From ce2c395b63def0ed7ff0003576c112b14761ce05 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@gmail.com>
Date: Thu, 15 Aug 2019 11:07:49 +0800
Subject: [PATCH] Revert changes of mac80211

---
 package/kernel/mac80211/Makefile              | 1553 +----------------
 package/kernel/mac80211/ath.mk                |  276 +++
 package/kernel/mac80211/broadcom.mk           |  487 ++++++
 .../files/lib/netifd/wireless/mac80211.sh     |   24 +-
 .../mac80211/files/lib/wifi/mac80211.sh       |    2 +-
 package/kernel/mac80211/intel.mk              |  200 +++
 package/kernel/mac80211/marvell.mk            |   90 +
 .../patches/005-revert-devcoredump.patch      |   11 -
 .../patches/006-fix-genl-multicast.patch      |   10 -
 .../007-fix-linux-verification-h.patch        |   11 -
 .../patches/008-fix-genl-family-id.patch      |   10 -
 .../patches/009-backport_sg_init_marker.patch |   30 -
 .../patches/011-backport-overflow_h.patch     |  322 ----
 ...013-backport-firmware_request_nowarn.patch |   19 -
 .../patches/060-no_local_ssb_bcma.patch       |  132 --
 .../081-ath10k-calibration-variant.patch      |  111 --
 ...press-Unknown-eventid-36925-warnings.patch |   36 -
 ...00-use-TXOP_BACKOFF-for-probe-frames.patch |   40 -
 ...-IEs-for-variant-before-falling-back.patch |  237 ---
 ...h10k-fix-build-errors-with-CONFIG_PM.patch |   72 -
 ...y-free-requested-but-not-started-TX-.patch |   37 -
 ...-drop-frames-appearing-to-be-from-us.patch |   25 -
 ...mac-handle-FWHALT-mailbox-indication.patch |   60 -
 ...-packet-filtering-in-promiscuous-mod.patch |  133 --
 ...leanup-brcmf_cfg80211_escan-function.patch |  133 --
 ...cs_to_jiffies-instead-of-calculation.patch |   31 -
 ...rid-of-brcmf_cfg80211_escan-function.patch |   83 -
 ...-of-struct-brcmf_cfg80211_info-activ.patch |   86 -
 ...e-configuration-of-probe-request-IEs.patch |   55 -
 ...15-brcmfmac-add-CLM-download-support.patch |  434 -----
 ...driver-unbind-order-of-the-sdio-func.patch |   37 -
 ...fmac-Avoid-build-error-with-make-W-1.patch |   33 -
 ...-load-error-for-legacy-chips-when-us.patch |   40 -
 ...ral-scan-support-under-a-separate-co.patch |  103 --
 ...tral-scan-support-under-a-separate-c.patch |   91 -
 ....16-ath9k-discard-undersized-packets.patch |   25 -
 ...ameter-order-in-brcmf_sdiod_f0_write.patch |   39 -
 ...r-sizes-on-hardware-are-not-dependen.patch |  105 --
 ...ac-Split-brcmf_sdiod_regrw_helper-up.patch |  179 --
 ...ean-up-brcmf_sdiod_set_sbaddr_window.patch |   62 -
 ...16-0005-brcmfmac-Remove-dead-IO-code.patch |   91 -
 ...brcmfmac-Remove-bandaid-for-SleepCSR.patch |   61 -
 ...fmac-Remove-brcmf_sdiod_request_data.patch |  344 ----
 ...brcmfmac-Fix-asymmetric-IO-functions.patch |   28 -
 ...0009-brcmfmac-Remove-noisy-debugging.patch |   53 -
 ...0010-brcmfmac-Rename-bcmerror-to-err.patch |   58 -
 ...Split-brcmf_sdiod_buffrw-function-up.patch |  143 --
 ...espace-fixes-in-brcmf_sdiod_send_buf.patch |   34 -
 ...003-brcmfmac-Clarify-if-using-braces.patch |   36 -
 ...replace-old-IO-functions-with-simple.patch |  831 ---------
 ...c-Tidy-register-definitions-a-little.patch |   59 -
 ...brcmfmac-Remove-brcmf_sdiod_addrprep.patch |  190 --
 ...unnecessary-call-to-brcmf_sdiod_set_.patch |   32 -
 ...v4.16-0008-brcmfmac-Cleanup-offsetof.patch |  134 --
 ...16-0009-brcmfmac-Remove-unused-macro.patch |   26 -
 ...repeated-calls-to-brcmf_chip_get_cor.patch |  128 --
 ...rge-buffer-size-of-caps-to-512-bytes.patch |   44 -
 ...16-0001-brcmfmac-Remove-r-w-_sdreg32.patch |  227 ---
 ...name-buscore-to-core-for-consistency.patch |   33 -
 ...se-the-value-of-sbwad-in-use-for-som.patch |   82 -
 ...rectly-handle-accesses-to-SDIO-func0.patch |   45 -
 ...mac-Remove-func0-from-function-array.patch |  111 --
 ...ficient-and-slightly-easier-to-read-.patch |   40 -
 ...-function-index-with-function-pointe.patch |  347 ----
 ...8-brcmfmac-Clean-up-interrupt-macros.patch |   53 -
 ...-43455-save-restore-SR-feature-if-FW.patch |   27 -
 ...1-brcmfmac-Remove-array-of-functions.patch | 1043 -----------
 ...ment-block-in-brcmf_sdio_buscore_rea.patch |   31 -
 ...brcmf_sdiod_buff_-read-write-functio.patch |  137 --
 ...oing-memory-allocator-than-allocator.patch |   59 -
 ...EEE80211_TX_STATUS_HEADROOM-up-to-mu.patch |   26 -
 ...ames-with-unexpected-DS-bits-from-fa.patch |   21 -
 ...80211-support-AP-4-addr-mode-fast-rx.patch |   25 -
 ...-fast-rx-with-incompatible-PS-capabi.patch |   53 -
 ...-support-station-4-addr-mode-fast-rx.patch |   34 -
 ...7-mac80211-support-A-MSDU-in-fast-rx.patch |  256 ---
 ...bcdc-dcmd-api-does-not-return-value-.patch |   68 -
 ...rate-firmware-errors-from-i-o-errors.patch |  186 --
 ...possibility-to-obtain-firmware-error.patch |   92 -
 ...P_DEVICE-ethernet-address-generation.patch |   64 -
 ...ter-Access-Point-Protocol-packets-by.patch |  157 --
 ...-brcmfmac-Fix-check-for-ISO3166-code.patch |   29 -
 ...cmf_bus_preinit-call-just-after-chan.patch |   45 -
 ...location-of-control-rx-buffer-to-brc.patch |   69 -
 ...cmf_attach-just-before-calling-brcmf.patch |  106 --
 ...l-brcmf_usb_up-during-brcmf_bus_prei.patch |   41 -
 ...move-brcmf_attach-function-in-core.c.patch |  130 --
 ...emove-brcmf_bus_started-from-bus-api.patch |  190 --
 ...log-level-for-some-low-level-sdio-fu.patch |   64 -
 ...duplicate-pointer-variable-from-brcm.patch |  126 --
 ...17-0001-brcmfmac-reject-too-long-PSK.patch |   27 -
 ...convert-linux-error-to-firmware-erro.patch |   31 -
 ...mf_chip_name-to-store-name-in-revinf.patch |  203 ---
 ...-use-brcmf_chip_name-for-consistency.patch |   69 -
 ...e-struct-brcmf_pub-instance-using-wi.patch |  452 -----
 ...brcmfmac-use-wiphy-debugfs-dir-entry.patch |  349 ----
 ...firmware-filenames-from-basename-map.patch |  286 ---
 ...ass-struct-in-brcmf_fw_get_firmwares.patch |  574 ------
 ...duce-brcmf_fw_alloc_request-function.patch |  328 ----
 ...d-extension-to-.get_fwname-callbacks.patch |  231 ---
 ...get-rid-of-brcmf_fw_map_chip_to_name.patch |   92 -
 ...ac-get-rid-of-brcmf_fw_get_full_name.patch |   44 -
 ...erneldoc-for-struct-brcmf_bus-msgbuf.patch |   23 -
 ...mware-request-processing-if-nvram-lo.patch |   81 -
 ...mac-add-support-for-BCM4366E-chipset.patch |   48 -
 ...-check-p2pdev-mac-address-uniqueness.patch |   34 -
 ...orts-boottime_ns-while-informing-bss.patch |   76 -
 ...0211_band-directly-to-get-ieee80211-.patch |   43 -
 ...mac-constify-firmware-mapping-tables.patch |   76 -
 ...05-brcmfmac-add-hostready-indication.patch |   74 -
 ...support-for-PCIe-shared-structure-re.patch |   97 -
 ...upport-for-bcm43364-wireless-chipset.patch |   45 -
 ...fmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch |   34 -
 ...tialization-of-struct-cfg80211_infor.patch |   29 -
 ...ugfs-entry-for-reading-firmware-capa.patch |   75 -
 ...ALLFFMAC-variable-in-flowring-module.patch |   52 -
 ...support-for-sysfs-initiated-coredump.patch |   76 -
 ...e-user-provided-data-for-memdump-bef.patch |   32 -
 ...-memory-dump-upon-firmware-halt-sign.patch |   38 -
 ...-memory-dump-on-SDIO-firmware-halt-m.patch |   30 -
 ...tchdog-before-detach-and-free-everyt.patch |   70 -
 ...ression-in-parsing-NVRAM-for-multipl.patch |   41 -
 ...firmware-support-for-monitor-interfa.patch |   59 -
 ...firmware-support-for-radiotap-monito.patch |   51 -
 ...msgbuf-packets-marked-with-monitor-m.patch |  137 --
 ...more-bits-for-the-flags-of-struct-br.patch |   60 -
 ...mac-update-STA-info-struct-to-the-v5.patch |   75 -
 ...y-some-features-per-firmware-version.patch |   84 -
 ...r-proper-support-of-160MHz-bandwidth.patch |  117 --
 ...fix-decoding-channel-info-for-160-MH.patch |   41 -
 ...porting-support-for-160-MHz-channels.patch |   34 -
 ...ctral-scan-enable-bit-on-trigger-for.patch |   21 -
 ...periodic-and-nf-calibation-at-the-sa.patch |   27 -
 ...80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch |  233 ---
 ...ata-bit-in-PS-buffered-frame-release.patch |   50 -
 ...ntially-stale-EOSP-status-bit-in-int.patch |   22 -
 .../362-ath9k-report-tx-status-on-EOSP.patch  |   19 -
 ...fix-block-ack-window-tracking-issues.patch |  114 --
 ...fix-channel-maximum-power-level-test.patch |   47 -
 ...ata-flag-for-buffered-multicast-pack.patch |   41 -
 ...sable-wake_tx_queue-for-older-device.patch |   27 -
 ...-fix-recent-bandwidth-conversion-bug.patch |   61 -
 ...e-only-1Mbps-for-basic-rates-in-mesh.patch |   55 -
 ...tect-queue-draining-by-rcu_read_lock.patch |   43 -
 ...ialize-sinfo-in-cfg80211_get_station.patch |   42 -
 ...-of-bounds-memory-access-during-fw-l.patch |  110 --
 ...0005-brcmfmac-fix-roamoff-1-modparam.patch |   68 -
 ...-teardown-code-before-de-registering.patch |   38 -
 ...x-HWMP-sequence-numbering-to-follow-.patch |   28 -
 ...ernel-panic-when-building-AMSDU-from.patch |  102 --
 ..._update_ft_ies-to-validate-NL80211_A.patch |   27 -
 ...convert-to-A-MSDU-if-frag-subframe-l.patch |   37 -
 ...ys-account-for-A-MSDU-header-changes.patch |   51 -
 ...off-by-one-issue-in-A-MSDU-max_subfr.patch |   26 -
 ...ype-issue-in-ieee80211_chandef_to_op.patch |   33 -
 ...a-race-between-restart-and-CSA-flows.patch |   86 -
 ...tion-bandwidth-setting-after-channel.patch |   96 -
 ...x-a-deauth-frame-if-the-AP-forbade-T.patch |   78 -
 ...0211-shorten-the-IBSS-debug-messages.patch |   74 -
 ...e-TXQs-for-active-monitor-interfaces.patch |   26 -
 ...ting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch |   25 -
 ...-skb-fraglist-before-freeing-the-skb.patch |   31 -
 ...tx-status-for-PS-stations-in-ieee802.patch |   26 -
 ...-nvram-filename-quirk-for-ACEPC-T8-a.patch |   70 -
 ...ilbox-interrupt-twice-for-specific-h.patch |   39 -
 ...ial-NULL-dereference-in-brcmf_cfg802.patch |   50 -
 ...low-request-id-from-1-to-pktids-arra.patch |   49 -
 ...irmware-messages-after-a-firmware-cr.patch |   90 -
 ...cmfmac-use-strlcpy-instead-of-strcpy.patch |   26 -
 ...ac-add-160MHz-in-chandef_to_chanspec.patch |   56 -
 ...fix-NULL-pointer-derefence-during-US.patch |  168 --
 ...-the-order-of-things-in-brcmf_detach.patch |   67 -
 ...irmware-command-in-brcmf_netdev_open.patch |   30 -
 ...vents-in-brcmf_fweh_detach-will-alwa.patch |   38 -
 ...d-firmware-commands-when-bus-is-down.patch |   79 -
 ...imply-remove-flowring-if-bus-is-down.patch |   33 -
 ...unnecessary-strlcpy-upon-obtaining-v.patch |   28 -
 ...et_ratelimit-CONSOLE-messages-on-fir.patch |   38 -
 ...-authentication-messages-for-late-ac.patch |   27 -
 ...ck-da-enabled-first-in-sampling-rout.patch |   33 -
 ...k-dynack-make-ewma-estimation-faster.patch |  139 --
 ...-rt2800lib-enable-support-for-RT3883.patch |   20 -
 ...x00-rt2800lib-add-rf_vals-for-RF3853.patch |  112 --
 ...ib-enable-VCO-calibration-for-RF3853.patch |   28 -
 ...-add-channel-configuration-function-.patch |  235 ---
 ...2x00-rt2800lib-enable-RF3853-support.patch |   20 -
 ...-add-MAC-register-initialization-for.patch |   62 -
 ...-fix-rt2800soc_disable_radio-for-RT3.patch |   30 -
 ...-add-BBP-register-initialization-for.patch |   71 -
 ...-add-RFCSR-initialization-for-RT3883.patch |  178 --
 ...-use-the-extended-EEPROM-map-for-RT3.patch |   22 -
 ...ib-force-rf-type-to-RF3853-on-RT3883.patch |   21 -
 ...-add-channel-configuration-code-for-.patch |  136 --
 ...-fix-txpower_to_dev-function-for-RT3.patch |   30 -
 ...-use-correct-txpower-calculation-fun.patch |   23 -
 ...-hardcode-txmixer-gain-values-to-zer.patch |   33 -
 ...b-use-correct-RT-XWI-size-for-RT3883.patch |   20 -
 ...-fix-antenna-configuration-for-RT388.patch |   22 -
 ...-fix-LNA-gain-configuration-for-RT38.patch |   32 -
 ...0-rt2800lib-fix-VGC-setup-for-RT3883.patch |   44 -
 ...-fix-EEPROM-LNA-validation-for-RT388.patch |   42 -
 ...-fix-txpower-compensation-for-RT3883.patch |   22 -
 ...o-add-a-workaround-for-spurious-TX_F.patch |  136 --
 .../651-rt2x00-remove-unneccesary-code.patch  |  132 --
 .../936-ath10k-fix-otp-failure-result.patch   |   11 -
 ...-mwl8k-add-non-DFS-5G-upper-channels.patch |   37 -
 ...0-0010-ath10k-limit-htt-rx-ring-size.patch |   11 -
 ...d-reported-build-errors-with-CONFIG_PM-off |   93 -
 ..._sdio_reinit_device-out-of-CONFIG_PM.patch |   96 -
 .../{ => ath}/070-ath_common_config.patch     |    0
 .../{ => ath}/080-ath10k_thermal_config.patch |   18 +-
 .../201-ath5k-WAR-for-AR71xx-PCI-bug.patch    |    0
 ...w-reset-AHB-WMAC-interface-on-AR91xx.patch |    2 +-
 ..._hw-issue-external-reset-for-QCA955x.patch |    4 +-
 ...h9k-force-rx_clear-when-disabling-rx.patch |    0
 ...erpret-requested-txpower-in-EIRP-dom.patch |    9 +-
 ...power-reduction-for-US-regulatory-do.patch |   12 +-
 ...fix-tx99-with-monitor-mode-interface.patch |   92 +
 ...upport-for-using-active-monitor-inte.patch |   96 +
 .../{ => ath}/400-ath_move_debug_code.patch   |    4 +-
 .../{ => ath}/401-ath9k_blink_default.patch   |    2 +-
 .../{ => ath}/402-ath_regd_optional.patch     |    2 +-
 .../{ => ath}/403-world_regd_fixup.patch      |    0
 .../{ => ath}/404-regd_no_assoc_hints.patch   |    4 +-
 .../patches/{ => ath}/405-ath_regd_us.patch   |    6 +-
 .../406-ath_relax_default_regd.patch          |    0
 .../407-regd_add_extra_country_codes.patch    |   35 +
 .../patches/ath/408-ath_phy_regd.patch        |   13 +
 .../410-ath9k_allow_adhoc_and_ap.patch        |    2 +-
 .../411-ath5k_allow_adhoc_and_ap.patch        |    0
 .../{ => ath}/420-ath5k_disable_fast_cc.patch |    0
 .../{ => ath}/430-add_ath5k_platform.patch    |    0
 ...add_platform_eeprom_support_to_ath5k.patch |    0
 .../{ => ath}/432-ath5k_add_pciids.patch      |    0
 .../440-ath5k_channel_bw_debugfs.patch        |   13 +-
 .../{ => ath}/500-ath9k_eeprom_debugfs.patch  |    0
 .../{ => ath}/501-ath9k_ahb_init.patch        |    4 +-
 .../510-ath9k_intr_mitigation_tweak.patch     |    2 +-
 .../{ => ath}/511-ath9k_reduce_rxbuf.patch    |    0
 .../512-ath9k_channelbw_debugfs.patch         |    2 +-
 .../{ => ath}/513-ath9k_add_pci_ids.patch     |    4 +-
 .../{ => ath}/530-ath9k_extra_leds.patch      |    2 +-
 .../531-ath9k_extra_platform_leds.patch       |    0
 .../540-ath9k_reduce_ani_interval.patch       |    0
 .../{ => ath}/542-ath9k_debugfs_diag.patch    |    8 +-
 .../543-ath9k_entropy_from_adc.patch          |   10 +-
 ...544-ath9k-ar933x-usb-hang-workaround.patch |   10 +-
 .../{ => ath}/545-ath9k_ani_ws_detect.patch   |    2 +-
 .../547-ath9k_led_defstate_fix.patch          |    0
 .../548-ath9k_enable_gpio_chip.patch          |    0
 .../549-ath9k_enable_gpio_buttons.patch       |    0
 .../550-ath9k-disable-bands-via-dt.patch      |    2 +-
 .../551-ath9k_ubnt_uap_plus_hsr.patch         |    4 +-
 .../mac80211/patches/ath/552-ahb_of.patch     |  330 ++++
 ...e-debug-log-after-buffer-increments.patch} |   14 +-
 ...th9k-dynack-remove-experimental-tag.patch} |    0
 ...21-ath10k_init_devices_synchronously.patch |    2 +-
 .../930-ath10k_add_tpt_led_trigger.patch      |    4 +-
 ...0-0010-ath10k-limit-htt-rx-ring-size.patch |   11 +
 ...60-0011-ath10k-limit-pci-buffer-size.patch |    8 +-
 ...-of-peer_bw_rxnss_override-parameter.patch |   96 +-
 ...dling-for-VHT160-in-recent-firmwares.patch |    9 +-
 ...rolling-support-for-various-chipsets.patch |   66 +-
 ...75-ath10k-use-tpt-trigger-by-default.patch |   53 +
 ...ilable-channels-via-DT-ieee80211-fre.patch |   39 +
 ...rt-for-configuring-management-packet.patch |   89 +
 ...ble-out-of-bound-access-of-ath10k_ra.patch |   66 +
 ...rect-multicast-broadcast-rate-settin.patch |   43 +
 ...980-ath10k-fix-max-antenna-gain-unit.patch |   49 +
 ...-power-reduction-for-US-regulatory-d.patch |  101 ++
 .../{ => brcm}/040-brcmutil_option.patch      |    0
 ...mfmac-add-CYW89342-mini-PCIe-device.patch} |    0
 ...01-brcmfmac-fix-wrong-strnchr-usage.patch} |    0
 ...-buffer-for-obtaining-firmware-capa.patch} |    0
 ...et-but-not-used-variables-sfdoff-an.patch} |    0
 ...educe-timeout-for-action-frame-scan.patch} |    0
 ...-timeout-waiting-for-action-frame-o.patch} |    0
 ...e-firmware-loading-code-duplication.patch} |    0
 ...ecursion-from-firmware-load-error-h.patch} |    0
 ...ort-for-first-trying-to-get-a-board.patch} |    0
 ...d_type-used-for-nvram-file-selectio.patch} |    0
 ...d_type-from-DMI-on-x86-based-machin.patch} |    0
 ...mfmac-Cleanup-brcmf_fw_request_done.patch} |    0
 ...port-for-getting-nvram-contents-from.patch |  132 ++
 ...-ccode-from-EFI-nvram-when-necessary.patch |   97 +
 ...lling-mistake-Retreiving-Retrieving.patch} |    0
 ...rint-invalid-chanspec-when-WARN-ing.patch} |    0
 ...brcmfmac-support-STA-info-struct-v7.patch} |    6 +-
 ...rcmf_dmi_probe-before-brcmf_of_probe.patch |   39 +
 ...-add-credit-numbers-updating-support.patch |   95 +
 ...frameburst-mode-in-default-firmware-.patch |   42 +
 ...c-handle-compressed-tx-status-signal.patch |  229 +++
 ...brcmfmac-add-4354-raw-pcie-device-id.patch |   36 +
 ...mac-set-F2-watermark-to-256-for-4373.patch |   73 +
 ...-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch |   55 +
 ...dd-support-for-CYW43012-SDIO-chipset.patch |  253 +++
 ...-brcmfmac-allow-GCI-core-enumuration.patch |   60 +
 ...43012-F2-watermark-setting-to-fix-DM.patch |   49 +
 ...7-brcmfmac-4373-save-restore-support.patch |   57 +
 ...c-disable-command-decode-in-sdio_aos.patch |   45 +
 ...se-positive-Wmaybe-unintialized-warn.patch |   34 +
 ...0001-brcmfmac-Fix-access-point-mode.patch} |    2 +-
 ...-nvram-filename-quirk-for-PoV-TAB-P1.patch |   51 +
 ...check-for-the-status-of-usb_register.patch |   28 +
 ...tem-warning-message-during-wowl-susp.patch |   33 +
 ..._brcmf_err-to-take-bus-as-a-paramet.patch} |    0
 ...ss-bus-to-the-__brcmf_err-in-pcie.c.patch} |    2 +-
 ...hy_err-and-use-it-in-the-cfg80211.c.patch} |  203 ++-
 .../brcm/347-v5.1-brcmfmac-fix-typos.patch    |   62 +
 ...monitor-frames-with-the-hardware-uc.patch} |    0
 ...SSID-length-from-firmware-is-limited.patch |   28 +
 ...type-check-for-event-handling-in-dat.patch |   96 +
 ...debugfs-files-for-bus-specific-layer.patch |  101 ++
 ...able-MBSS-feature-for-bcm4330-device.patch |   41 +
 ...and-dump-trap-info-during-sdio-probe.patch |  121 ++
 ...pname-in-brcmf_fw_alloc_request-for-.patch |   42 +
 ...irmware-reported-ring-status-errors.patch} |    0
 ...code-handling-bandwidth-of-firmware.patch} |    2 +-
 ...firmware-reporting-160-MHz-channels.patch} |    2 +-
 ...phy_err-to-take-struct-brcmf_pub-ar.patch} |  230 +--
 ...-set-but-not-used-variable-old_state.patch |   38 +
 ...-bphy_err-in-all-wiphy-related-code.patch} |   91 +-
 ...ic-validation-of-shared-RAM-address.patch} |    0
 ...ze-of-the-struct-msgbuf_ring_status.patch} |    0
 ...rmware-reported-general-status-erro.patch} |    0
 ...repeated-brcmf_fw_alloc_request-cal.patch} |    2 +-
 ...nction-designated-for-handling-firm.patch} |    6 +-
 ...-reset-PCIe-bus-on-a-firmware-crash.patch} |   14 +-
 ...ING-during-USB-disconnect-in-case-o.patch} |    6 +-
 ...-pointer-derefence-during-USB-disco.patch} |    6 +-
 ...-during-disconnect-when-USB-complet.patch} |    2 +-
 ...ending-parameter-from-brcmf_usb_fre.patch} |    2 +-
 ...nused-variable-i-from-brcmf_usb_fre.patch} |    0
 ...-when-bringing-up-interface-during-.patch} |    4 +-
 ...rt-dev_init_lock-mutex-to-completion.patch |  182 ++
 ...fmac-fix-missing-checks-for-kmemdup.patch} |    4 +-
 ...-brcmfmac-Use-struct_size-in-kzalloc.patch |   53 +
 ...-the-correct-firmware-for-brcm43456.patch} |    6 +-
 ...-leak-of-mypkt-on-error-return-path.patch} |    0
 .../810-b43-gpio-mask-module-option.patch     |    2 +-
 .../patches/{ => brcm}/811-b43_no_pio.patch   |    8 +-
 .../812-b43-add-antenna-control.patch         |    2 +-
 .../813-b43-reduce-number-of-RX-slots.patch   |    2 +-
 .../814-b43-only-use-gpio-0-1-for-led.patch   |    0
 ...815-b43-always-take-overlapping-devs.patch |    0
 ...-remove-extra-regulation-restriction.patch |    0
 ...-register-wiphy-s-during-module_init.patch |   18 +-
 ...und-bug-with-some-inconsistent-BSSes.patch |    2 +-
 ...62-brcmfmac-Disable-power-management.patch |    2 +-
 ...-in-driver-tables-with-country-codes.patch |    0
 ...e-internal-roaming-engine-by-default.patch |    2 +-
 ...-info-right-before-downloading-PCIe-.patch |    6 +-
 .../patches/{ => build}/000-fix_kconfig.patch |    0
 .../patches/{ => build}/001-fix_build.patch   |   12 +-
 .../{ => build}/002-change_allconfig.patch    |    0
 .../003-remove_bogus_modparams.patch          |    0
 .../004-kconfig_backport_fix.patch            |    0
 .../{ => build}/010-disable_rfkill.patch      |    0
 .../{ => build}/012-kernel_build_check.patch  |    0
 .../patches/{ => build}/015-ipw200-mtu.patch  |    4 +-
 .../{ => build}/050-lib80211_option.patch     |    6 +-
 .../patches/build/060-no_local_ssb_bcma.patch |  335 ++++
 ...700-mwl8k-missing-pci-id-for-WNR854T.patch |    2 +-
 .../801-libertas-configure-sysfs-links.patch  |    2 +-
 .../802-libertas-set-wireless-macaddr.patch   |    2 +-
 ...940-mwl8k_init_devices_synchronously.patch |    4 +-
 .../941-mwl8k-Fix-rate_idx-underflow.patch    |   80 +
 ...1-rt2x00-use-simple_read_from_buffer.patch |   59 +
 ...specific-txdone-txstatus-routines-to.patch |  357 ++++
 ...se-txdone-txstatus-routines-from-lib.patch |  244 +++
 ...eck-for-txstatus-timeout-every-time-.patch |   72 +
 ...rent-txstatus-timeouts-when-flushing.patch |  112 ++
 ...h-and-txstatus-rework-for-rt2800mmio.patch |  238 +++
 ...ci-mark-expected-switch-fall-through.patch |   25 +
 ...ci-mark-expected-switch-fall-through.patch |   25 +
 ...b-mark-expected-switch-fall-throughs.patch |   44 +
 ...ci-mark-expected-switch-fall-through.patch |   25 +
 ...s-tree-phase-out-dma_zalloc_coherent.patch |   40 +
 ...-tx-power-to-nominal-level-on-RT6352.patch |   32 +
 ...ound-a-firmware-bug-with-shared-keys.patch |  143 ++
 ...o-check-return-value-of-debugfs_crea.patch |  107 ++
 .../015-rt2x00-remove-unneeded-check.patch    |  137 ++
 ...rt2x00-remove-confusing-AGC-register.patch |   34 +
 ...ble-TX_PIN_CFG_LNA_PE_-bits-per-band.patch |   47 +
 ...e-TX_PIN_CFG_RFRX_EN-only-for-MT7620.patch |   41 +
 ...ent-and-simplify-AGC-init-for-RT6352.patch |   33 +
 ...ratelimited-variants-of-err-and-warn.patch |   39 +
 ...atelimited-variants-dev_warn-dev_err.patch |   42 +
 ...rt2x00-check-number-of-EPROTO-errors.patch |   96 +
 ...o-not-print-error-when-queue-is-full.patch |   43 +
 ...-restore-old-mmio-txstatus-behaviour.patch |  128 ++
 ...flush-implementation-for-SoC-devices.patch |   27 +
 ...rt2800-move-txstatus-pending-routine.patch |  106 ++
 ...7-rt2800mmio-fetch-tx-status-changes.patch |   61 +
 ...imer-and-work-for-handling-tx-status.patch |  194 ++
 ...29-rt2x00-remove-last_nostatus_check.patch |   57 +
 ...0-rt2x00-remove-not-used-entry-field.patch |   34 +
 ...031-rt2x00mmio-remove-legacy-comment.patch |   26 +
 ...crement-sequence-number-while-re-tra.patch |   94 +
 .../050-rt2x00-add-RT3883-support.patch       |  959 ++++++++++
 .../100-rt2x00_options.patch}                 |    0
 ...o-build-rt2800soc-module-for-RT3883.patch} |    0
 ...1-rt2x00-introduce-rt2x00_platform_h.patch |    0
 .../602-rt2x00-introduce-rt2x00eeprom.patch   |   13 +-
 .../603-rt2x00-of_load_eeprom_filename.patch  |    0
 ...om-on-SoC-from-a-mtd-device-defines-.patch |    5 +-
 ...isabling_bands_through_platform_data.patch |    0
 ...07-rt2x00-add_platform_data_mac_addr.patch |    0
 ...00-allow_disabling_bands_through_dts.patch |    0
 ...c-loadable-via-OF-on-rt288x-305x-SoC.patch |    2 +-
 ...0-rt2x00-change-led-polarity-from-OF.patch |    2 +-
 .../611-rt2x00-add-AP+STA-support.patch       |    0
 ...dd-support-for-external-PA-on-MT7620.patch |   61 +-
 ...-rt2x00-add-rf-self-txdc-calibration.patch |   89 +
 .../rt2x00/983-rt2x00-add-r-calibration.patch |  193 ++
 .../984-rt2x00-add-rxdcoc-calibration.patch   |  102 ++
 .../985-rt2x00-add-rxiq-calibration.patch     |  417 +++++
 .../986-rt2x00-add-TX-LOFT-calibration.patch  | 1002 +++++++++++
 .../100-remove-cryptoapi-dependencies.patch   |   24 +-
 .../110-mac80211_keep_keys_on_stop_ap.patch   |    2 +-
 .../120-cfg80211_allow_perm_addr_change.patch |    0
 .../{ => subsys}/130-disable-fils.patch       |    4 +-
 ...aes-cmac-switch-to-shash-CMAC-driver.patch |    0
 .../132-mac80211-remove-cmac-dependency.patch |    0
 .../{ => subsys}/140-tweak-TSQ-setting.patch  |    2 +-
 .../150-disable_addr_notifier.patch           |   16 +-
 .../patches/{ => subsys}/210-ap_scan.patch    |    2 +-
 ...-stop-start-logic-for-software-TXQs.patch} |   28 +-
 ...all-driver-wake_tx_queue-op-during-.patch} |    2 +-
 ...-Enable-STBC-and-LDPC-for-VHT-Rates.patch} |    2 +-
 ...-remove-unnecessary-debugfs-cleanup.patch} |   18 +-
 ...-merge-with-minstrel_ht-always-enab.patch} |   13 +-
 ...rel-reduce-minstrel_mcs_groups-size.patch} |    0
 ...-fix-using-short-preamble-CCK-rates.patch} |    0
 ...el-fix-CCK-rate-group-streams-value.patch} |    0
 ...-fix-sampling-reporting-of-CCK-rate.patch} |    0
 ...-do-not-sample-rates-3-times-slower.patch} |    0
 ...ry-accounting-with-A-MSDU-aggregati.patch} |   14 +-
 ...l_ht-add-flag-to-indicate-missing-in.patch |  122 ++
 ...ligned-access-in-mesh-table-hash-fun.patch |   21 +
 .../320-mac80211-Add-TXQ-scheduling-API.patch |  292 ++++
 ...-Add-airtime-statistics-and-settings.patch |  202 +++
 ...time-accounting-and-scheduling-to-TX.patch |  522 ++++++
 ...pose-ieee80211_schedule_txq-function.patch |   73 +
 ...211-add-hdrlen-to-ieee80211_tx_data.patch} |   47 +-
 ...1-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch |  304 ++++
 ...locking-for-txq-scheduling-airtime-f.patch |  214 +++
 ...op-redundant-rcu_read_lock-unlock-ca.patch |   96 +
 ...te-hash-for-fq-without-holding-fq-lo.patch |  124 ++
 ...e-dequeue-late-tx-handlers-without-h.patch |   55 +
 ...IF_F_LLTX-when-using-intermediate-tx.patch |   22 +
 .../357-mac80211-optimize-skb-resizing.patch  |  200 +++
 ...ee80211_schedule_txq-schedule-empty-.patch |  105 ++
 ...-un-schedule-TXQs-on-powersave-start.patch |   31 +
 ...ing-iTXQ-select-the-queue-in-ieee802.patch |  183 ++
 ...ow-4addr-AP-operation-on-crypto-cont.patch |  107 ++
 .../522-mac80211_configure_antenna_gain.patch |   42 +-
 package/kernel/mac80211/ralink.mk             |  172 ++
 package/kernel/mac80211/realtek.mk            |  170 ++
 459 files changed, 13971 insertions(+), 20198 deletions(-)
 create mode 100644 package/kernel/mac80211/ath.mk
 create mode 100644 package/kernel/mac80211/broadcom.mk
 create mode 100644 package/kernel/mac80211/intel.mk
 create mode 100644 package/kernel/mac80211/marvell.mk
 delete mode 100644 package/kernel/mac80211/patches/005-revert-devcoredump.patch
 delete mode 100644 package/kernel/mac80211/patches/006-fix-genl-multicast.patch
 delete mode 100644 package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
 delete mode 100644 package/kernel/mac80211/patches/008-fix-genl-family-id.patch
 delete mode 100644 package/kernel/mac80211/patches/009-backport_sg_init_marker.patch
 delete mode 100644 package/kernel/mac80211/patches/011-backport-overflow_h.patch
 delete mode 100644 package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch
 delete mode 100644 package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
 delete mode 100644 package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
 delete mode 100644 package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
 delete mode 100644 package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
 delete mode 100644 package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
 delete mode 100644 package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
 delete mode 100644 package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
 delete mode 100644 package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
 delete mode 100644 package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
 delete mode 100644 package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
 delete mode 100644 package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
 delete mode 100644 package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
 delete mode 100644 package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
 delete mode 100644 package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
 delete mode 100644 package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
 delete mode 100644 package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
 delete mode 100644 package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
 delete mode 100644 package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
 delete mode 100644 package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
 delete mode 100644 package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
 delete mode 100644 package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
 delete mode 100644 package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
 delete mode 100644 package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
 delete mode 100644 package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
 delete mode 100644 package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
 delete mode 100644 package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
 delete mode 100644 package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
 delete mode 100644 package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
 delete mode 100644 package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
 delete mode 100644 package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
 delete mode 100644 package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
 delete mode 100644 package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
 delete mode 100644 package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
 delete mode 100644 package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
 delete mode 100644 package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
 delete mode 100644 package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
 delete mode 100644 package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
 delete mode 100644 package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
 delete mode 100644 package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
 delete mode 100644 package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
 delete mode 100644 package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
 delete mode 100644 package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
 delete mode 100644 package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
 delete mode 100644 package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
 delete mode 100644 package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch
 delete mode 100644 package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
 delete mode 100644 package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
 delete mode 100644 package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
 delete mode 100644 package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
 delete mode 100644 package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
 delete mode 100644 package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
 delete mode 100644 package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
 delete mode 100644 package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
 delete mode 100644 package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
 delete mode 100644 package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
 delete mode 100644 package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
 delete mode 100644 package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
 delete mode 100644 package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
 delete mode 100644 package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
 delete mode 100644 package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
 delete mode 100644 package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch
 delete mode 100644 package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
 delete mode 100644 package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
 delete mode 100644 package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
 delete mode 100644 package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
 delete mode 100644 package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
 delete mode 100644 package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
 delete mode 100644 package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
 delete mode 100644 package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
 delete mode 100644 package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
 delete mode 100644 package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
 delete mode 100644 package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
 delete mode 100644 package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
 delete mode 100644 package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
 delete mode 100644 package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
 delete mode 100644 package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
 delete mode 100644 package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch
 delete mode 100644 package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
 delete mode 100644 package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
 delete mode 100644 package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
 delete mode 100644 package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
 delete mode 100644 package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
 delete mode 100644 package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
 delete mode 100644 package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
 delete mode 100644 package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
 delete mode 100644 package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
 delete mode 100644 package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch
 delete mode 100644 package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch
 delete mode 100644 package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch
 delete mode 100644 package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
 delete mode 100644 package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
 delete mode 100644 package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
 delete mode 100644 package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
 delete mode 100644 package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
 delete mode 100644 package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
 delete mode 100644 package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
 delete mode 100644 package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
 delete mode 100644 package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
 delete mode 100644 package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
 delete mode 100644 package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
 delete mode 100644 package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
 delete mode 100644 package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
 delete mode 100644 package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
 delete mode 100644 package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
 delete mode 100644 package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
 delete mode 100644 package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
 delete mode 100644 package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
 delete mode 100644 package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
 delete mode 100644 package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
 delete mode 100644 package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
 delete mode 100644 package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
 delete mode 100644 package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
 delete mode 100644 package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
 delete mode 100644 package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
 delete mode 100644 package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
 delete mode 100644 package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
 delete mode 100644 package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
 rename package/kernel/mac80211/patches/{ => ath}/070-ath_common_config.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/080-ath10k_thermal_config.patch (77%)
 rename package/kernel/mac80211/patches/{ => ath}/201-ath5k-WAR-for-AR71xx-PCI-bug.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch (89%)
 rename package/kernel/mac80211/patches/{ => ath}/351-ath9k_hw-issue-external-reset-for-QCA955x.patch (95%)
 rename package/kernel/mac80211/patches/{ => ath}/354-ath9k-force-rx_clear-when-disabling-rx.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch (82%)
 rename package/kernel/mac80211/patches/{ => ath}/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch (59%)
 create mode 100644 package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch
 create mode 100644 package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch
 rename package/kernel/mac80211/patches/{ => ath}/400-ath_move_debug_code.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/401-ath9k_blink_default.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/402-ath_regd_optional.patch (98%)
 rename package/kernel/mac80211/patches/{ => ath}/403-world_regd_fixup.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/404-regd_no_assoc_hints.patch (76%)
 rename package/kernel/mac80211/patches/{ => ath}/405-ath_regd_us.patch (83%)
 rename package/kernel/mac80211/patches/{ => ath}/406-ath_relax_default_regd.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/ath/407-regd_add_extra_country_codes.patch
 create mode 100644 package/kernel/mac80211/patches/ath/408-ath_phy_regd.patch
 rename package/kernel/mac80211/patches/{ => ath}/410-ath9k_allow_adhoc_and_ap.patch (83%)
 rename package/kernel/mac80211/patches/{ => ath}/411-ath5k_allow_adhoc_and_ap.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/420-ath5k_disable_fast_cc.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/430-add_ath5k_platform.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/431-add_platform_eeprom_support_to_ath5k.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/432-ath5k_add_pciids.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/440-ath5k_channel_bw_debugfs.patch (92%)
 rename package/kernel/mac80211/patches/{ => ath}/500-ath9k_eeprom_debugfs.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/501-ath9k_ahb_init.patch (86%)
 rename package/kernel/mac80211/patches/{ => ath}/510-ath9k_intr_mitigation_tweak.patch (87%)
 rename package/kernel/mac80211/patches/{ => ath}/511-ath9k_reduce_rxbuf.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/512-ath9k_channelbw_debugfs.patch (98%)
 rename package/kernel/mac80211/patches/{ => ath}/513-ath9k_add_pci_ids.patch (87%)
 rename package/kernel/mac80211/patches/{ => ath}/530-ath9k_extra_leds.patch (99%)
 rename package/kernel/mac80211/patches/{ => ath}/531-ath9k_extra_platform_leds.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/540-ath9k_reduce_ani_interval.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/542-ath9k_debugfs_diag.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/543-ath9k_entropy_from_adc.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/544-ath9k-ar933x-usb-hang-workaround.patch (84%)
 rename package/kernel/mac80211/patches/{ => ath}/545-ath9k_ani_ws_detect.patch (98%)
 rename package/kernel/mac80211/patches/{ => ath}/547-ath9k_led_defstate_fix.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/548-ath9k_enable_gpio_chip.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/549-ath9k_enable_gpio_buttons.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/550-ath9k-disable-bands-via-dt.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/551-ath9k_ubnt_uap_plus_hsr.patch (99%)
 create mode 100644 package/kernel/mac80211/patches/ath/552-ahb_of.patch
 rename package/kernel/mac80211/patches/{553-ath9k-dynack-move-debug-log-after-buffer-increments.patch => ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch} (86%)
 rename package/kernel/mac80211/patches/{556-ath9k-dynack-remove-experimental-tag.patch => ath/557-ath9k-dynack-remove-experimental-tag.patch} (100%)
 rename package/kernel/mac80211/patches/{ => ath}/921-ath10k_init_devices_synchronously.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/930-ath10k_add_tpt_led_trigger.patch (90%)
 create mode 100644 package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
 rename package/kernel/mac80211/patches/{ => ath}/960-0011-ath10k-limit-pci-buffer-size.patch (75%)
 rename package/kernel/mac80211/patches/{ => ath}/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch (55%)
 rename package/kernel/mac80211/patches/{ => ath}/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch (92%)
 create mode 100644 package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
 create mode 100644 package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
 create mode 100644 package/kernel/mac80211/patches/ath/977-ath10k-add-support-for-configuring-management-packet.patch
 create mode 100644 package/kernel/mac80211/patches/ath/978-ath10k-fix-possible-out-of-bound-access-of-ath10k_ra.patch
 create mode 100644 package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
 create mode 100644 package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch
 create mode 100644 package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
 rename package/kernel/mac80211/patches/{ => brcm}/040-brcmutil_option.patch (100%)
 rename package/kernel/mac80211/patches/{342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch => brcm/300-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch} (100%)
 rename package/kernel/mac80211/patches/{344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch => brcm/302-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch} (100%)
 rename package/kernel/mac80211/patches/{345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch => brcm/304-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch} (100%)
 rename package/kernel/mac80211/patches/{346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch => brcm/305-v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch} (100%)
 rename package/kernel/mac80211/patches/{347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch => brcm/306-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch} (100%)
 rename package/kernel/mac80211/patches/{347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch => brcm/306-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch} (100%)
 rename package/kernel/mac80211/patches/{355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch => brcm/320-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch} (100%)
 rename package/kernel/mac80211/patches/{355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch => brcm/320-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch} (100%)
 rename package/kernel/mac80211/patches/{355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch => brcm/320-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch} (100%)
 rename package/kernel/mac80211/patches/{355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch => brcm/320-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch} (100%)
 rename package/kernel/mac80211/patches/{355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch => brcm/320-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch} (100%)
 rename package/kernel/mac80211/patches/{355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch => brcm/320-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch} (100%)
 create mode 100644 package/kernel/mac80211/patches/brcm/321-v5.0-0001-brcmfmac-Add-support-for-getting-nvram-contents-from.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/321-v5.0-0002-brcmfmac-Fix-ccode-from-EFI-nvram-when-necessary.patch
 rename package/kernel/mac80211/patches/{380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch => brcm/322-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch} (100%)
 rename package/kernel/mac80211/patches/{380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch => brcm/323-v5.0-0001-brcmutil-print-invalid-chanspec-when-WARN-ing.patch} (100%)
 rename package/kernel/mac80211/patches/{380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch => brcm/325-v5.0-brcmfmac-support-STA-info-struct-v7.patch} (92%)
 create mode 100644 package/kernel/mac80211/patches/brcm/326-v5.0-brcmfmac-Call-brcmf_dmi_probe-before-brcmf_of_probe.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch
 rename package/kernel/mac80211/patches/{380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch => brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch} (95%)
 create mode 100644 package/kernel/mac80211/patches/brcm/340-v5.1-brcmfmac-Add-DMI-nvram-filename-quirk-for-PoV-TAB-P1.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/341-v5.1-brcmfmac-add-a-check-for-the-status-of-usb_register.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/342-v5.1-brcmfmac-fix-system-warning-message-during-wowl-susp.patch
 rename package/kernel/mac80211/patches/{381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch => brcm/344-v5.1-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch} (100%)
 rename package/kernel/mac80211/patches/{381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch => brcm/345-v5.1-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch} (99%)
 rename package/kernel/mac80211/patches/{381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch => brcm/346-v5.1-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch} (90%)
 create mode 100644 package/kernel/mac80211/patches/brcm/347-v5.1-brcmfmac-fix-typos.patch
 rename package/kernel/mac80211/patches/{381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch => brcm/348-v5.1-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch} (100%)
 create mode 100644 package/kernel/mac80211/patches/brcm/349-v5.1-0001-brcmfmac-assure-SSID-length-from-firmware-is-limited.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/349-v5.1-0002-brcmfmac-add-subtype-check-for-event-handling-in-dat.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/349-v5.1-0003-brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/349-v5.1-0004-brcmfmac-disable-MBSS-feature-for-bcm4330-device.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/349-v5.1-0005-brcmfmac-check-and-dump-trap-info-during-sdio-probe.patch
 create mode 100644 package/kernel/mac80211/patches/brcm/349-v5.1-0006-brcmfmac-use-chipname-in-brcmf_fw_alloc_request-for-.patch
 rename package/kernel/mac80211/patches/{381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch => brcm/350-v5.1-brcmfmac-print-firmware-reported-ring-status-errors.patch} (100%)
 rename package/kernel/mac80211/patches/{381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch => brcm/351-v5.1-0001-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch} (95%)
 rename package/kernel/mac80211/patches/{381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch => brcm/351-v5.1-0002-brcmfmac-support-firmware-reporting-160-MHz-channels.patch} (94%)
 rename package/kernel/mac80211/patches/{381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch => brcm/352-v5.1-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch} (91%)
 create mode 100644 package/kernel/mac80211/patches/brcm/353-v5.1-brcmfmac-remove-set-but-not-used-variable-old_state.patch
 rename package/kernel/mac80211/patches/{381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch => brcm/354-v5.1-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch} (95%)
 rename package/kernel/mac80211/patches/{381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch => brcm/355-v5.1-brcmfmac-add-basic-validation-of-shared-RAM-address.patch} (100%)
 rename package/kernel/mac80211/patches/{381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch => brcm/356-v5.1-0001-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch} (100%)
 rename package/kernel/mac80211/patches/{381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch => brcm/356-v5.1-0002-brcmfmac-print-firmware-reported-general-status-erro.patch} (100%)
 rename package/kernel/mac80211/patches/{450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch => brcm/360-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch} (95%)
 rename package/kernel/mac80211/patches/{450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch => brcm/360-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch} (93%)
 rename package/kernel/mac80211/patches/{450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch => brcm/360-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch} (91%)
 rename package/kernel/mac80211/patches/{451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch => brcm/361-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch} (96%)
 rename package/kernel/mac80211/patches/{451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch => brcm/361-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch} (97%)
 rename package/kernel/mac80211/patches/{452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch => brcm/362-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch} (98%)
 rename package/kernel/mac80211/patches/{452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch => brcm/362-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch} (96%)
 rename package/kernel/mac80211/patches/{452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch => brcm/362-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch} (100%)
 rename package/kernel/mac80211/patches/{453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch => brcm/363-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch} (98%)
 create mode 100644 package/kernel/mac80211/patches/brcm/364-v5.2-brcmfmac-convert-dev_init_lock-mutex-to-completion.patch
 rename package/kernel/mac80211/patches/{454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch => brcm/365-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch} (90%)
 create mode 100644 package/kernel/mac80211/patches/brcm/366-v5.2-brcmfmac-Use-struct_size-in-kzalloc.patch
 rename package/kernel/mac80211/patches/{455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch => brcm/367-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch} (89%)
 rename package/kernel/mac80211/patches/{456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch => brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch} (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/810-b43-gpio-mask-module-option.patch (97%)
 rename package/kernel/mac80211/patches/{ => brcm}/811-b43_no_pio.patch (91%)
 rename package/kernel/mac80211/patches/{ => brcm}/812-b43-add-antenna-control.patch (99%)
 rename package/kernel/mac80211/patches/{ => brcm}/813-b43-reduce-number-of-RX-slots.patch (88%)
 rename package/kernel/mac80211/patches/{ => brcm}/814-b43-only-use-gpio-0-1-for-led.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/815-b43-always-take-overlapping-devs.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/850-brcmsmac-remove-extra-regulation-restriction.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/860-brcmfmac-register-wiphy-s-during-module_init.patch (83%)
 rename package/kernel/mac80211/patches/{ => brcm}/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch (96%)
 rename package/kernel/mac80211/patches/{ => brcm}/862-brcmfmac-Disable-power-management.patch (93%)
 rename package/kernel/mac80211/patches/{ => brcm}/863-brcmfmac-add-in-driver-tables-with-country-codes.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch (92%)
 rename package/kernel/mac80211/patches/{ => brcm}/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch (93%)
 rename package/kernel/mac80211/patches/{ => build}/000-fix_kconfig.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/001-fix_build.patch (93%)
 rename package/kernel/mac80211/patches/{ => build}/002-change_allconfig.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/003-remove_bogus_modparams.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/004-kconfig_backport_fix.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/010-disable_rfkill.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/012-kernel_build_check.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/015-ipw200-mtu.patch (86%)
 rename package/kernel/mac80211/patches/{ => build}/050-lib80211_option.patch (78%)
 create mode 100644 package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
 rename package/kernel/mac80211/patches/{ => mwl}/700-mwl8k-missing-pci-id-for-WNR854T.patch (87%)
 rename package/kernel/mac80211/patches/{ => mwl}/801-libertas-configure-sysfs-links.patch (89%)
 rename package/kernel/mac80211/patches/{ => mwl}/802-libertas-set-wireless-macaddr.patch (85%)
 rename package/kernel/mac80211/patches/{ => mwl}/940-mwl8k_init_devices_synchronously.patch (75%)
 create mode 100644 package/kernel/mac80211/patches/mwl/941-mwl8k-Fix-rate_idx-underflow.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/001-rt2x00-use-simple_read_from_buffer.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/002-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/003-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/004-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/005-rt2x00-use-different-txstatus-timeouts-when-flushing.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/006-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/007-rt2x00-rt2400pci-mark-expected-switch-fall-through.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/008-rt2x00-rt2500pci-mark-expected-switch-fall-through.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/009-rt2x00-rt2800lib-mark-expected-switch-fall-throughs.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/010-rt2x00-rt61pci-mark-expected-switch-fall-through.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/011-cross-tree-phase-out-dma_zalloc_coherent.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/012-rt2x00-reduce-tx-power-to-nominal-level-on-RT6352.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/013-rt2x00-Work-around-a-firmware-bug-with-shared-keys.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/014-rt2x00-no-need-to-check-return-value-of-debugfs_crea.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/015-rt2x00-remove-unneeded-check.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/016-rt2x00-remove-confusing-AGC-register.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/017-rt2800-enable-TX_PIN_CFG_LNA_PE_-bits-per-band.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/018-rt2800-enable-TX_PIN_CFG_RFRX_EN-only-for-MT7620.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/019-rt2800-comment-and-simplify-AGC-init-for-RT6352.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/020-cfg80211-add-ratelimited-variants-of-err-and-warn.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/021-rt2x00-use-ratelimited-variants-dev_warn-dev_err.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/022-rt2x00-check-number-of-EPROTO-errors.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/023-rt2x00-do-not-print-error-when-queue-is-full.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/024-rt2800-partially-restore-old-mmio-txstatus-behaviour.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/025-rt2800-new-flush-implementation-for-SoC-devices.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/026-rt2800-move-txstatus-pending-routine.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/027-rt2800mmio-fetch-tx-status-changes.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/028-rt2800mmio-use-timer-and-work-for-handling-tx-status.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/029-rt2x00-remove-last_nostatus_check.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/030-rt2x00-remove-not-used-entry-field.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/031-rt2x00mmio-remove-legacy-comment.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/032-rt2x00-do-not-increment-sequence-number-while-re-tra.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/050-rt2x00-add-RT3883-support.patch
 rename package/kernel/mac80211/patches/{030-rt2x00_options.patch => rt2x00/100-rt2x00_options.patch} (100%)
 rename package/kernel/mac80211/patches/{600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch => rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch} (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/601-rt2x00-introduce-rt2x00_platform_h.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/602-rt2x00-introduce-rt2x00eeprom.patch (95%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/603-rt2x00-of_load_eeprom_filename.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch (96%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/606-rt2x00-allow_disabling_bands_through_platform_data.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/607-rt2x00-add_platform_data_mac_addr.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/608-rt2x00-allow_disabling_bands_through_dts.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch (94%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/610-rt2x00-change-led-polarity-from-OF.patch (95%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/611-rt2x00-add-AP+STA-support.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/650-rt2x00-add-support-for-external-PA-on-MT7620.patch (58%)
 create mode 100644 package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
 rename package/kernel/mac80211/patches/{ => subsys}/100-remove-cryptoapi-dependencies.patch (96%)
 rename package/kernel/mac80211/patches/{ => subsys}/110-mac80211_keep_keys_on_stop_ap.patch (84%)
 rename package/kernel/mac80211/patches/{ => subsys}/120-cfg80211_allow_perm_addr_change.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/130-disable-fils.patch (91%)
 rename package/kernel/mac80211/patches/{ => subsys}/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/132-mac80211-remove-cmac-dependency.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/140-tweak-TSQ-setting.patch (93%)
 rename package/kernel/mac80211/patches/{ => subsys}/150-disable_addr_notifier.patch (80%)
 rename package/kernel/mac80211/patches/{ => subsys}/210-ap_scan.patch (83%)
 rename package/kernel/mac80211/patches/{398-mac80211-add-stop-start-logic-for-software-TXQs.patch => subsys/300-mac80211-add-stop-start-logic-for-software-TXQs.patch} (90%)
 rename package/kernel/mac80211/patches/{399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch => subsys/301-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch} (94%)
 rename package/kernel/mac80211/patches/{359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch => subsys/303-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch} (97%)
 rename package/kernel/mac80211/patches/{370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch => subsys/304-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch} (89%)
 rename package/kernel/mac80211/patches/{371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch => subsys/305-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch} (97%)
 rename package/kernel/mac80211/patches/{372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch => subsys/306-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch} (100%)
 rename package/kernel/mac80211/patches/{373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch => subsys/307-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch} (100%)
 rename package/kernel/mac80211/patches/{375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch => subsys/308-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch} (100%)
 rename package/kernel/mac80211/patches/{376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch => subsys/309-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch} (100%)
 rename package/kernel/mac80211/patches/{377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch => subsys/310-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch} (100%)
 rename package/kernel/mac80211/patches/{378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch => subsys/311-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch} (83%)
 create mode 100644 package/kernel/mac80211/patches/subsys/312-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/313-mac80211-fix-unaligned-access-in-mesh-table-hash-fun.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/320-mac80211-Add-TXQ-scheduling-API.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/321-cfg80211-Add-airtime-statistics-and-settings.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/322-mac80211-Add-airtime-accounting-and-scheduling-to-TX.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/323-mac80211-Expose-ieee80211_schedule_txq-function.patch
 rename package/kernel/mac80211/patches/{357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch => subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch} (82%)
 create mode 100644 package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/352-mac80211-rework-locking-for-txq-scheduling-airtime-f.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/353-mac80211-mesh-drop-redundant-rcu_read_lock-unlock-ca.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/354-mac80211-calculate-hash-for-fq-without-holding-fq-lo.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/355-mac80211-run-late-dequeue-late-tx-handlers-without-h.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/356-mac80211-set-NETIF_F_LLTX-when-using-intermediate-tx.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/358-mac80211-make-ieee80211_schedule_txq-schedule-empty-.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/359-mac80211-un-schedule-TXQs-on-powersave-start.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/360-mac80211-when-using-iTXQ-select-the-queue-in-ieee802.patch
 create mode 100644 package/kernel/mac80211/patches/subsys/390-nl-mac-80211-allow-4addr-AP-operation-on-crypto-cont.patch
 rename package/kernel/mac80211/patches/{ => subsys}/522-mac80211_configure_antenna_gain.patch (79%)
 create mode 100644 package/kernel/mac80211/ralink.mk
 create mode 100644 package/kernel/mac80211/realtek.mk

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index f091199864..5ab42f0a1f 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2017-11-01
-PKG_RELEASE:=10
-PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
-PKG_HASH:=8437ab7886b988c8152e7a4db30b7f41009e49a3b2cb863edd05da1ecd7eb05a
+PKG_VERSION:=4.19.32-1
+PKG_RELEASE:=2
+PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.32/
+PKG_HASH:=838db1565b54fe4bd1e769c54f30c65c9ea2fb5e99a0cddb7910561794ae317a
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@@ -24,58 +24,23 @@ PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_DRIVERS = \
 	adm8211 \
 	airo \
-	ath ath5k ath6kl ath6kl-sdio ath6kl-usb ath9k ath9k-common ath9k-htc ath10k \
-	b43 b43legacy \
-	carl9170 \
 	hermes hermes-pci hermes-pcmcia hermes-plx\
-	iwl-legacy iwl3945 iwl4965 iwlwifi \
 	lib80211 \
-	libipw ipw2100 ipw2200 \
-	libertas-sdio libertas-usb libertas-spi \
 	mac80211-hwsim \
 	mt7601u \
-	mwl8k mwifiex-pcie mwifiex-sdio \
 	p54-common p54-pci p54-spi p54-usb \
 	rsi91x rsi91x-usb rsi91x-sdio\
-	rt2x00-lib rt2x00-pci rt2x00-usb \
-	rt2400-pci rt2500-pci rt2500-usb \
-	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
-	rt61-pci rt73-usb \
-	rtl8180 rtl8187 \
-	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
-	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8821ae \
-	rtl8xxxu \
 	wlcore wl12xx wl18xx \
 	zd1211rw
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-mac80211 \
-	$(patsubst %,CONFIG_PACKAGE_kmod-%,$(PKG_DRIVERS)) \
 	CONFIG_PACKAGE_MAC80211_DEBUGFS \
 	CONFIG_PACKAGE_MAC80211_MESH \
 	CONFIG_PACKAGE_MAC80211_TRACING \
-	CONFIG_PACKAGE_ATH_DEBUG \
-	CONFIG_PACKAGE_ATH_DFS \
-	CONFIG_PACKAGE_ATH_SPECTRAL \
-	CONFIG_PACKAGE_ATH_DYNACK \
-	CONFIG_PACKAGE_B43_DEBUG \
-	CONFIG_PACKAGE_B43_PIO \
-	CONFIG_PACKAGE_B43_PHY_G \
-	CONFIG_PACKAGE_B43_PHY_N \
-	CONFIG_PACKAGE_B43_PHY_LP \
-	CONFIG_PACKAGE_B43_PHY_HT \
-	CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB \
-	CONFIG_PACKAGE_B43_BUSES_BCMA \
-	CONFIG_PACKAGE_B43_BUSES_SSB \
-	CONFIG_PACKAGE_BRCM80211_DEBUG \
 	CONFIG_PACKAGE_IWLWIFI_DEBUG \
 	CONFIG_PACKAGE_IWLWIFI_DEBUGFS \
-	CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS \
-	CONFIG_PACKAGE_RT2X00_DEBUG \
 	CONFIG_PACKAGE_RTLWIFI_DEBUG \
-	CONFIG_ATH9K_SUPPORT_PCOEM \
-	CONFIG_ATH9K_TX99 \
-	CONFIG_ATH_USER_REGD \
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -87,10 +52,53 @@ define KernelPackage/mac80211/Default
   MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 endef
 
