,35 @@
+From 46953f97224d56a12ccbe9c6acaa84ca0dab2780 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Fri, 15 Mar 2019 12:04:32 -0500
+Subject: [PATCH] brcmfmac: fix missing checks for kmemdup
+
+In case kmemdup fails, the fix sets conn_info->req_ie_len and
+conn_info->resp_ie_len to zero to avoid buffer overflows.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5455,6 +5455,8 @@ static s32 brcmf_get_assoc_ies(struct br
+ 		conn_info->req_ie =
+ 		    kmemdup(cfg->extra_buf, conn_info->req_ie_len,
+ 			    GFP_KERNEL);
++		if (!conn_info->req_ie)
++			conn_info->req_ie_len = 0;
+ 	} else {
+ 		conn_info->req_ie_len = 0;
+ 		conn_info->req_ie = NULL;
+@@ -5471,6 +5473,8 @@ static s32 brcmf_get_assoc_ies(struct br
+ 		conn_info->resp_ie =
+ 		    kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
+ 			    GFP_KERNEL);
++		if (!conn_info->resp_ie)
++			conn_info->resp_ie_len = 0;
+ 	} else {
+ 		conn_info->resp_ie_len = 0;
+ 		conn_info->resp_ie = NULL;
diff --git a/package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch b/package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
new file mode 100644
index 0000000000..f7ca327517
--- /dev/null
+++ b/package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
@@ -0,0 +1,35 @@
+From e3062e05e1cfe378bb9b3fa0bef46711372bcf13 Mon Sep 17 00:00:00 2001
+From: Ondrej Jirman <megous@megous.com>
+Date: Sat, 6 Apr 2019 01:45:13 +0200
+Subject: [PATCH] brcmfmac: Loading the correct firmware for brcm43456
+
+SDIO based brcm43456 is currently misdetected as brcm43455 and the wrong
+firmware name is used. Correct the detection and load the correct
+firmware file. Chiprev for brcm43456 is "9".
+
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -615,6 +615,7 @@ BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-s
+ /* Note the names are not postfixed with a1 for backward compatibility */
+ BRCMF_FW_DEF(43430A1, "brcmfmac43430-sdio");
+ BRCMF_FW_DEF(43455, "brcmfmac43455-sdio");
++BRCMF_FW_DEF(43456, "brcmfmac43456-sdio");
+ BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
+ BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
+ BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
+@@ -634,7 +635,8 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
+-	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
++	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0x00000200, 43456),
++	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFDC0, 43455),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+ 	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
diff --git a/package/kernel/mac80211/patches/456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch b/package/kernel/mac80211/patches/456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
new file mode 100644
index 0000000000..a9a9d74c10
--- /dev/null
+++ b/package/kernel/mac80211/patches/456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
@@ -0,0 +1,41 @@
+From a927e8d8ab57e696800e20cf09a72b7dfe3bbebb Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 9 Apr 2019 12:43:33 +0100
+Subject: [PATCH] brcmfmac: fix leak of mypkt on error return path
+
+Currently if the call to brcmf_sdiod_set_backplane_window fails then
+error return path leaks mypkt. Fix this by returning by a new
+error path labelled 'out' that calls brcmu_pkt_buf_free_skb to free
+mypkt.  Also remove redundant check on err before calling
+brcmf_sdiod_skbuff_write.
+
+Addresses-Coverity: ("Resource Leak")
+Fixes: a7c3aa1509e2 ("brcmfmac: Remove brcmf_sdiod_addrprep()")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 
+ 	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+-		return err;
++		goto out;
+ 
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	if (!err)
+-		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
+-					       mypkt);
+-
++	err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt);
++out:
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+ 	return err;
diff --git a/package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch b/package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
new file mode 100644
index 0000000000..7865606f94
--- /dev/null
+++ b/package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
@@ -0,0 +1,70 @@
+From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 22 Apr 2019 22:41:23 +0200
+Subject: [PATCH] brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11
+ mini PCs
+
+The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
+and product_name DMI strings, without this patch brcmfmac will try to load:
+"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
+is way too generic.
+
+The DMI strings on which we are matching are somewhat generic too, but
+"To be filled by O.E.M." is less common then "Default string" and the
+system-sku and bios-version strings are pretty unique. Beside the DMI
+strings we also check the wifi-module chip-id and revision. I'm confident
+that the combination of all this is unique.
+
+Both the T8 and T11 use the same wifi-module, this commit adds DMI
+quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/dmi.c         | 26 +++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -31,6 +31,10 @@ struct brcmf_dmi_data {
+ 
+ /* NOTE: Please keep all entries sorted alphabetically */
+ 
++static const struct brcmf_dmi_data acepc_t8_data = {
++	BRCM_CC_4345_CHIP_ID, 6, "acepc-t8"
++};
++
+ static const struct brcmf_dmi_data gpd_win_pocket_data = {
+ 	BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
+ };
+@@ -45,6 +49,28 @@ static const struct brcmf_dmi_data meego
+ 
+ static const struct dmi_system_id dmi_platform_data[] = {
+ 	{
++		/* ACEPC T8 Cherry Trail Z8350 mini PC */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
++			/* also match on somewhat unique bios-version */
++			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++		},
++		.driver_data = (void *)&acepc_t8_data,
++	},
++	{
++		/* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
++			/* also match on somewhat unique bios-version */
++			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++		},
++		.driver_data = (void *)&acepc_t8_data,
++	},
++	{
+ 		/* Match for the GPDwin which unfortunately uses somewhat
+ 		 * generic dmi strings, which is why we test for 4 strings.
+ 		 * Comparing against 23 other byt/cht boards, board_vendor
diff --git a/package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch b/package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
new file mode 100644
index 0000000000..1fcf8c70c7
--- /dev/null
+++ b/package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
@@ -0,0 +1,39 @@
+From 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Fri, 26 Apr 2019 03:12:32 +0000
+Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware
+ device
+
+For PCIE wireless device with core revision less than 14, device may miss
+PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
+mail box interrupt twice as a hardware workaround.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -675,6 +675,7 @@ static int
+ brcmf_pcie_send_mb_data(struct brcmf_pciedev_info *devinfo, u32 htod_mb_data)
+ {
+ 	struct brcmf_pcie_shared_info *shared;
++	struct brcmf_core *core;
+ 	u32 addr;
+ 	u32 cur_htod_mb_data;
+ 	u32 i;
+@@ -698,7 +699,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci
+ 
+ 	brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data);
+ 	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+-	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
++
++	/* Send mailbox interrupt twice as a hardware workaround */
++	core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
++	if (core->rev <= 13)
++		pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+ 
+ 	return 0;
+ }
diff --git a/package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch b/package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
new file mode 100644
index 0000000000..b4d56c34bc
--- /dev/null
+++ b/package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
@@ -0,0 +1,50 @@
+From e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:52:18 +0300
+Subject: [PATCH] brcm80211: potential NULL dereference in
+ brcmf_cfg80211_vndr_cmds_dcmd_handler()
+
+If "ret_len" is negative then it could lead to a NULL dereference.
+
+The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative
+then we don't allocate the "dcmd_buf" buffer.  Then we pass "ret_len" to
+brcmf_fil_cmd_data_set() where it is cast to a very high u32 value.
+Most of the functions in that call tree check whether the buffer we pass
+is NULL but there are at least a couple places which don't such as
+brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd().  We memcpy() to and
+from the buffer so it would result in a NULL dereference.
+
+The fix is to change the types so that "ret_len" can't be negative.  (If
+we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an
+issue).
+
+Fixes: 1bacb0487d0e ("brcmfmac: replace cfg80211 testmode with vendor command")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+ 	struct brcmf_if *ifp;
+ 	const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
+ 	struct sk_buff *reply;
+-	int ret, payload, ret_len;
++	unsigned int payload, ret_len;
+ 	void *dcmd_buf = NULL, *wr_pointer;
+ 	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
++	int ret;
+ 
+ 	if (len < sizeof(*cmdhdr)) {
+ 		brcmf_err("vendor command too short: %d\n", len);
+@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+ 			brcmf_err("oversize return buffer %d\n", ret_len);
+ 			ret_len = BRCMF_DCMD_MAXLEN;
+ 		}
+-		payload = max(ret_len, len) + 1;
++		payload = max_t(unsigned int, ret_len, len) + 1;
+ 		dcmd_buf = vzalloc(payload);
+ 		if (NULL == dcmd_buf)
+ 			return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch b/package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
new file mode 100644
index 0000000000..6702dd57b6
--- /dev/null
+++ b/package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
@@ -0,0 +1,49 @@
+From 2d91c8ad068a5cad4d9e7ece8dc811a697c7176a Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Fri, 26 Apr 2019 03:41:46 +0000
+Subject: [PATCH] brcmfmac: set txflow request id from 1 to pktids array size
+
+Some PCIE firmwares drop txstatus if pktid is 0 and make packet held in
+host side and never be released. If that packet type is 802.1x, the
+pend_8021x_cnt value will be always greater than 0 and show "Timed out
+waiting for no pending 802.1x packets" error message when sending key to
+dongle every time.
+
+To be compatible with all firmwares, host should set txflow request id
+from 1 instead of from 0.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -375,7 +375,7 @@ brcmf_msgbuf_get_pktid(struct device *de
+ 	struct brcmf_msgbuf_pktid *pktid;
+ 	struct sk_buff *skb;
+ 
+-	if (idx >= pktids->array_size) {
++	if (idx < 0 || idx >= pktids->array_size) {
+ 		brcmf_err("Invalid packet id %d (max %d)\n", idx,
+ 			  pktids->array_size);
+ 		return NULL;
+@@ -747,7 +747,7 @@ static void brcmf_msgbuf_txflow(struct b
+ 		tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
+ 
+ 		tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
+-		tx_msghdr->msg.request_id = cpu_to_le32(pktid);
++		tx_msghdr->msg.request_id = cpu_to_le32(pktid + 1);
+ 		tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
+ 		tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
+ 		tx_msghdr->flags |= (skb->priority & 0x07) <<
+@@ -884,7 +884,7 @@ brcmf_msgbuf_process_txstatus(struct brc
+ 	u16 flowid;
+ 
+ 	tx_status = (struct msgbuf_tx_status *)buf;
+-	idx = le32_to_cpu(tx_status->msg.request_id);
++	idx = le32_to_cpu(tx_status->msg.request_id) - 1;
+ 	flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
+ 	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+ 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
diff --git a/package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch b/package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
new file mode 100644
index 0000000000..ceb85055d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
@@ -0,0 +1,90 @@
+From 47dd82e3d25e85a7c7c4e4b0eac9d297d1e5e2d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 28 Apr 2019 23:38:26 +0200
+Subject: [PATCH] brcmfmac: print firmware messages after a firmware crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Normally firmware messages are printed with debugging enabled only. It's
+a good idea as firmware may print a lot of messages that normal users
+don't need to care about.
+
+However, on firmware crash, it may be very helpful to log all recent
+messages. There is almost always a backtrace available as well as rought
+info on the latest actions/state.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 24 ++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -764,15 +764,22 @@ static void brcmf_pcie_bus_console_init(
+ 		  console->base_addr, console->buf_addr, console->bufsize);
+ }
+ 
+-
+-static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo)
++/**
++ * brcmf_pcie_bus_console_read - reads firmware messages
++ *
++ * @error: specifies if error has occurred (prints messages unconditionally)
++ */
++static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo,
++					bool error)
+ {
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	struct brcmf_pcie_console *console;
+ 	u32 addr;
+ 	u8 ch;
+ 	u32 newidx;
+ 
+-	if (!BRCMF_FWCON_ON())
++	if (!error && !BRCMF_FWCON_ON())
+ 		return;
+ 
+ 	console = &devinfo->shared.console;
+@@ -796,7 +803,10 @@ static void brcmf_pcie_bus_console_read(
+ 		}
+ 		if (ch == '\n') {
+ 			console->log_str[console->log_idx] = 0;
+-			pr_debug("CONSOLE: %s", console->log_str);
++			if (error)
++				brcmf_err(bus, "CONSOLE: %s", console->log_str);
++			else
++				pr_debug("CONSOLE: %s", console->log_str);
+ 			console->log_idx = 0;
+ 		}
+ 	}
+@@ -857,7 +867,7 @@ static irqreturn_t brcmf_pcie_isr_thread
+ 							&devinfo->pdev->dev);
+ 		}
+ 	}
+-	brcmf_pcie_bus_console_read(devinfo);
++	brcmf_pcie_bus_console_read(devinfo, false);
+ 	if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
+ 		brcmf_pcie_intr_enable(devinfo);
+ 	devinfo->in_irq = false;
+@@ -1426,6 +1436,8 @@ static int brcmf_pcie_reset(struct devic
+ 	struct brcmf_fw_request *fwreq;
+ 	int err;
+ 
++	brcmf_pcie_bus_console_read(devinfo, true);
++
+ 	brcmf_detach(dev);
+ 
+ 	brcmf_pcie_release_irq(devinfo);
+@@ -1818,7 +1830,7 @@ static void brcmf_pcie_setup(struct devi
+ 	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
+ 		return;
+ 
+-	brcmf_pcie_bus_console_read(devinfo);
++	brcmf_pcie_bus_console_read(devinfo, false);
+ 
+ fail:
+ 	device_release_driver(dev);
diff --git a/package/kernel/mac80211/patches/brcm/102-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch b/package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
similarity index 94%
rename from package/kernel/mac80211/patches/brcm/102-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
rename to package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
index d6ddd841cc..8731a99fd7 100644
--- a/package/kernel/mac80211/patches/brcm/102-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
+++ b/package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
@@ -15,7 +15,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -258,7 +258,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+@@ -269,7 +269,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
  
  	/* query for 'ver' to get version info from firmware */
  	memset(buf, 0, sizeof(buf));
diff --git a/package/kernel/mac80211/patches/brcm/103-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch b/package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
similarity index 93%
rename from package/kernel/mac80211/patches/brcm/103-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
rename to package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
index 0d38084e90..d7dce12d93 100644
--- a/package/kernel/mac80211/patches/brcm/103-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
+++ b/package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -276,8 +276,26 @@ static u16 chandef_to_chanspec(struct br
+@@ -287,8 +287,26 @@ static u16 chandef_to_chanspec(struct br
  		else
  			ch_inf.sb = BRCMU_CHAN_SB_UU;
  		break;
@@ -46,7 +46,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	case NL80211_CHAN_WIDTH_5:
  	case NL80211_CHAN_WIDTH_10:
  	default:
-@@ -296,6 +314,7 @@ static u16 chandef_to_chanspec(struct br
+@@ -307,6 +325,7 @@ static u16 chandef_to_chanspec(struct br
  	}
  	d11inf->encchspec(&ch_inf);
  
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch b/package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
similarity index 94%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
rename to package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
index 45a9a339fa..2b06acfbab 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
@@ -21,7 +21,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -479,18 +479,11 @@ fail:
+@@ -490,18 +490,11 @@ fail:
  	return -ENOMEM;
  }
  
@@ -44,7 +44,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  }
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
-@@ -7,16 +7,14 @@
+@@ -18,16 +18,14 @@
  
  #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
  int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
@@ -65,7 +65,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  #endif /* BRCMFMAC_BCDC_H */
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1335,8 +1335,6 @@ void brcmf_detach(struct device *dev)
+@@ -1344,8 +1344,6 @@ void brcmf_detach(struct device *dev)
  
  	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
  
@@ -74,7 +74,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	/* make sure primary interface removed last */
  	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
  		brcmf_remove_interface(drvr->iflist[i], false);
-@@ -1346,7 +1344,7 @@ void brcmf_detach(struct device *dev)
+@@ -1355,7 +1353,7 @@ void brcmf_detach(struct device *dev)
  
  	brcmf_bus_stop(drvr->bus_if);
  
@@ -85,7 +85,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	wiphy_free(drvr->wiphy);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2432,25 +2432,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
+@@ -2416,25 +2416,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
  	return fws;
  
  fail:
@@ -117,7 +117,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	brcmf_fws_lock(fws);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-@@ -7,8 +7,7 @@
+@@ -19,8 +19,7 @@
  #define FWSIGNAL_H_
  
  struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
@@ -129,7 +129,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-@@ -56,22 +56,16 @@ fail:
+@@ -67,22 +67,16 @@ fail:
  	return -ENOMEM;
  }
  
@@ -156,7 +156,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 -}
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -43,8 +43,7 @@ struct brcmf_proto {
+@@ -54,8 +54,7 @@ struct brcmf_proto {
  
  
  int brcmf_proto_attach(struct brcmf_pub *drvr);
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch b/package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
similarity index 97%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
rename to package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
index d40bf031b8..52657c3288 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
@@ -25,7 +25,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1328,25 +1328,26 @@ void brcmf_detach(struct device *dev)
+@@ -1337,25 +1337,26 @@ void brcmf_detach(struct device *dev)
  	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
  #endif
  
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch b/package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
similarity index 94%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
rename to package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
index 4c42b2b0c9..2b2f37b558 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -579,7 +579,8 @@ static int brcmf_netdev_stop(struct net_
+@@ -589,7 +589,8 @@ static int brcmf_netdev_stop(struct net_
  
  	brcmf_cfg80211_down(ndev);
  
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch b/package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
similarity index 95%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
rename to package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
index d796faa79f..1bb6c4b21d 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
@@ -19,7 +19,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -303,16 +303,7 @@ void brcmf_fweh_attach(struct brcmf_pub
+@@ -314,16 +314,7 @@ void brcmf_fweh_attach(struct brcmf_pub
  void brcmf_fweh_detach(struct brcmf_pub *drvr)
  {
  	struct brcmf_fweh_info *fweh = &drvr->fweh;
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch b/package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
similarity index 91%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
rename to package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
index 747cf58b7b..0a418433dd 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
@@ -19,7 +19,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1286,17 +1286,21 @@ static void brcmf_link_down(struct brcmf
+@@ -1297,17 +1297,21 @@ static void brcmf_link_down(struct brcmf
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
  	struct brcmf_pub *drvr = cfg->pub;
@@ -29,7 +29,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	brcmf_dbg(TRACE, "Enter\n");
  
  	if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
--		brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
+-		brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
 -		err = brcmf_fil_cmd_data_set(vif->ifp,
 -					     BRCMF_C_DISASSOC, NULL, 0);
 -		if (err) {
@@ -46,7 +46,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
  		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
  			cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
-@@ -1306,7 +1310,8 @@ static void brcmf_link_down(struct brcmf
+@@ -1317,7 +1321,8 @@ static void brcmf_link_down(struct brcmf
  	clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
  	brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
  	if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
@@ -56,7 +56,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
  	}
  	brcmf_dbg(TRACE, "Exit\n");
-@@ -5004,18 +5009,16 @@ static int brcmf_cfg80211_get_channel(st
+@@ -5006,18 +5011,16 @@ static int brcmf_cfg80211_get_channel(st
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct net_device *ndev = wdev->netdev;
  	struct brcmf_pub *drvr = cfg->pub;
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch b/package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
similarity index 95%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
rename to package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
index 040ab16a6c..c9bb1e82e9 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
@@ -17,7 +17,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1398,6 +1398,13 @@ void brcmf_msgbuf_delete_flowring(struct
+@@ -1408,6 +1408,13 @@ void brcmf_msgbuf_delete_flowring(struct
  	u8 ifidx;
  	int err;
  
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch b/package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
similarity index 95%
rename from package/kernel/mac80211/patches/brcm/104-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
rename to package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
index 444546aaf7..d9f129c273 100644
--- a/package/kernel/mac80211/patches/brcm/104-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
+++ b/package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -258,7 +258,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+@@ -269,7 +269,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
  
  	/* query for 'ver' to get version info from firmware */
  	memset(buf, 0, sizeof(buf));
diff --git a/package/kernel/mac80211/patches/brcm/105-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch b/package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
similarity index 96%
rename from package/kernel/mac80211/patches/brcm/105-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
rename to package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
index 60f6e49210..76ab29a6a0 100644
--- a/package/kernel/mac80211/patches/brcm/105-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
+++ b/package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
@@ -26,7 +26,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -794,7 +794,8 @@ static void brcmf_pcie_bus_console_read(
+@@ -804,7 +804,8 @@ static void brcmf_pcie_bus_console_read(
  		if (ch == '\n') {
  			console->log_str[console->log_idx] = 0;
  			if (error)
diff --git a/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
rename to package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
index 786a3ed3fb..b6dc45cd96 100644
--- a/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
+++ b/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1361,6 +1361,53 @@ void ath9k_deinit_debug(struct ath_softc
+@@ -1374,6 +1374,53 @@ void ath9k_deinit_debug(struct ath_softc
  	ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
  }
  
@@ -54,7 +54,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1380,6 +1427,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1393,6 +1440,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	ath9k_tx99_init_debug(sc);
  	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
  
diff --git a/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
similarity index 86%
rename from package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
rename to package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
index b9c784eb25..53225dbc36 100644
--- a/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1143,25 +1143,25 @@ static int __init ath9k_init(void)
+@@ -1088,23 +1088,23 @@ static int __init ath9k_init(void)
  {
  	int error;
  
@@ -21,8 +21,6 @@
 +		goto err_ahb_exit;
  	}
  
- 	dmi_check_system(ath9k_quirks);
- 
  	return 0;
  
 - err_pci_exit:
diff --git a/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
similarity index 87%
rename from package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
rename to package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
index 356939a354..d2a3b96570 100644
--- a/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -392,13 +392,8 @@ static void ath9k_hw_init_config(struct
+@@ -390,13 +390,8 @@ static void ath9k_hw_init_config(struct
  
  	ah->config.rx_intr_mitigation = true;
  
diff --git a/package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch b/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
rename to package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
diff --git a/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
rename to package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
index 80e33182f7..2ebb73d689 100644
--- a/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1408,6 +1408,52 @@ static const struct file_operations fops
+@@ -1421,6 +1421,52 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -53,7 +53,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1429,6 +1475,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1442,6 +1488,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
@@ -64,7 +64,7 @@
  	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -149,6 +149,7 @@ struct ath_common {
+@@ -151,6 +151,7 @@ struct ath_common {
  	int debug_mask;
  	enum ath_device_state state;
  	unsigned long op_flags;
diff --git a/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
similarity index 87%
rename from package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
rename to package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
index e536e60794..fdeaed05e8 100644
--- a/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -649,6 +649,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+@@ -647,6 +647,7 @@ int ath9k_hw_init(struct ath_hw *ah)
  
  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
  	switch (ah->hw_version.devid) {
@@ -20,7 +20,7 @@
  #define AR9160_DEVID_PCI	0x0027
 --- a/drivers/net/wireless/ath/ath9k/pci.c
 +++ b/drivers/net/wireless/ath/ath9k/pci.c
-@@ -774,6 +774,7 @@ static const struct pci_device_id ath_pc
+@@ -773,6 +773,7 @@ static const struct pci_device_id ath_pc
  	  .driver_data = ATH9K_PCI_BT_ANT_DIV },
  #endif
  
diff --git a/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
similarity index 79%
rename from package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
rename to package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index 7960039fd7..8a149dcb83 100644
--- a/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3322,6 +3322,7 @@ struct cfg80211_update_owe_info {
+@@ -2750,6 +2750,7 @@ struct cfg80211_pmk_conf {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -3634,6 +3635,7 @@ struct cfg80211_ops {
+@@ -3041,6 +3042,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -18,7 +18,7 @@
  				const u8 *addr);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1471,6 +1471,7 @@ enum ieee80211_smps_mode {
+@@ -1338,6 +1338,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1491,6 +1492,7 @@ enum ieee80211_smps_mode {
+@@ -1358,6 +1359,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,9 +36,9 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2341,6 +2341,9 @@ enum nl80211_commands {
-  *	should be picking up the lowest tx power, either tx power per-interface
-  *	or per-station.
+@@ -2153,6 +2153,9 @@ enum nl80211_commands {
+  * @NL80211_ATTR_PMKR0_NAME: PMK-R0 Name for offloaded FT.
+  * @NL80211_ATTR_PORT_AUTHORIZED: (reserved)
   *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2794,6 +2797,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_STA_TX_POWER_SETTING,
- 	NL80211_ATTR_STA_TX_POWER,
+@@ -2579,6 +2582,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_PMKR0_NAME,
+ 	NL80211_ATTR_PORT_AUTHORIZED,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2577,6 +2577,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2447,6 +2447,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3990,6 +4003,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3721,6 +3734,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1373,6 +1373,7 @@ struct ieee80211_local {
+@@ -1350,6 +1350,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -97,7 +97,7 @@
  
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -92,7 +92,7 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -93,7 +93,7 @@ static u32 ieee80211_hw_conf_chan(struct
  	struct ieee80211_sub_if_data *sdata;
  	struct cfg80211_chan_def chandef = {};
  	u32 changed = 0;
@@ -106,7 +106,7 @@
  	u32 offchannel_flag;
  
  	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
-@@ -149,6 +149,12 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -150,6 +150,12 @@ static u32 ieee80211_hw_conf_chan(struct
  	}
  	rcu_read_unlock();
  
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -638,6 +644,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -611,6 +617,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,15 +129,15 @@
  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -571,6 +571,7 @@ const struct nla_policy nl80211_policy[N
- 	[NL80211_ATTR_PEER_MEASUREMENTS] =
- 		NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
- 	[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
+@@ -420,6 +420,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
+ 	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
+ 	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -2866,6 +2867,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -2395,6 +2396,20 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			return result;
  	}
diff --git a/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
rename to package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
index 1f19483064..8ea2f79a20 100644
--- a/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -843,6 +843,9 @@ static inline int ath9k_dump_btcoex(stru
+@@ -850,6 +850,9 @@ static inline int ath9k_dump_btcoex(stru
  #ifdef CPTCFG_MAC80211_LEDS
  void ath_init_leds(struct ath_softc *sc);
  void ath_deinit_leds(struct ath_softc *sc);
@@ -10,9 +10,9 @@
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -979,6 +982,13 @@ void ath_ant_comb_scan(struct ath_softc
- 
- #define ATH9K_NUM_CHANCTX  2 /* supports 2 operating channels */
+@@ -991,6 +994,13 @@ void ath_ant_comb_scan(struct ath_softc
+ #define AIRTIME_USE_NEW_QUEUES	BIT(2)
+ #define AIRTIME_ACTIVE(flags) (!!(flags & (AIRTIME_USE_TX|AIRTIME_USE_RX)))
  
 +struct ath_led {
 +	struct list_head list;
@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1032,9 +1042,8 @@ struct ath_softc {
+@@ -1046,9 +1056,8 @@ struct ath_softc {
  	spinlock_t chan_lock;
  
  #ifdef CPTCFG_MAC80211_LEDS
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1055,7 +1055,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1000,7 +1000,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -192,7 +192,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1453,6 +1453,61 @@ static const struct file_operations fops
+@@ -1466,6 +1466,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -254,7 +254,7 @@
  
  int ath9k_init_debug(struct ath_hw *ah)
  {
-@@ -1477,6 +1532,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1490,6 +1545,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);
diff --git a/package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
rename to package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
diff --git a/package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch b/package/kernel/mac80211/patches/540-ath9k_reduce_ani_interval.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
rename to package/kernel/mac80211/patches/540-ath9k_reduce_ani_interval.patch
diff --git a/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
rename to package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
index e9ba4a9483..6dd03fd28a 100644
--- a/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1509,6 +1509,50 @@ static const struct file_operations fops
+@@ -1522,6 +1522,50 @@ static const struct file_operations fops
  #endif
  
  
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1536,6 +1580,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1549,6 +1593,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -75,7 +75,7 @@
  struct ath9k_hw_version {
  	u32 magic;
  	u16 devid;
-@@ -808,6 +814,8 @@ struct ath_hw {
+@@ -806,6 +812,8 @@ struct ath_hw {
  	u32 ah_flags;
  	s16 nf_override;
  
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1073,6 +1081,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
+@@ -1068,6 +1076,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1869,6 +1869,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1842,6 +1842,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2077,6 +2091,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2050,6 +2064,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
rename to package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
index 2e44b0095f..f9d3251c22 100644
--- a/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -819,7 +819,8 @@ static void ath9k_init_txpower_limits(st
+@@ -765,7 +765,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,8 +65,8 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -1015,6 +1016,18 @@ static void ath9k_set_hw_capab(struct at
- 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_AIRTIME_FAIRNESS);
+@@ -960,6 +961,18 @@ static void ath9k_set_hw_capab(struct at
+ 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  }
  
 +static void ath_get_initial_entropy(struct ath_softc *sc)
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1060,6 +1073,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -1005,6 +1018,8 @@ int ath9k_init_device(u16 devid, struct
  		ARRAY_SIZE(ath9k_tpt_blink));
  #endif
  
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1320,9 +1320,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1322,9 +1322,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1337,6 +1358,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1339,6 +1360,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
similarity index 84%
rename from package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
rename to package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
index ba8f1e5d61..680bb6d590 100644
--- a/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -248,6 +248,19 @@ void ath9k_hw_get_channel_centers(struct
+@@ -246,6 +246,19 @@ void ath9k_hw_get_channel_centers(struct
  		centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
  }
  
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1441,6 +1454,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1414,6 +1427,9 @@ static bool ath9k_hw_set_reset(struct at
  		udelay(50);
  	}
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1540,6 +1556,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1513,6 +1529,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1847,8 +1866,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1820,8 +1839,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2102,6 +2127,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2075,6 +2100,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
rename to package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
index 70db82a21e..22a2308a0b 100644
--- a/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -949,55 +949,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -951,55 +951,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
diff --git a/package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch b/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
rename to package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
diff --git a/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch b/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
rename to package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
index 78206d2860..eb9eb26a74 100644
--- a/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
+++ b/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  #include "common.h"
  #include "debug.h"
-@@ -989,6 +990,14 @@ struct ath_led {
+@@ -1001,6 +1002,14 @@ struct ath_led {
  	struct led_classdev cdev;
  };
  
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1044,6 +1053,9 @@ struct ath_softc {
+@@ -1058,6 +1067,9 @@ struct ath_softc {
  #ifdef CPTCFG_MAC80211_LEDS
  	const char *led_default_trigger;
  	struct list_head leds;
diff --git a/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch b/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
rename to package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
index 716e09f351..bd71b75e76 100644
--- a/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
+++ b/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -1055,6 +1055,7 @@ struct ath_softc {
+@@ -1069,6 +1069,7 @@ struct ath_softc {
  	struct list_head leds;
  #ifdef CONFIG_GPIOLIB
  	struct ath9k_gpio_chip *gpiochip;
diff --git a/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch b/package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
rename to package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
index 7d3a334c42..55f040f170 100644
--- a/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
+++ b/package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -627,6 +627,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -571,6 +571,12 @@ static int ath9k_of_init(struct ath_soft
  
  	ath_dbg(common, CONFIG, "parsing configuration from OF node\n");
  
diff --git a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
rename to package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
index c28054d58d..82b8109e06 100644
--- a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
+++ b/package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -365,7 +365,7 @@
  	 * semi-random values after suspend/resume.
 --- a/drivers/net/wireless/ath/ath9k/Makefile
 +++ b/drivers/net/wireless/ath/ath9k/Makefile
-@@ -17,6 +17,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
+@@ -16,6 +16,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
  ath9k-$(CPTCFG_ATH9K_TX99) += tx99.o
  ath9k-$(CPTCFG_ATH9K_WOW) += wow.o
  ath9k-$(CPTCFG_ATH9K_HWRNG) += rng.o
@@ -386,7 +386,7 @@
  #endif /* _LINUX_ATH9K_PLATFORM_H */
 --- a/local-symbols
 +++ b/local-symbols
-@@ -110,6 +110,7 @@ ATH9K_WOW=
+@@ -114,6 +114,7 @@ ATH9K_WOW=
  ATH9K_RFKILL=
  ATH9K_CHANNEL_CONTEXT=
  ATH9K_PCOEM=
@@ -396,7 +396,7 @@
  ATH9K_HWRNG=
 --- a/drivers/net/wireless/ath/ath9k/Kconfig
 +++ b/drivers/net/wireless/ath/ath9k/Kconfig
-@@ -60,6 +60,19 @@ config ATH9K_AHB
+@@ -59,6 +59,19 @@ config ATH9K_AHB
  	  Say Y, if you have a SoC with a compatible built-in
  	  wireless MAC. Say N if unsure.
  
diff --git a/package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch b/package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch
new file mode 100644
index 0000000000..831c534762
--- /dev/null
+++ b/package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch
@@ -0,0 +1,27 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 2 Nov 2018 21:49:55 +0100
+Subject: [PATCH] ath9k: dynack: use authentication messages for 'late' ack
+
+In order to properly support dynack in ad-hoc mode running
+wpa_supplicant, take into account authentication frames for
+'late ack' detection. This patch has been tested on devices
+mounted on offshore high-voltage stations connected through
+~24Km link
+
+Reported-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_
+ 	/* late ACK */
+ 	if (ts->ts_status & ATH9K_TXERR_XRETRY) {
+ 		if (ieee80211_is_assoc_req(hdr->frame_control) ||
+-		    ieee80211_is_assoc_resp(hdr->frame_control)) {
++		    ieee80211_is_assoc_resp(hdr->frame_control) ||
++		    ieee80211_is_auth(hdr->frame_control)) {
+ 			ath_dbg(common, DYNACK, "late ack\n");
+ 			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
+ 			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
diff --git a/package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch b/package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch
new file mode 100644
index 0000000000..a1d612660b
--- /dev/null
+++ b/package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch
@@ -0,0 +1,88 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 2 Nov 2018 21:49:56 +0100
+Subject: [PATCH] ath9k: dynack: move debug log after buffer increments
+
+Move debug log in ath_dynack_sample_tx_ts and ath_dynack_sample_ack_ts
+after timestamp buffer head/tail increments in order to make debugging
+more user friendly
+
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -171,11 +171,12 @@ static void ath_dynack_compute_to(struct
+ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+ 			     struct ath_tx_status *ts)
+ {
+-	u8 ridx;
+ 	struct ieee80211_hdr *hdr;
+ 	struct ath_dynack *da = &ah->dynack;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	u32 dur = ts->duration;
++	u8 ridx;
+ 
+ 	if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled)
+ 		return;
+@@ -203,14 +204,13 @@ void ath_dynack_sample_tx_ts(struct ath_
+ 	ridx = ts->ts_rateindex;
+ 
+ 	da->st_rbf.ts[da->st_rbf.t_rb].tstamp = ts->ts_tstamp;
+-	da->st_rbf.ts[da->st_rbf.t_rb].dur = ts->duration;
+ 	ether_addr_copy(da->st_rbf.addr[da->st_rbf.t_rb].h_dest, hdr->addr1);
+ 	ether_addr_copy(da->st_rbf.addr[da->st_rbf.t_rb].h_src, hdr->addr2);
+ 
+ 	if (!(info->status.rates[ridx].flags & IEEE80211_TX_RC_MCS)) {
+-		u32 phy, sifs;
+ 		const struct ieee80211_rate *rate;
+ 		struct ieee80211_tx_rate *rates = info->status.rates;
++		u32 phy;
+ 
+ 		rate = &common->sbands[info->band].bitrates[rates[ridx].idx];
+ 		if (info->band == NL80211_BAND_2GHZ &&
+@@ -219,19 +219,18 @@ void ath_dynack_sample_tx_ts(struct ath_
+ 		else
+ 			phy = WLAN_RC_PHY_OFDM;
+ 
+-		sifs = ath_dynack_get_sifs(ah, phy);
+-		da->st_rbf.ts[da->st_rbf.t_rb].dur -= sifs;
++		dur -= ath_dynack_get_sifs(ah, phy);
+ 	}
+-
+-	ath_dbg(common, DYNACK, "{%pM} tx sample %u [dur %u][h %u-t %u]\n",
+-		hdr->addr1, da->st_rbf.ts[da->st_rbf.t_rb].tstamp,
+-		da->st_rbf.ts[da->st_rbf.t_rb].dur, da->st_rbf.h_rb,
+-		(da->st_rbf.t_rb + 1) % ATH_DYN_BUF);
++	da->st_rbf.ts[da->st_rbf.t_rb].dur = dur;
+ 
+ 	INCR(da->st_rbf.t_rb, ATH_DYN_BUF);
+ 	if (da->st_rbf.t_rb == da->st_rbf.h_rb)
+ 		INCR(da->st_rbf.h_rb, ATH_DYN_BUF);
+ 
++	ath_dbg(common, DYNACK, "{%pM} tx sample %u [dur %u][h %u-t %u]\n",
++		hdr->addr1, ts->ts_tstamp, dur, da->st_rbf.h_rb,
++		da->st_rbf.t_rb);
++
+ 	ath_dynack_compute_to(ah);
+ 
+ 	spin_unlock_bh(&da->qlock);
+@@ -258,14 +257,13 @@ void ath_dynack_sample_ack_ts(struct ath
+ 	spin_lock_bh(&da->qlock);
+ 	da->ack_rbf.tstamp[da->ack_rbf.t_rb] = ts;
+ 
+-	ath_dbg(common, DYNACK, "rx sample %u [h %u-t %u]\n",
+-		da->ack_rbf.tstamp[da->ack_rbf.t_rb],
+-		da->ack_rbf.h_rb, (da->ack_rbf.t_rb + 1) % ATH_DYN_BUF);
+-
+ 	INCR(da->ack_rbf.t_rb, ATH_DYN_BUF);
+ 	if (da->ack_rbf.t_rb == da->ack_rbf.h_rb)
+ 		INCR(da->ack_rbf.h_rb, ATH_DYN_BUF);
+ 
++	ath_dbg(common, DYNACK, "rx sample %u [h %u-t %u]\n",
++		ts, da->ack_rbf.h_rb, da->ack_rbf.t_rb);
++
+ 	ath_dynack_compute_to(ah);
+ 
+ 	spin_unlock_bh(&da->qlock);
diff --git a/package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch b/package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch
new file mode 100644
index 0000000000..cc5cdf9233
--- /dev/null
+++ b/package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch
@@ -0,0 +1,33 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 2 Nov 2018 21:49:57 +0100
+Subject: [PATCH] ath9k: dynack: check da->enabled first in sampling
+ routines
+
+Check da->enabled flag first in ath_dynack_sample_tx_ts and
+ath_dynack_sample_ack_ts routines in order to avoid useless
+processing
+
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -178,7 +178,7 @@ void ath_dynack_sample_tx_ts(struct ath_
+ 	u32 dur = ts->duration;
+ 	u8 ridx;
+ 
+-	if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled)
++	if (!da->enabled || (info->flags & IEEE80211_TX_CTL_NO_ACK))
+ 		return;
+ 
+ 	spin_lock_bh(&da->qlock);
+@@ -251,7 +251,7 @@ void ath_dynack_sample_ack_ts(struct ath
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 
+-	if (!ath_dynack_bssidmask(ah, hdr->addr1) || !da->enabled)
++	if (!da->enabled || !ath_dynack_bssidmask(ah, hdr->addr1))
+ 		return;
+ 
+ 	spin_lock_bh(&da->qlock);
diff --git a/package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch b/package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch
new file mode 100644
index 0000000000..7735c9782d
--- /dev/null
+++ b/package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch
@@ -0,0 +1,139 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 2 Nov 2018 21:49:58 +0100
+Subject: [PATCH] ath9k: dynack: make ewma estimation faster
+
+In order to make propagation time estimation faster,
+use current sample as ewma output value during 'late ack'
+tracking
+
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -273,7 +273,7 @@ struct ath_node {
+ #endif
+ 	u8 key_idx[4];
+ 
+-	u32 ackto;
++	int ackto;
+ 	struct list_head list;
+ };
+ 
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -29,9 +29,13 @@
+  * ath_dynack_ewma - EWMA (Exponentially Weighted Moving Average) calculation
+  *
+  */
+-static inline u32 ath_dynack_ewma(u32 old, u32 new)
++static inline int ath_dynack_ewma(int old, int new)
+ {
+-	return (new * (EWMA_DIV - EWMA_LEVEL) + old * EWMA_LEVEL) / EWMA_DIV;
++	if (old > 0)
++		return (new * (EWMA_DIV - EWMA_LEVEL) +
++			old * EWMA_LEVEL) / EWMA_DIV;
++	else
++		return new;
+ }
+ 
+ /**
+@@ -82,10 +86,10 @@ static inline bool ath_dynack_bssidmask(
+  */
+ static void ath_dynack_compute_ackto(struct ath_hw *ah)
+ {
+-	struct ath_node *an;
+-	u32 to = 0;
+-	struct ath_dynack *da = &ah->dynack;
+ 	struct ath_common *common = ath9k_hw_common(ah);
++	struct ath_dynack *da = &ah->dynack;
++	struct ath_node *an;
++	int to = 0;
+ 
+ 	list_for_each_entry(an, &da->nodes, list)
+ 		if (an->ackto > to)
+@@ -144,7 +148,8 @@ static void ath_dynack_compute_to(struct
+ 					an->ackto = ath_dynack_ewma(an->ackto,
+ 								    ackto);
+ 					ath_dbg(ath9k_hw_common(ah), DYNACK,
+-						"%pM to %u\n", dst, an->ackto);
++						"%pM to %d [%u]\n", dst,
++						an->ackto, ackto);
+ 					if (time_is_before_jiffies(da->lto)) {
+ 						ath_dynack_compute_ackto(ah);
+ 						da->lto = jiffies + COMPUTE_TO;
+@@ -166,10 +171,12 @@ static void ath_dynack_compute_to(struct
+  * @ah: ath hw
+  * @skb: socket buffer
+  * @ts: tx status info
++ * @sta: station pointer
+  *
+  */
+ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+-			     struct ath_tx_status *ts)
++			     struct ath_tx_status *ts,
++			     struct ieee80211_sta *sta)
+ {
+ 	struct ieee80211_hdr *hdr;
+ 	struct ath_dynack *da = &ah->dynack;
+@@ -191,9 +198,16 @@ void ath_dynack_sample_tx_ts(struct ath_
+ 		    ieee80211_is_assoc_resp(hdr->frame_control) ||
+ 		    ieee80211_is_auth(hdr->frame_control)) {
+ 			ath_dbg(common, DYNACK, "late ack\n");
++
+ 			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
+ 			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
+ 			ath9k_hw_set_cts_timeout(ah, LATEACK_TO);
++			if (sta) {
++				struct ath_node *an;
++
++				an = (struct ath_node *)sta->drv_priv;
++				an->ackto = -1;
++			}
+ 			da->lto = jiffies + LATEACK_DELAY;
+ 		}
+ 
+--- a/drivers/net/wireless/ath/ath9k/dynack.h
++++ b/drivers/net/wireless/ath/ath9k/dynack.h
+@@ -86,7 +86,8 @@ void ath_dynack_node_deinit(struct ath_h
+ void ath_dynack_init(struct ath_hw *ah);
+ void ath_dynack_sample_ack_ts(struct ath_hw *ah, struct sk_buff *skb, u32 ts);
+ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+-			     struct ath_tx_status *ts);
++			     struct ath_tx_status *ts,
++			     struct ieee80211_sta *sta);
+ #else
+ static inline void ath_dynack_init(struct ath_hw *ah) {}
+ static inline void ath_dynack_node_init(struct ath_hw *ah,
+@@ -97,7 +98,8 @@ static inline void ath_dynack_sample_ack
+ 					    struct sk_buff *skb, u32 ts) {}
+ static inline void ath_dynack_sample_tx_ts(struct ath_hw *ah,
+ 					   struct sk_buff *skb,
+-					   struct ath_tx_status *ts) {}
++					   struct ath_tx_status *ts,
++					   struct ieee80211_sta *sta) {}
+ #endif
+ 
+ #endif /* DYNACK_H */
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -629,7 +629,7 @@ static void ath_tx_complete_aggr(struct
+ 				if (bf == bf->bf_lastbf)
+ 					ath_dynack_sample_tx_ts(sc->sc_ah,
+ 								bf->bf_mpdu,
+-								ts);
++								ts, sta);
+ 			}
+ 
+ 			ath_tx_complete_buf(sc, bf, txq, &bf_head, sta, ts,
+@@ -773,7 +773,8 @@ static void ath_tx_process_buffer(struct
+ 			memcpy(info->control.rates, bf->rates,
+ 			       sizeof(info->control.rates));
+ 			ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
+-			ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts);
++			ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts,
++						sta);
+ 		}
+ 		ath_tx_complete_buf(sc, bf, txq, bf_head, sta, ts, txok);
+ 	} else
diff --git a/package/kernel/mac80211/patches/556-ath9k-dynack-remove-experimental-tag.patch b/package/kernel/mac80211/patches/556-ath9k-dynack-remove-experimental-tag.patch
new file mode 100644
index 0000000000..2e4cffd1fa
--- /dev/null
+++ b/package/kernel/mac80211/patches/556-ath9k-dynack-remove-experimental-tag.patch
@@ -0,0 +1,22 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Fri, 2 Nov 2018 21:49:59 +0100
+Subject: [PATCH] ath9k: dynack: remove 'experimental' tag
+
+Remove experimental tag from dynack Kconfig entry since it has
+been tested on outdoor 25Km links
+
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/Kconfig
++++ b/drivers/net/wireless/ath/ath9k/Kconfig
+@@ -132,7 +132,7 @@ config ATH9K_DFS_CERTIFIED
+ 	  except increase code size.
+ 
+ config ATH9K_DYNACK
+-	bool "Atheros ath9k ACK timeout estimation algorithm (EXPERIMENTAL)"
++	bool "Atheros ath9k ACK timeout estimation algorithm"
+ 	depends on ATH9K
+ 	default n
+ 	---help---
diff --git a/package/kernel/mac80211/patches/rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch b/package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
similarity index 93%
rename from package/kernel/mac80211/patches/rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
rename to package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
index b4106b0197..699989baa0 100644
--- a/package/kernel/mac80211/patches/rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/Kconfig
 +++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
-@@ -211,7 +211,7 @@ endif
+@@ -210,7 +210,7 @@ endif
  config RT2800SOC
  	tristate "Ralink WiSoC support"
  	depends on m
@@ -19,7 +19,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	select RT2X00_LIB_SOC
  	select RT2X00_LIB_MMIO
  	select RT2X00_LIB_CRYPTO
-@@ -246,7 +246,7 @@ config RT2X00_LIB_PCI
+@@ -245,7 +245,7 @@ config RT2X00_LIB_PCI
  
  config RT2X00_LIB_SOC
  	tristate "RT2x00 SoC support"
diff --git a/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch b/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
new file mode 100644
index 0000000000..5127c5cfe4
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
@@ -0,0 +1,20 @@
+From 4f16582c93a71eba9d389e0f0a8aa9099a9587cd Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:26 +0100
+Subject: [PATCH] rt2x00: rt2800lib: enable support for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -9403,6 +9403,7 @@ static int rt2800_probe_rt(struct rt2x00
+ 	case RT3390:
+ 	case RT3572:
+ 	case RT3593:
++	case RT3883:
+ 	case RT5350:
+ 	case RT5390:
+ 	case RT5392:
diff --git a/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch b/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
new file mode 100644
index 0000000000..60e57c1bae
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
@@ -0,0 +1,112 @@
+From ecb394ccf248d8652c463133c4f404458a57a9c1 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:26 +0100
+Subject: [PATCH] rt2x00: rt2800lib: add rf_vals for RF3853
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    4 +-
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   65 +++++++++++++++++++++++++++++++
+ 2 files changed, 68 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -48,7 +48,8 @@
+  * RF2853 2.4G/5G 3T3R
+  * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
+  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
+- * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
++ * RF3053 2.4G/5G 3T3R(RT3563/RT3573/RT3593)
++ * RF3853 2.4G/5G 3T3R(RT3883/RT3662)
+  * RF5592 2.4G/5G 2T2R
+  * RF3070 2.4G 1T1R
+  * RF5360 2.4G 1T1R
+@@ -72,6 +73,7 @@
+ #define RF5592				0x000f
+ #define RF3070				0x3070
+ #define RF3290				0x3290
++#define RF3853				0x3853
+ #define RF5350				0x5350
+ #define RF5360				0x5360
+ #define RF5362				0x5362
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8981,6 +8981,66 @@ static const struct rf_channel rf_vals_3
+ 	{14,   0xF0,	 2,  0x18},
+ };
+ 
++static const struct rf_channel rf_vals_3853[] = {
++	{1,  241, 6, 2},
++	{2,  241, 6, 7},
++	{3,  242, 6, 2},
++	{4,  242, 6, 7},
++	{5,  243, 6, 2},
++	{6,  243, 6, 7},
++	{7,  244, 6, 2},
++	{8,  244, 6, 7},
++	{9,  245, 6, 2},
++	{10, 245, 6, 7},
++	{11, 246, 6, 2},
++	{12, 246, 6, 7},
++	{13, 247, 6, 2},
++	{14, 248, 6, 4},
++
++	{36, 0x56, 8, 4},
++	{38, 0x56, 8, 6},
++	{40, 0x56, 8, 8},
++	{44, 0x57, 8, 0},
++	{46, 0x57, 8, 2},
++	{48, 0x57, 8, 4},
++	{52, 0x57, 8, 8},
++	{54, 0x57, 8, 10},
++	{56, 0x58, 8, 0},
++	{60, 0x58, 8, 4},
++	{62, 0x58, 8, 6},
++	{64, 0x58, 8, 8},
++
++	{100, 0x5b, 8, 8},
++	{102, 0x5b, 8, 10},
++	{104, 0x5c, 8, 0},
++	{108, 0x5c, 8, 4},
++	{110, 0x5c, 8, 6},
++	{112, 0x5c, 8, 8},
++	{114, 0x5c, 8, 10},
++	{116, 0x5d, 8, 0},
++	{118, 0x5d, 8, 2},
++	{120, 0x5d, 8, 4},
++	{124, 0x5d, 8, 8},
++	{126, 0x5d, 8, 10},
++	{128, 0x5e, 8, 0},
++	{132, 0x5e, 8, 4},
++	{134, 0x5e, 8, 6},
++	{136, 0x5e, 8, 8},
++	{140, 0x5f, 8, 0},
++
++	{149, 0x5f, 8, 9},
++	{151, 0x5f, 8, 11},
++	{153, 0x60, 8, 1},
++	{157, 0x60, 8, 5},
++	{159, 0x60, 8, 7},
++	{161, 0x60, 8, 9},
++	{165, 0x61, 8, 1},
++	{167, 0x61, 8, 3},
++	{169, 0x61, 8, 5},
++	{171, 0x61, 8, 7},
++	{173, 0x61, 8, 9},
++};
++
+ static const struct rf_channel rf_vals_5592_xtal20[] = {
+ 	/* Channel, N, K, mod, R */
+ 	{1, 482, 4, 10, 3},
+@@ -9244,6 +9304,11 @@ static int rt2800_probe_hw_mode(struct r
+ 		spec->channels = rf_vals_3x;
+ 		break;
+ 
++	case RF3853:
++		spec->num_channels = ARRAY_SIZE(rf_vals_3853);
++		spec->channels = rf_vals_3853;
++		break;
++
+ 	case RF5592:
+ 		reg = rt2800_register_read(rt2x00dev, MAC_DEBUG_INDEX);
+ 		if (rt2x00_get_field32(reg, MAC_DEBUG_INDEX_XTAL)) {
diff --git a/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch b/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
new file mode 100644
index 0000000000..def2c397fd
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
@@ -0,0 +1,28 @@
+From f8e3fcf18e1f2d7f9e6a9680c5452da090f33d88 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Thu, 1 Aug 2013 14:40:44 +0200
+Subject: [PATCH] rt2x00: rt2800lib: enable VCO calibration for RF3853
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4881,6 +4881,7 @@ void rt2800_vco_calibration(struct rt2x0
+ 	case RF3053:
+ 	case RF3070:
+ 	case RF3290:
++	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
+ 	case RF5362:
+@@ -9426,6 +9427,7 @@ static int rt2800_probe_hw_mode(struct r
+ 	case RF3053:
+ 	case RF3070:
+ 	case RF3290:
++	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
+ 	case RF5362:
diff --git a/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch b/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
new file mode 100644
index 0000000000..1d6e312037
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
@@ -0,0 +1,235 @@
+From 6e3a17190815c6aa4dc53c2cfe9125fb1154f187 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:27 +0100
+Subject: [PATCH] rt2x00: rt2800lib: add channel configuration function for
+ RF3853
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  208 +++++++++++++++++++++++++++++++
+ 1 file changed, 208 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2713,6 +2713,211 @@ static void rt2800_config_channel_rf3053
+ 	}
+ }
+ 
++static void rt2800_config_channel_rf3853(struct rt2x00_dev *rt2x00dev,
++					 struct ieee80211_conf *conf,
++					 struct rf_channel *rf,
++					 struct channel_info *info)
++{
++	u8 rfcsr;
++	u8 bbp;
++	u8 pwr1, pwr2, pwr3;
++
++	const bool txbf_enabled = false; /* TODO */
++
++	/* TODO: add band selection */
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
++	else if (rf->channel < 132)
++		rt2800_rfcsr_write(rt2x00dev, 6, 0x80);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
++
++	rt2800_rfcsr_write(rt2x00dev, 8, rf->rf1);
++	rt2800_rfcsr_write(rt2x00dev, 9, rf->rf3);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 11, 0x46);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 11, 0x48);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 12, 0x1a);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 12, 0x52);
++
++	rt2800_rfcsr_write(rt2x00dev, 13, 0x12);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
++	rt2x00_set_field8(&rfcsr, RFCSR1_PLL_PD, 1);
++
++	switch (rt2x00dev->default_ant.tx_chain_num) {
++	case 3:
++		rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 1);
++		/* fallthrough */
++	case 2:
++		rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 1);
++		/* fallthrough */
++	case 1:
++		rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
++		break;
++	}
++
++	switch (rt2x00dev->default_ant.rx_chain_num) {
++	case 3:
++		rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 1);
++		/* fallthrough */
++	case 2:
++		rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 1);
++		/* fallthrough */
++	case 1:
++		rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
++		break;
++	}
++	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
++
++	rt2800_freq_cal_mode1(rt2x00dev);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 30);
++	if (!conf_is_ht40(conf))
++		rfcsr &= ~(0x06);
++	else
++		rfcsr |= 0x06;
++	rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 31, 0xa0);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
++
++	if (conf_is_ht40(conf))
++		rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 32, 0xd8);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 34, 0x3c);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 34, 0x20);
++
++	/* loopback RF_BS */
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 36);
++	if (rf->channel <= 14)
++		rt2x00_set_field8(&rfcsr, RFCSR36_RF_BS, 1);
++	else
++		rt2x00_set_field8(&rfcsr, RFCSR36_RF_BS, 0);
++	rt2800_rfcsr_write(rt2x00dev, 36, rfcsr);
++
++	if (rf->channel <= 14)
++		rfcsr = 0x23;
++	else if (rf->channel < 100)
++		rfcsr = 0x36;
++	else if (rf->channel < 132)
++		rfcsr = 0x32;
++	else
++		rfcsr = 0x30;
++
++	if (txbf_enabled)
++		rfcsr |= 0x40;
++
++	rt2800_rfcsr_write(rt2x00dev, 39, rfcsr);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 44, 0x93);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 44, 0x9b);
++
++	if (rf->channel <= 14)
++		rfcsr = 0xbb;
++	else if (rf->channel < 100)
++		rfcsr = 0xeb;
++	else if (rf->channel < 132)
++		rfcsr = 0xb3;
++	else
++		rfcsr = 0x9b;
++	rt2800_rfcsr_write(rt2x00dev, 45, rfcsr);
++
++	if (rf->channel <= 14)
++		rfcsr = 0x8e;
++	else
++		rfcsr = 0x8a;
++
++	if (txbf_enabled)
++		rfcsr |= 0x20;
++
++	rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
++
++	rt2800_rfcsr_write(rt2x00dev, 50, 0x86);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 51);
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 51, 0x75);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 51, 0x51);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 52);
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 52, 0x45);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 52, 0x05);
++
++	if (rf->channel <= 14) {
++		pwr1 = info->default_power1 & 0x1f;
++		pwr2 = info->default_power2 & 0x1f;
++		pwr3 = info->default_power3 & 0x1f;
++	} else {
++		pwr1 = 0x48 | ((info->default_power1 & 0x18) << 1) |
++			(info->default_power1 & 0x7);
++		pwr2 = 0x48 | ((info->default_power2 & 0x18) << 1) |
++			(info->default_power2 & 0x7);
++		pwr3 = 0x48 | ((info->default_power3 & 0x18) << 1) |
++			(info->default_power3 & 0x7);
++	}
++
++	rt2800_rfcsr_write(rt2x00dev, 53, pwr1);
++	rt2800_rfcsr_write(rt2x00dev, 54, pwr2);
++	rt2800_rfcsr_write(rt2x00dev, 55, pwr3);
++
++	rt2x00_dbg(rt2x00dev, "Channel:%d, pwr1:%02x, pwr2:%02x, pwr3:%02x\n",
++		   rf->channel, pwr1, pwr2, pwr3);
++
++	bbp = (info->default_power1 >> 5) |
++	      ((info->default_power2 & 0xe0) >> 1);
++	rt2800_bbp_write(rt2x00dev, 109, bbp);
++
++	bbp = rt2800_bbp_read(rt2x00dev, 110);
++	bbp &= 0x0f;
++	bbp |= (info->default_power3 & 0xe0) >> 1;
++	rt2800_bbp_write(rt2x00dev, 110, bbp);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 57);
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 57, 0x6e);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 57, 0x3e);
++
++	/* Enable RF tuning */
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 3);
++	rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
++	rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
++
++	udelay(2000);
++
++	bbp = rt2800_bbp_read(rt2x00dev, 49);
++	/* clear update flag */
++	rt2800_bbp_write(rt2x00dev, 49, bbp & 0xfe);
++	rt2800_bbp_write(rt2x00dev, 49, bbp);
++
++	/* TODO: add calibration for TxBF */
++}
++
+ #define POWER_BOUND		0x27
+ #define POWER_BOUND_5G		0x2b
+ 
+@@ -3570,6 +3775,9 @@ static void rt2800_config_channel(struct
+ 	case RF3322:
+ 		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
+ 		break;
++	case RF3853:
++		rt2800_config_channel_rf3853(rt2x00dev, conf, rf, info);
++		break;
+ 	case RF3070:
+ 	case RF5350:
+ 	case RF5360:
diff --git a/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch b/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
new file mode 100644
index 0000000000..6476dc107b
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
@@ -0,0 +1,20 @@
+From afd38ae82226551bf879b6c7c4b620c271fee9d2 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Thu, 1 Aug 2013 14:42:05 +0200
+Subject: [PATCH] rt2x00: rt2800lib: enable RF3853 support
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8906,6 +8906,7 @@ static int rt2800_init_eeprom(struct rt2
+ 	case RF3290:
+ 	case RF3320:
+ 	case RF3322:
++	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
+ 	case RF5362:
diff --git a/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch b/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
new file mode 100644
index 0000000000..0a931e2026
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
@@ -0,0 +1,62 @@
+From 0094872a5e8e4664c6ea1b2dfa487063d39ae363 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:26 +0100
+Subject: [PATCH] rt2x00: rt2800lib: add MAC register initialization for
+ RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |   14 ++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   19 ++++++++++++++++---
+ 2 files changed, 30 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -1727,6 +1727,20 @@
+ #define TX_PWR_CFG_9B_STBC_MCS7		FIELD32(0x000000ff)
+ 
+ /*
++ * TX_TXBF_CFG:
++ */
++#define TX_TXBF_CFG_0			0x138c
++#define TX_TXBF_CFG_1			0x13a4
++#define TX_TXBF_CFG_2			0x13a8
++#define TX_TXBF_CFG_3			0x13ac
++
++/*
++ * TX_FBK_CFG_3S:
++ */
++#define TX_FBK_CFG_3S_0			0x13c4
++#define TX_FBK_CFG_3S_1			0x13c8
++
++/*
+  * RX_FILTER_CFG: RX configuration register.
+  */
+ #define RX_FILTER_CFG			0x1400
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5509,6 +5509,12 @@ static int rt2800_init_registers(struct
+ 			rt2800_register_write(rt2x00dev, TX_SW_CFG2,
+ 					      0x00000000);
+ 		}
++	} else if (rt2x00_rt(rt2x00dev, RT3883)) {
++		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000402);
++		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
++		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00040000);
++		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_0, 0x8000fc21);
++		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_3, 0x00009c40);
+ 	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
+ 		   rt2x00_rt(rt2x00dev, RT5392) ||
+ 		   rt2x00_rt(rt2x00dev, RT6352)) {
+@@ -5722,6 +5728,11 @@ static int rt2800_init_registers(struct
+ 	reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
+ 	rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
+ 
++	if (rt2x00_rt(rt2x00dev, RT3883)) {
++		rt2800_register_write(rt2x00dev, TX_FBK_CFG_3S_0, 0x12111008);
++		rt2800_register_write(rt2x00dev, TX_FBK_CFG_3S_1, 0x16151413);
++	}
++
+ 	reg = rt2800_register_read(rt2x00dev, TX_RTS_CFG);
+ 	rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 7);
+ 	rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
diff --git a/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch b/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
new file mode 100644
index 0000000000..d68ad50447
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
@@ -0,0 +1,30 @@
+From 6c2d32478159fffff0b85abb6817a21bb2338231 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:27 +0100
+Subject: [PATCH] rt2x00: rt2800soc: fix rt2800soc_disable_radio for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800soc.c |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -51,9 +51,16 @@ static bool rt2800soc_hwcrypt_disabled(s
+ 
+ static void rt2800soc_disable_radio(struct rt2x00_dev *rt2x00dev)
+ {
++	u32 reg;
++
+ 	rt2800_disable_radio(rt2x00dev);
+ 	rt2x00mmio_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+-	rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, 0);
++
++	reg = 0;
++	if (rt2x00_rt(rt2x00dev, RT3883))
++		rt2x00_set_field32(&reg, TX_PIN_CFG_RFTR_EN, 1);
++
++	rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, reg);
+ }
+ 
+ static int rt2800soc_set_device_state(struct rt2x00_dev *rt2x00dev,
diff --git a/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch b/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
new file mode 100644
index 0000000000..99f57bcd33
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
@@ -0,0 +1,71 @@
+From 84833056aa7dd25f5b097e31c78f2a0914c5160c Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:26 +0100
+Subject: [PATCH] rt2x00: rt2800lib: add BBP register initialization for
+ RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -6349,6 +6349,47 @@ static void rt2800_init_bbp_3593(struct
+ 		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+ }
+ 
++static void rt2800_init_bbp_3883(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_init_bbp_early(rt2x00dev);
++
++	rt2800_bbp_write(rt2x00dev, 4, 0x50);
++	rt2800_bbp_write(rt2x00dev, 47, 0x48);
++
++	rt2800_bbp_write(rt2x00dev, 86, 0x46);
++	rt2800_bbp_write(rt2x00dev, 88, 0x90);
++
++	rt2800_bbp_write(rt2x00dev, 92, 0x02);
++
++	rt2800_bbp_write(rt2x00dev, 103, 0xc0);
++	rt2800_bbp_write(rt2x00dev, 104, 0x92);
++	rt2800_bbp_write(rt2x00dev, 105, 0x34);
++	rt2800_bbp_write(rt2x00dev, 106, 0x12);
++	rt2800_bbp_write(rt2x00dev, 120, 0x50);
++	rt2800_bbp_write(rt2x00dev, 137, 0x0f);
++	rt2800_bbp_write(rt2x00dev, 163, 0x9d);
++
++	/* Set ITxBF timeout to 0x9C40=1000msec */
++	rt2800_bbp_write(rt2x00dev, 179, 0x02);
++	rt2800_bbp_write(rt2x00dev, 180, 0x00);
++	rt2800_bbp_write(rt2x00dev, 182, 0x40);
++	rt2800_bbp_write(rt2x00dev, 180, 0x01);
++	rt2800_bbp_write(rt2x00dev, 182, 0x9c);
++
++	rt2800_bbp_write(rt2x00dev, 179, 0x00);
++
++	/* Reprogram the inband interface to put right values in RXWI */
++	rt2800_bbp_write(rt2x00dev, 142, 0x04);
++	rt2800_bbp_write(rt2x00dev, 143, 0x3b);
++	rt2800_bbp_write(rt2x00dev, 142, 0x06);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa0);
++	rt2800_bbp_write(rt2x00dev, 142, 0x07);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa1);
++	rt2800_bbp_write(rt2x00dev, 142, 0x08);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
++	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
++}
++
+ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
+ {
+ 	int ant, div_mode;
+@@ -6792,6 +6833,9 @@ static void rt2800_init_bbp(struct rt2x0
+ 	case RT3593:
+ 		rt2800_init_bbp_3593(rt2x00dev);
+ 		return;
++	case RT3883:
++		rt2800_init_bbp_3883(rt2x00dev);
++		return;
+ 	case RT5390:
+ 	case RT5392:
+ 		rt2800_init_bbp_53xx(rt2x00dev);
diff --git a/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch b/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
new file mode 100644
index 0000000000..c0f1f5863b
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
@@ -0,0 +1,178 @@
+From 99c659cf345640fd0f733cbcaf4583cc2c868ec0 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Mon, 29 Apr 2013 13:21:48 +0200
+Subject: [PATCH] rt2x00: rt2800lib: add RFCSR initialization for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |    1 +
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  141 +++++++++++++++++++++++++++++++
+ 2 files changed, 142 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -2311,6 +2311,7 @@ struct mac_iveiv_entry {
+ /*
+  * RFCSR 2:
+  */
++#define RFCSR2_RESCAL_BP		FIELD8(0x40)
+ #define RFCSR2_RESCAL_EN		FIELD8(0x80)
+ #define RFCSR2_RX2_EN_MT7620		FIELD8(0x02)
+ #define RFCSR2_TX2_EN_MT7620		FIELD8(0x20)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -7707,6 +7707,144 @@ static void rt2800_init_rfcsr_5350(struc
+ 	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
+ }
+ 
++static void rt2800_init_rfcsr_3883(struct rt2x00_dev *rt2x00dev)
++{
++	u8 rfcsr;
++
++	/* TODO: get the actual ECO value from the SoC */
++	const unsigned int eco = 5;
++
++	rt2800_rf_init_calibration(rt2x00dev, 2);
++
++	rt2800_rfcsr_write(rt2x00dev, 0, 0xe0);
++	rt2800_rfcsr_write(rt2x00dev, 1, 0x03);
++	rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
++	rt2800_rfcsr_write(rt2x00dev, 3, 0x20);
++	rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 5, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
++	rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 8, 0x5b);
++	rt2800_rfcsr_write(rt2x00dev, 9, 0x08);
++	rt2800_rfcsr_write(rt2x00dev, 10, 0xd3);
++	rt2800_rfcsr_write(rt2x00dev, 11, 0x48);
++	rt2800_rfcsr_write(rt2x00dev, 12, 0x1a);
++	rt2800_rfcsr_write(rt2x00dev, 13, 0x12);
++	rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
++
++	/* RFCSR 17 will be initialized later based on the
++	 * frequency offset stored in the EEPROM
++	 */
++
++	rt2800_rfcsr_write(rt2x00dev, 18, 0x40);
++	rt2800_rfcsr_write(rt2x00dev, 19, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
++	rt2800_rfcsr_write(rt2x00dev, 23, 0xc0);
++	rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 25, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 29, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
++	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
++	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
++	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 34, 0x20);
++	rt2800_rfcsr_write(rt2x00dev, 35, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 37, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 38, 0x86);
++	rt2800_rfcsr_write(rt2x00dev, 39, 0x23);
++	rt2800_rfcsr_write(rt2x00dev, 40, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 41, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 42, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 44, 0x93);
++	rt2800_rfcsr_write(rt2x00dev, 45, 0xbb);
++	rt2800_rfcsr_write(rt2x00dev, 46, 0x60);
++	rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 48, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 49, 0x8e);
++	rt2800_rfcsr_write(rt2x00dev, 50, 0x86);
++	rt2800_rfcsr_write(rt2x00dev, 51, 0x51);
++	rt2800_rfcsr_write(rt2x00dev, 52, 0x05);
++	rt2800_rfcsr_write(rt2x00dev, 53, 0x76);
++	rt2800_rfcsr_write(rt2x00dev, 54, 0x76);
++	rt2800_rfcsr_write(rt2x00dev, 55, 0x76);
++	rt2800_rfcsr_write(rt2x00dev, 56, 0xdb);
++	rt2800_rfcsr_write(rt2x00dev, 57, 0x3e);
++	rt2800_rfcsr_write(rt2x00dev, 58, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
++
++	/* TODO: rx filter calibration? */
++
++	rt2800_bbp_write(rt2x00dev, 137, 0x0f);
++
++	rt2800_bbp_write(rt2x00dev, 163, 0x9d);
++
++	rt2800_bbp_write(rt2x00dev, 105, 0x05);
++
++	rt2800_bbp_write(rt2x00dev, 179, 0x02);
++	rt2800_bbp_write(rt2x00dev, 180, 0x00);
++	rt2800_bbp_write(rt2x00dev, 182, 0x40);
++	rt2800_bbp_write(rt2x00dev, 180, 0x01);
++	rt2800_bbp_write(rt2x00dev, 182, 0x9c);
++
++	rt2800_bbp_write(rt2x00dev, 179, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 142, 0x04);
++	rt2800_bbp_write(rt2x00dev, 143, 0x3b);
++	rt2800_bbp_write(rt2x00dev, 142, 0x06);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa0);
++	rt2800_bbp_write(rt2x00dev, 142, 0x07);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa1);
++	rt2800_bbp_write(rt2x00dev, 142, 0x08);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
++	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
++
++	if (eco == 5) {
++		rt2800_rfcsr_write(rt2x00dev, 32, 0xd8);
++		rt2800_rfcsr_write(rt2x00dev, 33, 0x32);
++	}
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 2);
++	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_BP, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_EN, 1);
++	rt2800_rfcsr_write(rt2x00dev, 2, rfcsr);
++	msleep(1);
++	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_EN, 0);
++	rt2800_rfcsr_write(rt2x00dev, 2, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
++	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 6);
++	rfcsr |= 0xc0;
++	rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 22);
++	rfcsr |= 0x20;
++	rt2800_rfcsr_write(rt2x00dev, 22, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 46);
++	rfcsr |= 0x20;
++	rt2800_rfcsr_write(rt2x00dev, 46, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 20);
++	rfcsr &= ~0xee;
++	rt2800_rfcsr_write(rt2x00dev, 20, rfcsr);
++}
++
+ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
+ {
+ 	rt2800_rf_init_calibration(rt2x00dev, 2);
+@@ -8549,6 +8687,9 @@ static void rt2800_init_rfcsr(struct rt2
+ 	case RT3390:
+ 		rt2800_init_rfcsr_3390(rt2x00dev);
+ 		break;
++	case RT3883:
++		rt2800_init_rfcsr_3883(rt2x00dev);
++		break;
+ 	case RT3572:
+ 		rt2800_init_rfcsr_3572(rt2x00dev);
+ 		break;
diff --git a/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch b/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
new file mode 100644
index 0000000000..e74f399e65
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
@@ -0,0 +1,22 @@
+From 86022438ffeb1b87dfcd018bf477fdbb43076691 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Wed, 8 May 2013 19:35:33 +0200
+Subject: [PATCH] rt2x00: rt2800lib: use the extended EEPROM map for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -381,7 +381,8 @@ static unsigned int rt2800_eeprom_word_i
+ 		      wiphy_name(rt2x00dev->hw->wiphy), word))
+ 		return 0;
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		map = rt2800_eeprom_map_ext;
+ 	else
+ 		map = rt2800_eeprom_map;
diff --git a/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch b/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
new file mode 100644
index 0000000000..2e917c8ebf
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
@@ -0,0 +1,21 @@
+From 4cf5403f02fa65dc2207f61d223cffa9ae50e907 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Thu, 1 Aug 2013 14:48:21 +0200
+Subject: [PATCH] rt2x00: rt2800lib: force rf type to RF3853 on RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -9083,6 +9083,8 @@ static int rt2800_init_eeprom(struct rt2
+ 		rf = rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID);
+ 	else if (rt2x00_rt(rt2x00dev, RT3352))
+ 		rf = RF3322;
++	else if (rt2x00_rt(rt2x00dev, RT3883))
++		rf = RF3853;
+ 	else if (rt2x00_rt(rt2x00dev, RT5350))
+ 		rf = RF5350;
+ 	else
diff --git a/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch b/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
new file mode 100644
index 0000000000..0bb2d33577
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
@@ -0,0 +1,136 @@
+From 269f19c848a2380db03a3f207cafb88e28d71c53 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:28 +0100
+Subject: [PATCH] rt2x00: rt2800lib: add channel configuration code for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   72 +++++++++++++++++++++++++++++--
+ 1 file changed, 69 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3738,6 +3738,36 @@ static char rt2800_txpower_to_dev(struct
+ 		return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER);
+ }
+ 
++static void rt3883_bbp_adjust(struct rt2x00_dev *rt2x00dev,
++			      struct rf_channel *rf)
++{
++	u8 bbp;
++
++	bbp = (rf->channel > 14) ? 0x48 : 0x38;
++	rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 69, 0x12);
++
++	if (rf->channel <= 14) {
++		rt2800_bbp_write(rt2x00dev, 70, 0x0a);
++	} else {
++		/* Disable CCK packet detection */
++		rt2800_bbp_write(rt2x00dev, 70, 0x00);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 73, 0x10);
++
++	if (rf->channel > 14) {
++		rt2800_bbp_write(rt2x00dev, 62, 0x1d);
++		rt2800_bbp_write(rt2x00dev, 63, 0x1d);
++		rt2800_bbp_write(rt2x00dev, 64, 0x1d);
++	} else {
++		rt2800_bbp_write(rt2x00dev, 62, 0x2d);
++		rt2800_bbp_write(rt2x00dev, 63, 0x2d);
++		rt2800_bbp_write(rt2x00dev, 64, 0x2d);
++	}
++}
++
+ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
+ 				  struct ieee80211_conf *conf,
+ 				  struct rf_channel *rf,
+@@ -3756,6 +3786,12 @@ static void rt2800_config_channel(struct
+ 			rt2800_txpower_to_dev(rt2x00dev, rf->channel,
+ 					      info->default_power3);
+ 
++	switch (rt2x00dev->chip.rt) {
++	case RT3883:
++		rt3883_bbp_adjust(rt2x00dev, rf);
++		break;
++	}
++
+ 	switch (rt2x00dev->chip.rf) {
+ 	case RF2020:
+ 	case RF3020:
+@@ -3860,6 +3896,15 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 77, 0x98);
++	} else if (rt2x00_rt(rt2x00dev, RT3883)) {
++		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
++		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
++		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
++
++		if (rt2x00dev->default_ant.rx_chain_num > 1)
++			rt2800_bbp_write(rt2x00dev, 86, 0x46);
++		else
++			rt2800_bbp_write(rt2x00dev, 86, 0);
+ 	} else {
+ 		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+@@ -3873,6 +3918,7 @@ static void rt2800_config_channel(struct
+ 		    !rt2x00_rt(rt2x00dev, RT6352)) {
+ 			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+ 				rt2800_bbp_write(rt2x00dev, 82, 0x62);
++				rt2800_bbp_write(rt2x00dev, 82, 0x62);
+ 				rt2800_bbp_write(rt2x00dev, 75, 0x46);
+ 			} else {
+ 				if (rt2x00_rt(rt2x00dev, RT3593))
+@@ -3881,19 +3927,22 @@ static void rt2800_config_channel(struct
+ 					rt2800_bbp_write(rt2x00dev, 82, 0x84);
+ 				rt2800_bbp_write(rt2x00dev, 75, 0x50);
+ 			}
+-			if (rt2x00_rt(rt2x00dev, RT3593))
++			if (rt2x00_rt(rt2x00dev, RT3593) ||
++			    rt2x00_rt(rt2x00dev, RT3883))
+ 				rt2800_bbp_write(rt2x00dev, 83, 0x8a);
+ 		}
+ 
+ 	} else {
+ 		if (rt2x00_rt(rt2x00dev, RT3572))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0x94);
+-		else if (rt2x00_rt(rt2x00dev, RT3593))
++		else if (rt2x00_rt(rt2x00dev, RT3593) ||
++			 rt2x00_rt(rt2x00dev, RT3883))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0x82);
+ 		else if (!rt2x00_rt(rt2x00dev, RT6352))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0xf2);
+ 
+-		if (rt2x00_rt(rt2x00dev, RT3593))
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883))
+ 			rt2800_bbp_write(rt2x00dev, 83, 0x9a);
+ 
+ 		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
+@@ -4019,6 +4068,23 @@ static void rt2800_config_channel(struct
+ 
+ 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+ 
++		usleep_range(1000, 1500);
++	}
++
++	if (rt2x00_rt(rt2x00dev, RT3883)) {
++		if (!conf_is_ht40(conf))
++			rt2800_bbp_write(rt2x00dev, 105, 0x34);
++		else
++			rt2800_bbp_write(rt2x00dev, 105, 0x04);
++
++		/* AGC init */
++		if (rf->channel <= 14)
++			reg = 0x2e + rt2x00dev->lna_gain;
++		else
++			reg = 0x20 + ((rt2x00dev->lna_gain * 5) / 3);
++
++		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
++
+ 		usleep_range(1000, 1500);
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch b/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
new file mode 100644
index 0000000000..56157510eb
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
@@ -0,0 +1,30 @@
+From e37d93abaabe3ab72b0332a18092acc162307274 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Mon, 30 Sep 2013 13:57:26 +0200
+Subject: [PATCH] rt2x00: rt2800lib: fix txpower_to_dev function for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3725,13 +3725,15 @@ static char rt2800_txpower_to_dev(struct
+ 				  unsigned int channel,
+ 				  char txpower)
+ {
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		txpower = rt2x00_get_field8(txpower, EEPROM_TXPOWER_ALC);
+ 
+ 	if (channel <= 14)
+ 		return clamp_t(char, txpower, MIN_G_TXPOWER, MAX_G_TXPOWER);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		return clamp_t(char, txpower, MIN_A_TXPOWER_3593,
+ 			       MAX_A_TXPOWER_3593);
+ 	else
diff --git a/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch b/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
new file mode 100644
index 0000000000..c1409bcfa3
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
@@ -0,0 +1,23 @@
+From c4d79e344bd580d85821390d49f92dced7d8e125 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:29 +0100
+Subject: [PATCH] rt2x00: rt2800lib: use correct txpower calculation function
+ for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5111,7 +5111,8 @@ static void rt2800_config_txpower(struct
+ 				  struct ieee80211_channel *chan,
+ 				  int power_level)
+ {
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		rt2800_config_txpower_rt3593(rt2x00dev, chan, power_level);
+ 	else if (rt2x00_rt(rt2x00dev, RT6352))
+ 		rt2800_config_txpower_rt6352(rt2x00dev, chan, power_level);
diff --git a/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch b/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
new file mode 100644
index 0000000000..a4ccb28518
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
@@ -0,0 +1,33 @@
+From caea0671cd8fd9ade4f5969cbe0ee545e94ae105 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sat, 24 Aug 2013 11:49:55 +0200
+Subject: [PATCH] rt2x00: rt2800lib: hardcode txmixer gain values to zero for
+ RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8965,7 +8965,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
+ {
+ 	u16 word;
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		return 0;
+ 
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG);
+@@ -8979,7 +8980,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
+ {
+ 	u16 word;
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		return 0;
+ 
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_A);
diff --git a/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch b/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
new file mode 100644
index 0000000000..197aabd7bc
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
@@ -0,0 +1,20 @@
+From 11c40fb47c4a4dd6ad060c2ae127ced89ffb9fe1 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Thu, 18 Apr 2013 14:33:33 +0200
+Subject: [PATCH] rt2x00: rt2800lib: use correct [RT]XWI size for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -591,6 +591,7 @@ void rt2800_get_txwi_rxwi_size(struct rt
+ {
+ 	switch (rt2x00dev->chip.rt) {
+ 	case RT3593:
++	case RT3883:
+ 		*txwi_size = TXWI_DESC_SIZE_4WORDS;
+ 		*rxwi_size = RXWI_DESC_SIZE_5WORDS;
+ 		break;
diff --git a/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch b/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
new file mode 100644
index 0000000000..24c0ef91b0
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
@@ -0,0 +1,22 @@
+From fa5ad9c025610c22048add2f0ad03f62b6ca1e74 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Mon, 30 Sep 2013 16:53:33 +0200
+Subject: [PATCH] rt2x00: rt2800lib: fix antenna configuration for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2017,7 +2017,8 @@ void rt2800_config_ant(struct rt2x00_dev
+ 	rt2800_bbp_write(rt2x00dev, 3, r3);
+ 	rt2800_bbp_write(rt2x00dev, 1, r1);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593)) {
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883)) {
+ 		if (ant->rx_chain_num == 1)
+ 			rt2800_bbp_write(rt2x00dev, 86, 0x00);
+ 		else
diff --git a/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch b/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
new file mode 100644
index 0000000000..52733ffeb9
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
@@ -0,0 +1,32 @@
+From 6d668fef3a1baa60bdd715ee062ddb6333d2647c Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Mon, 30 Sep 2013 16:58:23 +0200
+Subject: [PATCH] rt2x00: rt2800lib: fix LNA gain configuration for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2040,7 +2040,8 @@ static void rt2800_config_lna_gain(struc
+ 		eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_LNA);
+ 		lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
+ 	} else if (libconf->rf.channel <= 128) {
+-		if (rt2x00_rt(rt2x00dev, RT3593)) {
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883)) {
+ 			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
+ 			lna_gain = rt2x00_get_field16(eeprom,
+ 						      EEPROM_EXT_LNA2_A1);
+@@ -2050,7 +2051,8 @@ static void rt2800_config_lna_gain(struc
+ 						      EEPROM_RSSI_BG2_LNA_A1);
+ 		}
+ 	} else {
+-		if (rt2x00_rt(rt2x00dev, RT3593)) {
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883)) {
+ 			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
+ 			lna_gain = rt2x00_get_field16(eeprom,
+ 						      EEPROM_EXT_LNA2_A2);
diff --git a/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch b/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
new file mode 100644
index 0000000000..301928d283
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
@@ -0,0 +1,44 @@
+From c49b2d829aa1c816a46a577cdec6d2ff14d9f06e Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Tue, 1 Oct 2013 15:40:08 +0200
+Subject: [PATCH] rt2x00: rt2800lib: fix VGC setup for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5364,7 +5364,8 @@ static u8 rt2800_get_default_vgc(struct
+ 		else
+ 			vgc = 0x2e + rt2x00dev->lna_gain;
+ 	} else { /* 5GHZ band */
+-		if (rt2x00_rt(rt2x00dev, RT3593))
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883))
+ 			vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
+ 		else if (rt2x00_rt(rt2x00dev, RT5592))
+ 			vgc = 0x24 + (2 * rt2x00dev->lna_gain);
+@@ -5384,7 +5385,8 @@ static inline void rt2800_set_vgc(struct
+ {
+ 	if (qual->vgc_level != vgc_level) {
+ 		if (rt2x00_rt(rt2x00dev, RT3572) ||
+-		    rt2x00_rt(rt2x00dev, RT3593)) {
++		    rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883)) {
+ 			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+ 						       vgc_level);
+ 		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
+@@ -5431,6 +5433,11 @@ void rt2800_link_tuner(struct rt2x00_dev
+ 		}
+ 		break;
+ 
++	case RT3883:
++		if (qual->rssi > -65)
++			vgc += 0x10;
++		break;
++
+ 	case RT5592:
+ 		if (qual->rssi > -65)
+ 			vgc += 0x20;
diff --git a/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch b/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
new file mode 100644
index 0000000000..4bbc7ae44e
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
@@ -0,0 +1,42 @@
+From 1616650aea676541d4dc8adc6f4219856d193c8b Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Tue, 1 Oct 2013 17:27:57 +0200
+Subject: [PATCH] rt2x00: rt2800lib: fix EEPROM LNA validation for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -9098,7 +9098,8 @@ static int rt2800_validate_eeprom(struct
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2);
+ 	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
+ 		rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
+-	if (!rt2x00_rt(rt2x00dev, RT3593)) {
++	if (!rt2x00_rt(rt2x00dev, RT3593) &&
++	    !rt2x00_rt(rt2x00dev, RT3883)) {
+ 		if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
+ 		    rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
+ 			rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
+@@ -9118,7 +9119,8 @@ static int rt2800_validate_eeprom(struct
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_A2);
+ 	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
+ 		rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
+-	if (!rt2x00_rt(rt2x00dev, RT3593)) {
++	if (!rt2x00_rt(rt2x00dev, RT3593) &&
++	    !rt2x00_rt(rt2x00dev, RT3883)) {
+ 		if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
+ 		    rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
+ 			rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
+@@ -9126,7 +9128,8 @@ static int rt2800_validate_eeprom(struct
+ 	}
+ 	rt2800_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593)) {
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883)) {
+ 		word = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
+ 		if (rt2x00_get_field16(word, EEPROM_EXT_LNA2_A1) == 0x00 ||
+ 		    rt2x00_get_field16(word, EEPROM_EXT_LNA2_A1) == 0xff)
diff --git a/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch b/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
new file mode 100644
index 0000000000..e752efd0ea
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
@@ -0,0 +1,22 @@
+From e3871034a0e7c8a95152dc3eafbcc4535398cbdc Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Wed, 2 Oct 2013 10:11:59 +0200
+Subject: [PATCH] rt2x00: rt2800lib: fix txpower compensation for RT3883
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4354,6 +4354,9 @@ static u8 rt2800_compensate_txpower(stru
+ 	if (rt2x00_rt(rt2x00dev, RT3593))
+ 		return min_t(u8, txpower, 0xc);
+ 
++	if (rt2x00_rt(rt2x00dev, RT3883))
++		return min_t(u8, txpower, 0xf);
++
+ 	if (rt2x00_has_cap_power_limit(rt2x00dev)) {
+ 		/*
+ 		 * Check if eirp txpower exceed txpower_limit.
diff --git a/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch b/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
new file mode 100644
index 0000000000..342174f8d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
@@ -0,0 +1,136 @@
+From 5e67d4f8a46d19748b501c2ef86de3f50d3cfd51 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 24 Mar 2013 19:26:27 +0100
+Subject: [PATCH] rt2x00: rt2800mmio: add a workaround for spurious
+ TX_FIFO_STATUS interrupts
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h     |    5 +++
+ 2 files changed, 65 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -424,9 +424,9 @@ void rt2800mmio_autowake_tasklet(unsigne
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
+ 
+-static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
++static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev,
++					  u32 status)
+ {
+-	u32 status;
+ 	int i;
+ 
+ 	/*
+@@ -447,29 +447,77 @@ static void rt2800mmio_txstatus_interrup
+ 	 * Since we have only one producer and one consumer we don't
+ 	 * need to lock the kfifo.
+ 	 */
+-	for (i = 0; i < rt2x00dev->tx->limit; i++) {
+-		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
+-
+-		if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
+-			break;
+-
++	i = 0;
++	do {
+ 		if (!kfifo_put(&rt2x00dev->txstatus_fifo, status)) {
+-			rt2x00_warn(rt2x00dev, "TX status FIFO overrun, drop tx status report\n");
++			rt2x00_warn(rt2x00dev,
++				    "TX status FIFO overrun, drop TX status report\n");
+ 			break;
+ 		}
+-	}
++
++		if (++i >= rt2x00dev->tx->limit)
++			break;
++
++		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
++	} while (rt2x00_get_field32(status, TX_STA_FIFO_VALID));
+ 
+ 	/* Schedule the tasklet for processing the tx status. */
+ 	tasklet_schedule(&rt2x00dev->txstatus_tasklet);
+ }
+ 
++#define RT2800MMIO_TXSTATUS_IRQ_MAX_RETRIES	4
++
++static bool rt2800mmio_txstatus_is_spurious(struct rt2x00_dev *rt2x00dev,
++					   u32 txstatus)
++{
++	if (likely(rt2x00_get_field32(txstatus, TX_STA_FIFO_VALID))) {
++		rt2x00dev->txstatus_irq_retries = 0;
++		return false;
++	}
++
++	rt2x00dev->txstatus_irq_retries++;
++
++	/* Ensure that we don't go into an infinite IRQ loop. */
++	if (rt2x00dev->txstatus_irq_retries >=
++	    RT2800MMIO_TXSTATUS_IRQ_MAX_RETRIES) {
++		rt2x00_warn(rt2x00dev,
++			    "%u spurious TX_FIFO_STATUS interrupt(s)\n",
++			    rt2x00dev->txstatus_irq_retries);
++		rt2x00dev->txstatus_irq_retries = 0;
++		return false;
++	}
++
++	return true;
++}
++
+ irqreturn_t rt2800mmio_interrupt(int irq, void *dev_instance)
+ {
+ 	struct rt2x00_dev *rt2x00dev = dev_instance;
+ 	u32 reg, mask;
++	u32 txstatus = 0;
+ 
+-	/* Read status and ACK all interrupts */
++	/* Read status */
+ 	reg = rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR);
++
++	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
++		/* Due to unknown reason the hardware generates a
++		 * TX_FIFO_STATUS interrupt before the TX_STA_FIFO
++		 * register contain valid data. Read the TX status
++		 * here to see if we have to process the actual
++		 * request.
++		 */
++		txstatus = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
++		if (rt2800mmio_txstatus_is_spurious(rt2x00dev, txstatus)) {
++			/* Remove the TX_FIFO_STATUS bit so it won't be
++			 * processed in this turn. The hardware will
++			 * generate another IRQ for us.
++			 */
++			rt2x00_set_field32(&reg,
++					   INT_SOURCE_CSR_TX_FIFO_STATUS, 0);
++		}
++	}
++
++	/* ACK interrupts */
+ 	rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+ 
+ 	if (!reg)
+@@ -486,7 +534,7 @@ irqreturn_t rt2800mmio_interrupt(int irq
+ 	mask = ~reg;
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
+-		rt2800mmio_txstatus_interrupt(rt2x00dev);
++		rt2800mmio_txstatus_interrupt(rt2x00dev, txstatus);
+ 		/*
+ 		 * Never disable the TX_FIFO_STATUS interrupt.
+ 		 */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -1000,6 +1000,11 @@ struct rt2x00_dev {
+ 	int rf_channel;
+ 
+ 	/*
++	 * Counter for tx status irq retries (rt2800pci).
++	 */
++	unsigned int txstatus_irq_retries;
++
++	/*
+ 	 * Protect the interrupt mask register.
+ 	 */
+ 	spinlock_t irqmask_lock;
diff --git a/package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch b/package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch
similarity index 97%
rename from package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch
rename to package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch
index f9d48b2b31..9d47076ff6 100644
--- a/package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch
+++ b/package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch
@@ -22,7 +22,7 @@
 +#endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -29,6 +29,7 @@
+@@ -40,6 +40,7 @@
  #include <linux/average.h>
  #include <linux/usb.h>
  #include <linux/clk.h>
diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
similarity index 89%
rename from package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
rename to package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
index 417ef32b3d..f95fa9540c 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -311,6 +311,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -298,6 +298,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -10,7 +10,7 @@
  RTL8180=
 --- a/drivers/net/wireless/ralink/rt2x00/Kconfig
 +++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
-@@ -70,6 +70,7 @@ config RT2800PCI
+@@ -69,6 +69,7 @@ config RT2800PCI
  	select RT2X00_LIB_MMIO
  	select RT2X00_LIB_PCI
  	select RT2X00_LIB_FIRMWARE
@@ -18,7 +18,7 @@
  	select RT2X00_LIB_CRYPTO
  	depends on CRC_CCITT
  	depends on EEPROM_93CX6
-@@ -216,6 +217,7 @@ config RT2800SOC
+@@ -215,6 +216,7 @@ config RT2800SOC
  	select RT2X00_LIB_MMIO
  	select RT2X00_LIB_CRYPTO
  	select RT2X00_LIB_FIRMWARE
@@ -26,7 +26,7 @@
  	select RT2800_LIB
  	select RT2800_LIB_MMIO
  	---help---
-@@ -266,6 +268,9 @@ config RT2X00_LIB_FIRMWARE
+@@ -265,6 +267,9 @@ config RT2X00_LIB_FIRMWARE
  config RT2X00_LIB_CRYPTO
  	bool
  