+config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
+
+config-y:= \
+	WLAN \
+	NL80211_TESTMODE \
+	CFG80211_WEXT \
+	CFG80211_CERTIFICATION_ONUS \
+	MAC80211_RC_MINSTREL \
+	MAC80211_RC_MINSTREL_HT \
+	MAC80211_RC_MINSTREL_VHT \
+	MAC80211_RC_DEFAULT_MINSTREL \
+	WLAN_VENDOR_ADMTEK \
+	WLAN_VENDOR_ATH \
+	WLAN_VENDOR_ATMEL \
+	WLAN_VENDOR_BROADCOM \
+	WLAN_VENDOR_CISCO \
+	WLAN_VENDOR_INTEL \
+	WLAN_VENDOR_INTERSIL \
+	WLAN_VENDOR_MARVELL \
+	WLAN_VENDOR_MEDIATEK \
+	WLAN_VENDOR_RALINK \
+	WLAN_VENDOR_REALTEK \
+	WLAN_VENDOR_RSI \
+	WLAN_VENDOR_ST \
+	WLAN_VENDOR_TI \
+	WLAN_VENDOR_ZYDAS \
+
+config-$(call config_package,cfg80211) += CFG80211
+
+config-$(call config_package,mac80211) += MAC80211
+config-$(CONFIG_PACKAGE_MAC80211_MESH) += MAC80211_MESH
+
+include ath.mk
+include broadcom.mk
+include intel.mk
+include marvell.mk
+include ralink.mk
+include realtek.mk
+
+PKG_CONFIG_DEPENDS += \
+	$(patsubst %,CONFIG_PACKAGE_kmod-%,$(PKG_DRIVERS))
+
 define KernelPackage/cfg80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=cfg80211 - wireless configuration API
   DEPENDS+= +iw +wireless-regdb
+  ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   FILES:= \
 	$(PKG_BUILD_DIR)/compat/compat.ko \
 	$(PKG_BUILD_DIR)/net/wireless/cfg80211.ko
@@ -108,6 +116,7 @@ define KernelPackage/mac80211
   KCONFIG:=\
 	CONFIG_AVERAGE=y
   FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.ko
+  ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   MENU:=1
 endef
 
@@ -162,645 +171,6 @@ define KernelPackage/airo/description
  Kernel support for Cisco Aironet cards
 endef
 
-define KernelPackage/ath/config
-  if PACKAGE_kmod-ath
-	config ATH_USER_REGD
-		bool "Force Atheros drivers to respect the user's regdomain settings"
-		default y
-		help
-		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
-		  the regulatory limits and the user is only allowed to restrict the settings
-		  even further, even if the country allows frequencies or power levels that
-		  are forbidden by the EEPROM settings.
-
-		  Select this option if you want the driver to respect the user's decision about
-		  regulatory settings.
-
-	config PACKAGE_ATH_DEBUG
-		bool "Atheros wireless debugging"
-		help
-		  Say Y, if you want to debug atheros wireless drivers.
-		  Only ath9k & ath10k make use of this.
-
-	config PACKAGE_ATH_DFS
-		bool "Enable DFS support"
-		default y
-		help
-		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
-		  channels in Europe, US, and Japan.
-
-		  Select this option if you want to use such channels.
-
-	config PACKAGE_ATH_SPECTRAL
-		bool "Atheros spectral scan support"
-		depends on PACKAGE_ATH_DEBUG
-		select KERNEL_RELAY
-		help
-		  Say Y to enable access to the FFT/spectral data via debugfs.
-
-	config PACKAGE_ATH_DYNACK
-		bool "Enable Dynack support"
-		depends on PACKAGE_kmod-ath9k-common
-		help
-		  Enables support for Dynamic ACK estimation, which allows the fastest possible speed
-		  at any distance automatically by increasing/decreasing the max frame ACK time for
-		  the most remote station detected.  It can be enabled by using iw (iw phy0 set distance auto),
-		  or by sending the NL80211_ATTR_WIPHY_DYN_ACK flag to mac80211 driver using netlink.
-
-		  Select this option if you want to enable this feature
-
-  endif
-endef
-
-define KernelPackage/ath
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros common driver part
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath25 +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
-  MENU:=1
-endef
-
-define KernelPackage/ath/description
- This module contains some common parts needed by Atheros Wireless drivers.
-endef
-
-define KernelPackage/ath5k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 5xxx wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
-  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath +@DRIVER_11W_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
-  AUTOLOAD:=$(call AutoProbe,ath5k)
-endef
-
-define KernelPackage/ath5k/description
- This module adds support for wireless adapters based on
- Atheros 5xxx chipset.
-endef
-
-define KernelPackage/ath6kl
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros FullMAC wireless devices (common code for ath6kl_sdio and ath6kl_usb)
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
-  HIDDEN:=1
-  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_core.ko
-endef
-
-define KernelPackage/ath6kl-sdio
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n SDIO wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
-  DEPENDS+= +kmod-mmc +kmod-ath6kl
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,ath6kl_sdio)
-endef
-
-define KernelPackage/ath6kl-sdio/description
-This module adds support for wireless adapters based on
-Atheros IEEE 802.11n AR6003 and AR6004 family of chipsets.
-endef
-
-define KernelPackage/ath6kl-usb
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n USB wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-ath6kl
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_usb.ko
-  AUTOLOAD:=$(call AutoProbe,ath6kl_usb)
-endef
-
-define KernelPackage/ath6kl-usb/description
-This module adds support for wireless adapters based on the
-Atheros IEEE 802.11n AR6004 chipset.
-endef
-
-define KernelPackage/ath9k-common
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-  HIDDEN:=1
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
-endef
-
-define KernelPackage/ath9k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n PCI wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx +kmod-ath9k-common
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
-  AUTOLOAD:=$(call AutoProbe,ath9k)
-endef
-
-define KernelPackage/ath9k/description
-This module adds support for wireless adapters based on
-Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
-endef
-
-define KernelPackage/ath9k/config
-
-	config ATH9K_SUPPORT_PCOEM
-		bool "Support chips used in PC OEM cards"
-		depends on PACKAGE_kmod-ath9k
-
-       config ATH9K_TX99
-               bool "Enable TX99 support (WARNING: testing only, breaks normal operation!)"
-               depends on PACKAGE_kmod-ath9k
-
-	config ATH9K_UBNTHSR
-		bool "Support for Ubiquiti UniFi Outdoor+ access point"
-		depends on PACKAGE_kmod-ath9k && TARGET_ar71xx_generic
-		default y
-
-endef
-
-define KernelPackage/ath9k-htc
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11n USB device support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
-  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core +ath9k-htc-firmware
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
-  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
-endef
-
-define KernelPackage/ath9k-htc/description
-This module adds support for wireless adapters based on
-Atheros USB AR9271 and AR7010 family of chipsets.
-endef
-
-define KernelPackage/ath10k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros 802.11ac wireless cards support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
-  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
-  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
-endef
-
-define KernelPackage/ath10k/description
-This module adds support for wireless adapters based on
-Atheros IEEE 802.11ac family of chipsets. For now only
-PCI is supported.
-endef
-
-#Broadcom firmware
-ifneq ($(CONFIG_B43_FW_6_30),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=6.30.163.46
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).wl_apsta.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-  PKG_B43_FWV4_HASH:=a07c3b6b277833c7dbe61daa511f908cd66c5e2763eb7a0859abc36cd9335c2d
-else
-ifneq ($(CONFIG_B43_FW_5_10),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=5.10.56.27.3
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta/wl_prebuilt.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)_mipsel.tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-  PKG_B43_FWV4_HASH:=26a8c370f48fc129d0731cfd751c36cae1419b0bc8ca35781126744e60eae009
-else
-ifneq ($(CONFIG_B43_FW_4_178),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=4.178.10.4
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-  PKG_B43_FWV4_HASH:=32f6ad98facbb9045646fdc8b54bb03086d204153253f9c65d0234a5d90ae53f
-else
-ifneq ($(CONFIG_B43_FW_5_100_138),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=5.100.138
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-  PKG_B43_FWV4_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
-else
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=4.150.10.5
-  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta_mimo.o
-  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
-  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-  PKG_B43_FWV4_HASH:=a9f4e276a4d8d3a1cd0f2eb87080ae89b77f0a7140f06d4e9e2135fc44fdd533
-endif
-endif
-endif
-endif
-ifneq ($(CONFIG_B43_OPENFIRMWARE),)
-  PKG_B43_FWV4_NAME:=broadcom-wl
-  PKG_B43_FWV4_VERSION:=5.2
-  PKG_B43_FWV4_OBJECT:=openfwwf-$(PKG_B43_FWV4_VERSION)
-  PKG_B43_FWV4_SOURCE:=openfwwf-$(PKG_B43_FWV4_VERSION).tar.gz
-  PKG_B43_FWV4_SOURCE_URL:=http://netweb.ing.unibs.it/~openfwwf/firmware
-  PKG_B43_FWV4_HASH:=9de03320083201080b2e94b81637ac07a159cf4e6f3481383e1a217e627bc0dc
-endif
-
-
-define Download/b43
-  FILE:=$(PKG_B43_FWV4_SOURCE)
-  URL:=$(PKG_B43_FWV4_SOURCE_URL)
-  HASH:=$(PKG_B43_FWV4_HASH)
-endef
-$(eval $(call Download,b43))
-
-define KernelPackage/b43
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom 43xx wireless support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-  KCONFIG:= \
-  	CONFIG_HW_RANDOM=y
-  # Depend on PCI_SUPPORT to make sure we can select kmod-bcma or kmod-ssb
-  DEPENDS += \
-	@PCI_SUPPORT +kmod-mac80211 \
-	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
-	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43/b43.ko
-  AUTOLOAD:=$(call AutoProbe,b43)
-  MENU:=1
-endef
-
-define KernelPackage/b43/config
-
-config PACKAGE_B43_USE_SSB
-	select PACKAGE_kmod-ssb
-	tristate
-	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
-
-config PACKAGE_B43_USE_BCMA
-	select PACKAGE_kmod-bcma
-	tristate
-	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
-	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
-
-  if PACKAGE_kmod-b43
-
-	choice
-		prompt "b43 firmware version"
-		default B43_FW_5_100_138
-		help
-		  This option allows you to select the version of the b43 firmware.
-
-	config B43_FW_4_150
-		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
-		help
-		  Old stable firmware for BCM43xx devices.
-
-		  If unsure, select this.
-
-	config B43_FW_4_178
-		bool "Firmware 478.104 from driver 4.178.10.4"
-		help
-		  Older firmware for BCM43xx devices.
-
-		  If unsure, select the "stable" firmware.
-
-	config B43_FW_5_10
-		bool "Firmware 508.1084 from driver 5.10.56.27"
-		help
-		  Older firmware for BCM43xx devices.
-
-		  If unsure, select the "stable" firmware.
-
-	config B43_FW_5_100_138
-		bool "Firmware 666.2 from driver 5.100.138 (stable)"
-		help
-		  The currently default firmware for BCM43xx devices.
-
-		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
-
-		  If unsure, select the this firmware.
-
-	config B43_FW_6_30
-		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
-		help
-		  Newer experimental firmware for BCM43xx devices.
-
-		  This firmware is mostly untested.
-
-		  If unsure, select the "stable" firmware.
-
-	config B43_OPENFIRMWARE
-		bool "Open FirmWare for WiFi networks"
-		help
-		  Opensource firmware for BCM43xx devices.
-
-		  Do _not_ select this, unless you know what you are doing.
-		  The Opensource firmware is not suitable for embedded devices, yet.
-		  It does not support QoS, which is bad for AccessPoints.
-		  It does not support hardware crypto acceleration, which is a showstopper
-		  for embedded devices with low CPU resources.
-
-		  If unsure, select the "stable" firmware.
-
-	endchoice
-
-	config B43_FW_SQUASH
-		bool "Remove unnecessary firmware files"
-		depends on !B43_OPENFIRMWARE
-		default y
-		help
-		  This options allows you to remove unnecessary b43 firmware files
-		  from the final rootfs image. This can reduce the rootfs size by
-		  up to 200k.
-
-		  If unsure, say Y.
-
-	config B43_FW_SQUASH_COREREVS
-		string "Core revisions to include"
-		depends on B43_FW_SQUASH
-		default "5,6,7,8,9,10,11,13,15" if TARGET_brcm47xx_legacy
-		default "16,28,29,30" if TARGET_brcm47xx_mips74k
-		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
-		help
-		  This is a comma seperated list of core revision numbers.
-
-		  Example (keep files for rev5 only):
-		    5
-
-		  Example (keep files for rev5 and rev11):
-		    5,11
-
-	config B43_FW_SQUASH_PHYTYPES
-		string "PHY types to include"
-		depends on B43_FW_SQUASH
-		default "G,N,LP" if TARGET_brcm47xx_legacy
-		default "N,HT" if TARGET_brcm47xx_mips74k
-		default "G,N,LP,HT"
-		help
-		  This is a comma seperated list of PHY types:
-		    A  => A-PHY
-		    AG => Dual A-PHY G-PHY
-		    G  => G-PHY
-		    LP => LP-PHY
-		    N  => N-PHY
-		    HT  => HT-PHY
-		    LCN  => LCN-PHY
-		    LCN40  => LCN40-PHY
-		    AC  => AC-PHY
-
-		  Example (keep files for G-PHY only):
-		    G
-
-		  Example (keep files for G-PHY and N-PHY):
-		    G,N
-
-	choice
-		prompt "Supported buses"
-		default PACKAGE_B43_BUSES_BCMA_AND_SSB
-		help
-		  This allows choosing buses that b43 should support.
-
-	config PACKAGE_B43_BUSES_BCMA_AND_SSB
-		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
-		bool "BCMA and SSB"
-
-	config PACKAGE_B43_BUSES_BCMA
-		depends on !TARGET_brcm47xx_legacy
-		bool "BCMA only"
-
-	config PACKAGE_B43_BUSES_SSB
-		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
-		bool "SSB only"
-
-	endchoice
-
-	config PACKAGE_B43_DEBUG
-		bool "Enable debug output and debugfs for b43"
-		default n
-		help
-		  Enable additional debug output and runtime sanity checks for b43
-		  and enables the debugfs interface.
-
-		  If unsure, say N.
-
-	config PACKAGE_B43_PIO
-		bool "Enable support for PIO transfer mode"
-		default n
-		help
-		  Enable support for using PIO instead of DMA. Unless you have DMA
-		  transfer problems you don't need this.
-
-		  If unsure, say N.
-
-	config PACKAGE_B43_PHY_G
-		bool "Enable support for G-PHYs"
-		default n if TARGET_brcm47xx_mips74k
-		default y
-		help
-		  Enable support for G-PHY. This includes support for the following devices:
-		  PCI: BCM4306, BCM4311, BCM4318
-		  SoC: BCM5352E, BCM4712
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_N
-		bool "Enable support for N-PHYs"
-		default y
-		help
-		  Enable support for N-PHY. This includes support for the following devices:
-		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
-		  SoC: BCM4716, BCM4717, BCM4718
-
-		  Currently only 11g speed is available.
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_LP
-		bool "Enable support for LP-PHYs"
-		default n if TARGET_brcm47xx_mips74k
-		default y
-		help
-		  Enable support for LP-PHY. This includes support for the following devices:
-		  PCI: BCM4312
-		  SoC: BCM5354
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_HT
-		bool "Enable support for HT-PHYs"
-		default n if TARGET_brcm47xx_legacy
-		default y
-		help
-		  Enable support for HT-PHY. This includes support for the following devices:
-		  PCI: BCM4331
-
-		  Currently only 11g speed is available.
-
-		  If unsure, say Y.
-
-	config PACKAGE_B43_PHY_LCN
-		bool "Enable support for LCN-PHYs"
-		depends on BROKEN
-		default n
-		help
-		  Currently broken.
-
-		  If unsure, say N.
-
-  endif
-endef
-
-define KernelPackage/b43/description
-Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
-endef
-
-define KernelPackage/b43legacy
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom 43xx-legacy wireless support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-  KCONFIG:= \
-  	CONFIG_HW_RANDOM=y
-  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb +b43legacy-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
-  AUTOLOAD:=$(call AutoProbe,b43legacy)
-  MENU:=1
-endef
-
-define KernelPackage/b43legacy/description
-Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
-endef
-
-
-define KernelPackage/brcmutil
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom IEEE802.11n common driver parts
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmutil/brcmutil.ko
-  AUTOLOAD:=$(call AutoProbe,brcmutil)
-  MENU:=1
-endef
-
-define KernelPackage/brcmutil/description
- This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
-endef
-
-define KernelPackage/brcmutil/config
-  if PACKAGE_kmod-brcmutil
-
-	config PACKAGE_BRCM80211_DEBUG
-		bool "Broadcom wireless driver debugging"
-		help
-		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
-
-  endif
-endef
-
-PKG_BRCMSMAC_FW_NAME:=broadcom-wl
-PKG_BRCMSMAC_FW_VERSION:=5.100.138
-PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
-PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
-PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
-PKG_BRCMSMAC_FW_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
-
-define Download/brcmsmac
-  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
-  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
-  HASH:=$(PKG_BRCMSMAC_FW_HASH)
-endef
-$(eval $(call Download,brcmsmac))
-
-define KernelPackage/brcmsmac
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
-  AUTOLOAD:=$(call AutoProbe,brcmsmac)
-  MENU:=1
-endef
-
-define KernelPackage/brcmsmac/description
- Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
-endef
-
-define KernelPackage/brcmsmac/config
-  if PACKAGE_kmod-brcmsmac
-
-	config BRCMSMAC_USE_FW_FROM_WL
-		bool "Use firmware extracted from broadcom proprietary driver"
-		default y
-		help
-		  Instead of using the official brcmsmac firmware a firmware
-		  version 666.2 extracted from the proprietary Broadcom driver
-		  is used. This is needed to get core rev 17 used in bcm4716
-		  to work.
-
-		  If unsure, say Y.
-
-  endif
-endef
-
-
-define KernelPackage/brcmfmac
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +kmod-brcmutil \
-	+BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
-	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
-  AUTOLOAD:=$(call AutoProbe,brcmfmac)
-endef
-
-define KernelPackage/brcmfmac/description
- Kernel module for Broadcom IEEE802.11n USB Wireless cards
-endef
-
-define KernelPackage/brcmfmac/config
-  if PACKAGE_kmod-brcmfmac
-
-	config BRCMFMAC_SDIO
-		bool "Enable SDIO bus interface support"
-		default y if TARGET_brcm2708
-		default y if TARGET_sunxi
-		default n
-		help
-		  Enable support for cards attached to an SDIO bus.
-		  Select this option only if you are sure that your
-		  board has a Broadcom wireless chip atacched to
-		  that bus.
-
-	config BRCMFMAC_USB
-		bool "Enable USB bus interface support"
-		depends on USB_SUPPORT
-		default y
-		help
-		  Supported USB connected chipsets:
-		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
-		  BCM43143, BCM43242, BCM43566, BCM43569
-
-	config BRCMFMAC_PCIE
-		bool "Enable PCIE bus interface support"
-		depends on PCI_SUPPORT
-		default y
-		help
-		  Supported PCIe connected chipsets:
-		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
-
-  endif
-endef
-
-
-define KernelPackage/carl9170
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Atheros AR9170 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
-  AUTOLOAD:=$(call AutoProbe,carl9170)
-endef
-
-
 define KernelPackage/hermes
   $(call KernelPackage/mac80211/Default)
   TITLE:=Hermes 802.11b chipset support
@@ -840,7 +210,7 @@ endef
 define KernelPackage/hermes-pcmcia
   $(call KernelPackage/mac80211/Default)
   TITLE:=Hermes based PCMCIA adaptors
-  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes @BROKEN
+  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes +kmod-pcmcia-core
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
   AUTOLOAD:=$(call AutoProbe,orinoco_cs)
 endef
@@ -850,114 +220,6 @@ define KernelPackage/hermes-pcmcia/description
 endef
 
 
-define KernelPackage/iwlwifi
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT @!LINUX_3_18
-  TITLE:=Intel AGN Wireless support
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/dvm/iwldvm.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/mvm/iwlmvm.ko
-  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm iwlmvm)
-  MENU:=1
-endef
-
-define KernelPackage/iwlwifi/description
- iwlwifi kernel module for
- Intel Wireless WiFi Link 6250AGN Adapter
- Intel 6000 Series Wi-Fi Adapters (6200AGN and 6300AGN)
- Intel WiFi Link 1000BGN
- Intel Wireless WiFi 5150AGN
- Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
- Intel 6005 Series Wi-Fi Adapters
- Intel 6030 Series Wi-Fi Adapters
- Intel Wireless WiFi Link 6150BGN 2 Adapter
- Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
- Intel 2000 Series Wi-Fi Adapters
- Intel 7260 Wi-Fi Adapter
- Intel 3160 Wi-Fi Adapter
- Intel 7265 Wi-Fi Adapter
- Intel 8260 Wi-Fi Adapter
- Intel 3165 Wi-Fi Adapter
-endef
-
-define KernelPackage/iwlwifi/config
-  if PACKAGE_kmod-iwlwifi
-
-	config PACKAGE_IWLWIFI_DEBUG
-		bool "Enable full debugging output in the iwlwifi driver"
-		default n
-		help
-		  This option will enable debug tracing output for the iwlwifi drivers
-
-		  This will result in the kernel module being ~100k larger.  You can
-		  control which debug output is sent to the kernel log by setting the
-		  value in
-
-			/sys/module/iwlwifi/parameters/debug
-
-		  This entry will only exist if this option is enabled.
-
-		  To set a value, simply echo an 8-byte hex value to the same file:
-
-			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
-
-		  You can find the list of debug mask values in:
-			  drivers/net/wireless/intel/iwlwifi/iwl-debug.h
-
-		  If this is your first time using this driver, you should say Y here
-		  as the debug information can assist others in helping you resolve
-		  any problems you may encounter.
-
-	config PACKAGE_IWLWIFI_DEBUGFS
-	        bool "iwlwifi debugfs support"
-		depends on PACKAGE_MAC80211_DEBUGFS
-		default n
-		help
-		  Enable creation of debugfs files for the iwlwifi drivers. This
-		  is a low-impact option that allows getting insight into the
-		  driver's state at runtime.
-
-  endif
-endef
-
-define KernelPackage/iwl-legacy
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
-  TITLE:=Intel legacy Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
-  AUTOLOAD:=$(call AutoProbe,iwlegacy)
-endef
-
-define KernelPackage/iwl-legacy/description
- iwl-legacy kernel module for legacy Intel wireless support
-endef
-
-define KernelPackage/iwl3945
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
-  TITLE:=Intel iwl3945 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
-  AUTOLOAD:=$(call AutoProbe,iwl3945)
-endef
-
-define KernelPackage/iwl3945/description
- iwl3945 kernel module for Intel 3945 support
-endef
-
-define KernelPackage/iwl4965
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
-  TITLE:=Intel iwl4965 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
-  AUTOLOAD:=$(call AutoProbe,iwl4965)
-endef
-
-define KernelPackage/iwl4965/description
- iwl4965 kernel module for Intel 4965 support
-endef
-
-
 define KernelPackage/lib80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=802.11 Networking stack
@@ -985,109 +247,6 @@ define KernelPackage/lib80211/description
 endef
 
 
-define KernelPackage/libipw
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=libipw for ipw2100 and ipw2200
-  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-crypto-ecb +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN @!LINUX_3_18
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
-  AUTOLOAD:=$(call AutoProbe,libipw)
-endef
-
-define KernelPackage/libipw/description
- Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-endef
-
-IPW2100_NAME:=ipw2100-fw
-IPW2100_VERSION:=1.3
-
-define Download/ipw2100
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2100-firmware/ipw2100-fw-1.3.tgz/46aa75bcda1a00efa841f9707bbbd113/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2100-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-  HASH:=e1107c455e48d324a616b47a622593bc8413dcce72026f72731c0b03dae3a7a2
-endef
-$(eval $(call Download,ipw2100))
-
-define KernelPackage/ipw2100
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2100 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2100)
-endef
-
-define KernelPackage/ipw2100/description
- Kernel support for Intel IPW2100
- Includes:
- - ipw2100
-endef
-
-IPW2200_NAME:=ipw2200-fw
-IPW2200_VERSION:=3.1
-
-define Download/ipw2200
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-3.1.tgz/eaba788643c7cc7483dd67ace70f6e99/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2200-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-  HASH:=c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd
-endef
-$(eval $(call Download,ipw2200))
-
-define KernelPackage/ipw2200
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2200 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2200)
-endef
-
-define KernelPackage/ipw2200/description
- Kernel support for Intel IPW2200
- Includes:
- - ipw2200
-endef
-
-
-define KernelPackage/libertas-usb
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware @!LINUX_3_18
-  TITLE:=Marvell 88W8015 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
-  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
-endef
-
-define KernelPackage/libertas-sdio
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware @!LINUX_3_18
-  TITLE:=Marvell 88W8686 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
-endef
-
-define KernelPackage/libertas-spi
-  $(call KernelPackage/mac80211/Default)
-  SUBMENU:=Wireless Drivers
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-spi-firmware @!LINUX_3_18
-  KCONFIG := \
-	CONFIG_SPI=y \
-	CONFIG_SPI_MASTER=y
-  TITLE:=Marvell 88W8686 SPI Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
-endef
-
 define KernelPackage/mac80211-hwsim
   $(call KernelPackage/mac80211/Default)
   TITLE:=mac80211 HW simulation device
@@ -1100,56 +259,11 @@ endef
 define KernelPackage/mt7601u
   $(call KernelPackage/mac80211/Default)
   TITLE:=MT7601U-based USB dongles Wireless Driver
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
   AUTOLOAD:=$(call AutoProbe,mt7601u)
 endef
 
-
-define KernelPackage/mwl8k
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
-  AUTOLOAD:=$(call AutoProbe,mwl8k)
-endef
-
-define KernelPackage/mwl8k/description
- Kernel modules for Marvell TOPDOG 802.11 Wireless cards
-endef
-
-
-define KernelPackage/mwifiex-pcie
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
-  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
-endef
-
-define KernelPackage/mwifiex-pcie/description
- Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
-endef
-
-define KernelPackage/mwifiex-sdio
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,mwifiex_sdio)
-endef
-
-define KernelPackage/mwifiex-sdio/description
- Kernel modules for Marvell 802.11n/802.11ac SDIO Wireless cards
-endef
-
 define KernelPackage/p54/Default
   $(call KernelPackage/mac80211/Default)
   TITLE:=Prism54 Drivers
@@ -1161,7 +275,7 @@ endef
 
 define KernelPackage/p54-common
   $(call KernelPackage/p54/Default)
-  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt
+  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-lib-crc-ccitt +@DRIVER_11W_SUPPORT
   TITLE+= (COMMON)
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54common.ko
 endef
@@ -1214,297 +328,6 @@ define KernelPackage/rsi91x-sdio
 endef
 
 
-
-define KernelPackage/rt2x00/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Ralink Drivers for RT2x00 cards
-endef
-
-define KernelPackage/rt2x00-lib
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-lib-crc-itu-t
-  TITLE+= (LIB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00lib.ko
-  MENU:=1
-endef
-
-define KernelPackage/rt2x00-lib/config
-  if PACKAGE_kmod-rt2x00-lib
-
-	config PACKAGE_RT2X00_LIB_DEBUGFS
-		bool "Enable rt2x00 debugfs support"
-		depends on PACKAGE_MAC80211_DEBUGFS
-		help
-		  Enable creation of debugfs files for the rt2x00 drivers.
-		  These debugfs files support both reading and writing of the
-		  most important register types of the rt2x00 hardware.
-
-	config PACKAGE_RT2X00_DEBUG
-		bool "Enable rt2x00 debug output"
-		help
-		  Enable debugging output for all rt2x00 modules
-
-  endif
-endef
-
-define KernelPackage/rt2x00-mmio
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
-  HIDDEN:=1
-  TITLE+= (MMIO)
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko
-endef
-
-define KernelPackage/rt2x00-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
-  HIDDEN:=1
-  TITLE+= (PCI)
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
-endef
-
-define KernelPackage/rt2x00-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
-  HIDDEN:=1
-  TITLE+= (USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
-endef
-
-define KernelPackage/rt2800-lib
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
-  HIDDEN:=1
-  TITLE+= (rt2800 LIB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
-endef
-
-define KernelPackage/rt2400-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
-  TITLE+= (RT2400 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-endef
-
-define KernelPackage/rt2500-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
-  TITLE+= (RT2500 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-endef
-
-define KernelPackage/rt2500-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
-  TITLE+= (RT2500 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-endef
-
-define KernelPackage/rt2800-mmio
-$(call KernelPackage/rt2x00/Default)
-  TITLE += (RT28xx/RT3xxx MMIO)
-  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
-  HIDDEN:=1
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800mmio.ko
-endef
-
-define KernelPackage/rt2800-soc
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
-  TITLE += (RT28xx/RT3xxx SoC)
-  FILES := \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00soc.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800soc.ko
-  AUTOLOAD:=$(call AutoProbe,rt2800soc)
-endef
-
-define KernelPackage/rt2800-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio +rt2800-pci-firmware
-  TITLE+= (RT2860 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2800pci)
-endef
-
-define KernelPackage/rt2800-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt +rt2800-usb-firmware
-  TITLE+= (RT2870 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2800usb)
-endef
-
-
-define KernelPackage/rt61-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +rt61-pci-firmware
-  TITLE+= (RT2x61 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt61pci)
-endef
-
-define KernelPackage/rt73-usb
-  $(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +rt73-usb-firmware
-  TITLE+= (RT73 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt73usb)
-endef
-
-
-define KernelPackage/rtl818x/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek Drivers for RTL818x devices
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/rtl8187
-  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
-endef
-
-define KernelPackage/rtl8180
-  $(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @PCI_SUPPORT
-  TITLE+= (RTL8180 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
-endef
-
-define KernelPackage/rtl8187
-$(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core
-  TITLE+= (RTL8187 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8187)
-endef
-
-define KernelPackage/rtlwifi/config
-	config PACKAGE_RTLWIFI_DEBUG
-		bool "Realtek wireless debugging"
-		depends on PACKAGE_kmod-rtlwifi
-		help
-		  Say Y, if you want to debug realtek wireless drivers.
-
-endef
-
-define KernelPackage/rtlwifi
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek common driver part
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtlwifi-pci
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek common driver part (PCI support)
-  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtl_pci)
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtlwifi-btcoexist
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek BT coexist support
-  DEPENDS+= +kmod-rtlwifi
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/btcoexist/btcoexist.ko
-  AUTOLOAD:=$(call AutoProbe,btcoexist)
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtlwifi-usb
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek common driver part (USB support)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
-  AUTOLOAD:=$(call AutoProbe,rtl_usb)
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtl8192c-common
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
-  DEPENDS+= +kmod-rtlwifi
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
-  HIDDEN:=1
-endef
-
-define KernelPackage/rtl8192ce
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192CE/RTL8188CE support
-  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common +rtl8192ce-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
-endef
-
-define KernelPackage/rtl8192se
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192SE/RTL8191SE support
-  DEPENDS+= +kmod-rtlwifi-pci +rtl8192se-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192se)
-endef
-
-define KernelPackage/rtl8192de
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192DE/RTL8188DE support
-  DEPENDS+= +kmod-rtlwifi-pci +rtl8192de-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192de)
-endef
-
-define KernelPackage/rtl8192cu
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8192CU/RTL8188CU support
-  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common +rtl8192cu-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
-endef
-
-define KernelPackage/rtl8821ae
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8821AE support
-  DEPENDS+= +kmod-rtlwifi-btcoexist +kmod-rtlwifi-pci +rtl8821ae-firmware
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/rtl8821ae.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8821ae)
-endef
-
-define KernelPackage/rtl8xxxu
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=alternative Realtek RTL8XXXU support
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8xxxu)
-endef
-
-define KernelPackage/rtl8xxxu/description
-  This is an alternative driver for various Realtek RTL8XXX
-  parts written to utilize the Linux mac80211 stack.
-  The driver is known to work with a number of RTL8723AU,
-  RL8188CU, RTL8188RU, RTL8191CU, and RTL8192CU devices
-
-  This driver is under development and has a limited feature
-  set. In particular it does not yet support 40MHz channels
-  and power management. However it should have a smaller
-  memory footprint than the vendor drivers and benetifs
-  from the in kernel mac80211 stack.
-
-  It can coexist with drivers from drivers/staging/rtl8723au,
-  drivers/staging/rtl8192u, and drivers/net/wireless/rtlwifi,
-  but you will need to control which module you wish to load.
-
-  RTL8XXXU_UNTESTED is enabled
-  This option enables detection of Realtek 8723/8188/8191/8192 WiFi
-  USB devices which have not been tested directly by the driver
-  author or reported to be working by third parties.
-
-  Please report your results!
-endef
-
-
 define KernelPackage/wlcore
   $(call KernelPackage/mac80211/Default)
   TITLE:=TI common driver part
@@ -1558,63 +381,19 @@ $(eval $(call Download,zd1211rw))
 define KernelPackage/zd1211rw
   $(call KernelPackage/mac80211/Default)
   TITLE:=Zydas ZD1211 support
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211 +@DRIVER_11W_SUPPORT
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zydas/zd1211rw/zd1211rw.ko
   AUTOLOAD:=$(call AutoProbe,zd1211rw)
 endef
 
-
-
-config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
-
-config-y:= \
-	WLAN \
-	NL80211_TESTMODE \
-	CFG80211_WEXT \
-	CFG80211_CERTIFICATION_ONUS \
-	MAC80211_RC_MINSTREL \
-	MAC80211_RC_MINSTREL_HT \
-	MAC80211_RC_MINSTREL_VHT \
-	MAC80211_RC_DEFAULT_MINSTREL \
-	WLAN_VENDOR_ADMTEK \
-	WLAN_VENDOR_ATH \
-	WLAN_VENDOR_ATMEL \
-	WLAN_VENDOR_BROADCOM \
-	WLAN_VENDOR_CISCO \
-	WLAN_VENDOR_INTEL \
-	WLAN_VENDOR_INTERSIL \
-	WLAN_VENDOR_MARVELL \
-	WLAN_VENDOR_MEDIATEK \
-	WLAN_VENDOR_RALINK \
-	WLAN_VENDOR_REALTEK \
-	WLAN_VENDOR_RSI \
-	WLAN_VENDOR_ST \
-	WLAN_VENDOR_TI \
-	WLAN_VENDOR_ZYDAS \
-
-config-$(call config_package,cfg80211) += CFG80211
-
-config-$(call config_package,mac80211) += MAC80211
-config-$(CONFIG_PACKAGE_MAC80211_MESH) += MAC80211_MESH
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
 	CFG80211_DEBUGFS \
-	MAC80211_DEBUGFS \
-	ATH9K_DEBUGFS \
-	ATH9K_HTC_DEBUGFS \
-	ATH10K_DEBUGFS \
-	CARL9170_DEBUGFS \
-	ATH5K_DEBUG \
-	ATH6KL_DEBUG
+	MAC80211_DEBUGFS
 endif
 
 ifdef CONFIG_PACKAGE_MAC80211_TRACING
   config-y += \
-	ATH10K_TRACING \
-	ATH6KL_TRACING \
-	ATH_TRACEPOINTS \
-	WIL6210_TRACING \
-	ATH5K_TRACER \
 	IWLWIFI_DEVICE_TRACING
 endif
 
@@ -1622,96 +401,10 @@ config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_C
 
 config-$(call config_package,airo) += AIRO
 
-config-$(call config_package,ath) += ATH_CARDS ATH_COMMON ATH_REG_DYNAMIC_USER_REG_HINTS
-config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
-config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
-config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
-config-$(CONFIG_PACKAGE_ATH_DYNACK) += ATH9K_DYNACK
-config-$(call config_package,ath9k) += ATH9K
-config-$(call config_package,ath9k-common) += ATH9K_COMMON
-config-$(CONFIG_TARGET_ar71xx) += ATH9K_AHB
-config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
-config-$(CONFIG_PCI) += ATH9K_PCI
-config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
-config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
-config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
-config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
-
-config-$(call config_package,ath9k-htc) += ATH9K_HTC
-config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
-
-config-$(call config_package,ath5k) += ATH5K
-ifdef CONFIG_TARGET_ath25
-  config-y += ATH5K_AHB
-else
-  config-y += ATH5K_PCI
-endif
-
-config-$(call config_package,ath6kl) += ATH6KL
-config-$(call config_package,ath6kl-sdio) += ATH6KL_SDIO
-config-$(call config_package,ath6kl-usb) += ATH6KL_USB
-
-config-$(call config_package,carl9170) += CARL9170
-
-config-$(call config_package,b43) += B43
-config-$(CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB) += B43_BUSES_BCMA_AND_SSB
-config-$(CONFIG_PACKAGE_B43_BUSES_BCMA) += B43_BUSES_BCMA
-config-$(CONFIG_PACKAGE_B43_BUSES_SSB) += B43_BUSES_SSB
-config-$(CONFIG_PACKAGE_B43_PHY_G) += B43_PHY_G
-config-$(CONFIG_PACKAGE_B43_PHY_N) += B43_PHY_N
-config-$(CONFIG_PACKAGE_B43_PHY_LP) += B43_PHY_LP
-config-$(CONFIG_PACKAGE_B43_PHY_HT) += B43_PHY_HT
-config-$(CONFIG_PACKAGE_B43_PIO) += B43_PIO
-config-$(CONFIG_PACKAGE_B43_DEBUG) += B43_DEBUG
-
-config-$(call config_package,b43legacy) += B43LEGACY
-config-y += B43LEGACY_DMA_MODE
-
-config-$(call config_package,brcmutil) += BRCMUTIL
-config-$(call config_package,brcmsmac) += BRCMSMAC
-config-$(call config_package,brcmfmac) += BRCMFMAC
-config-$(CONFIG_BRCMFMAC_SDIO) += BRCMFMAC_SDIO
-config-$(CONFIG_BRCMFMAC_USB) += BRCMFMAC_USB
-config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
-config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
-
 config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
 config-$(call config_package,mt7601u) += MT7601U
 config-y += WL_MEDIATEK
 
-config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
-config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
-config-$(call config_package,rt2x00-mmio) += RT2X00_LIB_MMIO
-config-$(call config_package,rt2x00-usb) += RT2X00_LIB_USB
-config-$(CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS) += RT2X00_LIB_DEBUGFS
-config-$(CONFIG_PACKAGE_RT2X00_DEBUG) += RT2X00_DEBUG
-
-config-$(call config_package,rt2400-pci) += RT2400PCI
-config-$(call config_package,rt2500-pci) += RT2500PCI
-config-$(call config_package,rt2500-usb) += RT2500USB
-config-$(call config_package,rt61-pci) += RT61PCI
-config-$(call config_package,rt73-usb) += RT73USB
-
-config-$(call config_package,rt2800-lib) += RT2800_LIB
-
-config-$(call config_package,rt2800-soc) += RT2800SOC
-config-$(call config_package,rt2800-pci) += RT2800PCI
-config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
-
-config-$(call config_package,rt2800-usb) += RT2800USB
-config-y += RT2800USB_RT33XX RT2800USB_RT35XX RT2800USB_RT3573 RT2800USB_RT53XX RT2800USB_RT55XX RT2800USB_UNKNOWN
-
-config-$(call config_package,iwl-legacy) += IWLEGACY
-config-$(call config_package,iwl3945) += IWL3945
-config-$(call config_package,iwl4965) += IWL4965
-config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
-config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
-config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
-
-config-$(call config_package,libipw) += LIBIPW
-config-$(call config_package,ipw2100) += IPW2100
-config-$(call config_package,ipw2200) += IPW2200
-
 config-$(call config_package,p54-common) += P54_COMMON
 config-$(call config_package,p54-pci) += P54_PCI
 config-$(call config_package,p54-usb) += P54_USB
@@ -1724,14 +417,6 @@ config-$(call config_package,hermes-pcmcia) += PCMCIA_HERMES
 config-y += HERMES_PRISM
 
 config-$(call config_package,adm8211) += ADM8211
-config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
-config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
-config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
-config-$(call config_package,mwl8k) += MWL8K
-config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
-config-$(call config_package,mwifiex-sdio) += MWIFIEX MWIFIEX_SDIO
-config-$(call config_package,rtl8180) += RTL8180
-config-$(call config_package,rtl8187) += RTL8187
 config-$(call config_package,wlcore) += WLCORE WLCORE_SDIO
 config-$(call config_package,wl12xx) += WL12XX
 config-$(call config_package,wl18xx) += WL18XX
@@ -1741,22 +426,7 @@ config-$(call config_package,rsi91x) += RSI_91X
 config-$(call config_package,rsi91x-usb) += RSI_USB
 config-$(call config_package,rsi91x-sdio) += RSI_SDIO
 
-config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
-config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
-config-$(call config_package,rtlwifi-btcoexist) += RTLBTCOEXIST
-config-$(call config_package,rtlwifi-usb) += RTLWIFI_USB
-config-$(call config_package,rtl8192c-common) += RTL8192C_COMMON
-config-$(call config_package,rtl8192ce) += RTL8192CE
-config-$(call config_package,rtl8192se) += RTL8192SE
-config-$(call config_package,rtl8192de) += RTL8192DE
-config-$(call config_package,rtl8192cu) += RTL8192CU
-config-$(call config_package,rtl8821ae) += RTL8821AE
-config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
-
-config-$(call config_package,rtl8xxxu) += RTL8XXXU
-config-y += RTL8XXXU_UNTESTED
-
-config-$(CONFIG_LEDS_TRIGGERS) += MAC80211_LEDS B43_LEDS B43LEGACY_LEDS
+config-$(CONFIG_LEDS_TRIGGERS) += MAC80211_LEDS
 
 MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
 	$(KERNEL_MAKE_FLAGS) \
@@ -1820,6 +490,26 @@ ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
   endif
 endif
 
+define Build/Patch
+	$(if $(QUILT),rm -rf $(PKG_BUILD_DIR)/patches; mkdir -p $(PKG_BUILD_DIR)/patches)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
+endef
+
+define Quilt/Refresh/Package
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+endef
+
 define Build/Compile
 	$(SH_FUNC) var2file "$(call shvar,mac80211_config)" $(PKG_BUILD_DIR)/.config
 	$(MAKE) $(MAKE_OPTS) allnoconfig
@@ -1862,14 +552,6 @@ ifneq ($(CONFIG_B43_FW_SQUASH),)
 endif
 endef
 
-define KernelPackage/brcmsmac/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-ifeq ($(CONFIG_BRCMSMAC_USE_FW_FROM_WL),y)
-	tar xjf "$(DL_DIR)/$(PKG_BRCMSMAC_FW_SOURCE)" -C "$(PKG_BUILD_DIR)"
-	b43-fwcutter --brcmsmac -w $(1)/lib/firmware/ $(PKG_BUILD_DIR)/$(PKG_BRCMSMAC_FW_OBJECT)
-endif
-endef
-
 define KernelPackage/cfg80211/install
 	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
 	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
@@ -1878,96 +560,11 @@ define KernelPackage/cfg80211/install
 	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/10-wifi-detect
 endef
 
-define KernelPackage/ipw2100/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
-endef
-
-define KernelPackage/ipw2200/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
-endef
-
 define KernelPackage/zd1211rw/install
 	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
 endef
 
-
-$(eval $(call KernelPackage,adm8211))
-$(eval $(call KernelPackage,airo))
-$(eval $(call KernelPackage,ath))
-$(eval $(call KernelPackage,ath10k))
-$(eval $(call KernelPackage,ath5k))
-$(eval $(call KernelPackage,ath6kl))
-$(eval $(call KernelPackage,ath6kl-sdio))
-$(eval $(call KernelPackage,ath6kl-usb))
-$(eval $(call KernelPackage,ath9k))
-$(eval $(call KernelPackage,ath9k-common))
-$(eval $(call KernelPackage,ath9k-htc))
-$(eval $(call KernelPackage,b43))
-$(eval $(call KernelPackage,b43legacy))
-$(eval $(call KernelPackage,brcmsmac))
-$(eval $(call KernelPackage,brcmfmac))
-$(eval $(call KernelPackage,brcmutil))
-$(eval $(call KernelPackage,carl9170))
+$(eval $(foreach drv,$(PKG_DRIVERS),$(call KernelPackage,$(drv))))
 $(eval $(call KernelPackage,cfg80211))
-$(eval $(call KernelPackage,hermes))
-$(eval $(call KernelPackage,hermes-pci))
-$(eval $(call KernelPackage,hermes-plx))
-$(eval $(call KernelPackage,hermes-pcmcia))
-$(eval $(call KernelPackage,iwlwifi))
-$(eval $(call KernelPackage,iwl-legacy))
-$(eval $(call KernelPackage,iwl4965))
-$(eval $(call KernelPackage,iwl3945))
-$(eval $(call KernelPackage,lib80211))
-$(eval $(call KernelPackage,libertas-usb))
-$(eval $(call KernelPackage,libertas-sdio))
-$(eval $(call KernelPackage,libertas-spi))
-$(eval $(call KernelPackage,libipw))
-$(eval $(call KernelPackage,ipw2100))
-$(eval $(call KernelPackage,ipw2200))
 $(eval $(call KernelPackage,mac80211))
-$(eval $(call KernelPackage,mac80211-hwsim))
-$(eval $(call KernelPackage,mt7601u))
-$(eval $(call KernelPackage,mwl8k))
-$(eval $(call KernelPackage,mwifiex-pcie))
-$(eval $(call KernelPackage,mwifiex-sdio))
-$(eval $(call KernelPackage,p54-common))
-$(eval $(call KernelPackage,p54-pci))
-$(eval $(call KernelPackage,p54-usb))
-$(eval $(call KernelPackage,p54-spi))
-$(eval $(call KernelPackage,rsi91x))
-$(eval $(call KernelPackage,rsi91x-usb))
-$(eval $(call KernelPackage,rsi91x-sdio))
-$(eval $(call KernelPackage,rt2x00-lib))
-$(eval $(call KernelPackage,rt2x00-mmio))
-$(eval $(call KernelPackage,rt2x00-pci))
-$(eval $(call KernelPackage,rt2x00-usb))
-$(eval $(call KernelPackage,rt2800-lib))
-$(eval $(call KernelPackage,rt2400-pci))
-$(eval $(call KernelPackage,rt2500-pci))
-$(eval $(call KernelPackage,rt2500-usb))
-$(eval $(call KernelPackage,rt2800-mmio))
-$(eval $(call KernelPackage,rt2800-soc))
-$(eval $(call KernelPackage,rt2800-pci))
-$(eval $(call KernelPackage,rt2800-usb))
-$(eval $(call KernelPackage,rt61-pci))
-$(eval $(call KernelPackage,rt73-usb))
-$(eval $(call KernelPackage,rtl8180))
-$(eval $(call KernelPackage,rtl8187))
-$(eval $(call KernelPackage,rtlwifi))
-$(eval $(call KernelPackage,rtlwifi-pci))
-$(eval $(call KernelPackage,rtlwifi-btcoexist))
-$(eval $(call KernelPackage,rtlwifi-usb))
-$(eval $(call KernelPackage,rtl8192c-common))
-$(eval $(call KernelPackage,rtl8192ce))
-$(eval $(call KernelPackage,rtl8192se))
-$(eval $(call KernelPackage,rtl8192de))
-$(eval $(call KernelPackage,rtl8192cu))
-$(eval $(call KernelPackage,rtl8821ae))
-$(eval $(call KernelPackage,rtl8xxxu))
-$(eval $(call KernelPackage,wlcore))
-$(eval $(call KernelPackage,wl12xx))
-$(eval $(call KernelPackage,wl18xx))
-$(eval $(call KernelPackage,zd1211rw))
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
new file mode 100644
index 0000000000..e4540422a4
--- /dev/null
+++ b/package/kernel/mac80211/ath.mk
@@ -0,0 +1,276 @@
+PKG_DRIVERS += \
+	ath ath5k ath6kl ath6kl-sdio ath6kl-usb ath9k ath9k-common ath9k-htc ath10k \
+	carl9170
+
+PKG_CONFIG_DEPENDS += \
+	CONFIG_PACKAGE_ATH_DEBUG \
+	CONFIG_PACKAGE_ATH_DFS \
+	CONFIG_PACKAGE_ATH_SPECTRAL \
+	CONFIG_PACKAGE_ATH_DYNACK \
+	CONFIG_ATH9K_SUPPORT_PCOEM \
+	CONFIG_ATH9K_TX99 \
+	CONFIG_ATH10K_LEDS \
+	CONFIG_ATH10K_THERMAL \
+	CONFIG_ATH_USER_REGD
+
+ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
+  config-y += \
+	ATH9K_DEBUGFS \
+	ATH9K_HTC_DEBUGFS \
+	ATH10K_DEBUGFS \
+	CARL9170_DEBUGFS \
+	ATH5K_DEBUG \
+	ATH6KL_DEBUG
+endif
+
+ifdef CONFIG_PACKAGE_MAC80211_TRACING
+  config-y += \
+	ATH10K_TRACING \
+	ATH6KL_TRACING \
+	ATH_TRACEPOINTS \
+	ATH5K_TRACER
+endif
+
+config-$(call config_package,ath) += ATH_CARDS ATH_COMMON ATH_REG_DYNAMIC_USER_REG_HINTS
+config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
+config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
+config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
+config-$(CONFIG_PACKAGE_ATH_DYNACK) += ATH9K_DYNACK
+config-$(call config_package,ath9k) += ATH9K
+config-$(call config_package,ath9k-common) += ATH9K_COMMON
+config-$(CONFIG_TARGET_ar71xx) += ATH9K_AHB
+config-$(CONFIG_TARGET_ath79) += ATH9K_AHB
+config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
+config-$(CONFIG_PCI) += ATH9K_PCI
+config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
+config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
+config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
+config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
+config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
+config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
+
+config-$(call config_package,ath9k-htc) += ATH9K_HTC
+config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
+
+config-$(call config_package,ath5k) += ATH5K
+ifdef CONFIG_TARGET_ath25
+  config-y += ATH5K_AHB
+else
+  config-y += ATH5K_PCI
+endif
+
+config-$(call config_package,ath6kl) += ATH6KL
+config-$(call config_package,ath6kl-sdio) += ATH6KL_SDIO
+config-$(call config_package,ath6kl-usb) += ATH6KL_USB
+
+config-$(call config_package,carl9170) += CARL9170
+
+define KernelPackage/ath/config
+  if PACKAGE_kmod-ath
+	config ATH_USER_REGD
+		bool "Force Atheros drivers to respect the user's regdomain settings"
+		default y
+		help
+		  Atheros' idea of regulatory handling is that the EEPROM of the card defines
+		  the regulatory limits and the user is only allowed to restrict the settings
+		  even further, even if the country allows frequencies or power levels that
+		  are forbidden by the EEPROM settings.
+
+		  Select this option if you want the driver to respect the user's decision about
+		  regulatory settings.
+
+	config PACKAGE_ATH_DEBUG
+		bool "Atheros wireless debugging"
+		help
+		  Say Y, if you want to debug atheros wireless drivers.
+		  Only ath9k & ath10k make use of this.
+
+	config PACKAGE_ATH_DFS
+		bool "Enable DFS support"
+		default y
+		help
+		  Dynamic frequency selection (DFS) is required for most of the 5 GHz band
+		  channels in Europe, US, and Japan.
+
+		  Select this option if you want to use such channels.
+
+	config PACKAGE_ATH_SPECTRAL
+		bool "Atheros spectral scan support"
+		depends on PACKAGE_ATH_DEBUG
+		select KERNEL_RELAY
+		help
+		  Say Y to enable access to the FFT/spectral data via debugfs.
+
+	config PACKAGE_ATH_DYNACK
+		bool "Enable Dynack support"
+		depends on PACKAGE_kmod-ath9k-common
+		help
+		  Enables support for Dynamic ACK estimation, which allows the fastest possible speed
+		  at any distance automatically by increasing/decreasing the max frame ACK time for
+		  the most remote station detected.  It can be enabled by using iw (iw phy0 set distance auto),
+		  or by sending the NL80211_ATTR_WIPHY_DYN_ACK flag to mac80211 driver using netlink.
+
+		  Select this option if you want to enable this feature
+
+  endif
+endef
+
+define KernelPackage/ath
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros common driver part
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath79||TARGET_ath25 +kmod-mac80211
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
+  MENU:=1
+endef
+
+define KernelPackage/ath/description
+ This module contains some common parts needed by Atheros Wireless drivers.
+endef
+
+define KernelPackage/ath5k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 5xxx wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath5k
+  DEPENDS+= @PCI_SUPPORT||@TARGET_ath25 +kmod-ath +@DRIVER_11W_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
+  AUTOLOAD:=$(call AutoProbe,ath5k)
+endef
+
+define KernelPackage/ath5k/description
+ This module adds support for wireless adapters based on
+ Atheros 5xxx chipset.
+endef
+
+define KernelPackage/ath6kl
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros FullMAC wireless devices (common code for ath6kl_sdio and ath6kl_usb)
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
+  HIDDEN:=1
+  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_core.ko
+endef
+
+define KernelPackage/ath6kl-sdio
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n SDIO wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
+  DEPENDS+= +kmod-mmc +kmod-ath6kl
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,ath6kl_sdio)
+endef
+
+define KernelPackage/ath6kl-sdio/description
+This module adds support for wireless adapters based on
+Atheros IEEE 802.11n AR6003 and AR6004 family of chipsets.
+endef
+
+define KernelPackage/ath6kl-usb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n USB wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-ath6kl
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_usb.ko
+  AUTOLOAD:=$(call AutoProbe,ath6kl_usb)
+endef
+
+define KernelPackage/ath6kl-usb/description
+This module adds support for wireless adapters based on the
+Atheros IEEE 802.11n AR6004 chipset.
+endef
+
+define KernelPackage/ath9k-common
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
+  HIDDEN:=1
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ar71xx||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
+endef
+
+define KernelPackage/ath9k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n PCI wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
+  DEPENDS+= @PCI_SUPPORT||TARGET_ar71xx||TARGET_ath79 +kmod-ath9k-common
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
+  AUTOLOAD:=$(call AutoProbe,ath9k)
+endef
+
+define KernelPackage/ath9k/description
+This module adds support for wireless adapters based on
+Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
+endef
+
+define KernelPackage/ath9k/config
+
+	config ATH9K_SUPPORT_PCOEM
+		bool "Support chips used in PC OEM cards"
+		depends on PACKAGE_kmod-ath9k
+
+       config ATH9K_TX99
+               bool "Enable TX99 support (WARNING: testing only, breaks normal operation!)"
+               depends on PACKAGE_kmod-ath9k
+
+	config ATH9K_UBNTHSR
+		bool "Support for Ubiquiti UniFi Outdoor+ access point"
+		depends on PACKAGE_kmod-ath9k && (TARGET_ar71xx_generic||TARGET_ath79)
+		default y
+
+endef
+
+define KernelPackage/ath9k-htc
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11n USB device support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
+  DEPENDS+= @USB_SUPPORT +kmod-ath9k-common +kmod-usb-core +ath9k-htc-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_htc.ko
+  AUTOLOAD:=$(call AutoProbe,ath9k_htc)
+endef
+
+define KernelPackage/ath9k-htc/description
+This module adds support for wireless adapters based on
+Atheros USB AR9271 and AR7010 family of chipsets.
+endef
+
+define KernelPackage/ath10k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Atheros 802.11ac wireless cards support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
+  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT \
+	+ATH10K_THERMAL:kmod-hwmon-core +ATH10K_THERMAL:kmod-thermal
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
+  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
+endef
+
+define KernelPackage/ath10k/description
+This module adds support for wireless adapters based on
+Atheros IEEE 802.11ac family of chipsets. For now only
+PCI is supported.
+endef
+
+define KernelPackage/ath10k/config
+
+       config ATH10K_LEDS
+               bool "Enable LED support"
+               default y
+               depends on PACKAGE_kmod-ath10k
+
+       config ATH10K_THERMAL
+               bool "Enable thermal sensors and throttling support"
+               depends on PACKAGE_kmod-ath10k
+
+endef
+
+define KernelPackage/carl9170
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Atheros AR9170 USB sticks
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT +carl9170-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
+  AUTOLOAD:=$(call AutoProbe,carl9170)
+endef
diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
new file mode 100644
index 0000000000..4b05c13dba
--- /dev/null
+++ b/package/kernel/mac80211/broadcom.mk
@@ -0,0 +1,487 @@
+PKG_DRIVERS += \
+	b43 b43legacy brcmsmac brcmfmac brcmutil
+
+PKG_CONFIG_DEPENDS += \
+	CONFIG_PACKAGE_B43_DEBUG \
+	CONFIG_PACKAGE_B43_PIO \
+	CONFIG_PACKAGE_B43_PHY_G \
+	CONFIG_PACKAGE_B43_PHY_N \
+	CONFIG_PACKAGE_B43_PHY_LP \
+	CONFIG_PACKAGE_B43_PHY_HT \
+	CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB \
+	CONFIG_PACKAGE_B43_BUSES_BCMA \
+	CONFIG_PACKAGE_B43_BUSES_SSB \
+	CONFIG_PACKAGE_BRCM80211_DEBUG
+
+config-$(call config_package,b43) += B43
+config-$(CONFIG_PACKAGE_B43_BUSES_BCMA_AND_SSB) += B43_BUSES_BCMA_AND_SSB
+config-$(CONFIG_PACKAGE_B43_BUSES_BCMA) += B43_BUSES_BCMA
+config-$(CONFIG_PACKAGE_B43_BUSES_SSB) += B43_BUSES_SSB
+config-$(CONFIG_PACKAGE_B43_PHY_G) += B43_PHY_G
+config-$(CONFIG_PACKAGE_B43_PHY_N) += B43_PHY_N
+config-$(CONFIG_PACKAGE_B43_PHY_LP) += B43_PHY_LP
+config-$(CONFIG_PACKAGE_B43_PHY_HT) += B43_PHY_HT
+config-$(CONFIG_PACKAGE_B43_PIO) += B43_PIO
+config-$(CONFIG_PACKAGE_B43_DEBUG) += B43_DEBUG
+
+config-$(call config_package,b43legacy) += B43LEGACY
+config-y += B43LEGACY_DMA_MODE
+
+config-$(call config_package,brcmutil) += BRCMUTIL
+config-$(call config_package,brcmsmac) += BRCMSMAC
+config-$(call config_package,brcmfmac) += BRCMFMAC
+config-$(CONFIG_BRCMFMAC_SDIO) += BRCMFMAC_SDIO
+config-$(CONFIG_BRCMFMAC_USB) += BRCMFMAC_USB
+config-$(CONFIG_BRCMFMAC_PCIE) += BRCMFMAC_PCIE
+config-$(CONFIG_PACKAGE_BRCM80211_DEBUG) += BRCMDBG
+
+config-$(CONFIG_LEDS_TRIGGERS) += B43_LEDS B43LEGACY_LEDS
+
+#Broadcom firmware
+ifneq ($(CONFIG_B43_FW_6_30),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=6.30.163.46
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).wl_apsta.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
+  PKG_B43_FWV4_HASH:=a07c3b6b277833c7dbe61daa511f908cd66c5e2763eb7a0859abc36cd9335c2d
+else
+ifneq ($(CONFIG_B43_FW_5_10),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=5.10.56.27.3
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta/wl_prebuilt.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)_mipsel.tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+  PKG_B43_FWV4_HASH:=26a8c370f48fc129d0731cfd751c36cae1419b0bc8ca35781126744e60eae009
+else
+ifneq ($(CONFIG_B43_FW_4_178),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=4.178.10.4
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+  PKG_B43_FWV4_HASH:=32f6ad98facbb9045646fdc8b54bb03086d204153253f9c65d0234a5d90ae53f
+else
+ifneq ($(CONFIG_B43_FW_5_100_138),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=5.100.138
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/linux/wl_apsta.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
+  PKG_B43_FWV4_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
+else
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=4.150.10.5
+  PKG_B43_FWV4_OBJECT:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION)/driver/wl_apsta_mimo.o
+  PKG_B43_FWV4_SOURCE:=$(PKG_B43_FWV4_NAME)-$(PKG_B43_FWV4_VERSION).tar.bz2
+  PKG_B43_FWV4_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+  PKG_B43_FWV4_HASH:=a9f4e276a4d8d3a1cd0f2eb87080ae89b77f0a7140f06d4e9e2135fc44fdd533
+endif
+endif
+endif
+endif
+ifneq ($(CONFIG_B43_OPENFIRMWARE),)
+  PKG_B43_FWV4_NAME:=broadcom-wl
+  PKG_B43_FWV4_VERSION:=5.2
+  PKG_B43_FWV4_OBJECT:=openfwwf-$(PKG_B43_FWV4_VERSION)
+  PKG_B43_FWV4_SOURCE:=openfwwf-$(PKG_B43_FWV4_VERSION).tar.gz
+  PKG_B43_FWV4_SOURCE_URL:=http://netweb.ing.unibs.it/~openfwwf/firmware
+  PKG_B43_FWV4_HASH:=9de03320083201080b2e94b81637ac07a159cf4e6f3481383e1a217e627bc0dc
+endif
+
+
+define Download/b43
+  FILE:=$(PKG_B43_FWV4_SOURCE)
+  URL:=$(PKG_B43_FWV4_SOURCE_URL)
+  HASH:=$(PKG_B43_FWV4_HASH)
+endef
+$(eval $(call Download,b43))
+
+define KernelPackage/b43
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom 43xx wireless support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
+  KCONFIG:= \
+  	CONFIG_HW_RANDOM=y
+  # Depend on PCI_SUPPORT to make sure we can select kmod-bcma or kmod-ssb
+  DEPENDS += \
+	@PCI_SUPPORT +kmod-mac80211 \
+	$(if $(CONFIG_PACKAGE_B43_USE_SSB),+kmod-ssb) \
+	$(if $(CONFIG_PACKAGE_B43_USE_BCMA),+kmod-bcma)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43/b43.ko
+  AUTOLOAD:=$(call AutoProbe,b43)
+  MENU:=1
+endef
+
+define KernelPackage/b43/config
+
+config PACKAGE_B43_USE_SSB
+	select PACKAGE_kmod-ssb
+	tristate
+	depends on !TARGET_brcm47xx && !TARGET_brcm63xx
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_SSB
+
+config PACKAGE_B43_USE_BCMA
+	select PACKAGE_kmod-bcma
+	tristate
+	depends on !TARGET_brcm47xx && !TARGET_bcm53xx
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA_AND_SSB
+	default PACKAGE_kmod-b43 if PACKAGE_B43_BUSES_BCMA
+
+  if PACKAGE_kmod-b43
+
+	choice
+		prompt "b43 firmware version"
+		default B43_FW_5_100_138
+		help
+		  This option allows you to select the version of the b43 firmware.
+
+	config B43_FW_4_150
+		bool "Firmware 410.2160 from driver 4.150.10.5 (old stable)"
+		help
+		  Old stable firmware for BCM43xx devices.
+
+		  If unsure, select this.
+
+	config B43_FW_4_178
+		bool "Firmware 478.104 from driver 4.178.10.4"
+		help
+		  Older firmware for BCM43xx devices.
+
+		  If unsure, select the "stable" firmware.
+
+	config B43_FW_5_10
+		bool "Firmware 508.1084 from driver 5.10.56.27"
+		help
+		  Older firmware for BCM43xx devices.
+
+		  If unsure, select the "stable" firmware.
+
+	config B43_FW_5_100_138
+		bool "Firmware 666.2 from driver 5.100.138 (stable)"
+		help
+		  The currently default firmware for BCM43xx devices.
+
+		  This firmware currently gets most of the testing and is needed for some N-PHY devices.
+
+		  If unsure, select the this firmware.
+
+	config B43_FW_6_30
+		bool "Firmware 784.2 from driver 6.30.163.46 (experimental)"
+		help
+		  Newer experimental firmware for BCM43xx devices.
+
+		  This firmware is mostly untested.
+
+		  If unsure, select the "stable" firmware.
+
+	config B43_OPENFIRMWARE
+		bool "Open FirmWare for WiFi networks"
+		help
+		  Opensource firmware for BCM43xx devices.
+
+		  Do _not_ select this, unless you know what you are doing.
+		  The Opensource firmware is not suitable for embedded devices, yet.
+		  It does not support QoS, which is bad for AccessPoints.
+		  It does not support hardware crypto acceleration, which is a showstopper
+		  for embedded devices with low CPU resources.
+
+		  If unsure, select the "stable" firmware.
+
+	endchoice
+
+	config B43_FW_SQUASH
+		bool "Remove unnecessary firmware files"
+		depends on !B43_OPENFIRMWARE
+		default y
+		help
+		  This options allows you to remove unnecessary b43 firmware files
+		  from the final rootfs image. This can reduce the rootfs size by
+		  up to 200k.
+
+		  If unsure, say Y.
+
+	config B43_FW_SQUASH_COREREVS
+		string "Core revisions to include"
+		depends on B43_FW_SQUASH
+		default "5,6,7,8,9,10,11,13,15" if TARGET_brcm47xx_legacy
+		default "16,28,29,30" if TARGET_brcm47xx_mips74k
+		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
+		help
+		  This is a comma seperated list of core revision numbers.
+
+		  Example (keep files for rev5 only):
+		    5
+
+		  Example (keep files for rev5 and rev11):
+		    5,11
+
+	config B43_FW_SQUASH_PHYTYPES
+		string "PHY types to include"
+		depends on B43_FW_SQUASH
+		default "G,N,LP" if TARGET_brcm47xx_legacy
+		default "N,HT" if TARGET_brcm47xx_mips74k
+		default "G,N,LP,HT"
+		help
+		  This is a comma seperated list of PHY types:
+		    A  => A-PHY
+		    AG => Dual A-PHY G-PHY
+		    G  => G-PHY
+		    LP => LP-PHY
+		    N  => N-PHY
+		    HT  => HT-PHY
+		    LCN  => LCN-PHY
+		    LCN40  => LCN40-PHY
+		    AC  => AC-PHY
+
+		  Example (keep files for G-PHY only):
+		    G
+
+		  Example (keep files for G-PHY and N-PHY):
+		    G,N
+
+	choice
+		prompt "Supported buses"
+		default PACKAGE_B43_BUSES_BCMA_AND_SSB
+		help
+		  This allows choosing buses that b43 should support.
+
+	config PACKAGE_B43_BUSES_BCMA_AND_SSB
+		depends on !TARGET_brcm47xx_legacy && !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
+		bool "BCMA and SSB"
+
+	config PACKAGE_B43_BUSES_BCMA
+		depends on !TARGET_brcm47xx_legacy
+		bool "BCMA only"
+
+	config PACKAGE_B43_BUSES_SSB
+		depends on !TARGET_brcm47xx_mips74k && !TARGET_bcm53xx
+		bool "SSB only"
+
+	endchoice
+
+	config PACKAGE_B43_DEBUG
+		bool "Enable debug output and debugfs for b43"
+		default n
+		help
+		  Enable additional debug output and runtime sanity checks for b43
+		  and enables the debugfs interface.
+
+		  If unsure, say N.
+
+	config PACKAGE_B43_PIO
+		bool "Enable support for PIO transfer mode"
+		default n
+		help
+		  Enable support for using PIO instead of DMA. Unless you have DMA
+		  transfer problems you don't need this.
+
+		  If unsure, say N.
+
+	config PACKAGE_B43_PHY_G
+		bool "Enable support for G-PHYs"
+		default n if TARGET_brcm47xx_mips74k
+		default y
+		help
+		  Enable support for G-PHY. This includes support for the following devices:
+		  PCI: BCM4306, BCM4311, BCM4318
+		  SoC: BCM5352E, BCM4712
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_N
+		bool "Enable support for N-PHYs"
+		default y
+		help
+		  Enable support for N-PHY. This includes support for the following devices:
+		  PCI: BCM4321, BCM4322, BCM43222, BCM43224, BCM43225
+		  SoC: BCM4716, BCM4717, BCM4718
+
+		  Currently only 11g speed is available.
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_LP
+		bool "Enable support for LP-PHYs"
+		default n if TARGET_brcm47xx_mips74k
+		default y
+		help
+		  Enable support for LP-PHY. This includes support for the following devices:
+		  PCI: BCM4312
+		  SoC: BCM5354
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_HT
+		bool "Enable support for HT-PHYs"
+		default n if TARGET_brcm47xx_legacy
+		default y
+		help
+		  Enable support for HT-PHY. This includes support for the following devices:
+		  PCI: BCM4331
+
+		  Currently only 11g speed is available.
+
+		  If unsure, say Y.
+
+	config PACKAGE_B43_PHY_LCN
+		bool "Enable support for LCN-PHYs"
+		depends on BROKEN
+		default n
+		help
+		  Currently broken.
+
+		  If unsure, say N.
+
+  endif
+endef
+
+define KernelPackage/b43/description
+Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
+endef
+
+define KernelPackage/b43legacy
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom 43xx-legacy wireless support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
+  KCONFIG:= \
+  	CONFIG_HW_RANDOM=y
+  DEPENDS+= +kmod-mac80211 +!(TARGET_brcm47xx||TARGET_brcm63xx):kmod-ssb +b43legacy-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
+  AUTOLOAD:=$(call AutoProbe,b43legacy)
+  MENU:=1
+endef
+
+define KernelPackage/b43legacy/description
+Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
+endef
+
+
+define KernelPackage/brcmutil
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom IEEE802.11n common driver parts
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+  DEPENDS+=@PCI_SUPPORT||USB_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmutil/brcmutil.ko
+  AUTOLOAD:=$(call AutoProbe,brcmutil)
+  MENU:=1
+endef
+
+define KernelPackage/brcmutil/description
+ This module contains some common parts needed by Broadcom Wireless drivers brcmsmac and brcmfmac.
+endef
+
+define KernelPackage/brcmutil/config
+  if PACKAGE_kmod-brcmutil
+
+	config PACKAGE_BRCM80211_DEBUG
+		bool "Broadcom wireless driver debugging"
+		help
+		  Say Y, if you want to debug brcmsmac and brcmfmac wireless driver.
+
+  endif
+endef
+
+PKG_BRCMSMAC_FW_NAME:=broadcom-wl
+PKG_BRCMSMAC_FW_VERSION:=5.100.138
+PKG_BRCMSMAC_FW_OBJECT:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION)/linux/wl_apsta.o
+PKG_BRCMSMAC_FW_SOURCE:=$(PKG_BRCMSMAC_FW_NAME)-$(PKG_BRCMSMAC_FW_VERSION).tar.bz2
+PKG_BRCMSMAC_FW_SOURCE_URL:=http://www.lwfinger.com/b43-firmware/
+PKG_BRCMSMAC_FW_HASH:=f1e7067aac5b62b67b8b6e4c517990277804339ac16065eb13c731ff909ae46f
+
+define Download/brcmsmac
+  FILE:=$(PKG_BRCMSMAC_FW_SOURCE)
+  URL:=$(PKG_BRCMSMAC_FW_SOURCE_URL)
+  HASH:=$(PKG_BRCMSMAC_FW_HASH)
+endef
+$(eval $(call Download,brcmsmac))
+
+define KernelPackage/brcmsmac
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_brcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
+  AUTOLOAD:=$(call AutoProbe,brcmsmac)
+  MENU:=1
+endef
+
+define KernelPackage/brcmsmac/description
+ Kernel module for Broadcom IEEE802.11n PCIe Wireless cards
+endef
+
+define KernelPackage/brcmsmac/config
+  if PACKAGE_kmod-brcmsmac
+
+	config BRCMSMAC_USE_FW_FROM_WL
+		bool "Use firmware extracted from broadcom proprietary driver"
+		default y
+		help
+		  Instead of using the official brcmsmac firmware a firmware
+		  version 666.2 extracted from the proprietary Broadcom driver
+		  is used. This is needed to get core rev 17 used in bcm4716
+		  to work.
+
+		  If unsure, say Y.
+
+  endif
+endef
+
+
+define KernelPackage/brcmfmac
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT \
+  	+kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
+	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
+  AUTOLOAD:=$(call AutoProbe,brcmfmac)
+endef
+
+define KernelPackage/brcmfmac/description
+ Kernel module for Broadcom IEEE802.11n USB Wireless cards
+endef
+
+define KernelPackage/brcmfmac/config
+  if PACKAGE_kmod-brcmfmac
+
+	config BRCMFMAC_SDIO
+		bool "Enable SDIO bus interface support"
+		default y if TARGET_brcm2708
+		default y if TARGET_sunxi
+		default n
+		help
+		  Enable support for cards attached to an SDIO bus.
+		  Select this option only if you are sure that your
+		  board has a Broadcom wireless chip atacched to
+		  that bus.
+
+	config BRCMFMAC_USB
+		bool "Enable USB bus interface support"
+		depends on USB_SUPPORT
+		default y
+		help
+		  Supported USB connected chipsets:
+		  BCM43235, BCM43236, BCM43238 (all in revision 3 only)
+		  BCM43143, BCM43242, BCM43566, BCM43569
+
+	config BRCMFMAC_PCIE
+		bool "Enable PCIE bus interface support"
+		depends on PCI_SUPPORT
+		default y
+		help
+		  Supported PCIe connected chipsets:
+		  BCM4354, BCM4356, BCM43567, BCM43570, BCM43602
+
+  endif
+endef
+
+define KernelPackage/brcmsmac/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+ifeq ($(CONFIG_BRCMSMAC_USE_FW_FROM_WL),y)
+	tar xjf "$(DL_DIR)/$(PKG_BRCMSMAC_FW_SOURCE)" -C "$(PKG_BUILD_DIR)"
+	b43-fwcutter --brcmsmac -w $(1)/lib/firmware/ $(PKG_BUILD_DIR)/$(PKG_BRCMSMAC_FW_OBJECT)
+endif
+endef
diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
index e7d442f8ef..6dc4e5bf5f 100644
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -23,6 +23,7 @@ drv_mac80211_init_device_config() {
 