@@ -38,7 +38,7 @@
  	default y if (RT2X00_LIB=y && LEDS_CLASS=y) || (RT2X00_LIB=m && LEDS_CLASS!=n)
 --- a/drivers/net/wireless/ralink/rt2x00/Makefile
 +++ b/drivers/net/wireless/ralink/rt2x00/Makefile
-@@ -8,6 +8,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
+@@ -7,6 +7,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
  rt2x00lib-$(CPTCFG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
  rt2x00lib-$(CPTCFG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
  rt2x00lib-$(CPTCFG_RT2X00_LIB_LEDS)	+= rt2x00leds.o
@@ -48,7 +48,7 @@
  obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -37,6 +37,8 @@ struct rt2800_drv_data {
+@@ -48,6 +48,8 @@ struct rt2800_drv_data {
  	struct ieee80211_sta *wcid_to_sta[STA_IDS_SIZE];
  };
  
@@ -57,7 +57,7 @@
  struct rt2800_ops {
  	u32 (*register_read)(struct rt2x00_dev *rt2x00dev,
  			      const unsigned int offset);
-@@ -134,6 +136,15 @@ static inline int rt2800_read_eeprom(str
+@@ -145,6 +147,15 @@ static inline int rt2800_read_eeprom(str
  {
  	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
  
@@ -75,7 +75,7 @@
  
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -90,19 +90,6 @@ static int rt2800soc_set_device_state(st
+@@ -102,19 +102,6 @@ static int rt2800soc_set_device_state(st
  	return retval;
  }
  
@@ -95,7 +95,7 @@
  /* Firmware functions */
  static char *rt2800soc_get_firmware_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -166,7 +153,6 @@ static const struct rt2800_ops rt2800soc
+@@ -178,7 +165,6 @@ static const struct rt2800_ops rt2800soc
  	.register_multiread	= rt2x00mmio_register_multiread,
  	.register_multiwrite	= rt2x00mmio_register_multiwrite,
  	.regbusy_read		= rt2x00mmio_regbusy_read,
@@ -105,7 +105,7 @@
  	.drv_init_registers	= rt2800mmio_init_registers,
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -691,6 +691,7 @@ enum rt2x00_capability_flags {
+@@ -702,6 +702,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
  	REQUIRE_DELAYED_RFKILL,
@@ -113,7 +113,7 @@
  
  	/*
  	 * Capabilities
-@@ -966,6 +967,11 @@ struct rt2x00_dev {
+@@ -977,6 +978,11 @@ struct rt2x00_dev {
  	const struct firmware *fw;
  
  	/*
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1412,6 +1412,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1421,6 +1421,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1555,6 +1559,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1562,6 +1566,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
@@ -152,7 +152,7 @@
  
 --- /dev/null
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -0,0 +1,106 @@
+@@ -0,0 +1,105 @@
 +/*
 +	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
 +	Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
@@ -255,13 +255,12 @@
 +
 +void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
 +{
-+	if (rt2x00dev->eeprom_file && rt2x00dev->eeprom_file->size)
-+		release_firmware(rt2x00dev->eeprom_file);
++	release_firmware(rt2x00dev->eeprom_file);
 +	rt2x00dev->eeprom_file = NULL;
 +}
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
-@@ -286,6 +286,22 @@ static inline void rt2x00lib_free_firmwa
+@@ -297,6 +297,22 @@ static inline void rt2x00lib_free_firmwa
  #endif /* CPTCFG_RT2X00_LIB_FIRMWARE */
  
  /*
@@ -286,7 +285,7 @@
  #ifdef CPTCFG_RT2X00_LIB_DEBUGFS
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
-@@ -86,6 +86,7 @@ int rt2x00soc_probe(struct platform_devi
+@@ -97,6 +97,7 @@ int rt2x00soc_probe(struct platform_devi
  	if (IS_ERR(rt2x00dev->clk))
  		rt2x00dev->clk = NULL;
  
diff --git a/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/603-rt2x00-of_load_eeprom_filename.patch
similarity index 100%
rename from package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
rename to package/kernel/mac80211/patches/603-rt2x00-of_load_eeprom_filename.patch
diff --git a/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
similarity index 95%
rename from package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
rename to package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
index 08ca7c96fd..a98b49c541 100644
--- a/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+++ b/package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
@@ -12,7 +12,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/Kconfig
 +++ b/drivers/net/wireless/ralink/rt2x00/Kconfig
-@@ -220,6 +220,7 @@ config RT2800SOC
+@@ -219,6 +219,7 @@ config RT2800SOC
  	select RT2X00_LIB_EEPROM
  	select RT2800_LIB
  	select RT2800_LIB_MMIO
@@ -22,7 +22,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	  Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -26,11 +26,72 @@
+@@ -26,11 +26,73 @@
  
  #include <linux/kernel.h>
  #include <linux/module.h>
@@ -84,6 +84,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +			rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
 +
 +	rt2x00dev->eeprom_file = &mtd_fw;
++	mtd_fw.size = len;
 +	mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
 +
 +	dev_info(rt2x00dev->dev, "loaded eeprom from mtd device \"%s\"\n", part);
@@ -95,7 +96,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -58,6 +119,9 @@ static int rt2x00lib_request_eeprom_file
+@@ -58,6 +120,9 @@ static int rt2x00lib_request_eeprom_file
  	const char *ee_name;
  	int retval;
  
diff --git a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch
similarity index 92%
rename from package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
rename to package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch
index 3372e0b3ab..202dfc0b89 100644
--- a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -12,7 +12,7 @@
  #endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1015,6 +1015,22 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1026,6 +1026,22 @@ static int rt2x00lib_probe_hw_modes(stru
  	unsigned int num_rates;
  	unsigned int i;
  
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -398,6 +398,7 @@ struct hw_mode_spec {
+@@ -409,6 +409,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch
similarity index 89%
rename from package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
rename to package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch
index f694b061d8..b8b0188040 100644
--- a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
+++ b/package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -993,8 +993,13 @@ static void rt2x00lib_rate(struct ieee80
+@@ -1004,8 +1004,13 @@ static void rt2x00lib_rate(struct ieee80
  
  void rt2x00lib_set_mac_address(struct rt2x00_dev *rt2x00dev, u8 *eeprom_mac_addr)
  {
@@ -12,7 +12,7 @@
 +		ether_addr_copy(eeprom_mac_addr, pdata->mac_address);
 +
  	mac_addr = of_get_mac_address(rt2x00dev->dev->of_node);
- 	if (!IS_ERR(mac_addr))
+ 	if (mac_addr)
  		ether_addr_copy(eeprom_mac_addr, mac_addr);
 --- a/include/linux/rt2x00_platform.h
 +++ b/include/linux/rt2x00_platform.h
diff --git a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch
similarity index 91%
rename from package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
rename to package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch
index 07f7d34941..ca66aa8e3b 100644
--- a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
+++ b/package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1019,6 +1019,16 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1030,6 +1030,16 @@ static int rt2x00lib_probe_hw_modes(stru
  	struct ieee80211_rate *rates;
  	unsigned int num_rates;
  	unsigned int i;
diff --git a/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
similarity index 94%
rename from package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
rename to package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index 4cb892b3df..02b66e3bc0 100644
--- a/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -220,10 +220,17 @@ static int rt2800soc_probe(struct platfo
+@@ -234,10 +234,17 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
  }
  
diff --git a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
similarity index 89%
rename from package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
rename to package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
index 5ea402f5da..ad70aa7826 100644
--- a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -25,6 +25,7 @@
+@@ -36,6 +36,7 @@
  #include <linux/kernel.h>
  #include <linux/module.h>
  #include <linux/slab.h>
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9447,6 +9448,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9285,6 +9286,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
@@ -28,7 +28,7 @@
  
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00leds.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00leds.c
-@@ -98,6 +98,9 @@ static int rt2x00leds_register_led(struc
+@@ -109,6 +109,9 @@ static int rt2x00leds_register_led(struc
  	led->led_dev.name = name;
  	led->led_dev.brightness = LED_OFF;
  
diff --git a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch
similarity index 86%
rename from package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
rename to package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch
index 453129d66a..062b18a63b 100644
--- a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1350,7 +1350,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1361,7 +1361,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch b/package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
similarity index 58%
rename from package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
rename to package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
index 98eb8c0b7e..9fad80b672 100644
--- a/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
+++ b/package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
@@ -6,13 +6,8 @@ To: Stanislaw Gruszka <sgruszka@redhat.com>
 Cc: Helmut Schaa <helmut.schaa@googlemail.com>,
     linux-wireless@vger.kernel.org,
     Kalle Valo <kvalo@codeaurora.org>
-Content-Type: text/plain; charset="UTF-8"
-Content-Transfer-Encoding: quoted-printable
 
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
-Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
-[pozega.tomislav@gmail.com: use chanreg and dccal helpers.]
-
 ---
  drivers/net/wireless/ralink/rt2x00/rt2800.h    |  1 +
  drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 70 +++++++++++++++++++++++++-
@@ -20,7 +15,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -2739,6 +2739,7 @@ enum rt2800_eeprom_word {
+@@ -2749,6 +2749,7 @@ enum rt2800_eeprom_word {
  #define EEPROM_NIC_CONF2_RX_STREAM	FIELD16(0x000f)
  #define EEPROM_NIC_CONF2_TX_STREAM	FIELD16(0x00f0)
  #define EEPROM_NIC_CONF2_CRYSTAL	FIELD16(0x0600)
@@ -30,7 +25,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
   * EEPROM LNA
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4279,6 +4279,45 @@ static void rt2800_config_channel(struct
+@@ -4120,6 +4120,61 @@ static void rt2800_config_channel(struct
  		rt2800_iq_calibrate(rt2x00dev, rf->channel);
  	}
  