 	config_add_string path phy 'macaddr:macaddr'
 	config_add_string hwmode
+	config_add_string tx_burst
 	config_add_int beacon_int chanbw frag rts
 	config_add_int rxantenna txantenna antenna_gain txpower distance
 	config_add_boolean noscan ht_coex
@@ -97,7 +98,10 @@ mac80211_hostapd_setup_base() {
 	[ "$auto_channel" -gt 0 ] && json_get_values channel_list channels
 
 	json_get_vars noscan ht_coex
-	json_get_values ht_capab_list ht_capab
+	json_get_values ht_capab_list ht_capab tx_burst
+
+	[ -n "$noscan" -a "$noscan" -gt 0 ] && hostapd_noscan=1
+	[ "$tx_burst" = 0 ] && tx_burst=
 
 	ieee80211n=1
 	ht_capab=
@@ -227,6 +231,7 @@ mac80211_hostapd_setup_base() {
 			vht_link_adapt:3 \
 			vht160:2
 
+		set_default tx_burst 2.0
 		append base_cfg "ieee80211ac=1" "$N"
 		vht_cap=0
 		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
@@ -307,7 +312,8 @@ mac80211_hostapd_setup_base() {
 	cat >> "$hostapd_conf_file" <<EOF
 ${channel:+channel=$channel}
 ${channel_list:+chanlist=$channel_list}
-${noscan:+noscan=$noscan}
+${hostapd_noscan:+noscan=1}
+${tx_burst:+tx_queue_data2_burst=$tx_burst}
 $base_cfg
 
 EOF
@@ -735,6 +741,10 @@ mac80211_interface_cleanup() {
 	done
 }
 
+mac80211_set_noscan() {
+	hostapd_noscan=1
+}
+
 drv_mac80211_cleanup() {
 	hostapd_common_cleanup
 }
@@ -781,11 +791,14 @@ drv_mac80211_setup() {
 		done
 	}
 
-	set_default rxantenna all
-	set_default txantenna all
+	set_default rxantenna 0xffffffff
+	set_default txantenna 0xffffffff
 	set_default distance 0
 	set_default antenna_gain 0
 
+	[ "$txantenna" = "all" ] && txantenna=0xffffffff
+	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
+
 	iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
 	iw phy "$phy" set antenna_gain $antenna_gain
 	iw phy "$phy" set distance "$distance"
@@ -795,9 +808,12 @@ drv_mac80211_setup() {
 
 	has_ap=
 	hostapd_ctrl=
+	hostapd_noscan=
 	for_each_interface "ap" mac80211_check_ap
 
 	rm -f "$hostapd_conf_file"
+
+	for_each_interface "sta adhoc mesh" mac80211_set_noscan
 	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
 
 	for_each_interface "sta adhoc mesh monitor" mac80211_prepare_vif
diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
index 511a9188db..6103b5d04e 100644
--- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
@@ -113,7 +113,7 @@ detect_mac80211() {
 			set wireless.radio${devidx}.hwmode=11${mode_band}
 			${dev_id}
 			${ht_capab}
-			set wireless.radio${devidx}.disabled=1
+			set wireless.radio${devidx}.disabled=0
 