@@ -47,22 +42,38 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
 +			reg |= 0x00000101;
 +			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
 +
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 43, 0x73);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 43, 0x73);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 44, 0x73);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 44, 0x73);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 45, 0x73);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0x73);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 46, 0x27);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 46, 0x27);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0xC8);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0xC8);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 48, 0xA4);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 48, 0xA4);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 49, 0x05);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 49, 0x05);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 54, 0x27);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 54, 0x27);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 55, 0xC8);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 55, 0xC8);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 56, 0xA4);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 56, 0xA4);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 57, 0x05);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 57, 0x05);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 58, 0x27);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 58, 0x27);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 59, 0xC8);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 59, 0xC8);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 60, 0xA4);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 60, 0xA4);
++			rt2800_rfcsr_write_bank(rt2x00dev, 4, 61, 0x05);
++			rt2800_rfcsr_write_bank(rt2x00dev, 6, 61, 0x05);
++			rt2800_rfcsr_write_bank(rt2x00dev, 5, 05, 0x00);
++			rt2800_rfcsr_write_bank(rt2x00dev, 7, 05, 0x00);
 +
 +			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
 +					      0x36303636);
@@ -76,7 +87,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  	bbp = rt2800_bbp_read(rt2x00dev, 4);
  	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
  	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9476,7 +9515,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9314,7 +9369,8 @@ static int rt2800_init_eeprom(struct rt2
  	 */
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  
@@ -86,7 +97,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  		if (rt2x00_get_field16(eeprom,
  		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
  		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9487,6 +9527,18 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9325,6 +9381,18 @@ static int rt2800_init_eeprom(struct rt2
  			      &rt2x00dev->cap_flags);
  	}
  
diff --git a/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch b/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
new file mode 100644
index 0000000000..475fcbc223
--- /dev/null
+++ b/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
@@ -0,0 +1,132 @@
+From pozega.tomislav@gmail.com Thu May 18 12:42:27 2017
+Return-path: <pozega.tomislav@gmail.com>
+Envelope-to: daniel@makrotopia.org
+Delivery-date: Thu, 18 May 2017 12:42:27 +0200
+Received: from mail by fudo.makrotopia.org with sa-checked (Exim 4.88)
+	(envelope-from <pozega.tomislav@gmail.com>)
+	id 1dBIsy-00088b-PU
+	for daniel@makrotopia.org; Thu, 18 May 2017 12:42:27 +0200
+X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on fudo.makrotopia.org
+X-Spam-Level: 
+X-Spam-Status: No, score=-0.8 required=2.5 tests=DKIM_SIGNED,DKIM_VALID,
+	DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW shortcircuit=no
+	autolearn=ham autolearn_force=no version=3.4.1
+Received: from mail-oi0-x22a.google.com ([2607:f8b0:4003:c06::22a])
+	by fudo.makrotopia.org with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
+	 (Exim 4.88)
+	(envelope-from <pozega.tomislav@gmail.com>)
+	id 1dBIsv-00088Q-Dq
+	for daniel@makrotopia.org; Thu, 18 May 2017 12:42:24 +0200
+Received: by mail-oi0-x22a.google.com with SMTP id w10so48782189oif.0
+        for <daniel@makrotopia.org>; Thu, 18 May 2017 03:42:21 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20161025;
+        h=mime-version:from:date:message-id:subject:to;
+        bh=9dF7PHDassYY74+N6dAhmsL/B9i5oG3SEuMzHuazhJo=;
+        b=cBGJ44v+o4ASyCPmHCBRMmRYnJCv4Gx6lzDiScKn0XqYmNHYpZTPg5cAY1GZFUhHdz
+         9QT5fzhJKFikBliSuJc/7/pI8KzvyEAdvawiWA7/5fbeiTZ+zjJnzRVGezqkYDKxjR6u
+         7TsoJxR2/oFwo7bOFlThhee+Nwf7qaX8AVal7JdkqovekX79JQ5vsKAa4LapDp7Cl0wr
+         KCh0WRUHGEgpTLJFyQ3ThPmLqc8bhmu+6/V/LJ53VOY7uksZHMhvaKkk9vDCoOuPnBMK
+         Cj2/c7z9RTErz/xlHg6HxnBe/pPc31XUsuPJUleOEdZASczPsreEEKacKCONVlP1wjAB
+         iOkA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20161025;
+        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
+        bh=9dF7PHDassYY74+N6dAhmsL/B9i5oG3SEuMzHuazhJo=;
+        b=LJAe4ZwS9aNJypROW7j+I9aNfRBWyDYy0c8ABnDbLrIoF9P2AA/Vs/Cli5f7GjaAxr
+         1JCx602ach+7R7QjQq/nqNmLuhRCfSvB0TGrq4R4v+CJ4ADO541+PddnFiU1dlIXQRP2
+         TE2FOydSO0FGJBMg+kY0eFiidBtYj1T5x7IHAhQzufiuiF6/1xZS8h61CYJjLzt/aR5y
+         JxOxsVvu3W2YQ0T5wKmAPlKtarFH6ZZgs446bRYt1MX5KAWzIoBM1+IPMMv7lSCpCaDR
+         fwH05aDyaJW2IzXH5R9Tq7gGYycYjx/SnO7JupJXJVvOzKgBJxp60JwJhCfqCwESDuuD
+         8nNA==
+X-Gm-Message-State: AODbwcDOpdFZgbxAxFsVsqFdCBN3pRGDvEclZ1heVg2byNZ9BuG5kqJg
+	GvZ9x4NGt0v8lVGa3esDw0N1KiJENg==
+X-Received: by 10.157.17.217 with SMTP id y25mr1310632oty.137.1495104134863;
+ Thu, 18 May 2017 03:42:14 -0700 (PDT)
+MIME-Version: 1.0
+Received: by 10.157.0.105 with HTTP; Thu, 18 May 2017 03:42:14 -0700 (PDT)
+From: Tom Psyborg <pozega.tomislav@gmail.com>
+Date: Thu, 18 May 2017 12:42:14 +0200
+Message-ID: <CAKR_QVJBSKw2uCY4RbHZPvbGkMcvnBh+j6F+9t93mG3BakjX3Q@mail.gmail.com>
+Subject: [PATCH] rt2x00: remove unneccesary code
+To: linux-wireless <linux-wireless@vger.kernel.org>, 
+	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Arnd Bergmann <arnd@arndb.de>, 
+	Jes Sorensen <jes.sorensen@gmail.com>, Stanislaw Gruszka <sgruszka@redhat.com>, 
+	David Miller <davem@davemloft.net>, Helmut Schaa <helmut.schaa@googlemail.com>, 
+	Kalle Valo <kvalo@codeaurora.org>, Daniel Golle <daniel@makrotopia.org>, 
+	Mathias Kresin <dev@kresin.me>, Johannes Berg <johannes.berg@intel.com>, 
+	Serge Vasilugin <vasilugin@yandex.ru>, Roman Yeryomin <roman@advem.lv>, 
+	Networking <netdev@vger.kernel.org>
+Content-Type: multipart/alternative; boundary="94eb2c1905d2dc6361054fca0e62"
+Status: RO
+Content-Length: 11079
+Lines: 178
+
+--94eb2c1905d2dc6361054fca0e62
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: quoted-printable
+
+Use chanreg and dccal helpers to reduce the size of ePA code.
+
+Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+[daniel@makrotopia.org: fixed white-space so patch applies]
+---
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4133,38 +4133,22 @@ static void rt2800_config_channel(struct
+ 			reg |= 0x00000101;
+ 			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
+ 
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 43, 0x73);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 43, 0x73);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 44, 0x73);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 44, 0x73);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 45, 0x73);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0x73);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 46, 0x27);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 46, 0x27);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0xC8);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0xC8);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 48, 0xA4);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 48, 0xA4);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 49, 0x05);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 49, 0x05);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 54, 0x27);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 54, 0x27);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 55, 0xC8);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 55, 0xC8);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 56, 0xA4);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 56, 0xA4);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 57, 0x05);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 57, 0x05);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 58, 0x27);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 58, 0x27);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 59, 0xC8);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 59, 0xC8);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 60, 0xA4);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 60, 0xA4);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 4, 61, 0x05);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 6, 61, 0x05);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 5, 05, 0x00);
+-			rt2800_rfcsr_write_bank(rt2x00dev, 7, 05, 0x00);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
+ 
+ 			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
+ 					      0x36303636);
diff --git a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
similarity index 87%
rename from package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
rename to package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
index cfa40e1bd2..a901a44ba4 100644
--- a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5694,6 +5694,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5681,6 +5681,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
similarity index 78%
rename from package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
rename to package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
index 90adb66bb1..885bc246ba 100644
--- a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2041,6 +2041,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2040,6 +2040,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
@@ -11,7 +11,7 @@
   err_wiphy_new:
 --- a/drivers/net/wireless/marvell/libertas/main.c
 +++ b/drivers/net/wireless/marvell/libertas/main.c
-@@ -935,6 +935,7 @@ struct lbs_private *lbs_add_card(void *c
+@@ -930,6 +930,7 @@ struct lbs_private *lbs_add_card(void *c
  		goto err_adapter;
  	}
  
diff --git a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
similarity index 85%
rename from package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
rename to package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
index f1966d88e6..089ad2fe78 100644
--- a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2117,6 +2117,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2116,6 +2116,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch b/package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
similarity index 88%
rename from package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
rename to package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
index a5706374f1..5ce49d3a07 100644
--- a/package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
+++ b/package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/b43.h
 +++ b/drivers/net/wireless/broadcom/b43/b43.h
-@@ -840,6 +840,7 @@ struct b43_wldev {
+@@ -839,6 +839,7 @@ struct b43_wldev {
  	bool qos_enabled;		/* TRUE, if QoS is used. */
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
@@ -10,7 +10,7 @@
  	struct b43_phy phy;
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -72,6 +72,11 @@ MODULE_FIRMWARE("b43/ucode40.fw");
+@@ -85,6 +85,11 @@ MODULE_FIRMWARE("b43/ucode40.fw");
  MODULE_FIRMWARE("b43/ucode42.fw");
  MODULE_FIRMWARE("b43/ucode9.fw");
  
@@ -22,7 +22,7 @@
  static int modparam_bad_frames_preempt;
  module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  MODULE_PARM_DESC(bad_frames_preempt,
-@@ -2872,10 +2877,10 @@ static int b43_gpio_init(struct b43_wlde
+@@ -2892,10 +2897,10 @@ static int b43_gpio_init(struct b43_wlde
  	u32 mask, set;
  
  	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
diff --git a/package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch b/package/kernel/mac80211/patches/811-b43_no_pio.patch
similarity index 86%
rename from package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
rename to package/kernel/mac80211/patches/811-b43_no_pio.patch
index a8dbefb5d9..d23387c8cd 100644
--- a/package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
+++ b/package/kernel/mac80211/patches/811-b43_no_pio.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/Makefile
 +++ b/drivers/net/wireless/broadcom/b43/Makefile
-@@ -18,7 +18,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
+@@ -17,7 +17,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
  b43-y				+= sysfs.o
  b43-y				+= xmit.o
  b43-y				+= dma.o
@@ -11,7 +11,7 @@
  b43-$(CPTCFG_B43_LEDS)		+= leds.o
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -2000,10 +2000,12 @@ static void b43_do_interrupt_thread(stru
+@@ -2018,10 +2018,12 @@ static void b43_do_interrupt_thread(stru
  			dma_reason[0], dma_reason[1],
  			dma_reason[2], dma_reason[3],
  			dma_reason[4], dma_reason[5]);
@@ -26,7 +26,7 @@
  	}
 --- a/drivers/net/wireless/broadcom/b43/pio.h
 +++ b/drivers/net/wireless/broadcom/b43/pio.h
-@@ -151,7 +151,7 @@ static inline void b43_piorx_write32(str
+@@ -150,7 +150,7 @@ static inline void b43_piorx_write32(str
  	b43_write32(q->dev, q->mmio_base + offset, value);
  }
  
@@ -35,7 +35,7 @@
  int b43_pio_init(struct b43_wldev *dev);
  void b43_pio_free(struct b43_wldev *dev);
  
-@@ -162,5 +162,37 @@ void b43_pio_rx(struct b43_pio_rxqueue *
+@@ -161,5 +161,37 @@ void b43_pio_rx(struct b43_pio_rxqueue *
  
  void b43_pio_tx_suspend(struct b43_wldev *dev);
  void b43_pio_tx_resume(struct b43_wldev *dev);
@@ -75,12 +75,12 @@
  #endif /* B43_PIO_H_ */
 --- a/drivers/net/wireless/broadcom/b43/Kconfig
 +++ b/drivers/net/wireless/broadcom/b43/Kconfig
-@@ -100,7 +100,7 @@ config B43_BCMA_PIO
+@@ -98,7 +98,7 @@ config B43_BCMA_PIO
  	default y
  
  config B43_PIO
 -	bool
 +	bool "Broadcom 43xx PIO support"
  	depends on B43 && B43_SSB
- 	depends on SSB_BLOCKIO
+ 	select SSB_BLOCKIO
  	default y
diff --git a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
similarity index 86%
rename from package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
rename to package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
index 6e3554701b..932c83b48e 100644
--- a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -1642,7 +1642,7 @@ static void b43_write_beacon_template(st
+@@ -1658,7 +1658,7 @@ static void b43_write_beacon_template(st
  				  len, ram_offset, shm_size_offset, rate);
  
  	/* Write the PHY TX control parameters. */
@@ -9,7 +9,7 @@
  	antenna = b43_antenna_to_phyctl(antenna);
  	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
  	/* We can't send beacons with short preamble. Would get PHY errors. */
-@@ -3287,8 +3287,8 @@ static int b43_chip_init(struct b43_wlde
+@@ -3307,8 +3307,8 @@ static int b43_chip_init(struct b43_wlde
  
  	/* Select the antennae */
  	if (phy->ops->set_rx_antenna)
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3988,7 +3988,6 @@ static int b43_op_config(struct ieee8021
+@@ -4008,7 +4008,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev = wl->current_dev;
  	struct b43_phy *phy = &dev->phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  
  	mutex_lock(&wl->mutex);
-@@ -4031,11 +4030,9 @@ static int b43_op_config(struct ieee8021
+@@ -4051,11 +4050,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5179,6 +5176,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5199,6 +5196,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -5200,6 +5238,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5220,6 +5258,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5501,6 +5541,8 @@ static int b43_one_core_attach(struct b4
+@@ -5523,6 +5563,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,19 +108,19 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5595,6 +5637,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5617,6 +5659,9 @@ static struct b43_wl *b43_wireless_init(
  
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
 +	hw->wiphy->available_antennas_rx = 0x3;
 +	hw->wiphy->available_antennas_tx = 0x3;
 +
- 	wl->hw_registered = false;
+ 	wl->hw_registred = false;
  	hw->max_rates = 2;
  	SET_IEEE80211_DEV(hw, dev->dev);
 --- a/drivers/net/wireless/broadcom/b43/b43.h
 +++ b/drivers/net/wireless/broadcom/b43/b43.h
-@@ -841,6 +841,8 @@ struct b43_wldev {
+@@ -840,6 +840,8 @@ struct b43_wldev {
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
  	int gpiomask;			/* GPIO LED mask as a module parameter */
diff --git a/package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch b/package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
similarity index 88%
rename from package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
rename to package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
index 85c52c0282..5899706896 100644
--- a/package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
+++ b/package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/dma.h
 +++ b/drivers/net/wireless/broadcom/b43/dma.h
-@@ -170,7 +170,7 @@ struct b43_dmadesc_generic {
+@@ -169,7 +169,7 @@ struct b43_dmadesc_generic {
  
  /* DMA engine tuning knobs */
  #define B43_TXRING_SLOTS		256
diff --git a/package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch b/package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch
similarity index 90%
rename from package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch
rename to package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch
index bd163be960..03f4524c88 100644
--- a/package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch
+++ b/package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -2889,6 +2889,14 @@ static int b43_gpio_init(struct b43_wlde
+@@ -2909,6 +2909,14 @@ static int b43_gpio_init(struct b43_wlde
  	} else if (dev->dev->chip_id == 0x5354) {
  		/* Don't allow overtaking buttons GPIOs */
  		set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
diff --git a/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch
similarity index 90%
rename from package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
rename to package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch
index a8eae19413..f07151aa4e 100644
--- a/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
+++ b/package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -114,7 +114,7 @@ static int b43_modparam_pio = 0;
+@@ -127,7 +127,7 @@ static int b43_modparam_pio = 0;
  module_param_named(pio, b43_modparam_pio, int, 0644);
  MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
  
diff --git a/package/kernel/mac80211/patches/brcm/850-brcmsmac-remove-extra-regulation-restriction.patch b/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
similarity index 100%
rename from package/kernel/mac80211/patches/brcm/850-brcmsmac-remove-extra-regulation-restriction.patch
rename to package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
diff --git a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
similarity index 83%
rename from package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
rename to package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
index 9af8df142f..e7385513db 100644
--- a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
+++ b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1425,6 +1425,7 @@ int __init brcmf_core_init(void)
+@@ -1434,6 +1434,7 @@ int __init brcmf_core_init(void)
  {
  	if (!schedule_work(&brcmf_driver_work))
  		return -EBUSY;
@@ -23,7 +23,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  }
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -431,6 +431,7 @@ struct brcmf_fw {
+@@ -441,6 +441,7 @@ struct brcmf_fw {
  	struct brcmf_fw_request *req;
  	u32 curpos;
  	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
@@ -31,7 +31,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  };
  
  static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
-@@ -638,6 +639,8 @@ static void brcmf_fw_request_done(const
+@@ -574,6 +575,8 @@ static void brcmf_fw_request_done(const
  		fwctx->req = NULL;
  	}
  	fwctx->done(fwctx->dev, ret, fwctx->req);
@@ -40,7 +40,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  	kfree(fwctx);
  }
  
-@@ -662,6 +665,8 @@ int brcmf_fw_get_firmwares(struct device
+@@ -598,6 +601,8 @@ int brcmf_fw_get_firmwares(struct device
  {
  	struct brcmf_fw_item *first = &req->items[0];
  	struct brcmf_fw *fwctx;
@@ -49,21 +49,19 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  	int ret;
  
  	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
-@@ -678,6 +683,9 @@ int brcmf_fw_get_firmwares(struct device
- 	fwctx->dev = dev;
+@@ -615,12 +620,20 @@ int brcmf_fw_get_firmwares(struct device
  	fwctx->req = req;
  	fwctx->done = fw_cb;
-+ 
+ 
 +	init_completion(&completion);
 +	fwctx->completion = &completion;
- 
++
  	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
  				      fwctx->dev, GFP_KERNEL, fwctx,
-@@ -685,6 +693,12 @@ int brcmf_fw_get_firmwares(struct device
+ 				      brcmf_fw_request_done);
  	if (ret < 0)
  		brcmf_fw_request_done(NULL, fwctx);
  
-+
 +	time_left = wait_for_completion_timeout(&completion,
 +						msecs_to_jiffies(5000));
 +	if (!time_left && fwctx)
diff --git a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
similarity index 96%
rename from package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
rename to package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
index 5f0fa7faab..912fe8ca14 100644
--- a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
+++ b/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -628,8 +628,36 @@ static struct wireless_dev *brcmf_cfg802
+@@ -639,8 +639,36 @@ static struct wireless_dev *brcmf_cfg802
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_pub *drvr = cfg->pub;
  	struct wireless_dev *wdev;
diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
similarity index 93%
rename from package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
rename to package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
index 6412653a3a..578b3e0399 100644
--- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2795,6 +2795,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2798,6 +2798,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
similarity index 95%
rename from package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
rename to package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
index 2613171a86..5bb7015810 100644
--- a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
+++ b/package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
@@ -12,7 +12,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -12,6 +12,36 @@
+@@ -23,6 +23,36 @@
  #include "common.h"
  #include "of.h"
  
@@ -49,7 +49,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  		    struct brcmf_mp_device *settings)
  {
-@@ -30,6 +60,8 @@ void brcmf_of_probe(struct device *dev,
+@@ -41,6 +71,8 @@ void brcmf_of_probe(struct device *dev,
  		of_node_put(root);
  	}
  
diff --git a/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch b/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
similarity index 87%
rename from package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
rename to package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
index fe79c40c11..417b6ec869 100644
--- a/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
+++ b/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
@@ -9,7 +9,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -59,7 +59,11 @@ static int brcmf_fcmode;
+@@ -70,7 +70,11 @@ static int brcmf_fcmode;
  module_param_named(fcmode, brcmf_fcmode, int, 0);
  MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
  
@@ -18,6 +18,6 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 +#else
  static int brcmf_roamoff;
 +#endif
- module_param_named(roamoff, brcmf_roamoff, int, 0400);
+ module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
  MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
  
diff --git a/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch b/package/kernel/mac80211/patches/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
similarity index 91%
rename from package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
rename to package/kernel/mac80211/patches/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
index 9805634114..c7b25714fb 100644
--- a/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
+++ b/package/kernel/mac80211/patches/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
@@ -22,7 +22,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -696,8 +696,10 @@ static u32 brcmf_chip_tcm_rambase(struct
+@@ -700,8 +700,10 @@ static u32 brcmf_chip_tcm_rambase(struct
  	return 0;
  }
  
@@ -34,7 +34,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  	struct brcmf_core_priv *mem_core;
  	struct brcmf_core *mem;
  
-@@ -979,7 +981,7 @@ static int brcmf_chip_recognition(struct
+@@ -981,7 +983,7 @@ static int brcmf_chip_recognition(struct
  		brcmf_chip_set_passive(&ci->pub);
  	}
  
@@ -45,7 +45,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  static void brcmf_chip_disable_arm(struct brcmf_chip_priv *chip, u16 id)
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-@@ -69,6 +69,7 @@ struct brcmf_buscore_ops {
+@@ -80,6 +80,7 @@ struct brcmf_buscore_ops {
  	void (*activate)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
  };
  
@@ -55,7 +55,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_chip_detach(struct brcmf_chip *chip);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1770,6 +1770,12 @@ static void brcmf_pcie_setup(struct devi
+@@ -1780,6 +1780,12 @@ static void brcmf_pcie_setup(struct devi
  	nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len;
  	kfree(fwreq);
  
diff --git a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
index 3a16b08a44..2c466a300c 100644
--- a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
@@ -14,8 +14,8 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3003,6 +3003,16 @@ int ath10k_core_register(struct ath10k *
- 
+@@ -2494,6 +2494,16 @@ int ath10k_core_register(struct ath10k *
+ 	ar->chip_id = chip_id;
  	queue_work(ar->workqueue, &ar->register_work);
  
 +	/* OpenWrt requires all PHYs to be initialized to create the
diff --git a/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
similarity index 84%
rename from package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
rename to package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
index 352a49c4c3..21e7359bc9 100644
--- a/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8483,6 +8483,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -8080,6 +8080,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,9 +22,9 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -8806,6 +8821,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8352,6 +8367,12 @@ int ath10k_mac_register(struct ath10k *a
  
- 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
+ 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
 +#ifdef CPTCFG_MAC80211_LEDS
 +	ieee80211_create_tpt_led_trigger(ar->hw,
diff --git a/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch b/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
new file mode 100644
index 0000000000..ea30a9dfd6
--- /dev/null
+++ b/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -770,7 +770,7 @@ static int ath10k_core_get_board_id_from
+ 	if (ret) {
+ 		ath10k_err(ar, "could not execute otp for board id check: %d\n",
+ 			   ret);
+-		return ret;
++		return -EOPNOTSUPP;
+ 	}
+ 
+ 	board_id = MS(result, ATH10K_BMI_BOARD_ID_FROM_OTP);
diff --git a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
similarity index 75%
rename from package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
index f3130f7ae7..a958c78b43 100644
--- a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6279,6 +6279,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6266,6 +6266,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6312,8 +6314,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6299,8 +6301,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch b/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
new file mode 100644
index 0000000000..e82db4d67e
--- /dev/null
+++ b/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
@@ -0,0 +1,37 @@
+From 4628257bf3006c18e0037459922624f02a138aed Mon Sep 17 00:00:00 2001
+From: Weixiao Zhang <waveletboy@gmail.com>
+Date: Thu, 16 Nov 2017 01:59:55 -0600
+Subject: [PATCH] mwl8k: Expand non-DFS 5G channels
+
+Add non-DFS 5G upper channels (149-165) besides existed 4 lower channels
+(36, 40, 44, 48).
+
+Signed-off-by: Weixiao Zhang <waveletboy@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/marvell/mwl8k.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -199,7 +199,7 @@ struct mwl8k_priv {
+ 	struct ieee80211_channel channels_24[14];
+ 	struct ieee80211_rate rates_24[13];
+ 	struct ieee80211_supported_band band_50;
+-	struct ieee80211_channel channels_50[4];
++	struct ieee80211_channel channels_50[9];
+ 	struct ieee80211_rate rates_50[8];
+ 	u32 ap_macids_supported;
+ 	u32 sta_macids_supported;
+@@ -383,6 +383,11 @@ static const struct ieee80211_channel mw
+ 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
+ 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
+ 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5745, .hw_value = 149, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5765, .hw_value = 153, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5785, .hw_value = 157, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5805, .hw_value = 161, },
++	{ .band = NL80211_BAND_5GHZ, .center_freq = 5825, .hw_value = 165, },
+ };
+ 
+ static const struct ieee80211_rate mwl8k_rates_50[] = {
diff --git a/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
new file mode 100644
index 0000000000..914472aab9
--- /dev/null
+++ b/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath10k/htt.h
++++ b/drivers/net/wireless/ath/ath10k/htt.h
+@@ -200,7 +200,7 @@ enum htt_rx_ring_flags {
+ };
+ 
+ #define HTT_RX_RING_SIZE_MIN 128
+-#define HTT_RX_RING_SIZE_MAX 2048
++#define HTT_RX_RING_SIZE_MAX 512
+ 
+ struct htt_rx_ring_setup_ring {
+ 	__le32 fw_idx_shadow_reg_paddr;
diff --git a/package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch b/package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
similarity index 75%
rename from package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
rename to package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
index 0c25fb3f04..a101282d07 100644
--- a/package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
+++ b/package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/pci.c
 +++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -131,7 +131,7 @@ static struct ce_attr host_ce_config_wla
+@@ -128,7 +128,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
@@ -9,7 +9,7 @@
  		.recv_cb = ath10k_pci_htt_htc_rx_cb,
  	},
  
-@@ -140,7 +140,7 @@ static struct ce_attr host_ce_config_wla
+@@ -137,7 +137,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
@@ -18,7 +18,7 @@
  		.recv_cb = ath10k_pci_htc_rx_cb,
  	},
  
-@@ -167,7 +167,7 @@ static struct ce_attr host_ce_config_wla
+@@ -164,7 +164,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 512,
@@ -27,7 +27,7 @@
  		.recv_cb = ath10k_pci_htt_rx_cb,
  	},
  
-@@ -192,7 +192,7 @@ static struct ce_attr host_ce_config_wla
+@@ -189,7 +189,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
diff --git a/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off b/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
new file mode 100644
index 0000000000..3b139ee326
--- /dev/null
+++ b/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
@@ -0,0 +1,93 @@
+From e6b3b2ed3d270b3c7080c9cf7d28636dc74b0387 Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <amit.karwar@redpinesignals.com>
+Date: Wed, 1 Nov 2017 17:42:45 +0530
+Subject: rsi: fix kbuild reported build errors with CONFIG_PM off
+
+Some wowlan related code was outside CONFIG_PM flag which caused these
+build errors. They are fixed by moving that code under CONFIG_PM flag.
+
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Fixes: ef71ed0608c ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
+Fixes: a24e35fcee0 ("rsi: sdio: Add WOWLAN support for S4 hibernate state")
+Fixes: e1ced6422a3 ("rsi: sdio: add WOWLAN support for S3 suspend state")
+Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_mac80211.c | 5 ++++-
+ drivers/net/wireless/rsi/rsi_91x_mgmt.c     | 2 ++
+ drivers/net/wireless/rsi/rsi_common.h       | 2 ++
+ drivers/net/wireless/rsi/rsi_mgmt.h         | 2 ++
+ 4 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -1752,6 +1752,7 @@ static int rsi_mac80211_cancel_roc(struc
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM
+ static const struct wiphy_wowlan_support rsi_wowlan_support = {
+ 	.flags = WIPHY_WOWLAN_ANY |
+ 		 WIPHY_WOWLAN_MAGIC_PKT |
+@@ -1824,7 +1825,6 @@ int rsi_config_wowlan(struct rsi_hw *ada
+ }
+ EXPORT_SYMBOL(rsi_config_wowlan);
+ 
+-#ifdef CONFIG_PM
+ static int rsi_mac80211_suspend(struct ieee80211_hw *hw,
+ 				struct cfg80211_wowlan *wowlan)
+ {
+@@ -1977,7 +1977,10 @@ int rsi_mac80211_attach(struct rsi_commo
+ 	wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER;
+ 	wiphy->reg_notifier = rsi_reg_notify;
+ 
++#ifdef CONFIG_PM
+ 	wiphy->wowlan = &rsi_wowlan_support;
++#endif
++
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
+ 
+ 	/* Wi-Fi direct parameters */
+--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+@@ -1597,6 +1597,7 @@ static int rsi_send_beacon(struct rsi_co
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM
+ int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
+ 			    u16 sleep_status)
+ {
+@@ -1630,6 +1631,7 @@ int rsi_send_wowlan_request(struct rsi_c
+ 
+ 	return rsi_send_internal_mgmt_frame(common, skb);
+ }
++#endif
+ 
+ /**
+  * rsi_handle_ta_confirm_type() - This function handles the confirm frames.
+--- a/drivers/net/wireless/rsi/rsi_common.h
++++ b/drivers/net/wireless/rsi/rsi_common.h
+@@ -83,7 +83,9 @@ u16 rsi_get_connected_channel(struct iee
+ struct rsi_hw *rsi_91x_init(void);
+ void rsi_91x_deinit(struct rsi_hw *adapter);
+ int rsi_read_pkt(struct rsi_common *common, s32 rcv_pkt_len);
++#ifdef CONFIG_PM
+ int rsi_config_wowlan(struct rsi_hw *adapter, struct cfg80211_wowlan *wowlan);
++#endif
+ struct rsi_sta *rsi_find_sta(struct rsi_common *common, u8 *mac_addr);
+ struct ieee80211_vif *rsi_get_vif(struct rsi_hw *adapter, u8 *mac);
+ void rsi_roc_timeout(struct timer_list *t);
+--- a/drivers/net/wireless/rsi/rsi_mgmt.h
++++ b/drivers/net/wireless/rsi/rsi_mgmt.h
+@@ -668,8 +668,10 @@ int rsi_band_check(struct rsi_common *co
+ int rsi_send_rx_filter_frame(struct rsi_common *common, u16 rx_filter_word);
+ int rsi_send_radio_params_update(struct rsi_common *common);
+ int rsi_set_antenna(struct rsi_common *common, u8 antenna);
++#ifdef CONFIG_PM
+ int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
+ 			    u16 sleep_status);
++#endif
+ int rsi_send_ps_request(struct rsi_hw *adapter, bool enable,
+ 			struct ieee80211_vif *vif);
+ #endif
diff --git a/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch b/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
new file mode 100644
index 0000000000..499b4ee7fc
--- /dev/null
+++ b/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
@@ -0,0 +1,96 @@
+From 39f1332c526cd9d6de59a72520e8334e54b62cda Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <amit.karwar@redpinesignals.com>
+Date: Wed, 1 Nov 2017 17:42:44 +0530
+Subject: rsi: move rsi_sdio_reinit_device() out of CONFIG_PM
+
+This function is generic. It doesn't contain wowlan specific code.
+It should not be under CONFIG_PM. This patch resolves compilation
+errors observed when CONFIG_PM flag is disabled.
+
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Fixes: ef71ed0608c ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
+Fixes: a24e35fcee0 ("rsi: sdio: Add WOWLAN support for S4 hibernate state")
+Fixes: e1ced6422a3 ("rsi: sdio: add WOWLAN support for S3 suspend state")
+Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_sdio.c | 52 ++++++++++++++++-----------------
+ drivers/net/wireless/rsi/rsi_sdio.h     |  1 -
+ 2 files changed, 26 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -871,6 +871,32 @@ fail:
+ 	return status;
+ }
+ 
++static int rsi_sdio_reinit_device(struct rsi_hw *adapter)
++{
++	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
++	struct sdio_func *pfunction = sdev->pfunction;
++	int ii;
++
++	for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
++		skb_queue_purge(&adapter->priv->tx_queue[ii]);
++
++	/* Initialize device again */
++	sdio_claim_host(pfunction);
++
++	sdio_release_irq(pfunction);
++	rsi_reset_card(pfunction);
++
++	sdio_enable_func(pfunction);
++	rsi_setupcard(adapter);
++	rsi_init_sdio_slave_regs(adapter);
++	sdio_claim_irq(pfunction, rsi_handle_interrupt);
++	rsi_hal_device_init(adapter);
++
++	sdio_release_host(pfunction);
++
++	return 0;
++}
++
+ static struct rsi_host_intf_ops sdio_host_intf_ops = {
+ 	.write_pkt		= rsi_sdio_host_intf_write_pkt,
+ 	.read_pkt		= rsi_sdio_host_intf_read_pkt,
+@@ -1281,32 +1307,6 @@ static void rsi_shutdown(struct device *
+ 	rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n");
+ }
+ 
+-int rsi_sdio_reinit_device(struct rsi_hw *adapter)
+-{
+-	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
+-	struct sdio_func *pfunction = sdev->pfunction;
+-	int ii;
+-
+-	for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
+-		skb_queue_purge(&adapter->priv->tx_queue[ii]);
+-
+-	/* Initialize device again */
+-	sdio_claim_host(pfunction);
+-
+-	sdio_release_irq(pfunction);
+-	rsi_reset_card(pfunction);
+-
+-	sdio_enable_func(pfunction);
+-	rsi_setupcard(adapter);
+-	rsi_init_sdio_slave_regs(adapter);
+-	sdio_claim_irq(pfunction, rsi_handle_interrupt);
+-	rsi_hal_device_init(adapter);
+-
+-	sdio_release_host(pfunction);
+-
+-	return 0;
+-}
+-
+ static int rsi_restore(struct device *dev)
+ {
+ 	struct sdio_func *pfunction = dev_to_sdio_func(dev);
+--- a/drivers/net/wireless/rsi/rsi_sdio.h
++++ b/drivers/net/wireless/rsi/rsi_sdio.h
+@@ -131,5 +131,4 @@ int rsi_sdio_master_access_msword(struct
+ void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit);
+ int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter);
+ int rsi_sdio_check_buffer_status(struct rsi_hw *adapter, u8 q_num);
+-int rsi_sdio_reinit_device(struct rsi_hw *adapter);
+ #endif
diff --git a/package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch b/package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
similarity index 55%
rename from package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
rename to package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
index df4223fcb8..9dceea8f41 100644
--- a/package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
+++ b/package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
@@ -1,29 +1,34 @@
-From: Sebastian Gottschall <s.gottschall@dd-wrt.com>
+From: Sebastian Gottschall <s.gottsch...@dd-wrt.com>
 
-current handling of peer_bw_rxnss_override parameter is based on guessing the VHT160/8080 capability by rx rate. this is wrong and may lead
-to a non initialized peer_bw_rxnss_override parameter which is required since VHT160 operation mode only supports 2x2 chainmasks in addition the original code
+current handling of peer_bw_rxnss_override parameter is based on guessing the 
+VHT160/8080 capability by rx rate. this is wrong and may lead
+to a non initialized peer_bw_rxnss_override parameter which is required since 
+VHT160 operation mode only supports 2x2 chainmasks in addition the original code
 initialized the parameter with wrong masked values.
-This patch uses the peer phymode and peer nss information for correct initialisation of the peer_bw_rxnss_override parameter.
-if this peer information is not available, we initialize the parameter by minimum nss which is suggested by QCA as temporary workaround according
+This patch uses the peer phymode and peer nss information for correct 
+initialisation of the peer_bw_rxnss_override parameter.
+if this peer information is not available, we initialize the parameter by 
+minimum nss which is suggested by QCA as temporary workaround according
 to the QCA sourcecodes.
 
-Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
+Signed-off-by: Sebastian Gottschall <s.gottsch...@dd-wrt.com>
 
 v2: remove debug messages
 v3: apply some cosmetics, update documentation
-v4: fix compile warning and truncate nss to maximum of 2x2 since current chipsets only support 2x2 at vht160
+v4: fix compile warning and truncate nss to maximum of 2x2 since current 
+chipsets only support 2x2 at vht160
 v5: handle maximum nss for chipsets supportig vht160 with 1x1 only
-v7: use more simple code variant and take care about hw/sw chainmask configuration
-v8: fix some code style issues
-v9: use SM/MS macros from code.h to simplify shift/mask handling
+v7: use more simple code variant and take care about hw/sw chainmask 
+configuration
 ---
- drivers/net/wireless/ath/ath10k/mac.c | 54 +++++++++++++++++++--------
- drivers/net/wireless/ath/ath10k/wmi.c |  7 +---
- drivers/net/wireless/ath/ath10k/wmi.h | 14 ++++++-
- 3 files changed, 52 insertions(+), 23 deletions(-)
+ drivers/net/wireless/ath/ath10k/mac.c | 40 +++++++++++++++------------
+ drivers/net/wireless/ath/ath10k/wmi.c |  7 +----
+ drivers/net/wireless/ath/ath10k/wmi.h | 14 +++++++++-
+ 3 files changed, 36 insertions(+), 25 deletions(-)
+
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -2475,7 +2475,7 @@ static void ath10k_peer_assoc_h_vht(stru
+@@ -2466,7 +2466,7 @@ static void ath10k_peer_assoc_h_vht(stru
  	const u16 *vht_mcs_mask;
  	u8 ampdu_factor;
  	u8 max_nss, vht_mcs;
@@ -32,7 +37,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  
  	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
  		return;
-@@ -2535,23 +2535,45 @@ static void ath10k_peer_assoc_h_vht(stru
+@@ -2526,23 +2526,27 @@ static void ath10k_peer_assoc_h_vht(stru
  		__le16_to_cpu(vht_cap->vht_mcs.tx_highest);
  	arg->peer_vht_rates.tx_mcs_set = ath10k_peer_assoc_h_vht_limit(
  		__le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
@@ -41,10 +46,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  
 -	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
 -		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
-+	/* only local 4x4 configuration do support 2x2 for VHT160,
-+	 * everything else must use 1x1 
-+	 */
- 
+-
 -	if (arg->peer_vht_rates.rx_max_rate &&
 -	    (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK)) {
 -		switch (arg->peer_vht_rates.rx_max_rate) {
@@ -57,42 +59,28 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
 -			arg->peer_bw_rxnss_override = 1;
 -			break;
 -		}
++	/* only 4x4 configuration do support 2x2 for VHT160, everything else must use 1x1 */
 +	if (ar->cfg_rx_chainmask == 15)
-+		nss160 = arg->peer_num_spatial_streams <= 2 ? 1 : 2;
++		nss160 = arg->peer_num_spatial_streams <= 2 ? arg->peer_num_spatial_streams : 2;
 +
-+	/* if peer provides 1x1 nss160 information using max rate
-+	 * vht information, we reduce local nss160 to 1x1.
-+	 * consider that it has been observed that some client
-+	 * devices provide zero here, no matter which transmission
-+	 * rate is possible. in that case the local nss configuration 
-+	 * will be used at maxmimum configuration possible. (see above)
-+	 */
-+
-+	if (arg->peer_vht_rates.rx_max_rate == 780)
-+		nss160 = 1;
-+
-+	/* in case if peer is connected with vht160 or vht80+80,
-+         * we need to properly adjust rxnss parameters otherwise 
-+	 * firmware will raise a assert 
-+	 */
-+	switch (arg->peer_phymode) {
++	/* in case if peer is connected with vht160 or vht80+80, we need to properly adjust rxnss parameters otherwise firmware will raise a assert */
++	switch(arg->peer_phymode) {
 +	case MODE_11AC_VHT80_80:
 +		arg->peer_bw_rxnss_override = BW_NSS_FWCONF_80_80(nss160);
 +	/* fall through */
 +	case MODE_11AC_VHT160:
 +		arg->peer_bw_rxnss_override |= BW_NSS_FWCONF_160(nss160);
-+		break;
++	break;
 +	default:
-+		break;
++	break;
  	}
 +
 +	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x peer_bw_rxnss_override 0x%x\n",
-+		   sta->addr, arg->peer_max_mpdu, arg->peer_flags, 
-+		   arg->peer_bw_rxnss_override);
++		   sta->addr, arg->peer_max_mpdu, arg->peer_flags, arg->peer_bw_rxnss_override);
  }
  
  static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
-@@ -2703,9 +2725,9 @@ static int ath10k_peer_assoc_prepare(str
+@@ -2694,9 +2698,9 @@ static int ath10k_peer_assoc_prepare(str
  	ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
  	ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
  	ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
@@ -105,7 +93,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  }
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -7552,12 +7552,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
+@@ -6760,12 +6760,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
  	struct wmi_10_4_peer_assoc_complete_cmd *cmd = buf;
  
  	ath10k_wmi_peer_assoc_fill_10_2(ar, buf, arg);
@@ -121,24 +109,24 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  static int
 --- a/drivers/net/wireless/ath/ath10k/wmi.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -6468,7 +6468,19 @@ struct wmi_10_2_peer_assoc_complete_cmd
+@@ -6209,7 +6209,19 @@ struct wmi_10_2_peer_assoc_complete_cmd
  	__le32 info0; /* WMI_PEER_ASSOC_INFO0_ */
  } __packed;
  
 -#define PEER_BW_RXNSS_OVERRIDE_OFFSET  31
-+#define BW_NSS_FWCONF_MAP_ENABLE	BIT(31)
-+#define BW_NSS_FWCONF_MAP_160MHZ_LSB	(0)
-+#define BW_NSS_FWCONF_MAP_160MHZ_MASK	(0x00000007)
-+#define BW_NSS_FWCONF_MAP_80_80MHZ_LSB	(3)
-+#define BW_NSS_FWCONF_MAP_80_80MHZ_MASK (0x00000038)
-+#define BW_NSS_FWCONF_MAP_MASK		(0x0000003F)
++#define BW_NSS_FWCONF_MAP_ENABLE             (1 << 31)
++#define BW_NSS_FWCONF_MAP_160MHZ_S           (0)
++#define BW_NSS_FWCONF_MAP_160MHZ_M           (0x00000007)
++#define BW_NSS_FWCONF_MAP_80_80MHZ_S         (3)
++#define BW_NSS_FWCONF_MAP_80_80MHZ_M         (0x00000038)
++#define BW_NSS_FWCONF_MAP_M                  (0x0000003F)
 +
-+#define GET_BW_NSS_FWCONF_160(x)	(MS(x, BW_NSS_FWCONF_MAP_160MHZ) + 1)
-+#define GET_BW_NSS_FWCONF_80_80(x)	(MS(x, BW_NSS_FWCONF_MAP_80_80MHZ) + 1)
++#define GET_BW_NSS_FWCONF_160(x)             ((((x) & BW_NSS_FWCONF_MAP_160MHZ_M) >> BW_NSS_FWCONF_MAP_160MHZ_S) + 1)
++#define GET_BW_NSS_FWCONF_80_80(x)           ((((x) & BW_NSS_FWCONF_MAP_80_80MHZ_M) >> BW_NSS_FWCONF_MAP_80_80MHZ_S) + 1)
 +
 +/* Values defined to set 160 MHz Bandwidth NSS Mapping into FW*/
-+#define BW_NSS_FWCONF_160(x)		(BW_NSS_FWCONF_MAP_ENABLE | SM(x - 1, BW_NSS_FWCONF_MAP_160MHZ))
-+#define BW_NSS_FWCONF_80_80(x)		(BW_NSS_FWCONF_MAP_ENABLE | SM(x - 1, BW_NSS_FWCONF_MAP_80_80MHZ))
++#define BW_NSS_FWCONF_160(x)          (BW_NSS_FWCONF_MAP_ENABLE | (((x - 1) << BW_NSS_FWCONF_MAP_160MHZ_S) & BW_NSS_FWCONF_MAP_160MHZ_M))
++#define BW_NSS_FWCONF_80_80(x)        (BW_NSS_FWCONF_MAP_ENABLE | (((x - 1) << BW_NSS_FWCONF_MAP_80_80MHZ_S) & BW_NSS_FWCONF_MAP_80_80MHZ_M))
  
  struct wmi_10_4_peer_assoc_complete_cmd {
  	struct wmi_10_2_peer_assoc_complete_cmd cmd;
diff --git a/package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch b/package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
rename to package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
index 2863e4b4b6..657b31f5a8 100644
--- a/package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
+++ b/package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
@@ -4,16 +4,13 @@ starting with firmware 10.4.3.4.x series QCA changed the handling of the channel
 likelly for backward compatiblity with vht80 only capable clients.
 this patch adjusts the handling to get vht160 to work again with official qca firmwares newer than 3.3
 consider that this patch will not work with older firmwares anymore. to avoid undefined behaviour this we disable vht160 capability for outdated firmwares
-Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
-
-v2: fix trailing whitespace issue and fix some typos within the commit note
 ---
  drivers/net/wireless/ath/ath10k/mac.c |  7 -------
  drivers/net/wireless/ath/ath10k/wmi.c | 11 ++++++++---
  2 files changed, 8 insertions(+), 10 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -4533,13 +4533,6 @@ static struct ieee80211_sta_vht_cap ath1
+@@ -4415,13 +4415,6 @@ static struct ieee80211_sta_vht_cap ath1
  		vht_cap.cap |= val;
  	}
  
@@ -29,7 +26,7 @@ v2: fix trailing whitespace issue and fix some typos within the commit note
  		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -1700,13 +1700,18 @@ void ath10k_wmi_put_wmi_channel(struct w
+@@ -1660,13 +1660,18 @@ void ath10k_wmi_put_wmi_channel(struct w
  		flags |= WMI_CHAN_FLAG_HT40_PLUS;
  	if (arg->chan_radar)
  		flags |= WMI_CHAN_FLAG_DFS;
@@ -45,7 +42,7 @@ v2: fix trailing whitespace issue and fix some typos within the commit note
 +		if (arg->freq < arg->band_center_freq1)
 +			ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1 - 40);
 +		else
-+			ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1 + 40);
++			ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1 + 40);		
 +		ch->band_center_freq2 = __cpu_to_le32(arg->band_center_freq1);
 +	}
  	ch->min_power = arg->min_power;
diff --git a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
similarity index 90%
rename from package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
rename to package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index 1fd255b121..fc7fe1edb0 100644
--- a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -85,7 +85,7 @@ v13:
  create mode 100644 drivers/net/wireless/ath/ath10k/leds.h
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -71,6 +71,16 @@ config ATH10K_DEBUGFS
+@@ -56,6 +56,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -104,75 +104,75 @@ v13:
  	depends on ATH10K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath10k/Makefile
 +++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -19,6 +19,7 @@ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) +=
+@@ -18,6 +18,7 @@ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) +=
  ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
  ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
 +ath10k_core-$(CPTCFG_ATH10K_LEDS) += leds.o
  ath10k_core-$(CPTCFG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
- ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
+ 
 --- a/local-symbols
 +++ b/local-symbols
-@@ -142,6 +142,7 @@ ATH10K_DEBUG=
+@@ -143,6 +143,7 @@ ATH10K_USB=
+ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
- ATH10K_THERMAL=
 +ATH10K_LEDS=
  ATH10K_TRACING=
  ATH10K_DFS_CERTIFIED=
  WCN36XX=
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -24,6 +24,7 @@
+@@ -32,6 +32,7 @@
+ #include "htt.h"
  #include "testmode.h"
  #include "wmi-ops.h"
- #include "coredump.h"
 +#include "leds.h"
  
  unsigned int ath10k_debug_mask;
  static unsigned int ath10k_cryptmode_param;
-@@ -55,6 +56,7 @@ static const struct ath10k_hw_params ath
+@@ -56,6 +57,7 @@ static const struct ath10k_hw_params ath
+ 		.id = QCA988X_HW_2_0_VERSION,
  		.dev_id = QCA988X_2_0_DEVICE_ID,
- 		.bus = ATH10K_BUS_PCI,
  		.name = "qca988x hw2.0",
 +		.led_pin = 1,
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -123,6 +125,7 @@ static const struct ath10k_hw_params ath
+@@ -80,6 +82,7 @@ static const struct ath10k_hw_params ath
+ 		.id = QCA9887_HW_1_0_VERSION,
  		.dev_id = QCA9887_1_0_DEVICE_ID,
- 		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
 +		.led_pin = 1,
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -297,6 +300,7 @@ static const struct ath10k_hw_params ath
+@@ -199,6 +202,7 @@ static const struct ath10k_hw_params ath
+ 		.id = QCA99X0_HW_2_0_DEV_VERSION,
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
- 		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
 +		.led_pin = 17,
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -337,6 +341,7 @@ static const struct ath10k_hw_params ath
+@@ -228,6 +232,7 @@ static const struct ath10k_hw_params ath
+ 		.id = QCA9984_HW_1_0_DEV_VERSION,
  		.dev_id = QCA9984_1_0_DEVICE_ID,
- 		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
 +		.led_pin = 17,
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -384,6 +389,7 @@ static const struct ath10k_hw_params ath
+@@ -262,6 +267,7 @@ static const struct ath10k_hw_params ath
+ 		.id = QCA9888_HW_2_0_DEV_VERSION,
  		.dev_id = QCA9888_2_0_DEVICE_ID,
- 		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
 +		.led_pin = 17,
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -2720,6 +2726,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -2254,6 +2260,10 @@ int ath10k_core_start(struct ath10k *ar,
  	if (status)
  		goto err_hif_stop;
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -2976,9 +2986,18 @@ static void ath10k_core_register_work(st
+@@ -2471,9 +2481,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -3024,6 +3043,8 @@ void ath10k_core_unregister(struct ath10
+@@ -2515,6 +2534,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -213,7 +213,7 @@ v13:
  	 * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -14,6 +14,7 @@
+@@ -24,6 +24,7 @@
  #include <linux/pci.h>
  #include <linux/uuid.h>
  #include <linux/time.h>
@@ -221,7 +221,15 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1150,6 +1151,13 @@ struct ath10k {
+@@ -789,7 +790,6 @@ struct ath10k {
+ 	u32 low_5ghz_chan;
+ 	u32 high_5ghz_chan;
+ 	bool ani_enabled;
+-
+ 	bool p2p;
+ 
+ 	struct {
+@@ -972,6 +972,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -237,7 +245,7 @@ v13:
  		u32 fw_warm_reset_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -511,6 +511,7 @@ struct ath10k_hw_params {
+@@ -490,6 +490,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;
@@ -397,7 +405,7 @@ v13:
 +#endif /* _LEDS_H_ */
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -23,6 +23,7 @@
+@@ -32,6 +32,7 @@
  #include "wmi-tlv.h"
  #include "wmi-ops.h"
  #include "wow.h"
@@ -407,18 +415,18 @@ v13:
  /* Rates */
 --- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
-@@ -216,7 +216,10 @@ struct wmi_ops {
- 	struct sk_buff *(*gen_bb_timing)
- 			(struct ath10k *ar,
- 			 const struct wmi_bb_timing_cfg_arg *arg);
+@@ -197,6 +197,10 @@ struct wmi_ops {
+ 					(struct ath10k *ar,
+ 					 enum wmi_bss_survey_req_type type);
+ 	struct sk_buff *(*gen_echo)(struct ath10k *ar, u32 value);
 +	struct sk_buff *(*gen_gpio_config)(struct ath10k *ar, u32 gpio_num,
 +					   u32 input, u32 pull_type, u32 intr_mode);
- 
++ 
 +	struct sk_buff *(*gen_gpio_output)(struct ath10k *ar, u32 gpio_num, u32 set);
  };
  
  int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-@@ -1080,6 +1083,35 @@ ath10k_wmi_force_fw_hang(struct ath10k *
+@@ -951,6 +955,35 @@ ath10k_wmi_force_fw_hang(struct ath10k *
  	return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
  }
  
@@ -456,7 +464,7 @@ v13:
  {
 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
-@@ -4309,6 +4309,8 @@ static const struct wmi_ops wmi_tlv_ops
+@@ -3619,6 +3619,8 @@ static const struct wmi_ops wmi_tlv_ops
  	.gen_echo = ath10k_wmi_tlv_op_gen_echo,
  	.gen_vdev_spectral_conf = ath10k_wmi_tlv_op_gen_vdev_spectral_conf,
  	.gen_vdev_spectral_enable = ath10k_wmi_tlv_op_gen_vdev_spectral_enable,
@@ -467,7 +475,7 @@ v13:
  static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -7372,6 +7372,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
+@@ -6580,6 +6580,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
  	return skb;
  }
  
@@ -517,7 +525,7 @@ v13:
  static struct sk_buff *
  ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
  			     enum wmi_sta_ps_mode psmode)
-@@ -9004,6 +9047,9 @@ static const struct wmi_ops wmi_ops = {
+@@ -8081,6 +8124,9 @@ static const struct wmi_ops wmi_ops = {
  	.fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -527,7 +535,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -9074,6 +9120,8 @@ static const struct wmi_ops wmi_10_1_ops
+@@ -8151,6 +8197,8 @@ static const struct wmi_ops wmi_10_1_ops
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -536,7 +544,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -9146,6 +9194,8 @@ static const struct wmi_ops wmi_10_2_ops
+@@ -8222,6 +8270,8 @@ static const struct wmi_ops wmi_10_2_ops
  	.gen_delba_send = ath10k_wmi_op_gen_delba_send,
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
@@ -545,16 +553,16 @@ v13:
  	/* .gen_pdev_enable_adaptive_cca not implemented */
  };
  
-@@ -9217,6 +9267,8 @@ static const struct wmi_ops wmi_10_2_4_o
+@@ -8292,6 +8342,8 @@ static const struct wmi_ops wmi_10_2_4_o
+ 	.gen_pdev_enable_adaptive_cca =
  		ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
  	.get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
- 	.gen_bb_timing = ath10k_wmi_10_2_4_op_gen_bb_timing,
 +	.gen_gpio_config = ath10k_wmi_op_gen_gpio_config,
 +	.gen_gpio_output = ath10k_wmi_op_gen_gpio_output,
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -9297,6 +9349,8 @@ static const struct wmi_ops wmi_10_4_ops
+@@ -8367,6 +8419,8 @@ static const struct wmi_ops wmi_10_4_ops
  	.gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
  	.gen_echo = ath10k_wmi_op_gen_echo,
  	.gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,
@@ -565,7 +573,7 @@ v13:
  int ath10k_wmi_attach(struct ath10k *ar)
 --- a/drivers/net/wireless/ath/ath10k/wmi.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -2998,6 +2998,41 @@ enum wmi_10_4_feature_mask {
+@@ -2899,6 +2899,41 @@ enum wmi_10_4_feature_mask {
  
  };
  