 			set wireless.default_radio${devidx}=wifi-iface
 			set wireless.default_radio${devidx}.device=radio${devidx}
diff --git a/package/kernel/mac80211/intel.mk b/package/kernel/mac80211/intel.mk
new file mode 100644
index 0000000000..71494fe0ce
--- /dev/null
+++ b/package/kernel/mac80211/intel.mk
@@ -0,0 +1,200 @@
+PKG_DRIVERS += \
+	iwl-legacy iwl3945 iwl4965 iwlwifi \
+	libipw ipw2100 ipw2200 \
+
+config-$(call config_package,iwl-legacy) += IWLEGACY
+config-$(call config_package,iwl3945) += IWL3945
+config-$(call config_package,iwl4965) += IWL4965
+config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
+config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
+config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
+
+config-$(call config_package,libipw) += LIBIPW
+config-$(call config_package,ipw2100) += IPW2100
+config-$(call config_package,ipw2200) += IPW2200
+
+define KernelPackage/iwlwifi
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11W_SUPPORT @!LINUX_3_18
+  TITLE:=Intel AGN Wireless support
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/dvm/iwldvm.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/mvm/iwlmvm.ko
+  AUTOLOAD:=$(call AutoProbe,iwlwifi iwldvm iwlmvm)
+  MENU:=1
+endef
+
+define KernelPackage/iwlwifi/description
+ iwlwifi kernel module for
+ Intel Wireless WiFi Link 6250AGN Adapter
+ Intel 6000 Series Wi-Fi Adapters (6200AGN and 6300AGN)
+ Intel WiFi Link 1000BGN
+ Intel Wireless WiFi 5150AGN
+ Intel Wireless WiFi 5100AGN, 5300AGN, and 5350AGN
+ Intel 6005 Series Wi-Fi Adapters
+ Intel 6030 Series Wi-Fi Adapters
+ Intel Wireless WiFi Link 6150BGN 2 Adapter
+ Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
+ Intel 2000 Series Wi-Fi Adapters
+ Intel 7260 Wi-Fi Adapter
+ Intel 3160 Wi-Fi Adapter
+ Intel 7265 Wi-Fi Adapter
+ Intel 8260 Wi-Fi Adapter
+ Intel 3165 Wi-Fi Adapter
+endef
+
+define KernelPackage/iwlwifi/config
+  if PACKAGE_kmod-iwlwifi
+
+	config PACKAGE_IWLWIFI_DEBUG
+		bool "Enable full debugging output in the iwlwifi driver"
+		default n
+		help
+		  This option will enable debug tracing output for the iwlwifi drivers
+
+		  This will result in the kernel module being ~100k larger.  You can
+		  control which debug output is sent to the kernel log by setting the
+		  value in
+
+			/sys/module/iwlwifi/parameters/debug
+
+		  This entry will only exist if this option is enabled.
+
+		  To set a value, simply echo an 8-byte hex value to the same file:
+
+			  % echo 0x43fff > /sys/module/iwlwifi/parameters/debug
+
+		  You can find the list of debug mask values in:
+			  drivers/net/wireless/intel/iwlwifi/iwl-debug.h
+
+		  If this is your first time using this driver, you should say Y here
+		  as the debug information can assist others in helping you resolve
+		  any problems you may encounter.
+
+	config PACKAGE_IWLWIFI_DEBUGFS
+	        bool "iwlwifi debugfs support"
+		depends on PACKAGE_MAC80211_DEBUGFS
+		default n
+		help
+		  Enable creation of debugfs files for the iwlwifi drivers. This
+		  is a low-impact option that allows getting insight into the
+		  driver's state at runtime.
+
+  endif
+endef
+
+define KernelPackage/iwl-legacy
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
+  TITLE:=Intel legacy Wireless support
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
+  AUTOLOAD:=$(call AutoProbe,iwlegacy)
+endef
+
+define KernelPackage/iwl-legacy/description
+ iwl-legacy kernel module for legacy Intel wireless support
+endef
+
+define KernelPackage/iwl3945
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
+  TITLE:=Intel iwl3945 Wireless support
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
+  AUTOLOAD:=$(call AutoProbe,iwl3945)
+endef
+
+define KernelPackage/iwl3945/description
+ iwl3945 kernel module for Intel 3945 support
+endef
+
+define KernelPackage/iwl4965
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
+  TITLE:=Intel iwl4965 Wireless support
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
+  AUTOLOAD:=$(call AutoProbe,iwl4965)
+endef
+
+define KernelPackage/iwl4965/description
+ iwl4965 kernel module for Intel 4965 support
+endef
+
+
+define KernelPackage/libipw
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=libipw for ipw2100 and ipw2200
+  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-crypto-ecb +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN @!LINUX_3_18
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
+  AUTOLOAD:=$(call AutoProbe,libipw)
+endef
+
+define KernelPackage/libipw/description
+ Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
+endef
+
+IPW2100_NAME:=ipw2100-fw
+IPW2100_VERSION:=1.3
+
+define Download/ipw2100
+  URL:= \
+	https://src.fedoraproject.org/repo/pkgs/ipw2100-firmware/ipw2100-fw-1.3.tgz/46aa75bcda1a00efa841f9707bbbd113/ \
+	https://archlinux.mirror.pkern.at/other/packages/ipw2100-fw/ \
+	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
+	http://firmware.openbsd.org/firmware-dist/
+  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
+  HASH:=e1107c455e48d324a616b47a622593bc8413dcce72026f72731c0b03dae3a7a2
+endef
+$(eval $(call Download,ipw2100))
+
+define KernelPackage/ipw2100
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Intel IPW2100 driver
+  DEPENDS:=@PCI_SUPPORT +kmod-libipw
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
+  AUTOLOAD:=$(call AutoProbe,ipw2100)
+endef
+
+define KernelPackage/ipw2100/description
+ Kernel support for Intel IPW2100
+ Includes:
+ - ipw2100
+endef
+
+IPW2200_NAME:=ipw2200-fw
+IPW2200_VERSION:=3.1
+
+define Download/ipw2200
+  URL:= \
+	https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-3.1.tgz/eaba788643c7cc7483dd67ace70f6e99/ \
+	https://archlinux.mirror.pkern.at/other/packages/ipw2200-fw/ \
+	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
+	http://firmware.openbsd.org/firmware-dist/
+  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
+  HASH:=c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd
+endef
+$(eval $(call Download,ipw2200))
+
+define KernelPackage/ipw2200
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Intel IPW2200 driver
+  DEPENDS:=@PCI_SUPPORT +kmod-libipw
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
+  AUTOLOAD:=$(call AutoProbe,ipw2200)
+endef
+
+define KernelPackage/ipw2200/description
+ Kernel support for Intel IPW2200
+ Includes:
+ - ipw2200
+endef
+
+define KernelPackage/ipw2100/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
+endef
+
+define KernelPackage/ipw2200/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
+endef
diff --git a/package/kernel/mac80211/marvell.mk b/package/kernel/mac80211/marvell.mk
new file mode 100644
index 0000000000..4e2f925b73
--- /dev/null
+++ b/package/kernel/mac80211/marvell.mk
@@ -0,0 +1,90 @@
+PKG_DRIVERS += \
+	libertas-sdio libertas-usb libertas-spi \
+	mwl8k mwifiex-pcie mwifiex-sdio
+
+config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
+config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
+config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
+config-$(call config_package,mwl8k) += MWL8K
+config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
+config-$(call config_package,mwifiex-sdio) += MWIFIEX MWIFIEX_SDIO
+
+define KernelPackage/libertas-usb
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware @!LINUX_3_18
+  TITLE:=Marvell 88W8015 Wireless Driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
+  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
+endef
+
+define KernelPackage/libertas-sdio
+  $(call KernelPackage/mac80211/Default)
+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware @!LINUX_3_18
+  TITLE:=Marvell 88W8686 Wireless Driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
+endef
+
+define KernelPackage/libertas-spi
+  $(call KernelPackage/mac80211/Default)
+  SUBMENU:=Wireless Drivers
+  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-spi-firmware @!LINUX_3_18
+  KCONFIG := \
+	CONFIG_SPI=y \
+	CONFIG_SPI_MASTER=y
+  TITLE:=Marvell 88W8686 SPI Wireless Driver
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
+  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
+endef
+
+
+define KernelPackage/mwl8k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
+  AUTOLOAD:=$(call AutoProbe,mwl8k)
+endef
+
+define KernelPackage/mwl8k/description
+ Kernel modules for Marvell TOPDOG 802.11 Wireless cards
+endef
+
+
+define KernelPackage/mwifiex-pcie
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
+  AUTOLOAD:=$(call AutoProbe,mwifiex_pcie)
+endef
+
+define KernelPackage/mwifiex-pcie/description
+ Kernel modules for Marvell 802.11n/802.11ac PCIe Wireless cards
+endef
+
+define KernelPackage/mwifiex-sdio
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
+  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
+  AUTOLOAD:=$(call AutoProbe,mwifiex_sdio)
+endef
+
+define KernelPackage/mwifiex-sdio/description
+ Kernel modules for Marvell 802.11n/802.11ac SDIO Wireless cards
+endef
+
diff --git a/package/kernel/mac80211/patches/005-revert-devcoredump.patch b/package/kernel/mac80211/patches/005-revert-devcoredump.patch
deleted file mode 100644
index d485d95586..0000000000
--- a/package/kernel/mac80211/patches/005-revert-devcoredump.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/compat/Makefile
-+++ b/compat/Makefile
-@@ -70,8 +70,6 @@ quiet_cmd_build_OID_registry = GEN     $
- 	cmd_build_OID_registry = perl $(src)/build_OID_registry $< $@
- compat-$(CPTCFG_BPAUTO_ASN1_DECODER) += lib-asn1_decoder.o
- compat-$(CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION) += lib-oid_registry.o
--skcipher-objs += crypto-skcipher.o
--obj-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += skcipher.o
- compat-$(CPTCFG_BPAUTO_RHASHTABLE) += lib-rhashtable.o
- cordic-objs += lib-cordic.o
- obj-$(CPTCFG_BPAUTO_BUILD_CORDIC) += cordic.o
diff --git a/package/kernel/mac80211/patches/006-fix-genl-multicast.patch b/package/kernel/mac80211/patches/006-fix-genl-multicast.patch
deleted file mode 100644
index 42fd3e8271..0000000000
--- a/package/kernel/mac80211/patches/006-fix-genl-multicast.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/compat/backport-4.12.c
-+++ b/compat/backport-4.12.c
-@@ -225,6 +225,7 @@ int bp_extack_genl_register_family(struc
- 
- 	/* copy this since the family might access it directly */
- 	family->attrbuf = copy->family.attrbuf;
-+	family->mcgrp_offset = copy->family.mcgrp_offset;
- 
- 	mutex_lock(&copies_mutex);
- 	list_add_tail(&copy->list, &copies_list);
diff --git a/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch b/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
deleted file mode 100644
index 4011f1d3ba..0000000000
--- a/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/backport-include/linux/verification.h
-+++ b/backport-include/linux/verification.h
-@@ -1,7 +1,7 @@
- #ifndef __BP_VERIFICATION_H
- #define __BP_VERIFICATION_H
- #include <linux/version.h>
--#ifndef CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION
-+#if LINUX_VERSION_IS_GEQ(4,7,0) && !defined(CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION)
- #include_next <linux/verification.h>
- #else
- #include <linux/key.h>
diff --git a/package/kernel/mac80211/patches/008-fix-genl-family-id.patch b/package/kernel/mac80211/patches/008-fix-genl-family-id.patch
deleted file mode 100644
index ee8fa6c2bc..0000000000
--- a/package/kernel/mac80211/patches/008-fix-genl-family-id.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/compat/backport-4.12.c
-+++ b/compat/backport-4.12.c
-@@ -224,6 +224,7 @@ int bp_extack_genl_register_family(struc
- 	}
- 
- 	/* copy this since the family might access it directly */
-+	family->id = copy->family.id;
- 	family->attrbuf = copy->family.attrbuf;
- 	family->mcgrp_offset = copy->family.mcgrp_offset;
- 
diff --git a/package/kernel/mac80211/patches/009-backport_sg_init_marker.patch b/package/kernel/mac80211/patches/009-backport_sg_init_marker.patch
deleted file mode 100644
index d7c20daf16..0000000000
--- a/package/kernel/mac80211/patches/009-backport_sg_init_marker.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- a/backport-include/linux/scatterlist.h
-+++ b/backport-include/linux/scatterlist.h
-@@ -102,4 +102,27 @@ size_t sg_pcopy_from_buffer(struct scatt
- 
- #endif /* LINUX_VERSION_IS_LESS(3, 11, 0) */
- 
-+#if LINUX_VERSION_IS_LESS(4, 17, 0)
-+
-+#define sg_init_marker LINUX_BACKPORT(sg_init_marker)
-+/**
-+ * sg_init_marker - Initialize markers in sg table
-+ * @sgl:	   The SG table
-+ * @nents:	   Number of entries in table
-+ *
-+ **/
-+static inline void sg_init_marker(struct scatterlist *sgl,
-+				  unsigned int nents)
-+{
-+#ifdef CONFIG_DEBUG_SG
-+	unsigned int i;
-+
-+	for (i = 0; i < nents; i++)
-+		sgl[i].sg_magic = SG_MAGIC;
-+#endif
-+	sg_mark_end(&sgl[nents - 1]);
-+}
-+
-+#endif /* LINUX_VERSION_IS_LESS(4, 17, 0) */
-+
- #endif /* __BACKPORT_SCATTERLIST_H */
diff --git a/package/kernel/mac80211/patches/011-backport-overflow_h.patch b/package/kernel/mac80211/patches/011-backport-overflow_h.patch
deleted file mode 100644
index 169d3bab15..0000000000
--- a/package/kernel/mac80211/patches/011-backport-overflow_h.patch
+++ /dev/null
@@ -1,322 +0,0 @@
---- a/backport-include/linux/slab.h
-+++ b/backport-include/linux/slab.h
-@@ -1,6 +1,7 @@
- #ifndef __BACKPORT_SLAB_H
- #define __BACKPORT_SLAB_H
- #include_next <linux/slab.h>
-+#include <linux/overflow.h>
- #include <linux/version.h>
- 
- #if LINUX_VERSION_IS_LESS(3,4,0)
---- /dev/null
-+++ b/include/linux/overflow.h
-@@ -0,0 +1,309 @@
-+/* SPDX-License-Identifier: GPL-2.0 OR MIT */
-+#ifndef __LINUX_OVERFLOW_H
-+#define __LINUX_OVERFLOW_H
-+
-+#include <linux/compiler.h>
-+
-+/*
-+ * In the fallback code below, we need to compute the minimum and
-+ * maximum values representable in a given type. These macros may also
-+ * be useful elsewhere, so we provide them outside the
-+ * COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW block.
-+ *
-+ * It would seem more obvious to do something like
-+ *
-+ * #define type_min(T) (T)(is_signed_type(T) ? (T)1 << (8*sizeof(T)-1) : 0)
-+ * #define type_max(T) (T)(is_signed_type(T) ? ((T)1 << (8*sizeof(T)-1)) - 1 : ~(T)0)
-+ *
-+ * Unfortunately, the middle expressions, strictly speaking, have
-+ * undefined behaviour, and at least some versions of gcc warn about
-+ * the type_max expression (but not if -fsanitize=undefined is in
-+ * effect; in that case, the warning is deferred to runtime...).
-+ *
-+ * The slightly excessive casting in type_min is to make sure the
-+ * macros also produce sensible values for the exotic type _Bool. [The
-+ * overflow checkers only almost work for _Bool, but that's
-+ * a-feature-not-a-bug, since people shouldn't be doing arithmetic on
-+ * _Bools. Besides, the gcc builtins don't allow _Bool* as third
-+ * argument.]
-+ *
-+ * Idea stolen from
-+ * https://mail-index.netbsd.org/tech-misc/2007/02/05/0000.html -
-+ * credit to Christian Biere.
-+ */
-+#define is_signed_type(type)       (((type)(-1)) < (type)1)
-+#define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
-+#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
-+#define type_min(T) ((T)((T)-type_max(T)-(T)1))
-+
-+
-+#ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
-+/*
-+ * For simplicity and code hygiene, the fallback code below insists on
-+ * a, b and *d having the same type (similar to the min() and max()
-+ * macros), whereas gcc's type-generic overflow checkers accept
-+ * different types. Hence we don't just make check_add_overflow an
-+ * alias for __builtin_add_overflow, but add type checks similar to
-+ * below.
-+ */
-+#define check_add_overflow(a, b, d) ({		\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	__builtin_add_overflow(__a, __b, __d);	\
-+})
-+
-+#define check_sub_overflow(a, b, d) ({		\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	__builtin_sub_overflow(__a, __b, __d);	\
-+})
-+
-+#define check_mul_overflow(a, b, d) ({		\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	__builtin_mul_overflow(__a, __b, __d);	\
-+})
-+
-+#else
-+
-+
-+/* Checking for unsigned overflow is relatively easy without causing UB. */
-+#define __unsigned_add_overflow(a, b, d) ({	\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	*__d = __a + __b;			\
-+	*__d < __a;				\
-+})
-+#define __unsigned_sub_overflow(a, b, d) ({	\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	*__d = __a - __b;			\
-+	__a < __b;				\
-+})
-+/*
-+ * If one of a or b is a compile-time constant, this avoids a division.
-+ */
-+#define __unsigned_mul_overflow(a, b, d) ({		\
-+	typeof(a) __a = (a);				\
-+	typeof(b) __b = (b);				\
-+	typeof(d) __d = (d);				\
-+	(void) (&__a == &__b);				\
-+	(void) (&__a == __d);				\
-+	*__d = __a * __b;				\
-+	__builtin_constant_p(__b) ?			\
-+	  __b > 0 && __a > type_max(typeof(__a)) / __b : \
-+	  __a > 0 && __b > type_max(typeof(__b)) / __a;	 \
-+})
-+
-+/*
-+ * For signed types, detecting overflow is much harder, especially if
-+ * we want to avoid UB. But the interface of these macros is such that
-+ * we must provide a result in *d, and in fact we must produce the
-+ * result promised by gcc's builtins, which is simply the possibly
-+ * wrapped-around value. Fortunately, we can just formally do the
-+ * operations in the widest relevant unsigned type (u64) and then
-+ * truncate the result - gcc is smart enough to generate the same code
-+ * with and without the (u64) casts.
-+ */
-+
-+/*
-+ * Adding two signed integers can overflow only if they have the same
-+ * sign, and overflow has happened iff the result has the opposite
-+ * sign.
-+ */
-+#define __signed_add_overflow(a, b, d) ({	\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	*__d = (u64)__a + (u64)__b;		\
-+	(((~(__a ^ __b)) & (*__d ^ __a))	\
-+		& type_min(typeof(__a))) != 0;	\
-+})
-+
-+/*
-+ * Subtraction is similar, except that overflow can now happen only
-+ * when the signs are opposite. In this case, overflow has happened if
-+ * the result has the opposite sign of a.
-+ */
-+#define __signed_sub_overflow(a, b, d) ({	\
-+	typeof(a) __a = (a);			\
-+	typeof(b) __b = (b);			\
-+	typeof(d) __d = (d);			\
-+	(void) (&__a == &__b);			\
-+	(void) (&__a == __d);			\
-+	*__d = (u64)__a - (u64)__b;		\
-+	((((__a ^ __b)) & (*__d ^ __a))		\
-+		& type_min(typeof(__a))) != 0;	\
-+})
-+
-+/*
-+ * Signed multiplication is rather hard. gcc always follows C99, so
-+ * division is truncated towards 0. This means that we can write the
-+ * overflow check like this:
-+ *
-+ * (a > 0 && (b > MAX/a || b < MIN/a)) ||
-+ * (a < -1 && (b > MIN/a || b < MAX/a) ||
-+ * (a == -1 && b == MIN)
-+ *
-+ * The redundant casts of -1 are to silence an annoying -Wtype-limits
-+ * (included in -Wextra) warning: When the type is u8 or u16, the
-+ * __b_c_e in check_mul_overflow obviously selects
-+ * __unsigned_mul_overflow, but unfortunately gcc still parses this
-+ * code and warns about the limited range of __b.
-+ */
-+
-+#define __signed_mul_overflow(a, b, d) ({				\
-+	typeof(a) __a = (a);						\
-+	typeof(b) __b = (b);						\
-+	typeof(d) __d = (d);						\
-+	typeof(a) __tmax = type_max(typeof(a));				\
-+	typeof(a) __tmin = type_min(typeof(a));				\
-+	(void) (&__a == &__b);						\
-+	(void) (&__a == __d);						\
-+	*__d = (u64)__a * (u64)__b;					\
-+	(__b > 0   && (__a > __tmax/__b || __a < __tmin/__b)) ||	\
-+	(__b < (typeof(__b))-1  && (__a > __tmin/__b || __a < __tmax/__b)) || \
-+	(__b == (typeof(__b))-1 && __a == __tmin);			\
-+})
-+
-+
-+#define check_add_overflow(a, b, d)					\
-+	__builtin_choose_expr(is_signed_type(typeof(a)),		\
-+			__signed_add_overflow(a, b, d),			\
-+			__unsigned_add_overflow(a, b, d))
-+
-+#define check_sub_overflow(a, b, d)					\
-+	__builtin_choose_expr(is_signed_type(typeof(a)),		\
-+			__signed_sub_overflow(a, b, d),			\
-+			__unsigned_sub_overflow(a, b, d))
-+
-+#define check_mul_overflow(a, b, d)					\
-+	__builtin_choose_expr(is_signed_type(typeof(a)),		\
-+			__signed_mul_overflow(a, b, d),			\
-+			__unsigned_mul_overflow(a, b, d))
-+
-+
-+#endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
-+
-+/** check_shl_overflow() - Calculate a left-shifted value and check overflow
-+ *
-+ * @a: Value to be shifted
-+ * @s: How many bits left to shift
-+ * @d: Pointer to where to store the result
-+ *
-+ * Computes *@d = (@a << @s)
-+ *
-+ * Returns true if '*d' cannot hold the result or when 'a << s' doesn't
-+ * make sense. Example conditions:
-+ * - 'a << s' causes bits to be lost when stored in *d.
-+ * - 's' is garbage (e.g. negative) or so large that the result of
-+ *   'a << s' is guaranteed to be 0.
-+ * - 'a' is negative.
-+ * - 'a << s' sets the sign bit, if any, in '*d'.
-+ *
-+ * '*d' will hold the results of the attempted shift, but is not
-+ * considered "safe for use" if false is returned.
-+ */
-+#define check_shl_overflow(a, s, d) ({					\
-+	typeof(a) _a = a;						\
-+	typeof(s) _s = s;						\
-+	typeof(d) _d = d;						\
-+	u64 _a_full = _a;						\
-+	unsigned int _to_shift =					\
-+		_s >= 0 && _s < 8 * sizeof(*d) ? _s : 0;		\
-+	*_d = (_a_full << _to_shift);					\
-+	(_to_shift != _s || *_d < 0 || _a < 0 ||			\
-+		(*_d >> _to_shift) != _a);				\
-+})
-+
-+/**
-+ * array_size() - Calculate size of 2-dimensional array.
-+ *
-+ * @a: dimension one
-+ * @b: dimension two
-+ *
-+ * Calculates size of 2-dimensional array: @a * @b.
-+ *
-+ * Returns: number of bytes needed to represent the array or SIZE_MAX on
-+ * overflow.
-+ */
-+static inline __must_check size_t array_size(size_t a, size_t b)
-+{
-+	size_t bytes;
-+
-+	if (check_mul_overflow(a, b, &bytes))
-+		return SIZE_MAX;
-+
-+	return bytes;
-+}
-+
-+/**
-+ * array3_size() - Calculate size of 3-dimensional array.
-+ *
-+ * @a: dimension one
-+ * @b: dimension two
-+ * @c: dimension three
-+ *
-+ * Calculates size of 3-dimensional array: @a * @b * @c.
-+ *
-+ * Returns: number of bytes needed to represent the array or SIZE_MAX on
-+ * overflow.
-+ */
-+static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
-+{
-+	size_t bytes;
-+
-+	if (check_mul_overflow(a, b, &bytes))
-+		return SIZE_MAX;
-+	if (check_mul_overflow(bytes, c, &bytes))
-+		return SIZE_MAX;
-+
-+	return bytes;
-+}
-+
-+static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
-+{
-+	size_t bytes;
-+
-+	if (check_mul_overflow(n, size, &bytes))
-+		return SIZE_MAX;
-+	if (check_add_overflow(bytes, c, &bytes))
-+		return SIZE_MAX;
-+
-+	return bytes;
-+}
-+
-+/**
-+ * struct_size() - Calculate size of structure with trailing array.
-+ * @p: Pointer to the structure.
-+ * @member: Name of the array member.
-+ * @n: Number of elements in the array.
-+ *
-+ * Calculates size of memory needed for structure @p followed by an
-+ * array of @n @member elements.
-+ *
-+ * Return: number of bytes needed or SIZE_MAX on overflow.
-+ */
-+#define struct_size(p, member, n)					\
-+	__ab_c_size(n,							\
-+		    sizeof(*(p)->member) + __must_be_array((p)->member),\
-+		    sizeof(*(p)))
-+
-+#endif /* __LINUX_OVERFLOW_H */
diff --git a/package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch b/package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch
deleted file mode 100644
index f71e40bf10..0000000000
--- a/package/kernel/mac80211/patches/013-backport-firmware_request_nowarn.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/backport-include/linux/firmware.h
-+++ b/backport-include/linux/firmware.h
-@@ -5,5 +5,16 @@
- #if LINUX_VERSION_IS_LESS(3,14,0)
- #define request_firmware_direct(fw, name, device) request_firmware(fw, name, device)
- #endif
-+#if LINUX_VERSION_IS_LESS(4,18,0)
-+#define firmware_request_nowarn(fw, name, device) request_firmware(fw, name, device)
-+#endif
-+
-+#if LINUX_VERSION_IS_LESS(4,17,0)
-+#define firmware_request_cache LINUX_BACKPORT(firmware_request_cache)
-+static inline int firmware_request_cache(struct device *device, const char *name)
-+{
-+	return 0;
-+}
-+#endif
- 
- #endif /* __BACKPORT_LINUX_FIRMWARE_H */
diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
deleted file mode 100644
index d897b2b40e..0000000000
--- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
+++ /dev/null
@@ -1,132 +0,0 @@
---- a/local-symbols
-+++ b/local-symbols
-@@ -388,45 +388,6 @@ USB_IPHETH=
- USB_SIERRA_NET=
- USB_VL600=
- USB_NET_CH9200=
--SSB_POSSIBLE=
--SSB=
--SSB_SPROM=
--SSB_BLOCKIO=
--SSB_PCIHOST_POSSIBLE=
--SSB_PCIHOST=
--SSB_B43_PCI_BRIDGE=
--SSB_PCMCIAHOST_POSSIBLE=
--SSB_PCMCIAHOST=
--SSB_SDIOHOST_POSSIBLE=
--SSB_SDIOHOST=
--SSB_HOST_SOC=
--SSB_SILENT=
--SSB_DEBUG=
--SSB_SERIAL=
--SSB_DRIVER_PCICORE_POSSIBLE=
--SSB_DRIVER_PCICORE=
--SSB_PCICORE_HOSTMODE=
--SSB_DRIVER_MIPS=
--SSB_SFLASH=
--SSB_EMBEDDED=
--SSB_DRIVER_EXTIF=
--SSB_DRIVER_GIGE=
--SSB_DRIVER_GPIO=
--BCMA_POSSIBLE=
--BCMA=
--BCMA_BLOCKIO=
--BCMA_HOST_PCI_POSSIBLE=
--BCMA_HOST_PCI=
--BCMA_HOST_SOC=
--BCMA_DRIVER_PCI=
--BCMA_DRIVER_PCI_HOSTMODE=
--BCMA_DRIVER_MIPS=
--BCMA_PFLASH=
--BCMA_SFLASH=
--BCMA_NFLASH=
--BCMA_DRIVER_GMAC_CMN=
--BCMA_DRIVER_GPIO=
--BCMA_DEBUG=
- NFC=
- NFC_DIGITAL=
- NFC_NCI=
---- a/drivers/net/wireless/broadcom/b43/main.c
-+++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -2876,7 +2876,7 @@ static struct ssb_device *b43_ssb_gpio_d
- {
- 	struct ssb_bus *bus = dev->dev->sdev->bus;
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
- #else
- 	return bus->chipco.dev;
-@@ -4893,7 +4893,7 @@ static int b43_wireless_core_init(struct
- 	}
- 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
- 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
--#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
-+#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
- 	if (dev->dev->bus_type == B43_BUS_SSB &&
- 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
- 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
---- a/drivers/net/wireless/broadcom/b43legacy/main.c
-+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
-@@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
- 	if (dev->dev->id.revision >= 2)
- 		mask  |= 0x0010; /* FIXME: This is redundant. */
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	pcidev = bus->pcicore.dev;
- #endif
- 	gpiodev = bus->chipco.dev ? : pcidev;
-@@ -1956,7 +1956,7 @@ static void b43legacy_gpio_cleanup(struc
- 	struct ssb_bus *bus = dev->dev->bus;
- 	struct ssb_device *gpiodev, *pcidev = NULL;
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	pcidev = bus->pcicore.dev;
- #endif
- 	gpiodev = bus->chipco.dev ? : pcidev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-@@ -42,6 +42,6 @@ brcmsmac-y := \
- 	brcms_trace_events.o \
- 	debug.o
- 
--brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
-+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
- 
- obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-@@ -22,7 +22,7 @@ struct brcms_led {
- 	bool active_low;
- };
- 
--#ifdef CPTCFG_BCMA_DRIVER_GPIO
-+#ifdef CONFIG_BCMA_DRIVER_GPIO
- void brcms_led_unregister(struct brcms_info *wl);
- int brcms_led_register(struct brcms_info *wl);
- #else
---- a/Kconfig.sources
-+++ b/Kconfig.sources
-@@ -9,9 +9,6 @@ source "$BACKPORT_DIR/drivers/net/wirele
- #source "$BACKPORT_DIR/drivers/net/ethernet/Kconfig"
- source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
- 
--source "$BACKPORT_DIR/drivers/ssb/Kconfig"
--source "$BACKPORT_DIR/drivers/bcma/Kconfig"
--
- source "$BACKPORT_DIR/net/nfc/Kconfig"
- 
- #source "$BACKPORT_DIR/drivers/media/Kconfig"
---- a/Makefile.kernel
-+++ b/Makefile.kernel
-@@ -42,8 +42,6 @@ obj-$(CPTCFG_MAC80211) += net/mac80211/
- obj-$(CPTCFG_WLAN) += drivers/net/wireless/
- #obj-$(CPTCFG_BT) += net/bluetooth/
- #obj-$(CPTCFG_BT) += drivers/bluetooth/
--obj-$(CPTCFG_SSB) += drivers/ssb/
--obj-$(CPTCFG_BCMA) += drivers/bcma/
- #obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
- obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
- obj-$(CPTCFG_NFC) += net/nfc/
diff --git a/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch b/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
deleted file mode 100644
index 2724027866..0000000000
--- a/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From d06f26c5c8a41f246a9c40862a77a55725cedbd3 Mon Sep 17 00:00:00 2001
-From: Sven Eckelmann <sven.eckelmann@openmesh.com>
-Date: Fri, 8 Dec 2017 11:37:42 +0100
-Subject: ath10k: search DT for qcom,ath10k-calibration-variant
-
-Board Data File (BDF) is loaded upon driver boot-up procedure. The right
-board data file is identified on QCA4019 using bus, bmi-chip-id and
-bmi-board-id.
-
-The problem, however, can occur when the (default) board data file cannot
-fulfill with the vendor requirements and it is necessary to use a different
-board data file.
-
-This problem was solved for SMBIOS by adding a special SMBIOS type 0xF8.
-Something similar has to be provided for systems without SMBIOS but with
-device trees. No solution was specified by QCA and therefore a new one has
-to be found for ath10k.
-
-The device tree requires addition strings to define the variant name
-
-    wifi@a000000 {
-    	status = "okay";
-    	qcom,ath10k-calibration-variant = "RT-AC58U";
-    };
-
-    wifi@a800000 {
-    	status = "okay";
-    	qcom,ath10k-calibration-variant = "RT-AC58U";
-    };
-
-This would create the boarddata identifiers for the board-2.bin search
-
- *  bus=ahb,bmi-chip-id=0,bmi-board-id=16,variant=RT-AC58U
- *  bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=RT-AC58U
-
-Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/core.c | 40 ++++++++++++++++++++++++++++------
- 1 file changed, 33 insertions(+), 7 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -860,6 +860,28 @@ static int ath10k_core_check_smbios(stru
- 	return 0;
- }
- 
-+static int ath10k_core_check_dt(struct ath10k *ar)
-+{
-+	struct device_node *node;
-+	const char *variant = NULL;
-+
-+	node = ar->dev->of_node;
-+	if (!node)
-+		return -ENOENT;
-+
-+	of_property_read_string(node, "qcom,ath10k-calibration-variant",
-+				&variant);
-+	if (!variant)
-+		return -ENODATA;
-+
-+	if (strscpy(ar->id.bdf_ext, variant, sizeof(ar->id.bdf_ext)) < 0)
-+		ath10k_dbg(ar, ATH10K_DBG_BOOT,
-+			   "bdf variant string is longer than the buffer can accommodate (variant: %s)\n",
-+			    variant);
-+
-+	return 0;
-+}
-+
- static int ath10k_download_and_run_otp(struct ath10k *ar)
- {
- 	u32 result, address = ar->hw_params.patch_load_addr;
-@@ -1231,19 +1253,19 @@ static int ath10k_core_create_board_name
- 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
- 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
- 
-+	if (ar->id.bdf_ext[0] != '\0')
-+		scnprintf(variant, sizeof(variant), ",variant=%s",
-+			  ar->id.bdf_ext);
-+
- 	if (ar->id.bmi_ids_valid) {
- 		scnprintf(name, name_len,
--			  "bus=%s,bmi-chip-id=%d,bmi-board-id=%d",
-+			  "bus=%s,bmi-chip-id=%d,bmi-board-id=%d%s",
- 			  ath10k_bus_str(ar->hif.bus),
- 			  ar->id.bmi_chip_id,
--			  ar->id.bmi_board_id);
-+			  ar->id.bmi_board_id, variant);
- 		goto out;
- 	}
- 
--	if (ar->id.bdf_ext[0] != '\0')
--		scnprintf(variant, sizeof(variant), ",variant=%s",
--			  ar->id.bdf_ext);
--
- 	scnprintf(name, name_len,
- 		  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x%s",
- 		  ath10k_bus_str(ar->hif.bus),
-@@ -2343,7 +2365,11 @@ static int ath10k_core_probe_fw(struct a
- 
- 	ret = ath10k_core_check_smbios(ar);
- 	if (ret)
--		ath10k_dbg(ar, ATH10K_DBG_BOOT, "bdf variant name not set.\n");
-+		ath10k_dbg(ar, ATH10K_DBG_BOOT, "SMBIOS bdf variant name not set.\n");
-+
-+	ret = ath10k_core_check_dt(ar);
-+	if (ret)
-+		ath10k_dbg(ar, ATH10K_DBG_BOOT, "DT bdf variant name not set.\n");
- 
- 	ret = ath10k_core_fetch_board_file(ar);
- 	if (ret) {
diff --git a/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch b/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
deleted file mode 100644
index 9ddede3a67..0000000000
--- a/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 606204bb863fa3b0bb54929d79b4dc46338f9180 Mon Sep 17 00:00:00 2001
-From: Sathishkumar Muruganandam <murugana@codeaurora.org>
-Date: Tue, 27 Mar 2018 11:26:46 +0300
-Subject: [PATCH] ath10k: suppress "Unknown eventid: 36925" warnings
-
-FW has Smart Logging feature enabled by default for detecting failures
-and processing FATAL_CONDITION_EVENTID (36925 - 0x903D) back to host.
-
-Since ath10k doesn't implement the Smart Logging and FATAL CONDITION
-EVENT processing yet, suppressing the unknown event ID warning by moving
-this under ATH10K_DBG_WMI.
-
-Simulated the same issue by having associated STA powered off when
-ping flood was running from AP backbone. This triggerd STA KICKOUT
-in AP followed by FATAL CONDITION event 36925.
-
-Issue was reproduced and verified in below DUT
-------------------------------------------------
-AP mode of OpenWRT QCA9984 running 6.0.8 with FW ver 10.4-3.5.3-00053
-
-Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/wmi.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -5462,6 +5462,7 @@ static void ath10k_wmi_10_4_op_rx(struct
- 	case WMI_10_4_WOW_WAKEUP_HOST_EVENTID:
- 	case WMI_10_4_PEER_RATECODE_LIST_EVENTID:
- 	case WMI_10_4_WDS_PEER_EVENTID:
-+	case WMI_10_4_DEBUG_FATAL_CONDITION_EVENTID:
- 		ath10k_dbg(ar, ATH10K_DBG_WMI,
- 			   "received event id %d not implemented\n", id);
- 		break;
diff --git a/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch b/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
deleted file mode 100644
index 57b4a727eb..0000000000
--- a/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 52a192362932f333a7ebafd581c4d9b81da2fec8 Mon Sep 17 00:00:00 2001
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-Date: Mon, 28 May 2018 13:25:06 +0200
-Subject: [PATCH] Revert "rt2800: use TXOP_BACKOFF for probe frames"
-
-This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e.
-
-In some situations when we set TXOP_BACKOFF, the probe frame is
-not sent at all. What it worse then sending probe frame as part
-of AMPDU and can degrade 11n performance to 11g rates.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
-@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri
- 
- 	/*
- 	 * Determine IFS values
--	 * - Use TXOP_BACKOFF for probe and management frames except beacons
-+	 * - Use TXOP_BACKOFF for management frames except beacons
- 	 * - Use TXOP_SIFS for fragment bursts
- 	 * - Use TXOP_HTTXOP for everything else
- 	 *
- 	 * Note: rt2800 devices won't use CTS protection (if used)
- 	 * for frames not transmitted with TXOP_HTTXOP
- 	 */
--	if ((ieee80211_is_mgmt(hdr->frame_control) &&
--	     !ieee80211_is_beacon(hdr->frame_control)) ||
--	    (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
-+	if (ieee80211_is_mgmt(hdr->frame_control) &&
-+	    !ieee80211_is_beacon(hdr->frame_control))
- 		txdesc->u.ht.txop = TXOP_BACKOFF;
- 	else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
- 		txdesc->u.ht.txop = TXOP_SIFS;
diff --git a/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch b/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
deleted file mode 100644
index 357b006bcc..0000000000
--- a/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
+++ /dev/null
@@ -1,237 +0,0 @@
-From: Thomas Hebb <tommyhebb@gmail.com>
-Subject: [PATCH] ath10k: search all IEs for variant before falling back
-Date: Wed, 21 Feb 2018 11:43:39 -0500
-
-commit f2593cb1b291 ("ath10k: Search SMBIOS for OEM board file
-extension") added a feature to ath10k that allows Board Data File
-(BDF) conflicts between multiple devices that use the same device IDs
-but have different calibration requirements to be resolved by allowing
-a "variant" string to be stored in SMBIOS [and later device tree, added
-by commit d06f26c5c8a4 ("ath10k: search DT for qcom,ath10k-calibration-
-variant")] that gets appended to the ID stored in board-2.bin.
-
-This original patch had a regression, however. Namely that devices with
-a variant present in SMBIOS that didn't need custom BDFs could no longer
-find the default BDF, which has no variant appended. The patch was
-reverted and re-applied with a fix for this issue in commit 1657b8f84ed9
-("search SMBIOS for OEM board file extension").
-
-But the fix to fall back to a default BDF introduced another issue: the
-driver currently parses IEs in board-2.bin one by one, and for each one
-it first checks to see if it matches the ID with the variant appended.
-If it doesn't, it checks to see if it matches the "fallback" ID with no
-variant. If a matching BDF is found at any point during this search, the
-search is terminated and that BDF is used. The issue is that it's very
-possible (and is currently the case for board-2.bin files present in the
-ath10k-firmware repository) for the default BDF to occur in an earlier
-IE than the variant-specific BDF. In this case, the current code will
-happily choose the default BDF even though a better-matching BDF is
-present later in the file.
-
-This patch fixes the issue by first searching the entire file for the ID
-with variant, and searching for the fallback ID only if that search
-fails. It also includes some code cleanup in the area, as
-ath10k_core_fetch_board_data_api_n() no longer does its own string
-mangling to remove the variant from an ID, instead leaving that job to a
-new flag passed to ath10k_core_create_board_name().
-
-I've tested this patch on a QCA4019 and verified that the driver behaves
-correctly for 1) both fallback and variant BDFs present, 2) only fallback
-BDF present, and 3) no matching BDFs present.
-
-Fixes: 1657b8f84ed9 ("ath10k: search SMBIOS for OEM board file extension")
-Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
----
- drivers/net/wireless/ath/ath10k/core.c | 134 ++++++++++++++++++---------------
- 1 file changed, 72 insertions(+), 62 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -1132,14 +1132,61 @@ out:
- 	return ret;
- }
- 
-+static int ath10k_core_search_bd(struct ath10k *ar,
-+				 const char *boardname,
-+				 const u8 *data,
-+				 size_t len)
-+{
-+	size_t ie_len;
-+	struct ath10k_fw_ie *hdr;
-+	int ret = -ENOENT, ie_id;
-+
-+	while (len > sizeof(struct ath10k_fw_ie)) {
-+		hdr = (struct ath10k_fw_ie *)data;
-+		ie_id = le32_to_cpu(hdr->id);
-+		ie_len = le32_to_cpu(hdr->len);
-+
-+		len -= sizeof(*hdr);
-+		data = hdr->data;
-+
-+		if (len < ALIGN(ie_len, 4)) {
-+			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
-+				   ie_id, ie_len, len);
-+			return -EINVAL;
-+		}
-+
-+		switch (ie_id) {
-+		case ATH10K_BD_IE_BOARD:
-+			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
-+							    boardname);
-+			if (ret == -ENOENT)
-+				/* no match found, continue */
-+				break;
-+
-+			/* either found or error, so stop searching */
-+			goto out;
-+		}
-+
-+		/* jump over the padding */
-+		ie_len = ALIGN(ie_len, 4);
-+
-+		len -= ie_len;
-+		data += ie_len;
-+	}
-+
-+out:
-+	/* return result of parse_bd_ie_board() or -ENOENT */
-+	return ret;
-+}
-+
- static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
- 					      const char *boardname,
-+					      const char *fallback_boardname,
- 					      const char *filename)
- {
--	size_t len, magic_len, ie_len;
--	struct ath10k_fw_ie *hdr;
-+	size_t len, magic_len;
- 	const u8 *data;
--	int ret, ie_id;
-+	int ret;
- 
- 	ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
- 							ar->hw_params.fw.dir,
-@@ -1177,69 +1224,23 @@ static int ath10k_core_fetch_board_data_
- 	data += magic_len;
- 	len -= magic_len;
- 
--	while (len > sizeof(struct ath10k_fw_ie)) {
--		hdr = (struct ath10k_fw_ie *)data;
--		ie_id = le32_to_cpu(hdr->id);
--		ie_len = le32_to_cpu(hdr->len);
--
--		len -= sizeof(*hdr);
--		data = hdr->data;
--
--		if (len < ALIGN(ie_len, 4)) {
--			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
--				   ie_id, ie_len, len);
--			ret = -EINVAL;
--			goto err;
--		}
-+	/* attempt to find boardname in the IE list */
-+	ret = ath10k_core_search_bd(ar, boardname, data, len);
- 
--		switch (ie_id) {
--		case ATH10K_BD_IE_BOARD:
--			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
--							    boardname);
--			if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') {
--				/* try default bdf if variant was not found */
--				char *s, *v = ",variant=";
--				char boardname2[100];
--
--				strlcpy(boardname2, boardname,
--					sizeof(boardname2));
--
--				s = strstr(boardname2, v);
--				if (s)
--					*s = '\0';  /* strip ",variant=%s" */
--
--				ret = ath10k_core_parse_bd_ie_board(ar, data,
--								    ie_len,
--								    boardname2);
--			}
-+	/* if we didn't find it and have a fallback name, try that */
-+	if (ret == -ENOENT && fallback_boardname)
-+		ret = ath10k_core_search_bd(ar, fallback_boardname, data, len);
- 
--			if (ret == -ENOENT)
--				/* no match found, continue */
--				break;
--			else if (ret)
--				/* there was an error, bail out */
--				goto err;
--
--			/* board data found */
--			goto out;
--		}
--
--		/* jump over the padding */
--		ie_len = ALIGN(ie_len, 4);
--
--		len -= ie_len;
--		data += ie_len;
--	}
--
--out:
--	if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) {
-+	if (ret == -ENOENT) {
- 		ath10k_err(ar,
- 			   "failed to fetch board data for %s from %s/%s\n",
- 			   boardname, ar->hw_params.fw.dir, filename);
- 		ret = -ENODATA;
--		goto err;
- 	}
- 
-+	if (ret)
-+		goto err;
-+
- 	return 0;
- 
- err:
-@@ -1248,12 +1249,12 @@ err:
- }
- 
- static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
--					 size_t name_len)
-+					 size_t name_len, bool with_variant)
- {
- 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
- 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
- 
--	if (ar->id.bdf_ext[0] != '\0')
-+	if (with_variant && ar->id.bdf_ext[0] != '\0')
- 		scnprintf(variant, sizeof(variant), ",variant=%s",
- 			  ar->id.bdf_ext);
- 
-@@ -1279,17 +1280,26 @@ out:
- 
- static int ath10k_core_fetch_board_file(struct ath10k *ar)
- {
--	char boardname[100];
-+	char boardname[100], fallback_boardname[100];
- 	int ret;
- 
--	ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname));
-+	ret = ath10k_core_create_board_name(ar, boardname,
-+					    sizeof(boardname), true);
- 	if (ret) {
- 		ath10k_err(ar, "failed to create board name: %d", ret);
- 		return ret;
- 	}
- 
-+	ret = ath10k_core_create_board_name(ar, fallback_boardname,
-+					    sizeof(boardname), false);
-+	if (ret) {
-+		ath10k_err(ar, "failed to create fallback board name: %d", ret);
-+		return ret;
-+	}
-+
- 	ar->bd_api = 2;
- 	ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
-+						 fallback_boardname,
- 						 ATH10K_BOARD_API2_FILE);
- 	if (!ret)
- 		goto success;
diff --git a/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch b/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
deleted file mode 100644
index 2aeb49dc16..0000000000
--- a/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From: Brian Norris <briannorris@chromium.org>
-Date: Thu, 19 Oct 2017 11:45:19 -0700
-Subject: [PATCH] ath10k: fix build errors with !CONFIG_PM
-
-Build errors have been reported with CONFIG_PM=n:
-
-drivers/net/wireless/ath/ath10k/pci.c:3416:8: error: implicit
-declaration of function 'ath10k_pci_suspend'
-[-Werror=implicit-function-declaration]
-
-drivers/net/wireless/ath/ath10k/pci.c:3428:8: error: implicit
-declaration of function 'ath10k_pci_resume'
-[-Werror=implicit-function-declaration]
-
-These are caused by the combination of the following two commits:
-
-6af1de2e4ec4 ("ath10k: mark PM functions as __maybe_unused")
-96378bd2c6cd ("ath10k: fix core PCI suspend when WoWLAN is supported but
-disabled")
-
-Both build fine on their own.
-
-But now that ath10k_pci_pm_{suspend,resume}() is compiled
-unconditionally, we should also compile ath10k_pci_{suspend,resume}()
-unconditionally.
-
-And drop the #ifdef around ath10k_pci_hif_{suspend,resume}() too; they
-are trivial (empty), so we're not saving much space by compiling them
-out. And the alternatives would be to sprinkle more __maybe_unused, or
-spread the #ifdef's further.
-
-Build tested with the following combinations:
-CONFIG_PM=y && CONFIG_PM_SLEEP=y
-CONFIG_PM=y && CONFIG_PM_SLEEP=n
-CONFIG_PM=n
-
-Fixes: 96378bd2c6cd ("ath10k: fix core PCI suspend when WoWLAN is supported but disabled")
-Fixes: 096ad2a15fd8 ("Merge branch 'ath-next'")
-Signed-off-by: Brian Norris <briannorris@chromium.org>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/pci.c
-+++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -2577,8 +2577,6 @@ void ath10k_pci_hif_power_down(struct at
- 	 */
- }
- 
--#ifdef CONFIG_PM
--
- static int ath10k_pci_hif_suspend(struct ath10k *ar)
- {
- 	/* Nothing to do; the important stuff is in the driver suspend. */
-@@ -2627,7 +2625,6 @@ static int ath10k_pci_resume(struct ath1
- 
- 	return ret;
- }
--#endif
- 
- static bool ath10k_pci_validate_cal(void *data, size_t size)
- {
-@@ -2782,10 +2779,8 @@ static const struct ath10k_hif_ops ath10
- 	.power_down		= ath10k_pci_hif_power_down,
- 	.read32			= ath10k_pci_read32,
- 	.write32		= ath10k_pci_write32,
--#ifdef CONFIG_PM
- 	.suspend		= ath10k_pci_hif_suspend,
- 	.resume			= ath10k_pci_hif_resume,
--#endif
- 	.fetch_cal_eeprom	= ath10k_pci_hif_fetch_cal_eeprom,
- };
- 
diff --git a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch b/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
deleted file mode 100644
index ecc5e49120..0000000000
--- a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 20 Nov 2017 17:01:44 +0100
-Subject: [PATCH] mac80211: properly free requested-but-not-started TX agg
- sessions
-
-When deleting a station or otherwise tearing down all aggregation
-sessions, make sure to delete requested but not yet started ones,
-to avoid the following scenario:
-
- * session is requested, added to tid_start_tx[]
- * ieee80211_ba_session_work() runs, gets past BLOCK_BA check
- * ieee80211_sta_tear_down_BA_sessions() runs, locks &sta->ampdu_mlme.mtx,
-   e.g. while deleting the station - deleting all active sessions
- * ieee80211_ba_session_work() continues since tear down flushes it, and
-   calls ieee80211_tx_ba_session_handle_start() for the new session, arms
-   the timer for it
- * station deletion continues to __cleanup_single_sta() and frees the
-   session struct, while the timer is armed
-
-Reported-by: Fengguang Wu <fengguang.wu@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -330,6 +330,11 @@ int ___ieee80211_stop_tx_ba_session(stru
- 
- 	spin_lock_bh(&sta->lock);
- 
-+	/* free struct pending for start, if present */
-+	tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
-+	kfree(tid_tx);
-+	sta->ampdu_mlme.tid_start_tx[tid] = NULL;
-+
- 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
- 	if (!tid_tx) {
- 		spin_unlock_bh(&sta->lock);
diff --git a/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch b/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
deleted file mode 100644
index 839e927880..0000000000
--- a/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 4 Jan 2018 15:51:53 +0100
-Subject: [PATCH] mac80211: mesh: drop frames appearing to be from us
-
-If there are multiple mesh stations with the same MAC address,
-they will both get confused and start throwing warnings.
-
-Obviously in this case nothing can actually work anyway, so just
-drop frames that look like they're from ourselves early on.
-
-Reported-by: Gui Iribarren <gui@altermundi.net>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc
- 		}
- 		return true;
- 	case NL80211_IFTYPE_MESH_POINT:
-+		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
-+			return false;
- 		if (multicast)
- 			return true;
- 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch b/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
deleted file mode 100644
index b8f3be1c8b..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 2fd3877b5bb7d39782c3205a1dcda02023b8514a Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:31 +0100
-Subject: [PATCH] brcmfmac: handle FWHALT mailbox indication
-
-The firmware uses a mailbox to communicate to the host what is going
-on. In the driver we validate the bit received. Various people seen
-the following message:
-
- brcmfmac: brcmf_sdio_hostmail: Unknown mailbox data content: 0x40012
-
-Bit 4 is cause of this message, but this actually indicates the firmware
-has halted. Handle this bit by giving a more meaningful error message.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -260,10 +260,11 @@ struct rte_console {
- #define I_HMB_HOST_INT	I_HMB_SW3	/* Miscellaneous Interrupt */
- 
- /* tohostmailboxdata */
--#define HMB_DATA_NAKHANDLED	1	/* retransmit NAK'd frame */
--#define HMB_DATA_DEVREADY	2	/* talk to host after enable */
--#define HMB_DATA_FC		4	/* per prio flowcontrol update flag */
--#define HMB_DATA_FWREADY	8	/* fw ready for protocol activity */
-+#define HMB_DATA_NAKHANDLED	0x0001	/* retransmit NAK'd frame */
-+#define HMB_DATA_DEVREADY	0x0002	/* talk to host after enable */
-+#define HMB_DATA_FC		0x0004	/* per prio flowcontrol update flag */
-+#define HMB_DATA_FWREADY	0x0008	/* fw ready for protocol activity */
-+#define HMB_DATA_FWHALT		0x0010	/* firmware halted */
- 
- #define HMB_DATA_FCDATA_MASK	0xff000000
- #define HMB_DATA_FCDATA_SHIFT	24
-@@ -1094,6 +1095,10 @@ static u32 brcmf_sdio_hostmail(struct br
- 			  offsetof(struct sdpcmd_regs, tosbmailbox));
- 	bus->sdcnt.f1regdata += 2;
- 
-+	/* dongle indicates the firmware has halted/crashed */
-+	if (hmb_data & HMB_DATA_FWHALT)
-+		brcmf_err("mailbox indicates firmware halted\n");
-+
- 	/* Dongle recomposed rx frames, accept them again */
- 	if (hmb_data & HMB_DATA_NAKHANDLED) {
- 		brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
-@@ -1151,6 +1156,7 @@ static u32 brcmf_sdio_hostmail(struct br
- 			 HMB_DATA_NAKHANDLED |
- 			 HMB_DATA_FC |
- 			 HMB_DATA_FWREADY |
-+			 HMB_DATA_FWHALT |
- 			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
- 		brcmf_err("Unknown mailbox data content: 0x%02x\n",
- 			  hmb_data);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch b/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
deleted file mode 100644
index 901663193a..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 6c219b0088158da839a5be63c5b3d96c145501d2 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:32 +0100
-Subject: [PATCH] brcmfmac: disable packet filtering in promiscuous mode
-
-Disable arp and nd offload to allow all packets sending to host.
-
-Reported-by: Phil Elwell <phil@raspberrypi.org>
-Tested-by: Phil Elwell <phil@raspberrypi.org>
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 41 ----------------------
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 38 ++++++++++++++++++++
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
- 3 files changed, 39 insertions(+), 41 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -472,47 +472,6 @@ send_key_to_dongle(struct brcmf_if *ifp,
- 	return err;
- }
- 
--static s32
--brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
--{
--	s32 err;
--	u32 mode;
--
--	if (enable)
--		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
--	else
--		mode = 0;
--
--	/* Try to set and enable ARP offload feature, this may fail, then it  */
--	/* is simply not supported and err 0 will be returned                 */
--	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
--	if (err) {
--		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
--			  mode, err);
--		err = 0;
--	} else {
--		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
--		if (err) {
--			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
--				  enable, err);
--			err = 0;
--		} else
--			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
--				  enable, mode);
--	}
--
--	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
--	if (err) {
--		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
--			  enable, err);
--		err = 0;
--	} else
--		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
--			  enable, mode);
--
--	return err;
--}
--
- static void
- brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
- {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -71,6 +71,43 @@ struct brcmf_if *brcmf_get_ifp(struct br
- 	return ifp;
- }
- 
-+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
-+{
-+	s32 err;
-+	u32 mode;
-+
-+	if (enable)
-+		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
-+	else
-+		mode = 0;
-+
-+	/* Try to set and enable ARP offload feature, this may fail, then it  */
-+	/* is simply not supported and err 0 will be returned                 */
-+	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
-+	if (err) {
-+		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
-+			  mode, err);
-+	} else {
-+		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
-+		if (err) {
-+			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
-+				  enable, err);
-+		} else {
-+			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
-+				  enable, mode);
-+		}
-+	}
-+
-+	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
-+	if (err) {
-+		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
-+			  enable, err);
-+	} else {
-+		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
-+			  enable, mode);
-+	}
-+}
-+
- static void _brcmf_set_multicast_list(struct work_struct *work)
- {
- 	struct brcmf_if *ifp;
-@@ -134,6 +171,7 @@ static void _brcmf_set_multicast_list(st
- 	if (err < 0)
- 		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
- 			  err);
-+	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
- }
- 
- #if IS_ENABLED(CONFIG_IPV6)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -203,6 +203,7 @@ int brcmf_netdev_wait_pend8021x(struct b
- /* Return pointer to interface name */
- char *brcmf_ifname(struct brcmf_if *ifp);
- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
- 			      bool is_p2pdev, const char *name, u8 *mac_addr);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
deleted file mode 100644
index b6f3d0c697..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 8c6efda22f5f9f73fc948f517424466be01ae84d Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:33 +0100
-Subject: [PATCH] brcmfmac: cleanup brcmf_cfg80211_escan() function
-
-The function brcmf_cfg80211_escan() was always called with a non-null
-request parameter and null pointer for this_ssid parameter. Clean up
-the function removing the dead code path.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 76 ++++------------------
- 1 file changed, 11 insertions(+), 65 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1072,18 +1072,10 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- 
- static s32
- brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
--		     struct cfg80211_scan_request *request,
--		     struct cfg80211_ssid *this_ssid)
-+		     struct cfg80211_scan_request *request)
- {
--	struct brcmf_if *ifp = vif->ifp;
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	struct cfg80211_ssid *ssids;
--	u32 passive_scan;
--	bool escan_req;
--	bool spec_scan;
- 	s32 err;
--	struct brcmf_ssid_le ssid_le;
--	u32 SSID_len;
- 
- 	brcmf_dbg(SCAN, "START ESCAN\n");
- 
-@@ -1101,8 +1093,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 			  cfg->scan_status);
- 		return -EAGAIN;
- 	}
--	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
--		brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
-+	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
-+		brcmf_err("Connecting: status (%lu)\n", vif->sme_state);
- 		return -EAGAIN;
- 	}
- 
-@@ -1110,63 +1102,17 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
- 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
- 
--	escan_req = false;
--	if (request) {
--		/* scan bss */
--		ssids = request->ssids;
--		escan_req = true;
--	} else {
--		/* scan in ibss */
--		/* we don't do escan in ibss */
--		ssids = this_ssid;
--	}
--
- 	cfg->scan_request = request;
- 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
--	if (escan_req) {
--		cfg->escan_info.run = brcmf_run_escan;
--		err = brcmf_p2p_scan_prep(wiphy, request, vif);
--		if (err)
--			goto scan_out;
--
--		err = brcmf_do_escan(vif->ifp, request);
--		if (err)
--			goto scan_out;
--	} else {
--		brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
--			  ssids->ssid, ssids->ssid_len);
--		memset(&ssid_le, 0, sizeof(ssid_le));
--		SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
--		ssid_le.SSID_len = cpu_to_le32(0);
--		spec_scan = false;
--		if (SSID_len) {
--			memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
--			ssid_le.SSID_len = cpu_to_le32(SSID_len);
--			spec_scan = true;
--		} else
--			brcmf_dbg(SCAN, "Broadcast scan\n");
--
--		passive_scan = cfg->active_scan ? 0 : 1;
--		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
--					    passive_scan);
--		if (err) {
--			brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
--			goto scan_out;
--		}
--		brcmf_scan_config_mpc(ifp, 0);
--		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
--					     sizeof(ssid_le));
--		if (err) {
--			if (err == -EBUSY)
--				brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
--					  ssid_le.SSID);
--			else
--				brcmf_err("WLC_SCAN error (%d)\n", err);
--
--			brcmf_scan_config_mpc(ifp, 1);
--			goto scan_out;
--		}
--	}
-+
-+	cfg->escan_info.run = brcmf_run_escan;
-+	err = brcmf_p2p_scan_prep(wiphy, request, vif);
-+	if (err)
-+		goto scan_out;
-+
-+	err = brcmf_do_escan(vif->ifp, request);
-+	if (err)
-+		goto scan_out;
- 
- 	/* Arm scan timeout timer */
- 	mod_timer(&cfg->escan_timeout, jiffies +
-@@ -1191,7 +1137,7 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
- 	if (!check_vif_up(vif))
- 		return -EIO;
- 
--	err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
-+	err = brcmf_cfg80211_escan(wiphy, vif, request);
- 
- 	if (err)
- 		brcmf_err("scan error (%d)\n", err);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch b/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
deleted file mode 100644
index c2e3cba52d..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From df2d8388bc96c0f29d27d121f2a4cd054f8b3900 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:34 +0100
-Subject: [PATCH] brcmfmac: use msecs_to_jiffies() instead of calculation using
- HZ
-
-Minor cleanup using provided macro to convert milliseconds interval
-to jiffies in brcmf_cfg80211_escan().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1115,8 +1115,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 		goto scan_out;
- 
- 	/* Arm scan timeout timer */
--	mod_timer(&cfg->escan_timeout, jiffies +
--			BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
-+	mod_timer(&cfg->escan_timeout,
-+		  jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
- 
- 	return 0;
- 
diff --git a/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
deleted file mode 100644
index 575ffb0183..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 588378f15cff285ac81c929239ccba01d7f71d50 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:35 +0100
-Subject: [PATCH] brcmfmac: get rid of brcmf_cfg80211_escan() function
-
-The function brcmf_cfg80211_escan() is only called by brcmf_cfg80211_scan()
-so there is no reason to split in two function especially since the latter
-does not do an awful lot.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 34 +++++++---------------
- 1 file changed, 10 insertions(+), 24 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1071,13 +1071,16 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- }
- 
- static s32
--brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
--		     struct cfg80211_scan_request *request)
-+brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	s32 err;
-+	struct brcmf_cfg80211_vif *vif;
-+	s32 err = 0;
- 
--	brcmf_dbg(SCAN, "START ESCAN\n");
-+	brcmf_dbg(TRACE, "Enter\n");
-+	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
-+	if (!check_vif_up(vif))
-+		return -EIO;
- 
- 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
- 		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
-@@ -1102,6 +1105,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
- 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
- 
-+	brcmf_dbg(SCAN, "START ESCAN\n");
-+
- 	cfg->scan_request = request;
- 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
- 
-@@ -1121,31 +1126,12 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 	return 0;
- 
- scan_out:
-+	brcmf_err("scan error (%d)\n", err);
- 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
- 	cfg->scan_request = NULL;
- 	return err;
- }
- 
--static s32
--brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
--{
--	struct brcmf_cfg80211_vif *vif;
--	s32 err = 0;
--
--	brcmf_dbg(TRACE, "Enter\n");
--	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
--	if (!check_vif_up(vif))
--		return -EIO;
--
--	err = brcmf_cfg80211_escan(wiphy, vif, request);
--
--	if (err)
--		brcmf_err("scan error (%d)\n", err);
--
--	brcmf_dbg(TRACE, "Exit\n");
--	return err;
--}
--
- static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
- {
- 	s32 err = 0;
diff --git a/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch b/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
deleted file mode 100644
index 4d4235f4b0..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From bbf35414cd23a9d7230bfd7046e1e2c26020e7eb Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:36 +0100
-Subject: [PATCH] brcmfmac: get rid of struct brcmf_cfg80211_info::active_scan
- field
-
-The field struct brcmf_cfg80211_info::active_scan is set to true upon
-initializing the driver instance, but it is never changed so simply
-get rid of it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 +---------
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h |  2 --
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      |  5 +----
- 3 files changed, 2 insertions(+), 15 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1043,7 +1043,6 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- {
- 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
- 	s32 err;
--	u32 passive_scan;
- 	struct brcmf_scan_results *results;
- 	struct escan_info *escan = &cfg->escan_info;
- 
-@@ -1051,13 +1050,7 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- 	escan->ifp = ifp;
- 	escan->wiphy = cfg->wiphy;
- 	escan->escan_state = WL_ESCAN_STATE_SCANNING;
--	passive_scan = cfg->active_scan ? 0 : 1;
--	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
--				    passive_scan);
--	if (err) {
--		brcmf_err("error (%d)\n", err);
--		return err;
--	}
-+
- 	brcmf_scan_config_mpc(ifp, 0);
- 	results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
- 	results->version = 0;
-@@ -5767,7 +5760,6 @@ static s32 wl_init_priv(struct brcmf_cfg
- 
- 	cfg->scan_request = NULL;
- 	cfg->pwr_save = true;
--	cfg->active_scan = true;	/* we do active scan per default */
- 	cfg->dongle_up = false;		/* dongle is not up yet */
- 	err = brcmf_init_priv_mem(cfg);
- 	if (err)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -283,7 +283,6 @@ struct brcmf_cfg80211_wowl {
-  * @scan_status: scan activity on the dongle.
-  * @pub: common driver information.
-  * @channel: current channel.
-- * @active_scan: current scan mode.
-  * @int_escan_map: bucket map for which internal e-scan is done.
-  * @ibss_starter: indicates this sta is ibss starter.
-  * @pwr_save: indicate whether dongle to support power save mode.
-@@ -316,7 +315,6 @@ struct brcmf_cfg80211_info {
- 	unsigned long scan_status;
- 	struct brcmf_pub *pub;
- 	u32 channel;
--	bool active_scan;
- 	u32 int_escan_map;
- 	bool ibss_starter;
- 	bool pwr_save;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -692,10 +692,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
- 
- 	/* determine the scan engine parameters */
- 	sparams->bss_type = DOT11_BSSTYPE_ANY;
--	if (p2p->cfg->active_scan)
--		sparams->scan_type = 0;
--	else
--		sparams->scan_type = 1;
-+	sparams->scan_type = BRCMF_SCANTYPE_ACTIVE;
- 
- 	eth_broadcast_addr(sparams->bssid);
- 	sparams->home_time = cpu_to_le32(P2PAPI_SCAN_HOME_TIME_MS);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch b/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
deleted file mode 100644
index 3ad6e79db7..0000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From bd99a3013bdc00f8fc7534c657b39616792b4467 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:37 +0100
-Subject: [PATCH] brcmfmac: move configuration of probe request IEs
-
-The configuration of the IEs for probe requests was done in a P2P
-related function, which is not very obvious. Moving it to
-.scan callback function, ie. brcmf_cfg80211_scan().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      | 6 ++----
- 2 files changed, 7 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1108,6 +1108,11 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
- 	if (err)
- 		goto scan_out;
- 
-+	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
-+				    request->ie, request->ie_len);
-+	if (err)
-+		goto scan_out;
-+
- 	err = brcmf_do_escan(vif->ifp, request);
- 	if (err)
- 		goto scan_out;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -881,7 +881,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct brcmf_p2p_info *p2p = &cfg->p2p;
--	int err = 0;
-+	int err;
- 
- 	if (brcmf_p2p_scan_is_p2p_request(request)) {
- 		/* find my listen channel */
-@@ -904,9 +904,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
- 		/* override .run_escan() callback. */
- 		cfg->escan_info.run = brcmf_p2p_run_escan;
- 	}
--	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
--				    request->ie, request->ie_len);
--	return err;
-+	return 0;
- }
- 
- 
diff --git a/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch b/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
deleted file mode 100644
index 2cd5f73126..0000000000
--- a/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
+++ /dev/null
@@ -1,434 +0,0 @@
-From fdd0bd88ceaecf729db103ac8836af5805dd2dc1 Mon Sep 17 00:00:00 2001
-From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Date: Fri, 10 Nov 2017 17:27:15 +0800
-Subject: [PATCH] brcmfmac: add CLM download support
-
-The firmware for brcmfmac devices includes information regarding
-regulatory constraints. For certain devices this information is kept
-separately in a binary form that needs to be downloaded to the device.
-This patch adds support to download this so-called CLM blob file. It
-uses the same naming scheme as the other firmware files with extension
-of .clm_blob.
-
-The CLM blob file is optional. If the file does not exist, the download
-process will be bypassed. It will not affect the driver loading.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  10 ++
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 157 +++++++++++++++++++++
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   2 +
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |   2 +
- .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  31 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  19 +++
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  19 +++
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  18 +++
- 8 files changed, 258 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -71,6 +71,7 @@ struct brcmf_bus_dcmd {
-  * @wowl_config: specify if dongle is configured for wowl when going to suspend
-  * @get_ramsize: obtain size of device memory.
-  * @get_memdump: obtain device memory dump in provided buffer.
-+ * @get_fwname: obtain firmware name.
-  *
-  * This structure provides an abstract interface towards the
-  * bus specific driver. For control messages to common driver
-@@ -87,6 +88,8 @@ struct brcmf_bus_ops {
- 	void (*wowl_config)(struct device *dev, bool enabled);
- 	size_t (*get_ramsize)(struct device *dev);
- 	int (*get_memdump)(struct device *dev, void *data, size_t len);
-+	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
-+			  unsigned char *fw_name);
- };
- 
- 
-@@ -224,6 +227,13 @@ int brcmf_bus_get_memdump(struct brcmf_b
- 	return bus->ops->get_memdump(bus->dev, data, len);
- }
- 
-+static inline
-+int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
-+			 unsigned char *fw_name)
-+{
-+	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
-+}
-+
- /*
-  * interface functions from common layer
-  */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -18,6 +18,7 @@
- #include <linux/string.h>
- #include <linux/netdevice.h>
- #include <linux/module.h>
-+#include <linux/firmware.h>
- #include <brcmu_wifi.h>
- #include <brcmu_utils.h>
- #include "core.h"
-@@ -28,6 +29,7 @@
- #include "tracepoint.h"
- #include "common.h"
- #include "of.h"
-+#include "firmware.h"
- 
- MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-@@ -104,12 +106,140 @@ void brcmf_c_set_joinpref_default(struct
- 		brcmf_err("Set join_pref error (%d)\n", err);
- }
- 
-+static int brcmf_c_download(struct brcmf_if *ifp, u16 flag,
-+			    struct brcmf_dload_data_le *dload_buf,
-+			    u32 len)
-+{
-+	s32 err;
-+
-+	flag |= (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT);
-+	dload_buf->flag = cpu_to_le16(flag);
-+	dload_buf->dload_type = cpu_to_le16(DL_TYPE_CLM);
-+	dload_buf->len = cpu_to_le32(len);
-+	dload_buf->crc = cpu_to_le32(0);
-+	len = sizeof(*dload_buf) + len - 1;
-+
-+	err = brcmf_fil_iovar_data_set(ifp, "clmload", dload_buf, len);
-+
-+	return err;
-+}
-+
-+static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
-+{
-+	struct brcmf_bus *bus = ifp->drvr->bus_if;
-+	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
-+	u8 fw_name[BRCMF_FW_NAME_LEN];
-+	u8 *ptr;
-+	size_t len;
-+	s32 err;
-+
-+	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
-+	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
-+	if (err) {
-+		brcmf_err("get firmware name failed (%d)\n", err);
-+		goto done;
-+	}
-+
-+	/* generate CLM blob file name */
-+	ptr = strrchr(fw_name, '.');
-+	if (!ptr) {
-+		err = -ENOENT;
-+		goto done;
-+	}
-+
-+	len = ptr - fw_name + 1;
-+	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
-+		err = -E2BIG;
-+	} else {
-+		strlcpy(clm_name, fw_name, len);
-+		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
-+	}
-+done:
-+	return err;
-+}
-+
-+static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
-+{
-+	struct device *dev = ifp->drvr->bus_if->dev;
-+	struct brcmf_dload_data_le *chunk_buf;
-+	const struct firmware *clm = NULL;
-+	u8 clm_name[BRCMF_FW_NAME_LEN];
-+	u32 chunk_len;
-+	u32 datalen;
-+	u32 cumulative_len;
-+	u16 dl_flag = DL_BEGIN;
-+	u32 status;
-+	s32 err;
-+
-+	brcmf_dbg(TRACE, "Enter\n");
-+
-+	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
-+	err = brcmf_c_get_clm_name(ifp, clm_name);
-+	if (err) {
-+		brcmf_err("get CLM blob file name failed (%d)\n", err);
-+		return err;
-+	}
-+
-+	err = request_firmware(&clm, clm_name, dev);
-+	if (err) {
-+		if (err == -ENOENT) {
-+			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
-+			return 0;
-+		}
-+		brcmf_err("request CLM blob file failed (%d)\n", err);
-+		return err;
-+	}
-+
-+	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
-+	if (!chunk_buf) {
-+		err = -ENOMEM;
-+		goto done;
-+	}
-+
-+	datalen = clm->size;
-+	cumulative_len = 0;
-+	do {
-+		if (datalen > MAX_CHUNK_LEN) {
-+			chunk_len = MAX_CHUNK_LEN;
-+		} else {
-+			chunk_len = datalen;
-+			dl_flag |= DL_END;
-+		}
-+		memcpy(chunk_buf->data, clm->data + cumulative_len, chunk_len);
-+
-+		err = brcmf_c_download(ifp, dl_flag, chunk_buf, chunk_len);
-+
-+		dl_flag &= ~DL_BEGIN;
-+
-+		cumulative_len += chunk_len;
-+		datalen -= chunk_len;
-+	} while ((datalen > 0) && (err == 0));
-+
-+	if (err) {
-+		brcmf_err("clmload (%zu byte file) failed (%d); ",
-+			  clm->size, err);
-+		/* Retrieve clmload_status and print */
-+		err = brcmf_fil_iovar_int_get(ifp, "clmload_status", &status);
-+		if (err)
-+			brcmf_err("get clmload_status failed (%d)\n", err);
-+		else
-+			brcmf_dbg(INFO, "clmload_status=%d\n", status);
-+		err = -EIO;
-+	}
-+
-+	kfree(chunk_buf);
-+done:
-+	release_firmware(clm);
-+	return err;
-+}
-+
- int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
- {
- 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
- 	u8 buf[BRCMF_DCMD_SMLEN];
- 	struct brcmf_rev_info_le revinfo;
- 	struct brcmf_rev_info *ri;
-+	char *clmver;
- 	char *ptr;
- 	s32 err;
- 
-@@ -148,6 +278,13 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	}
- 	ri->result = err;
- 
-+	/* Do any CLM downloading */
-+	err = brcmf_c_process_clm_blob(ifp);
-+	if (err < 0) {
-+		brcmf_err("download CLM blob file failed, %d\n", err);
-+		goto done;
-+	}
-+
- 	/* query for 'ver' to get version info from firmware */
- 	memset(buf, 0, sizeof(buf));
- 	strcpy(buf, "ver");
-@@ -167,6 +304,26 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	ptr = strrchr(buf, ' ') + 1;
- 	strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
- 
-+	/* Query for 'clmver' to get CLM version info from firmware */
-+	memset(buf, 0, sizeof(buf));
-+	err = brcmf_fil_iovar_data_get(ifp, "clmver", buf, sizeof(buf));
-+	if (err) {
-+		brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
-+	} else {
-+		clmver = (char *)buf;
-+		/* store CLM version for adding it to revinfo debugfs file */
-+		memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
-+
-+		/* Replace all newline/linefeed characters with space
-+		 * character
-+		 */
-+		ptr = clmver;
-+		while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
-+			*ptr = ' ';
-+
-+		brcmf_dbg(INFO, "CLM version = %s\n", clmver);
-+	}
-+
- 	/* set mpc */
- 	err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
- 	if (err) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1009,6 +1009,8 @@ static int brcmf_revinfo_read(struct seq
- 	seq_printf(s, "anarev: %u\n", ri->anarev);
- 	seq_printf(s, "nvramrev: %08x\n", ri->nvramrev);
- 
-+	seq_printf(s, "clmver: %s\n", bus_if->drvr->clmver);
-+
- 	return 0;
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -141,6 +141,8 @@ struct brcmf_pub {
- 	struct notifier_block inetaddr_notifier;
- 	struct notifier_block inet6addr_notifier;
- 	struct brcmf_mp_device *settings;
-+
-+	u8 clmver[BRCMF_DCMD_SMLEN];
- };
- 
- /* forward declarations */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -155,6 +155,21 @@
- #define BRCMF_MFP_CAPABLE		1
- #define BRCMF_MFP_REQUIRED		2
- 
-+/* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
-+ * ioctl. It is relatively small because firmware has small maximum size input
-+ * playload restriction for ioctls.
-+ */
-+#define MAX_CHUNK_LEN			1400
-+
-+#define DLOAD_HANDLER_VER		1	/* Downloader version */
-+#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
-+#define DLOAD_FLAG_VER_SHIFT		12	/* Downloader version shift */
-+
-+#define DL_BEGIN			0x0002
-+#define DL_END				0x0004
-+
-+#define DL_TYPE_CLM			2
-+
- /* join preference types for join_pref iovar */
- enum brcmf_join_pref_types {
- 	BRCMF_JOIN_PREF_RSSI = 1,
-@@ -827,6 +842,22 @@ struct brcmf_pno_macaddr_le {
- };
- 
- /**
-+ * struct brcmf_dload_data_le - data passing to firmware for downloading
-+ * @flag: flags related to download data.
-+ * @dload_type: type of download data.
-+ * @len: length in bytes of download data.
-+ * @crc: crc of download data.
-+ * @data: download data.
-+ */
-+struct brcmf_dload_data_le {
-+	__le16 flag;
-+	__le16 dload_type;
-+	__le32 len;
-+	__le32 crc;
-+	u8 data[1];
-+};
-+
-+/**
-  * struct brcmf_pno_bssid_le - bssid configuration for PNO scan.
-  *
-  * @bssid: BSS network identifier.
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1350,6 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
- 	return 0;
- }
- 
-+static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
-+				 u8 *fw_name)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
-+	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
-+	int ret = 0;
-+
-+	if (devinfo->fw_name[0] != '\0')
-+		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
-+	else
-+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
-+						brcmf_pcie_fwnames,
-+						ARRAY_SIZE(brcmf_pcie_fwnames),
-+						fw_name, NULL);
-+
-+	return ret;
-+}
- 
- static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
- 	.txdata = brcmf_pcie_tx,
-@@ -1359,6 +1377,7 @@ static const struct brcmf_bus_ops brcmf_
- 	.wowl_config = brcmf_pcie_wowl_config,
- 	.get_ramsize = brcmf_pcie_get_ramsize,
- 	.get_memdump = brcmf_pcie_get_memdump,
-+	.get_fwname = brcmf_pcie_get_fwname,
- };
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3985,6 +3985,24 @@ brcmf_sdio_watchdog(unsigned long data)
- 	}
- }
- 
-+static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
-+				 u8 *fw_name)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-+	int ret = 0;
-+
-+	if (sdiodev->fw_name[0] != '\0')
-+		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
-+	else
-+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
-+						brcmf_sdio_fwnames,
-+						ARRAY_SIZE(brcmf_sdio_fwnames),
-+						fw_name, NULL);
-+
-+	return ret;
-+}
-+
- static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
- 	.stop = brcmf_sdio_bus_stop,
- 	.preinit = brcmf_sdio_bus_preinit,
-@@ -3995,6 +4013,7 @@ static const struct brcmf_bus_ops brcmf_
- 	.wowl_config = brcmf_sdio_wowl_config,
- 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
- 	.get_memdump = brcmf_sdio_bus_get_memdump,
-+	.get_fwname = brcmf_sdio_get_fwname,
- };
- 
- static void brcmf_sdio_firmware_callback(struct device *dev, int err,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1128,12 +1128,30 @@ static void brcmf_usb_wowl_config(struct
- 		device_set_wakeup_enable(devinfo->dev, false);
- }
- 
-+static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
-+				u8 *fw_name)
-+{
-+	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
-+	int ret = 0;
-+
-+	if (devinfo->fw_name[0] != '\0')
-+		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
-+	else
-+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
-+						brcmf_usb_fwnames,
-+						ARRAY_SIZE(brcmf_usb_fwnames),
-+						fw_name, NULL);
-+
-+	return ret;
-+}
-+
- static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
- 	.txdata = brcmf_usb_tx,
- 	.stop = brcmf_usb_down,
- 	.txctl = brcmf_usb_tx_ctlpkt,
- 	.rxctl = brcmf_usb_rx_ctlpkt,
- 	.wowl_config = brcmf_usb_wowl_config,
-+	.get_fwname = brcmf_usb_get_fwname,
- };
- 
- static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
diff --git a/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch b/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
deleted file mode 100644
index 3649bdda49..0000000000
--- a/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 5c3de777bdaf48bd0cfb43097c0d0fb85056cab7 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Sat, 25 Nov 2017 21:39:25 +0100
-Subject: [PATCH] brcmfmac: change driver unbind order of the sdio function
- devices
-
-In the function brcmf_sdio_firmware_callback() the driver is
-unbound from the sdio function devices in the error path.
-However, the order in which it is done resulted in a use-after-free
-issue (see brcmf_ops_sdio_remove() in bcmsdh.c). Hence change
-the order and first unbind sdio function #2 device and then
-unbind sdio function #1 device.
-
-Cc: stable@vger.kernel.org # v4.12.x
-Fixes: 7a51461fc2da ("brcmfmac: unbind all devices upon failure in firmware callback")
-Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4121,8 +4121,8 @@ release:
- 	sdio_release_host(sdiodev->func[1]);
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
--	device_release_driver(dev);
- 	device_release_driver(&sdiodev->func[2]->dev);
-+	device_release_driver(dev);
- }
- 
- struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch b/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
deleted file mode 100644
index 7344580d34..0000000000
--- a/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 51ef7925e10688c57186d438e784532e063492e4 Mon Sep 17 00:00:00 2001
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Date: Thu, 23 Nov 2017 17:57:04 +0200
-Subject: [PATCH] brcmfmac: Avoid build error with make W=1
-
-When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for
-the first run, all next ones are okay.
-
-  CC [M]  drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
-scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed
-
-Seems like something happened with W=1 and wrong kernel doc format.
-As a quick fix remove dubious /** in the code.
-
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -2070,7 +2070,7 @@ static int brcmf_sdio_txpkt_hdalign(stru
- 	return head_pad;
- }
- 
--/**
-+/*
-  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
-  * bus layer usage.
-  */
diff --git a/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch b/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
deleted file mode 100644
index ead5e72145..0000000000
--- a/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From cc124d5cc8d81985c3511892d7a6d546552ff754 Mon Sep 17 00:00:00 2001
-From: Wright Feng <wright.feng@cypress.com>
-Date: Tue, 16 Jan 2018 17:26:50 +0800
-Subject: [PATCH] brcmfmac: fix CLM load error for legacy chips when user
- helper is enabled
-
-For legacy chips without CLM blob files, kernel with user helper function
-returns -EAGAIN when we request_firmware(), and then driver got failed
-when bringing up legacy chips. We expect the CLM blob file for legacy chip
-is not existence in firmware path, but the -ENOENT error is transferred to
--EAGAIN in firmware_class.c with user helper.
-Because of that, we continue with CLM data currently present in firmware
-if getting error from doing request_firmware().
-
-Cc: stable@vger.kernel.org # v4.15.y
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -182,12 +182,9 @@ static int brcmf_c_process_clm_blob(stru
- 
- 	err = request_firmware(&clm, clm_name, dev);
- 	if (err) {
--		if (err == -ENOENT) {
--			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
--			return 0;
--		}
--		brcmf_err("request CLM blob file failed (%d)\n", err);
--		return err;
-+		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
-+			   err);
-+		return 0;
- 	}
- 
- 	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch b/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
deleted file mode 100644
index 703051fe19..0000000000
--- a/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 9df7ddc3ed25b7d3473f117a0680b9418adb5753 Mon Sep 17 00:00:00 2001
-Message-Id: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 27 Nov 2017 18:56:22 +0100
-Subject: [PATCH 1/2] ath9k: move spectral scan support under a separate config
- symbol
-
-At the moment, spectral scan support, and with it RELAY, is always enabled
-with ATH9K[_HTC]_DEBUGFS. Spectral scan support is currently the only user
-of RELAY in ath9k, and it unconditionally reserves a relay channel.
-
-Having debugfs support in ath9k is often useful even on very small embedded
-routers, where we'd rather like to avoid the code size and RAM usage of the
-relay support.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath9k/Kconfig           | 14 ++++++++++----
- drivers/net/wireless/ath/ath9k/Makefile          |  4 ++--
- drivers/net/wireless/ath/ath9k/common-spectral.h |  4 ++--
- 3 files changed, 14 insertions(+), 8 deletions(-)
-
---- a/drivers/net/wireless/ath/ath9k/Kconfig
-+++ b/drivers/net/wireless/ath/ath9k/Kconfig
-@@ -64,13 +64,12 @@ config ATH9K_DEBUGFS
- 	depends on ATH9K && DEBUG_FS
- 	select MAC80211_DEBUGFS
- 	select ATH9K_COMMON_DEBUG
--	depends on RELAY
- 	---help---
- 	  Say Y, if you need access to ath9k's statistics for
- 	  interrupts, rate control, etc.
- 
--	  Also required for changing debug message flags at run time.
--	  As well as access to the FFT/spectral data and TX99.
-+	  Also required for changing debug message flags at run time and for
-+	  TX99.
- 
- config ATH9K_STATION_STATISTICS
- 	bool "Detailed station statistics"
-@@ -181,7 +180,6 @@ config ATH9K_HTC_DEBUGFS
- 	bool "Atheros ath9k_htc debugging"
- 	depends on ATH9K_HTC && DEBUG_FS
- 	select ATH9K_COMMON_DEBUG
--	depends on RELAY
- 	---help---
- 	  Say Y, if you need access to ath9k_htc's statistics.
- 	  As well as access to the FFT/spectral data.
-@@ -197,3 +195,11 @@ config ATH9K_HWRNG
- 
- 	  Say Y, feeds the entropy directly from the WiFi driver to the input
- 	  pool.
-+
-+config ATH9K_COMMON_SPECTRAL
-+	bool "Atheros ath9k/ath9k_htc spectral scan support"
-+	depends on ATH9K_DEBUGFS || ATH9K_HTC_DEBUGFS
-+	depends on RELAY
-+	default n
-+	---help---
-+	  Say Y to enable access to the FFT/spectral data via debugfs.
---- a/drivers/net/wireless/ath/ath9k/Makefile
-+++ b/drivers/net/wireless/ath/ath9k/Makefile
-@@ -61,8 +61,8 @@ ath9k_common-y:=	common.o \
- 			common-init.o \
- 			common-beacon.o \
- 
--ath9k_common-$(CPTCFG_ATH9K_COMMON_DEBUG) += common-debug.o \
--					     common-spectral.o
-+ath9k_common-$(CPTCFG_ATH9K_COMMON_DEBUG) += common-debug.o
-+ath9k_common-$(CPTCFG_ATH9K_COMMON_SPECTRAL) += common-spectral.o
- 
- ath9k_htc-y +=	htc_hst.o \
- 		hif_usb.o \
---- a/drivers/net/wireless/ath/ath9k/common-spectral.h
-+++ b/drivers/net/wireless/ath/ath9k/common-spectral.h
-@@ -151,7 +151,7 @@ static inline u8 spectral_bitmap_weight(
- 	return bins[0] & 0x3f;
- }
- 
--#ifdef CPTCFG_ATH9K_COMMON_DEBUG
-+#ifdef CPTCFG_ATH9K_COMMON_SPECTRAL
- void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, struct dentry *debugfs_phy);
- void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv);
- 
-@@ -183,6 +183,6 @@ static inline int ath_cmn_process_fft(st
- {
- 	return 0;
- }
--#endif /* CPTCFG_ATH9K_COMMON_DEBUG */
-+#endif /* CPTCFG_ATH9K_COMMON_SPECTRAL */
- 
- #endif /* SPECTRAL_H */
---- a/local-symbols
-+++ b/local-symbols
-@@ -116,6 +116,7 @@ ATH9K_PCOEM=
- ATH9K_HTC=
- ATH9K_HTC_DEBUGFS=
- ATH9K_HWRNG=
-+ATH9K_COMMON_SPECTRAL=
- CARL9170=
- CARL9170_LEDS=
- CARL9170_DEBUGFS=
diff --git a/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch b/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
deleted file mode 100644
index 604a6f1585..0000000000
--- a/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 42e01cb9cb109fb0bb4743f6c54d6aa67ac39b61 Mon Sep 17 00:00:00 2001
-Message-Id: <42e01cb9cb109fb0bb4743f6c54d6aa67ac39b61.1515610034.git.mschiffer@universe-factory.net>
-In-Reply-To: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
-References: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 27 Nov 2017 18:56:23 +0100
-Subject: [PATCH 2/2] ath10k: move spectral scan support under a separate
- config symbol
-
-At the moment, spectral scan support, and with it RELAY, is always enabled
-with ATH10K_DEBUGFS. Spectral scan support is currently the only user of
-RELAY in ath10k, and it unconditionally reserves a relay channel.
-
-Having debugfs support in ath10k is often useful even on very small
-embedded routers, where we'd rather like to avoid the code size and RAM
-usage of the relay support. While ath10k-based devices usually have more
-resources than ath9k-based ones, it makes sense to keep the configuration
-symmetric to ath9k, so the same base kernel without RELAY can be used for
-both ath9k and ath10k hardware.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/Kconfig    | 9 ++++++++-
- drivers/net/wireless/ath/ath10k/Makefile   | 2 +-
- drivers/net/wireless/ath/ath10k/spectral.h | 4 ++--
- 3 files changed, 11 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/Kconfig
-+++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -51,12 +51,19 @@ config ATH10K_DEBUG
- config ATH10K_DEBUGFS
- 	bool "Atheros ath10k debugfs support"
- 	depends on ATH10K && DEBUG_FS
--	depends on RELAY
- 	---help---
- 	  Enabled debugfs support
- 
- 	  If unsure, say Y to make it easier to debug problems.
- 
-+config ATH10K_SPECTRAL
-+	bool "Atheros ath10k spectral scan support"
-+	depends on ATH10K_DEBUGFS
-+	depends on RELAY
-+	default n
-+	---help---
-+	  Say Y to enable access to the FFT/spectral data via debugfs.
-+
- config ATH10K_TRACING
- 	depends on !KERNEL_3_4
- 	bool "Atheros ath10k tracing support"
---- a/drivers/net/wireless/ath/ath10k/Makefile
-+++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -14,7 +14,7 @@ ath10k_core-y += mac.o \
- 		 p2p.o \
- 		 swap.o
- 
--ath10k_core-$(CPTCFG_ATH10K_DEBUGFS) += spectral.o
-+ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) += spectral.o
- ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
- ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
- ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
---- a/drivers/net/wireless/ath/ath10k/spectral.h
-+++ b/drivers/net/wireless/ath/ath10k/spectral.h
-@@ -44,7 +44,7 @@ enum ath10k_spectral_mode {
- 	SPECTRAL_MANUAL,
- };
- 
--#ifdef CPTCFG_ATH10K_DEBUGFS
-+#ifdef CPTCFG_ATH10K_SPECTRAL
- 
- int ath10k_spectral_process_fft(struct ath10k *ar,
- 				struct wmi_phyerr_ev_arg *phyerr,
-@@ -85,6 +85,6 @@ static inline void ath10k_spectral_destr
- {
- }
- 
--#endif /* CPTCFG_ATH10K_DEBUGFS */
-+#endif /* CPTCFG_ATH10K_SPECTRAL */
- 
- #endif /* SPECTRAL_H */
---- a/local-symbols
-+++ b/local-symbols
-@@ -140,6 +140,7 @@ ATH10K_SDIO=
- ATH10K_USB=
- ATH10K_DEBUG=
- ATH10K_DEBUGFS=
-+ATH10K_SPECTRAL=
- ATH10K_TRACING=
- ATH10K_DFS_CERTIFIED=
- WCN36XX=
diff --git a/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch b/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
deleted file mode 100644
index b2b2fcf4aa..0000000000
--- a/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 17 Jan 2018 11:11:17 +0100
-Subject: [PATCH] ath9k: discard undersized packets
-
-Sometimes the hardware will push small packets that trigger a WARN_ON
-in mac80211. Discard them early to avoid this issue.
-
-Reported-by: Stijn Tintel <stijn@linux-ipv6.be>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -826,9 +826,9 @@ static int ath9k_rx_skb_preprocess(struc
- 	sc->rx.discard_next = false;
- 
- 	/*
--	 * Discard zero-length packets.
-+	 * Discard zero-length packets and packets smaller than an ACK
- 	 */
--	if (!rx_stats->rs_datalen) {
-+	if (rx_stats->rs_datalen < 10) {
- 		RX_STAT_INC(rx_len_err);
- 		goto corrupt;
- 	}
diff --git a/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch b/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
deleted file mode 100644
index 616a82119f..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 1fd3ae124d5e675f57cf7e3c601fb8f7712e0329 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:38 +0100
-Subject: [PATCH] brcmfmac: Fix parameter order in brcmf_sdiod_f0_writeb()
-
-All the other IO functions are the other way round in this
-driver. Make this one match.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -230,8 +230,8 @@ void brcmf_sdiod_change_state(struct brc
- 	sdiodev->state = state;
- }
- 
--static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func,
--					uint regaddr, u8 byte)
-+static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
-+					uint regaddr)
- {
- 	int err_ret;
- 
-@@ -269,8 +269,8 @@ static int brcmf_sdiod_request_data(stru
- 			if (fn)
- 				sdio_writeb(func, *(u8 *)data, addr, &ret);
- 			else
--				ret = brcmf_sdiod_f0_writeb(func, addr,
--							    *(u8 *)data);
-+				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
-+							    addr);
- 		} else {
- 			if (fn)
- 				*(u8 *)data = sdio_readb(func, addr, &ret);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch b/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
deleted file mode 100644
index 719268f8fe..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 1e6f676f43aa4270ebc5cff8e32a55f72362e042 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:39 +0100
-Subject: [PATCH] brcmfmac: Register sizes on hardware are not dependent on
- compiler types
-
-The 4 IO functions in this patch are incorrect as they use compiler types
-to determine how many bytes to send to the hardware.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -264,7 +264,7 @@ static int brcmf_sdiod_request_data(stru
- 	func = sdiodev->func[fn];
- 
- 	switch (regsz) {
--	case sizeof(u8):
-+	case 1:
- 		if (write) {
- 			if (fn)
- 				sdio_writeb(func, *(u8 *)data, addr, &ret);
-@@ -278,13 +278,13 @@ static int brcmf_sdiod_request_data(stru
- 				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
- 		}
- 		break;
--	case sizeof(u16):
-+	case 2:
- 		if (write)
- 			sdio_writew(func, *(u16 *)data, addr, &ret);
- 		else
- 			*(u16 *)data = sdio_readw(func, addr, &ret);
- 		break;
--	case sizeof(u32):
-+	case 4:
- 		if (write)
- 			sdio_writel(func, *(u32 *)data, addr, &ret);
- 		else
-@@ -368,7 +368,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
- 	for (i = 0; i < 3; i++) {
- 		err = brcmf_sdiod_regrw_helper(sdiodev,
- 					       SBSDIO_FUNC1_SBADDRLOW + i,
--					       sizeof(u8), &addr[i], true);
-+					       1, &addr[i], true);
- 		if (err) {
- 			brcmf_err("failed at addr: 0x%0x\n",
- 				  SBSDIO_FUNC1_SBADDRLOW + i);
-@@ -407,7 +407,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
- 					  false);
- 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
- 
-@@ -423,10 +423,10 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
- 					  false);
- 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
-@@ -443,7 +443,7 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
- 					  true);
- 	if (ret)
- 		*ret = retval;
-@@ -455,10 +455,10 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
--	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
- 					  true);
- 
- done:
-@@ -876,7 +876,7 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
- 
- 	/* issue abort cmd52 command through F0 */
- 	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
--				 sizeof(t_func), &t_func, true);
-+				 1, &t_func, true);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
diff --git a/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch b/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
deleted file mode 100644
index b04465ae4f..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
+++ /dev/null
@@ -1,179 +0,0 @@
-From 0fcc9fe0048422d66bb906eaa73cc75e11ff7345 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:40 +0100
-Subject: [PATCH] brcmfmac: Split brcmf_sdiod_regrw_helper() up.
-
-This large function is concealing a LOT of obscure logic about
-how the hardware functions. Time to split it up.
-
-This first patch splits the function into two pieces - read and write,
-doing away with the rw flag in the process.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 94 +++++++++++++++++-----
- 1 file changed, 73 insertions(+), 21 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -302,8 +302,8 @@ static int brcmf_sdiod_request_data(stru
- 	return ret;
- }
- 
--static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
--				   u8 regsz, void *data, bool write)
-+static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
-+				 u8 regsz, void *data)
- {
- 	u8 func;
- 	s32 retry = 0;
-@@ -324,13 +324,66 @@ static int brcmf_sdiod_regrw_helper(stru
- 		func = SDIO_FUNC_1;
- 
- 	do {
--		if (!write)
--			memset(data, 0, regsz);
- 		/* for retry wait for 1 ms till bus get settled down */
- 		if (retry)
- 			usleep_range(1000, 2000);
-+
-+		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
-+					       data, true);
-+
-+	} while (ret != 0 && ret != -ENOMEDIUM &&
-+		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-+
-+	if (ret == -ENOMEDIUM) {
-+		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+	} else if (ret != 0) {
-+		/*
-+		 * SleepCSR register access can fail when
-+		 * waking up the device so reduce this noise
-+		 * in the logs.
-+		 */
-+		if (addr != SBSDIO_FUNC1_SLEEPCSR)
-+			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
-+		else
-+			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
-+	}
-+
-+	return ret;
-+}
-+
-+static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
-+				u8 regsz, void *data)
-+{
-+	u8 func;
-+	s32 retry = 0;
-+	int ret;
-+
-+	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
-+		return -ENOMEDIUM;
-+
-+	/*
-+	 * figure out how to read the register based on address range
-+	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
-+	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
-+	 * The rest: function 1 silicon backplane core registers
-+	 */
-+	if ((addr & ~REG_F0_REG_MASK) == 0)
-+		func = SDIO_FUNC_0;
-+	else
-+		func = SDIO_FUNC_1;
-+
-+	do {
-+		memset(data, 0, regsz);
-+
-+		/* for retry wait for 1 ms till bus get settled down */
-+		if (retry)
-+			usleep_range(1000, 2000);
-+
- 		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
--					       data, write);
-+					       data, false);
-+
- 	} while (ret != 0 && ret != -ENOMEDIUM &&
- 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
- 
-@@ -343,12 +396,13 @@ static int brcmf_sdiod_regrw_helper(stru
- 		 * in the logs.
- 		 */
- 		if (addr != SBSDIO_FUNC1_SLEEPCSR)
--			brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
--				  write ? "write" : "read", func, addr, ret);
-+			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
- 		else
--			brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
--				  write ? "write" : "read", func, addr, ret);
-+			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
- 	}
-+
- 	return ret;
- }
- 
-@@ -366,13 +420,11 @@ brcmf_sdiod_set_sbaddr_window(struct brc
- 	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
- 
- 	for (i = 0; i < 3; i++) {
--		err = brcmf_sdiod_regrw_helper(sdiodev,
--					       SBSDIO_FUNC1_SBADDRLOW + i,
--					       1, &addr[i], true);
-+		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
-+				  &err);
- 		if (err) {
- 			brcmf_err("failed at addr: 0x%0x\n",
- 				  SBSDIO_FUNC1_SBADDRLOW + i);
--			break;
- 		}
- 	}
- 
-@@ -407,8 +459,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
--					  false);
-+	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
- 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
- 
- 	if (ret)
-@@ -426,8 +477,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
--					  false);
-+
-+	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
-+
- 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
- done:
-@@ -443,8 +495,8 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
--					  true);
-+	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
-+
- 	if (ret)
- 		*ret = retval;
- }
-@@ -458,8 +510,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
--					  true);
-+
-+	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
- 
- done:
- 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch b/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
deleted file mode 100644
index 1f0488a621..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From b9b0d290bc0c90a5a262bc89c9d995988ea98669 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:41 +0100
-Subject: [PATCH] brcmfmac: Clean up brcmf_sdiod_set_sbaddr_window()
-
-This function sets the address of the IO window used for
-SDIO accesses onto the backplane of the chip.
-
-It currently uses 3 separate masks despite the full mask being
-defined in the code already. Remove the separate masks and clean up.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c   | 17 +++++------------
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h |  3 ---
- 2 files changed, 5 insertions(+), 15 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -410,23 +410,16 @@ static int
- brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
- {
- 	int err = 0, i;
--	u8 addr[3];
-+	u32 addr;
- 
- 	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
- 		return -ENOMEDIUM;
- 
--	addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
--	addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
--	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
-+	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
- 
--	for (i = 0; i < 3; i++) {
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
--				  &err);
--		if (err) {
--			brcmf_err("failed at addr: 0x%0x\n",
--				  SBSDIO_FUNC1_SBADDRLOW + i);
--		}
--	}
-+	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
-+		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
-+				  addr & 0xff, &err);
- 
- 	return err;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -133,9 +133,6 @@
- 
- /* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
- 
--#define SBSDIO_SBADDRLOW_MASK		0x80	/* Valid bits in SBADDRLOW */
--#define SBSDIO_SBADDRMID_MASK		0xff	/* Valid bits in SBADDRMID */
--#define SBSDIO_SBADDRHIGH_MASK		0xffU	/* Valid bits in SBADDRHIGH */
- /* Address bits from SBADDR regs */
- #define SBSDIO_SBWINDOW_MASK		0xffff8000
- 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch b/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
deleted file mode 100644
index 7d50ce923d..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From ea243e9077b3545f20d93884e91c50ac0719685a Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:42 +0100
-Subject: [PATCH] brcmfmac: Remove dead IO code
-
-The value passed to brcmf_sdiod_addrprep() is *always* 4
-remove this parameter and the unused code to handle it.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 18 ++++++++----------
- 1 file changed, 8 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -425,7 +425,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
- }
- 
- static int
--brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
-+brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
- {
- 	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
- 	int err = 0;
-@@ -439,9 +439,7 @@ brcmf_sdiod_addrprep(struct brcmf_sdio_d
- 	}
- 
- 	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
--
--	if (width == 4)
--		*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	return 0;
- }
-@@ -467,7 +465,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (retval)
- 		goto done;
- 
-@@ -500,7 +498,7 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
--	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (retval)
- 		goto done;
- 
-@@ -736,7 +734,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (err)
- 		goto done;
- 
-@@ -757,7 +755,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
- 		  addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (err)
- 		goto done;
- 
-@@ -801,7 +799,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 
- 	memcpy(mypkt->data, buf, nbytes);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
- 	if (!err)
- 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
-@@ -821,7 +819,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (err)
- 		return err;
- 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch b/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
deleted file mode 100644
index fef29fc715..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 4a3338ba2a7421db2260159cca5a27bd2ee36d00 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:43 +0100
-Subject: [PATCH] brcmfmac: Remove bandaid for SleepCSR
-
-Register access code is not the place for band-aid fixes like this.
-If this is a genuine problem, it should be fixed further up in the driver
-stack.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 28 +---------------------
- 1 file changed, 1 insertion(+), 27 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -334,21 +334,8 @@ static int brcmf_sdiod_reg_write(struct
- 	} while (ret != 0 && ret != -ENOMEDIUM &&
- 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
- 
--	if (ret == -ENOMEDIUM) {
-+	if (ret == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
--	} else if (ret != 0) {
--		/*
--		 * SleepCSR register access can fail when
--		 * waking up the device so reduce this noise
--		 * in the logs.
--		 */
--		if (addr != SBSDIO_FUNC1_SLEEPCSR)
--			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--		else
--			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--	}
- 
- 	return ret;
- }
-@@ -389,19 +376,6 @@ static int brcmf_sdiod_reg_read(struct b
- 
- 	if (ret == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
--	else if (ret != 0) {
--		/*
--		 * SleepCSR register access can fail when
--		 * waking up the device so reduce this noise
--		 * in the logs.
--		 */
--		if (addr != SBSDIO_FUNC1_SLEEPCSR)
--			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--		else
--			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--	}
- 
- 	return ret;
- }
diff --git a/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch b/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
deleted file mode 100644
index 552f9fb443..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
+++ /dev/null
@@ -1,344 +0,0 @@
-From 993a98a42e6e790fd0d2bf7d55a031513c7ba7dc Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:44 +0100
-Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_request_data()
-
-This function is obfuscating how IO works on this chip. Remove it
-and push its logic into brcmf_sdiod_reg_{read,write}().
-
-Handling of -ENOMEDIUM is altered, but as that's pretty much broken anyway
-we can ignore that.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 237 ++++++++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   2 +-
- 2 files changed, 87 insertions(+), 152 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -230,6 +230,43 @@ void brcmf_sdiod_change_state(struct brc
- 	sdiodev->state = state;
- }
- 
-+static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
-+					 u32 address)
-+{
-+	int err = 0, i;
-+	u32 addr;
-+
-+	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
-+		return -ENOMEDIUM;
-+
-+	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
-+
-+	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
-+		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
-+				  addr & 0xff, &err);
-+
-+	return err;
-+}
-+
-+static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
-+{
-+	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
-+	int err = 0;
-+
-+	if (bar0 != sdiodev->sbwad) {
-+		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
-+		if (err)
-+			return err;
-+
-+		sdiodev->sbwad = bar0;
-+	}
-+
-+	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
-+	return 0;
-+}
-+
- static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
- 					uint regaddr)
- {
-@@ -249,173 +286,84 @@ static inline int brcmf_sdiod_f0_writeb(
- 	return err_ret;
- }
- 
--static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
--				    u32 addr, u8 regsz, void *data, bool write)
--{
--	struct sdio_func *func;
--	int ret = -EINVAL;
--
--	brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
--		  write, fn, addr, regsz);
--
--	/* only allow byte access on F0 */
--	if (WARN_ON(regsz > 1 && !fn))
--		return -EINVAL;
--	func = sdiodev->func[fn];
--
--	switch (regsz) {
--	case 1:
--		if (write) {
--			if (fn)
--				sdio_writeb(func, *(u8 *)data, addr, &ret);
--			else
--				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
--							    addr);
--		} else {
--			if (fn)
--				*(u8 *)data = sdio_readb(func, addr, &ret);
--			else
--				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
--		}
--		break;
--	case 2:
--		if (write)
--			sdio_writew(func, *(u16 *)data, addr, &ret);
--		else
--			*(u16 *)data = sdio_readw(func, addr, &ret);
--		break;
--	case 4:
--		if (write)
--			sdio_writel(func, *(u32 *)data, addr, &ret);
--		else
--			*(u32 *)data = sdio_readl(func, addr, &ret);
--		break;
--	default:
--		brcmf_err("invalid size: %d\n", regsz);
--		break;
--	}
--
--	if (ret)
--		brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
--			  write ? "write" : "read", fn, addr, ret);
--
--	return ret;
--}
--
- static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
- 				 u8 regsz, void *data)
- {
--	u8 func;
--	s32 retry = 0;
- 	int ret;
- 
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
--
- 	/*
- 	 * figure out how to read the register based on address range
- 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
- 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
- 	 * The rest: function 1 silicon backplane core registers
-+	 * f0 writes must be bytewise
- 	 */
--	if ((addr & ~REG_F0_REG_MASK) == 0)
--		func = SDIO_FUNC_0;
--	else
--		func = SDIO_FUNC_1;
--
--	do {
--		/* for retry wait for 1 ms till bus get settled down */
--		if (retry)
--			usleep_range(1000, 2000);
- 
--		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
--					       data, true);
--
--	} while (ret != 0 && ret != -ENOMEDIUM &&
--		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-+	if ((addr & ~REG_F0_REG_MASK) == 0) {
-+		if (WARN_ON(regsz > 1))
-+			return -EINVAL;
-+		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
-+					    *(u8 *)data, addr);
-+	} else {
-+		switch (regsz) {
-+		case 1:
-+			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
-+			break;
-+		case 4:
-+			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
-+			if (ret)
-+				goto done;
- 
--	if (ret == -ENOMEDIUM)
--		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
-+			break;
-+		default:
-+			WARN(1, "Invalid reg size\n");
-+			ret = -EINVAL;
-+			break;
-+		}
-+	}
- 
-+done:
- 	return ret;
- }
- 
- static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
- 				u8 regsz, void *data)
- {
--	u8 func;
--	s32 retry = 0;
- 	int ret;
- 
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
--
- 	/*
- 	 * figure out how to read the register based on address range
- 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
- 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
- 	 * The rest: function 1 silicon backplane core registers
-+	 * f0 reads must be bytewise
- 	 */
--	if ((addr & ~REG_F0_REG_MASK) == 0)
--		func = SDIO_FUNC_0;
--	else
--		func = SDIO_FUNC_1;
--
--	do {
--		memset(data, 0, regsz);
--
--		/* for retry wait for 1 ms till bus get settled down */
--		if (retry)
--			usleep_range(1000, 2000);
--
--		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
--					       data, false);
--
--	} while (ret != 0 && ret != -ENOMEDIUM &&
--		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
--
--	if (ret == -ENOMEDIUM)
--		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
--
--	return ret;
--}
--
--static int
--brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
--{
--	int err = 0, i;
--	u32 addr;
--
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
--
--	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
--
--	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
--				  addr & 0xff, &err);
--
--	return err;
--}
--
--static int
--brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
--{
--	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
--	int err = 0;
--
--	if (bar0 != sdiodev->sbwad) {
--		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
--		if (err)
--			return err;
-+	if ((addr & ~REG_F0_REG_MASK) == 0) {
-+		if (WARN_ON(regsz > 1))
-+			return -EINVAL;
-+		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
-+	} else {
-+		switch (regsz) {
-+		case 1:
-+			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
-+			break;
-+		case 4:
-+			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
-+			if (ret)
-+				goto done;
- 
--		sdiodev->sbwad = bar0;
-+			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
-+			break;
-+		default:
-+			WARN(1, "Invalid reg size\n");
-+			ret = -EINVAL;
-+			break;
-+		}
- 	}
- 
--	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
--	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
--
--	return 0;
-+done:
-+	return ret;
- }
- 
- u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
-@@ -439,15 +387,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
--	if (retval)
--		goto done;
--
- 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
--
- 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
--done:
- 	if (ret)
- 		*ret = retval;
- 
-@@ -472,13 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
--	if (retval)
--		goto done;
--
- 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
- 
--done:
- 	if (ret)
- 		*ret = retval;
- }
-@@ -886,14 +823,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	return bcmerror;
- }
- 
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
- {
--	char t_func = (char)fn;
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* issue abort cmd52 command through F0 */
--	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
--				 1, &t_func, true);
-+	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -339,7 +339,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
- 		      u8 *data, uint size);
- 
- /* Issue an abort to the specified function */
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
- void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
- 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch b/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
deleted file mode 100644
index bcf59722b2..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 3508a056a1f45d95c874fc9af8748bf4229432b6 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:45 +0100
-Subject: [PATCH] brcmfmac: Fix asymmetric IO functions.
-
-Unlikely to be a problem, but brcmf_sdiod_regrl() is
-not symmetric with brcmf_sdiod_regrb() in initializing
-the data value on stack. Fix that.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-[arend: reword the commit message a bit]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -383,7 +383,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 
- u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
- {
--	u32 data = 0;
-+	u32 data;
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch b/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
deleted file mode 100644
index 9a570450a7..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 12e3e74e2820e11d91ee44fd3a190cd80d109faa Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:46 +0100
-Subject: [PATCH] brcmfmac: Remove noisy debugging.
-
-If you need debugging this low level, you're doing something wrong.
-Remove these noisy debug statements so the code is more readable.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 6 ------
- 1 file changed, 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -371,9 +371,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 	u8 data;
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
- 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
--	brcmf_dbg(SDIO, "data:0x%02x\n", data);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -386,9 +384,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	u32 data;
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
- 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
--	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -401,7 +397,6 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
- {
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
- 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
- 
- 	if (ret)
-@@ -413,7 +408,6 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- {
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
- 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
- 
- 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch b/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
deleted file mode 100644
index dd153fe6cc..0000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From dd8a2d49e4ed321ab8e7b679499c3a98ccc5ca24 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:47 +0100
-Subject: [PATCH] brcmfmac: Rename bcmerror to err
-
-Trivial cleanup of nasty variable name
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -746,7 +746,7 @@ int
- brcmf_sdiod_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
- 		  u8 *data, uint size)
- {
--	int bcmerror = 0;
-+	int err = 0;
- 	struct sk_buff *pkt;
- 	u32 sdaddr;
- 	uint dsize;
-@@ -771,8 +771,8 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	/* Do the transfer(s) */
- 	while (size) {
- 		/* Set the backplane window to include the start address */
--		bcmerror = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
--		if (bcmerror)
-+		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
-+		if (err)
- 			break;
- 
- 		brcmf_dbg(SDIO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
-@@ -785,9 +785,9 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 		skb_put(pkt, dsize);
- 		if (write)
- 			memcpy(pkt->data, data, dsize);
--		bcmerror = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write,
--					      sdaddr, pkt);
--		if (bcmerror) {
-+		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
-+					 pkt);
-+		if (err) {
- 			brcmf_err("membytes transfer failed\n");
- 			break;
- 		}
-@@ -814,7 +814,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 	sdio_release_host(sdiodev->func[1]);
- 
--	return bcmerror;
-+	return err;
- }
- 
- int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
diff --git a/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch b/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
deleted file mode 100644
index c260b96550..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 8f13c87ccc495e30de5f58bbda967f6edd5bec53 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:26 +0100
-Subject: [PATCH] brcmfmac: Split brcmf_sdiod_buffrw function up.
-
-This function needs to be split up into separate read / write variants
-for clarity.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 67 +++++++++++++++-------
- 1 file changed, 45 insertions(+), 22 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -414,8 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 		*ret = retval;
- }
- 
--static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
--			     bool write, u32 addr, struct sk_buff *pkt)
-+static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
-+				 u32 addr, struct sk_buff *pkt)
- {
- 	unsigned int req_sz;
- 	int err;
-@@ -424,18 +424,36 @@ static int brcmf_sdiod_buffrw(struct brc
- 	req_sz = pkt->len + 3;
- 	req_sz &= (uint)~3;
- 
--	if (write)
--		err = sdio_memcpy_toio(sdiodev->func[fn], addr,
--				       ((u8 *)(pkt->data)), req_sz);
--	else if (fn == 1)
--		err = sdio_memcpy_fromio(sdiodev->func[fn], ((u8 *)(pkt->data)),
--					 addr, req_sz);
-+	if (fn == 1)
-+		err = sdio_memcpy_fromio(sdiodev->func[fn],
-+					 ((u8 *)(pkt->data)), addr, req_sz);
- 	else
- 		/* function 2 read is FIFO operation */
--		err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
--				  req_sz);
-+		err = sdio_readsb(sdiodev->func[fn],
-+				  ((u8 *)(pkt->data)), addr, req_sz);
-+
-+	if (err == -ENOMEDIUM)
-+		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+
-+	return err;
-+}
-+
-+static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
-+				  u32 addr, struct sk_buff *pkt)
-+{
-+	unsigned int req_sz;
-+	int err;
-+
-+	/* Single skb use the standard mmc interface */
-+	req_sz = pkt->len + 3;
-+	req_sz &= (uint)~3;
-+
-+	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
-+			       ((u8 *)(pkt->data)), req_sz);
-+
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+
- 	return err;
- }
- 
-@@ -643,7 +661,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	if (err)
- 		goto done;
- 
--	err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, pkt);
-+	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
- 
- done:
- 	return err;
-@@ -665,14 +683,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 		goto done;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
--					 pktq->next);
-+		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+					    pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
--					 glom_skb);
-+		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+					    glom_skb);
- 		if (err)
- 			goto done;
- 
-@@ -707,8 +725,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
- 	if (!err)
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
--					 mypkt);
-+		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
- 	return err;
-@@ -730,8 +747,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support)
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true,
--						 addr, skb);
-+			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
-+						     addr, skb);
- 			if (err)
- 				break;
- 		}
-@@ -783,10 +800,16 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 		sdaddr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 		skb_put(pkt, dsize);
--		if (write)
-+
-+		if (write) {
- 			memcpy(pkt->data, data, dsize);
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
--					 pkt);
-+			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
-+						     sdaddr, pkt);
-+		} else {
-+			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
-+						    sdaddr, pkt);
-+		}
-+
- 		if (err) {
- 			brcmf_err("membytes transfer failed\n");
- 			break;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch b/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
deleted file mode 100644
index 088a6169fd..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 6e24dd012bfda479d0046f7995058f167e1923bc Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:27 +0100
-Subject: [PATCH] brcmfmac: whitespace fixes in brcmf_sdiod_send_buf()
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: mention function in patch subject]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -714,6 +714,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	int err;
- 
- 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
-+
- 	if (!mypkt) {
- 		brcmf_err("brcmu_pkt_buf_get_skb failed: len %d\n",
- 			  nbytes);
-@@ -728,8 +729,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
--	return err;
- 
-+	return err;
- }
- 
- int brcmf_sdiod_send_pkt(struct brcmf_sdio_dev *sdiodev,
diff --git a/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch b/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
deleted file mode 100644
index a44155b61a..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From a7323378dcf1f10a98f47b744e6f65e6fd671d84 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:28 +0100
-Subject: [PATCH] brcmfmac: Clarify if using braces.
-
-Whilst this if () statement is technically correct, it lacks clarity.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -746,16 +746,17 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 	if (err)
- 		return err;
- 
--	if (pktq->qlen == 1 || !sdiodev->sg_support)
-+	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
- 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
- 						     addr, skb);
- 			if (err)
- 				break;
- 		}
--	else
-+	} else {
- 		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
- 					    pktq);
-+	}
- 
- 	return err;
- }
diff --git a/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch b/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
deleted file mode 100644
index 7c27e17775..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
+++ /dev/null
@@ -1,831 +0,0 @@
-From 71bd508d7ded8c504ef05d1b4befecfe25e54cb1 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:29 +0100
-Subject: [PATCH] brcmfmac: Rename / replace old IO functions with simpler
- ones.
-
-Primarily this patch removes:
-
-brcmf_sdiod_f0_writeb()
-brcmf_sdiod_reg_write()
-brcmf_sdiod_reg_read()
-
-Since we no longer use the quirky method of deciding which function to
-address via the address being accessed, take the opportunity to rename
-some IO functions more in line with common kernel code. We also convert
-those that map directly to sdio_{read,write}*() to macros.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 169 +++----------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 186 ++++++++++-----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  28 +++-
- 3 files changed, 138 insertions(+), 245 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -137,27 +137,27 @@ int brcmf_sdiod_intr_register(struct brc
- 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
- 			/* assign GPIO to SDIO core */
- 			addr = CORE_CC_REG(SI_ENUM_BASE, gpiocontrol);
--			gpiocontrol = brcmf_sdiod_regrl(sdiodev, addr, &ret);
-+			gpiocontrol = brcmf_sdiod_readl(sdiodev, addr, &ret);
- 			gpiocontrol |= 0x2;
--			brcmf_sdiod_regwl(sdiodev, addr, gpiocontrol, &ret);
-+			brcmf_sdiod_writel(sdiodev, addr, gpiocontrol, &ret);
- 
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_SELECT, 0xf,
--					  &ret);
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_SELECT,
-+					   0xf, &ret);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
- 		}
- 
- 		/* must configure SDIO_CCCR_IENx to enable irq */
--		data = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
-+		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
- 		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
- 
- 		/* redirect, configure and enable io for interrupt signal */
- 		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
- 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
- 			data |= SDIO_SEPINT_ACT_HI;
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
--
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
-+				     data, &ret);
- 		sdio_release_host(sdiodev->func[1]);
- 	} else {
- 		brcmf_dbg(SDIO, "Entering\n");
-@@ -183,8 +183,8 @@ void brcmf_sdiod_intr_unregister(struct
- 
- 		pdata = &sdiodev->settings->bus.sdio;
- 		sdio_claim_host(sdiodev->func[1]);
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
- 		sdio_release_host(sdiodev->func[1]);
- 
- 		sdiodev->oob_irq_requested = false;
-@@ -242,8 +242,8 @@ static int brcmf_sdiod_set_sbaddr_window
- 	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
- 
- 	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
--				  addr & 0xff, &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
-+				   addr & 0xff, &err);
- 
- 	return err;
- }
-@@ -267,124 +267,15 @@ static int brcmf_sdiod_addrprep(struct b
- 	return 0;
- }
- 
--static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
--					uint regaddr)
--{
--	int err_ret;
--
--	/*
--	 * Can only directly write to some F0 registers.
--	 * Handle CCCR_IENx and CCCR_ABORT command
--	 * as a special case.
--	 */
--	if ((regaddr == SDIO_CCCR_ABORT) ||
--	    (regaddr == SDIO_CCCR_IENx))
--		sdio_writeb(func, byte, regaddr, &err_ret);
--	else
--		sdio_f0_writeb(func, byte, regaddr, &err_ret);
--
--	return err_ret;
--}
--
--static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
--				 u8 regsz, void *data)
--{
--	int ret;
--
--	/*
--	 * figure out how to read the register based on address range
--	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
--	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
--	 * The rest: function 1 silicon backplane core registers
--	 * f0 writes must be bytewise
--	 */
--
--	if ((addr & ~REG_F0_REG_MASK) == 0) {
--		if (WARN_ON(regsz > 1))
--			return -EINVAL;
--		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
--					    *(u8 *)data, addr);
--	} else {
--		switch (regsz) {
--		case 1:
--			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
--			break;
--		case 4:
--			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
--			if (ret)
--				goto done;
--
--			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
--			break;
--		default:
--			WARN(1, "Invalid reg size\n");
--			ret = -EINVAL;
--			break;
--		}
--	}
--
--done:
--	return ret;
--}
--
--static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
--				u8 regsz, void *data)
--{
--	int ret;
--
--	/*
--	 * figure out how to read the register based on address range
--	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
--	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
--	 * The rest: function 1 silicon backplane core registers
--	 * f0 reads must be bytewise
--	 */
--	if ((addr & ~REG_F0_REG_MASK) == 0) {
--		if (WARN_ON(regsz > 1))
--			return -EINVAL;
--		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
--	} else {
--		switch (regsz) {
--		case 1:
--			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
--			break;
--		case 4:
--			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
--			if (ret)
--				goto done;
--
--			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
--			break;
--		default:
--			WARN(1, "Invalid reg size\n");
--			ret = -EINVAL;
--			break;
--		}
--	}
--
--done:
--	return ret;
--}
--
--u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
-+u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
- {
--	u8 data;
-+	u32 data = 0;
- 	int retval;
- 
--	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
--
--	if (ret)
--		*ret = retval;
--
--	return data;
--}
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
--u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
--{
--	u32 data;
--	int retval;
--
--	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
-+	if (!retval)
-+		data = sdio_readl(sdiodev->func[1], addr, &retval);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -392,23 +283,15 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	return data;
- }
- 
--void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
--		      u8 data, int *ret)
-+void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr,
-+			u32 data, int *ret)
- {
- 	int retval;
- 
--	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
--
--	if (ret)
--		*ret = retval;
--}
--
--void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
--		      u32 data, int *ret)
--{
--	int retval;
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
--	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
-+	if (!retval)
-+		sdio_writel(sdiodev->func[1], data, addr, &retval);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -846,8 +729,8 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
- {
- 	brcmf_dbg(SDIO, "Enter\n");
- 
--	/* issue abort cmd52 command through F0 */
--	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
-+	/* Issue abort cmd52 command through F0 */
-+	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -669,7 +669,7 @@ static int r_sdreg32(struct brcmf_sdio *
- 	int ret;
- 
- 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
--	*regvar = brcmf_sdiod_regrl(bus->sdiodev, core->base + offset, &ret);
-+	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
- 
- 	return ret;
- }
-@@ -680,7 +680,7 @@ static int w_sdreg32(struct brcmf_sdio *
- 	int ret;
- 
- 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
--	brcmf_sdiod_regwl(bus->sdiodev, core->base + reg_offset, regval, &ret);
-+	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
- 
- 	return ret;
- }
-@@ -697,8 +697,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 
- 	wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
- 	/* 1st KSO write goes to AOS wake up core if device is asleep  */
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
--			  wr_val, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
- 
- 	if (on) {
- 		/* device WAKEUP through KSO:
-@@ -724,7 +723,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 		 * just one write attempt may fail,
- 		 * read it back until it matches written value
- 		 */
--		rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-+		rd_val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
- 					   &err);
- 		if (!err) {
- 			if ((rd_val & bmask) == cmp_val)
-@@ -734,9 +733,11 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 		/* bail out upon subsequent access errors */
- 		if (err && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS))
- 			break;
-+
- 		udelay(KSO_WAIT_US);
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
--				  wr_val, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val,
-+				   &err);
-+
- 	} while (try_cnt++ < MAX_KSO_ATTEMPTS);
- 
- 	if (try_cnt > 2)
-@@ -772,15 +773,15 @@ static int brcmf_sdio_htclk(struct brcmf
- 		clkreq =
- 		    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
- 
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  clkreq, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   clkreq, &err);
- 		if (err) {
- 			brcmf_err("HT Avail request error: %d\n", err);
- 			return -EBADE;
- 		}
- 
- 		/* Check current status */
--		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+		clkctl = brcmf_sdiod_readb(bus->sdiodev,
- 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 		if (err) {
- 			brcmf_err("HT Avail read error: %d\n", err);
-@@ -790,35 +791,34 @@ static int brcmf_sdio_htclk(struct brcmf
- 		/* Go to pending and await interrupt if appropriate */
- 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
- 			/* Allow only clock-available interrupt */
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			if (err) {
--				brcmf_err("Devctl error setting CA: %d\n",
--					  err);
-+				brcmf_err("Devctl error setting CA: %d\n", err);
- 				return -EBADE;
- 			}
- 
- 			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   devctl, &err);
- 			brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
- 			bus->clkstate = CLK_PENDING;
- 
- 			return 0;
- 		} else if (bus->clkstate == CLK_PENDING) {
- 			/* Cancel CA-only interrupt filter */
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   devctl, &err);
- 		}
- 
- 		/* Otherwise, wait here (polling) for HT Avail */
- 		timeout = jiffies +
- 			  msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
- 		while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
--			clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			clkctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_FUNC1_CHIPCLKCSR,
- 						   &err);
- 			if (time_after(jiffies, timeout))
-@@ -852,16 +852,16 @@ static int brcmf_sdio_htclk(struct brcmf
- 
- 		if (bus->clkstate == CLK_PENDING) {
- 			/* Cancel CA-only interrupt filter */
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   devctl, &err);
- 		}
- 
- 		bus->clkstate = CLK_SDONLY;
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  clkreq, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   clkreq, &err);
- 		brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
- 		if (err) {
- 			brcmf_err("Failed access turning clock off: %d\n",
-@@ -951,14 +951,14 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *
- 
- 		/* Going to sleep */
- 		if (sleep) {
--			clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
-+			clkcsr = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_FUNC1_CHIPCLKCSR,
- 						   &err);
- 			if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
- 				brcmf_dbg(SDIO, "no clock, set ALP\n");
--				brcmf_sdiod_regwb(bus->sdiodev,
--						  SBSDIO_FUNC1_CHIPCLKCSR,
--						  SBSDIO_ALP_AVAIL_REQ, &err);
-+				brcmf_sdiod_writeb(bus->sdiodev,
-+						   SBSDIO_FUNC1_CHIPCLKCSR,
-+						   SBSDIO_ALP_AVAIL_REQ, &err);
- 			}
- 			err = brcmf_sdio_kso_control(bus, false);
- 		} else {
-@@ -1178,16 +1178,16 @@ static void brcmf_sdio_rxfail(struct brc
- 	if (abort)
- 		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
- 
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
--			  SFC_RF_TERM, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
-+			   &err);
- 	bus->sdcnt.f1regdata++;
- 
- 	/* Wait until the packet has been flushed (device/FIFO stable) */
- 	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
--		hi = brcmf_sdiod_regrb(bus->sdiodev,
--				       SBSDIO_FUNC1_RFRAMEBCHI, &err);
--		lo = brcmf_sdiod_regrb(bus->sdiodev,
--				       SBSDIO_FUNC1_RFRAMEBCLO, &err);
-+		hi = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCHI,
-+				       &err);
-+		lo = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCLO,
-+				       &err);
- 		bus->sdcnt.f1regdata += 2;
- 
- 		if ((hi == 0) && (lo == 0))
-@@ -1229,12 +1229,12 @@ static void brcmf_sdio_txfail(struct brc
- 	bus->sdcnt.tx_sderrs++;
- 
- 	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
- 	bus->sdcnt.f1regdata++;
- 
- 	for (i = 0; i < 3; i++) {
--		hi = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
--		lo = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
-+		hi = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
-+		lo = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
- 		bus->sdcnt.f1regdata += 2;
- 		if ((hi == 0) && (lo == 0))
- 			break;
-@@ -2446,11 +2446,11 @@ static void brcmf_sdio_bus_stop(struct d
- 		bus->hostintmask = 0;
- 
- 		/* Force backplane clocks to assure F2 interrupt propagates */
--		saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+		saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
- 					    &err);
- 		if (!err)
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--					  (saveclk | SBSDIO_FORCE_HT), &err);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+					   (saveclk | SBSDIO_FORCE_HT), &err);
- 		if (err)
- 			brcmf_err("Failed to force clock for F2: err %d\n",
- 				  err);
-@@ -2509,7 +2509,7 @@ static int brcmf_sdio_intr_rstatus(struc
- 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
- 
--	val = brcmf_sdiod_regrl(bus->sdiodev, addr, &ret);
-+	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
- 	bus->sdcnt.f1regdata++;
- 	if (ret != 0)
- 		return ret;
-@@ -2519,7 +2519,7 @@ static int brcmf_sdio_intr_rstatus(struc
- 
- 	/* Clear interrupts */
- 	if (val) {
--		brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
-+		brcmf_sdiod_writel(bus->sdiodev, addr, val, &ret);
- 		bus->sdcnt.f1regdata++;
- 		atomic_or(val, &bus->intstatus);
- 	}
-@@ -2545,23 +2545,23 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- #ifdef DEBUG
- 		/* Check for inconsistent device control */
--		devctl = brcmf_sdiod_regrb(bus->sdiodev,
--					   SBSDIO_DEVICE_CTL, &err);
-+		devctl = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   &err);
- #endif				/* DEBUG */
- 
- 		/* Read CSR, if clock on switch to AVAIL, else ignore */
--		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+		clkctl = brcmf_sdiod_readb(bus->sdiodev,
- 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 
- 		brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
- 			  devctl, clkctl);
- 
- 		if (SBSDIO_HTAV(clkctl)) {
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev,
-+					   SBSDIO_DEVICE_CTL, devctl, &err);
- 			bus->clkstate = CLK_AVAIL;
- 		}
- 	}
-@@ -3347,31 +3347,31 @@ static void brcmf_sdio_sr_init(struct br
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
-+	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
- 	if (err) {
- 		brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
- 		return;
- 	}
- 
- 	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
- 	if (err) {
- 		brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
- 		return;
- 	}
- 
- 	/* Add CMD14 Support */
--	brcmf_sdiod_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
--			  (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
--			   SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
--			  &err);
-+	brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
-+			     (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
-+			      SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
-+			     &err);
- 	if (err) {
- 		brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
- 		return;
- 	}
- 
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--			  SBSDIO_FORCE_HT, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+			   SBSDIO_FORCE_HT, &err);
- 	if (err) {
- 		brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
- 		return;
-@@ -3394,7 +3394,7 @@ static int brcmf_sdio_kso_init(struct br
- 	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
- 		return 0;
- 
--	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
-+	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
- 	if (err) {
- 		brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
- 		return err;
-@@ -3403,8 +3403,8 @@ static int brcmf_sdio_kso_init(struct br
- 	if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
- 		val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
- 			SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
--				  val, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-+				   val, &err);
- 		if (err) {
- 			brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
- 			return err;
-@@ -3565,9 +3565,9 @@ static void brcmf_sdio_bus_watchdog(stru
- 				u8 devpend;
- 
- 				sdio_claim_host(bus->sdiodev->func[1]);
--				devpend = brcmf_sdiod_regrb(bus->sdiodev,
--							    SDIO_CCCR_INTx,
--							    NULL);
-+				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
-+							       SDIO_CCCR_INTx,
-+							       NULL);
- 				sdio_release_host(bus->sdiodev->func[1]);
- 				intstatus = devpend & (INTR_STATUS_FUNC1 |
- 						       INTR_STATUS_FUNC2);
-@@ -3705,12 +3705,12 @@ brcmf_sdio_drivestrengthinit(struct brcm
- 			}
- 		}
- 		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
--		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
--		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-+		brcmf_sdiod_writel(sdiodev, addr, 1, NULL);
-+		cc_data_temp = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 		cc_data_temp &= ~str_mask;
- 		drivestrength_sel <<= str_shift;
- 		cc_data_temp |= drivestrength_sel;
--		brcmf_sdiod_regwl(sdiodev, addr, cc_data_temp, NULL);
-+		brcmf_sdiod_writel(sdiodev, addr, cc_data_temp, NULL);
- 
- 		brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
- 			  str_tab[i].strength, drivestrength, cc_data_temp);
-@@ -3725,7 +3725,7 @@ static int brcmf_sdio_buscoreprep(void *
- 
- 	/* Try forcing SDIO core to do ALPAvail request only */
- 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
- 	if (err) {
- 		brcmf_err("error writing for HT off\n");
- 		return err;
-@@ -3733,8 +3733,7 @@ static int brcmf_sdio_buscoreprep(void *
- 
- 	/* If register supported, wait for ALPAvail and then force ALP */
- 	/* This may take up to 15 milliseconds */
--	clkval = brcmf_sdiod_regrb(sdiodev,
--				   SBSDIO_FUNC1_CHIPCLKCSR, NULL);
-+	clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
- 
- 	if ((clkval & ~SBSDIO_AVBITS) != clkset) {
- 		brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
-@@ -3742,10 +3741,11 @@ static int brcmf_sdio_buscoreprep(void *
- 		return -EACCES;
- 	}
- 
--	SPINWAIT(((clkval = brcmf_sdiod_regrb(sdiodev,
--					      SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
--			!SBSDIO_ALPAV(clkval)),
--			PMU_MAX_TRANSITION_DLY);
-+	SPINWAIT(((clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+					      NULL)),
-+		 !SBSDIO_ALPAV(clkval)),
-+		 PMU_MAX_TRANSITION_DLY);
-+
- 	if (!SBSDIO_ALPAV(clkval)) {
- 		brcmf_err("timeout on ALPAV wait, clkval 0x%02x\n",
- 			  clkval);
-@@ -3753,11 +3753,11 @@ static int brcmf_sdio_buscoreprep(void *
- 	}
- 
- 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
- 	udelay(65);
- 
- 	/* Also, disable the extra SDIO pull-ups */
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
- 
- 	return 0;
- }
-@@ -3772,7 +3772,7 @@ static void brcmf_sdio_buscore_activate(
- 	/* clear all interrupts */
- 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
- 	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
--	brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
-+	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
- 
- 	if (rstvec)
- 		/* Write reset vector to address 0 */
-@@ -3785,7 +3785,7 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	struct brcmf_sdio_dev *sdiodev = ctx;
- 	u32 val, rev;
- 
--	val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-+	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
- 	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
- 	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
-@@ -3802,7 +3802,7 @@ static void brcmf_sdio_buscore_write32(v
- {
- 	struct brcmf_sdio_dev *sdiodev = ctx;
- 
--	brcmf_sdiod_regwl(sdiodev, addr, val, NULL);
-+	brcmf_sdiod_writel(sdiodev, addr, val, NULL);
- }
- 
- static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
-@@ -3826,18 +3826,18 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	sdio_claim_host(sdiodev->func[1]);
- 
- 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
--		 brcmf_sdiod_regrl(sdiodev, SI_ENUM_BASE, NULL));
-+		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
- 
- 	/*
- 	 * Force PLL off until brcmf_chip_attach()
- 	 * programs PLL control regs
- 	 */
- 
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--			  BRCMF_INIT_CLKCTL1, &err);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, BRCMF_INIT_CLKCTL1,
-+			   &err);
- 	if (!err)
--		clkctl = brcmf_sdiod_regrb(sdiodev,
--					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
-+		clkctl = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+					   &err);
- 
- 	if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
- 		brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
-@@ -3897,25 +3897,25 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
- 
- 	/* Set card control so an SDIO card reset does a WLAN backplane reset */
--	reg_val = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
-+	reg_val = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
- 	if (err)
- 		goto fail;
- 
- 	reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
- 
--	brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
-+	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
- 	if (err)
- 		goto fail;
- 
- 	/* set PMUControl so a backplane reset does PMU state reload */
- 	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
--	reg_val = brcmf_sdiod_regrl(sdiodev, reg_addr, &err);
-+	reg_val = brcmf_sdiod_readl(sdiodev, reg_addr, &err);
- 	if (err)
- 		goto fail;
- 
- 	reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
- 
--	brcmf_sdiod_regwl(sdiodev, reg_addr, reg_val, &err);
-+	brcmf_sdiod_writel(sdiodev, reg_addr, reg_val, &err);
- 	if (err)
- 		goto fail;
- 
-@@ -4055,10 +4055,10 @@ static void brcmf_sdio_firmware_callback
- 		goto release;
- 
- 	/* Force clocks on backplane to be sure F2 interrupt propagates */
--	saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
-+	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 	if (!err) {
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  (saveclk | SBSDIO_FORCE_HT), &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   (saveclk | SBSDIO_FORCE_HT), &err);
- 	}
- 	if (err) {
- 		brcmf_err("Failed to force clock for F2: err %d\n", err);
-@@ -4080,7 +4080,7 @@ static void brcmf_sdio_firmware_callback
- 		w_sdreg32(bus, bus->hostintmask,
- 			  offsetof(struct sdpcmd_regs, hostintmask));
- 
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_WATERMARK, 8, &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
- 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
-@@ -4091,8 +4091,8 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdio_sr_init(bus);
- 	} else {
- 		/* Restore previous clock setting */
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  saveclk, &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   saveclk, &err);
- 	}
- 
- 	if (err == 0) {
-@@ -4225,7 +4225,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->rxflow = false;
- 
- 	/* Done with backplane-dependent accesses, can drop clock... */
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
- 
- 	sdio_release_host(bus->sdiodev->func[1]);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -50,6 +50,7 @@
- #define SBSDIO_NUM_FUNCTION		3
- 
- /* function 0 vendor specific CCCR registers */
-+
- #define SDIO_CCCR_BRCM_CARDCAP			0xf0
- #define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
- #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
-@@ -131,8 +132,6 @@
- /* with b15, maps to 32-bit SB access */
- #define SBSDIO_SB_ACCESS_2_4B_FLAG	0x08000
- 
--/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
--
- /* Address bits from SBADDR regs */
- #define SBSDIO_SBWINDOW_MASK		0xffff8000
- 
-@@ -293,13 +292,24 @@ struct sdpcmd_regs {
- int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev);
- 
--/* sdio device register access interface */
--u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
--u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
--void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