diff --git a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
deleted file mode 100644
index e4d1a6daab..0000000000
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -3032,6 +3032,8 @@ void regulatory_hint_country_ie(struct w
- 	enum environment_cap env = ENVIRON_ANY;
- 	struct regulatory_request *request = NULL, *lr;
- 
-+	return;
-+
- 	/* IE len must be evenly divisible by 2 */
- 	if (country_ie_len & 0x01)
- 		return;
-@@ -3283,6 +3285,7 @@ static bool is_wiphy_all_set_reg_flag(en
- 
- void regulatory_hint_disconnect(void)
- {
-+	return;
- 	/* Restore of regulatory settings is not required when wiphy(s)
- 	 * ignore IE from connected access point but clearance of beacon hints
- 	 * is required when wiphy(s) supports beacon hints.
diff --git a/package/kernel/mac80211/patches/ath/552-ahb_of.patch b/package/kernel/mac80211/patches/ath/552-ahb_of.patch
deleted file mode 100644
index 1170fc64bd..0000000000
--- a/package/kernel/mac80211/patches/ath/552-ahb_of.patch
+++ /dev/null
@@ -1,330 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/ahb.c
-+++ b/drivers/net/wireless/ath/ath9k/ahb.c
-@@ -20,7 +20,15 @@
- #include <linux/platform_device.h>
- #include <linux/module.h>
- #include <linux/mod_devicetable.h>
-+#include <linux/of_device.h>
- #include "ath9k.h"
-+#include <linux/ath9k_platform.h>
-+
-+#ifdef CONFIG_OF
-+#include <asm/mach-ath79/ath79.h>
-+#include <asm/mach-ath79/ar71xx_regs.h>
-+#include <linux/mtd/mtd.h>
-+#endif
- 
- static const struct platform_device_id ath9k_platform_id_table[] = {
- 	{
-@@ -69,6 +77,235 @@ static const struct ath_bus_ops ath_ahb_
- 	.eeprom_read = ath_ahb_eeprom_read,
- };
- 
-+#ifdef CONFIG_OF
-+
-+#define QCA955X_DDR_CTL_CONFIG          0x108
-+#define QCA955X_DDR_CTL_CONFIG_ACT_WMAC BIT(23)
-+
-+static int of_get_wifi_cal(struct device_node *np, struct ath9k_platform_data *pdata)
-+{
-+#ifdef CONFIG_MTD
-+	struct device_node *mtd_np = NULL;
-+	size_t retlen;
-+	int size, ret;
-+	struct mtd_info *mtd;
-+	const char *part;
-+	const __be32 *list;
-+	phandle phandle;
-+
-+	list = of_get_property(np, "mtd-cal-data", &size);
-+	if (!list)
-+		return 0;
-+
-+	if (size != (2 * sizeof(*list)))
-+		return 1;
-+
-+	phandle = be32_to_cpup(list++);
-+	if (phandle)
-+		mtd_np = of_find_node_by_phandle(phandle);
-+
-+	if (!mtd_np)
-+		return 1;
-+
-+	part = of_get_property(mtd_np, "label", NULL);
-+	if (!part)
-+		part = mtd_np->name;
-+
-+	mtd = get_mtd_device_nm(part);
-+	if (IS_ERR(mtd))
-+		return 1;
-+
-+	ret = mtd_read(mtd, be32_to_cpup(list), sizeof(pdata->eeprom_data),
-+			&retlen, (u8*)pdata->eeprom_data);
-+	put_mtd_device(mtd);
-+
-+#endif
-+	return 0;
-+}
-+
-+static int ar913x_wmac_reset(void)
-+{
-+	ath79_device_reset_set(AR913X_RESET_AMBA2WMAC);
-+	mdelay(10);
-+
-+	ath79_device_reset_clear(AR913X_RESET_AMBA2WMAC);
-+	mdelay(10);
-+
-+	return 0;
-+}
-+
-+static int ar933x_wmac_reset(void)
-+{
-+	int retries = 20;
-+
-+	ath79_device_reset_set(AR933X_RESET_WMAC);
-+	ath79_device_reset_clear(AR933X_RESET_WMAC);
-+
-+	while (1) {
-+		u32 bootstrap;
-+
-+		bootstrap = ath79_reset_rr(AR933X_RESET_REG_BOOTSTRAP);
-+		if ((bootstrap & AR933X_BOOTSTRAP_EEPBUSY) == 0)
-+			return 0;
-+
-+		if (retries-- == 0)
-+			break;
-+
-+		udelay(10000);
-+	}
-+
-+	pr_err("ar933x: WMAC reset timed out");
-+	return -ETIMEDOUT;
-+}
-+
-+static int qca955x_wmac_reset(void)
-+{
-+	int i;
-+
-+	/* Try to wait for WMAC DDR activity to stop */
-+	for (i = 0; i < 10; i++) {
-+		if (!(__raw_readl(ath79_ddr_base + QCA955X_DDR_CTL_CONFIG) &
-+		    QCA955X_DDR_CTL_CONFIG_ACT_WMAC))
-+			break;
-+
-+		udelay(10);
-+	}
-+
-+	ath79_device_reset_set(QCA955X_RESET_RTC);
-+	udelay(10);
-+	ath79_device_reset_clear(QCA955X_RESET_RTC);
-+	udelay(10);
-+
-+	return 0;
-+}
-+
-+enum {
-+	AR913X_WMAC = 0,
-+	AR933X_WMAC,
-+	AR934X_WMAC,
-+	QCA953X_WMAC,
-+	QCA955X_WMAC,
-+	QCA956X_WMAC,
-+};
-+
-+static int ar9330_get_soc_revision(void)
-+{
-+	if (ath79_soc_rev == 1)
-+		return ath79_soc_rev;
-+
-+	return 0;
-+}
-+
-+static int ath79_get_soc_revision(void)
-+{
-+	return ath79_soc_rev;
-+}
-+
-+static const struct of_ath_ahb_data {
-+	u16 dev_id;
-+	u32 bootstrap_reg;
-+	u32 bootstrap_ref;
-+
-+	int (*soc_revision)(void);
-+	int (*wmac_reset)(void);
-+} of_ath_ahb_data[] = {
-+	[AR913X_WMAC] = {
-+		.dev_id = AR5416_AR9100_DEVID,
-+		.wmac_reset = ar913x_wmac_reset,
-+
-+	},
-+	[AR933X_WMAC] = {
-+		.dev_id = AR9300_DEVID_AR9330,
-+		.bootstrap_reg = AR933X_RESET_REG_BOOTSTRAP,
-+		.bootstrap_ref = AR933X_BOOTSTRAP_REF_CLK_40,
-+		.soc_revision = ar9330_get_soc_revision,
-+		.wmac_reset = ar933x_wmac_reset,
-+	},
-+	[AR934X_WMAC] = {
-+		.dev_id = AR9300_DEVID_AR9340,
-+		.bootstrap_reg = AR934X_RESET_REG_BOOTSTRAP,
-+		.bootstrap_ref = AR934X_BOOTSTRAP_REF_CLK_40,
-+		.soc_revision = ath79_get_soc_revision,
-+	},
-+	[QCA953X_WMAC] = {
-+		.dev_id = AR9300_DEVID_AR953X,
-+		.bootstrap_reg = QCA953X_RESET_REG_BOOTSTRAP,
-+		.bootstrap_ref = QCA953X_BOOTSTRAP_REF_CLK_40,
-+		.soc_revision = ath79_get_soc_revision,
-+	},
-+	[QCA955X_WMAC] = {
-+		.dev_id = AR9300_DEVID_QCA955X,
-+		.bootstrap_reg = QCA955X_RESET_REG_BOOTSTRAP,
-+		.bootstrap_ref = QCA955X_BOOTSTRAP_REF_CLK_40,
-+		.wmac_reset = qca955x_wmac_reset,
-+	},
-+	[QCA956X_WMAC] = {
-+		.dev_id = AR9300_DEVID_QCA956X,
-+		.bootstrap_reg = QCA956X_RESET_REG_BOOTSTRAP,
-+		.bootstrap_ref = QCA956X_BOOTSTRAP_REF_CLK_40,
-+		.soc_revision = ath79_get_soc_revision,
-+	},
-+};
-+
-+const struct of_device_id of_ath_ahb_match[] = {
-+	{ .compatible = "qca,ar9130-wmac", .data = &of_ath_ahb_data[AR913X_WMAC] },
-+	{ .compatible = "qca,ar9330-wmac", .data = &of_ath_ahb_data[AR933X_WMAC] },
-+	{ .compatible = "qca,ar9340-wmac", .data = &of_ath_ahb_data[AR934X_WMAC] },
-+	{ .compatible = "qca,qca9530-wmac", .data = &of_ath_ahb_data[QCA953X_WMAC] },
-+	{ .compatible = "qca,qca9550-wmac", .data = &of_ath_ahb_data[QCA955X_WMAC] },
-+	{ .compatible = "qca,qca9560-wmac", .data = &of_ath_ahb_data[QCA956X_WMAC] },
-+	{},
-+};
-+MODULE_DEVICE_TABLE(of, of_ath_ahb_match);
-+
-+static int of_ath_ahb_probe(struct platform_device *pdev)
-+{
-+	struct ath9k_platform_data *pdata;
-+	const struct of_device_id *match;
-+	const struct of_ath_ahb_data *data;
-+	u8 led_pin;
-+
-+	match = of_match_device(of_ath_ahb_match, &pdev->dev);
-+	data = (const struct of_ath_ahb_data *)match->data;
-+
-+	pdata = dev_get_platdata(&pdev->dev);
-+
-+	if (!of_property_read_u8(pdev->dev.of_node, "qca,led-pin", &led_pin))
-+		pdata->led_pin = led_pin;
-+	else
-+		pdata->led_pin = -1;
-+
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-2ghz"))
-+		pdata->disable_2ghz = true;
-+
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-5ghz"))
-+		pdata->disable_5ghz = true;
-+
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,tx-gain-buffalo"))
-+		pdata->tx_gain_buffalo = true;
-+
-+	if (data->wmac_reset) {
-+		data->wmac_reset();
-+		pdata->external_reset = data->wmac_reset;
-+	}
-+
-+	if (data->bootstrap_reg && data->bootstrap_ref) {
-+		u32 t = ath79_reset_rr(data->bootstrap_reg);
-+		if (t & data->bootstrap_ref)
-+			pdata->is_clk_25mhz = false;
-+		else
-+			pdata->is_clk_25mhz = true;
-+	}
-+
-+	pdata->get_mac_revision = data->soc_revision;
-+
-+	if (of_get_wifi_cal(pdev->dev.of_node, pdata))
-+		dev_err(&pdev->dev, "failed to load calibration data from mtd device\n");
-+
-+	return data->dev_id;
-+}
-+#endif
-+
- static int ath_ahb_probe(struct platform_device *pdev)
- {
- 	void __iomem *mem;
-@@ -80,6 +317,17 @@ static int ath_ahb_probe(struct platform
- 	int ret = 0;
- 	struct ath_hw *ah;
- 	char hw_name[64];
-+	u16 dev_id;
-+
-+	if (id)
-+		dev_id = id->driver_data;
-+
-+#ifdef CONFIG_OF
-+	if (pdev->dev.of_node)
-+		pdev->dev.platform_data = devm_kzalloc(&pdev->dev,
-+					sizeof(struct ath9k_platform_data),
-+					GFP_KERNEL);
-+#endif
- 
- 	if (!dev_get_platdata(&pdev->dev)) {
- 		dev_err(&pdev->dev, "no platform data specified\n");
-@@ -122,13 +370,16 @@ static int ath_ahb_probe(struct platform
- 	sc->mem = mem;
- 	sc->irq = irq;
- 
-+#ifdef CONFIG_OF
-+	dev_id = of_ath_ahb_probe(pdev);
-+#endif
- 	ret = request_irq(irq, ath_isr, IRQF_SHARED, "ath9k", sc);
- 	if (ret) {
- 		dev_err(&pdev->dev, "request_irq failed\n");
- 		goto err_free_hw;
- 	}
- 
--	ret = ath9k_init_device(id->driver_data, sc, &ath_ahb_bus_ops);
-+	ret = ath9k_init_device(dev_id, sc, &ath_ahb_bus_ops);
- 	if (ret) {
- 		dev_err(&pdev->dev, "failed to initialize device\n");
- 		goto err_irq;
-@@ -159,6 +410,9 @@ static int ath_ahb_remove(struct platfor
- 		free_irq(sc->irq, sc);
- 		ieee80211_free_hw(sc->hw);
- 	}
-+#ifdef CONFIG_OF
-+	pdev->dev.platform_data = NULL;
-+#endif
- 
- 	return 0;
- }
-@@ -168,6 +422,9 @@ static struct platform_driver ath_ahb_dr
- 	.remove     = ath_ahb_remove,
- 	.driver		= {
- 		.name	= "ath9k",
-+#ifdef CONFIG_OF
-+		.of_match_table = of_ath_ahb_match,
-+#endif
- 	},
- 	.id_table    = ath9k_platform_id_table,
- };
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -25,6 +25,7 @@
- #include <linux/time.h>
- #include <linux/hw_random.h>
- #include <linux/gpio/driver.h>
-+#include <linux/reset.h>
- 
- #include "common.h"
- #include "debug.h"
-@@ -1011,6 +1012,9 @@ struct ath_softc {
- 	struct ath_hw *sc_ah;
- 	void __iomem *mem;
- 	int irq;
-+#ifdef CONFIG_OF
-+	struct reset_control *reset;
-+#endif
- 	spinlock_t sc_serial_rw;
- 	spinlock_t sc_pm_lock;
- 	spinlock_t sc_pcu_lock;
diff --git a/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
deleted file mode 100644
index 05fce6a168..0000000000
--- a/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/ath10k/htt.h
-+++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -226,7 +226,7 @@ enum htt_rx_ring_flags {
- };
- 
- #define HTT_RX_RING_SIZE_MIN 128
--#define HTT_RX_RING_SIZE_MAX 2048
-+#define HTT_RX_RING_SIZE_MAX 512
- #define HTT_RX_RING_SIZE HTT_RX_RING_SIZE_MAX
- #define HTT_RX_RING_FILL_LEVEL (((HTT_RX_RING_SIZE) / 2) - 1)
- #define HTT_RX_RING_FILL_LEVEL_DUAL_MAC (HTT_RX_RING_SIZE - 1)
diff --git a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
deleted file mode 100644
index 60801243fb..0000000000
--- a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 79c9d7aabae1d1da9eea97d83b61e1517a8a2221 Mon Sep 17 00:00:00 2001
-From: Mathias Kresin <dev@kresin.me>
-Date: Fri, 22 Jun 2018 18:59:44 +0200
-Subject: [PATCH] ath10k: use tpt LED trigger by default
-
-Use the tpt LED trigger for each created phy led. Ths way LEDs attached
-to the ath10k GPIO pins are indicating the phy status and blink on
-traffic.
-
-Signed-off-by: Mathias Kresin <dev@kresin.me>
----
- drivers/net/wireless/ath/ath10k/core.h | 4 ++++
- drivers/net/wireless/ath/ath10k/leds.c | 4 +---
- drivers/net/wireless/ath/ath10k/mac.c  | 2 +-
- 3 files changed, 6 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1198,6 +1198,10 @@ struct ath10k {
- 	struct work_struct radar_confirmation_work;
- 	struct ath10k_bus_params bus_param;
- 
-+#ifdef CPTCFG_MAC80211_LEDS
-+	const char *led_default_trigger;
-+#endif
-+
- 	/* must be last */
- 	u8 drv_priv[0] __aligned(sizeof(void *));
- };
---- a/drivers/net/wireless/ath/ath10k/leds.c
-+++ b/drivers/net/wireless/ath/ath10k/leds.c
-@@ -81,9 +81,7 @@ int ath10k_leds_register(struct ath10k *
- 
- 	ar->leds.cdev.name = ar->leds.label;
- 	ar->leds.cdev.brightness_set_blocking = ath10k_leds_set_brightness_blocking;
--
--	/* FIXME: this assignment doesn't make sense as it's NULL, remove it? */
--	ar->leds.cdev.default_trigger = ar->leds.wifi_led.default_trigger;
-+	ar->leds.cdev.default_trigger = ar->led_default_trigger;
- 
- 	ret = led_classdev_register(wiphy_dev(ar->hw->wiphy), &ar->leds.cdev);
- 	if (ret)
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8838,7 +8838,7 @@ int ath10k_mac_register(struct ath10k *a
- 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
- 
- #ifdef CPTCFG_MAC80211_LEDS
--	ieee80211_create_tpt_led_trigger(ar->hw,
-+	ar->led_default_trigger = ieee80211_create_tpt_led_trigger(ar->hw,
- 		IEEE80211_TPT_LEDTRIG_FL_RADIO, ath10k_tpt_blink,
- 		ARRAY_SIZE(ath10k_tpt_blink));
- #endif
diff --git a/package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch b/package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
deleted file mode 100644
index 0c98be2ada..0000000000
--- a/package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: Pradeep kumar Chitrapu <pradeepc@codeaurora.org>
-Date: Mon, 10 Dec 2018 20:56:11 -0800
-Subject: ath10k: fix incorrect multicast/broadcast rate setting
-
-Invalid rate code is sent to firmware when multicast rate value of 0 is
-sent to driver indicating disabled case, causing broken mesh path.
-so fix that.
-
-Tested on QCA9984 with firmware 10.4-3.6.1-00827
-
-Fixes: cd93b83ad92 ("ath10k: support for multicast rate control")
-Co-developed-by: Zhi Chen <zhichen@codeaurora.org>
-Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
-Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
-
-Origin: other, https://patchwork.kernel.org/patch/10723033/
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -5604,8 +5604,8 @@ static void ath10k_bss_info_changed(stru
- 	struct cfg80211_chan_def def;
- 	u32 vdev_param, pdev_param, slottime, preamble;
- 	u16 bitrate, hw_value;
--	u8 rate, basic_rate_idx;
--	int rateidx, ret = 0, hw_rate_code;
-+	u8 rate, basic_rate_idx, rateidx;
-+	int ret = 0, hw_rate_code, mcast_rate;
- 	enum nl80211_band band;
- 	const struct ieee80211_supported_band *sband;
- 
-@@ -5792,7 +5792,11 @@ static void ath10k_bss_info_changed(stru
- 	if (changed & BSS_CHANGED_MCAST_RATE &&
- 	    !ath10k_mac_vif_chan(arvif->vif, &def)) {
- 		band = def.chan->band;
--		rateidx = vif->bss_conf.mcast_rate[band] - 1;
-+		mcast_rate = vif->bss_conf.mcast_rate[band];
-+		if (mcast_rate > 0)
-+			rateidx = mcast_rate - 1;
-+		else
-+			rateidx = ffs(vif->bss_conf.basic_rates) - 1;
- 
- 		if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY)
- 			rateidx += ATH10K_MAC_FIRST_OFDM_RATE_IDX;
diff --git a/package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch b/package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch
deleted file mode 100644
index 49f6057799..0000000000
--- a/package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From: Sven Eckelmann <seckelmann@datto.com>
-Date: Tue, 11 Jun 2019 13:58:35 +0200
-Subject: ath10k: fix max antenna gain unit
-
-Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB
-steps). This isn't the case for max_antenna_gain - which is still expected
-by the firmware as dB.
-
-The firmware is converting it from dB to the internal (twicepower)
-representation when it calculates the limits of a channel. This can be seen
-in tpc_stats when configuring "12" as max_antenna_gain. Instead of the
-expected 12 (6 dB), the tpc_stats shows 24 (12 dB).
-
-Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057.
-
-Fixes: 02256930d9b8 ("ath10k: use proper tx power unit")
-Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
-
-Forwarded: https://patchwork.kernel.org/patch/10986723/
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1009,7 +1009,7 @@ static int ath10k_monitor_vdev_start(str
- 	arg.channel.min_power = 0;
- 	arg.channel.max_power = channel->max_power * 2;
- 	arg.channel.max_reg_power = channel->max_reg_power * 2;
--	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
-+	arg.channel.max_antenna_gain = channel->max_antenna_gain;
- 
- 	reinit_completion(&ar->vdev_setup_done);
- 
-@@ -1451,7 +1451,7 @@ static int ath10k_vdev_start_restart(str
- 	arg.channel.min_power = 0;
- 	arg.channel.max_power = chandef->chan->max_power * 2;
- 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
--	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
-+	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
- 
- 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
- 		arg.ssid = arvif->u.ap.ssid;
-@@ -3128,7 +3128,7 @@ static int ath10k_update_channel_list(st
- 			ch->min_power = 0;
- 			ch->max_power = channel->max_power * 2;
- 			ch->max_reg_power = channel->max_reg_power * 2;
--			ch->max_antenna_gain = channel->max_antenna_gain * 2;
-+			ch->max_antenna_gain = channel->max_antenna_gain;
- 			ch->reg_class_id = 0; /* FIXME */
- 
- 			/* FIXME: why use only legacy modes, why not any
diff --git a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch b/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
deleted file mode 100644
index bea5eaa7ae..0000000000
--- a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From: Sven Eckelmann <seckelmann@datto.com>
-Date: Wed, 28 Nov 2018 16:16:27 +0100
-Subject: ath10k: adjust tx power reduction for US regulatory domain
-
-FCC allows maximum antenna gain of 6 dBi. 15.247(b)(4):
-
-> (4) The conducted output power limit
-> specified in paragraph (b) of this section
-> is based on the use of antennas
-> with directional gains that do not exceed
-> 6 dBi. Except as shown in paragraph
-> (c) of this section, if transmitting
-> antennas of directional gain greater
-> than 6 dBi are used, the conducted
-> output power from the intentional radiator
-> shall be reduced below the stated
-> values in paragraphs (b)(1), (b)(2),
-> and (b)(3) of this section, as appropriate,
-> by the amount in dB that the
-> directional gain of the antenna exceeds
-> 6 dBi.
-
-https://www.gpo.gov/fdsys/pkg/CFR-2013-title47-vol1/pdf/CFR-2013-title47-vol1-sec15-247.pdf
-
-Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
-
-Forwarded: no
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -977,6 +977,40 @@ static inline int ath10k_vdev_setup_sync
- 	return ar->last_wmi_vdev_start_status;
- }
- 
-+static u32 ath10k_get_max_antenna_gain(struct ath10k *ar,
-+				       u32 ch_max_antenna_gain)
-+{
-+	u32 max_antenna_gain;
-+
-+	if (ar->dfs_detector && ar->dfs_detector->region == NL80211_DFS_FCC) {
-+		/* FCC allows maximum antenna gain of 6 dBi. 15.247(b)(4):
-+		 *
-+		 * > (4) The conducted output power limit
-+		 * > specified in paragraph (b) of this section
-+		 * > is based on the use of antennas
-+		 * > with directional gains that do not exceed
-+		 * > 6 dBi. Except as shown in paragraph
-+		 * > (c) of this section, if transmitting
-+		 * > antennas of directional gain greater
-+		 * > than 6 dBi are used, the conducted
-+		 * > output power from the intentional radiator
-+		 * > shall be reduced below the stated
-+		 * > values in paragraphs (b)(1), (b)(2),
-+		 * > and (b)(3) of this section, as appropriate,
-+		 * > by the amount in dB that the
-+		 * > directional gain of the antenna exceeds
-+		 * > 6 dBi.
-+		 *
-+		 * https://www.gpo.gov/fdsys/pkg/CFR-2013-title47-vol1/pdf/CFR-2013-title47-vol1-sec15-247.pdf
-+		 */
-+		max_antenna_gain = 6;
-+	} else {
-+		max_antenna_gain = 0;
-+	}
-+
-+	return max(ch_max_antenna_gain, max_antenna_gain);
-+}
-+
- static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
- {
- 	struct cfg80211_chan_def *chandef = NULL;
-@@ -1009,7 +1043,8 @@ static int ath10k_monitor_vdev_start(str
- 	arg.channel.min_power = 0;
- 	arg.channel.max_power = channel->max_power * 2;
- 	arg.channel.max_reg_power = channel->max_reg_power * 2;
--	arg.channel.max_antenna_gain = channel->max_antenna_gain;
-+	arg.channel.max_antenna_gain = ath10k_get_max_antenna_gain(ar,
-+						channel->max_antenna_gain);
- 
- 	reinit_completion(&ar->vdev_setup_done);
- 
-@@ -1451,7 +1486,8 @@ static int ath10k_vdev_start_restart(str
- 	arg.channel.min_power = 0;
- 	arg.channel.max_power = chandef->chan->max_power * 2;
- 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
--	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
-+	arg.channel.max_antenna_gain = ath10k_get_max_antenna_gain(ar,
-+					chandef->chan->max_antenna_gain);
- 
- 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
- 		arg.ssid = arvif->u.ap.ssid;
-@@ -3128,7 +3164,8 @@ static int ath10k_update_channel_list(st
- 			ch->min_power = 0;
- 			ch->max_power = channel->max_power * 2;
- 			ch->max_reg_power = channel->max_reg_power * 2;
--			ch->max_antenna_gain = channel->max_antenna_gain;
-+			ch->max_antenna_gain = ath10k_get_max_antenna_gain(ar,
-+						channel->max_antenna_gain);
- 			ch->reg_class_id = 0; /* FIXME */
- 
- 			/* FIXME: why use only legacy modes, why not any
diff --git a/package/kernel/mac80211/patches/brcm/100-v5.4-0001-brcmfmac-switch-source-files-to-using-SPDX-license-i.patch b/package/kernel/mac80211/patches/brcm/100-v5.4-0001-brcmfmac-switch-source-files-to-using-SPDX-license-i.patch
deleted file mode 100644
index 5362177980..0000000000
--- a/package/kernel/mac80211/patches/brcm/100-v5.4-0001-brcmfmac-switch-source-files-to-using-SPDX-license-i.patch
+++ /dev/null
@@ -1,1223 +0,0 @@
-From daeccac2d5e7a6179ffff63e40b4a59bc3376a05 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 16 May 2019 14:04:09 +0200
-Subject: [PATCH] brcmfmac: switch source files to using SPDX license
- identifier
-
-With ISC license text in place under the LICENSES folder switch
-to using the SPDX license identifier to refer to the ISC license.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/Makefile | 14 ++------------
- .../broadcom/brcm80211/brcmfmac/Makefile         | 14 ++------------
- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  | 13 +------------
- .../broadcom/brcm80211/brcmfmac/bcmsdh.c         | 13 +------------
- .../broadcom/brcm80211/brcmfmac/btcoex.c         | 13 +------------
- .../broadcom/brcm80211/brcmfmac/btcoex.h         | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/bus.h   | 13 +------------
- .../broadcom/brcm80211/brcmfmac/cfg80211.c       | 13 +------------
- .../broadcom/brcm80211/brcmfmac/cfg80211.h       | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/chip.c  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/chip.h  | 13 +------------
- .../broadcom/brcm80211/brcmfmac/common.c         | 13 +------------
- .../broadcom/brcm80211/brcmfmac/common.h         | 16 +++-------------
- .../broadcom/brcm80211/brcmfmac/commonring.c     | 16 +++-------------
- .../broadcom/brcm80211/brcmfmac/commonring.h     | 16 +++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/core.c  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/core.h  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/debug.c | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/debug.h | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/dmi.c   | 13 +------------
- .../broadcom/brcm80211/brcmfmac/feature.c        | 13 +------------
- .../broadcom/brcm80211/brcmfmac/feature.h        | 13 +------------
- .../broadcom/brcm80211/brcmfmac/firmware.c       | 13 +------------
- .../broadcom/brcm80211/brcmfmac/firmware.h       | 13 +------------
- .../broadcom/brcm80211/brcmfmac/flowring.c       | 16 +++-------------
- .../broadcom/brcm80211/brcmfmac/flowring.h       | 16 +++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/fweh.h  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/fwil.c  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/fwil.h  | 13 +------------
- .../broadcom/brcm80211/brcmfmac/fwil_types.h     | 13 +------------
- .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 13 +------------
- .../broadcom/brcm80211/brcmfmac/fwsignal.h       | 14 +-------------
- .../broadcom/brcm80211/brcmfmac/msgbuf.c         | 16 +++-------------
- .../broadcom/brcm80211/brcmfmac/msgbuf.h         | 16 +++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/of.c    | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/of.h    | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/p2p.c   | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/p2p.h   | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c  | 16 +++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.h  | 16 +++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/pno.c   | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/pno.h   | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/proto.h | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h  | 13 +------------
- .../broadcom/brcm80211/brcmfmac/tracepoint.c     | 13 +------------
- .../broadcom/brcm80211/brcmfmac/tracepoint.h     | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/usb.c   | 13 +------------
- .../wireless/broadcom/brcm80211/brcmfmac/usb.h   | 13 +------------
- .../broadcom/brcm80211/brcmfmac/vendor.c         | 13 +------------
- .../broadcom/brcm80211/brcmfmac/vendor.h         | 13 +------------
- 54 files changed, 74 insertions(+), 658 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/Makefile
-@@ -1,19 +1,9 @@
-+# SPDX-License-Identifier: ISC
- #
--# Makefile fragment for Broadcom 802.11n Networking Device Driver
-+# Makefile fragment for Broadcom 802.11 Networking Device Driver
- #
- # Copyright (c) 2010 Broadcom Corporation
- #
--# Permission to use, copy, modify, and/or distribute this software for any
--# purpose with or without fee is hereby granted, provided that the above
--# copyright notice and this permission notice appear in all copies.
--#
--# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
--# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
--# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
--# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
--# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
--# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
--# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- 
- # common flags
- subdir-ccflags-$(CPTCFG_BRCMDBG)	+= -DDEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
-@@ -1,19 +1,9 @@
-+# SPDX-License-Identifier: ISC
- #
--# Makefile fragment for Broadcom 802.11n Networking Device Driver
-+# Makefile fragment for Broadcom 802.11 Networking Device Driver
- #
- # Copyright (c) 2010 Broadcom Corporation
- #
--# Permission to use, copy, modify, and/or distribute this software for any
--# purpose with or without fee is hereby granted, provided that the above
--# copyright notice and this permission notice appear in all copies.
--#
--# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
--# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
--# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
--# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
--# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
--# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
--# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- 
- ccflags-y += \
- 	-I $(src) \
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- /*******************************************************************************
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef BRCMFMAC_BCDC_H
- #define BRCMFMAC_BCDC_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- /* ****************** SDIO CARD Interface Functions **************************/
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/slab.h>
- #include <linux/netdevice.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef WL_BTCOEX_H_
- #define WL_BTCOEX_H_
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #ifndef BRCMFMAC_BUS_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #ifndef BRCMFMAC_CFG80211_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/kernel.h>
- #include <linux/delay.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef BRCMF_CHIP_H
- #define BRCMF_CHIP_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/kernel.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- #ifndef BRCMFMAC_COMMON_H
- #define BRCMFMAC_COMMON_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/commonring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/commonring.c
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- 
- #include <linux/types.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/commonring.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/commonring.h
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- #ifndef BRCMFMAC_COMMONRING_H
- #define BRCMFMAC_COMMONRING_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/kernel.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- /****************
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/debugfs.h>
- #include <linux/netdevice.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #ifndef BRCMFMAC_DEBUG_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright 2018 Hans de Goede <hdegoede@redhat.com>
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/dmi.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/netdevice.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef _BRCMF_FEATURE_H
- #define _BRCMF_FEATURE_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/efi.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef BRCMFMAC_FIRMWARE_H
- #define BRCMFMAC_FIRMWARE_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- #ifndef BRCMFMAC_FLOWRING_H
- #define BRCMFMAC_FLOWRING_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/netdevice.h>
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- /* FWIL is the Firmware Interface Layer. In this module the support functions
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #ifndef _fwil_h_
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/types.h>
- #include <linux/module.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-@@ -1,20 +1,8 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
--
- #ifndef FWSIGNAL_H_
- #define FWSIGNAL_H_
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- 
- /*******************************************************************************
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- #ifndef BRCMFMAC_MSGBUF_H
- #define BRCMFMAC_MSGBUF_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/init.h>
- #include <linux/of.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifdef CONFIG_OF
- void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/slab.h>
- #include <linux/netdevice.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef WL_CFGP2P_H_
- #define WL_CFGP2P_H_
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- 
- #include <linux/kernel.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.h
-@@ -1,16 +1,6 @@
--/* Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2014 Broadcom Corporation
-  */
- #ifndef BRCMFMAC_PCIE_H
- #define BRCMFMAC_PCIE_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2016 Broadcom
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #include <linux/netdevice.h>
- #include <linux/gcd.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2016 Broadcom
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef _BRCMF_PNO_H
- #define _BRCMF_PNO_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef BRCMFMAC_PROTO_H
- #define BRCMFMAC_PROTO_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/types.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2010 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #ifndef	BRCMFMAC_SDIO_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2012 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/device.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2013 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #if !defined(BRCMF_TRACEPOINT_H_) || defined(TRACE_HEADER_MULTI_READ)
- #define BRCMF_TRACEPOINT_H_
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2011 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/kernel.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2011 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- #ifndef BRCMFMAC_USB_H
- #define BRCMFMAC_USB_H
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #include <linux/vmalloc.h>
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.h
-@@ -1,17 +1,6 @@
-+// SPDX-License-Identifier: ISC
- /*
-  * Copyright (c) 2014 Broadcom Corporation
-- *
-- * Permission to use, copy, modify, and/or distribute this software for any
-- * purpose with or without fee is hereby granted, provided that the above
-- * copyright notice and this permission notice appear in all copies.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
-- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
-- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
-- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-  */
- 
- #ifndef _vendor_h_
diff --git a/package/kernel/mac80211/patches/brcm/101-v5.4-brcmfmac-fix-typos-in-code-comments.patch b/package/kernel/mac80211/patches/brcm/101-v5.4-brcmfmac-fix-typos-in-code-comments.patch
deleted file mode 100644
index da359063c6..0000000000
--- a/package/kernel/mac80211/patches/brcm/101-v5.4-brcmfmac-fix-typos-in-code-comments.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From b07e1ae2ce53a60af67009ef199603a588003e07 Mon Sep 17 00:00:00 2001
-From: Weitao Hou <houweitaoo@gmail.com>
-Date: Mon, 20 May 2019 20:28:25 +0800
-Subject: [PATCH] brcmfmac: fix typos in code comments
-
-fix lengh to length
-
-Signed-off-by: Weitao Hou <houweitaoo@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -303,7 +303,7 @@ brcmf_create_bsscfg(s32 bsscfgidx, char
- 		return brcmf_create_iovar(name, data, datalen, buf, buflen);
- 
- 	prefixlen = strlen(prefix);
--	namelen = strlen(name) + 1; /* lengh of iovar  name + null */
-+	namelen = strlen(name) + 1; /* length of iovar  name + null */
- 	iolen = prefixlen + namelen + sizeof(bsscfgidx_le) + datalen;
- 
- 	if (buflen < iolen) {
diff --git a/package/kernel/mac80211/patches/brcm/103-v5.4-0002-brcmfmac-enable-DFS_OFFLOAD-extended-feature-if-supp.patch b/package/kernel/mac80211/patches/brcm/103-v5.4-0002-brcmfmac-enable-DFS_OFFLOAD-extended-feature-if-supp.patch
deleted file mode 100644
index 6d0756ca78..0000000000
--- a/package/kernel/mac80211/patches/brcm/103-v5.4-0002-brcmfmac-enable-DFS_OFFLOAD-extended-feature-if-supp.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 011a56a3336a5de9c3152c169cd52ff79b8c3f89 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 10:45:31 +0200
-Subject: [PATCH] brcmfmac: enable DFS_OFFLOAD extended feature if supported
-
-If the firmware supports 802.11h and the device can operate in 5GHz
-band we can enable DFS_OFFLOAD extended feature.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c  | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h  | 4 +++-
- 3 files changed, 9 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6733,6 +6733,11 @@ static int brcmf_setup_wiphy(struct wiph
- 		}
- 	}
- 
-+	if (wiphy->bands[NL80211_BAND_5GHZ] &&
-+	    brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
-+		wiphy_ext_feature_set(wiphy,
-+				      NL80211_EXT_FEATURE_DFS_OFFLOAD);
-+
- 	wiphy_read_of_freq_limits(wiphy);
- 
- 	return 0;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -39,6 +39,7 @@ static const struct brcmf_feat_fwcap brc
- 	{ BRCMF_FEAT_P2P, "p2p" },
- 	{ BRCMF_FEAT_MONITOR, "monitor" },
- 	{ BRCMF_FEAT_MONITOR_FMT_RADIOTAP, "rtap" },
-+	{ BRCMF_FEAT_DOT11H, "802.11h" }
- };
- 
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -25,6 +25,7 @@
-  * MONITOR: firmware can pass monitor packets to host.
-  * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
-  * MONITOR_FMT_HW_RX_HDR: firmware provides monitor packets with hw/ucode header
-+ * DOT11H: firmware supports 802.11h
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -43,7 +44,8 @@
- 	BRCMF_FEAT_DEF(FWSUP) \
- 	BRCMF_FEAT_DEF(MONITOR) \
- 	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP) \
--	BRCMF_FEAT_DEF(MONITOR_FMT_HW_RX_HDR)
-+	BRCMF_FEAT_DEF(MONITOR_FMT_HW_RX_HDR) \
-+	BRCMF_FEAT_DEF(DOT11H)
- 
- /*
-  * Quirks:
diff --git a/package/kernel/mac80211/patches/brcm/103-v5.4-0003-brcmfmac-allow-160MHz-in-custom-regulatory-rules.patch b/package/kernel/mac80211/patches/brcm/103-v5.4-0003-brcmfmac-allow-160MHz-in-custom-regulatory-rules.patch
deleted file mode 100644
index 3df8057ced..0000000000
--- a/package/kernel/mac80211/patches/brcm/103-v5.4-0003-brcmfmac-allow-160MHz-in-custom-regulatory-rules.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From fa9050927fa885410055ee03c948c2252693d296 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 10:45:32 +0200
-Subject: [PATCH] brcmfmac: allow 160MHz in custom regulatory rules
-
-The driver has custom regulatory rules which had maximum bandwidth
-for 5GHz channels set to 80MHz. As a consequence the driver can
-not use 160MHz in AP mode even when the device supports it. So
-relax the rules allowing 160MHz. After wiphy_register() the channel
-flags are updated according what the device actually supports.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -189,9 +189,9 @@ static const struct ieee80211_regdomain
- 		 */
- 		REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
- 		/* IEEE 802.11a, channel 36..64 */
--		REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
-+		REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
- 		/* IEEE 802.11a, channel 100..165 */
--		REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
-+		REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
- };
- 
- /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
diff --git a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
deleted file mode 100644
index 5ef01cc61e..0000000000
--- a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
+++ /dev/null
@@ -1,335 +0,0 @@
---- a/local-symbols
-+++ b/local-symbols
-@@ -410,43 +410,6 @@ USB_SIERRA_NET=
- USB_VL600=
- USB_NET_CH9200=
- USB_NET_AQC111=
--SSB_POSSIBLE=
--SSB=
--SSB_SPROM=
--SSB_BLOCKIO=
--SSB_PCIHOST_POSSIBLE=
--SSB_PCIHOST=
--SSB_B43_PCI_BRIDGE=
--SSB_PCMCIAHOST_POSSIBLE=
--SSB_PCMCIAHOST=
--SSB_SDIOHOST_POSSIBLE=
--SSB_SDIOHOST=
--SSB_HOST_SOC=
--SSB_SERIAL=
--SSB_DRIVER_PCICORE_POSSIBLE=
--SSB_DRIVER_PCICORE=
--SSB_PCICORE_HOSTMODE=
--SSB_DRIVER_MIPS=
--SSB_SFLASH=
--SSB_EMBEDDED=
--SSB_DRIVER_EXTIF=
--SSB_DRIVER_GIGE=
--SSB_DRIVER_GPIO=
--BCMA_POSSIBLE=
--BCMA=
--BCMA_BLOCKIO=
--BCMA_HOST_PCI_POSSIBLE=
--BCMA_HOST_PCI=
--BCMA_HOST_SOC=
--BCMA_DRIVER_PCI=
--BCMA_DRIVER_PCI_HOSTMODE=
--BCMA_DRIVER_MIPS=
--BCMA_PFLASH=
--BCMA_SFLASH=
--BCMA_NFLASH=
--BCMA_DRIVER_GMAC_CMN=
--BCMA_DRIVER_GPIO=
--BCMA_DEBUG=
- USB_ACM=
- USB_PRINTER=
- USB_WDM=
---- a/drivers/net/wireless/broadcom/b43/Kconfig
-+++ b/drivers/net/wireless/broadcom/b43/Kconfig
-@@ -63,21 +63,21 @@ endchoice
- config B43_PCI_AUTOSELECT
- 	bool
- 	depends on B43 && SSB_PCIHOST_POSSIBLE
--	select SSB_PCIHOST
--	select SSB_B43_PCI_BRIDGE
-+	depends on SSB_PCIHOST
-+	depends on SSB_B43_PCI_BRIDGE
- 	default y
- 
- # Auto-select SSB PCICORE driver, if possible
- config B43_PCICORE_AUTOSELECT
- 	bool
- 	depends on B43 && SSB_DRIVER_PCICORE_POSSIBLE
--	select SSB_DRIVER_PCICORE
-+	depends on SSB_DRIVER_PCICORE
- 	default y
- 
- config B43_SDIO
- 	bool "Broadcom 43xx SDIO device support"
- 	depends on B43 && B43_SSB && SSB_SDIOHOST_POSSIBLE
--	select SSB_SDIOHOST
-+	depends on SSB_SDIOHOST
- 	---help---
- 	  Broadcom 43xx device support for Soft-MAC SDIO devices.
- 
-@@ -96,13 +96,13 @@ config B43_SDIO
- config B43_BCMA_PIO
- 	bool
- 	depends on B43 && B43_BCMA
--	select BCMA_BLOCKIO
-+	depends on BCMA_BLOCKIO
- 	default y
- 
- config B43_PIO
- 	bool
- 	depends on B43 && B43_SSB
--	select SSB_BLOCKIO
-+	depends on SSB_BLOCKIO
- 	default y
- 
- config B43_PHY_G
---- a/drivers/net/wireless/broadcom/b43/main.c
-+++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -2856,7 +2856,7 @@ static struct ssb_device *b43_ssb_gpio_d
- {
- 	struct ssb_bus *bus = dev->dev->sdev->bus;
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
- #else
- 	return bus->chipco.dev;
-@@ -4873,7 +4873,7 @@ static int b43_wireless_core_init(struct
- 	}
- 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
- 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
--#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
-+#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
- 	if (dev->dev->bus_type == B43_BUS_SSB &&
- 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
- 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
---- a/drivers/net/wireless/broadcom/b43legacy/Kconfig
-+++ b/drivers/net/wireless/broadcom/b43legacy/Kconfig
-@@ -3,7 +3,7 @@ config B43LEGACY
- 	tristate "Broadcom 43xx-legacy wireless support (mac80211 stack)"
- 	depends on m
- 	depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
--	select SSB
-+	depends on SSB
- 	depends on FW_LOADER
- 	---help---
- 	  b43legacy is a driver for 802.11b devices from Broadcom (BCM4301 and
-@@ -25,15 +25,15 @@ config B43LEGACY
- config B43LEGACY_PCI_AUTOSELECT
- 	bool
- 	depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
--	select SSB_PCIHOST
--	select SSB_B43_PCI_BRIDGE
-+	depends on SSB_PCIHOST
-+	depends on SSB_B43_PCI_BRIDGE
- 	default y
- 
- # Auto-select SSB PCICORE driver, if possible
- config B43LEGACY_PCICORE_AUTOSELECT
- 	bool
- 	depends on B43LEGACY && SSB_DRIVER_PCICORE_POSSIBLE
--	select SSB_DRIVER_PCICORE
-+	depends on SSB_DRIVER_PCICORE
- 	default y
- 
- # LED support
---- a/drivers/net/wireless/broadcom/b43legacy/main.c
-+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
-@@ -1905,7 +1905,7 @@ static int b43legacy_gpio_init(struct b4
- 	if (dev->dev->id.revision >= 2)
- 		mask  |= 0x0010; /* FIXME: This is redundant. */
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	pcidev = bus->pcicore.dev;
- #endif
- 	gpiodev = bus->chipco.dev ? : pcidev;
-@@ -1924,7 +1924,7 @@ static void b43legacy_gpio_cleanup(struc
- 	struct ssb_bus *bus = dev->dev->bus;
- 	struct ssb_device *gpiodev, *pcidev = NULL;
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	pcidev = bus->pcicore.dev;
- #endif
- 	gpiodev = bus->chipco.dev ? : pcidev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-@@ -22,7 +22,7 @@ struct brcms_led {
- 	bool active_low;
- };
- 
--#ifdef CPTCFG_BCMA_DRIVER_GPIO
-+#ifdef CONFIG_BCMA_DRIVER_GPIO
- void brcms_led_unregister(struct brcms_info *wl);
- int brcms_led_register(struct brcms_info *wl);
- #else
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-@@ -42,6 +42,6 @@ brcmsmac-y := \
- 	brcms_trace_events.o \
- 	debug.o
- 
--brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
-+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
- 
- obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
---- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
-+++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
-@@ -8,7 +8,7 @@ config BRCMSMAC
- 	depends on m
- 	depends on MAC80211
- 	depends on BCMA_POSSIBLE
--	select BCMA
-+	depends on BCMA
- 	select NEW_LEDS if BCMA_DRIVER_GPIO
- 	select LEDS_CLASS if BCMA_DRIVER_GPIO
- 	select BRCMUTIL
---- a/Kconfig.local
-+++ b/Kconfig.local
-@@ -1234,117 +1234,6 @@ config BACKPORTED_USB_NET_CH9200
- config BACKPORTED_USB_NET_AQC111
- 	tristate
- 	default USB_NET_AQC111
--config BACKPORTED_SSB_POSSIBLE
--	tristate
--	default SSB_POSSIBLE
--config BACKPORTED_SSB
--	tristate
--	default SSB
--config BACKPORTED_SSB_SPROM
--	tristate
--	default SSB_SPROM
--config BACKPORTED_SSB_BLOCKIO
--	tristate
--	default SSB_BLOCKIO
--config BACKPORTED_SSB_PCIHOST_POSSIBLE
--	tristate
--	default SSB_PCIHOST_POSSIBLE
--config BACKPORTED_SSB_PCIHOST
--	tristate
--	default SSB_PCIHOST
--config BACKPORTED_SSB_B43_PCI_BRIDGE
--	tristate
--	default SSB_B43_PCI_BRIDGE
--config BACKPORTED_SSB_PCMCIAHOST_POSSIBLE
--	tristate
--	default SSB_PCMCIAHOST_POSSIBLE
--config BACKPORTED_SSB_PCMCIAHOST
--	tristate
--	default SSB_PCMCIAHOST
--config BACKPORTED_SSB_SDIOHOST_POSSIBLE
--	tristate
--	default SSB_SDIOHOST_POSSIBLE
--config BACKPORTED_SSB_SDIOHOST
--	tristate
--	default SSB_SDIOHOST
--config BACKPORTED_SSB_HOST_SOC
--	tristate
--	default SSB_HOST_SOC
--config BACKPORTED_SSB_SERIAL
--	tristate
--	default SSB_SERIAL
--config BACKPORTED_SSB_DRIVER_PCICORE_POSSIBLE
--	tristate
--	default SSB_DRIVER_PCICORE_POSSIBLE
--config BACKPORTED_SSB_DRIVER_PCICORE
--	tristate
--	default SSB_DRIVER_PCICORE
--config BACKPORTED_SSB_PCICORE_HOSTMODE
--	tristate
--	default SSB_PCICORE_HOSTMODE
--config BACKPORTED_SSB_DRIVER_MIPS
--	tristate
--	default SSB_DRIVER_MIPS
--config BACKPORTED_SSB_SFLASH
--	tristate
--	default SSB_SFLASH
--config BACKPORTED_SSB_EMBEDDED
--	tristate
--	default SSB_EMBEDDED
--config BACKPORTED_SSB_DRIVER_EXTIF
--	tristate
--	default SSB_DRIVER_EXTIF
--config BACKPORTED_SSB_DRIVER_GIGE
--	tristate
--	default SSB_DRIVER_GIGE
--config BACKPORTED_SSB_DRIVER_GPIO
--	tristate
--	default SSB_DRIVER_GPIO
--config BACKPORTED_BCMA_POSSIBLE
--	tristate
--	default BCMA_POSSIBLE
--config BACKPORTED_BCMA
--	tristate
--	default BCMA
--config BACKPORTED_BCMA_BLOCKIO
--	tristate
--	default BCMA_BLOCKIO
--config BACKPORTED_BCMA_HOST_PCI_POSSIBLE
--	tristate
--	default BCMA_HOST_PCI_POSSIBLE
--config BACKPORTED_BCMA_HOST_PCI
--	tristate
--	default BCMA_HOST_PCI
--config BACKPORTED_BCMA_HOST_SOC
--	tristate
--	default BCMA_HOST_SOC
--config BACKPORTED_BCMA_DRIVER_PCI
--	tristate
--	default BCMA_DRIVER_PCI
--config BACKPORTED_BCMA_DRIVER_PCI_HOSTMODE
--	tristate
--	default BCMA_DRIVER_PCI_HOSTMODE
--config BACKPORTED_BCMA_DRIVER_MIPS
--	tristate
--	default BCMA_DRIVER_MIPS
--config BACKPORTED_BCMA_PFLASH
--	tristate
--	default BCMA_PFLASH
--config BACKPORTED_BCMA_SFLASH
--	tristate
--	default BCMA_SFLASH
--config BACKPORTED_BCMA_NFLASH
--	tristate
--	default BCMA_NFLASH
--config BACKPORTED_BCMA_DRIVER_GMAC_CMN
--	tristate
--	default BCMA_DRIVER_GMAC_CMN
--config BACKPORTED_BCMA_DRIVER_GPIO
--	tristate
--	default BCMA_DRIVER_GPIO
--config BACKPORTED_BCMA_DEBUG
--	tristate
--	default BCMA_DEBUG
- config BACKPORTED_USB_ACM
- 	tristate
- 	default USB_ACM
---- a/Kconfig.sources
-+++ b/Kconfig.sources
-@@ -7,9 +7,6 @@ source "$BACKPORT_DIR/net/mac80211/Kconf
- source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
- source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
- 
--source "$BACKPORT_DIR/drivers/ssb/Kconfig"
--source "$BACKPORT_DIR/drivers/bcma/Kconfig"
--
- source "$BACKPORT_DIR/drivers/usb/class/Kconfig"
- 
- source "$BACKPORT_DIR/drivers/staging/Kconfig"
---- a/Makefile.kernel
-+++ b/Makefile.kernel
-@@ -40,8 +40,6 @@ obj-y += compat/
- obj-$(CPTCFG_CFG80211) += net/wireless/
- obj-$(CPTCFG_MAC80211) += net/mac80211/
- obj-$(CPTCFG_WLAN) += drivers/net/wireless/
--obj-$(CPTCFG_SSB) += drivers/ssb/
--obj-$(CPTCFG_BCMA) += drivers/bcma/
- obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
- 
- obj-$(CPTCFG_USB_WDM) += drivers/usb/class/
diff --git a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
deleted file mode 100644
index ceec92d928..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
+++ /dev/null
@@ -1,89 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8338,6 +8338,58 @@ static void rt2800_init_rfcsr_5592(struc
- 	rt2800_led_open_drain_enable(rt2x00dev);
- }
- 
-+void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev)
-+{
-+	u8 rfb5r1_org, rfb7r1_org, rfvalue;
-+	u32 mac0518, mac051c, mac0528, mac052c;
-+	u8 i;
-+
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration start\n");
-+	mac0518 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	mac051c = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	mac0528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
-+	mac052c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0xC);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x3306);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL2, 0x3330);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0xfffff);
-+	rfb5r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
-+	rfb7r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
-+		if((rfvalue & 0x04) != 0x4)
-+			break;
-+	}
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, rfb5r1_org);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
-+		if((rfvalue & 0x04) != 0x4)
-+			break;
-+	}
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, rfb7r1_org);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, mac0518);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, mac051c);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL2, mac0528);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
-+
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
-+
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rf_self_txdc_cal);
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -8945,6 +8997,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
- 
-+	rt2800_rf_self_txdc_cal(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
- }
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -232,6 +232,7 @@ void rt2800_link_tuner(struct rt2x00_dev
- 		       const u32 count);
- void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev);
- void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev);
-+void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
- 
- int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
- void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -561,6 +561,7 @@ struct rt2x00lib_ops {
- 			    struct link_qual *qual, const u32 count);
- 	void (*gain_calibration) (struct rt2x00_dev *rt2x00dev);
- 	void (*vco_calibration) (struct rt2x00_dev *rt2x00dev);
-+	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
- 
- 	/*
- 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
deleted file mode 100644
index 45edee8644..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
+++ /dev/null
@@ -1,193 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8390,6 +8390,160 @@ void rt2800_rf_self_txdc_cal(struct rt2x
- }
- EXPORT_SYMBOL_GPL(rt2800_rf_self_txdc_cal);
- 
-+int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2)
-+{
-+	int calcode;
-+	calcode = ((d2 - d1) * 1000) / 43;
-+	if ((calcode%10) >= 5)
-+		calcode += 10;
-+	calcode = (calcode / 10);
-+
-+	return calcode;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_calcrcalibrationcode);
-+
-+void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev)
-+{
-+	u32 savemacsysctrl;
-+	u8 saverfb0r1, saverfb0r34, saverfb0r35;
-+	u8 saverfb5r4, saverfb5r17, saverfb5r18;
-+	u8 saverfb5r19, saverfb5r20;
-+	u8 savebbpr22, savebbpr47, savebbpr49;
-+	u8 bytevalue = 0;
-+	int rcalcode;
-+	u8 r_cal_code = 0;
-+	char d1 = 0, d2 = 0;
-+	u8 rfvalue;
-+	u32 MAC_RF_BYPASS0, MAC_RF_CONTROL0, MAC_PWR_PIN_CFG;
-+
-+	saverfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+	saverfb0r34 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 34);
-+	saverfb0r35 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
-+	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
-+	saverfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
-+	saverfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
-+	saverfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
-+	saverfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
-+
-+	savebbpr22 = rt2800_bbp_read(rt2x00dev, 22);
-+	savebbpr47 = rt2800_bbp_read(rt2x00dev, 47);
-+	savebbpr49 = rt2800_bbp_read(rt2x00dev, 49);
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	MAC_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	MAC_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	MAC_PWR_PIN_CFG = rt2800_register_read(rt2x00dev, PWR_PIN_CFG);
-+
-+	{
-+	u32 maccfg, macstatus;
-+	int i;
-+
-+	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	maccfg &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+		}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
-+
-+	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	maccfg &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x2)
-+			udelay(50);
-+		else
-+			break;
-+		}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Rx Status to MAX !!!\n");
-+	}
-+
-+	rfvalue = (MAC_RF_BYPASS0 | 0x3004);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, rfvalue);
-+	rfvalue = (MAC_RF_CONTROL0 | (~0x3002));
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, rfvalue);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x27);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0x83);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, 0x13);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
-+
-+	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x1);
-+
-+	rt2800_bbp_write(rt2x00dev, 47, 0x04);
-+	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
-+	if (bytevalue > 128)
-+		d1 = bytevalue - 256;
-+	else
-+		d1 = (char)bytevalue;
-+	rt2800_bbp_write(rt2x00dev, 22, 0x0);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x01);
-+
-+	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
-+	if (bytevalue > 128)
-+		d2 = bytevalue - 256;
-+	else
-+		d2 = (char)bytevalue;
-+	rt2800_bbp_write(rt2x00dev, 22, 0x0);
-+
-+	rcalcode = rt2800_calcrcalibrationcode(rt2x00dev, d1, d2);
-+	if (rcalcode < 0)
-+		r_cal_code = 256 + rcalcode;
-+	else
-+		r_cal_code = (u8)rcalcode;
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 7, r_cal_code);
-+
-+	rt2800_bbp_write(rt2x00dev, 22, 0x0);
-+
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
-+	bytevalue |= 0x1;
-+	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
-+	bytevalue &= (~0x1);
-+	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, saverfb0r1);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, saverfb0r34);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, saverfb0r35);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, saverfb5r17);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, saverfb5r18);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, saverfb5r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, saverfb5r20);
-+
-+	rt2800_bbp_write(rt2x00dev, 22, savebbpr22);
-+	rt2800_bbp_write(rt2x00dev, 47, savebbpr47);
-+	rt2800_bbp_write(rt2x00dev, 49, savebbpr49);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, MAC_RF_BYPASS0);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, MAC_RF_CONTROL0);
-+
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_r_calibration);
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -8997,6 +9151,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
- 
-+	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -233,6 +233,8 @@ void rt2800_link_tuner(struct rt2x00_dev
- void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev);
- void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev);
- void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
-+int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
-+void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
- 
- int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
- void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -562,6 +562,8 @@ struct rt2x00lib_ops {
- 	void (*gain_calibration) (struct rt2x00_dev *rt2x00dev);
- 	void (*vco_calibration) (struct rt2x00_dev *rt2x00dev);
- 	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
-+	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
-+	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
- 
- 	/*
- 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
deleted file mode 100644
index c6b996782c..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
+++ /dev/null
@@ -1,102 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8544,6 +8544,71 @@ void rt2800_r_calibration(struct rt2x00_
- }
- EXPORT_SYMBOL_GPL(rt2800_r_calibration);
- 
-+void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
-+{
-+	u8 bbpreg = 0;
-+	u32 macvalue = 0, macvalue1 = 0;
-+	u8 saverfb0r2, saverfb5r4, saverfb7r4, rfvalue;
-+	int i;
-+
-+	saverfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+	rfvalue = saverfb0r2;
-+	rfvalue |= 0x03;
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfvalue);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 141);
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg |= 0x10;
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x8);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macvalue1 = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue1 & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 0);
-+	saverfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
-+	saverfb5r4 = saverfb5r4 & (~0x40);
-+	saverfb7r4 = saverfb7r4 & (~0x40);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x64);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 141);
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg = bbpreg & (~0x40);
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+	bbpreg |= 0x48;
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	for (i = 0; i < 10000; i++) {
-+		bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+		if ((bbpreg & 0x40)==0)
-+			break;
-+		udelay(50);
-+	}
-+
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg = bbpreg & (~0x40);
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 141);
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg &= (~0x10);
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rxdcoc_calibration);
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9153,6 +9218,7 @@ static void rt2800_init_rfcsr_6352(struc
- 
- 	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);
-+	rt2800_rxdcoc_calibration(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
- }
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -235,6 +235,7 @@ void rt2800_vco_calibration(struct rt2x0
- void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
- int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
- void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
-+void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
- 
- int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
- void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -564,6 +564,7 @@ struct rt2x00lib_ops {
- 	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
- 	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
- 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
-+	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
- 
- 	/*
- 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
deleted file mode 100644
index 9881469d99..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
+++ /dev/null
@@ -1,417 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8609,6 +8609,386 @@ void rt2800_rxdcoc_calibration(struct rt
- }
- EXPORT_SYMBOL_GPL(rt2800_rxdcoc_calibration);
- 
-+static u32 rt2800_do_sqrt_accumulation(u32 si) {
-+	u32 root, root_pre, bit;
-+	char i;
-+	bit = 1 << 15;
-+	root = 0;
-+	for (i = 15; i >= 0; i = i - 1) {
-+		root_pre = root + bit;
-+		if ((root_pre*root_pre) <= si)
-+			root = root_pre;
-+		bit = bit >> 1;
-+	}
-+
-+	return root;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_do_sqrt_accumulation);
-+
-+void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev) {
-+	u8 rfb0r1, rfb0r2, rfb0r42;
-+	u8 rfb4r0, rfb4r19;
-+	u8 rfb5r3, rfb5r4, rfb5r17, rfb5r18, rfb5r19, rfb5r20;
-+	u8 rfb6r0, rfb6r19;
-+	u8 rfb7r3, rfb7r4, rfb7r17, rfb7r18, rfb7r19, rfb7r20;
-+
-+	u8 bbp1, bbp4;
-+	u8 bbpr241, bbpr242;
-+	u32 i;
-+	u8 ch_idx;
-+	u8 bbpval;
-+	u8 rfval, vga_idx = 0;
-+	int mi = 0, mq = 0, si = 0, sq = 0, riq = 0;
-+	int sigma_i, sigma_q, r_iq, g_rx;
-+	int g_imb;
-+	int ph_rx;
-+	u32 savemacsysctrl = 0;
-+	u32 orig_RF_CONTROL0 = 0;
-+	u32 orig_RF_BYPASS0 = 0;
-+	u32 orig_RF_CONTROL1 = 0;
-+	u32 orig_RF_BYPASS1 = 0;
-+	u32 orig_RF_CONTROL3 = 0;
-+	u32 orig_RF_BYPASS3 = 0;
-+	u32 macstatus, bbpval1 = 0;
-+	u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	orig_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	orig_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	orig_RF_CONTROL1 = rt2800_register_read(rt2x00dev, RF_CONTROL1);
-+	orig_RF_BYPASS1 = rt2800_register_read(rt2x00dev, RF_BYPASS1);
-+	orig_RF_CONTROL3 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+	orig_RF_BYPASS3 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+
-+	bbp1 = rt2800_bbp_read(rt2x00dev, 1);
-+	bbp4 = rt2800_bbp_read(rt2x00dev, 4);
-+
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x0);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x3)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
-+
-+	bbpval = bbp4 & (~0x18);
-+	bbpval = bbp4 | 0x00;
-+	rt2800_bbp_write(rt2x00dev, 4, bbpval);
-+
-+	bbpval = rt2800_bbp_read(rt2x00dev, 21);
-+	bbpval = bbpval | 1;
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+	bbpval = bbpval & 0xfe;
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL1, 0x00000202);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS1, 0x00000303);
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0101);
-+	} else {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0000);
-+	}
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, 0xf1f1);
-+
-+	rfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+	rfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+	rfb4r0 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
-+	rfb4r19 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 19);
-+	rfb5r3 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
-+	rfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
-+	rfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
-+	rfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
-+	rfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
-+	rfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
-+
-+	rfb6r0 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
-+	rfb6r19 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 19);
-+	rfb7r3 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
-+	rfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
-+	rfb7r17 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
-+	rfb7r18 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
-+	rfb7r19 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
-+	rfb7r20 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
-+
-+	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x87);
-+	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0x27);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x38);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x38);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x80);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 18, 0xC1);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 19, 0x60);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 20, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x0);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x0);
-+
-+	rt2800_bbp_dcoc_write(rt2x00dev, 5, 0x0);
-+
-+	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
-+	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
-+
-+	rt2800_bbp_write(rt2x00dev, 241, 0x10);
-+	rt2800_bbp_write(rt2x00dev, 242, 0x84);
-+	rt2800_bbp_write(rt2x00dev, 244, 0x31);
-+
-+	bbpval = rt2800_bbp_dcoc_read(rt2x00dev, 3);
-+	bbpval = bbpval & (~0x7);
-+	rt2800_bbp_dcoc_write(rt2x00dev, 3, bbpval);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
-+	usleep_range(1, 200);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003376);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
-+	udelay(1);
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x06);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x06);
-+	} else {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x02);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x02);
-+	}
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx = ch_idx + 1) {
-+		if (ch_idx == 0) {
-+			rfval = rfb0r1 & (~0x3);
-+			rfval = rfb0r1 | 0x1;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
-+			rfval = rfb0r2 & (~0x33);
-+			rfval = rfb0r2 | 0x11;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
-+			rfval = rfb0r42 & (~0x50);
-+			rfval = rfb0r42 | 0x10;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
-+
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
-+			udelay(1);
-+
-+			bbpval = bbp1 & (~ 0x18);
-+			bbpval = bbpval | 0x00;
-+			rt2800_bbp_write(rt2x00dev, 1, bbpval);
-+
-+			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x00);
-+		} else {
-+			rfval = rfb0r1 & (~0x3);
-+			rfval = rfb0r1 | 0x2;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
-+			rfval = rfb0r2 & (~0x33);
-+			rfval = rfb0r2 | 0x22;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
-+			rfval = rfb0r42 & (~0x50);
-+			rfval = rfb0r42 | 0x40;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
-+
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
-+			udelay(1);
-+
-+			bbpval = bbp1 & (~ 0x18);
-+			bbpval = bbpval | 0x08;
-+			rt2800_bbp_write(rt2x00dev, 1, bbpval);
-+
-+			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x01);
-+		}
-+		udelay(500);
-+
-+		vga_idx = 0;
-+			while (vga_idx < 11) {
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
-+
-+				rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
-+
-+				for (i = 0; i < 10000; i++) {
-+					bbpval = rt2800_bbp_read(rt2x00dev, 159);
-+					if ((bbpval & 0xff) == 0x93)
-+						udelay(50);
-+					else
-+						break;
-+					}
-+
-+				if ((bbpval & 0xff) == 0x93) {
-+					rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
-+					goto restore_value;
-+				}
-+
-+				for (i = 0; i < 5; i++) {
-+					u32 bbptemp = 0;
-+					u8 value = 0;
-+					int result = 0;
-+
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1e);
-+					rt2800_bbp_write(rt2x00dev, 159, i);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x22);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 24);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x21);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 16);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x20);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 8);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1f);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + value;
-+
-+					if ((i < 2) && (bbptemp & 0x800000))
-+						result = (bbptemp & 0xffffff) - 0x1000000;
-+					else if (i == 4)
-+						result = bbptemp;
-+					else
-+						result = bbptemp;
-+
-+					if (i == 0)
-+						mi = result/4096;
-+					else if (i == 1)
-+						mq = result/4096;
-+					else if (i == 2)
-+						si = bbptemp/4096;
-+					else if (i == 3)
-+						sq = bbptemp/4096;
-+					else
-+						riq = result/4096;
-+				}
-+
-+				bbpval1 = si - mi*mi;
-+				rt2x00_dbg(rt2x00dev, "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d", si, sq, riq, bbpval1, vga_idx);
-+
-+				if (bbpval1 >= (100*100))
-+					break;
-+
-+				if (bbpval1 <= 100)
-+					vga_idx = vga_idx + 9;
-+				else if (bbpval1 <= 158)
-+					vga_idx = vga_idx + 8;
-+				else if (bbpval1 <= 251)
-+					vga_idx = vga_idx + 7;
-+				else if (bbpval1 <= 398)
-+					vga_idx = vga_idx + 6;
-+				else if (bbpval1 <= 630)
-+					vga_idx = vga_idx + 5;
-+				else if (bbpval1 <= 1000)
-+					vga_idx = vga_idx + 4;
-+				else if (bbpval1 <= 1584)
-+					vga_idx = vga_idx + 3;
-+				else if (bbpval1 <= 2511)
-+					vga_idx = vga_idx + 2;
-+				else
-+					vga_idx = vga_idx + 1;
-+			}
-+
-+		sigma_i = rt2800_do_sqrt_accumulation(100*(si - mi*mi));
-+		sigma_q = rt2800_do_sqrt_accumulation(100*(sq - mq*mq));
-+		r_iq = 10*(riq-(mi*mq));
-+
-+		rt2x00_dbg(rt2x00dev, "Sigma_i=%d, Sigma_q=%d, R_iq=%d", sigma_i, sigma_q, r_iq);
-+
-+		if (((sigma_i <= 1400 ) && (sigma_i >= 1000))
-+			&& ((sigma_i - sigma_q) <= 112)
-+			&& ((sigma_i - sigma_q) >= -112)
-+			&& ((mi <= 32) && (mi >= -32))
-+			&& ((mq <= 32) && (mq >= -32))) {
-+				r_iq = 10*(riq-(mi*mq));
-+				rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
-+
-+				g_rx = (1000 * sigma_q) / sigma_i;
-+				g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
-+				ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
-+				rt2x00_info(rt2x00dev, "RXIQ G_imb=%d, Ph_rx=%d\n", g_imb, ph_rx);
-+
-+				if ((ph_rx > 20) || (ph_rx < -20)) {
-+					ph_rx = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
-+
-+				if ((g_imb > 12) || (g_imb < -12)) {
-+					g_imb = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
-+			}
-+		else {
-+			g_imb = 0;
-+			ph_rx = 0;
-+			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
-+			rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+		}
-+
-+		if (ch_idx == 0) {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x37);
-+			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
-+			rt2800_bbp_write(rt2x00dev, 158, 0x35);
-+			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x55);
-+			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
-+			rt2800_bbp_write(rt2x00dev, 158, 0x53);
-+			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
-+		}
-+	}
-+
-+restore_value:
-+	rt2800_bbp_write(rt2x00dev, 158, 0x3);
-+	bbpval = rt2800_bbp_read(rt2x00dev, 159);
-+	rt2800_bbp_write(rt2x00dev, 159, (bbpval | 0x07));
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 1, bbp1);
-+	rt2800_bbp_write(rt2x00dev, 4, bbp4);
-+	rt2800_bbp_write(rt2x00dev, 241, bbpr241);
-+	rt2800_bbp_write(rt2x00dev, 242, bbpr242);
-+
-+	rt2800_bbp_write(rt2x00dev, 244, 0x00);
-+	bbpval = rt2800_bbp_read(rt2x00dev, 21);
-+	bbpval = (bbpval | 0x1);
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+	usleep_range(10, 200);
-+	bbpval = (bbpval & 0xfe);
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfb0r1);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfb0r2);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, rfb4r0);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 19, rfb4r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, rfb5r3);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, rfb5r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, rfb5r17);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, rfb5r18);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, rfb5r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, rfb5r20);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, rfb6r0);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 19, rfb6r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, rfb7r3);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, rfb7r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, rfb7r17);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, rfb7r18);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, rfb7r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, rfb7r20);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, orig_RF_CONTROL0);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, orig_RF_BYPASS0);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL1, orig_RF_CONTROL1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS1, orig_RF_BYPASS1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL3, orig_RF_CONTROL3);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, orig_RF_BYPASS3);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rxiq_calibration);
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9221,6 +9601,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rxdcoc_calibration(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
-+	rt2800_rxiq_calibration(rt2x00dev);
- }
- 
- static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -236,6 +236,7 @@ void rt2800_rf_self_txdc_cal(struct rt2x
- int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
- void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
- void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
-+void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev);
- 
- int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
- void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -565,6 +565,7 @@ struct rt2x00lib_ops {
- 	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
- 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
- 	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
-+	void (*rxiq_calibration) (struct rt2x00_dev *rt2x00dev);
- 
- 	/*
- 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
deleted file mode 100644
index d3118ebb3b..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
+++ /dev/null
@@ -1,1002 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8989,6 +8989,954 @@ restore_value:
- }
- EXPORT_SYMBOL_GPL(rt2800_rxiq_calibration);
- 
-+static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_reg_record[][13], u8 chain)
-+{
-+	u8 rfvalue = 0;
-+
-+	if (chain == CHAIN_0) {
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+		rf_reg_record[CHAIN_0][0].bank = 0;
-+		rf_reg_record[CHAIN_0][0].reg = 1;
-+		rf_reg_record[CHAIN_0][0].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+		rf_reg_record[CHAIN_0][1].bank = 0;
-+		rf_reg_record[CHAIN_0][1].reg = 2;
-+		rf_reg_record[CHAIN_0][1].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
-+		rf_reg_record[CHAIN_0][2].bank = 0;
-+		rf_reg_record[CHAIN_0][2].reg = 35;
-+		rf_reg_record[CHAIN_0][2].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+		rf_reg_record[CHAIN_0][3].bank = 0;
-+		rf_reg_record[CHAIN_0][3].reg = 42;
-+		rf_reg_record[CHAIN_0][3].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
-+		rf_reg_record[CHAIN_0][4].bank = 4;
-+		rf_reg_record[CHAIN_0][4].reg = 0;
-+		rf_reg_record[CHAIN_0][4].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 2);
-+		rf_reg_record[CHAIN_0][5].bank = 4;
-+		rf_reg_record[CHAIN_0][5].reg = 2;
-+		rf_reg_record[CHAIN_0][5].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 34);
-+		rf_reg_record[CHAIN_0][6].bank = 4;
-+		rf_reg_record[CHAIN_0][6].reg = 34;
-+		rf_reg_record[CHAIN_0][6].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
-+		rf_reg_record[CHAIN_0][7].bank = 5;
-+		rf_reg_record[CHAIN_0][7].reg = 3;
-+		rf_reg_record[CHAIN_0][7].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
-+		rf_reg_record[CHAIN_0][8].bank = 5;
-+		rf_reg_record[CHAIN_0][8].reg = 4;
-+		rf_reg_record[CHAIN_0][8].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
-+		rf_reg_record[CHAIN_0][9].bank = 5;
-+		rf_reg_record[CHAIN_0][9].reg = 17;
-+		rf_reg_record[CHAIN_0][9].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
-+		rf_reg_record[CHAIN_0][10].bank = 5;
-+		rf_reg_record[CHAIN_0][10].reg = 18;
-+		rf_reg_record[CHAIN_0][10].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
-+		rf_reg_record[CHAIN_0][11].bank = 5;
-+		rf_reg_record[CHAIN_0][11].reg = 19;
-+		rf_reg_record[CHAIN_0][11].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
-+		rf_reg_record[CHAIN_0][12].bank = 5;
-+		rf_reg_record[CHAIN_0][12].reg = 20;
-+		rf_reg_record[CHAIN_0][12].value = rfvalue;
-+	} else if (chain == CHAIN_1) {
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+		rf_reg_record[CHAIN_1][0].bank = 0;
-+		rf_reg_record[CHAIN_1][0].reg = 1;
-+		rf_reg_record[CHAIN_1][0].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+		rf_reg_record[CHAIN_1][1].bank = 0;
-+		rf_reg_record[CHAIN_1][1].reg = 2;
-+		rf_reg_record[CHAIN_1][1].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
-+		rf_reg_record[CHAIN_1][2].bank = 0;
-+		rf_reg_record[CHAIN_1][2].reg = 35;
-+		rf_reg_record[CHAIN_1][2].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+		rf_reg_record[CHAIN_1][3].bank = 0;
-+		rf_reg_record[CHAIN_1][3].reg = 42;
-+		rf_reg_record[CHAIN_1][3].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
-+		rf_reg_record[CHAIN_1][4].bank = 6;
-+		rf_reg_record[CHAIN_1][4].reg = 0;
-+		rf_reg_record[CHAIN_1][4].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 2);
-+		rf_reg_record[CHAIN_1][5].bank = 6;
-+		rf_reg_record[CHAIN_1][5].reg = 2;
-+		rf_reg_record[CHAIN_1][5].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 34);
-+		rf_reg_record[CHAIN_1][6].bank = 6;
-+		rf_reg_record[CHAIN_1][6].reg = 34;
-+		rf_reg_record[CHAIN_1][6].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
-+		rf_reg_record[CHAIN_1][7].bank = 7;
-+		rf_reg_record[CHAIN_1][7].reg = 3;
-+		rf_reg_record[CHAIN_1][7].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
-+		rf_reg_record[CHAIN_1][8].bank = 7;
-+		rf_reg_record[CHAIN_1][8].reg = 4;
-+		rf_reg_record[CHAIN_1][8].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
-+		rf_reg_record[CHAIN_1][9].bank = 7;
-+		rf_reg_record[CHAIN_1][9].reg = 17;
-+		rf_reg_record[CHAIN_1][9].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
-+		rf_reg_record[CHAIN_1][10].bank = 7;
-+		rf_reg_record[CHAIN_1][10].reg = 18;
-+		rf_reg_record[CHAIN_1][10].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
-+		rf_reg_record[CHAIN_1][11].bank = 7;
-+		rf_reg_record[CHAIN_1][11].reg = 19;
-+		rf_reg_record[CHAIN_1][11].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
-+		rf_reg_record[CHAIN_1][12].bank = 7;
-+		rf_reg_record[CHAIN_1][12].reg = 20;
-+		rf_reg_record[CHAIN_1][12].value = rfvalue;
-+	} else {
-+		rt2x00_warn(rt2x00dev, "Unknown chain = %u\n", chain);
-+		return;
-+	}
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rf_configstore);
-+
-+static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_record[][13])
-+{
-+	u8 chain_index = 0, record_index = 0;
-+	u8 bank = 0, rf_register = 0, value = 0;
-+
-+	for (chain_index = 0; chain_index < 2; chain_index++) {
-+		for (record_index = 0; record_index < 13; record_index++) {
-+			bank = rf_record[chain_index][record_index].bank;
-+			rf_register = rf_record[chain_index][record_index].reg;
-+			value = rf_record[chain_index][record_index].value;
-+			rt2800_rfcsr_write_bank(rt2x00dev, bank, rf_register, value);
-+			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n", bank, rf_register, value);
-+		}
-+	}
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rf_configrecover);
-+
-+static void rt2800_setbbptonegenerator(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAA);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAB);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x0A);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAC);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAD);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
-+
-+	rt2800_bbp_write(rt2x00dev, 244, 0x40);
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_setbbptonegenerator);
-+
-+u32 rt2800_do_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx, u8 read_neg)
-+{
-+	u32 macvalue = 0;
-+	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
-+	u8 bbp = 0;
-+	u8 tidxi;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x9b);
-+
-+	bbp = 0x9b;
-+
-+	while (bbp == 0x9b) {
-+		udelay(10);
-+		bbp = rt2800_bbp_read(rt2x00dev, 159);
-+		bbp = bbp & 0xff;
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xba);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
-+
-+	fftout_i = (macvalue >> 16);
-+	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
-+	fftout_q = (macvalue & 0xffff);
-+	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
-+	ptmp = (fftout_i * fftout_i);
-+	ptmp = ptmp + (fftout_q * fftout_q);
-+	pint = ptmp;
-+	rt2x00_dbg(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
-+	if (read_neg) {
-+		pint = pint >> 1;
-+		tidxi = 0x40 - tidx;
-+		tidxi = tidxi & 0x3f;
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0xba);
-+		rt2800_bbp_write(rt2x00dev, 159, tidxi);
-+		rt2800_bbp_write(rt2x00dev, 159, tidxi);
-+		rt2800_bbp_write(rt2x00dev, 159, tidxi);
-+
-+		macvalue = rt2800_register_read(rt2x00dev, 0x057C);
-+
-+		fftout_i = (macvalue >> 16);
-+		fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
-+		fftout_q = (macvalue & 0xffff);
-+		fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
-+		ptmp = (fftout_i * fftout_i);
-+		ptmp = ptmp + (fftout_q * fftout_q);
-+		ptmp = ptmp >> 1;
-+		pint = pint + ptmp;
-+	}
-+
-+	return pint;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_do_fft_accumulation);
-+
-+u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx) {
-+	u32 macvalue = 0;
-+	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xBA);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
-+
-+	fftout_i = (macvalue >> 16);
-+	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
-+	fftout_q = (macvalue & 0xffff);
-+	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
-+	ptmp = (fftout_i * fftout_i);
-+	ptmp = ptmp + (fftout_q * fftout_q);
-+	pint = ptmp;
-+	rt2x00_info(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
-+
-+	return pint;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_read_fft_accumulation);
-+
-+static void rt2800_write_dc(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc, u8 iorq, u8 dc)
-+{
-+	u8 bbp = 0;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
-+	bbp = alc | 0x80;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	if (ch_idx == 0)
-+		bbp = (iorq == 0) ? 0xb1: 0xb2;
-+	else
-+		bbp = (iorq == 0) ? 0xb8: 0xb9;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, bbp);
-+	bbp = dc;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_write_dc);
-+
-+static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
-+{
-+	u32 p0 = 0, p1 = 0, pf = 0;
-+	char idx0 = 0, idx1 = 0;
-+	u8 idxf[] = {0x00, 0x00};
-+	u8 ibit = 0x20;
-+	u8 iorq;
-+	char bidx;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x80);
-+
-+	for (bidx = 5; bidx >= 0; bidx--) {
-+		for (iorq = 0; iorq <= 1; iorq++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
-+			if (idxf[iorq] == 0x20) {
-+				idx0 = 0x20;
-+				p0 = pf;
-+			} else {
-+				idx0 = idxf[iorq] - ibit;
-+				idx0 = idx0 & 0x3F;
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx0);
-+				p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+			}
-+
-+			idx1 = idxf[iorq] + ((bidx == 5) ? 0 : ibit);
-+			idx1 = idx1 & 0x3F;
-+			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx1);
-+			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+
-+			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n", alc_idx, iorq, idxf[iorq]);
-+			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x !\n", p0, p1, pf, idx0, idx1, ibit);
-+
-+			if ((bidx != 5) && (pf <= p0) && (pf < p1)) {
-+				pf = pf;
-+				idxf[iorq] = idxf[iorq];
-+			} else if (p0 < p1) {
-+				pf = p0;
-+				idxf[iorq] = idx0 & 0x3F;
-+			} else {
-+				pf = p1;
-+				idxf[iorq] = idx1 & 0x3F;
-+			}
-+			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n", iorq, iorq, idxf[iorq], pf);
-+
-+			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idxf[iorq]);
-+
-+		}
-+		ibit = ibit >> 1;
-+	}
-+	dc_result[ch_idx][alc_idx][0] = idxf[0];
-+	dc_result[ch_idx][alc_idx][1] = idxf[1];
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_loft_search);
-+
-+static void rt2800_iq_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 *ges, u8 *pes)
-+{
-+	u32 p0 = 0, p1 = 0, pf = 0;
-+	char perr = 0, gerr = 0, iq_err = 0;
-+	char pef = 0, gef = 0;
-+	char psta, pend;
-+	char gsta, gend;
-+
-+	u8 ibit = 0x20;
-+	u8 first_search = 0x00, touch_neg_max = 0x00;
-+	char idx0 = 0, idx1 = 0;
-+	u8 gop;
-+	u8 bbp = 0;
-+	char bidx;
-+
-+	rt2x00_info(rt2x00dev, "IQCalibration Start!\n");
-+	for (bidx = 5; bidx >= 1; bidx--) {
-+		for (gop = 0; gop < 2; gop++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
-+			if ((gop == 1) || (bidx < 4)) {
-+				if (gop == 0)
-+					iq_err = gerr;
-+				else
-+					iq_err = perr;
-+
-+				first_search = (gop == 0) ? (bidx == 3) : (bidx == 5);
-+				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) : ((iq_err & 0x3F) == 0x20);
-+
-+				if (touch_neg_max) {
-+					p0 = pf;
-+					idx0 = iq_err;
-+				} else {
-+					idx0 = iq_err - ibit;
-+					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29): ((gop == 0) ? 0x46 : 0x47);
-+
-+					rt2800_bbp_write(rt2x00dev, 158, bbp);
-+					rt2800_bbp_write(rt2x00dev, 159, idx0);
-+
-+					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+				}
-+
-+				idx1 = iq_err + (first_search ? 0 : ibit);
-+				idx1 = (gop == 0) ? (idx1 & 0x0F) : (idx1 & 0x3F);
-+
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
-+
-+				rt2800_bbp_write(rt2x00dev, 158, bbp);
-+				rt2800_bbp_write(rt2x00dev, 159, idx1);
-+
-+				p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+
-+				rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x !\n", p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
-+
-+				if ((!first_search) && (pf <= p0) && (pf < p1)) {
-+					pf = pf;
-+				} else if (p0 < p1) {
-+					pf = p0;
-+					iq_err = idx0;
-+				} else {
-+					pf = p1;
-+					iq_err = idx1;
-+				}
-+
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
-+
-+				rt2800_bbp_write(rt2x00dev, 158, bbp);
-+				rt2800_bbp_write(rt2x00dev, 159, iq_err);
-+
-+				if (gop == 0)
-+					gerr = iq_err;
-+				else
-+					perr = iq_err;
-+
-+				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n", pf, gerr & 0x0F, perr & 0x3F);
-+
-+			}
-+		}
-+
-+		if (bidx > 0)
-+			ibit = (ibit >> 1);
-+	}
-+	gerr = (gerr & 0x08) ? (gerr & 0x0F) - 0x10 : (gerr & 0x0F);
-+	perr = (perr & 0x20) ? (perr & 0x3F) - 0x40 : (perr & 0x3F);
-+
-+	gerr = (gerr < -0x07) ? -0x07 : (gerr > 0x05) ? 0x05 : gerr;
-+	gsta = gerr - 1;
-+	gend = gerr + 2;
-+
-+	perr = (perr < -0x1f) ? -0x1f : (perr > 0x1d) ? 0x1d : perr;