--		       int *ret);
--void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
--		       int *ret);
-+/* SDIO device register access interface */
-+/* Accessors for SDIO Function 0 */
-+#define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
-+	sdio_readb((sdiodev)->func[0], (addr), (r))
-+
-+#define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
-+	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
-+
-+/* Accessors for SDIO Function 1 */
-+#define brcmf_sdiod_readb(sdiodev, addr, r) \
-+	sdio_readb((sdiodev)->func[1], (addr), (r))
-+
-+#define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
-+	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
-+
-+u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
-+void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
-+			int *ret);
- 
- /* Buffer transfer to/from device (client) core via cmd53.
-  *   fn:       function number
diff --git a/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch b/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
deleted file mode 100644
index e77d601a81..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From eeef8a5da781e11746347b3cd9f1942be48ebaf0 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:30 +0100
-Subject: [PATCH] brcmfmac: Tidy register definitions a little
-
-Trivial tidy of register definitions.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  4 ++--
- .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 19 ++++++++++---------
- 2 files changed, 12 insertions(+), 11 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -153,9 +153,9 @@ int brcmf_sdiod_intr_register(struct brc
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
- 
- 		/* redirect, configure and enable io for interrupt signal */
--		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
-+		data = SDIO_CCCR_BRCM_SEPINT_MASK | SDIO_CCCR_BRCM_SEPINT_OE;
- 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
--			data |= SDIO_SEPINT_ACT_HI;
-+			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
- 				     data, &ret);
- 		sdio_release_host(sdiodev->func[1]);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -52,16 +52,17 @@
- /* function 0 vendor specific CCCR registers */
- 
- #define SDIO_CCCR_BRCM_CARDCAP			0xf0
--#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
--#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
--#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	0x08
--#define SDIO_CCCR_BRCM_CARDCTRL		0xf1
--#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	0x02
--#define SDIO_CCCR_BRCM_SEPINT			0xf2
-+#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	BIT(1)
-+#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
-+#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
-+
-+#define SDIO_CCCR_BRCM_CARDCTRL			0xf1
-+#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
- 
--#define  SDIO_SEPINT_MASK		0x01
--#define  SDIO_SEPINT_OE			0x02
--#define  SDIO_SEPINT_ACT_HI		0x04
-+#define SDIO_CCCR_BRCM_SEPINT			0xf2
-+#define SDIO_CCCR_BRCM_SEPINT_MASK		BIT(0)
-+#define SDIO_CCCR_BRCM_SEPINT_OE		BIT(1)
-+#define SDIO_CCCR_BRCM_SEPINT_ACT_HI		BIT(2)
- 
- /* function 1 miscellaneous registers */
- 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch b/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
deleted file mode 100644
index dc598aa471..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
+++ /dev/null
@@ -1,190 +0,0 @@
-From a7c3aa1509e243a09c5b1660c8702d792ca76aed Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:31 +0100
-Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_addrprep()
-
-This function has become trivial enough that it may as well be pushed into
-its callers, which has the side-benefit of clarifying what's going on.
-
-Remove it, and rename brcmf_sdiod_set_sbaddr_window() to
-brcmf_sdiod_set_backplane_window() as it's easier to understand.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 84 ++++++++++++----------
- 1 file changed, 46 insertions(+), 38 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -230,41 +230,25 @@ void brcmf_sdiod_change_state(struct brc
- 	sdiodev->state = state;
- }
- 
--static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
--					 u32 address)
-+static int brcmf_sdiod_set_backplane_window(struct brcmf_sdio_dev *sdiodev,
-+					    u32 addr)
- {
-+	u32 v, bar0 = addr & SBSDIO_SBWINDOW_MASK;
- 	int err = 0, i;
--	u32 addr;
- 
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
-+	if (bar0 == sdiodev->sbwad)
-+		return 0;
- 
--	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
-+	v = bar0 >> 8;
- 
--	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
-+	for (i = 0 ; i < 3 && !err ; i++, v >>= 8)
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
--				   addr & 0xff, &err);
--
--	return err;
--}
--
--static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
--{
--	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
--	int err = 0;
--
--	if (bar0 != sdiodev->sbwad) {
--		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
--		if (err)
--			return err;
-+				   v & 0xff, &err);
- 
-+	if (!err)
- 		sdiodev->sbwad = bar0;
--	}
- 
--	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
--	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
--
--	return 0;
-+	return err;
- }
- 
- u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
-@@ -272,11 +256,16 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
- 	u32 data = 0;
- 	int retval;
- 
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
-+	if (retval)
-+		goto out;
-+
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	if (!retval)
--		data = sdio_readl(sdiodev->func[1], addr, &retval);
-+	data = sdio_readl(sdiodev->func[1], addr, &retval);
- 
-+out:
- 	if (ret)
- 		*ret = retval;
- 
-@@ -288,11 +277,16 @@ void brcmf_sdiod_writel(struct brcmf_sdi
- {
- 	int retval;
- 
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
-+	if (retval)
-+		goto out;
- 
--	if (!retval)
--		sdio_writel(sdiodev->func[1], data, addr, &retval);
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
-+	sdio_writel(sdiodev->func[1], data, addr, &retval);
-+
-+out:
- 	if (ret)
- 		*ret = retval;
- }
-@@ -540,10 +534,13 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
- 	if (err)
- 		goto done;
- 
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
- 	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
- 
- done:
-@@ -561,10 +558,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
- 		  addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
- 	if (err)
- 		goto done;
- 
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
- 	if (pktq->qlen == 1)
- 		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
- 					    pktq->next);
-@@ -606,7 +606,12 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 
- 	memcpy(mypkt->data, buf, nbytes);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
-+	if (err)
-+		return err;
-+
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
- 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
-@@ -625,10 +630,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
- 	if (err)
- 		return err;
- 
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
- 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
-@@ -673,7 +681,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	/* Do the transfer(s) */
- 	while (size) {
- 		/* Set the backplane window to include the start address */
--		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
-+		err = brcmf_sdiod_set_backplane_window(sdiodev, address);
- 		if (err)
- 			break;
- 
-@@ -716,7 +724,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	dev_kfree_skb(pkt);
- 
- 	/* Return the window to backplane enumeration space for core access */
--	if (brcmf_sdiod_set_sbaddr_window(sdiodev, sdiodev->sbwad))
-+	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
- 		brcmf_err("FAILED to set window back to 0x%x\n",
- 			  sdiodev->sbwad);
- 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch b/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
deleted file mode 100644
index b9410dd7d0..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From c900072bd6faff089aa4fb7b19136a2a0fe3baf0 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:32 +0100
-Subject: [PATCH] brcmfmac: remove unnecessary call to
- brcmf_sdiod_set_backplane_window()
-
-All functions that might require the window address changing call
-brcmf_sdiod_set_backplane_window() prior to access. Thus resetting
-the window is not required.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-[arend: corrected the driver prefix in the subject]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 -----
- 1 file changed, 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -723,11 +723,6 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 	dev_kfree_skb(pkt);
- 
--	/* Return the window to backplane enumeration space for core access */
--	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
--		brcmf_err("FAILED to set window back to 0x%x\n",
--			  sdiodev->sbwad);
--
- 	sdio_release_host(sdiodev->func[1]);
- 
- 	return err;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch b/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
deleted file mode 100644
index f9e5df550f..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From e4c05fc3c0a6c79376f72f17d08014477e962ada Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:33 +0100
-Subject: [PATCH] brcmfmac: Cleanup offsetof()
-
-Create a macro to make the code a bit more readable, whilst we're stuck
-with using struct element offsets as register offsets.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: rename macro to SD_REG]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 35 +++++++++-------------
- 1 file changed, 14 insertions(+), 21 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -161,6 +161,8 @@ struct rte_console {
- 
- #define CORE_BUS_REG(base, field) \
- 		(base + offsetof(struct sdpcmd_regs, field))
-+#define SD_REG(field) \
-+		(offsetof(struct sdpcmd_regs, field))
- 
- /* SDIO function 1 register CHIPCLKCSR */
- /* Force ALP request to backplane */
-@@ -1087,12 +1089,10 @@ static u32 brcmf_sdio_hostmail(struct br
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Read mailbox data and ack that we did so */
--	ret = r_sdreg32(bus, &hmb_data,
--			offsetof(struct sdpcmd_regs, tohostmailboxdata));
-+	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
- 
- 	if (ret == 0)
--		w_sdreg32(bus, SMB_INT_ACK,
--			  offsetof(struct sdpcmd_regs, tosbmailbox));
-+		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
- 	bus->sdcnt.f1regdata += 2;
- 
- 	/* dongle indicates the firmware has halted/crashed */
-@@ -1207,8 +1207,7 @@ static void brcmf_sdio_rxfail(struct brc
- 
- 	if (rtx) {
- 		bus->sdcnt.rxrtx++;
--		err = w_sdreg32(bus, SMB_NAK,
--				offsetof(struct sdpcmd_regs, tosbmailbox));
-+		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
- 
- 		bus->sdcnt.f1regdata++;
- 		if (err == 0)
-@@ -2333,9 +2332,7 @@ static uint brcmf_sdio_sendfromq(struct
- 		if (!bus->intr) {
- 			/* Check device status, signal pending interrupt */
- 			sdio_claim_host(bus->sdiodev->func[1]);
--			ret = r_sdreg32(bus, &intstatus,
--					offsetof(struct sdpcmd_regs,
--						 intstatus));
-+			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
- 			sdio_release_host(bus->sdiodev->func[1]);
- 			bus->sdcnt.f2txdata++;
- 			if (ret != 0)
-@@ -2441,7 +2438,7 @@ static void brcmf_sdio_bus_stop(struct d
- 		brcmf_sdio_bus_sleep(bus, false, false);
- 
- 		/* Disable and clear interrupts at the chip level also */
--		w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
-+		w_sdreg32(bus, 0, SD_REG(hostintmask));
- 		local_hostintmask = bus->hostintmask;
- 		bus->hostintmask = 0;
- 
-@@ -2460,8 +2457,7 @@ static void brcmf_sdio_bus_stop(struct d
- 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
--		w_sdreg32(bus, local_hostintmask,
--			  offsetof(struct sdpcmd_regs, intstatus));
-+		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
- 
- 		sdio_release_host(sdiodev->func[1]);
- 	}
-@@ -2507,7 +2503,7 @@ static int brcmf_sdio_intr_rstatus(struc
- 	int ret;
- 
- 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
--	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
-+	addr = buscore->base + SD_REG(intstatus);
- 
- 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
- 	bus->sdcnt.f1regdata++;
-@@ -2584,11 +2580,9 @@ static void brcmf_sdio_dpc(struct brcmf_
- 	 */
- 	if (intstatus & I_HMB_FC_CHANGE) {
- 		intstatus &= ~I_HMB_FC_CHANGE;
--		err = w_sdreg32(bus, I_HMB_FC_CHANGE,
--				offsetof(struct sdpcmd_regs, intstatus));
-+		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
- 
--		err = r_sdreg32(bus, &newstatus,
--				offsetof(struct sdpcmd_regs, intstatus));
-+		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
- 		bus->sdcnt.f1regdata += 2;
- 		atomic_set(&bus->fcstate,
- 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
-@@ -3771,7 +3765,7 @@ static void brcmf_sdio_buscore_activate(
- 
- 	/* clear all interrupts */
- 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
--	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
-+	reg_addr = core->base + SD_REG(intstatus);
- 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
- 
- 	if (rstvec)
-@@ -4067,7 +4061,7 @@ static void brcmf_sdio_firmware_callback
- 
- 	/* Enable function 2 (frame transfers) */
- 	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
--		  offsetof(struct sdpcmd_regs, tosbmailboxdata));
-+		  SD_REG(tosbmailboxdata));
- 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 
-@@ -4077,8 +4071,7 @@ static void brcmf_sdio_firmware_callback
- 	if (!err) {
- 		/* Set up the interrupt mask and enable interrupts */
- 		bus->hostintmask = HOSTINTMASK;
--		w_sdreg32(bus, bus->hostintmask,
--			  offsetof(struct sdpcmd_regs, hostintmask));
-+		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
- 
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
diff --git a/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch b/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
deleted file mode 100644
index df72a70b3b..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 5cfe38f1f8d3c6b98e15b8cfde05028a3c79930b Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:34 +0100
-Subject: [PATCH] brcmfmac: Remove unused macro.
-
-This macro is used exactly nowhere in the code. Delete it.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 --
- 1 file changed, 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -159,8 +159,6 @@ struct rte_console {
- /* manfid tuple length, include tuple, link bytes */
- #define SBSDIO_CIS_MANFID_TUPLE_LEN	6
- 
--#define CORE_BUS_REG(base, field) \
--		(base + offsetof(struct sdpcmd_regs, field))
- #define SD_REG(field) \
- 		(offsetof(struct sdpcmd_regs, field))
- 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch b/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
deleted file mode 100644
index 69fbf5c80f..0000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From 21a10846d09db3c5e3bdfb0be0fc7aa9fdc7000a Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:35 +0100
-Subject: [PATCH] brcmfmac: Remove repeated calls to brcmf_chip_get_core()
-
-There is no need to repeatdly call brcmf_chip_get_core(), which
-traverses a list of cores every time its called (including during
-register access code!).
-
-Call it once, and store a pointer to the core structure. The existing
-code does nto keep track of users of the cores anyway, and even so, this
-will allow for easier refcounting in future.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 25 +++++++++++++---------
- 1 file changed, 15 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -436,6 +436,7 @@ struct brcmf_sdio_count {
- struct brcmf_sdio {
- 	struct brcmf_sdio_dev *sdiodev;	/* sdio device handler */
- 	struct brcmf_chip *ci;	/* Chip info struct */
-+	struct brcmf_core *sdio_core; /* sdio core info struct */
- 
- 	u32 hostintmask;	/* Copy of Host Interrupt Mask */
- 	atomic_t intstatus;	/* Intstatus bits (events) pending */
-@@ -665,10 +666,9 @@ static bool data_ok(struct brcmf_sdio *b
-  */
- static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
- {
--	struct brcmf_core *core;
-+	struct brcmf_core *core = bus->sdio_core;
- 	int ret;
- 
--	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
- 
- 	return ret;
-@@ -676,10 +676,9 @@ static int r_sdreg32(struct brcmf_sdio *
- 
- static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
- {
--	struct brcmf_core *core;
-+	struct brcmf_core *core = bus->sdio_core;
- 	int ret;
- 
--	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
- 
- 	return ret;
-@@ -2495,12 +2494,11 @@ static inline void brcmf_sdio_clrintr(st
- 
- static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
- {
--	struct brcmf_core *buscore;
-+	struct brcmf_core *buscore = bus->sdio_core;
- 	u32 addr;
- 	unsigned long val;
- 	int ret;
- 
--	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	addr = buscore->base + SD_REG(intstatus);
- 
- 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
-@@ -3377,13 +3375,14 @@ static void brcmf_sdio_sr_init(struct br
- /* enable KSO bit */
- static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
- {
-+	struct brcmf_core *core = bus->sdio_core;
- 	u8 val;
- 	int err = 0;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
- 	/* KSO bit added in SDIO core rev 12 */
--	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
-+	if (core->rev < 12)
- 		return 0;
- 
- 	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
-@@ -3412,6 +3411,7 @@ static int brcmf_sdio_bus_preinit(struct
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
- 	struct brcmf_sdio *bus = sdiodev->bus;
-+	struct brcmf_core *core = bus->sdio_core;
- 	uint pad_size;
- 	u32 value;
- 	int err;
-@@ -3420,7 +3420,7 @@ static int brcmf_sdio_bus_preinit(struct
- 	 * a device perspective, ie. bus:txglom affects the
- 	 * bus transfers from device to host.
- 	 */
--	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12) {
-+	if (core->rev < 12) {
- 		/* for sdio core rev < 12, disable txgloming */
- 		value = 0;
- 		err = brcmf_iovar_data_set(dev, "bus:txglom", &value,
-@@ -3758,11 +3758,10 @@ static void brcmf_sdio_buscore_activate(
- 					u32 rstvec)
- {
- 	struct brcmf_sdio_dev *sdiodev = ctx;
--	struct brcmf_core *core;
-+	struct brcmf_core *core = sdiodev->bus->sdio_core;
- 	u32 reg_addr;
- 
- 	/* clear all interrupts */
--	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
- 	reg_addr = core->base + SD_REG(intstatus);
- 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
- 
-@@ -3843,6 +3842,12 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 		bus->ci = NULL;
- 		goto fail;
- 	}
-+
-+	/* Pick up the SDIO core info struct from chip.c */
-+	bus->sdio_core   = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
-+	if (!bus->sdio_core)
-+		goto fail;
-+
- 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
- 						   BRCMF_BUSTYPE_SDIO,
- 						   bus->ci->chip,
diff --git a/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch b/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
deleted file mode 100644
index 731b7eda1b..0000000000
--- a/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 7762bb134e3b40e8ee2611365775b7432190a9c7 Mon Sep 17 00:00:00 2001
-From: Wright Feng <wright.feng@cypress.com>
-Date: Mon, 11 Dec 2017 15:38:21 +0800
-Subject: [PATCH] brcmfmac: enlarge buffer size of caps to 512 bytes
-
-The buffer size of return of cap iovar is greater than 256 bytes in some
-firmwares. For instance, the return size of cap iovar is 271 bytes in 4373
-13.10.246.79 firmare. It makes feature capability parsing failed because
-caps buffer is default value.
-So we enlarge caps buffer size to 512 bytes and add the error print for
-cap iovar error.
-
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -130,13 +130,19 @@ static void brcmf_feat_iovar_data_set(st
- 	}
- }
- 
-+#define MAX_CAPS_BUFFER_SIZE	512
- static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
- {
--	char caps[256];
-+	char caps[MAX_CAPS_BUFFER_SIZE];
- 	enum brcmf_feat_id id;
--	int i;
-+	int i, err;
-+
-+	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
-+	if (err) {
-+		brcmf_err("could not get firmware cap (%d)\n", err);
-+		return;
-+	}
- 
--	brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
- 	brcmf_dbg(INFO, "[ %s]\n", caps);
- 
- 	for (i = 0; i < ARRAY_SIZE(brcmf_fwcap_map); i++) {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch b/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
deleted file mode 100644
index 291cd5d787..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
+++ /dev/null
@@ -1,227 +0,0 @@
-From 3d110df8f74781354051e4bb1e3e97fa368b2f80 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:07 +0100
-Subject: [PATCH] brcmfmac: Remove {r,w}_sdreg32
-
-Remove yet another IO function from the code and replace with one
-that already exists.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: keep address calculation, ie. (base + offset) in one line]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 88 +++++++++++-----------
- 1 file changed, 42 insertions(+), 46 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -660,30 +660,6 @@ static bool data_ok(struct brcmf_sdio *b
- 	       ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
- }
- 
--/*
-- * Reads a register in the SDIO hardware block. This block occupies a series of
-- * adresses on the 32 bit backplane bus.
-- */
--static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
--{
--	struct brcmf_core *core = bus->sdio_core;
--	int ret;
--
--	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
--
--	return ret;
--}
--
--static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
--{
--	struct brcmf_core *core = bus->sdio_core;
--	int ret;
--
--	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
--
--	return ret;
--}
--
- static int
- brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
- {
-@@ -1078,6 +1054,8 @@ static void brcmf_sdio_get_console_addr(
- 
- static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
- {
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_core *core = bus->sdio_core;
- 	u32 intstatus = 0;
- 	u32 hmb_data;
- 	u8 fcbits;
-@@ -1086,10 +1064,14 @@ static u32 brcmf_sdio_hostmail(struct br
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Read mailbox data and ack that we did so */
--	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
-+	hmb_data = brcmf_sdiod_readl(sdiod,
-+				     core->base + SD_REG(tohostmailboxdata),
-+				     &ret);
-+
-+	if (!ret)
-+		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
-+				   SMB_INT_ACK, &ret);
- 
--	if (ret == 0)
--		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
- 	bus->sdcnt.f1regdata += 2;
- 
- 	/* dongle indicates the firmware has halted/crashed */
-@@ -1163,6 +1145,8 @@ static u32 brcmf_sdio_hostmail(struct br
- 
- static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
- {
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_core *core = bus->sdio_core;
- 	uint retries = 0;
- 	u16 lastrbc;
- 	u8 hi, lo;
-@@ -1204,7 +1188,8 @@ static void brcmf_sdio_rxfail(struct brc
- 
- 	if (rtx) {
- 		bus->sdcnt.rxrtx++;
--		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
-+		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
-+				   SMB_NAK, &err);
- 
- 		bus->sdcnt.f1regdata++;
- 		if (err == 0)
-@@ -2291,6 +2276,7 @@ static uint brcmf_sdio_sendfromq(struct
- {
- 	struct sk_buff *pkt;
- 	struct sk_buff_head pktq;
-+	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
- 	u32 intstatus = 0;
- 	int ret = 0, prec_out, i;
- 	uint cnt = 0;
-@@ -2329,7 +2315,8 @@ static uint brcmf_sdio_sendfromq(struct
- 		if (!bus->intr) {
- 			/* Check device status, signal pending interrupt */
- 			sdio_claim_host(bus->sdiodev->func[1]);
--			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
-+			intstatus = brcmf_sdiod_readl(bus->sdiodev,
-+						      intstat_addr, &ret);
- 			sdio_release_host(bus->sdiodev->func[1]);
- 			bus->sdcnt.f2txdata++;
- 			if (ret != 0)
-@@ -2413,12 +2400,13 @@ static int brcmf_sdio_tx_ctrlframe(struc
- 
- static void brcmf_sdio_bus_stop(struct device *dev)
- {
--	u32 local_hostintmask;
--	u8 saveclk;
--	int err;
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
- 	struct brcmf_sdio *bus = sdiodev->bus;
-+	struct brcmf_core *core = bus->sdio_core;
-+	u32 local_hostintmask;
-+	u8 saveclk;
-+	int err;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
-@@ -2435,7 +2423,9 @@ static void brcmf_sdio_bus_stop(struct d
- 		brcmf_sdio_bus_sleep(bus, false, false);
- 
- 		/* Disable and clear interrupts at the chip level also */
--		w_sdreg32(bus, 0, SD_REG(hostintmask));
-+		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(hostintmask),
-+				   0, NULL);
-+
- 		local_hostintmask = bus->hostintmask;
- 		bus->hostintmask = 0;
- 
-@@ -2454,7 +2444,8 @@ static void brcmf_sdio_bus_stop(struct d
- 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
--		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
-+		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
-+				   local_hostintmask, NULL);
- 
- 		sdio_release_host(sdiodev->func[1]);
- 	}
-@@ -2521,7 +2512,9 @@ static int brcmf_sdio_intr_rstatus(struc
- 
- static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
- {
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
- 	u32 newstatus = 0;
-+	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
- 	unsigned long intstatus;
- 	uint txlimit = bus->txbound;	/* Tx frames to send before resched */
- 	uint framecnt;			/* Temporary counter of tx/rx frames */
-@@ -2576,9 +2569,10 @@ static void brcmf_sdio_dpc(struct brcmf_
- 	 */
- 	if (intstatus & I_HMB_FC_CHANGE) {
- 		intstatus &= ~I_HMB_FC_CHANGE;
--		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
-+		brcmf_sdiod_writel(sdiod, intstat_addr, I_HMB_FC_CHANGE, &err);
-+
-+		newstatus = brcmf_sdiod_readl(sdiod, intstat_addr, &err);
- 
--		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
- 		bus->sdcnt.f1regdata += 2;
- 		atomic_set(&bus->fcstate,
- 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
-@@ -4017,22 +4011,21 @@ static void brcmf_sdio_firmware_callback
- 					 const struct firmware *code,
- 					 void *nvram, u32 nvram_len)
- {
--	struct brcmf_bus *bus_if;
--	struct brcmf_sdio_dev *sdiodev;
--	struct brcmf_sdio *bus;
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-+	struct brcmf_sdio *bus = sdiodev->bus;
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_core *core = bus->sdio_core;
- 	u8 saveclk;
- 
- 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
--	bus_if = dev_get_drvdata(dev);
--	sdiodev = bus_if->bus_priv.sdio;
-+
- 	if (err)
- 		goto fail;
- 
- 	if (!bus_if->drvr)
- 		return;
- 
--	bus = sdiodev->bus;
--
- 	/* try to download image and nvram to the dongle */
- 	bus->alp_only = true;
- 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-@@ -4063,8 +4056,9 @@ static void brcmf_sdio_firmware_callback
- 	}
- 
- 	/* Enable function 2 (frame transfers) */
--	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
--		  SD_REG(tosbmailboxdata));
-+	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
-+			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
-+
- 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 
-@@ -4074,7 +4068,9 @@ static void brcmf_sdio_firmware_callback
- 	if (!err) {
- 		/* Set up the interrupt mask and enable interrupts */
- 		bus->hostintmask = HOSTINTMASK;
--		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
-+		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
-+				   bus->hostintmask, NULL);
-+
- 
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch b/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
deleted file mode 100644
index e9b5628309..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From dbda7dacb79a377e8ed9d38ce0e4a58b70aa9060 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 19 Dec 2017 13:47:08 +0100
-Subject: [PATCH] brcmfmac: Rename buscore to core for consistency
-
-Avoid confusion with unrelated _buscore labels.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: only do the rename]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -2485,12 +2485,12 @@ static inline void brcmf_sdio_clrintr(st
- 
- static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
- {
--	struct brcmf_core *buscore = bus->sdio_core;
-+	struct brcmf_core *core = bus->sdio_core;
- 	u32 addr;
- 	unsigned long val;
- 	int ret;
- 
--	addr = buscore->base + SD_REG(intstatus);
-+	addr = core->base + SD_REG(intstatus);
- 
- 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
- 	bus->sdcnt.f1regdata++;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch b/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
deleted file mode 100644
index 3828c320f4..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 874bb8e49b7c6368f8ff9f2566c7bd06a2249be0 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:09 +0100
-Subject: [PATCH] brcmfmac: stabilise the value of ->sbwad in use for some xfer
- routines.
-
-The IO functions operate within the Chipcommon IO window. Explicitly
-set this, rather than relying on the last initialisation IO access to
-leave it set to the right value by chance.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 5 +++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 1 +
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -529,7 +529,7 @@ int brcmf_sdiod_recv_buf(struct brcmf_sd
- 
- int brcmf_sdiod_recv_pkt(struct brcmf_sdio_dev *sdiodev, struct sk_buff *pkt)
- {
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err = 0;
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
-@@ -552,7 +552,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- {
- 	struct sk_buff *glom_skb = NULL;
- 	struct sk_buff *skb;
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err = 0;
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
-@@ -593,7 +593,7 @@ done:
- int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
- {
- 	struct sk_buff *mypkt;
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err;
- 
- 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
-@@ -625,7 +625,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 			 struct sk_buff_head *pktq)
- {
- 	struct sk_buff *skb;
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err;
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3842,6 +3842,11 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	if (!bus->sdio_core)
- 		goto fail;
- 
-+	/* Pick up the CHIPCOMMON core info struct, for bulk IO in bcmsdh.c */
-+	sdiodev->cc_core = brcmf_chip_get_core(bus->ci, BCMA_CORE_CHIPCOMMON);
-+	if (!sdiodev->cc_core)
-+		goto fail;
-+
- 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
- 						   BRCMF_BUSTYPE_SDIO,
- 						   bus->ci->chip,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -178,6 +178,7 @@ struct brcmf_sdio_dev {
- 	struct sdio_func *func[SDIO_MAX_FUNCS];
- 	u8 num_funcs;			/* Supported funcs on client */
- 	u32 sbwad;			/* Save backplane window address */
-+	struct brcmf_core *cc_core;	/* chipcommon core info struct */
- 	struct brcmf_sdio *bus;
- 	struct device *dev;
- 	struct brcmf_bus *bus_if;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch b/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
deleted file mode 100644
index 86b269a348..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 508422f3695bf66f7b85fb4723c22f5166003ec6 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:10 +0100
-Subject: [PATCH] brcmfmac: Correctly handle accesses to SDIO func0
-
-Rather than workaround the restrictions on func0 addressing in the
-driver, set MMC_QUIRK_LENIENT_FN0
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 ++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 4 ++--
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -995,6 +995,10 @@ static int brcmf_ops_sdio_probe(struct s
- 	brcmf_dbg(SDIO, "Function#: %d\n", func->num);
- 
- 	dev = &func->dev;
-+
-+	/* Set MMC_QUIRK_LENIENT_FN0 for this card */
-+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
-+
- 	/* prohibit ACPI power management for this device */
- 	brcmf_sdiod_acpi_set_power_manageable(dev, 0);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -297,10 +297,10 @@ void brcmf_sdiod_intr_unregister(struct
- /* SDIO device register access interface */
- /* Accessors for SDIO Function 0 */
- #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
--	sdio_readb((sdiodev)->func[0], (addr), (r))
-+	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
- 
- #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
--	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
-+	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
- 
- /* Accessors for SDIO Function 1 */
- #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch b/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
deleted file mode 100644
index 715b865619..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From 99d7b6fdfc8c24052c92c720330d31ca1332f996 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:11 +0100
-Subject: [PATCH] brcmfmac: Remove func0 from function array
-
-func0 is not provided by the mmc stack as a function when probing.
-Instead providing specific access functions to read/write it.
-
-This prepares for a patch to remove the actual array entry itself.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: rephrased the commit message]
-[arend: removed unrelated comment for which separate patch is warranted]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  5 +----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   |  7 ++++---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 13 ++++++-------
- 3 files changed, 11 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -1022,8 +1022,7 @@ static int brcmf_ops_sdio_probe(struct s
- 	/* store refs to functions used. mmc_card does
- 	 * not hold the F0 function pointer.
- 	 */
--	sdiodev->func[0] = kmemdup(func, sizeof(*func), GFP_KERNEL);
--	sdiodev->func[0]->num = 0;
-+	sdiodev->func[0] = NULL;
- 	sdiodev->func[1] = func->card->sdio_func[0];
- 	sdiodev->func[2] = func;
- 
-@@ -1049,7 +1048,6 @@ static int brcmf_ops_sdio_probe(struct s
- fail:
- 	dev_set_drvdata(&func->dev, NULL);
- 	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
--	kfree(sdiodev->func[0]);
- 	kfree(sdiodev);
- 	kfree(bus_if);
- 	return err;
-@@ -1082,7 +1080,6 @@ static void brcmf_ops_sdio_remove(struct
- 		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
- 
- 		kfree(bus_if);
--		kfree(sdiodev->func[0]);
- 		kfree(sdiodev);
- 	}
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3771,9 +3771,10 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	u32 val, rev;
- 
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
--	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
--	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
--	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
-+
-+	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
-+	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
-+	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
- 			val &= ~CID_ID_MASK;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -21,7 +21,9 @@
- #include <linux/firmware.h>
- #include "firmware.h"
- 
--#define SDIO_FUNC_0		0
-+/* Maximum number of I/O funcs */
-+#define NUM_SDIO_FUNCS	3
-+
- #define SDIO_FUNC_1		1
- #define SDIO_FUNC_2		2
- 
-@@ -39,9 +41,6 @@
- #define INTR_STATUS_FUNC1	0x2
- #define INTR_STATUS_FUNC2	0x4
- 
--/* Maximum number of I/O funcs */
--#define SDIOD_MAX_IOFUNCS	7
--
- /* mask of register map */
- #define REG_F0_REG_MASK		0x7FF
- #define REG_F1_MISC_MASK	0x1FFFF
-@@ -175,7 +174,7 @@ struct brcmf_sdio;
- struct brcmf_sdiod_freezer;
- 
- struct brcmf_sdio_dev {
--	struct sdio_func *func[SDIO_MAX_FUNCS];
-+	struct sdio_func *func[NUM_SDIO_FUNCS];
- 	u8 num_funcs;			/* Supported funcs on client */
- 	u32 sbwad;			/* Save backplane window address */
- 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
-@@ -297,10 +296,10 @@ void brcmf_sdiod_intr_unregister(struct
- /* SDIO device register access interface */
- /* Accessors for SDIO Function 0 */
- #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
--	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
-+	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
- 
- #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
--	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
-+	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
- 
- /* Accessors for SDIO Function 1 */
- #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch b/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
deleted file mode 100644
index 71e4894b06..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From bcadaaa097c7ec103fe75f9da41f8fe52693b644 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 19 Dec 2017 13:47:12 +0100
-Subject: [PATCH] brcmfmac: More efficient and slightly easier to read fixup
- for 4339 chips
-
-Its more efficient to test the register we're interested in first,
-potentially avoiding two more comparisons, and therefore always avoiding
-one comparison per call on all other chips.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-[arend: fix some checkpatch warnings]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3772,15 +3772,16 @@ static u32 brcmf_sdio_buscore_read32(voi
- 
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 
--	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
--	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
--	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
-+	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
-+	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
-+	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
- 			val &= ~CID_ID_MASK;
- 			val |= BRCM_CC_4339_CHIP_ID;
- 		}
- 	}
-+
- 	return val;
- }
- 
diff --git a/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch b/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
deleted file mode 100644
index 4354a7081c..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
+++ /dev/null
@@ -1,347 +0,0 @@
-From 00eb62cfc5f806b003fe5d54c8b5fe9a9665482f Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:13 +0100
-Subject: [PATCH] brcmfmac: Replace function index with function pointer
-
-In preparation for removing the function array, remove all code that
-refers to function by index and replace with pointers to the function
-itself.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: replace BUG() with WARN() macro]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 85 ++++++++++++----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 15 ++--
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  6 +-
- 3 files changed, 56 insertions(+), 50 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -291,8 +291,9 @@ out:
- 		*ret = retval;
- }
- 
--static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
--				 u32 addr, struct sk_buff *pkt)
-+static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
-+				 struct sdio_func *func, u32 addr,
-+				 struct sk_buff *pkt)
- {
- 	unsigned int req_sz;
- 	int err;
-@@ -301,13 +302,19 @@ static int brcmf_sdiod_buff_read(struct
- 	req_sz = pkt->len + 3;
- 	req_sz &= (uint)~3;
- 
--	if (fn == 1)
--		err = sdio_memcpy_fromio(sdiodev->func[fn],
--					 ((u8 *)(pkt->data)), addr, req_sz);
--	else
--		/* function 2 read is FIFO operation */
--		err = sdio_readsb(sdiodev->func[fn],
--				  ((u8 *)(pkt->data)), addr, req_sz);
-+	switch (func->num) {
-+	case 1:
-+		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
-+					 req_sz);
-+		break;
-+	case 2:
-+		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
-+		break;
-+	default:
-+		/* bail out as things are really fishy here */
-+		WARN(1, "invalid sdio function number: %d\n", func->num);
-+		err = -ENOMEDIUM;
-+	};
- 
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-@@ -315,8 +322,9 @@ static int brcmf_sdiod_buff_read(struct
- 	return err;
- }
- 
--static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
--				  u32 addr, struct sk_buff *pkt)
-+static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
-+				  struct sdio_func *func, u32 addr,
-+				  struct sk_buff *pkt)
- {
- 	unsigned int req_sz;
- 	int err;
-@@ -325,8 +333,7 @@ static int brcmf_sdiod_buff_write(struct
- 	req_sz = pkt->len + 3;
- 	req_sz &= (uint)~3;
- 
--	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
--			       ((u8 *)(pkt->data)), req_sz);
-+	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
- 
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-@@ -337,7 +344,7 @@ static int brcmf_sdiod_buff_write(struct
- /**
-  * brcmf_sdiod_sglist_rw - SDIO interface function for block data access
-  * @sdiodev: brcmfmac sdio device
-- * @fn: SDIO function number
-+ * @func: SDIO function
-  * @write: direction flag
-  * @addr: dongle memory address as source/destination
-  * @pkt: skb pointer
-@@ -346,7 +353,8 @@ static int brcmf_sdiod_buff_write(struct
-  * stack for block data access. It assumes that the skb passed down by the
-  * caller has already been padded and aligned.
-  */
--static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
-+static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev,
-+				 struct sdio_func *func,
- 				 bool write, u32 addr,
- 				 struct sk_buff_head *pktlist)
- {
-@@ -372,7 +380,7 @@ static int brcmf_sdiod_sglist_rw(struct
- 		req_sz = 0;
- 		skb_queue_walk(pktlist, pkt_next)
- 			req_sz += pkt_next->len;
--		req_sz = ALIGN(req_sz, sdiodev->func[fn]->cur_blksize);
-+		req_sz = ALIGN(req_sz, func->cur_blksize);
- 		while (req_sz > PAGE_SIZE) {
- 			pkt_next = brcmu_pkt_buf_get_skb(PAGE_SIZE);
- 			if (pkt_next == NULL) {
-@@ -391,7 +399,7 @@ static int brcmf_sdiod_sglist_rw(struct
- 		target_list = &local_list;
- 	}
- 
--	func_blk_sz = sdiodev->func[fn]->cur_blksize;
-+	func_blk_sz = func->cur_blksize;
- 	max_req_sz = sdiodev->max_request_size;
- 	max_seg_cnt = min_t(unsigned short, sdiodev->max_segment_count,
- 			    target_list->qlen);
-@@ -408,10 +416,10 @@ static int brcmf_sdiod_sglist_rw(struct
- 	mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
- 	mmc_cmd.opcode = SD_IO_RW_EXTENDED;
- 	mmc_cmd.arg = write ? 1<<31 : 0;	/* write flag  */
--	mmc_cmd.arg |= (fn & 0x7) << 28;	/* SDIO func num */
--	mmc_cmd.arg |= 1<<27;			/* block mode */
-+	mmc_cmd.arg |= (func->num & 0x7) << 28;	/* SDIO func num */
-+	mmc_cmd.arg |= 1 << 27;			/* block mode */
- 	/* for function 1 the addr will be incremented */
--	mmc_cmd.arg |= (fn == 1) ? 1<<26 : 0;
-+	mmc_cmd.arg |= (func->num == 1) ? 1 << 26 : 0;
- 	mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
- 	mmc_req.cmd = &mmc_cmd;
- 	mmc_req.data = &mmc_dat;
-@@ -457,11 +465,11 @@ static int brcmf_sdiod_sglist_rw(struct
- 		mmc_cmd.arg |= (addr & 0x1FFFF) << 9;	/* address */
- 		mmc_cmd.arg |= mmc_dat.blocks & 0x1FF;	/* block count */
- 		/* incrementing addr for function 1 */
--		if (fn == 1)
-+		if (func->num == 1)
- 			addr += req_sz;
- 
--		mmc_set_data_timeout(&mmc_dat, sdiodev->func[fn]->card);
--		mmc_wait_for_req(sdiodev->func[fn]->card->host, &mmc_req);
-+		mmc_set_data_timeout(&mmc_dat, func->card);
-+		mmc_wait_for_req(func->card->host, &mmc_req);
- 
- 		ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
- 		if (ret == -ENOMEDIUM) {
-@@ -541,7 +549,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
-+	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
- 
- done:
- 	return err;
-@@ -566,13 +574,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
- 					    pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
- 					    glom_skb);
- 		if (err)
- 			goto done;
-@@ -582,8 +590,8 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 			skb_pull(glom_skb, skb->len);
- 		}
- 	} else
--		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
--					    pktq);
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
-+					    addr, pktq);
- 
- done:
- 	brcmu_pkt_buf_free_skb(glom_skb);
-@@ -614,7 +622,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
--		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
-+		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
-+					     mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
- 
-@@ -639,14 +648,14 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
- 						     addr, skb);
- 			if (err)
- 				break;
- 		}
- 	} else {
--		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
--					    pktq);
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
-+					    addr, pktq);
- 	}
- 
- 	return err;
-@@ -696,10 +705,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 		if (write) {
- 			memcpy(pkt->data, data, dsize);
--			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
- 						     sdaddr, pkt);
- 		} else {
--			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
-+			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
- 						    sdaddr, pkt);
- 		}
- 
-@@ -728,12 +737,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	return err;
- }
- 
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func)
- {
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Issue abort cmd52 command through F0 */
--	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
-+	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, func->num, NULL);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
-@@ -1105,7 +1114,7 @@ static int brcmf_ops_sdio_suspend(struct
- 
- 	func = container_of(dev, struct sdio_func, dev);
- 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
--	if (func->num != SDIO_FUNC_1)
-+	if (func->num != 1)
- 		return 0;
- 
- 
-@@ -1134,7 +1143,7 @@ static int brcmf_ops_sdio_resume(struct
- 	struct sdio_func *func = container_of(dev, struct sdio_func, dev);
- 
- 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
--	if (func->num != SDIO_FUNC_2)
-+	if (func->num != 2)
- 		return 0;
- 
- 	brcmf_sdiod_freezer_off(sdiodev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
- 		  rtx ? ", send NAK" : "");
- 
- 	if (abort)
--		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
-+		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
- 
- 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
- 			   &err);
-@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
- 	brcmf_err("sdio error, abort command and terminate frame\n");
- 	bus->sdcnt.tx_sderrs++;
- 
--	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
-+	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
- 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
- 	bus->sdcnt.f1regdata++;
- 
-@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
- 	int ntail, ret;
- 
- 	sdiodev = bus->sdiodev;
--	blksize = sdiodev->func[SDIO_FUNC_2]->cur_blksize;
-+	blksize = sdiodev->func[2]->cur_blksize;
- 	/* sg entry alignment should be a divisor of block size */
- 	WARN_ON(blksize % bus->sgentry_align);
- 
-@@ -2441,7 +2441,7 @@ static void brcmf_sdio_bus_stop(struct d
- 
- 		/* Turn off the bus (F2), free any pending packets */
- 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
--		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
-+		sdio_disable_func(sdiodev->func[2]);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
- 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
-@@ -4066,8 +4066,7 @@ static void brcmf_sdio_firmware_callback
- 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
- 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
- 
--	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
--
-+	err = sdio_enable_func(sdiodev->func[2]);
- 
- 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
- 
-@@ -4082,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
--		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
-+		sdio_disable_func(sdiodev->func[2]);
- 		goto release;
- 	}
- 
-@@ -4219,7 +4218,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	sdio_claim_host(bus->sdiodev->func[1]);
- 
- 	/* Disable F2 to clear any intermediate frame state on the dongle */
--	sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
-+	sdio_disable_func(bus->sdiodev->func[2]);
- 
- 	bus->rxflow = false;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -45,9 +45,6 @@
- #define REG_F0_REG_MASK		0x7FF
- #define REG_F1_MISC_MASK	0x1FFFF
- 
--/* as of sdiod rev 0, supports 3 functions */
--#define SBSDIO_NUM_FUNCTION		3
--
- /* function 0 vendor specific CCCR registers */
- 
- #define SDIO_CCCR_BRCM_CARDCAP			0xf0
-@@ -350,7 +347,8 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
- 		      u8 *data, uint size);
- 
- /* Issue an abort to the specified function */
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func);
-+
- void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
- 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch b/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
deleted file mode 100644
index d732c8e58a..0000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 9c3438ed215adba7025268ee1f0b6f7a2af12316 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:14 +0100
-Subject: [PATCH] brcmfmac: Clean up interrupt macros
-
-Make it more obvious that this code acually enables interrupts, and
-provide nice definitions for the bits in the register.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 8 +++++---
- 2 files changed, 7 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -149,7 +149,8 @@ int brcmf_sdiod_intr_register(struct brc
- 
- 		/* must configure SDIO_CCCR_IENx to enable irq */
- 		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
--		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
-+		data |= SDIO_CCCR_IEN_FUNC1 | SDIO_CCCR_IEN_FUNC2 |
-+			SDIO_CCCR_IEN_FUNC0;
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
- 
- 		/* redirect, configure and enable io for interrupt signal */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -24,9 +24,6 @@
- /* Maximum number of I/O funcs */
- #define NUM_SDIO_FUNCS	3
- 
--#define SDIO_FUNC_1		1
--#define SDIO_FUNC_2		2
--
- #define SDIOD_FBR_SIZE		0x100
- 
- /* io_en */
-@@ -52,6 +49,11 @@
- #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
- #define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
- 
-+/* Interrupt enable bits for each function */
-+#define SDIO_CCCR_IEN_FUNC0			BIT(0)
-+#define SDIO_CCCR_IEN_FUNC1			BIT(1)
-+#define SDIO_CCCR_IEN_FUNC2			BIT(2)
-+
- #define SDIO_CCCR_BRCM_CARDCTRL			0xf1
- #define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
- 
diff --git a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
deleted file mode 100644
index d010d23f01..0000000000
--- a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From e3720dad99859251a8b0fe2807275a8afcfb560d Mon Sep 17 00:00:00 2001
-From: Double Lo <double.lo@cypress.com>
-Date: Tue, 19 Dec 2017 14:56:44 +0800
-Subject: [PATCH] brcmfmac: Support 43455 save-restore (SR) feature if FW
- include -sr
-
-This patch will add 43455 into the save-restore(SR) capable chip list, so
-the SR engine will be enabled with 43455 FW which built-in the -sr
-function.
-
-Signed-off-by: Double Lo <double.lo@cypress.com>
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -1338,6 +1338,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
- 	switch (pub->chip) {
- 	case BRCM_CC_4354_CHIP_ID:
- 	case BRCM_CC_4356_CHIP_ID:
-+	case BRCM_CC_4345_CHIP_ID:
- 		/* explicitly check SR engine enable bit */
- 		pmu_cc3_mask = BIT(2);
- 		/* fall-through */
diff --git a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
deleted file mode 100644
index bd9de13d7a..0000000000
--- a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
+++ /dev/null
@@ -1,1043 +0,0 @@
-From c9aa7a91de740c537dc8c2f9f3d36fc651371b13 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 9 Jan 2018 13:22:52 +0100
-Subject: [PATCH] brcmfmac: Remove array of functions
-
-Replace the array of functions with a pair of pointers to the
-relevant functions.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 115 +++++++-------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 168 ++++++++++-----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  15 +-
- 3 files changed, 146 insertions(+), 152 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -118,7 +118,7 @@ int brcmf_sdiod_intr_register(struct brc
- 
- 		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
- 				  pdata->oob_irq_flags, "brcmf_oob_intr",
--				  &sdiodev->func[1]->dev);
-+				  &sdiodev->func1->dev);
- 		if (ret != 0) {
- 			brcmf_err("request_irq failed %d\n", ret);
- 			return ret;
-@@ -132,7 +132,7 @@ int brcmf_sdiod_intr_register(struct brc
- 		}
- 		sdiodev->irq_wake = true;
- 
--		sdio_claim_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
- 
- 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
- 			/* assign GPIO to SDIO core */
-@@ -159,13 +159,13 @@ int brcmf_sdiod_intr_register(struct brc
- 			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
- 				     data, &ret);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 	} else {
- 		brcmf_dbg(SDIO, "Entering\n");
--		sdio_claim_host(sdiodev->func[1]);
--		sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler);
--		sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
-+		sdio_claim_irq(sdiodev->func1, brcmf_sdiod_ib_irqhandler);
-+		sdio_claim_irq(sdiodev->func2, brcmf_sdiod_dummy_irqhandler);
-+		sdio_release_host(sdiodev->func1);
- 		sdiodev->sd_irq_requested = true;
- 	}
- 
-@@ -183,26 +183,26 @@ void brcmf_sdiod_intr_unregister(struct
- 		struct brcmfmac_sdio_pd *pdata;
- 
- 		pdata = &sdiodev->settings->bus.sdio;
--		sdio_claim_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 
- 		sdiodev->oob_irq_requested = false;
- 		if (sdiodev->irq_wake) {
- 			disable_irq_wake(pdata->oob_irq_nr);
- 			sdiodev->irq_wake = false;
- 		}
--		free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
-+		free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev);
- 		sdiodev->irq_en = false;
- 		sdiodev->oob_irq_requested = false;
- 	}
- 
- 	if (sdiodev->sd_irq_requested) {
--		sdio_claim_host(sdiodev->func[1]);
--		sdio_release_irq(sdiodev->func[2]);
--		sdio_release_irq(sdiodev->func[1]);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
-+		sdio_release_irq(sdiodev->func2);
-+		sdio_release_irq(sdiodev->func1);
-+		sdio_release_host(sdiodev->func1);
- 		sdiodev->sd_irq_requested = false;
- 	}
- }
-@@ -264,7 +264,7 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	data = sdio_readl(sdiodev->func[1], addr, &retval);
-+	data = sdio_readl(sdiodev->func1, addr, &retval);
- 
- out:
- 	if (ret)
-@@ -285,7 +285,7 @@ void brcmf_sdiod_writel(struct brcmf_sdi
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	sdio_writel(sdiodev->func[1], data, addr, &retval);
-+	sdio_writel(sdiodev->func1, data, addr, &retval);
- 
- out:
- 	if (ret)
-@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
-+	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
- 
- done:
- 	return err;
-@@ -575,13 +575,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
- 					    pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
- 					    glom_skb);
- 		if (err)
- 			goto done;
-@@ -591,7 +591,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 			skb_pull(glom_skb, skb->len);
- 		}
- 	} else
--		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, false,
- 					    addr, pktq);
- 
- done:
-@@ -623,7 +623,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
--		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
-+		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
- 					     mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
-@@ -649,13 +649,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
- 						     addr, skb);
- 			if (err)
- 				break;
- 		}
- 	} else {
--		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, true,
- 					    addr, pktq);
- 	}
- 
-@@ -686,7 +686,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	else
- 		dsize = size;
- 
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 
- 	/* Do the transfer(s) */
- 	while (size) {
-@@ -706,10 +706,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 		if (write) {
- 			memcpy(pkt->data, data, dsize);
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
- 						     sdaddr, pkt);
- 		} else {
--			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
-+			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
- 						    sdaddr, pkt);
- 		}
- 
-@@ -733,7 +733,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 	dev_kfree_skb(pkt);
- 
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 
- 	return err;
- }
-@@ -757,7 +757,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
- 	uint nents;
- 	int err;
- 
--	func = sdiodev->func[2];
-+	func = sdiodev->func2;
- 	host = func->card->host;
- 	sdiodev->sg_support = host->max_segs > 1;
- 	max_blocks = min_t(uint, host->max_blk_count, 511u);
-@@ -818,17 +818,17 @@ static int brcmf_sdiod_freezer_on(struct
- 	brcmf_sdio_trigger_dpc(sdiodev->bus);
- 	wait_event(sdiodev->freezer->thread_freeze,
- 		   atomic_read(expect) == sdiodev->freezer->frozen_count);
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 	res = brcmf_sdio_sleep(sdiodev->bus, true);
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	return res;
- }
- 
- static void brcmf_sdiod_freezer_off(struct brcmf_sdio_dev *sdiodev)
- {
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 	brcmf_sdio_sleep(sdiodev->bus, false);
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	atomic_set(&sdiodev->freezer->freezing, 0);
- 	complete_all(&sdiodev->freezer->resumed);
- }
-@@ -878,19 +878,19 @@ static int brcmf_sdiod_remove(struct brc
- 	brcmf_sdiod_freezer_detach(sdiodev);
- 
- 	/* Disable Function 2 */
--	sdio_claim_host(sdiodev->func[2]);
--	sdio_disable_func(sdiodev->func[2]);
--	sdio_release_host(sdiodev->func[2]);
-+	sdio_claim_host(sdiodev->func2);
-+	sdio_disable_func(sdiodev->func2);
-+	sdio_release_host(sdiodev->func2);
- 
- 	/* Disable Function 1 */
--	sdio_claim_host(sdiodev->func[1]);
--	sdio_disable_func(sdiodev->func[1]);
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
-+	sdio_disable_func(sdiodev->func1);
-+	sdio_release_host(sdiodev->func1);
- 
- 	sg_free_table(&sdiodev->sgtable);
- 	sdiodev->sbwad = 0;
- 
--	pm_runtime_allow(sdiodev->func[1]->card->host->parent);
-+	pm_runtime_allow(sdiodev->func1->card->host->parent);
- 	return 0;
- }
- 
-@@ -906,29 +906,27 @@ static int brcmf_sdiod_probe(struct brcm
- {
- 	int ret = 0;
- 
--	sdiodev->num_funcs = 2;
-+	sdio_claim_host(sdiodev->func1);
- 
--	sdio_claim_host(sdiodev->func[1]);
--
--	ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
-+	ret = sdio_set_block_size(sdiodev->func1, SDIO_FUNC1_BLOCKSIZE);
- 	if (ret) {
- 		brcmf_err("Failed to set F1 blocksize\n");
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 		goto out;
- 	}
--	ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
-+	ret = sdio_set_block_size(sdiodev->func2, SDIO_FUNC2_BLOCKSIZE);
- 	if (ret) {
- 		brcmf_err("Failed to set F2 blocksize\n");
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 		goto out;
- 	}
- 
- 	/* increase F2 timeout */
--	sdiodev->func[2]->enable_timeout = SDIO_WAIT_F2RDY;
-+	sdiodev->func2->enable_timeout = SDIO_WAIT_F2RDY;
- 
- 	/* Enable Function 1 */
--	ret = sdio_enable_func(sdiodev->func[1]);
--	sdio_release_host(sdiodev->func[1]);
-+	ret = sdio_enable_func(sdiodev->func1);
-+	sdio_release_host(sdiodev->func1);
- 	if (ret) {
- 		brcmf_err("Failed to enable F1: err=%d\n", ret);
- 		goto out;
-@@ -944,7 +942,7 @@ static int brcmf_sdiod_probe(struct brcm
- 		ret = -ENODEV;
- 		goto out;
- 	}
--	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
-+	brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
- out:
- 	if (ret)
- 		brcmf_sdiod_remove(sdiodev);
-@@ -1032,16 +1030,15 @@ static int brcmf_ops_sdio_probe(struct s
- 	/* store refs to functions used. mmc_card does
- 	 * not hold the F0 function pointer.
- 	 */
--	sdiodev->func[0] = NULL;
--	sdiodev->func[1] = func->card->sdio_func[0];
--	sdiodev->func[2] = func;
-+	sdiodev->func1 = func->card->sdio_func[0];
-+	sdiodev->func2 = func;
- 
- 	sdiodev->bus_if = bus_if;
- 	bus_if->bus_priv.sdio = sdiodev;
- 	bus_if->proto_type = BRCMF_PROTO_BCDC;
- 	dev_set_drvdata(&func->dev, bus_if);
--	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
--	sdiodev->dev = &sdiodev->func[1]->dev;
-+	dev_set_drvdata(&sdiodev->func1->dev, bus_if);
-+	sdiodev->dev = &sdiodev->func1->dev;
- 
- 	brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
- 
-@@ -1057,7 +1054,7 @@ static int brcmf_ops_sdio_probe(struct s
- 
- fail:
- 	dev_set_drvdata(&func->dev, NULL);
--	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
-+	dev_set_drvdata(&sdiodev->func1->dev, NULL);
- 	kfree(sdiodev);
- 	kfree(bus_if);
- 	return err;
-@@ -1086,8 +1083,8 @@ static void brcmf_ops_sdio_remove(struct
- 		/* only proceed with rest of cleanup if func 1 */
- 		brcmf_sdiod_remove(sdiodev);
- 
--		dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
--		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
-+		dev_set_drvdata(&sdiodev->func1->dev, NULL);
-+		dev_set_drvdata(&sdiodev->func2->dev, NULL);
- 
- 		kfree(bus_if);
- 		kfree(sdiodev);
-@@ -1132,7 +1129,7 @@ static int brcmf_ops_sdio_suspend(struct
- 		else
- 			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
- 	}
--	if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
-+	if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags))
- 		brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
- 	return 0;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -979,7 +979,7 @@ static int brcmf_sdio_readshared(struct
- 	struct sdpcm_shared_le sh_le;
- 	__le32 addr_le;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	brcmf_sdio_bus_sleep(bus, false, false);
- 
- 	/*
-@@ -1013,7 +1013,7 @@ static int brcmf_sdio_readshared(struct
- 	if (rv < 0)
- 		goto fail;
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	/* Endianness */
- 	sh->flags = le32_to_cpu(sh_le.flags);
-@@ -1035,7 +1035,7 @@ static int brcmf_sdio_readshared(struct
- fail:
- 	brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
- 		  rv, addr);
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 	return rv;
- }
- 
-@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
- 		  rtx ? ", send NAK" : "");
- 
- 	if (abort)
--		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
-+		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func2);
- 
- 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
- 			   &err);
-@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
- 	brcmf_err("sdio error, abort command and terminate frame\n");
- 	bus->sdcnt.tx_sderrs++;
- 
--	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
-+	brcmf_sdiod_abort(sdiodev, sdiodev->func2);
- 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
- 	bus->sdcnt.f1regdata++;
- 
-@@ -1565,10 +1565,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 		 * read directly into the chained packet, or allocate a large
- 		 * packet and and copy into the chain.
- 		 */
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
- 						 &bus->glom, dlen);
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 		bus->sdcnt.f2rxdata++;
- 
- 		/* On failure, kill the superframe */
-@@ -1576,11 +1576,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 			brcmf_err("glom read of %d bytes failed: %d\n",
- 				  dlen, errcode);
- 
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			brcmf_sdio_rxfail(bus, true, false);
- 			bus->sdcnt.rxglomfail++;
- 			brcmf_sdio_free_glom(bus);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			return 0;
- 		}
- 
-@@ -1590,10 +1590,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 
- 		rd_new.seq_num = rxseq;
- 		rd_new.len = dlen;
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
- 					     BRCMF_SDIO_FT_SUPER);
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 		bus->cur_read.len = rd_new.len_nxtfrm << 4;
- 
- 		/* Remove superframe header, remember offset */
-@@ -1609,10 +1609,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 
- 			rd_new.len = pnext->len;
- 			rd_new.seq_num = rxseq++;
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
- 						     BRCMF_SDIO_FT_SUB);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
- 					   pnext->data, 32, "subframe:\n");
- 
-@@ -1621,11 +1621,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 
- 		if (errcode) {
- 			/* Terminate frame on error */
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			brcmf_sdio_rxfail(bus, true, false);
- 			bus->sdcnt.rxglomfail++;
- 			brcmf_sdio_free_glom(bus);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			bus->cur_read.len = 0;
- 			return 0;
- 		}
-@@ -1833,7 +1833,7 @@ static uint brcmf_sdio_readframes(struct
- 
- 		rd->len_left = rd->len;
- 		/* read header first for unknow frame length */
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		if (!rd->len) {
- 			ret = brcmf_sdiod_recv_buf(bus->sdiodev,
- 						   bus->rxhdr, BRCMF_FIRSTREAD);
-@@ -1843,7 +1843,7 @@ static uint brcmf_sdio_readframes(struct
- 					  ret);
- 				bus->sdcnt.rx_hdrfail++;
- 				brcmf_sdio_rxfail(bus, true, true);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				continue;
- 			}
- 
-@@ -1853,7 +1853,7 @@ static uint brcmf_sdio_readframes(struct
- 
- 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
- 					       BRCMF_SDIO_FT_NORMAL)) {
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				if (!bus->rxpending)
- 					break;
- 				else
-@@ -1869,7 +1869,7 @@ static uint brcmf_sdio_readframes(struct
- 				rd->len_nxtfrm = 0;
- 				/* treat all packet as event if we don't know */
- 				rd->channel = SDPCM_EVENT_CHANNEL;
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				continue;
- 			}
- 			rd->len_left = rd->len > BRCMF_FIRSTREAD ?
-@@ -1886,7 +1886,7 @@ static uint brcmf_sdio_readframes(struct
- 			brcmf_err("brcmu_pkt_buf_get_skb failed\n");
- 			brcmf_sdio_rxfail(bus, false,
- 					    RETRYCHAN(rd->channel));
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			continue;
- 		}
- 		skb_pull(pkt, head_read);
-@@ -1894,16 +1894,16 @@ static uint brcmf_sdio_readframes(struct
- 
- 		ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
- 		bus->sdcnt.f2rxdata++;
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 
- 		if (ret < 0) {
- 			brcmf_err("read %d bytes from channel %d failed: %d\n",
- 				  rd->len, rd->channel, ret);
- 			brcmu_pkt_buf_free_skb(pkt);
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			brcmf_sdio_rxfail(bus, true,
- 					    RETRYCHAN(rd->channel));
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			continue;
- 		}
- 
-@@ -1914,7 +1914,7 @@ static uint brcmf_sdio_readframes(struct
- 		} else {
- 			memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
- 			rd_new.seq_num = rd->seq_num;
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
- 					       BRCMF_SDIO_FT_NORMAL)) {
- 				rd->len = 0;
-@@ -1927,11 +1927,11 @@ static uint brcmf_sdio_readframes(struct
- 					  roundup(rd_new.len, 16) >> 4);
- 				rd->len = 0;
- 				brcmf_sdio_rxfail(bus, true, true);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				brcmu_pkt_buf_free_skb(pkt);
- 				continue;
- 			}
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			rd->len_nxtfrm = rd_new.len_nxtfrm;
- 			rd->channel = rd_new.channel;
- 			rd->dat_offset = rd_new.dat_offset;
-@@ -1947,9 +1947,9 @@ static uint brcmf_sdio_readframes(struct
- 					  rd_new.seq_num);
- 				/* Force retry w/normal header read */
- 				rd->len = 0;
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_rxfail(bus, false, true);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				brcmu_pkt_buf_free_skb(pkt);
- 				continue;
- 			}
-@@ -1972,9 +1972,9 @@ static uint brcmf_sdio_readframes(struct
- 			} else {
- 				brcmf_err("%s: glom superframe w/o "
- 					  "descriptor!\n", __func__);
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_rxfail(bus, false, false);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 			}
- 			/* prepare the descriptor for the next read */
- 			rd->len = rd->len_nxtfrm << 4;
-@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
- 	int ntail, ret;
- 
- 	sdiodev = bus->sdiodev;
--	blksize = sdiodev->func[2]->cur_blksize;
-+	blksize = sdiodev->func2->cur_blksize;
- 	/* sg entry alignment should be a divisor of block size */
- 	WARN_ON(blksize % bus->sgentry_align);
- 
-@@ -2251,14 +2251,14 @@ static int brcmf_sdio_txpkt(struct brcmf
- 	if (ret)
- 		goto done;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
- 	bus->sdcnt.f2txdata++;
- 
- 	if (ret < 0)
- 		brcmf_sdio_txfail(bus);
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- done:
- 	brcmf_sdio_txpkt_postp(bus, pktq);
-@@ -2314,10 +2314,11 @@ static uint brcmf_sdio_sendfromq(struct
- 		/* In poll mode, need to check for other events */
- 		if (!bus->intr) {
- 			/* Check device status, signal pending interrupt */
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			intstatus = brcmf_sdiod_readl(bus->sdiodev,
- 						      intstat_addr, &ret);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
-+
- 			bus->sdcnt.f2txdata++;
- 			if (ret != 0)
- 				break;
-@@ -2417,7 +2418,7 @@ static void brcmf_sdio_bus_stop(struct d
- 	}
- 
- 	if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
--		sdio_claim_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
- 
- 		/* Enable clock for device interrupts */
- 		brcmf_sdio_bus_sleep(bus, false, false);
-@@ -2441,13 +2442,13 @@ static void brcmf_sdio_bus_stop(struct d
- 
- 		/* Turn off the bus (F2), free any pending packets */
- 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
--		sdio_disable_func(sdiodev->func[2]);
-+		sdio_disable_func(sdiodev->func2);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
- 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
- 				   local_hostintmask, NULL);
- 
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 	}
- 	/* Clear the data packet queues */
- 	brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
-@@ -2522,7 +2523,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 
- 	/* If waiting for HTAVAIL, check status */
- 	if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
-@@ -2585,7 +2586,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 		intstatus |= brcmf_sdio_hostmail(bus);
- 	}
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	/* Generally don't ask for these, can get CRC errors... */
- 	if (intstatus & I_WR_OOSYNC) {
-@@ -2628,7 +2629,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
- 	    data_ok(bus)) {
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		if (bus->ctrl_frame_stat) {
- 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
- 						      bus->ctrl_frame_len);
-@@ -2636,7 +2637,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 			wmb();
- 			bus->ctrl_frame_stat = false;
- 		}
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 		brcmf_sdio_wait_event_wakeup(bus);
- 	}
- 	/* Send queued frames (limit 1 if rx may still be pending) */
-@@ -2652,14 +2653,14 @@ static void brcmf_sdio_dpc(struct brcmf_
- 		brcmf_err("failed backplane access over SDIO, halting operation\n");
- 		atomic_set(&bus->intstatus, 0);
- 		if (bus->ctrl_frame_stat) {
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			if (bus->ctrl_frame_stat) {
- 				bus->ctrl_frame_err = -ENODEV;
- 				wmb();
- 				bus->ctrl_frame_stat = false;
- 				brcmf_sdio_wait_event_wakeup(bus);
- 			}
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 		}
- 	} else if (atomic_read(&bus->intstatus) ||
- 		   atomic_read(&bus->ipend) > 0 ||
-@@ -2874,13 +2875,13 @@ brcmf_sdio_bus_txctl(struct device *dev,
- 					 CTL_DONE_TIMEOUT);
- 	ret = 0;
- 	if (bus->ctrl_frame_stat) {
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		if (bus->ctrl_frame_stat) {
- 			brcmf_dbg(SDIO, "ctrl_frame timeout\n");
- 			bus->ctrl_frame_stat = false;
- 			ret = -ETIMEDOUT;
- 		}
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 	}
- 	if (!ret) {
- 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
-@@ -3004,7 +3005,7 @@ static int brcmf_sdio_assert_info(struct
- 		return 0;
- 	}
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	if (sh->assert_file_addr != 0) {
- 		error = brcmf_sdiod_ramrw(bus->sdiodev, false,
- 					  sh->assert_file_addr, (u8 *)file, 80);
-@@ -3017,7 +3018,7 @@ static int brcmf_sdio_assert_info(struct
- 		if (error < 0)
- 			return error;
- 	}
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	seq_printf(seq, "dongle assert: %s:%d: assert(%s)\n",
- 		   file, sh->assert_line, expr);
-@@ -3291,7 +3292,7 @@ static int brcmf_sdio_download_firmware(
- 	int bcmerror;
- 	u32 rstvec;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
- 
- 	rstvec = get_unaligned_le32(fw->data);
-@@ -3320,7 +3321,7 @@ static int brcmf_sdio_download_firmware(
- 
- err:
- 	brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 	return bcmerror;
- }
- 
-@@ -3435,7 +3436,7 @@ static int brcmf_sdio_bus_preinit(struct
- 	if (sdiodev->sg_support) {
- 		bus->txglom = false;
- 		value = 1;
--		pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
-+		pad_size = bus->sdiodev->func2->cur_blksize << 1;
- 		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
- 					   &value, sizeof(u32));
- 		if (err < 0) {
-@@ -3477,7 +3478,7 @@ static int brcmf_sdio_bus_get_memdump(st
- 
- 	address = bus->ci->rambase;
- 	offset = err = 0;
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 	while (offset < mem_size) {
- 		len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
- 		      mem_size - offset;
-@@ -3493,7 +3494,7 @@ static int brcmf_sdio_bus_get_memdump(st
- 	}
- 
- done:
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	return err;