-+	psta = perr - 1;
-+	pend = perr + 2;
-+
-+	for (gef = gsta; gef <= gend; gef = gef + 1)
-+		for (pef = psta; pef <= pend; pef = pef + 1) {
-+			bbp = (ch_idx == 0) ? 0x28 : 0x46;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, gef & 0x0F);
-+
-+			bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, pef & 0x3F);
-+
-+			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+			if ((gef == gsta) && (pef == psta)) {
-+				pf = p1;
-+				gerr = gef;
-+				perr = pef;
-+			}
-+			else if (pf > p1){
-+				pf = p1;
-+				gerr = gef;
-+				perr = pef;
-+			}
-+			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n", p1, pf, gef & 0x0F, pef & 0x3F);
-+		}
-+
-+	ges[ch_idx] = gerr & 0x0F;
-+	pes[ch_idx] = perr & 0x3F;
-+
-+	rt2x00_info(rt2x00dev, "IQCalibration Done! CH = %u, (gain=%2x, phase=%2x)\n", ch_idx, gerr & 0x0F, perr & 0x3F);
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_iq_search);
-+
-+static void rt2800_rf_aux_tx0_loopback(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x21);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x10);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x1b);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 2, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 34, 0xee);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0xd7);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0xa2);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rf_aux_tx0_loopback);
-+
-+static void rt2800_rf_aux_tx1_loopback(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x22);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x20);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x4b);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 2, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 34, 0xee);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, 0xd7);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, 0xa2);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, 0x20);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_rf_aux_tx1_loopback);
-+
-+void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
-+{
-+	rf_reg_pair rf_store[CHAIN_NUM][13];
-+	u32 macorg1 = 0;
-+	u32 macorg2 = 0;
-+	u32 macorg3 = 0;
-+	u32 macorg4 = 0;
-+	u32 macorg5 = 0;
-+	u32 orig528 = 0;
-+	u32 orig52c = 0;
-+
-+	u32 savemacsysctrl = 0, mtxcycle = 0;
-+	u32 macvalue = 0;
-+	u32 mac13b8 = 0;
-+	u32 p0 = 0, p1 = 0;
-+	u32 p0_idx10 = 0, p1_idx10 = 0;
-+
-+	u8 rfvalue;
-+	u8 loft_dc_search_result[CHAIN_NUM][RF_ALC_NUM][2];
-+	u8 ger[CHAIN_NUM], per[CHAIN_NUM];
-+	u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
-+	u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
-+
-+	u8 vga_gain[] = {14, 14};
-+	u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
-+	u8 bbp = 0, ch_idx = 0, rf_alc_idx = 0, idx = 0;
-+	u8 bbpr30, rfb0r39, rfb0r42;
-+	u8 bbpr1;
-+	u8 bbpr4;
-+	u8 bbpr241, bbpr242;
-+	u8 count_step;
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
-+	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
-+	orig528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
-+	orig52c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x08);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
-+		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
-+
-+	bbpr30 = rt2800_bbp_read(rt2x00dev, 30);
-+	rfb0r39 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 39);
-+	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+
-+	rt2800_bbp_write(rt2x00dev, 30, 0x1F);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x5B);
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+	rt2800_setbbptonegenerator(rt2x00dev);
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
-+		rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
-+		rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
-+		rt2800_register_write(rt2x00dev, 0x13b8, 0x10);
-+		udelay(1);
-+
-+		if (ch_idx == 0) {
-+			rt2800_rf_aux_tx0_loopback(rt2x00dev);
-+		} else {
-+			rt2800_rf_aux_tx1_loopback(rt2x00dev);
-+		}
-+		udelay(1);
-+
-+		if (ch_idx == 0) {
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
-+		} else {
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
-+		}
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0x05);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0x01);
-+		if (ch_idx == 0)
-+			rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+		else
-+			rt2800_bbp_write(rt2x00dev, 159, 0x01);
-+
-+		vga_gain[ch_idx] = 18;
-+		for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
-+			rt2800_bbp_write(rt2x00dev, 23, bbp_2324gain[rf_alc_idx]);
-+			rt2800_bbp_write(rt2x00dev, 24, bbp_2324gain[rf_alc_idx]);
-+
-+			macvalue = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+			macvalue &= (~0x0000F1F1);
-+			macvalue |= (rf_gain[rf_alc_idx] << 4);
-+			macvalue |= (rf_gain[rf_alc_idx] << 12);
-+			rt2800_register_write(rt2x00dev, RF_CONTROL3, macvalue);
-+			macvalue = (0x0000F1F1);
-+			rt2800_register_write(rt2x00dev, RF_BYPASS3, macvalue);
-+
-+			if (rf_alc_idx == 0) {
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x21);
-+				for (;vga_gain[ch_idx] > 0;vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
-+					rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
-+					rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
-+					rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
-+					rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
-+					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
-+					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x21);
-+					p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+					rt2x00_dbg(rt2x00dev, "LOFT AGC %d %d\n", p0, p1);
-+					if ((p0 < 7000*7000) && (p1 < (7000*7000))) {
-+						break;
-+					}
-+				}
-+
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
-+
-+				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
-+
-+				if (vga_gain[ch_idx] < 0)
-+					vga_gain[ch_idx] = 0;
-+		 	}
-+
-+			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
-+
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
-+
-+			rt2800_loft_search(rt2x00dev, ch_idx, rf_alc_idx, loft_dc_search_result);
-+		}
-+	}
-+
-+	for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
-+		for (idx = 0; idx < 4; idx++) {
-+			rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+			bbp = (idx<<2) + rf_alc_idx;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " ALC %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb1);
-+			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x00];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " I0 %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb2);
-+			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x01];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " Q0 %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb8);
-+			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x00];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " I1 %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb9);
-+			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x01];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " Q1 %2x\n", bbp);
-+		}
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+	bbp = 0x00;
-+	rt2800_bbp_write(rt2x00dev, 244, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 21, 0x01);
-+	udelay(1);
-+	rt2800_bbp_write(rt2x00dev, 21, 0x00);
-+
-+	rt2800_rf_configrecover(rt2x00dev, rf_store);
-+
-+	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL2, orig528);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, orig52c);
-+	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
-+
-+	rt2x00_info(rt2x00dev, "LOFT Calibration Done!\n");
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
-+	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+
-+	bbpr1 = rt2800_bbp_read(rt2x00dev, 1);
-+	bbpr4 = rt2800_bbp_read(rt2x00dev, 4);
-+	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
-+	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
-+	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x08);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000101);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 4, bbpr4 & (~0x18));
-+		rt2800_bbp_write(rt2x00dev, 21, 0x01);
-+		udelay(1);
-+		rt2800_bbp_write(rt2x00dev, 21, 0x00);
-+
-+		rt2800_bbp_write(rt2x00dev, 241, 0x14);
-+		rt2800_bbp_write(rt2x00dev, 242, 0x80);
-+		rt2800_bbp_write(rt2x00dev, 244, 0x31);
-+	} else {
-+		rt2800_setbbptonegenerator(rt2x00dev);
-+	}
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
-+	udelay(1);
-+
-+	rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
-+
-+	if (!test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000000);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
-+	}
-+
-+	rt2800_register_write(rt2x00dev, 0x13b8, 0x00000010);
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
-+		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
-+
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x3B);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x3B);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x03);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x60);
-+	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x80);
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+		if (ch_idx == 0) {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x01);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+				bbp = bbpr1 & (~0x18);
-+				bbp = bbp | 0x00;
-+				rt2800_bbp_write(rt2x00dev, 1, bbp);
-+			}
-+			rt2800_rf_aux_tx0_loopback(rt2x00dev);
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x01);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x01);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
-+				bbp = bbpr1 & (~0x18);
-+				bbp = bbp | 0x08;
-+				rt2800_bbp_write(rt2x00dev, 1, bbp);
-+			}
-+			rt2800_rf_aux_tx1_loopback(rt2x00dev);
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
-+		}
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0x05);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x04);
-+
-+		bbp = (ch_idx == 0) ? 0x28 : 0x46;
-+		rt2800_bbp_write(rt2x00dev, 158, bbp);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+			rt2800_bbp_write(rt2x00dev, 23, 0x06);
-+			rt2800_bbp_write(rt2x00dev, 24, 0x06);
-+			count_step = 1;
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 23, 0x1F);
-+			rt2800_bbp_write(rt2x00dev, 24, 0x1F);
-+			count_step = 2;
-+		}
-+
-+		for (;vga_gain[ch_idx] < 19; vga_gain[ch_idx]=(vga_gain[ch_idx] + count_step)) {
-+			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
-+
-+			bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+			p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+				p0_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
-+
-+			bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x21);
-+			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
-+				p1_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
-+
-+			rt2x00_dbg(rt2x00dev, "IQ AGC %d %d\n", p0, p1);
-+
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+				rt2x00_dbg(rt2x00dev, "IQ AGC IDX 10 %d %d\n", p0_idx10, p1_idx10);
-+				if ((p0_idx10 > 7000*7000) || (p1_idx10 > 7000*7000)) {
-+					if (vga_gain[ch_idx]!=0)
-+						vga_gain[ch_idx] = vga_gain[ch_idx]-1;
-+					break;
-+				}
-+			}
-+
-+			if ((p0 > 2500*2500) || (p1 > 2500*2500)) {
-+				break;
-+			}
-+		}
-+
-+		if (vga_gain[ch_idx] > 18)
-+			vga_gain[ch_idx] = 18;
-+		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
-+
-+		bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+		rt2800_bbp_write(rt2x00dev, 158, bbp);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+		rt2800_iq_search(rt2x00dev, ch_idx, ger, per);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x28);
-+	bbp = ger[CHAIN_0] & 0x0F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x29);
-+	bbp = per[CHAIN_0] & 0x3F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x46);
-+	bbp = ger[CHAIN_1] & 0x0F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x47);
-+	bbp = per[CHAIN_1] & 0x3F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 1, bbpr1);
-+		rt2800_bbp_write(rt2x00dev, 241, bbpr241);
-+		rt2800_bbp_write(rt2x00dev, 242, bbpr242);
-+	}
-+	rt2800_bbp_write(rt2x00dev, 244, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 30, bbpr30);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, rfb0r39);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 4, bbpr4);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 21, 0x01);
-+	udelay(1);
-+	rt2800_bbp_write(rt2x00dev, 21, 0x00);
-+
-+	rt2800_rf_configrecover(rt2x00dev, rf_store);
-+
-+	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
-+
-+	rt2x00_info(rt2x00dev, "TX IQ Calibration Done!\n");
-+
-+	return;
-+}
-+EXPORT_SYMBOL_GPL(rt2800_loft_iq_calibration);
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9601,6 +10549,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rxdcoc_calibration(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
-+	rt2800_loft_iq_calibration(rt2x00dev);
- 	rt2800_rxiq_calibration(rt2x00dev);
- }
- 
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -17,6 +17,16 @@
- #define WCID_START	33
- #define WCID_END	222
- #define STA_IDS_SIZE	(WCID_END - WCID_START + 2)
-+#define CHAIN_0		0x0
-+#define CHAIN_1		0x1
-+#define RF_ALC_NUM	6
-+#define CHAIN_NUM	2
-+
-+typedef struct rf_reg_pair {
-+	u8 bank;
-+	u8 reg;
-+	u8 value;
-+} rf_reg_pair;
- 
- /* RT2800 driver data structure */
- struct rt2800_drv_data {
-@@ -237,6 +247,7 @@ int rt2800_calcrcalibrationcode(struct r
- void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
- void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
- void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev);
-+void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev);
- 
- int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
- void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -566,6 +566,7 @@ struct rt2x00lib_ops {
- 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
- 	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
- 	void (*rxiq_calibration) (struct rt2x00_dev *rt2x00dev);
-+	void (*loft_iq_calibration) (struct rt2x00_dev *rt2x00dev);
- 
- 	/*
- 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch
deleted file mode 100644
index 8d9b6e7de9..0000000000
--- a/package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch
+++ /dev/null
@@ -1,304 +0,0 @@
-From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
-Date: Sun, 10 Mar 2019 17:22:08 +0100
-Subject: [PATCH] mac80211: add TX_NEEDS_ALIGNED4_SKBS hw flag
-
-The driver should set this flag if the hardware requires tx skb data
-(starting with the LLC header) to be aligned to 4 bytes.
-
-Padding is added after ieee80211_hdr, before IV/LLC.
-
-Before this patch, we have to do memmove(hdrlen) twice in the driver:
-Once before we pass this to HW and once again in tx completion
-(to fix up the skb for monitor mode).
-
-With this patch we can skip this memmove() and thus reduce CPU cycles in
-the data path.
-
-Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -2266,6 +2266,9 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_EXT_KEY_ID_NATIVE: Driver and hardware are supporting Extended
-  *	Key ID and can handle two unicast keys per station for Rx and Tx.
-  *
-+ * @IEEE80211_HW_TX_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
-+ *	Padding will be added after ieee80211_hdr, before IV/LLC.
-+ *
-  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-  */
- enum ieee80211_hw_flags {
-@@ -2318,6 +2321,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_SUPPORTS_MULTI_BSSID,
- 	IEEE80211_HW_SUPPORTS_ONLY_HE_MULTI_BSSID,
- 	IEEE80211_HW_EXT_KEY_ID_NATIVE,
-+	IEEE80211_HW_TX_NEEDS_ALIGNED4_SKBS,
- 
- 	/* keep last, obviously */
- 	NUM_IEEE80211_HW_FLAGS
-@@ -2611,6 +2615,40 @@ ieee80211_get_alt_retry_rate(const struc
- void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
- 
- /**
-+ * ieee80211_hdr_padsize - get size of padding between 802.11 header and LLC
-+ * @hw: the hardware
-+ * @hdrlen: 802.11 header length
-+ */
-+static inline unsigned int
-+ieee80211_hdr_padsize(struct ieee80211_hw *hw, unsigned int hdrlen)
-+{
-+	/*
-+	 * While hdrlen is already aligned to two-byte boundaries,
-+	 * simple check with & 2 will return correct padsize.
-+	 */
-+	if (ieee80211_hw_check(hw, TX_NEEDS_ALIGNED4_SKBS))
-+		return hdrlen & 2;
-+	return 0;
-+}
-+
-+/**
-+ * ieee80211_padded_hdrlen - get padded 802.11 header size
-+ * @hw: the hardware
-+ * @fc: frame control field in little-endian format
-+ */
-+static inline unsigned int
-+ieee80211_padded_hdrlen(struct ieee80211_hw *hw, __le16 fc)
-+{
-+	unsigned int hdrlen;
-+
-+	hdrlen = ieee80211_hdrlen(fc);
-+	hdrlen += ieee80211_hdr_padsize(hw, hdrlen);
-+
-+	return hdrlen;
-+}
-+
-+
-+/**
-  * DOC: Hardware crypto acceleration
-  *
-  * mac80211 is capable of taking advantage of many hardware
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -1877,6 +1877,10 @@ int ieee80211_if_add(struct ieee80211_lo
- 					+ 8 /* rfc1042/bridge tunnel */
- 					- ETH_HLEN /* ethernet hard_header_len */
- 					+ IEEE80211_ENCRYPT_HEADROOM;
-+
-+		if (ieee80211_hw_check(&local->hw, TX_NEEDS_ALIGNED4_SKBS))
-+			ndev->needed_headroom += 2; /* padding */
-+
- 		ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
- 
- 		ret = dev_alloc_name(ndev, ndev->name);
---- a/net/mac80211/mesh_pathtbl.c
-+++ b/net/mac80211/mesh_pathtbl.c
-@@ -102,13 +102,15 @@ void mesh_path_assign_nexthop(struct mes
- static void prepare_for_gate(struct sk_buff *skb, char *dst_addr,
- 			     struct mesh_path *gate_mpath)
- {
-+	struct ieee80211_sub_if_data *sdata = gate_mpath->sdata;
-+	struct ieee80211_hw *hw = &sdata->local->hw;
- 	struct ieee80211_hdr *hdr;
- 	struct ieee80211s_hdr *mshdr;
- 	int mesh_hdrlen, hdrlen;
- 	char *next_hop;
- 
- 	hdr = (struct ieee80211_hdr *) skb->data;
--	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
- 	mshdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
- 
- 	if (!(mshdr->flags & MESH_FLAGS_AE)) {
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2673,7 +2673,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	struct ieee80211_local *local = rx->local;
- 	struct ieee80211_sub_if_data *sdata = rx->sdata;
- 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
--	u16 ac, q, hdrlen;
-+	u16 ac, q, hdrlen, padsize;
- 	int tailroom = 0;
- 
- 	hdr = (struct ieee80211_hdr *) skb->data;
-@@ -2766,7 +2766,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	if (sdata->crypto_tx_tailroom_needed_cnt)
- 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
- 
--	fwd_skb = skb_copy_expand(skb, local->tx_headroom +
-+	padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
-+
-+	fwd_skb = skb_copy_expand(skb, local->tx_headroom + padsize +
- 				       sdata->encrypt_headroom,
- 				  tailroom, GFP_ATOMIC);
- 	if (!fwd_skb)
-@@ -2798,6 +2800,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 		return RX_DROP_MONITOR;
- 	}
- 
-+	if (padsize) {
-+		skb_push(fwd_skb, padsize);
-+		memmove(fwd_skb->data, skb->data + padsize, hdrlen);
-+		memset(fwd_skb->data + hdrlen, 0, padsize);
-+	}
-+
- 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
- 	ieee80211_add_pending_skb(local, fwd_skb);
-  out:
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -308,7 +308,7 @@ struct ieee80211_fast_tx {
- 	u8 hdr_len;
- 	u8 sa_offs, da_offs, pn_offs;
- 	u8 band;
--	u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
-+	u8 hdr[30 + 2 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
- 	       sizeof(rfc1042_header)] __aligned(2);
- 
- 	struct rcu_head rcu_head;
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -512,6 +512,7 @@ static void ieee80211_report_used_skb(st
- {
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_hdr *hdr = (void *)skb->data;
-+	struct ieee80211_hw *hw = &local->hw;
- 	bool acked = info->flags & IEEE80211_TX_STAT_ACK;
- 
- 	if (dropped)
-@@ -528,7 +529,7 @@ static void ieee80211_report_used_skb(st
- 			skb->dev = NULL;
- 		} else {
- 			unsigned int hdr_size =
--				ieee80211_hdrlen(hdr->frame_control);
-+				ieee80211_padded_hdrlen(hw, hdr->frame_control);
- 
- 			/* Check to see if packet is a TDLS teardown packet */
- 			if (ieee80211_is_data(hdr->frame_control) &&
-@@ -652,9 +653,22 @@ void ieee80211_tx_monitor(struct ieee802
- 	struct sk_buff *skb2;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_hdr *hdr = (void *)skb->data;
- 	struct net_device *prev_dev = NULL;
-+	unsigned int hdrlen, padsize;
- 	int rtap_len;
- 
-+	/* Remove padding if was added */
-+	if (ieee80211_hw_check(&local->hw, TX_NEEDS_ALIGNED4_SKBS)) {
-+		hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+		padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
-+
-+		if (padsize && skb->len > hdrlen + padsize) {
-+			memmove(skb->data + padsize, skb->data, hdrlen);
-+			skb_pull(skb, padsize);
-+		}
-+	}
-+
- 	/* send frame to monitor interfaces now */
- 	rtap_len = ieee80211_tx_radiotap_len(info);
- 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
---- a/net/mac80211/tkip.c
-+++ b/net/mac80211/tkip.c
-@@ -198,10 +198,12 @@ void ieee80211_get_tkip_p2k(struct ieee8
- {
- 	struct ieee80211_key *key = (struct ieee80211_key *)
- 			container_of(keyconf, struct ieee80211_key, conf);
-+	struct ieee80211_hw *hw = &key->local->hw;
- 	const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
- 	struct tkip_ctx *ctx = &key->u.tkip.tx;
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
--	const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
-+	const u8 *data = (u8 *)hdr + ieee80211_padded_hdrlen(hw,
-+							hdr->frame_control);
- 	u32 iv32 = get_unaligned_le32(&data[4]);
- 	u16 iv16 = data[2] | (data[0] << 8);
- 
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1171,8 +1171,7 @@ ieee80211_tx_prepare(struct ieee80211_su
- 	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
- 
- 	hdr = (struct ieee80211_hdr *) skb->data;
--
--	tx->hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	tx->hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
- 
- 	if (likely(sta)) {
- 		if (!IS_ERR(sta))
-@@ -2244,7 +2243,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
- 		goto fail;
- 
- 	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
--	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
- 
- 	if (skb->len < len_rthdr + hdrlen)
- 		goto fail;
-@@ -2463,7 +2462,7 @@ static struct sk_buff *ieee80211_build_h
- 	struct ieee80211_chanctx_conf *chanctx_conf;
- 	struct ieee80211_sub_if_data *ap_sdata;
- 	enum nl80211_band band;
--	int ret;
-+	int padsize, ret;
- 
- 	if (IS_ERR(sta))
- 		sta = NULL;
-@@ -2774,7 +2773,9 @@ static struct sk_buff *ieee80211_build_h
- 	}
- 
- 	skb_pull(skb, skip_header_bytes);
-+	padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
- 	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
-+	head_need += padsize;
- 
- 	/*
- 	 * So we need to modify the skb header and hence need a copy of
-@@ -2807,6 +2808,9 @@ static struct sk_buff *ieee80211_build_h
- 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
- #endif
- 
-+	if (padsize)
-+		memset(skb_push(skb, padsize), 0, padsize);
-+
- 	if (ieee80211_is_data_qos(fc)) {
- 		__le16 *qos_control;
- 
-@@ -2983,6 +2987,8 @@ void ieee80211_check_fast_xmit(struct st
- 		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
- 	}
- 
-+	build.hdr_len += ieee80211_hdr_padsize(&local->hw, build.hdr_len);
-+
- 	/* We store the key here so there's no point in using rcu_dereference()
- 	 * but that's fine because the code that changes the pointers will call
- 	 * this function after doing so. For a single CPU that would be enough,
-@@ -3577,7 +3583,7 @@ begin:
- 	tx.local = local;
- 	tx.skb = skb;
- 	tx.sdata = vif_to_sdata(info->control.vif);
--	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
- 
- 	if (txq->sta)
- 		tx.sta = container_of(txq->sta, struct sta_info, sta);
-@@ -4059,7 +4065,7 @@ ieee80211_build_data_template(struct iee
- 	hdr = (void *)skb->data;
- 	tx.sta = sta_info_get(sdata, hdr->addr1);
- 	tx.skb = skb;
--	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	tx.hdrlen = ieee80211_padded_hdrlen(&tx.local->hw, hdr->frame_control);
- 
- 	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
- 		rcu_read_unlock();
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -272,6 +272,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(SUPPORTS_MULTI_BSSID),
- 	FLAG(SUPPORTS_ONLY_HE_MULTI_BSSID),
- 	FLAG(EXT_KEY_ID_NATIVE),
-+	FLAG(TX_NEEDS_ALIGNED4_SKBS),
- #undef FLAG
- };
- 
diff --git a/package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch b/package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch
deleted file mode 100644
index 6ed2884d5e..0000000000
--- a/package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 17 Mar 2019 18:11:30 +0100
-Subject: [PATCH] mac80211: optimize skb resizing
-
-When forwarding unicast packets from ethernet to batman-adv over 802.11s
-(with forwarding disabled), the typical required headroom to transmit
-encrypted packets on mt76 is 32 (802.11) + 6 (802.11s) + 8 (CCMP) +
-2 (padding) + 6 (LLC) + 18 (batman-adv) - 14 (old ethernet header) = 58 bytes.
-
-On systems where NET_SKB_PAD is 64 this leads to a call to pskb_expand_head
-for every packet, since mac80211 also tries to allocate 16 bytes status
-headroom for radiotap headers.
-
-This patch fixes these unnecessary reallocations by only requiring the extra
-status headroom in ieee80211_tx_monitor()
-If however a reallocation happens before that call, the status headroom gets
-added there as well, in order to avoid double reallocation.
-
-The patch also cleans up the code by moving the headroom calculation to
-ieee80211_skb_resize.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1780,6 +1780,9 @@ int ieee80211_tx_control_port(struct wip
- 			      const u8 *dest, __be16 proto, bool unencrypted);
- int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
- 			      const u8 *buf, size_t len);
-+int ieee80211_skb_resize(struct ieee80211_local *local,
-+			 struct ieee80211_sub_if_data *sdata,
-+			 struct sk_buff *skb, int hdrlen, int hdr_add);
- 
- /* HT */
- void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -669,6 +669,11 @@ void ieee80211_tx_monitor(struct ieee802
- 		}
- 	}
- 
-+	if (ieee80211_skb_resize(local, NULL, skb, 0, 0)) {
-+		dev_kfree_skb(skb);
-+		return;
-+	}
-+
- 	/* send frame to monitor interfaces now */
- 	rtap_len = ieee80211_tx_radiotap_len(info);
- 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1935,37 +1935,53 @@ static bool ieee80211_tx(struct ieee8021
- }
- 
- /* device xmit handlers */
--
--static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
--				struct sk_buff *skb,
--				int head_need, bool may_encrypt)
-+int ieee80211_skb_resize(struct ieee80211_local *local,
-+			 struct ieee80211_sub_if_data *sdata,
-+			 struct sk_buff *skb, int hdr_len, int hdr_extra)
- {
--	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_hdr *hdr;
--	bool enc_tailroom;
--	int tail_need = 0;
--
--	hdr = (struct ieee80211_hdr *) skb->data;
--	enc_tailroom = may_encrypt &&
--		       (sdata->crypto_tx_tailroom_needed_cnt ||
--			ieee80211_is_mgmt(hdr->frame_control));
--
--	if (enc_tailroom) {
--		tail_need = IEEE80211_ENCRYPT_TAILROOM;
--		tail_need -= skb_tailroom(skb);
--		tail_need = max_t(int, tail_need, 0);
-+	int head_need, head_max;
-+	int tail_need, tail_max;
-+	bool enc_tailroom = false;
-+
-+	if (sdata && !hdr_len &&
-+	    !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
-+		hdr = (struct ieee80211_hdr *) skb->data;
-+		enc_tailroom = (sdata->crypto_tx_tailroom_needed_cnt ||
-+				ieee80211_is_mgmt(hdr->frame_control));
-+		hdr_len += sdata->encrypt_headroom;
-+	}
-+
-+	head_need = head_max = hdr_len;
-+	tail_need = tail_max = 0;
-+	if (!sdata) {
-+		head_need = head_max = local->tx_headroom;
-+	} else {
-+		head_max += hdr_extra;
-+		head_max += max_t(int, local->tx_headroom,
-+				  local->hw.extra_tx_headroom);
-+		head_need += local->hw.extra_tx_headroom;
-+
-+		tail_max = IEEE80211_ENCRYPT_TAILROOM;
-+		if (enc_tailroom)
-+			tail_need = tail_max;
- 	}
- 
- 	if (skb_cloned(skb) &&
- 	    (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
- 	     !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
- 		I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
--	else if (head_need || tail_need)
-+	else if (head_need > skb_headroom(skb) ||
-+		 tail_need > skb_tailroom(skb))
- 		I802_DEBUG_INC(local->tx_expand_skb_head);
- 	else
- 		return 0;
- 
--	if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
-+	head_max = max_t(int, 0, head_max - skb_headroom(skb));
-+	tail_max = max_t(int, 0, tail_max - skb_tailroom(skb));
-+
-+	if (pskb_expand_head(skb, head_max, tail_max, GFP_ATOMIC)) {
- 		wiphy_debug(local->hw.wiphy,
- 			    "failed to reallocate TX buffer\n");
- 		return -ENOMEM;
-@@ -1981,18 +1997,8 @@ void ieee80211_xmit(struct ieee80211_sub
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_hdr *hdr;
--	int headroom;
--	bool may_encrypt;
--
--	may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
- 
--	headroom = local->tx_headroom;
--	if (may_encrypt)
--		headroom += sdata->encrypt_headroom;
--	headroom -= skb_headroom(skb);
--	headroom = max_t(int, 0, headroom);
--
--	if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
-+	if (ieee80211_skb_resize(local, sdata, skb, 0, 0)) {
- 		ieee80211_free_txskb(&local->hw, skb);
- 		return;
- 	}
-@@ -2774,30 +2780,14 @@ static struct sk_buff *ieee80211_build_h
- 
- 	skb_pull(skb, skip_header_bytes);
- 	padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
--	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
-+	head_need = hdrlen + encaps_len + meshhdrlen;
- 	head_need += padsize;
- 
--	/*
--	 * So we need to modify the skb header and hence need a copy of
--	 * that. The head_need variable above doesn't, so far, include
--	 * the needed header space that we don't need right away. If we
--	 * can, then we don't reallocate right now but only after the
--	 * frame arrives at the master device (if it does...)
--	 *
--	 * If we cannot, however, then we will reallocate to include all
--	 * the ever needed space. Also, if we need to reallocate it anyway,
--	 * make it big enough for everything we may ever need.
--	 */
--
--	if (head_need > 0 || skb_cloned(skb)) {
--		head_need += sdata->encrypt_headroom;
--		head_need += local->tx_headroom;
--		head_need = max_t(int, 0, head_need);
--		if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
--			ieee80211_free_txskb(&local->hw, skb);
--			skb = NULL;
--			return ERR_PTR(-ENOMEM);
--		}
-+	if (ieee80211_skb_resize(local, sdata, skb, head_need,
-+				 sdata->encrypt_headroom)) {
-+		ieee80211_free_txskb(&local->hw, skb);
-+		skb = NULL;
-+		return ERR_PTR(-ENOMEM);
- 	}
- 
- 	if (encaps_data)
-@@ -3417,7 +3407,6 @@ static bool ieee80211_xmit_fast(struct i
- 	struct ieee80211_local *local = sdata->local;
- 	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
- 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
--	int hw_headroom = sdata->local->hw.extra_tx_headroom;
- 	struct ethhdr eth;
- 	struct ieee80211_tx_info *info;
- 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
-@@ -3469,10 +3458,7 @@ static bool ieee80211_xmit_fast(struct i
- 	 * as the may-encrypt argument for the resize to not account for
- 	 * more room than we already have in 'extra_head'
- 	 */
--	if (unlikely(ieee80211_skb_resize(sdata, skb,
--					  max_t(int, extra_head + hw_headroom -
--						     skb_headroom(skb), 0),
--					  false))) {
-+	if (unlikely(ieee80211_skb_resize(local, sdata, skb, extra_head, 0))) {
- 		kfree_skb(skb);
- 		return true;
- 	}
diff --git a/package/kernel/mac80211/ralink.mk b/package/kernel/mac80211/ralink.mk
deleted file mode 100644
index 6aca170773..0000000000
--- a/package/kernel/mac80211/ralink.mk
+++ /dev/null
@@ -1,172 +0,0 @@
-PKG_DRIVERS += \
-	rt2x00-lib rt2x00-pci rt2x00-usb rt2x00-mmio \
-	rt2400-pci rt2500-pci rt2500-usb \
-	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
-	rt61-pci rt73-usb
-
-PKG_CONFIG_DEPENDS += \
-	CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS \
-	CONFIG_PACKAGE_RT2X00_DEBUG
-
-config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
-config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
-config-$(call config_package,rt2x00-mmio) += RT2X00_LIB_MMIO
-config-$(call config_package,rt2x00-usb) += RT2X00_LIB_USB
-config-$(CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS) += RT2X00_LIB_DEBUGFS
-config-$(CONFIG_PACKAGE_RT2X00_DEBUG) += RT2X00_DEBUG
-
-config-$(call config_package,rt2400-pci) += RT2400PCI
-config-$(call config_package,rt2500-pci) += RT2500PCI
-config-$(call config_package,rt2500-usb) += RT2500USB
-config-$(call config_package,rt61-pci) += RT61PCI
-config-$(call config_package,rt73-usb) += RT73USB
-
-config-$(call config_package,rt2800-lib) += RT2800_LIB
-
-config-$(call config_package,rt2800-soc) += RT2800SOC
-config-$(call config_package,rt2800-pci) += RT2800PCI
-config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
-
-config-$(call config_package,rt2800-usb) += RT2800USB
-config-y += RT2800USB_RT33XX RT2800USB_RT35XX RT2800USB_RT3573 RT2800USB_RT53XX RT2800USB_RT55XX RT2800USB_UNKNOWN
-
-define KernelPackage/rt2x00/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Ralink Drivers for RT2x00 cards
-endef
-
-define KernelPackage/rt2x00-lib
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211
-  TITLE+= (LIB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00lib.ko
-  MENU:=1
-endef
-
-define KernelPackage/rt2x00-lib/config
-  if PACKAGE_kmod-rt2x00-lib
-
-	config PACKAGE_RT2X00_LIB_DEBUGFS
-		bool "Enable rt2x00 debugfs support"
-		depends on PACKAGE_MAC80211_DEBUGFS
-		help
-		  Enable creation of debugfs files for the rt2x00 drivers.
-		  These debugfs files support both reading and writing of the
-		  most important register types of the rt2x00 hardware.
-
-	config PACKAGE_RT2X00_DEBUG
-		bool "Enable rt2x00 debug output"
-		help
-		  Enable debugging output for all rt2x00 modules
-
-  endif
-endef
-
-define KernelPackage/rt2x00-mmio
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib
-  HIDDEN:=1
-  TITLE+= (MMIO)
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko
-endef
-
-define KernelPackage/rt2x00-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
-  HIDDEN:=1
-  TITLE+= (PCI)
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
-endef
-
-define KernelPackage/rt2x00-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
-  HIDDEN:=1
-  TITLE+= (USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
-endef
-
-define KernelPackage/rt2800-lib
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
-  HIDDEN:=1
-  TITLE+= (rt2800 LIB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
-endef
-
-define KernelPackage/rt2400-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
-  TITLE+= (RT2400 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-endef
-
-define KernelPackage/rt2500-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
-  TITLE+= (RT2500 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-endef
-
-define KernelPackage/rt2500-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
-  TITLE+= (RT2500 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-endef
-
-define KernelPackage/rt2800-mmio
-$(call KernelPackage/rt2x00/Default)
-  TITLE += (RT28xx/RT3xxx MMIO)
-  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
-  HIDDEN:=1
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800mmio.ko
-endef
-
-define KernelPackage/rt2800-soc
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
-  TITLE += (RT28xx/RT3xxx SoC)
-  FILES := \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00soc.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800soc.ko
-  AUTOLOAD:=$(call AutoProbe,rt2800soc)
-endef
-
-define KernelPackage/rt2800-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio +kmod-eeprom-93cx6 +rt2800-pci-firmware
-  TITLE+= (RT2860 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2800pci)
-endef
-
-define KernelPackage/rt2800-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt +rt2800-usb-firmware
-  TITLE+= (RT2870 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2800usb)
-endef
-
-
-define KernelPackage/rt61-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6 +kmod-lib-crc-itu-t +rt61-pci-firmware
-  TITLE+= (RT2x61 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt61pci)
-endef
-
-define KernelPackage/rt73-usb
-  $(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-lib-crc-itu-t +rt73-usb-firmware
-  TITLE+= (RT73 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt73usb)
-endef
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
deleted file mode 100644
index e7eb9e3117..0000000000
--- a/package/kernel/mac80211/realtek.mk
+++ /dev/null
@@ -1,170 +0,0 @@
-PKG_DRIVERS += \
-	rtl8180 rtl8187 \
-	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
-	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8821ae \
-	rtl8xxxu
-
-config-$(call config_package,rtl8180) += RTL8180
-config-$(call config_package,rtl8187) += RTL8187
-
-config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
-config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
-config-$(call config_package,rtlwifi-btcoexist) += RTLBTCOEXIST
-config-$(call config_package,rtlwifi-usb) += RTLWIFI_USB
-config-$(call config_package,rtl8192c-common) += RTL8192C_COMMON
-config-$(call config_package,rtl8192ce) += RTL8192CE
-config-$(call config_package,rtl8192se) += RTL8192SE
-config-$(call config_package,rtl8192de) += RTL8192DE
-config-$(call config_package,rtl8192cu) += RTL8192CU
-config-$(call config_package,rtl8821ae) += RTL8821AE
-config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
-
-config-$(call config_package,rtl8xxxu) += RTL8XXXU
-config-y += RTL8XXXU_UNTESTED
-
-define KernelPackage/rtl818x/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek Drivers for RTL818x devices
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/rtl8187
-  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
-endef
-
-define KernelPackage/rtl8180
-  $(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @PCI_SUPPORT
-  TITLE+= (RTL8180 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
-endef
-
-define KernelPackage/rtl8187
-$(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core
-  TITLE+= (RTL8187 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8187)
-endef
-
-define KernelPackage/rtlwifi/config
-	config PACKAGE_RTLWIFI_DEBUG
-		bool "Realtek wireless debugging"
-		depends on PACKAGE_kmod-rtlwifi
-		help
-		  Say Y, if you want to debug realtek wireless drivers.
-
-endef
-
-define KernelPackage/rtlwifi
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek common driver part
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtlwifi-pci
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek common driver part (PCI support)
-  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtl_pci)
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtlwifi-btcoexist
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek BT coexist support
-  DEPENDS+= +kmod-rtlwifi
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/btcoexist/btcoexist.ko
-  AUTOLOAD:=$(call AutoProbe,btcoexist)
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtlwifi-usb
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek common driver part (USB support)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
-  AUTOLOAD:=$(call AutoProbe,rtl_usb)
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtl8192c-common
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
-  DEPENDS+= +kmod-rtlwifi
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtl8192ce
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192CE/RTL8188CE support
-  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common +rtl8192ce-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
-endef
-
-define KernelPackage/rtl8192se
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192SE/RTL8191SE support
-  DEPENDS+= +kmod-rtlwifi-pci +rtl8192se-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192se)
-endef
-
-define KernelPackage/rtl8192de
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192DE/RTL8188DE support
-  DEPENDS+= +kmod-rtlwifi-pci +rtl8192de-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192de)
-endef
-
-define KernelPackage/rtl8192cu
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192CU/RTL8188CU support
-  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common +rtl8192cu-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
-endef
-
-define KernelPackage/rtl8821ae
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8821AE support
-  DEPENDS+= +kmod-rtlwifi-btcoexist +kmod-rtlwifi-pci +rtl8821ae-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/rtl8821ae.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8821ae)
-endef
-
-define KernelPackage/rtl8xxxu
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=alternative Realtek RTL8XXXU support
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8xxxu)
-endef
-
-define KernelPackage/rtl8xxxu/description
-  This is an alternative driver for various Realtek RTL8XXX
-  parts written to utilize the Linux mac80211 stack.
-  The driver is known to work with a number of RTL8723AU,
-  RL8188CU, RTL8188RU, RTL8191CU, and RTL8192CU devices
-
-  This driver is under development and has a limited feature
-  set. In particular it does not yet support 40MHz channels
-  and power management. However it should have a smaller
-  memory footprint than the vendor drivers and benetifs
-  from the in kernel mac80211 stack.
-
-  It can coexist with drivers from drivers/staging/rtl8723au,
-  drivers/staging/rtl8192u, and drivers/net/wireless/rtlwifi,
-  but you will need to control which module you wish to load.
-
-  RTL8XXXU_UNTESTED is enabled
-  This option enables detection of Realtek 8723/8188/8191/8192 WiFi
-  USB devices which have not been tested directly by the driver
-  author or reported to be working by third parties.
-
-  Please report your results!
-endef