- }
- 
-@@ -3550,11 +3551,10 @@ static void brcmf_sdio_bus_watchdog(stru
- 			if (!bus->dpc_triggered) {
- 				u8 devpend;
- 
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
--							       SDIO_CCCR_INTx,
--							       NULL);
--				sdio_release_host(bus->sdiodev->func[1]);
-+						  SDIO_CCCR_INTx, NULL);
-+				sdio_release_host(bus->sdiodev->func1);
- 				intstatus = devpend & (INTR_STATUS_FUNC1 |
- 						       INTR_STATUS_FUNC2);
- 			}
-@@ -3580,13 +3580,13 @@ static void brcmf_sdio_bus_watchdog(stru
- 		bus->console.count += jiffies_to_msecs(BRCMF_WD_POLL);
- 		if (bus->console.count >= bus->console_interval) {
- 			bus->console.count -= bus->console_interval;
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			/* Make sure backplane clock is on */
- 			brcmf_sdio_bus_sleep(bus, false, false);
- 			if (brcmf_sdio_readconsole(bus) < 0)
- 				/* stop on error */
- 				bus->console_interval = 0;
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 		}
- 	}
- #endif				/* DEBUG */
-@@ -3599,11 +3599,11 @@ static void brcmf_sdio_bus_watchdog(stru
- 			bus->idlecount++;
- 			if (bus->idlecount > bus->idletime) {
- 				brcmf_dbg(SDIO, "idle\n");
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_wd_timer(bus, false);
- 				bus->idlecount = 0;
- 				brcmf_sdio_bus_sleep(bus, true, false);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 			}
- 		} else {
- 			bus->idlecount = 0;
-@@ -3773,8 +3773,8 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 
- 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
--	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
--	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
-+	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
-+	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
- 			val &= ~CID_ID_MASK;
-@@ -3810,7 +3810,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	u32 drivestrength;
- 
- 	sdiodev = bus->sdiodev;
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 
- 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
- 		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
-@@ -3877,8 +3877,8 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
- 	 * is true or when platform data OOB irq is true).
- 	 */
--	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
--	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
-+	if ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_KEEP_POWER) &&
-+	    ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_WAKE_SDIO_IRQ) ||
- 	     (sdiodev->settings->bus.sdio.oob_irq_supported)))
- 		sdiodev->bus_if->wowl_supported = true;
- #endif
-@@ -3917,7 +3917,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	if (err)
- 		goto fail;
- 
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 
- 	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
- 
-@@ -3938,7 +3938,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	return true;
- 
- fail:
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	return false;
- }
- 
-@@ -4044,7 +4044,7 @@ static void brcmf_sdio_firmware_callback
- 	bus->sdcnt.tickcnt = 0;
- 	brcmf_sdio_wd_timer(bus, true);
- 
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 
- 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-@@ -4066,7 +4066,7 @@ static void brcmf_sdio_firmware_callback
- 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
- 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
- 
--	err = sdio_enable_func(sdiodev->func[2]);
-+	err = sdio_enable_func(sdiodev->func2);
- 
- 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
- 
-@@ -4081,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
--		sdio_disable_func(sdiodev->func[2]);
-+		sdio_disable_func(sdiodev->func2);
- 		goto release;
- 	}
- 
-@@ -4106,7 +4106,7 @@ static void brcmf_sdio_firmware_callback
- 	if (err != 0)
- 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
- 
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 
- 	err = brcmf_bus_started(dev);
- 	if (err != 0) {
-@@ -4116,10 +4116,10 @@ static void brcmf_sdio_firmware_callback
- 	return;
- 
- release:
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
--	device_release_driver(&sdiodev->func[2]->dev);
-+	device_release_driver(&sdiodev->func2->dev);
- 	device_release_driver(dev);
- }
- 
-@@ -4146,7 +4146,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 
- 	/* single-threaded workqueue */
- 	wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
--				     dev_name(&sdiodev->func[1]->dev));
-+				     dev_name(&sdiodev->func1->dev));
- 	if (!wq) {
- 		brcmf_err("insufficient memory to create txworkqueue\n");
- 		goto fail;
-@@ -4173,7 +4173,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	init_completion(&bus->watchdog_wait);
- 	bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
- 					bus, "brcmf_wdog/%s",
--					dev_name(&sdiodev->func[1]->dev));
-+					dev_name(&sdiodev->func1->dev));
- 	if (IS_ERR(bus->watchdog_tsk)) {
- 		pr_warn("brcmf_watchdog thread failed to start\n");
- 		bus->watchdog_tsk = NULL;
-@@ -4199,7 +4199,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	}
- 
- 	/* Query the F2 block size, set roundup accordingly */
--	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
-+	bus->blocksize = bus->sdiodev->func2->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
- 
- 	/* Allocate buffers */
-@@ -4215,17 +4215,17 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 		}
- 	}
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 
- 	/* Disable F2 to clear any intermediate frame state on the dongle */
--	sdio_disable_func(bus->sdiodev->func[2]);
-+	sdio_disable_func(bus->sdiodev->func2);
- 
- 	bus->rxflow = false;
- 
- 	/* Done with backplane-dependent accesses, can drop clock... */
- 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	/* ...and initialize clock/power states */
- 	bus->clkstate = CLK_SDONLY;
-@@ -4277,7 +4277,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 
- 		if (bus->ci) {
- 			if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_wd_timer(bus, false);
- 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
- 				/* Leave the device in state where it is
-@@ -4287,7 +4287,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 				msleep(20);
- 				brcmf_chip_set_passive(bus->ci);
- 				brcmf_sdio_clkctl(bus, CLK_NONE, false);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 			}
- 			brcmf_chip_detach(bus->ci);
- 		}
-@@ -4334,9 +4334,9 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
- {
- 	int ret;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	ret = brcmf_sdio_bus_sleep(bus, sleep, false);
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	return ret;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -21,9 +21,6 @@
- #include <linux/firmware.h>
- #include "firmware.h"
- 
--/* Maximum number of I/O funcs */
--#define NUM_SDIO_FUNCS	3
--
- #define SDIOD_FBR_SIZE		0x100
- 
- /* io_en */
-@@ -173,8 +170,8 @@ struct brcmf_sdio;
- struct brcmf_sdiod_freezer;
- 
- struct brcmf_sdio_dev {
--	struct sdio_func *func[NUM_SDIO_FUNCS];
--	u8 num_funcs;			/* Supported funcs on client */
-+	struct sdio_func *func1;
-+	struct sdio_func *func2;
- 	u32 sbwad;			/* Save backplane window address */
- 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
- 	struct brcmf_sdio *bus;
-@@ -295,17 +292,17 @@ void brcmf_sdiod_intr_unregister(struct
- /* SDIO device register access interface */
- /* Accessors for SDIO Function 0 */
- #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
--	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
-+	sdio_f0_readb((sdiodev)->func1, (addr), (r))
- 
- #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
--	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
-+	sdio_f0_writeb((sdiodev)->func1, (v), (addr), (ret))
- 
- /* Accessors for SDIO Function 1 */
- #define brcmf_sdiod_readb(sdiodev, addr, r) \
--	sdio_readb((sdiodev)->func[1], (addr), (r))
-+	sdio_readb((sdiodev)->func1, (addr), (r))
- 
- #define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
--	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
-+	sdio_writeb((sdiodev)->func1, (v), (addr), (ret))
- 
- u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
- void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
diff --git a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
deleted file mode 100644
index dc78000be1..0000000000
--- a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 32adbcaa5df49f1977441f7a4bf180a0bcfe9966 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 9 Jan 2018 13:22:53 +0100
-Subject: [PATCH] brcmfmac: add comment block in brcmf_sdio_buscore_read()
-
-In brcmf_sdio_buscore_read() there is some special handling upon
-register access to chipid register of the chipcommon core. Add
-comment explaining why it is done here.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3772,6 +3772,13 @@ static u32 brcmf_sdio_buscore_read32(voi
- 
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 
-+	/*
-+	 * this is a bit of special handling if reading the chipcommon chipid
-+	 * register. The 4339 is a next-gen of the 4335. It uses the same
-+	 * SDIO device id as 4335 and the chipid register returns 4335 as well.
-+	 * It can be identified as 4339 by looking at the chip revision. It
-+	 * is corrected here so the chip.c module has the right info.
-+	 */
- 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
- 	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
- 	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
diff --git a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
deleted file mode 100644
index c587f413d5..0000000000
--- a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 378f6a16043e5d3346301fc618f503e97aea335b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 9 Jan 2018 13:22:54 +0100
-Subject: [PATCH] brcmfmac: rename brcmf_sdiod_buff_{read,write}() functions
-
-Rename functions to brcmf_sdio_skbuff_{read,write}() as we pass an
-skbuff to this function.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 48 +++++++++++-----------
- 1 file changed, 24 insertions(+), 24 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -292,24 +292,24 @@ out:
- 		*ret = retval;
- }
- 
--static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
--				 struct sdio_func *func, u32 addr,
--				 struct sk_buff *pkt)
-+static int brcmf_sdiod_skbuff_read(struct brcmf_sdio_dev *sdiodev,
-+				   struct sdio_func *func, u32 addr,
-+				   struct sk_buff *skb)
- {
- 	unsigned int req_sz;
- 	int err;
- 
- 	/* Single skb use the standard mmc interface */
--	req_sz = pkt->len + 3;
-+	req_sz = skb->len + 3;
- 	req_sz &= (uint)~3;
- 
- 	switch (func->num) {
- 	case 1:
--		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
-+		err = sdio_memcpy_fromio(func, ((u8 *)(skb->data)), addr,
- 					 req_sz);
- 		break;
- 	case 2:
--		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
-+		err = sdio_readsb(func, ((u8 *)(skb->data)), addr, req_sz);
- 		break;
- 	default:
- 		/* bail out as things are really fishy here */
-@@ -323,18 +323,18 @@ static int brcmf_sdiod_buff_read(struct
- 	return err;
- }
- 
--static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
--				  struct sdio_func *func, u32 addr,
--				  struct sk_buff *pkt)
-+static int brcmf_sdiod_skbuff_write(struct brcmf_sdio_dev *sdiodev,
-+				    struct sdio_func *func, u32 addr,
-+				    struct sk_buff *skb)
- {
- 	unsigned int req_sz;
- 	int err;
- 
- 	/* Single skb use the standard mmc interface */
--	req_sz = pkt->len + 3;
-+	req_sz = skb->len + 3;
- 	req_sz &= (uint)~3;
- 
--	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
-+	err = sdio_memcpy_toio(func, addr, ((u8 *)(skb->data)), req_sz);
- 
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
-+	err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr, pkt);
- 
- done:
- 	return err;
-@@ -575,14 +575,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
--					    pktq->next);
-+		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
-+					      pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
--					    glom_skb);
-+		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
-+					      glom_skb);
- 		if (err)
- 			goto done;
- 
-@@ -623,8 +623,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
--		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
--					     mypkt);
-+		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
-+					       mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
- 
-@@ -649,8 +649,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
--						     addr, skb);
-+			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2,
-+						       addr, skb);
- 			if (err)
- 				break;
- 		}
-@@ -706,11 +706,11 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 		if (write) {
- 			memcpy(pkt->data, data, dsize);
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
--						     sdaddr, pkt);
-+			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func1,
-+						       sdaddr, pkt);
- 		} else {
--			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
--						    sdaddr, pkt);
-+			err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func1,
-+						      sdaddr, pkt);
- 		}
- 
- 		if (err) {
diff --git a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
deleted file mode 100644
index b60c81a3a2..0000000000
--- a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From b7acadaf038740c43515dc1548f43d01cc92823a Mon Sep 17 00:00:00 2001
-From: Himanshu Jha <himanshujha199640@gmail.com>
-Date: Tue, 9 Jan 2018 02:15:31 +0530
-Subject: [PATCH] brcmfmac: Use zeroing memory allocator than allocator/memset
-
-Use dma_zalloc_coherent for allocating zeroed
-memory and remove unnecessary memset function.
-
-Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci
-
-Suggested-by: Luis R. Rodriguez <mcgrof@kernel.org>
-Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c  | 20 ++++++++++----------
- 1 file changed, 10 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1251,14 +1251,14 @@ static int brcmf_pcie_init_scratchbuffer
- 	u64 address;
- 	u32 addr;
- 
--	devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
--		BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
--		&devinfo->shared.scratch_dmahandle, GFP_KERNEL);
-+	devinfo->shared.scratch =
-+		dma_zalloc_coherent(&devinfo->pdev->dev,
-+					BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
-+					&devinfo->shared.scratch_dmahandle,
-+					GFP_KERNEL);
- 	if (!devinfo->shared.scratch)
- 		goto fail;
- 
--	memset(devinfo->shared.scratch, 0, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
--
- 	addr = devinfo->shared.tcm_base_address +
- 	       BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
- 	address = (u64)devinfo->shared.scratch_dmahandle;
-@@ -1268,14 +1268,14 @@ static int brcmf_pcie_init_scratchbuffer
- 	       BRCMF_SHARED_DMA_SCRATCH_LEN_OFFSET;
- 	brcmf_pcie_write_tcm32(devinfo, addr, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
- 
--	devinfo->shared.ringupd = dma_alloc_coherent(&devinfo->pdev->dev,
--		BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
--		&devinfo->shared.ringupd_dmahandle, GFP_KERNEL);
-+	devinfo->shared.ringupd =
-+		dma_zalloc_coherent(&devinfo->pdev->dev,
-+					BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
-+					&devinfo->shared.ringupd_dmahandle,
-+					GFP_KERNEL);
- 	if (!devinfo->shared.ringupd)
- 		goto fail;
- 
--	memset(devinfo->shared.ringupd, 0, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
--
- 	addr = devinfo->shared.tcm_base_address +
- 	       BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
- 	address = (u64)devinfo->shared.ringupd_dmahandle;
diff --git a/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch b/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
deleted file mode 100644
index e955cb3a25..0000000000
--- a/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 9 Feb 2018 19:46:54 +0100
-Subject: [PATCH] mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple
- of 4
-
-This ensures that mac80211 allocated management frames are properly
-aligned, which makes copying them more efficient.
-For instance, mt76 uses iowrite32_copy to copy beacon frames to beacon
-template memory on the chip.
-Misaligned 32-bit accesses cause CPU exceptions on MIPS and should be
-avoided.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4145,7 +4145,7 @@ void ieee80211_sta_uapsd_trigger(struct
-  * The TX headroom reserved by mac80211 for its own tx_status functions.
-  * This is enough for the radiotap header.
-  */
--#define IEEE80211_TX_STATUS_HEADROOM	14
-+#define IEEE80211_TX_STATUS_HEADROOM	ALIGN(14, 4)
- 
- /**
-  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
diff --git a/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch b/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
deleted file mode 100644
index a7562996b1..0000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 09:59:35 +0100
-Subject: [PATCH] mac80211: drop frames with unexpected DS bits from
- fast-rx to slow path
-
-Fixes rx for 4-addr packets in AP mode
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3928,7 +3928,7 @@ static bool ieee80211_invoke_fast_rx(str
- 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
- 					      IEEE80211_FCTL_TODS)) !=
- 	    fast_rx->expected_ds_bits)
--		goto drop;
-+		return false;
- 
- 	/* assign the key to drop unencrypted frames (later)
- 	 * and strip the IV/MIC if necessary
diff --git a/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
deleted file mode 100644
index 3f3eb0a5e1..0000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 10:00:22 +0100
-Subject: [PATCH] mac80211: support AP 4-addr mode fast-rx
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3774,6 +3774,15 @@ void ieee80211_check_fast_rx(struct sta_
- 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
- 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
- 			 !sdata->u.vlan.sta);
-+
-+		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-+		    sdata->u.vlan.sta) {
-+			fastrx.expected_ds_bits |=
-+				cpu_to_le16(IEEE80211_FCTL_FROMDS);
-+			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
-+			fastrx.internal_forward = 0;
-+		}
-+
- 		break;
- 	default:
- 		goto clear;
diff --git a/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch b/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
deleted file mode 100644
index 8c4c724ef7..0000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 10:01:53 +0100
-Subject: [PATCH] mac80211: support fast-rx with incompatible PS
- capabilities when PS is disabled
-
-When powersave is disabled for the interface, we can do fast-rx anyway.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -2658,6 +2658,7 @@ static int ieee80211_set_power_mgmt(stru
- 
- 	ieee80211_recalc_ps(local);
- 	ieee80211_recalc_ps_vif(sdata);
-+	ieee80211_check_fast_rx_iface(sdata);
- 
- 	return 0;
- }
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3741,12 +3741,7 @@ void ieee80211_check_fast_rx(struct sta_
- 		/* 4-addr is harder to deal with, later maybe */
- 		if (sdata->u.mgd.use_4addr)
- 			goto clear;
--		/* software powersave is a huge mess, avoid all of it */
--		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
--			goto clear;
--		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
--		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
--			goto clear;
-+
- 		if (sta->sta.tdls) {
- 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
- 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
-@@ -3758,6 +3753,16 @@ void ieee80211_check_fast_rx(struct sta_
- 			fastrx.expected_ds_bits =
- 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
- 		}
-+
-+		if (!sdata->u.mgd.powersave)
-+		    break;
-+
-+		/* software powersave is a huge mess, avoid all of it */
-+		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
-+			goto clear;
-+		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
-+		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
-+			goto clear;
- 		break;
- 	case NL80211_IFTYPE_AP_VLAN:
- 	case NL80211_IFTYPE_AP:
diff --git a/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
deleted file mode 100644
index 97a5d8beba..0000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 10:05:08 +0100
-Subject: [PATCH] mac80211: support station 4-addr mode fast-rx
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3738,10 +3738,6 @@ void ieee80211_check_fast_rx(struct sta_
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_STATION:
--		/* 4-addr is harder to deal with, later maybe */
--		if (sdata->u.mgd.use_4addr)
--			goto clear;
--
- 		if (sta->sta.tdls) {
- 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
- 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
-@@ -3754,6 +3750,13 @@ void ieee80211_check_fast_rx(struct sta_
- 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
- 		}
- 
-+		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
-+			fastrx.expected_ds_bits |=
-+				cpu_to_le16(IEEE80211_FCTL_TODS);
-+			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
-+			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
-+		}
-+
- 		if (!sdata->u.mgd.powersave)
- 		    break;
- 
diff --git a/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch b/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
deleted file mode 100644
index 3c6d342ff1..0000000000
--- a/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
+++ /dev/null
@@ -1,256 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 26 Feb 2018 22:09:29 +0100
-Subject: [PATCH] mac80211: support A-MSDU in fast-rx
-
-Only works if the IV was stripped from packets. Create a smaller
-variant of ieee80211_rx_h_amsdu, which bypasses checks already done
-within the fast-rx context.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2358,39 +2358,17 @@ ieee80211_deliver_skb(struct ieee80211_r
- }
- 
- static ieee80211_rx_result debug_noinline
--ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
-+__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
- {
- 	struct net_device *dev = rx->sdata->dev;
- 	struct sk_buff *skb = rx->skb;
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- 	__le16 fc = hdr->frame_control;
- 	struct sk_buff_head frame_list;
--	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
- 	struct ethhdr ethhdr;
- 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
- 
--	if (unlikely(!ieee80211_is_data(fc)))
--		return RX_CONTINUE;
--
--	if (unlikely(!ieee80211_is_data_present(fc)))
--		return RX_DROP_MONITOR;
--
--	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
--		return RX_CONTINUE;
--
- 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
--		switch (rx->sdata->vif.type) {
--		case NL80211_IFTYPE_AP_VLAN:
--			if (!rx->sdata->u.vlan.sta)
--				return RX_DROP_UNUSABLE;
--			break;
--		case NL80211_IFTYPE_STATION:
--			if (!rx->sdata->u.mgd.use_4addr)
--				return RX_DROP_UNUSABLE;
--			break;
--		default:
--			return RX_DROP_UNUSABLE;
--		}
- 		check_da = NULL;
- 		check_sa = NULL;
- 	} else switch (rx->sdata->vif.type) {
-@@ -2410,15 +2388,13 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
- 			break;
- 	}
- 
--	if (is_multicast_ether_addr(hdr->addr1))
--		return RX_DROP_UNUSABLE;
--
- 	skb->dev = dev;
- 	__skb_queue_head_init(&frame_list);
- 
- 	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
- 					  rx->sdata->vif.addr,
--					  rx->sdata->vif.type))
-+					  rx->sdata->vif.type,
-+					  data_offset))
- 		return RX_DROP_UNUSABLE;
- 
- 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
-@@ -2440,6 +2416,44 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
- 	return RX_QUEUED;
- }
- 
-+static ieee80211_rx_result debug_noinline
-+ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
-+{
-+	struct sk_buff *skb = rx->skb;
-+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	__le16 fc = hdr->frame_control;
-+
-+	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
-+		return RX_CONTINUE;
-+
-+	if (unlikely(!ieee80211_is_data(fc)))
-+		return RX_CONTINUE;
-+
-+	if (unlikely(!ieee80211_is_data_present(fc)))
-+		return RX_DROP_MONITOR;
-+
-+	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
-+		switch (rx->sdata->vif.type) {
-+		case NL80211_IFTYPE_AP_VLAN:
-+			if (!rx->sdata->u.vlan.sta)
-+				return RX_DROP_UNUSABLE;
-+			break;
-+		case NL80211_IFTYPE_STATION:
-+			if (!rx->sdata->u.mgd.use_4addr)
-+				return RX_DROP_UNUSABLE;
-+			break;
-+		default:
-+			return RX_DROP_UNUSABLE;
-+		}
-+	}
-+
-+	if (is_multicast_ether_addr(hdr->addr1))
-+		return RX_DROP_UNUSABLE;
-+
-+	return __ieee80211_rx_h_amsdu(rx, 0);
-+}
-+
- #ifdef CPTCFG_MAC80211_MESH
- static ieee80211_rx_result
- ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
-@@ -3889,7 +3903,8 @@ static bool ieee80211_invoke_fast_rx(str
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct sta_info *sta = rx->sta;
- 	int orig_len = skb->len;
--	int snap_offs = ieee80211_hdrlen(hdr->frame_control);
-+	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	int snap_offs = hdrlen;
- 	struct {
- 		u8 snap[sizeof(rfc1042_header)];
- 		__be16 proto;
-@@ -3920,10 +3935,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
- 		return false;
- 
--	/* we don't deal with A-MSDU deaggregation here */
--	if (status->rx_flags & IEEE80211_RX_AMSDU)
--		return false;
--
- 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
- 		return false;
- 
-@@ -3955,21 +3966,24 @@ static bool ieee80211_invoke_fast_rx(str
- 		snap_offs += IEEE80211_CCMP_HDR_LEN;
- 	}
- 
--	if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
--		goto drop;
--	payload = (void *)(skb->data + snap_offs);
-+	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
-+		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-+			goto drop;
- 
--	if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
--		return false;
-+		payload = (void *)(skb->data + snap_offs);
- 
--	/* Don't handle these here since they require special code.
--	 * Accept AARP and IPX even though they should come with a
--	 * bridge-tunnel header - but if we get them this way then
--	 * there's little point in discarding them.
--	 */
--	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
--		     payload->proto == fast_rx->control_port_protocol))
--		return false;
-+		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
-+			return false;
-+
-+		/* Don't handle these here since they require special code.
-+		 * Accept AARP and IPX even though they should come with a
-+		 * bridge-tunnel header - but if we get them this way then
-+		 * there's little point in discarding them.
-+		 */
-+		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
-+			     payload->proto == fast_rx->control_port_protocol))
-+			return false;
-+	}
- 
- 	/* after this point, don't punt to the slowpath! */
- 
-@@ -3983,12 +3997,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	}
- 
- 	/* statistics part of ieee80211_rx_h_sta_process() */
--	stats->last_rx = jiffies;
--	stats->last_rate = sta_stats_encode_rate(status);
--
--	stats->fragments++;
--	stats->packets++;
--
- 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
- 		stats->last_signal = status->signal;
- 		if (!fast_rx->uses_rss)
-@@ -4017,6 +4025,20 @@ static bool ieee80211_invoke_fast_rx(str
- 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
- 		goto drop;
- 
-+	if (status->rx_flags & IEEE80211_RX_AMSDU) {
-+		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
-+		    RX_QUEUED)
-+			goto drop;
-+
-+		return true;
-+	}
-+
-+	stats->last_rx = jiffies;
-+	stats->last_rate = sta_stats_encode_rate(status);
-+
-+	stats->fragments++;
-+	stats->packets++;
-+
- 	/* do the header conversion - first grab the addresses */
- 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
- 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -4331,10 +4331,12 @@ unsigned int ieee80211_get_mesh_hdrlen(s
-  *	of it being pushed into the SKB
-  * @addr: the device MAC address
-  * @iftype: the virtual interface type
-+ * @data_offset: offset of payload after the 802.11 header
-  * Return: 0 on success. Non-zero on error.
-  */
- int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
--				  const u8 *addr, enum nl80211_iftype iftype);
-+				  const u8 *addr, enum nl80211_iftype iftype,
-+				  u8 data_offset);
- 
- /**
-  * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
-@@ -4346,7 +4348,7 @@ int ieee80211_data_to_8023_exthdr(struct
- static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
- 					 enum nl80211_iftype iftype)
- {
--	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype);
-+	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0);
- }
- 
- /**
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -419,7 +419,8 @@ unsigned int ieee80211_get_mesh_hdrlen(s
- EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
- 
- int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
--				  const u8 *addr, enum nl80211_iftype iftype)
-+				  const u8 *addr, enum nl80211_iftype iftype,
-+				  u8 data_offset)
- {
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct {
-@@ -433,7 +434,7 @@ int ieee80211_data_to_8023_exthdr(struct
- 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
- 		return -1;
- 
--	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
- 	if (skb->len < hdrlen + 8)
- 		return -1;
- 
diff --git a/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch b/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
deleted file mode 100644
index 394fbfc5b2..0000000000
--- a/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 5242a5444e0b6464d7455beb55d936dd192b5e9d Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 22 Jan 2018 21:46:39 +0100
-Subject: [PATCH] brcmfmac: assure bcdc dcmd api does not return value > 0
-
-The protocol layer api defines callbacks for dongle commands.
-Although not really well documented these should only return an
-error code in case of an error, or 0 upon success. In the bcdc
-protocol it can return value above 0 and we carry a fix in the
-caller of the protocol layer api. This patch makes it adhere to
-the intent of the api as described above.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 6 +++++-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 8 +++-----
- 2 files changed, 8 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -211,6 +211,8 @@ retry:
- 		memcpy(buf, info, len);
- 	}
- 
-+	ret = 0;
-+
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
- 		ret = le32_to_cpu(msg->status);
-@@ -225,7 +227,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- {
- 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
- 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
--	int ret = 0;
-+	int ret;
- 	u32 flags, id;
- 
- 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
-@@ -249,6 +251,8 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- 		goto done;
- 	}
- 
-+	ret = 0;
-+
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
- 		ret = le32_to_cpu(msg->status);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -121,11 +121,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 	else
- 		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
- 
--	if (err >= 0)
--		return 0;
--
--	brcmf_dbg(FIL, "Failed: %s (%d)\n",
--		  brcmf_fil_get_errstr((u32)(-err)), err);
-+	if (err)
-+		brcmf_dbg(FIL, "Failed: %s (%d)\n",
-+			  brcmf_fil_get_errstr((u32)(-err)), err);
- 
- 	return err;
- }
diff --git a/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch b/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
deleted file mode 100644
index 28e3c1a65f..0000000000
--- a/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From b69c1df47281ad47bd2037a42b98f5c7115b7fd5 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 22 Jan 2018 21:46:40 +0100
-Subject: [PATCH] brcmfmac: separate firmware errors from i/o errors
-
-When using the firmware api it can fail simply because firmware does
-not like the request or it fails due to issues in the host interface.
-Currently, there is only a single error code which is confusing. So
-adding a parameter to pass the firmware error separately and in case
-of a firmware error always return -EBADE to user-space.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++++++-----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c  | 16 +++++++++++-----
- .../net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c    | 10 ++++++----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 14 ++++++++------
- 4 files changed, 31 insertions(+), 20 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -165,7 +165,7 @@ static int brcmf_proto_bcdc_cmplt(struct
- 
- static int
- brcmf_proto_bcdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
--			    void *buf, uint len)
-+			    void *buf, uint len, int *fwerr)
- {
- 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
- 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
-@@ -175,6 +175,7 @@ brcmf_proto_bcdc_query_dcmd(struct brcmf
- 
- 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
- 
-+	*fwerr = 0;
- 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, false);
- 	if (ret < 0) {
- 		brcmf_err("brcmf_proto_bcdc_msg failed w/status %d\n",
-@@ -215,15 +216,14 @@ retry:
- 
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
--		ret = le32_to_cpu(msg->status);
--
-+		*fwerr = le32_to_cpu(msg->status);
- done:
- 	return ret;
- }
- 
- static int
- brcmf_proto_bcdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
--			  void *buf, uint len)
-+			  void *buf, uint len, int *fwerr)
- {
- 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
- 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
-@@ -232,6 +232,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- 
- 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
- 
-+	*fwerr = 0;
- 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, true);
- 	if (ret < 0)
- 		goto done;
-@@ -255,7 +256,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- 
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
--		ret = le32_to_cpu(msg->status);
-+		*fwerr = le32_to_cpu(msg->status);
- 
- done:
- 	return ret;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -107,7 +107,7 @@ static s32
- brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
- {
- 	struct brcmf_pub *drvr = ifp->drvr;
--	s32 err;
-+	s32 err, fwerr;
- 
- 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
- 		brcmf_err("bus is down. we have nothing to do.\n");
-@@ -117,14 +117,20 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 	if (data != NULL)
- 		len = min_t(uint, len, BRCMF_DCMD_MAXLEN);
- 	if (set)
--		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd, data, len);
-+		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd,
-+					   data, len, &fwerr);
- 	else
--		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
-+		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd,
-+					     data, len, &fwerr);
- 
--	if (err)
-+	if (err) {
- 		brcmf_dbg(FIL, "Failed: %s (%d)\n",
- 			  brcmf_fil_get_errstr((u32)(-err)), err);
--
-+	} else if (fwerr < 0) {
-+		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
-+			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
-+		err = -EBADE;
-+	}
- 	return err;
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -477,7 +477,7 @@ static void brcmf_msgbuf_ioctl_resp_wake
- 
- 
- static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
--				   uint cmd, void *buf, uint len)
-+				   uint cmd, void *buf, uint len, int *fwerr)
- {
- 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
- 	struct sk_buff *skb = NULL;
-@@ -485,6 +485,7 @@ static int brcmf_msgbuf_query_dcmd(struc
- 	int err;
- 
- 	brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
-+	*fwerr = 0;
- 	msgbuf->ctl_completed = false;
- 	err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
- 	if (err)
-@@ -508,14 +509,15 @@ static int brcmf_msgbuf_query_dcmd(struc
- 	}
- 	brcmu_pkt_buf_free_skb(skb);
- 
--	return msgbuf->ioctl_resp_status;
-+	*fwerr = msgbuf->ioctl_resp_status;
-+	return 0;
- }
- 
- 
- static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
--				 uint cmd, void *buf, uint len)
-+				 uint cmd, void *buf, uint len, int *fwerr)
- {
--	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len);
-+	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
- }
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -30,9 +30,9 @@ struct brcmf_proto {
- 	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
- 		       struct sk_buff *skb, struct brcmf_if **ifp);
- 	int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
--			  void *buf, uint len);
-+			  void *buf, uint len, int *fwerr);
- 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
--			uint len);
-+			uint len, int *fwerr);
- 	int (*tx_queue_data)(struct brcmf_pub *drvr, int ifidx,
- 			     struct sk_buff *skb);
- 	int (*txdata)(struct brcmf_pub *drvr, int ifidx, u8 offset,
-@@ -71,14 +71,16 @@ static inline int brcmf_proto_hdrpull(st
- 	return drvr->proto->hdrpull(drvr, do_fws, skb, ifp);
- }
- static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
--					 uint cmd, void *buf, uint len)
-+					 uint cmd, void *buf, uint len,
-+					 int *fwerr)
- {
--	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len);
-+	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len,fwerr);
- }
- static inline int brcmf_proto_set_dcmd(struct brcmf_pub *drvr, int ifidx,
--				       uint cmd, void *buf, uint len)
-+				       uint cmd, void *buf, uint len,
-+				       int *fwerr)
- {
--	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len);
-+	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
- }
- 
- static inline int brcmf_proto_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
diff --git a/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch b/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
deleted file mode 100644
index e6486160fc..0000000000
--- a/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 933897342d0714ae1c10729cbaeecea0c6178db5 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 28 Feb 2018 21:15:19 +0100
-Subject: [PATCH] brcmfmac: add possibility to obtain firmware error
-
-The feature module needs to evaluate the actual firmware error return
-upon a control command. This adds a flag to struct brcmf_if that the
-caller can set. This flag is checked to determine the error code that
-needs to be returned.
-
-Fixes: b69c1df47281 ("brcmfmac: separate firmware errors from i/o errors")
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 10 ++++++++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c    |  3 +++
- 3 files changed, 15 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -181,6 +181,7 @@ enum brcmf_netif_stop_reason {
-  * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
-  * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
-  * @pend_8021x_wait: used for signalling change in count.
-+ * @fwil_fwerr: flag indicating fwil layer should return firmware error codes.
-  */
- struct brcmf_if {
- 	struct brcmf_pub *drvr;
-@@ -198,6 +199,7 @@ struct brcmf_if {
- 	wait_queue_head_t pend_8021x_wait;
- 	struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
- 	u8 ipv6addr_idx;
-+	bool fwil_fwerr;
- };
- 
- int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -104,6 +104,9 @@ static void brcmf_feat_iovar_int_get(str
- 	u32 data;
- 	int err;
- 
-+	/* we need to know firmware error */
-+	ifp->fwil_fwerr = true;
-+
- 	err = brcmf_fil_iovar_int_get(ifp, name, &data);
- 	if (err == 0) {
- 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
-@@ -112,6 +115,8 @@ static void brcmf_feat_iovar_int_get(str
- 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
- 			  brcmf_feat_names[id], err);
- 	}
-+
-+	ifp->fwil_fwerr = false;
- }
- 
- static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
-@@ -120,6 +125,9 @@ static void brcmf_feat_iovar_data_set(st
- {
- 	int err;
- 
-+	/* we need to know firmware error */
-+	ifp->fwil_fwerr = true;
-+
- 	err = brcmf_fil_iovar_data_set(ifp, name, data, len);
- 	if (err != -BRCMF_FW_UNSUPPORTED) {
- 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
-@@ -128,6 +136,8 @@ static void brcmf_feat_iovar_data_set(st
- 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
- 			  brcmf_feat_names[id], err);
- 	}
-+
-+	ifp->fwil_fwerr = false;
- }
- 
- #define MAX_CAPS_BUFFER_SIZE	512
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -131,6 +131,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
- 		err = -EBADE;
- 	}
-+	if (ifp->fwil_fwerr)
-+		return fwerr;
-+
- 	return err;
- }
- 
diff --git a/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch b/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
deleted file mode 100644
index 20e16ad23f..0000000000
--- a/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 455f3e76cfc0d893585a5f358b9ddbe9c1e1e53b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 28 Feb 2018 21:15:20 +0100
-Subject: [PATCH] brcmfmac: fix P2P_DEVICE ethernet address generation
-
-The firmware has a requirement that the P2P_DEVICE address should
-be different from the address of the primary interface. When not
-specified by user-space, the driver generates the MAC address for
-the P2P_DEVICE interface using the MAC address of the primary
-interface and setting the locally administered bit. However, the MAC
-address of the primary interface may already have that bit set causing
-the creation of the P2P_DEVICE interface to fail with -EBUSY. Fix this
-by using a random address instead to determine the P2P_DEVICE address.
-
-Cc: stable@vger.kernel.org # 3.10.y
-Reported-by: Hans de Goede <hdegoede@redhat.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 24 ++++++++++------------
- 1 file changed, 11 insertions(+), 13 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct
-  * @dev_addr: optional device address.
-  *
-  * P2P needs mac addresses for P2P device and interface. If no device
-- * address it specified, these are derived from the primary net device, ie.
-- * the permanent ethernet address of the device.
-+ * address it specified, these are derived from a random ethernet
-+ * address.
-  */
- static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
- {
--	struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
--	bool local_admin = false;
-+	bool random_addr = false;
- 
--	if (!dev_addr || is_zero_ether_addr(dev_addr)) {
--		dev_addr = pri_ifp->mac_addr;
--		local_admin = true;
--	}
-+	if (!dev_addr || is_zero_ether_addr(dev_addr))
-+		random_addr = true;
- 
--	/* Generate the P2P Device Address.  This consists of the device's
--	 * primary MAC address with the locally administered bit set.
-+	/* Generate the P2P Device Address obtaining a random ethernet
-+	 * address with the locally administered bit set.
- 	 */
--	memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
--	if (local_admin)
--		p2p->dev_addr[0] |= 0x02;
-+	if (random_addr)
-+		eth_random_addr(p2p->dev_addr);
-+	else
-+		memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
- 
- 	/* Generate the P2P Interface Address.  If the discovery and connection
- 	 * BSSCFGs need to simultaneously co-exist, then this address must be
diff --git a/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch b/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
deleted file mode 100644
index f25dea01d2..0000000000
--- a/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
+++ /dev/null
@@ -1,157 +0,0 @@
-From 1259055170287a350cad453e9eac139c81609860 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 15 Mar 2018 08:29:09 +0100
-Subject: [PATCH] brcmfmac: drop Inter-Access Point Protocol packets by default
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Testing brcmfmac with more recent firmwares resulted in AP interfaces
-not working in some specific setups. Debugging resulted in discovering
-support for IAPP in Broadcom's firmwares.
-
-Older firmwares were only generating 802.11f frames. Newer ones like:
-1) 10.10 (TOB) (r663589)
-2) 10.10.122.20 (r683106)
-for 4366b1 and 4366c0 respectively seem to also /respect/ 802.11f frames
-in the Tx path by performing a STA disassociation.
-
-This obsoleted standard and its implementation is something that:
-1) Most people don't need / want to use
-2) Can allow local DoS attacks
-3) Breaks AP interfaces in some specific bridge setups
-
-To solve issues it can cause this commit modifies brcmfmac to drop IAPP
-packets. If affects:
-1) Rx path: driver won't be sending these unwanted packets up.
-2) Tx path: driver will reject packets that would trigger STA
-   disassociation perfromed by a firmware (possible local DoS attack).
-
-It appears there are some Broadcom's clients/users who care about this
-feature despite the drawbacks. They can switch it on using a new module
-param.
-
-This change results in only two more comparisons (check for module param
-and check for Ethernet packet length) for 99.9% of packets. Its overhead
-should be very minimal.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ++
- .../wireless/broadcom/brcm80211/brcmfmac/common.h  |  1 +
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 57 ++++++++++++++++++++++
- 3 files changed, 63 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -75,6 +75,10 @@ static int brcmf_roamoff;
- module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
- MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
- 
-+static int brcmf_iapp_enable;
-+module_param_named(iapp, brcmf_iapp_enable, int, 0);
-+MODULE_PARM_DESC(iapp, "Enable partial support for the obsoleted Inter-Access Point Protocol");
-+
- #ifdef DEBUG
- /* always succeed brcmf_bus_started() */
- static int brcmf_ignore_probe_fail;
-@@ -441,6 +445,7 @@ struct brcmf_mp_device *brcmf_get_module
- 	settings->feature_disable = brcmf_feature_disable;
- 	settings->fcmode = brcmf_fcmode;
- 	settings->roamoff = !!brcmf_roamoff;
-+	settings->iapp = !!brcmf_iapp_enable;
- #ifdef DEBUG
- 	settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
- #endif
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -58,6 +58,7 @@ struct brcmf_mp_device {
- 	unsigned int	feature_disable;
- 	int		fcmode;
- 	bool		roamoff;
-+	bool		iapp;
- 	bool		ignore_probe_fail;
- 	struct brcmfmac_pd_cc *country_codes;
- 	union {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -230,6 +230,37 @@ static void brcmf_netdev_set_multicast_l
- 	schedule_work(&ifp->multicast_work);
- }
- 
-+/**
-+ * brcmf_skb_is_iapp - checks if skb is an IAPP packet
-+ *
-+ * @skb: skb to check
-+ */
-+static bool brcmf_skb_is_iapp(struct sk_buff *skb)
-+{
-+	static const u8 iapp_l2_update_packet[6] __aligned(2) = {
-+		0x00, 0x01, 0xaf, 0x81, 0x01, 0x00,
-+	};
-+	unsigned char *eth_data;
-+#if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-+	const u16 *a, *b;
-+#endif
-+
-+	if (skb->len - skb->mac_len != 6 ||
-+	    !is_multicast_ether_addr(eth_hdr(skb)->h_dest))
-+		return false;
-+
-+	eth_data = skb_mac_header(skb) + ETH_HLEN;
-+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-+	return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) |
-+		 ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4))));
-+#else
-+	a = (const u16 *)eth_data;
-+	b = (const u16 *)iapp_l2_update_packet;
-+
-+	return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]));
-+#endif
-+}
-+
- static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
- 					   struct net_device *ndev)
- {
-@@ -250,6 +281,23 @@ static netdev_tx_t brcmf_netdev_start_xm
- 		goto done;
- 	}
- 
-+	/* Some recent Broadcom's firmwares disassociate STA when they receive
-+	 * an 802.11f ADD frame. This behavior can lead to a local DoS security
-+	 * issue. Attacker may trigger disassociation of any STA by sending a
-+	 * proper Ethernet frame to the wireless interface.
-+	 *
-+	 * Moreover this feature may break AP interfaces in some specific
-+	 * setups. This applies e.g. to the bridge with hairpin mode enabled and
-+	 * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware
-+	 * will get passed back to the wireless interface and cause immediate
-+	 * disassociation of a just-connected STA.
-+	 */
-+	if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
-+		dev_kfree_skb(skb);
-+		ret = -EINVAL;
-+		goto done;
-+	}
-+
- 	/* Make sure there's enough writeable headroom */
- 	if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
- 		head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
-@@ -325,6 +373,15 @@ void brcmf_txflowblock_if(struct brcmf_i
- 
- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
- {
-+	/* Most of Broadcom's firmwares send 802.11f ADD frame every time a new
-+	 * STA connects to the AP interface. This is an obsoleted standard most
-+	 * users don't use, so don't pass these frames up unless requested.
-+	 */
-+	if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
-+		brcmu_pkt_buf_free_skb(skb);
-+		return;
-+	}
-+
- 	if (skb->pkt_type == PACKET_MULTICAST)
- 		ifp->ndev->stats.multicast++;
- 
diff --git a/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch b/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
deleted file mode 100644
index d45f64ff23..0000000000
--- a/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 9b9322db5c5a1917a66c71fe47c3848a9a31227e Mon Sep 17 00:00:00 2001
-From: Stefan Wahren <stefan.wahren@i2se.com>
-Date: Wed, 14 Mar 2018 20:02:59 +0100
-Subject: [PATCH] brcmfmac: Fix check for ISO3166 code
-
-The commit "regulatory: add NUL to request alpha2" increases the length of
-alpha2 to 3. This causes a regression on brcmfmac, because
-brcmf_cfg80211_reg_notifier() expect valid ISO3166 codes in the complete
-array. So fix this accordingly.
-
-Fixes: 657308f73e67 ("regulatory: add NUL to request alpha2")
-Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
-Acked-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6803,7 +6803,7 @@ static void brcmf_cfg80211_reg_notifier(
- 		return;
- 
- 	/* ignore non-ISO3166 country codes */
--	for (i = 0; i < sizeof(req->alpha2); i++)
-+	for (i = 0; i < 2; i++)
- 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
- 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
- 				  req->alpha2[0], req->alpha2[1]);
diff --git a/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch b/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
deleted file mode 100644
index f4d9a84b25..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From da472385a29f1fddcac7cfa0499482704310bd16 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:18 +0100
-Subject: [PATCH] brcmfmac: move brcmf_bus_preinit() call just after changing
- bus state
-
-Moving the brcmf_bus_preinit() call allows the bus code to do some
-required initialization before handling firmware control messages.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 3 ---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 5 +++++
- 2 files changed, 5 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -369,9 +369,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 
- 	/* Enable tx beamforming, errors can be ignored (not supported) */
- 	(void)brcmf_fil_iovar_int_set(ifp, "txbf", 1);
--
--	/* do bus specific preinit here */
--	err = brcmf_bus_preinit(ifp->drvr->bus_if);
- done:
- 	return err;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1091,6 +1091,11 @@ int brcmf_bus_started(struct device *dev
- 	/* signal bus ready */
- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
- 
-+	/* do bus specific preinit here */
-+	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
-+	if (ret < 0)
-+		goto fail;
-+
- 	/* Bus is ready, do any initialization */
- 	ret = brcmf_c_preinit_dcmds(ifp);
- 	if (ret < 0)
diff --git a/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch b/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
deleted file mode 100644
index 230e891cea..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 4b5adc736828dc25ca33e263ad8c0b9dcd3bf325 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:19 +0100
-Subject: [PATCH] brcmfmac: move allocation of control rx buffer to
- brcmf_sdio_bus_preinit()
-
-Allocate the control rx buffer needed for firmware control interface
-during brcmf_sdio_bus_preinit(). This relies on common layer setting
-struct brcmf_bus::maxctl during brcmf_attach(). By moving the allocation
-we can move brcmf_attach() in subsequent change.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 26 ++++++++++------------
- 1 file changed, 12 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1707,7 +1707,6 @@ brcmf_sdio_read_control(struct brcmf_sdi
- 	int sdret;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
--
- 	if (bus->rxblen)
- 		buf = vzalloc(bus->rxblen);
- 	if (!buf)
-@@ -3411,6 +3410,18 @@ static int brcmf_sdio_bus_preinit(struct
- 	u32 value;
- 	int err;
- 
-+	/* maxctl provided by common layer */
-+	if (WARN_ON(!bus_if->maxctl))
-+		return -EINVAL;
-+
-+	/* Allocate control receive buffer */
-+	bus_if->maxctl += bus->roundup;
-+	value = roundup((bus_if->maxctl + SDPCM_HDRLEN), ALIGNMENT);
-+	value += bus->head_align;
-+	bus->rxbuf = kmalloc(value, GFP_ATOMIC);
-+	if (bus->rxbuf)
-+		bus->rxblen = value;
-+
- 	/* the commands below use the terms tx and rx from
- 	 * a device perspective, ie. bus:txglom affects the
- 	 * bus transfers from device to host.
-@@ -4209,19 +4220,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->blocksize = bus->sdiodev->func2->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
- 
--	/* Allocate buffers */
--	if (bus->sdiodev->bus_if->maxctl) {
--		bus->sdiodev->bus_if->maxctl += bus->roundup;
--		bus->rxblen =
--		    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
--			    ALIGNMENT) + bus->head_align;
--		bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
--		if (!(bus->rxbuf)) {
--			brcmf_err("rxbuf allocation failed\n");
--			goto fail;
--		}
--	}
--
- 	sdio_claim_host(bus->sdiodev->func1);
- 
- 	/* Disable F2 to clear any intermediate frame state on the dongle */
diff --git a/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch b/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
deleted file mode 100644
index a8b0171cb3..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 262f2b53f67936b59cc8dfc6f3899ab8905bf1ed Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:20 +0100
-Subject: [PATCH] brcmfmac: call brcmf_attach() just before calling
- brcmf_bus_started()
-
-Now we can move brcmf_attach() until after the firmware has been downloaded
-to the device. Make the call just before brcmf_bus_started().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  6 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 34 +++++++++++-----------
- 2 files changed, 23 insertions(+), 17 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1268,6 +1268,12 @@ void brcmf_bus_change_state(struct brcmf
- 	int ifidx;
- 
- 	brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
-+
-+	if (!drvr) {
-+		brcmf_dbg(INFO, "ignoring transition, bus not attached yet\n");
-+		return;
-+	}
-+
- 	bus->state = state;
- 
- 	if (state == BRCMF_BUS_UP) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4048,9 +4048,6 @@ static void brcmf_sdio_firmware_callback
- 	if (err)
- 		goto fail;
- 
--	if (!bus_if->drvr)
--		return;
--
- 	/* try to download image and nvram to the dongle */
- 	bus->alp_only = true;
- 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-@@ -4126,11 +4123,28 @@ static void brcmf_sdio_firmware_callback
- 
- 	sdio_release_host(sdiodev->func1);
- 
-+	/* Assign bus interface call back */
-+	sdiodev->bus_if->dev = sdiodev->dev;
-+	sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
-+	sdiodev->bus_if->chip = bus->ci->chip;
-+	sdiodev->bus_if->chiprev = bus->ci->chiprev;
-+
-+	/* Attach to the common layer, reserve hdr space */
-+	err = brcmf_attach(sdiodev->dev, sdiodev->settings);
-+	if (err != 0) {
-+		brcmf_err("brcmf_attach failed\n");
-+		goto fail;
-+	}
-+
-+	brcmf_sdio_debugfs_create(bus);
-+
- 	err = brcmf_bus_started(dev);
- 	if (err != 0) {
- 		brcmf_err("dongle is not responding\n");
- 		goto fail;
- 	}
-+
-+	/* ready */
- 	return;
- 
- release:
-@@ -4200,22 +4214,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->dpc_triggered = false;
- 	bus->dpc_running = false;
- 
--	/* Assign bus interface call back */
--	bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
--	bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
--	bus->sdiodev->bus_if->chip = bus->ci->chip;
--	bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
--
- 	/* default sdio bus header length for tx packet */
- 	bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
- 
--	/* Attach to the common layer, reserve hdr space */
--	ret = brcmf_attach(bus->sdiodev->dev, bus->sdiodev->settings);
--	if (ret != 0) {
--		brcmf_err("brcmf_attach failed\n");
--		goto fail;
--	}
--
- 	/* Query the F2 block size, set roundup accordingly */
- 	bus->blocksize = bus->sdiodev->func2->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
-@@ -4240,7 +4241,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	/* SR state */
- 	bus->sr_enabled = false;
- 
--	brcmf_sdio_debugfs_create(bus);
- 	brcmf_dbg(INFO, "completed!!\n");
- 
- 	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
diff --git a/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch b/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
deleted file mode 100644
index 00c4141cc5..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From a7f4a80c0070b673d4a4ce94b99979ea6d0c6296 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:21 +0100
-Subject: [PATCH] brcmfmac: usb: call brcmf_usb_up() during brcmf_bus_preinit()
-
-By calling brcmf_usb_up() during brcmf_bus_preinit() it does not need
-to be called in brcmf_usb_bus_setup().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1146,8 +1146,9 @@ static int brcmf_usb_get_fwname(struct d
- }
- 
- static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
--	.txdata = brcmf_usb_tx,
-+	.preinit = brcmf_usb_up,
- 	.stop = brcmf_usb_down,
-+	.txdata = brcmf_usb_tx,
- 	.txctl = brcmf_usb_tx_ctlpkt,
- 	.rxctl = brcmf_usb_rx_ctlpkt,
- 	.wowl_config = brcmf_usb_wowl_config,
-@@ -1165,10 +1166,6 @@ static int brcmf_usb_bus_setup(struct br
- 		return ret;
- 	}
- 
--	ret = brcmf_usb_up(devinfo->dev);
--	if (ret)
--		goto fail;
--
- 	ret = brcmf_bus_started(devinfo->dev);
- 	if (ret)
- 		goto fail;
diff --git a/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch b/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
deleted file mode 100644
index 086b5fadcc..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 0542503c4c164c65cd1567b0f2b3f887af6c81eb Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:22 +0100
-Subject: [PATCH] brcmfmac: move brcmf_attach() function in core.c
-
-Moving the function in preparation of subsequent patch.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 98 +++++++++++-----------
- 1 file changed, 49 insertions(+), 49 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -992,55 +992,6 @@ static int brcmf_inet6addr_changed(struc
- }
- #endif
- 
--int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
--{
--	struct brcmf_pub *drvr = NULL;
--	int ret = 0;
--	int i;
--
--	brcmf_dbg(TRACE, "Enter\n");
--
--	/* Allocate primary brcmf_info */
--	drvr = kzalloc(sizeof(struct brcmf_pub), GFP_ATOMIC);
--	if (!drvr)
--		return -ENOMEM;
--
--	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
--		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
--
--	mutex_init(&drvr->proto_block);
--
--	/* Link to bus module */
--	drvr->hdrlen = 0;
--	drvr->bus_if = dev_get_drvdata(dev);
--	drvr->bus_if->drvr = drvr;
--	drvr->settings = settings;
--
--	/* attach debug facilities */
--	brcmf_debug_attach(drvr);
--
--	/* Attach and link in the protocol */
--	ret = brcmf_proto_attach(drvr);
--	if (ret != 0) {
--		brcmf_err("brcmf_prot_attach failed\n");
--		goto fail;
--	}
--
--	/* Attach to events important for core code */
--	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
--			    brcmf_psm_watchdog_notify);
--
--	/* attach firmware event handler */
--	brcmf_fweh_attach(drvr);
--
--	return ret;
--
--fail:
--	brcmf_detach(dev);
--
--	return ret;
--}
--
- static int brcmf_revinfo_read(struct seq_file *s, void *data)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(s->private);
-@@ -1170,6 +1121,55 @@ fail:
- 
- 	return ret;
- }
-+
-+int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
-+{
-+	struct brcmf_pub *drvr = NULL;
-+	int ret = 0;
-+	int i;
-+
-+	brcmf_dbg(TRACE, "Enter\n");
-+
-+	/* Allocate primary brcmf_info */
-+	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
-+	if (!drvr)
-+		return -ENOMEM;
-+
-+	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
-+		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
-+
-+	mutex_init(&drvr->proto_block);
-+
-+	/* Link to bus module */
-+	drvr->hdrlen = 0;
-+	drvr->bus_if = dev_get_drvdata(dev);
-+	drvr->bus_if->drvr = drvr;
-+	drvr->settings = settings;
-+
-+	/* attach debug facilities */
-+	brcmf_debug_attach(drvr);
-+
-+	/* Attach and link in the protocol */
-+	ret = brcmf_proto_attach(drvr);
-+	if (ret != 0) {
-+		brcmf_err("brcmf_prot_attach failed\n");
-+		goto fail;
-+	}
-+
-+	/* Attach to events important for core code */
-+	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
-+			    brcmf_psm_watchdog_notify);
-+
-+	/* attach firmware event handler */
-+	brcmf_fweh_attach(drvr);
-+
-+	return ret;
-+
-+fail:
-+	brcmf_detach(dev);
-+
-+	return ret;
-+}
- 
- void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
- {
diff --git a/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch b/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
deleted file mode 100644
index 6d23ccdac2..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
+++ /dev/null
@@ -1,190 +0,0 @@
-From de2a3027f6f15e2f6558dc4d178282ccc1f054db Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:23 +0100
-Subject: [PATCH] brcmfmac: remove brcmf_bus_started() from bus api
-
-No longer needed to call this in bus layer so make it static and call
-it in the last phase of brcmf_attach() instead.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  1 -
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 14 +++++++----
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 20 +---------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 10 ++------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 28 ++++------------------
- 5 files changed, 16 insertions(+), 57 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -253,7 +253,6 @@ void brcmf_dev_reset(struct device *dev)
- /* Configure the "global" bus state used by upper layers */
- void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
- 
--int brcmf_bus_started(struct device *dev);
- s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
- void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1022,11 +1022,10 @@ static int brcmf_revinfo_read(struct seq
- 	return 0;
- }
- 
--int brcmf_bus_started(struct device *dev)
-+static int brcmf_bus_started(struct brcmf_pub *drvr)
- {
- 	int ret = -1;
--	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_pub *drvr = bus_if->drvr;
-+	struct brcmf_bus *bus_if = drvr->bus_if;
- 	struct brcmf_if *ifp;
- 	struct brcmf_if *p2p_ifp;
- 
-@@ -1043,7 +1042,7 @@ int brcmf_bus_started(struct device *dev
- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
- 
- 	/* do bus specific preinit here */
--	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
-+	ret = brcmf_bus_preinit(bus_if);
- 	if (ret < 0)
- 		goto fail;
- 
-@@ -1163,7 +1162,12 @@ int brcmf_attach(struct device *dev, str
- 	/* attach firmware event handler */
- 	brcmf_fweh_attach(drvr);
- 
--	return ret;
-+	ret = brcmf_bus_started(drvr);
-+	if (ret != 0) {
-+		brcmf_err("dongle is not responding: err=%d\n", ret);
-+		goto fail;
-+	}
-+	return 0;
- 
- fail:
- 	brcmf_detach(dev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1581,24 +1581,6 @@ static void brcmf_pcie_release_resource(
- }
- 
- 
--static int brcmf_pcie_attach_bus(struct brcmf_pciedev_info *devinfo)
--{
--	int ret;
--
--	/* Attach to the common driver interface */
--	ret = brcmf_attach(&devinfo->pdev->dev, devinfo->settings);
--	if (ret) {
--		brcmf_err("brcmf_attach failed\n");
--	} else {
--		ret = brcmf_bus_started(&devinfo->pdev->dev);
--		if (ret)
--			brcmf_err("dongle is not responding\n");
--	}
--
--	return ret;
--}
--
--
- static u32 brcmf_pcie_buscore_prep_addr(const struct pci_dev *pdev, u32 addr)
- {
- 	u32 ret_addr;
-@@ -1735,7 +1717,7 @@ static void brcmf_pcie_setup(struct devi
- 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
- 
- 	brcmf_pcie_intr_enable(devinfo);
--	if (brcmf_pcie_attach_bus(devinfo) == 0)
-+	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
- 		return;
- 
- 	brcmf_pcie_bus_console_read(devinfo);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3422,6 +3422,8 @@ static int brcmf_sdio_bus_preinit(struct
- 	if (bus->rxbuf)
- 		bus->rxblen = value;
- 
-+	brcmf_sdio_debugfs_create(bus);
-+
- 	/* the commands below use the terms tx and rx from
- 	 * a device perspective, ie. bus:txglom affects the
- 	 * bus transfers from device to host.
-@@ -4136,14 +4138,6 @@ static void brcmf_sdio_firmware_callback
- 		goto fail;
- 	}
- 
--	brcmf_sdio_debugfs_create(bus);
--
--	err = brcmf_bus_started(dev);
--	if (err != 0) {
--		brcmf_err("dongle is not responding\n");
--		goto fail;
--	}
--
- 	/* ready */
- 	return;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1155,27 +1155,6 @@ static const struct brcmf_bus_ops brcmf_
- 	.get_fwname = brcmf_usb_get_fwname,
- };
- 
--static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
--{
--	int ret;
--
--	/* Attach to the common driver interface */
--	ret = brcmf_attach(devinfo->dev, devinfo->settings);
--	if (ret) {
--		brcmf_err("brcmf_attach failed\n");
--		return ret;
--	}
--
--	ret = brcmf_bus_started(devinfo->dev);
--	if (ret)
--		goto fail;
--
--	return 0;
--fail:
--	brcmf_detach(devinfo->dev);
--	return ret;
--}
--
- static void brcmf_usb_probe_phase2(struct device *dev, int ret,
- 				   const struct firmware *fw,
- 				   void *nvram, u32 nvlen)
-@@ -1203,7 +1182,8 @@ static void brcmf_usb_probe_phase2(struc
- 	if (ret)
- 		goto error;
- 
--	ret = brcmf_usb_bus_setup(devinfo);
-+	/* Attach to the common driver interface */
-+	ret = brcmf_attach(devinfo->dev, devinfo->settings);
- 	if (ret)
- 		goto error;
- 
-@@ -1253,7 +1233,7 @@ static int brcmf_usb_probe_cb(struct brc
- 	}
- 
- 	if (!brcmf_usb_dlneeded(devinfo)) {
--		ret = brcmf_usb_bus_setup(devinfo);
-+		ret = brcmf_attach(devinfo->dev, devinfo->settings);
- 		if (ret)
- 			goto fail;
- 		/* we are done */
-@@ -1456,7 +1436,7 @@ static int brcmf_usb_resume(struct usb_i
- 
- 	brcmf_dbg(USB, "Enter\n");
- 	if (!devinfo->wowl_enabled)
--		return brcmf_usb_bus_setup(devinfo);
-+		return brcmf_attach(devinfo->dev, devinfo->settings);
- 
- 	devinfo->bus_pub.state = BRCMFMAC_USB_STATE_UP;
- 	brcmf_usb_rx_fill_all(devinfo);
diff --git a/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch b/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
deleted file mode 100644
index 344826912d..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From d678296bfb9a630d0000222fc21f4ed0d0d65332 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:24 +0100
-Subject: [PATCH] brcmfmac: change log level for some low-level sdio functions
-
-Reducing the number of trace level messages in sdio code giving
-them sdio log level instead.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1706,7 +1706,7 @@ brcmf_sdio_read_control(struct brcmf_sdi
- 	u8 *buf = NULL, *rbuf;
- 	int sdret;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 	if (bus->rxblen)
- 		buf = vzalloc(bus->rxblen);
- 	if (!buf)
-@@ -1809,7 +1809,7 @@ static uint brcmf_sdio_readframes(struct
- 	struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
- 	u8 head_read = 0;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Not finished unless we encounter no more frames indication */
- 	bus->rxpending = true;
-@@ -2344,7 +2344,7 @@ static int brcmf_sdio_tx_ctrlframe(struc
- 	struct brcmf_sdio_hdrinfo hd_info = {0};
- 	int ret;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Back the pointer to make room for bus header */
- 	frame -= bus->tx_hdrlen;
-@@ -2520,7 +2520,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 	uint framecnt;			/* Temporary counter of tx/rx frames */
- 	int err = 0;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 
- 	sdio_claim_host(bus->sdiodev->func1);
- 
-@@ -2605,7 +2605,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- 	/* Would be active due to wake-wlan in gSPI */
- 	if (intstatus & I_CHIPACTIVE) {
--		brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
-+		brcmf_dbg(SDIO, "Dongle reports CHIPACTIVE\n");
- 		intstatus &= ~I_CHIPACTIVE;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch b/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
deleted file mode 100644
index 39fba211fe..0000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From 2d6edad4b2da1991f74e7b02053eeb4a043b887f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:25 +0100
-Subject: [PATCH] brcmfmac: remove duplicate pointer variable from
- brcmf_sdio_firmware_callback()
-
-In brcmf_sdio_firmware_callback() two pointer variables were used
-pointing to the same construct. Get rid of sdiodev variable.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 37 +++++++++++-----------
- 1 file changed, 18 insertions(+), 19 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4039,9 +4039,8 @@ static void brcmf_sdio_firmware_callback
- 					 void *nvram, u32 nvram_len)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
--	struct brcmf_sdio *bus = sdiodev->bus;
--	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
-+	struct brcmf_sdio *bus = sdiod->bus;
- 	struct brcmf_core *core = bus->sdio_core;
- 	u8 saveclk;
- 
-@@ -4061,7 +4060,7 @@ static void brcmf_sdio_firmware_callback
- 	bus->sdcnt.tickcnt = 0;
- 	brcmf_sdio_wd_timer(bus, true);
- 
--	sdio_claim_host(sdiodev->func1);
-+	sdio_claim_host(sdiod->func1);
- 
- 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-@@ -4069,9 +4068,9 @@ static void brcmf_sdio_firmware_callback
- 		goto release;
- 
- 	/* Force clocks on backplane to be sure F2 interrupt propagates */
--	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
-+	saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 	if (!err) {
--		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
- 				   (saveclk | SBSDIO_FORCE_HT), &err);
- 	}
- 	if (err) {
-@@ -4083,7 +4082,7 @@ static void brcmf_sdio_firmware_callback
- 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
- 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
- 
--	err = sdio_enable_func(sdiodev->func2);
-+	err = sdio_enable_func(sdiod->func2);
- 
- 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
- 
-@@ -4095,10 +4094,10 @@ static void brcmf_sdio_firmware_callback
- 				   bus->hostintmask, NULL);
- 
- 
--		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
-+		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
--		sdio_disable_func(sdiodev->func2);
-+		sdio_disable_func(sdiod->func2);
- 		goto release;
- 	}
- 
-@@ -4106,7 +4105,7 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdio_sr_init(bus);
- 	} else {
- 		/* Restore previous clock setting */
--		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
- 				   saveclk, &err);
- 	}
- 
-@@ -4114,7 +4113,7 @@ static void brcmf_sdio_firmware_callback
- 		/* Allow full data communication using DPC from now on. */
- 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
- 
--		err = brcmf_sdiod_intr_register(sdiodev);
-+		err = brcmf_sdiod_intr_register(sdiod);
- 		if (err != 0)
- 			brcmf_err("intr register failed:%d\n", err);
- 	}
-@@ -4123,16 +4122,16 @@ static void brcmf_sdio_firmware_callback
- 	if (err != 0)
- 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
- 
--	sdio_release_host(sdiodev->func1);
-+	sdio_release_host(sdiod->func1);
- 
- 	/* Assign bus interface call back */
--	sdiodev->bus_if->dev = sdiodev->dev;
--	sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
--	sdiodev->bus_if->chip = bus->ci->chip;
--	sdiodev->bus_if->chiprev = bus->ci->chiprev;
-+	sdiod->bus_if->dev = sdiod->dev;
-+	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
-+	sdiod->bus_if->chip = bus->ci->chip;
-+	sdiod->bus_if->chiprev = bus->ci->chiprev;
- 
- 	/* Attach to the common layer, reserve hdr space */
--	err = brcmf_attach(sdiodev->dev, sdiodev->settings);
-+	err = brcmf_attach(sdiod->dev, sdiod->settings);
- 	if (err != 0) {
- 		brcmf_err("brcmf_attach failed\n");
- 		goto fail;
-@@ -4142,10 +4141,10 @@ static void brcmf_sdio_firmware_callback
- 	return;
- 
- release:
--	sdio_release_host(sdiodev->func1);
-+	sdio_release_host(sdiod->func1);
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
--	device_release_driver(&sdiodev->func2->dev);
-+	device_release_driver(&sdiod->func2->dev);
- 	device_release_driver(dev);
- }
- 
diff --git a/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch b/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
deleted file mode 100644
index b83f2fce8b..0000000000
--- a/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 64d1519edc959f5b8f86a66a51c40971c215e4ec Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 19 Feb 2018 13:30:45 +0100
-Subject: [PATCH] brcmfmac: reject too long PSK
-
-nl80211 already allows specifying 48 bytes, but brcmfmac
-only supports 32. Reject keys that are too long.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5125,6 +5125,9 @@ static int brcmf_cfg80211_set_pmk(struct
- 	if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
- 		return -EINVAL;
- 
-+	if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
-+		return -ERANGE;
-+
- 	return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
- }
- 
diff --git a/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch b/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
deleted file mode 100644
index 2e9ec8b963..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 1170f6d1be6a39e1a115a2c0f50923eb4ce2a7ec Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:20 +0100
-Subject: [PATCH] brcmfmac: do not convert linux error to firmware error string
-
-In case of a linux error brcmf_fil_cmd_data() blurts an error message
-in which the error code is translated to an error string. However, it
-maps it to a firmware error string which should not happen. Simply
-print only the numeric error code and be done with it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -124,8 +124,7 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 					     data, len, &fwerr);
- 
- 	if (err) {
--		brcmf_dbg(FIL, "Failed: %s (%d)\n",
--			  brcmf_fil_get_errstr((u32)(-err)), err);
-+		brcmf_dbg(FIL, "Failed: error=%d\n", err);
- 	} else if (fwerr < 0) {
- 		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
- 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
diff --git a/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch b/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
deleted file mode 100644
index 790811957a..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
+++ /dev/null
@@ -1,203 +0,0 @@
-From 756a2b390874d274f2f615921318ef0856ff9313 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:21 +0100
-Subject: [PATCH] brcmfmac: use brcmf_chip_name() to store name in revinfo
-
-The chip id can either be four or five digits. For the chip name either
-the hexadecimal value needs to be taken (four digits) or the decimal
-value (five digits). The function brcmf_chip_name() does this conversion
-so use it to store the name in driver revision info.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |  9 +++++----
- .../wireless/broadcom/brcm80211/brcmfmac/chip.h    |  3 ++-
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 23 ++++++++++++++++------
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 +---------
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  3 +--
- 5 files changed, 26 insertions(+), 22 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -464,12 +464,12 @@ static void brcmf_chip_ai_resetcore(stru
- 	ci->ops->read32(ci->ctx, core->wrapbase + BCMA_IOCTL);
- }
- 
--static char *brcmf_chip_name(uint chipid, char *buf, uint len)
-+char *brcmf_chip_name(u32 id, u32 rev, char *buf, uint len)
- {
- 	const char *fmt;
- 
--	fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
--	snprintf(buf, len, fmt, chipid);
-+	fmt = ((id > 0xa000) || (id < 0x4000)) ? "BCM%d/%u" : "BCM%x/%u";
-+	snprintf(buf, len, fmt, id, rev);
- 	return buf;
- }
- 
-@@ -924,7 +924,8 @@ static int brcmf_chip_recognition(struct
- 	ci->pub.chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
- 	socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
- 
--	brcmf_chip_name(ci->pub.chip, ci->pub.name, sizeof(ci->pub.name));
-+	brcmf_chip_name(ci->pub.chip, ci->pub.chiprev,
-+			ci->pub.name, sizeof(ci->pub.name));
- 	brcmf_dbg(INFO, "found %s chip: BCM%s, rev=%d\n",
- 		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name,
- 		  ci->pub.chiprev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-@@ -45,7 +45,7 @@ struct brcmf_chip {
- 	u32 rambase;
- 	u32 ramsize;
- 	u32 srsize;
--	char name[8];
-+	char name[12];
- };
- 
- /**
-@@ -93,5 +93,6 @@ void brcmf_chip_resetcore(struct brcmf_c
- void brcmf_chip_set_passive(struct brcmf_chip *ci);
- bool brcmf_chip_set_active(struct brcmf_chip *ci, u32 rstvec);
- bool brcmf_chip_sr_capable(struct brcmf_chip *pub);
-+char *brcmf_chip_name(u32 chipid, u32 chiprev, char *buf, uint len);
- 
- #endif /* BRCMF_AXIDMP_H */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -30,6 +30,7 @@
- #include "common.h"
- #include "of.h"
- #include "firmware.h"
-+#include "chip.h"
- 
- MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-@@ -131,14 +132,13 @@ static int brcmf_c_download(struct brcmf
- static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
- {
- 	struct brcmf_bus *bus = ifp->drvr->bus_if;
--	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
- 	u8 fw_name[BRCMF_FW_NAME_LEN];
- 	u8 *ptr;
- 	size_t len;
- 	s32 err;
- 
- 	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
--	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
-+	err = brcmf_bus_get_fwname(bus, bus->chip, bus->chiprev, fw_name);
- 	if (err) {
- 		brcmf_err("get firmware name failed (%d)\n", err);
- 		goto done;
-@@ -238,6 +238,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- {
- 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
- 	u8 buf[BRCMF_DCMD_SMLEN];
-+	struct brcmf_bus *bus;
- 	struct brcmf_rev_info_le revinfo;
- 	struct brcmf_rev_info *ri;
- 	char *clmver;
-@@ -253,16 +254,18 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	}
- 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
- 
-+	bus = ifp->drvr->bus_if;
-+	ri = &ifp->drvr->revinfo;
-+
- 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
- 				     &revinfo, sizeof(revinfo));
--	ri = &ifp->drvr->revinfo;
- 	if (err < 0) {
- 		brcmf_err("retrieving revision info failed, %d\n", err);
-+		strlcpy(ri->chipname, "UNKNOWN", sizeof(ri->chipname));
- 	} else {
- 		ri->vendorid = le32_to_cpu(revinfo.vendorid);
- 		ri->deviceid = le32_to_cpu(revinfo.deviceid);
- 		ri->radiorev = le32_to_cpu(revinfo.radiorev);
--		ri->chiprev = le32_to_cpu(revinfo.chiprev);
- 		ri->corerev = le32_to_cpu(revinfo.corerev);
- 		ri->boardid = le32_to_cpu(revinfo.boardid);
- 		ri->boardvendor = le32_to_cpu(revinfo.boardvendor);
-@@ -270,15 +273,23 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 		ri->driverrev = le32_to_cpu(revinfo.driverrev);
- 		ri->ucoderev = le32_to_cpu(revinfo.ucoderev);
- 		ri->bus = le32_to_cpu(revinfo.bus);
--		ri->chipnum = le32_to_cpu(revinfo.chipnum);
- 		ri->phytype = le32_to_cpu(revinfo.phytype);
- 		ri->phyrev = le32_to_cpu(revinfo.phyrev);
- 		ri->anarev = le32_to_cpu(revinfo.anarev);
- 		ri->chippkg = le32_to_cpu(revinfo.chippkg);
- 		ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
-+
-+		if (!bus->chip) {
-+			bus->chip = le32_to_cpu(revinfo.chipnum);
-+			bus->chiprev = le32_to_cpu(revinfo.chiprev);
-+		}
- 	}
- 	ri->result = err;
- 
-+	if (bus->chip)
-+		brcmf_chip_name(bus->chip, bus->chiprev,
-+				ri->chipname, sizeof(ri->chipname));
-+
- 	/* Do any CLM downloading */
- 	err = brcmf_c_process_clm_blob(ifp);
- 	if (err < 0) {
-@@ -299,7 +310,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	strsep(&ptr, "\n");
- 
- 	/* Print fw version info */
--	brcmf_info("Firmware version = %s\n", buf);
-+	brcmf_info("Firmware: %s %s\n", ri->chipname, buf);
- 
- 	/* locate firmware version number for ethtool */
- 	ptr = strrchr(buf, ' ') + 1;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1002,8 +1002,7 @@ static int brcmf_revinfo_read(struct seq
- 	seq_printf(s, "vendorid: 0x%04x\n", ri->vendorid);
- 	seq_printf(s, "deviceid: 0x%04x\n", ri->deviceid);
- 	seq_printf(s, "radiorev: %s\n", brcmu_dotrev_str(ri->radiorev, drev));
--	seq_printf(s, "chipnum: %u (%x)\n", ri->chipnum, ri->chipnum);
--	seq_printf(s, "chiprev: %u\n", ri->chiprev);
-+	seq_printf(s, "chip: %s\n", ri->chipname);
- 	seq_printf(s, "chippkg: %u\n", ri->chippkg);
- 	seq_printf(s, "corerev: %u\n", ri->corerev);
- 	seq_printf(s, "boardid: 0x%04x\n", ri->boardid);
-@@ -1053,13 +1052,6 @@ static int brcmf_bus_started(struct brcm
- 
- 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
- 
--	/* assure we have chipid before feature attach */
--	if (!bus_if->chip) {
--		bus_if->chip = drvr->revinfo.chipnum;
--		bus_if->chiprev = drvr->revinfo.chiprev;
--		brcmf_dbg(INFO, "firmware revinfo: chip %x (%d) rev %d\n",
--			  bus_if->chip, bus_if->chip, bus_if->chiprev);
--	}
- 	brcmf_feat_attach(drvr);
- 
- 	ret = brcmf_proto_init_done(drvr);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -87,7 +87,6 @@ struct brcmf_rev_info {
- 	u32 vendorid;
- 	u32 deviceid;
- 	u32 radiorev;
--	u32 chiprev;
- 	u32 corerev;
- 	u32 boardid;
- 	u32 boardvendor;
-@@ -95,7 +94,7 @@ struct brcmf_rev_info {
- 	u32 driverrev;
- 	u32 ucoderev;
- 	u32 bus;
--	u32 chipnum;
-+	char chipname[12];
- 	u32 phytype;
- 	u32 phyrev;
- 	u32 anarev;
diff --git a/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch b/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
deleted file mode 100644
index e3d06f32cc..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From c88cfa075de356ddf40c668896b2126340f19ba4 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:22 +0100
-Subject: [PATCH] brcmfmac: use brcmf_chip_name() for consistency
-
-When logging the chip id/revision information make use of
-brcmf_chip_name() so it is always the same.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c     | 5 ++---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 7 +++++--
- 2 files changed, 7 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -926,9 +926,8 @@ static int brcmf_chip_recognition(struct
- 
- 	brcmf_chip_name(ci->pub.chip, ci->pub.chiprev,
- 			ci->pub.name, sizeof(ci->pub.name));
--	brcmf_dbg(INFO, "found %s chip: BCM%s, rev=%d\n",
--		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name,
--		  ci->pub.chiprev);
-+	brcmf_dbg(INFO, "found %s chip: %s\n",
-+		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name);
- 
- 	if (socitype == SOCI_SB) {
- 		if (ci->pub.chip != BRCM_CC_4329_CHIP_ID) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -25,6 +25,7 @@
- #include "firmware.h"
- #include "core.h"
- #include "common.h"
-+#include "chip.h"
- 
- #define BRCMF_FW_MAX_NVRAM_SIZE			64000
- #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
-@@ -567,6 +568,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
- 			      char nvram_name[BRCMF_FW_NAME_LEN])
- {
-+	char chipname[12];
- 	u32 i;
- 	char end;
- 
-@@ -581,6 +583,8 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 		return -ENODEV;
- 	}
- 
-+	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
-+
- 	/* check if firmware path is provided by module parameter */
- 	if (brcmf_mp_global.firmware_path[0] != '\0') {
- 		strlcpy(fw_name, brcmf_mp_global.firmware_path,
-@@ -601,8 +605,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 	if ((nvram_name) && (mapping_table[i].nvram))
- 		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
- 
--	brcmf_info("using %s for chip %#08x(%d) rev %#08x\n",
--		   fw_name, chip, chip, chiprev);
-+	brcmf_info("using %s for chip %s\n", fw_name, chipname);
- 
- 	return 0;
- }
diff --git a/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch b/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
deleted file mode 100644
index 42adff61b9..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
+++ /dev/null
@@ -1,452 +0,0 @@
-From 856d5a011c86b59f6564be4508912fb1d866adfc Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:23 +0100
-Subject: [PATCH] brcmfmac: allocate struct brcmf_pub instance using
- wiphy_new()
-
-Rework the driver so the wiphy instance holds the main driver information
-in its private buffer. Previously it held struct brcmf_cfg80211_info
-instance so a bit of reorg was needed. This was done so that the wiphy
-name or its parent device can be shown in debug output.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c  |  2 +-
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 86 ++++++++++------------
- .../broadcom/brcm80211/brcmfmac/cfg80211.h         | 17 +++--
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  2 +
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 27 +++++--
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  2 +-
- 7 files changed, 76 insertions(+), 61 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
-@@ -462,7 +462,7 @@ static void brcmf_btcoex_dhcp_end(struct
- int brcmf_btcoex_set_mode(struct brcmf_cfg80211_vif *vif,
- 			  enum brcmf_btcoex_mode mode, u16 duration)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(vif->wdev.wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
- 	struct brcmf_btcoex_info *btci = cfg->btcoex;
- 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -753,7 +753,7 @@ s32 brcmf_notify_escan_complete(struct b
- static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
- 				       struct wireless_dev *wdev)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct net_device *ndev = wdev->netdev;
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	int ret;
-@@ -786,7 +786,7 @@ err_unarm:
- static
- int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct net_device *ndev = wdev->netdev;
- 
- 	if (ndev && ndev == cfg_to_ndev(cfg))
-@@ -831,7 +831,7 @@ brcmf_cfg80211_change_iface(struct wiphy
- 			 enum nl80211_iftype type,
- 			 struct vif_params *params)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	struct brcmf_cfg80211_vif *vif = ifp->vif;
- 	s32 infra = 0;
-@@ -2127,17 +2127,15 @@ static s32
- brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
- 			    s32 *dbm)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	struct net_device *ndev = cfg_to_ndev(cfg);
--	struct brcmf_if *ifp = netdev_priv(ndev);
-+	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
- 	s32 qdbm = 0;
- 	s32 err;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
--	if (!check_vif_up(ifp->vif))
-+	if (!check_vif_up(vif))
- 		return -EIO;
- 
--	err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
-+	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
- 	if (err) {
- 		brcmf_err("error (%d)\n", err);
- 		goto done;
-@@ -3359,7 +3357,7 @@ brcmf_cfg80211_sched_scan_start(struct w
- 				struct cfg80211_sched_scan_request *req)
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 
- 	brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
- 		  req->n_match_sets, req->n_ssids);
-@@ -5191,6 +5189,12 @@ static struct cfg80211_ops brcmf_cfg8021
- 	.del_pmk = brcmf_cfg80211_del_pmk,
- };
- 
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
-+{
-+	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
-+		       GFP_KERNEL);
-+}
-+
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
- 					   enum nl80211_iftype type)
- {
-@@ -5898,7 +5902,7 @@ static void brcmf_update_bw40_channel_fl
- static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
- 				    u32 bw_cap[])
- {
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 	struct ieee80211_supported_band *band;
- 	struct ieee80211_channel *channel;
- 	struct wiphy *wiphy;
-@@ -6013,7 +6017,7 @@ fail_pbuf:
- 
- static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
- {
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 	struct ieee80211_supported_band *band;
- 	struct brcmf_fil_bwcap_le band_bwcap;
- 	struct brcmf_chanspec_list *list;
-@@ -6198,10 +6202,10 @@ static void brcmf_update_vht_cap(struct
- 	}
- }
- 
--static int brcmf_setup_wiphybands(struct wiphy *wiphy)
-+static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
-+	struct wiphy *wiphy;
- 	u32 nmode = 0;
- 	u32 vhtmode = 0;
- 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
-@@ -6795,8 +6799,8 @@ static s32 brcmf_translate_country_code(
- static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
- 					struct regulatory_request *req)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 	struct brcmf_fil_country_le ccreq;
- 	s32 err;
- 	int i;
-@@ -6831,7 +6835,7 @@ static void brcmf_cfg80211_reg_notifier(
- 		brcmf_err("Firmware rejected country setting\n");
- 		return;
- 	}
--	brcmf_setup_wiphybands(wiphy);
-+	brcmf_setup_wiphybands(cfg);
- }
- 
- static void brcmf_free_wiphy(struct wiphy *wiphy)
-@@ -6858,17 +6862,15 @@ static void brcmf_free_wiphy(struct wiph
- 	if (wiphy->wowlan != &brcmf_wowlan_support)
- 		kfree(wiphy->wowlan);
- #endif
--	wiphy_free(wiphy);
- }
- 
- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
--						  struct device *busdev,
-+						  struct cfg80211_ops *ops,
- 						  bool p2pdev_forced)
- {
-+	struct wiphy *wiphy = drvr->wiphy;
- 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
- 	struct brcmf_cfg80211_info *cfg;
--	struct wiphy *wiphy;
--	struct cfg80211_ops *ops;
- 	struct brcmf_cfg80211_vif *vif;
- 	struct brcmf_if *ifp;
- 	s32 err = 0;
-@@ -6880,26 +6882,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		return NULL;
- 	}
- 
--	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
--	if (!ops)
--		return NULL;
--
--	ifp = netdev_priv(ndev);
--#ifdef CONFIG_PM
--	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
--		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
--#endif
--	wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
--	if (!wiphy) {
-+	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
-+	if (!cfg) {
- 		brcmf_err("Could not allocate wiphy device\n");
--		goto ops_out;
-+		return NULL;
- 	}
--	memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
--	set_wiphy_dev(wiphy, busdev);
- 
--	cfg = wiphy_priv(wiphy);
- 	cfg->wiphy = wiphy;
--	cfg->ops = ops;
- 	cfg->pub = drvr;
- 	init_vif_event(&cfg->vif_event);
- 	INIT_LIST_HEAD(&cfg->vif_list);
-@@ -6908,6 +6897,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 	if (IS_ERR(vif))
- 		goto wiphy_out;
- 
-+	ifp = netdev_priv(ndev);
- 	vif->ifp = ifp;
- 	vif->wdev.netdev = ndev;
- 	ndev->ieee80211_ptr = &vif->wdev;
-@@ -6934,6 +6924,11 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 	if (err < 0)
- 		goto priv_out;
- 
-+	/* regulatory notifer below needs access to cfg so
-+	 * assign it now.
-+	 */
-+	drvr->config = cfg;
-+
- 	brcmf_dbg(INFO, "Registering custom regulatory\n");
- 	wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
- 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
-@@ -6947,13 +6942,17 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
- 		*cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
- 	}
-+#ifdef CONFIG_PM
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
-+		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
-+#endif
- 	err = wiphy_register(wiphy);
- 	if (err < 0) {
- 		brcmf_err("Could not register wiphy device (%d)\n", err);
- 		goto priv_out;
- 	}
- 
--	err = brcmf_setup_wiphybands(wiphy);
-+	err = brcmf_setup_wiphybands(cfg);
- 	if (err) {
- 		brcmf_err("Setting wiphy bands failed (%d)\n", err);
- 		goto wiphy_unreg_out;
-@@ -6970,12 +6969,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		else
- 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
- 	}
--	/* p2p might require that "if-events" get processed by fweh. So
--	 * activate the already registered event handlers now and activate
--	 * the rest when initialization has completed. drvr->config needs to
--	 * be assigned before activating events.
--	 */
--	drvr->config = cfg;
-+
- 	err = brcmf_fweh_activate_events(ifp);
- 	if (err) {
- 		brcmf_err("FWEH activation failed (%d)\n", err);
-@@ -7043,8 +7037,7 @@ priv_out:
- 	ifp->vif = NULL;
- wiphy_out:
- 	brcmf_free_wiphy(wiphy);
--ops_out:
--	kfree(ops);
-+	kfree(cfg);
- 	return NULL;
- }
- 
-@@ -7059,4 +7052,5 @@ void brcmf_cfg80211_detach(struct brcmf_
- 	kfree(cfg->ops);
- 	wl_deinit_priv(cfg);
- 	brcmf_free_wiphy(cfg->wiphy);
-+	kfree(cfg);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -355,20 +355,24 @@ static inline struct wiphy *cfg_to_wiphy
- 
- static inline struct brcmf_cfg80211_info *wiphy_to_cfg(struct wiphy *w)
- {
--	return (struct brcmf_cfg80211_info *)(wiphy_priv(w));
-+	struct brcmf_pub *drvr = wiphy_priv(w);
-+	return drvr->config;
- }
- 
- static inline struct brcmf_cfg80211_info *wdev_to_cfg(struct wireless_dev *wd)
- {
--	return (struct brcmf_cfg80211_info *)(wdev_priv(wd));
-+	return wiphy_to_cfg(wd->wiphy);
-+}
-+
-+static inline struct brcmf_cfg80211_vif *wdev_to_vif(struct wireless_dev *wdev)
-+{
-+	return container_of(wdev, struct brcmf_cfg80211_vif, wdev);
- }
- 
- static inline
- struct net_device *cfg_to_ndev(struct brcmf_cfg80211_info *cfg)
- {
--	struct brcmf_cfg80211_vif *vif;
--	vif = list_first_entry(&cfg->vif_list, struct brcmf_cfg80211_vif, list);
--	return vif->wdev.netdev;
-+	return brcmf_get_ifp(cfg->pub, 0)->ndev;
- }
- 
- static inline struct brcmf_cfg80211_info *ndev_to_cfg(struct net_device *ndev)
-@@ -395,11 +399,12 @@ brcmf_cfg80211_connect_info *cfg_to_conn
- }
- 
- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
--						  struct device *busdev,
-+						  struct cfg80211_ops *ops,
- 						  bool p2pdev_forced);
- void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
- s32 brcmf_cfg80211_up(struct net_device *ndev);
- s32 brcmf_cfg80211_down(struct net_device *ndev);
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
- enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
- 
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -252,6 +252,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 		brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
- 		goto done;
- 	}
-+	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
- 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
- 
- 	bus = ifp->drvr->bus_if;
-@@ -279,6 +280,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 		ri->chippkg = le32_to_cpu(revinfo.chippkg);
- 		ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
- 
-+		/* use revinfo if not known yet */
- 		if (!bus->chip) {
- 			bus->chip = le32_to_cpu(revinfo.chipnum);
- 			bus->chiprev = le32_to_cpu(revinfo.chiprev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1021,7 +1021,7 @@ static int brcmf_revinfo_read(struct seq
- 	return 0;
- }
- 
--static int brcmf_bus_started(struct brcmf_pub *drvr)
-+static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
- {
- 	int ret = -1;
- 	struct brcmf_bus *bus_if = drvr->bus_if;
-@@ -1060,7 +1060,7 @@ static int brcmf_bus_started(struct brcm
- 
- 	brcmf_proto_add_if(drvr, ifp);
- 
--	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev,
-+	drvr->config = brcmf_cfg80211_attach(drvr, ops,
- 					     drvr->settings->p2p_enable);
- 	if (drvr->config == NULL) {
- 		ret = -ENOMEM;
-@@ -1115,17 +1115,26 @@ fail:
- 
- int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
- {
-+	struct wiphy *wiphy;
-+	struct cfg80211_ops *ops;
- 	struct brcmf_pub *drvr = NULL;
- 	int ret = 0;
- 	int i;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	/* Allocate primary brcmf_info */
--	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
--	if (!drvr)
-+	ops = brcmf_cfg80211_get_ops();
-+	if (!ops)
- 		return -ENOMEM;
- 
-+	wiphy = wiphy_new(ops, sizeof(*drvr));
-+	if (!wiphy)
-+		return -ENOMEM;
-+
-+	set_wiphy_dev(wiphy, dev);
-+	drvr = wiphy_priv(wiphy);
-+	drvr->wiphy = wiphy;
-+
- 	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
- 		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
- 
-@@ -1154,15 +1163,18 @@ int brcmf_attach(struct device *dev, str
- 	/* attach firmware event handler */
- 	brcmf_fweh_attach(drvr);
- 
--	ret = brcmf_bus_started(drvr);
-+	ret = brcmf_bus_started(drvr, ops);
- 	if (ret != 0) {
- 		brcmf_err("dongle is not responding: err=%d\n", ret);
- 		goto fail;
- 	}
-+
-+	drvr->config->ops = ops;
- 	return 0;
- 
- fail:
- 	brcmf_detach(dev);
-+	kfree(ops);
- 
- 	return ret;
- }
-@@ -1220,6 +1232,7 @@ void brcmf_detach(struct device *dev)
- 		brcmf_remove_interface(drvr->iflist[i], false);
- 
- 	brcmf_cfg80211_detach(drvr->config);
-+	drvr->config = NULL;
- 
- 	brcmf_bus_stop(drvr->bus_if);
- 
-@@ -1227,7 +1240,7 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_debug_detach(drvr);
- 	bus_if->drvr = NULL;
--	kfree(drvr);
-+	wiphy_free(drvr->wiphy);
- }
- 
- s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -107,6 +107,7 @@ struct brcmf_pub {
- 	/* Linkage ponters */
- 	struct brcmf_bus *bus_if;
- 	struct brcmf_proto *proto;
-+	struct wiphy *wiphy;
- 	struct brcmf_cfg80211_info *config;
- 
- 	/* Internal brcmf items */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2229,7 +2229,7 @@ fail:
-  */
- int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct brcmf_p2p_info *p2p = &cfg->p2p;
- 	struct brcmf_cfg80211_vif *vif;
- 	enum nl80211_iftype iftype;
diff --git a/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch b/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
deleted file mode 100644
index c5485c390a..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
+++ /dev/null
@@ -1,349 +0,0 @@
-From 34789d0cf682c643862792750a06c31ccf016cbc Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:24 +0100
-Subject: [PATCH] brcmfmac: use wiphy debugfs dir entry
-
-The driver used to create a brcmfmac dir entry at the top level
-debugfs mount point. This moves the debugfs entries into the
-wiphy debugfs dir entry.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c    |  6 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ---
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 11 +++---
- .../wireless/broadcom/brcm80211/brcmfmac/debug.c   | 42 ++--------------------
- .../wireless/broadcom/brcm80211/brcmfmac/debug.h   | 17 ---------
- .../wireless/broadcom/brcm80211/brcmfmac/feature.c |  3 ++
- .../wireless/broadcom/brcm80211/brcmfmac/feature.h |  7 ++++
- .../broadcom/brcm80211/brcmfmac/fwsignal.c         | 11 +++---
- .../broadcom/brcm80211/brcmfmac/fwsignal.h         |  1 +
- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |  8 +++--
- .../wireless/broadcom/brcm80211/brcmfmac/proto.c   |  3 +-
- .../wireless/broadcom/brcm80211/brcmfmac/proto.h   |  7 ++++
- 12 files changed, 47 insertions(+), 74 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -445,6 +445,11 @@ brcmf_proto_bcdc_init_done(struct brcmf_
- 	return 0;
- }
- 
-+static void brcmf_proto_bcdc_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	brcmf_fws_debugfs_create(drvr);
-+}
-+
- int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_bcdc *bcdc;
-@@ -472,6 +477,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
- 	drvr->proto->del_if = brcmf_proto_bcdc_del_if;
- 	drvr->proto->reset_if = brcmf_proto_bcdc_reset_if;
- 	drvr->proto->init_done = brcmf_proto_bcdc_init_done;
-+	drvr->proto->debugfs_create = brcmf_proto_bcdc_debugfs_create;
- 	drvr->proto->pd = bcdc;
- 
- 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -529,9 +529,6 @@ static int __init brcmfmac_module_init(v
- {
- 	int err;
- 
--	/* Initialize debug system first */
--	brcmf_debugfs_init();
--
- 	/* Get the platform data (if available) for our devices */
- 	err = platform_driver_probe(&brcmf_pd, brcmf_common_pd_probe);
- 	if (err == -ENODEV)
-@@ -543,7 +540,6 @@ static int __init brcmfmac_module_init(v
- 	/* Continue the initialization by registering the different busses */
- 	err = brcmf_core_init();
- 	if (err) {
--		brcmf_debugfs_exit();
- 		if (brcmfmac_pdata)
- 			platform_driver_unregister(&brcmf_pd);
- 	}
-@@ -556,7 +552,6 @@ static void __exit brcmfmac_module_exit(
- 	brcmf_core_exit();
- 	if (brcmfmac_pdata)
- 		platform_driver_unregister(&brcmf_pd);
--	brcmf_debugfs_exit();
- }
- 
- module_init(brcmfmac_module_init);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1050,8 +1050,6 @@ static int brcmf_bus_started(struct brcm
- 	if (ret < 0)
- 		goto fail;
- 
--	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
--
- 	brcmf_feat_attach(drvr);
- 
- 	ret = brcmf_proto_init_done(drvr);
-@@ -1094,6 +1092,11 @@ static int brcmf_bus_started(struct brcm
- #endif
- #endif /* CONFIG_INET */
- 
-+	/* populate debugfs */
-+	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
-+	brcmf_feat_debugfs_create(drvr);
-+	brcmf_proto_debugfs_create(drvr);
-+
- 	return 0;
- 
- fail:
-@@ -1146,9 +1149,6 @@ int brcmf_attach(struct device *dev, str
- 	drvr->bus_if->drvr = drvr;
- 	drvr->settings = settings;
- 
--	/* attach debug facilities */
--	brcmf_debug_attach(drvr);
--
- 	/* Attach and link in the protocol */
- 	ret = brcmf_proto_attach(drvr);
- 	if (ret != 0) {
-@@ -1238,7 +1238,6 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_proto_detach(drvr);
- 
--	brcmf_debug_detach(drvr);
- 	bus_if->drvr = NULL;
- 	wiphy_free(drvr->wiphy);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-@@ -25,8 +25,6 @@
- #include "fweh.h"
- #include "debug.h"
- 
--static struct dentry *root_folder;
--
- int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
- 			       size_t len)
- {
-@@ -54,44 +52,9 @@ int brcmf_debug_create_memdump(struct br
- 	return 0;
- }
- 
--void brcmf_debugfs_init(void)
--{
--	root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
--	if (IS_ERR(root_folder))
--		root_folder = NULL;
--}
--
--void brcmf_debugfs_exit(void)
--{
--	if (!root_folder)
--		return;
--
--	debugfs_remove_recursive(root_folder);
--	root_folder = NULL;
--}
--
--int brcmf_debug_attach(struct brcmf_pub *drvr)
--{
--	struct device *dev = drvr->bus_if->dev;
--
--	if (!root_folder)
--		return -ENODEV;
--
--	drvr->dbgfs_dir = debugfs_create_dir(dev_name(dev), root_folder);
--	return PTR_ERR_OR_ZERO(drvr->dbgfs_dir);
--}
--
--void brcmf_debug_detach(struct brcmf_pub *drvr)
--{
--	brcmf_fweh_unregister(drvr, BRCMF_E_PSM_WATCHDOG);
--
--	if (!IS_ERR_OR_NULL(drvr->dbgfs_dir))
--		debugfs_remove_recursive(drvr->dbgfs_dir);
--}
--
- struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr)
- {
--	return drvr->dbgfs_dir;
-+	return drvr->wiphy->debugfsdir;
- }
- 
- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
-@@ -99,7 +62,8 @@ int brcmf_debugfs_add_entry(struct brcmf
- {
- 	struct dentry *e;
- 
-+	WARN(!drvr->wiphy->debugfsdir, "wiphy not (yet) registered\n");
- 	e = debugfs_create_devm_seqfile(drvr->bus_if->dev, fn,
--					drvr->dbgfs_dir, read_fn);
-+					drvr->wiphy->debugfsdir, read_fn);
- 	return PTR_ERR_OR_ZERO(e);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
-@@ -113,29 +113,12 @@ extern int brcmf_msg_level;
- struct brcmf_bus;
- struct brcmf_pub;
- #ifdef DEBUG
--void brcmf_debugfs_init(void);
--void brcmf_debugfs_exit(void);
--int brcmf_debug_attach(struct brcmf_pub *drvr);
--void brcmf_debug_detach(struct brcmf_pub *drvr);
- struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
- 			    int (*read_fn)(struct seq_file *seq, void *data));
- int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
- 			       size_t len);
- #else
--static inline void brcmf_debugfs_init(void)
--{
--}
--static inline void brcmf_debugfs_exit(void)
--{
--}
--static inline int brcmf_debug_attach(struct brcmf_pub *drvr)
--{
--	return 0;
--}
--static inline void brcmf_debug_detach(struct brcmf_pub *drvr)
--{
--}
- static inline
- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
- 			    int (*read_fn)(struct seq_file *seq, void *data))
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -228,7 +228,10 @@ void brcmf_feat_attach(struct brcmf_pub
- 		/* no quirks */
- 		break;
- 	}
-+}
- 
-+void brcmf_feat_debugfs_create(struct brcmf_pub *drvr)
-+{
- 	brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -90,6 +90,13 @@ enum brcmf_feat_quirk {
- void brcmf_feat_attach(struct brcmf_pub *drvr);
- 
- /**
-+ * brcmf_feat_debugfs_create() - create debugfs entries.
-+ *
-+ * @drvr: driver instance.
-+ */
-+void brcmf_feat_debugfs_create(struct brcmf_pub *drvr);
-+
-+/**
-  * brcmf_feat_is_enabled() - query feature.
-  *
-  * @ifp: interface instance.
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2399,10 +2399,6 @@ struct brcmf_fws_info *brcmf_fws_attach(
- 	brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
- 			BRCMF_FWS_PSQ_LEN);
- 
--	/* create debugfs file for statistics */
--	brcmf_debugfs_add_entry(drvr, "fws_stats",
--				brcmf_debugfs_fws_stats_read);
--
- 	brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
- 		  fws->fw_signals ? "enabled" : "disabled", tlv);
- 	return fws;
-@@ -2429,6 +2425,13 @@ void brcmf_fws_detach(struct brcmf_fws_i
- 	kfree(fws);
- }
- 
-+void brcmf_fws_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	/* create debugfs file for statistics */
-+	brcmf_debugfs_add_entry(drvr, "fws_stats",
-+				brcmf_debugfs_fws_stats_read);
-+}
-+
- bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws)
- {
- 	return !fws->avoid_queueing;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-@@ -20,6 +20,7 @@
- 
- struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
- void brcmf_fws_detach(struct brcmf_fws_info *fws);
-+void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
- bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
- bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
- void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1418,6 +1418,11 @@ static int brcmf_msgbuf_stats_read(struc
- }
- #endif
- 
-+static void brcmf_msgbuf_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
-+}
-+
- int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_bus_msgbuf *if_msgbuf;
-@@ -1472,6 +1477,7 @@ int brcmf_proto_msgbuf_attach(struct brc
- 	drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
- 	drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
- 	drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
-+	drvr->proto->debugfs_create = brcmf_msgbuf_debugfs_create;
- 	drvr->proto->pd = msgbuf;
- 
- 	init_waitqueue_head(&msgbuf->ioctl_resp_wait);
-@@ -1525,8 +1531,6 @@ int brcmf_proto_msgbuf_attach(struct brc
- 	spin_lock_init(&msgbuf->flowring_work_lock);
- 	INIT_LIST_HEAD(&msgbuf->work_queue);
- 
--	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
--
- 	return 0;
- 
- fail:
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-@@ -54,7 +54,8 @@ int brcmf_proto_attach(struct brcmf_pub
- 	if (!proto->tx_queue_data || (proto->hdrpull == NULL) ||
- 	    (proto->query_dcmd == NULL) || (proto->set_dcmd == NULL) ||
- 	    (proto->configure_addr_mode == NULL) ||
--	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL)) {
-+	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL) ||
-+	    (proto->debugfs_create == NULL)) {
- 		brcmf_err("Not all proto handlers have been installed\n");
- 		goto fail;
- 	}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -48,6 +48,7 @@ struct brcmf_proto {
- 	void (*del_if)(struct brcmf_if *ifp);
- 	void (*reset_if)(struct brcmf_if *ifp);
- 	int (*init_done)(struct brcmf_pub *drvr);
-+	void (*debugfs_create)(struct brcmf_pub *drvr);
- 	void *pd;
- };
- 
-@@ -156,4 +157,10 @@ brcmf_proto_init_done(struct brcmf_pub *
- 	return drvr->proto->init_done(drvr);
- }
- 
-+static inline void
-+brcmf_proto_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	drvr->proto->debugfs_create(drvr);
-+}
-+
- #endif /* BRCMFMAC_PROTO_H */
diff --git a/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch b/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
deleted file mode 100644
index 0b1ae56bc0..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
+++ /dev/null
@@ -1,286 +0,0 @@
-From 41f573dbb534f14e62a4a5411f602c970cad1d77 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:25 +0100
-Subject: [PATCH] brcmfmac: derive firmware filenames from basename mapping
-
-Instead of defining individual filenames for firmware and nvram
-use a basename and derive the names from that.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 31 ++++++---
- .../broadcom/brcm80211/brcmfmac/firmware.h         | 24 ++-----
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 56 ++++++++---------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 73 +++++++++++-----------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 10 +--
- 5 files changed, 96 insertions(+), 98 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -563,6 +563,13 @@ int brcmf_fw_get_firmwares(struct device
- 					   0);
- }
- 
-+static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
-+				   const char *fw_base, const char *extension)
-+{
-+	strlcat(fw_name, fw_base, BRCMF_FW_NAME_LEN);
-+	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
-+}
-+
- int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
- 			      struct brcmf_firmware_mapping mapping_table[],
- 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
-@@ -587,25 +594,31 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 
- 	/* check if firmware path is provided by module parameter */
- 	if (brcmf_mp_global.firmware_path[0] != '\0') {
--		strlcpy(fw_name, brcmf_mp_global.firmware_path,
--			BRCMF_FW_NAME_LEN);
--		if ((nvram_name) && (mapping_table[i].nvram))
-+		if (fw_name)
-+			strlcpy(fw_name, brcmf_mp_global.firmware_path,
-+				BRCMF_FW_NAME_LEN);
-+		if (nvram_name)
- 			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
- 				BRCMF_FW_NAME_LEN);
- 
- 		end = brcmf_mp_global.firmware_path[
- 				strlen(brcmf_mp_global.firmware_path) - 1];
- 		if (end != '/') {
--			strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
--			if ((nvram_name) && (mapping_table[i].nvram))
-+			if (fw_name)
-+				strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
-+			if (nvram_name)
- 				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
- 		}
- 	}
--	strlcat(fw_name, mapping_table[i].fw, BRCMF_FW_NAME_LEN);
--	if ((nvram_name) && (mapping_table[i].nvram))
--		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
- 
--	brcmf_info("using %s for chip %s\n", fw_name, chipname);
-+	brcmf_info("using %s for chip %s\n",
-+		   mapping_table[i].fw_base, chipname);
-+	if (fw_name)
-+		brcmf_fw_get_full_name(fw_name,
-+				       mapping_table[i].fw_base, ".bin");
-+	if (nvram_name)
-+		brcmf_fw_get_full_name(nvram_name,
-+				       mapping_table[i].fw_base, ".txt");
- 
- 	return 0;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -38,28 +38,16 @@
- struct brcmf_firmware_mapping {
- 	u32 chipid;
- 	u32 revmask;
--	const char *fw;
--	const char *nvram;
-+	const char *fw_base;
- };
- 
--#define BRCMF_FW_NVRAM_DEF(fw_nvram_name, fw, nvram) \
--static const char BRCM_ ## fw_nvram_name ## _FIRMWARE_NAME[] = \
--	BRCMF_FW_DEFAULT_PATH fw; \
--static const char BRCM_ ## fw_nvram_name ## _NVRAM_NAME[] = \
--	BRCMF_FW_DEFAULT_PATH nvram; \
--MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw);
--
--#define BRCMF_FW_DEF(fw_name, fw) \
--static const char BRCM_ ## fw_name ## _FIRMWARE_NAME[] = \
--	BRCMF_FW_DEFAULT_PATH fw; \
--MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw) \
--
--#define BRCMF_FW_NVRAM_ENTRY(chipid, mask, name) \
--	{ chipid, mask, \
--	  BRCM_ ## name ## _FIRMWARE_NAME, BRCM_ ## name ## _NVRAM_NAME }
-+#define BRCMF_FW_DEF(fw_name, fw_base) \
-+static const char BRCM_ ## fw_name ## _FIRMWARE_BASENAME[] = \
-+	BRCMF_FW_DEFAULT_PATH fw_base; \
-+MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw_base ".bin")
- 
- #define BRCMF_FW_ENTRY(chipid, mask, name) \
--	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_NAME, NULL }
-+	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_BASENAME }
- 
- int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
- 			      struct brcmf_firmware_mapping mapping_table[],
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -46,36 +46,36 @@ enum brcmf_pcie_state {
- 	BRCMFMAC_PCIE_STATE_UP
- };
- 
--BRCMF_FW_NVRAM_DEF(43602, "brcmfmac43602-pcie.bin", "brcmfmac43602-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4350, "brcmfmac4350-pcie.bin", "brcmfmac4350-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4350C, "brcmfmac4350c2-pcie.bin", "brcmfmac4350c2-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-pcie.bin", "brcmfmac4356-pcie.txt");
--BRCMF_FW_NVRAM_DEF(43570, "brcmfmac43570-pcie.bin", "brcmfmac43570-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-pcie.bin", "brcmfmac4358-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4365C, "brcmfmac4365c-pcie.bin", "brcmfmac4365c-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4366C, "brcmfmac4366c-pcie.bin", "brcmfmac4366c-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
-+BRCMF_FW_DEF(43602, "brcmfmac43602-pcie");
-+BRCMF_FW_DEF(4350, "brcmfmac4350-pcie");
-+BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie");
-+BRCMF_FW_DEF(4356, "brcmfmac4356-pcie");
-+BRCMF_FW_DEF(43570, "brcmfmac43570-pcie");
-+BRCMF_FW_DEF(4358, "brcmfmac4358-pcie");
-+BRCMF_FW_DEF(4359, "brcmfmac4359-pcie");
-+BRCMF_FW_DEF(4365B, "brcmfmac4365b-pcie");
-+BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie");
-+BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie");
-+BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
-+BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
- 
- static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
-+	BRCMF_FW_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
-+	BRCMF_FW_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
-+	BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
-+	BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
-+	BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
-+	BRCMF_FW_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
-+	BRCMF_FW_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
-+	BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
-+	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
-+	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
-+	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
- };
- 
- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -600,47 +600,44 @@ static const struct sdiod_drive_str sdio
- 	{4,  0x1}
- };
- 
--BRCMF_FW_NVRAM_DEF(43143, "brcmfmac43143-sdio.bin", "brcmfmac43143-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43241B0, "brcmfmac43241b0-sdio.bin",
--		   "brcmfmac43241b0-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43241B4, "brcmfmac43241b4-sdio.bin",
--		   "brcmfmac43241b4-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43241B5, "brcmfmac43241b5-sdio.bin",
--		   "brcmfmac43241b5-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4329, "brcmfmac4329-sdio.bin", "brcmfmac4329-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4330, "brcmfmac4330-sdio.bin", "brcmfmac4330-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4334, "brcmfmac4334-sdio.bin", "brcmfmac4334-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340-sdio.bin", "brcmfmac43340-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4335, "brcmfmac4335-sdio.bin", "brcmfmac4335-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43362, "brcmfmac43362-sdio.bin", "brcmfmac43362-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4339, "brcmfmac4339-sdio.bin", "brcmfmac4339-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43430A0, "brcmfmac43430a0-sdio.bin", "brcmfmac43430a0-sdio.txt");
-+BRCMF_FW_DEF(43143, "brcmfmac43143-sdio");
-+BRCMF_FW_DEF(43241B0, "brcmfmac43241b0-sdio");
-+BRCMF_FW_DEF(43241B4, "brcmfmac43241b4-sdio");
-+BRCMF_FW_DEF(43241B5, "brcmfmac43241b5-sdio");
-+BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
-+BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
-+BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
-+BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
-+BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
-+BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
-+BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
-+BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-sdio");
- /* Note the names are not postfixed with a1 for backward compatibility */
--BRCMF_FW_NVRAM_DEF(43430A1, "brcmfmac43430-sdio.bin", "brcmfmac43430-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-sdio.bin", "brcmfmac4356-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4373, "brcmfmac4373-sdio.bin", "brcmfmac4373-sdio.txt");
-+BRCMF_FW_DEF(43430A1, "brcmfmac43430-sdio");
-+BRCMF_FW_DEF(43455, "brcmfmac43455-sdio");
-+BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
-+BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
-+BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
- 
- static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
--	BRCMF_FW_NVRAM_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
-+	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
-+	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
-+	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
-+	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
-+	BRCMF_FW_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
-+	BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
-+	BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
-+	BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
-+	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
-+	BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
-+	BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
-+	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
-+	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
-+	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
-+	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
-+	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
-+	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
-+	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
- };
- 
- static void pkt_align(struct sk_buff *p, int len, int align)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -46,11 +46,11 @@
- #define BRCMF_USB_CBCTL_READ		1
- #define BRCMF_USB_MAX_PKT_SIZE		1600
- 
--BRCMF_FW_DEF(43143, "brcmfmac43143.bin");
--BRCMF_FW_DEF(43236B, "brcmfmac43236b.bin");
--BRCMF_FW_DEF(43242A, "brcmfmac43242a.bin");
--BRCMF_FW_DEF(43569, "brcmfmac43569.bin");
--BRCMF_FW_DEF(4373, "brcmfmac4373.bin");
-+BRCMF_FW_DEF(43143, "brcmfmac43143");
-+BRCMF_FW_DEF(43236B, "brcmfmac43236b");
-+BRCMF_FW_DEF(43242A, "brcmfmac43242a");
-+BRCMF_FW_DEF(43569, "brcmfmac43569");
-+BRCMF_FW_DEF(4373, "brcmfmac4373");
- 
- static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
diff --git a/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch b/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
deleted file mode 100644
index a75465a893..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
+++ /dev/null
@@ -1,574 +0,0 @@
-From d09ae51a4b676151edaf572bcd5f272b5532639f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:26 +0100
-Subject: [PATCH] brcmfmac: pass struct in brcmf_fw_get_firmwares()
-
-Make the function brcmf_fw_get_firmwares() a bit more easy to extend
-using a structure to pass the request parameters.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 175 ++++++++++++++-------
- .../broadcom/brcm80211/brcmfmac/firmware.h         |  43 +++--
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  38 ++++-
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  32 +++-
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  43 ++++-
- 5 files changed, 245 insertions(+), 86 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -438,18 +438,31 @@ void brcmf_fw_nvram_free(void *nvram)
- 
- struct brcmf_fw {
- 	struct device *dev;
--	u16 flags;
--	const struct firmware *code;
--	const char *nvram_name;
--	u16 domain_nr;
--	u16 bus_nr;
--	void (*done)(struct device *dev, int err, const struct firmware *fw,
--		     void *nvram_image, u32 nvram_len);
-+	struct brcmf_fw_request *req;
-+	u32 curpos;
-+	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
- };
- 
-+static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
-+
-+static void brcmf_fw_free_request(struct brcmf_fw_request *req)
-+{
-+	struct brcmf_fw_item *item;
-+	int i;
-+
-+	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
-+		if (item->type == BRCMF_FW_TYPE_BINARY)
-+			release_firmware(item->binary);
-+		else if (item->type == BRCMF_FW_TYPE_NVRAM)
-+			brcmf_fw_nvram_free(item->nv_data.data);
-+	}
-+	kfree(req);
-+}
-+
- static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
- {
- 	struct brcmf_fw *fwctx = ctx;
-+	struct brcmf_fw_item *cur;
- 	u32 nvram_length = 0;
- 	void *nvram = NULL;
- 	u8 *data = NULL;
-@@ -457,83 +470,150 @@ static void brcmf_fw_request_nvram_done(
- 	bool raw_nvram;
- 
- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
-+
-+	cur = &fwctx->req->items[fwctx->curpos];
-+
- 	if (fw && fw->data) {
- 		data = (u8 *)fw->data;
- 		data_len = fw->size;
- 		raw_nvram = false;
- 	} else {
- 		data = bcm47xx_nvram_get_contents(&data_len);
--		if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-+		if (!data && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
- 			goto fail;
- 		raw_nvram = true;
- 	}
- 
- 	if (data)
- 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
--					     fwctx->domain_nr, fwctx->bus_nr);
-+					     fwctx->req->domain_nr,
-+					     fwctx->req->bus_nr);
- 
- 	if (raw_nvram)
- 		bcm47xx_nvram_release_contents(data);
- 	release_firmware(fw);
--	if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-+	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
- 		goto fail;
- 
--	fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length);
--	kfree(fwctx);
-+	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
-+	cur->nv_data.data = nvram;
-+	cur->nv_data.len = nvram_length;
- 	return;
- 
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
--	release_firmware(fwctx->code);
--	fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0);
-+	fwctx->done(fwctx->dev, -ENOENT, NULL);
-+	brcmf_fw_free_request(fwctx->req);
- 	kfree(fwctx);
- }
- 
--static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
-+static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
-+{
-+	struct brcmf_fw_item *cur;
-+	const struct firmware *fw = NULL;
-+	int ret;
-+
-+	cur = &fwctx->req->items[fwctx->curpos];
-+
-+	brcmf_dbg(TRACE, "%srequest for %s\n", async ? "async " : "",
-+		  cur->path);
-+
-+	if (async)
-+		ret = request_firmware_nowait(THIS_MODULE, true, cur->path,
-+					      fwctx->dev, GFP_KERNEL, fwctx,
-+					      brcmf_fw_request_done);
-+	else
-+		ret = request_firmware(&fw, cur->path, fwctx->dev);
-+
-+	if (ret < 0) {
-+		brcmf_fw_request_done(NULL, fwctx);
-+	} else if (!async && fw) {
-+		brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path,
-+			  fw ? "" : "not ");
-+		if (cur->type == BRCMF_FW_TYPE_BINARY)
-+			cur->binary = fw;
-+		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-+			brcmf_fw_request_nvram_done(fw, fwctx);
-+		else
-+			release_firmware(fw);
-+
-+		return -EAGAIN;
-+	}
-+	return 0;
-+}
-+
-+static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
- {
- 	struct brcmf_fw *fwctx = ctx;
-+	struct brcmf_fw_item *cur;
- 	int ret = 0;
- 
--	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
--	if (!fw) {
-+	cur = &fwctx->req->items[fwctx->curpos];
-+
-+	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
-+		  fw ? "" : "not ");
-+
-+	if (fw) {
-+		if (cur->type == BRCMF_FW_TYPE_BINARY)
-+			cur->binary = fw;
-+		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-+			brcmf_fw_request_nvram_done(fw, fwctx);
-+		else
-+			release_firmware(fw);
-+	} else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
-+		brcmf_fw_request_nvram_done(NULL, fwctx);
-+	} else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
- 		ret = -ENOENT;
- 		goto fail;
- 	}
--	/* only requested code so done here */
--	if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM))
--		goto done;
--
--	fwctx->code = fw;
--	ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
--				      fwctx->dev, GFP_KERNEL, fwctx,
--				      brcmf_fw_request_nvram_done);
- 
--	/* pass NULL to nvram callback for bcm47xx fallback */
--	if (ret)
--		brcmf_fw_request_nvram_done(NULL, fwctx);
-+	do {
-+		if (++fwctx->curpos == fwctx->req->n_items) {
-+			ret = 0;
-+			goto done;
-+		}
-+
-+		ret = brcmf_fw_request_next_item(fwctx, false);
-+	} while (ret == -EAGAIN);
-+
- 	return;
- 
- fail:
--	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-+	brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
-+		  dev_name(fwctx->dev), cur->path);
-+	brcmf_fw_free_request(fwctx->req);
-+	fwctx->req = NULL;
- done:
--	fwctx->done(fwctx->dev, ret, fw, NULL, 0);
-+	fwctx->done(fwctx->dev, ret, fwctx->req);
- 	kfree(fwctx);
- }
- 
--int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
--				const char *code, const char *nvram,
--				void (*fw_cb)(struct device *dev, int err,
--					      const struct firmware *fw,
--					      void *nvram_image, u32 nvram_len),
--				u16 domain_nr, u16 bus_nr)
-+static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
-+{
-+	struct brcmf_fw_item *item;
-+	int i;
-+
-+	if (!req->n_items)
-+		return false;
-+
-+	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
-+		if (!item->path)
-+			return false;
-+	}
-+	return true;
-+}
-+
-+int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
-+			   void (*fw_cb)(struct device *dev, int err,
-+					 struct brcmf_fw_request *req))
- {
- 	struct brcmf_fw *fwctx;
- 
- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
--	if (!fw_cb || !code)
-+	if (!fw_cb)
- 		return -EINVAL;
- 
--	if ((flags & BRCMF_FW_REQUEST_NVRAM) && !nvram)
-+	if (!brcmf_fw_request_is_valid(req))
- 		return -EINVAL;
- 
- 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
-@@ -541,26 +621,11 @@ int brcmf_fw_get_firmwares_pcie(struct d
- 		return -ENOMEM;
- 
- 	fwctx->dev = dev;
--	fwctx->flags = flags;
-+	fwctx->req = req;
- 	fwctx->done = fw_cb;
--	if (flags & BRCMF_FW_REQUEST_NVRAM)
--		fwctx->nvram_name = nvram;
--	fwctx->domain_nr = domain_nr;
--	fwctx->bus_nr = bus_nr;
--
--	return request_firmware_nowait(THIS_MODULE, true, code, dev,
--				       GFP_KERNEL, fwctx,
--				       brcmf_fw_request_code_done);
--}
- 
--int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
--			   const char *code, const char *nvram,
--			   void (*fw_cb)(struct device *dev, int err,
--					 const struct firmware *fw,
--					 void *nvram_image, u32 nvram_len))
--{
--	return brcmf_fw_get_firmwares_pcie(dev, flags, code, nvram, fw_cb, 0,
--					   0);
-+	brcmf_fw_request_next_item(fwctx, true);
-+	return 0;
- }
- 
- static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -16,10 +16,7 @@
- #ifndef BRCMFMAC_FIRMWARE_H
- #define BRCMFMAC_FIRMWARE_H
- 
--#define BRCMF_FW_REQUEST		0x000F
--#define  BRCMF_FW_REQUEST_NVRAM		0x0001
--#define BRCMF_FW_REQ_FLAGS		0x00F0
--#define  BRCMF_FW_REQ_NV_OPTIONAL	0x0010
-+#define BRCMF_FW_REQF_OPTIONAL		0x0001
- 
- #define	BRCMF_FW_NAME_LEN		320
- 
-@@ -54,21 +51,39 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
- 			      char nvram_name[BRCMF_FW_NAME_LEN]);
- void brcmf_fw_nvram_free(void *nvram);
-+
-+enum brcmf_fw_type {
-+	BRCMF_FW_TYPE_BINARY,
-+	BRCMF_FW_TYPE_NVRAM
-+};
-+
-+struct brcmf_fw_item {
-+	const char *path;
-+	enum brcmf_fw_type type;
-+	u16 flags;
-+	union {
-+		const struct firmware *binary;
-+		struct {
-+			void *data;
-+			u32 len;
-+		} nv_data;
-+	};
-+};
-+
-+struct brcmf_fw_request {
-+	u16 domain_nr;
-+	u16 bus_nr;
-+	u32 n_items;
-+	struct brcmf_fw_item items[0];
-+};
-+
- /*
-  * Request firmware(s) asynchronously. When the asynchronous request
-  * fails it will not use the callback, but call device_release_driver()
-  * instead which will call the driver .remove() callback.
-  */
--int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
--				const char *code, const char *nvram,
--				void (*fw_cb)(struct device *dev, int err,
--					      const struct firmware *fw,
--					      void *nvram_image, u32 nvram_len),
--				u16 domain_nr, u16 bus_nr);
--int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
--			   const char *code, const char *nvram,
-+int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
- 			   void (*fw_cb)(struct device *dev, int err,
--					 const struct firmware *fw,
--					 void *nvram_image, u32 nvram_len));
-+					 struct brcmf_fw_request *req));
- 
- #endif /* BRCMFMAC_FIRMWARE_H */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1651,15 +1651,19 @@ static const struct brcmf_buscore_ops br
- 	.write32 = brcmf_pcie_buscore_write32,
- };
- 
-+#define BRCMF_PCIE_FW_CODE	0
-+#define BRCMF_PCIE_FW_NVRAM	1
-+
- static void brcmf_pcie_setup(struct device *dev, int ret,
--			     const struct firmware *fw,
--			     void *nvram, u32 nvram_len)
-+			     struct brcmf_fw_request *fwreq)
- {
-+	const struct firmware *fw;
-+	void *nvram;
- 	struct brcmf_bus *bus;
- 	struct brcmf_pciedev *pcie_bus_dev;
- 	struct brcmf_pciedev_info *devinfo;
- 	struct brcmf_commonring **flowrings;
--	u32 i;
-+	u32 i, nvram_len;
- 
- 	/* check firmware loading result */
- 	if (ret)
-@@ -1670,6 +1674,11 @@ static void brcmf_pcie_setup(struct devi
- 	devinfo = pcie_bus_dev->devinfo;
- 	brcmf_pcie_attach(devinfo);
- 
-+	fw = fwreq->items[BRCMF_PCIE_FW_CODE].binary;
-+	nvram = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.data;
-+	nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len;
-+	kfree(fwreq);
-+
- 	/* Some of the firmwares have the size of the memory of the device
- 	 * defined inside the firmware. This is because part of the memory in
- 	 * the device is shared and the devision is determined by FW. Parse
-@@ -1730,6 +1739,7 @@ static int
- brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- {
- 	int ret;
-+	struct brcmf_fw_request *fwreq;
- 	struct brcmf_pciedev_info *devinfo;
- 	struct brcmf_pciedev *pcie_bus_dev;
- 	struct brcmf_bus *bus;
-@@ -1800,12 +1810,26 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 	if (ret)
- 		goto fail_bus;
- 
--	ret = brcmf_fw_get_firmwares_pcie(bus->dev, BRCMF_FW_REQUEST_NVRAM |
--						    BRCMF_FW_REQ_NV_OPTIONAL,
--					  devinfo->fw_name, devinfo->nvram_name,
--					  brcmf_pcie_setup, domain_nr, bus_nr);
-+	fwreq = kzalloc(sizeof(*fwreq) + 2 * sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq) {
-+		ret = -ENOMEM;
-+		goto fail_bus;
-+	}
-+
-+	fwreq->items[BRCMF_PCIE_FW_CODE].path = devinfo->fw_name;
-+	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].path = devinfo->nvram_name;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-+	fwreq->n_items = 2;
-+	fwreq->domain_nr = domain_nr;
-+	fwreq->bus_nr = bus_nr;
-+	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
- 	if (ret == 0)
- 		return 0;
-+
-+	kfree(fwreq);
- fail_bus:
- 	kfree(bus->msgbuf);
- 	kfree(bus);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4031,14 +4031,19 @@ static const struct brcmf_bus_ops brcmf_
- 	.get_fwname = brcmf_sdio_get_fwname,
- };
- 
-+#define BRCMF_SDIO_FW_CODE	0
-+#define BRCMF_SDIO_FW_NVRAM	1
-+
- static void brcmf_sdio_firmware_callback(struct device *dev, int err,
--					 const struct firmware *code,
--					 void *nvram, u32 nvram_len)
-+					 struct brcmf_fw_request *fwreq)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
- 	struct brcmf_sdio *bus = sdiod->bus;
- 	struct brcmf_core *core = bus->sdio_core;
-+	const struct firmware *code;
-+	void *nvram;
-+	u32 nvram_len;
- 	u8 saveclk;
- 
- 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
-@@ -4046,6 +4051,11 @@ static void brcmf_sdio_firmware_callback
- 	if (err)
- 		goto fail;
- 
-+	code = fwreq->items[BRCMF_SDIO_FW_CODE].binary;
-+	nvram = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.data;
-+	nvram_len = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.len;
-+	kfree(fwreq);
-+
- 	/* try to download image and nvram to the dongle */
- 	bus->alp_only = true;
- 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-@@ -4150,6 +4160,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	int ret;
- 	struct brcmf_sdio *bus;
- 	struct workqueue_struct *wq;
-+	struct brcmf_fw_request *fwreq;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
-@@ -4240,11 +4251,24 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	if (ret)
- 		goto fail;
- 
--	ret = brcmf_fw_get_firmwares(sdiodev->dev, BRCMF_FW_REQUEST_NVRAM,
--				     sdiodev->fw_name, sdiodev->nvram_name,
-+	fwreq = kzalloc(sizeof(fwreq) + 2 * sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq) {
-+		ret = -ENOMEM;
-+		goto fail;
-+	}
-+
-+	fwreq->items[BRCMF_SDIO_FW_CODE].path = sdiodev->fw_name;
-+	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_SDIO_FW_NVRAM].path = sdiodev->nvram_name;
-+	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+	fwreq->n_items = 2;
-+
-+	ret = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
- 				     brcmf_sdio_firmware_callback);
- 	if (ret != 0) {
- 		brcmf_err("async firmware request failed: %d\n", ret);
-+		kfree(fwreq);
- 		goto fail;
- 	}
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1155,18 +1155,23 @@ static const struct brcmf_bus_ops brcmf_
- 	.get_fwname = brcmf_usb_get_fwname,
- };
- 
-+#define BRCMF_USB_FW_CODE	0
-+
- static void brcmf_usb_probe_phase2(struct device *dev, int ret,
--				   const struct firmware *fw,
--				   void *nvram, u32 nvlen)
-+				   struct brcmf_fw_request *fwreq)
- {
- 	struct brcmf_bus *bus = dev_get_drvdata(dev);
- 	struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo;
-+	const struct firmware *fw;
- 
- 	if (ret)
- 		goto error;
- 
- 	brcmf_dbg(USB, "Start fw downloading\n");
- 
-+	fw = fwreq->items[BRCMF_USB_FW_CODE].binary;
-+	kfree(fwreq);
-+
- 	ret = check_file(fw->data);
- 	if (ret < 0) {
- 		brcmf_err("invalid firmware\n");
-@@ -1200,6 +1205,7 @@ static int brcmf_usb_probe_cb(struct brc
- 	struct brcmf_bus *bus = NULL;
- 	struct brcmf_usbdev *bus_pub = NULL;
- 	struct device *dev = devinfo->dev;
-+	struct brcmf_fw_request *fwreq;
- 	int ret;
- 
- 	brcmf_dbg(USB, "Enter\n");
-@@ -1250,11 +1256,22 @@ static int brcmf_usb_probe_cb(struct brc
- 	if (ret)
- 		goto fail;
- 
-+	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq) {
-+		ret = -ENOMEM;
-+		goto fail;
-+	}
-+
-+	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
-+	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->n_items = 1;
-+
- 	/* request firmware here */
--	ret = brcmf_fw_get_firmwares(dev, 0, devinfo->fw_name, NULL,
--				     brcmf_usb_probe_phase2);
-+	ret = brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2);
- 	if (ret) {
- 		brcmf_err("firmware request failed: %d\n", ret);
-+		kfree(fwreq);
- 		goto fail;
- 	}
- 
-@@ -1447,11 +1464,25 @@ static int brcmf_usb_reset_resume(struct
- {
- 	struct usb_device *usb = interface_to_usbdev(intf);
- 	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
-+	struct brcmf_fw_request *fwreq;
-+	int ret;
- 
- 	brcmf_dbg(USB, "Enter\n");
- 
--	return brcmf_fw_get_firmwares(&usb->dev, 0, devinfo->fw_name, NULL,
--				      brcmf_usb_probe_phase2);
-+	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq)
-+		return -ENOMEM;
-+
-+	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
-+	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->n_items = 1;
-+
-+	ret = brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2);
-+	if (ret < 0)
-+		kfree(fwreq);
-+
-+	return ret;
- }
- 
- #define BRCMF_USB_DEVICE(dev_id)	\
diff --git a/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch b/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
deleted file mode 100644
index 408154ef0f..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
+++ /dev/null
@@ -1,328 +0,0 @@
-From 2baa3aaee27f137b8db9a9224d0fe9b281d28e34 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:27 +0100
-Subject: [PATCH] brcmfmac: introduce brcmf_fw_alloc_request() function
-
-The function brcmf_fw_alloc_request() takes a list of required files
-and allocated the struct brcmf_fw_request instance accordingly. The
-request can be modified by the caller before being passed to the
-brcmf_fw_request_firmwares() function.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 58 ++++++++++++++++++++++
- .../broadcom/brcm80211/brcmfmac/firmware.h         | 11 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 58 ++++++++++++----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 38 ++++++++------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 42 +++++++++-------
- 5 files changed, 147 insertions(+), 60 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -688,3 +688,61 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 	return 0;
- }
- 
-+struct brcmf_fw_request *
-+brcmf_fw_alloc_request(u32 chip, u32 chiprev,
-+		       struct brcmf_firmware_mapping mapping_table[],
-+		       u32 table_size, struct brcmf_fw_name *fwnames,
-+		       u32 n_fwnames)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	char chipname[12];
-+	const char *mp_path;
-+	u32 i, j;
-+	char end;
-+	size_t reqsz;
-+
-+	for (i = 0; i < table_size; i++) {
-+		if (mapping_table[i].chipid == chip &&
-+		    mapping_table[i].revmask & BIT(chiprev))
-+			break;
-+	}
-+
-+	if (i == table_size) {
-+		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
-+		return NULL;
-+	}
-+
-+	reqsz = sizeof(*fwreq) + n_fwnames * sizeof(struct brcmf_fw_item);
-+	fwreq = kzalloc(reqsz, GFP_KERNEL);
-+	if (!fwreq)
-+		return NULL;
-+
-+	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
-+
-+	brcmf_info("using %s for chip %s\n",
-+		   mapping_table[i].fw_base, chipname);
-+
-+	mp_path = brcmf_mp_global.firmware_path;
-+	end = mp_path[strlen(mp_path) - 1];
-+	fwreq->n_items = n_fwnames;
-+
-+	for (j = 0; j < n_fwnames; j++) {
-+		fwreq->items[j].path = fwnames[j].path;
-+		/* check if firmware path is provided by module parameter */
-+		if (brcmf_mp_global.firmware_path[0] != '\0') {
-+			strlcpy(fwnames[j].path, mp_path,
-+				BRCMF_FW_NAME_LEN);
-+
-+			if (end != '/') {
-+				strlcat(fwnames[j].path, "/",
-+					BRCMF_FW_NAME_LEN);
-+			}
-+		}
-+		brcmf_fw_get_full_name(fwnames[j].path,
-+				       mapping_table[i].fw_base,
-+				       fwnames[j].extension);
-+		fwreq->items[j].path = fwnames[j].path;
-+	}
-+
-+	return fwreq;
-+}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -77,6 +77,17 @@ struct brcmf_fw_request {
- 	struct brcmf_fw_item items[0];
- };
- 
-+struct brcmf_fw_name {
-+	const char *extension;
-+	char *path;
-+};
-+
-+struct brcmf_fw_request *
-+brcmf_fw_alloc_request(u32 chip, u32 chiprev,
-+		       struct brcmf_firmware_mapping mapping_table[],
-+		       u32 table_size, struct brcmf_fw_name *fwnames,
-+		       u32 n_fwnames);
-+
- /*
-  * Request firmware(s) asynchronously. When the asynchronous request
-  * fails it will not use the callback, but call device_release_driver()
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1735,6 +1735,31 @@ fail:
- 	device_release_driver(dev);
- }
- 
-+static struct brcmf_fw_request *
-+brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ".bin", devinfo->fw_name },
-+		{ ".txt", devinfo->nvram_name },
-+	};
-+
-+	fwreq = brcmf_fw_alloc_request(devinfo->ci->chip, devinfo->ci->chiprev,
-+				       brcmf_pcie_fwnames,
-+				       ARRAY_SIZE(brcmf_pcie_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return NULL;
-+
-+	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-+	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
-+	fwreq->bus_nr = devinfo->pdev->bus->number;
-+
-+	return fwreq;
-+}
-+
- static int
- brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- {
-@@ -1743,13 +1768,8 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 	struct brcmf_pciedev_info *devinfo;
- 	struct brcmf_pciedev *pcie_bus_dev;
- 	struct brcmf_bus *bus;
--	u16 domain_nr;
--	u16 bus_nr;
- 
--	domain_nr = pci_domain_nr(pdev->bus) + 1;
--	bus_nr = pdev->bus->number;
--	brcmf_dbg(PCIE, "Enter %x:%x (%d/%d)\n", pdev->vendor, pdev->device,
--		  domain_nr, bus_nr);
-+	brcmf_dbg(PCIE, "Enter %x:%x\n", pdev->vendor, pdev->device);
- 
- 	ret = -ENOMEM;
- 	devinfo = kzalloc(sizeof(*devinfo), GFP_KERNEL);
-@@ -1803,33 +1823,19 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 	bus->wowl_supported = pci_pme_capable(pdev, PCI_D3hot);
- 	dev_set_drvdata(&pdev->dev, bus);
- 
--	ret = brcmf_fw_map_chip_to_name(devinfo->ci->chip, devinfo->ci->chiprev,
--					brcmf_pcie_fwnames,
--					ARRAY_SIZE(brcmf_pcie_fwnames),
--					devinfo->fw_name, devinfo->nvram_name);
--	if (ret)
--		goto fail_bus;
--
--	fwreq = kzalloc(sizeof(*fwreq) + 2 * sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
- 	if (!fwreq) {
- 		ret = -ENOMEM;
- 		goto fail_bus;
- 	}
- 
--	fwreq->items[BRCMF_PCIE_FW_CODE].path = devinfo->fw_name;
--	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->items[BRCMF_PCIE_FW_NVRAM].path = devinfo->nvram_name;
--	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
--	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
--	fwreq->n_items = 2;
--	fwreq->domain_nr = domain_nr;
--	fwreq->bus_nr = bus_nr;
- 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
--	if (ret == 0)
--		return 0;
-+	if (ret < 0) {
-+		kfree(fwreq);
-+		goto fail_bus;
-+	}
-+	return 0;
- 
--	kfree(fwreq);
- fail_bus:
- 	kfree(bus->msgbuf);
- 	kfree(bus);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4155,6 +4155,28 @@ fail:
- 	device_release_driver(dev);
- }
- 
-+static struct brcmf_fw_request *
-+brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ".bin", bus->sdiodev->fw_name },
-+		{ ".txt", bus->sdiodev->nvram_name },
-+	};
-+
-+	fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
-+				       brcmf_sdio_fwnames,
-+				       ARRAY_SIZE(brcmf_sdio_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return NULL;
-+
-+	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+
-+	return fwreq;
-+}
-+
- struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
- {
- 	int ret;
-@@ -4244,26 +4266,12 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 
- 	brcmf_dbg(INFO, "completed!!\n");
- 
--	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
--					brcmf_sdio_fwnames,
--					ARRAY_SIZE(brcmf_sdio_fwnames),
--					sdiodev->fw_name, sdiodev->nvram_name);
--	if (ret)
--		goto fail;
--
--	fwreq = kzalloc(sizeof(fwreq) + 2 * sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_sdio_prepare_fw_request(bus);
- 	if (!fwreq) {
- 		ret = -ENOMEM;
- 		goto fail;
- 	}
- 
--	fwreq->items[BRCMF_SDIO_FW_CODE].path = sdiodev->fw_name;
--	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->items[BRCMF_SDIO_FW_NVRAM].path = sdiodev->nvram_name;
--	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
--	fwreq->n_items = 2;
--
- 	ret = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
- 				     brcmf_sdio_firmware_callback);
- 	if (ret != 0) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1200,6 +1200,27 @@ error:
- 	device_release_driver(dev);
- }
- 
-+static struct brcmf_fw_request *
-+brcmf_usb_prepare_fw_request(struct brcmf_usbdev_info *devinfo)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ".bin", devinfo->fw_name },
-+	};
-+
-+	fwreq = brcmf_fw_alloc_request(devinfo->bus_pub.devid,
-+				       devinfo->bus_pub.chiprev,
-+				       brcmf_usb_fwnames,
-+				       ARRAY_SIZE(brcmf_usb_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return NULL;
-+
-+	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+
-+	return fwreq;
-+}
-+
- static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
- {
- 	struct brcmf_bus *bus = NULL;
-@@ -1249,24 +1270,12 @@ static int brcmf_usb_probe_cb(struct brc
- 	bus->chip = bus_pub->devid;
- 	bus->chiprev = bus_pub->chiprev;
- 
--	ret = brcmf_fw_map_chip_to_name(bus_pub->devid, bus_pub->chiprev,
--					brcmf_usb_fwnames,
--					ARRAY_SIZE(brcmf_usb_fwnames),
--					devinfo->fw_name, NULL);
--	if (ret)
--		goto fail;
--
--	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_usb_prepare_fw_request(devinfo);
- 	if (!fwreq) {
- 		ret = -ENOMEM;
- 		goto fail;
- 	}
- 
--	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
--	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->n_items = 1;
--
- 	/* request firmware here */
- 	ret = brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2);
- 	if (ret) {
-@@ -1469,15 +1478,10 @@ static int brcmf_usb_reset_resume(struct
- 
- 	brcmf_dbg(USB, "Enter\n");
- 
--	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_usb_prepare_fw_request(devinfo);
- 	if (!fwreq)
- 		return -ENOMEM;
- 
--	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
--	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->n_items = 1;
--
- 	ret = brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2);
- 	if (ret < 0)
- 		kfree(fwreq);
diff --git a/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch b/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
deleted file mode 100644
index 391229a865..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From bf7a7b37f6ef5090a2bae7e7ae23cd26b741cca4 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:28 +0100
-Subject: [PATCH] brcmfmac: add extension to .get_fwname() callbacks
-
-This changes the bus layer api by having the caller provide an
-extension. With this the callback can use brcmf_fw_alloc_request()
-to get the needed firmware name.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  6 +--
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 43 +++-------------------
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 27 +++++++-------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 26 +++++++------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 27 ++++++++------
- 5 files changed, 51 insertions(+), 78 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -88,7 +88,7 @@ struct brcmf_bus_ops {
- 	void (*wowl_config)(struct device *dev, bool enabled);
- 	size_t (*get_ramsize)(struct device *dev);
- 	int (*get_memdump)(struct device *dev, void *data, size_t len);
--	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
-+	int (*get_fwname)(struct device *dev, const char *ext,
- 			  unsigned char *fw_name);
- };
- 
-@@ -228,10 +228,10 @@ int brcmf_bus_get_memdump(struct brcmf_b
- }
- 
- static inline
--int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
-+int brcmf_bus_get_fwname(struct brcmf_bus *bus, const char *ext,
- 			 unsigned char *fw_name)
- {
--	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
-+	return bus->ops->get_fwname(bus->dev, ext, fw_name);
- }
- 
- /*
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -129,42 +129,9 @@ static int brcmf_c_download(struct brcmf
- 	return err;
- }
- 
--static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
--{
--	struct brcmf_bus *bus = ifp->drvr->bus_if;
--	u8 fw_name[BRCMF_FW_NAME_LEN];
--	u8 *ptr;
--	size_t len;
--	s32 err;
--
--	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
--	err = brcmf_bus_get_fwname(bus, bus->chip, bus->chiprev, fw_name);
--	if (err) {
--		brcmf_err("get firmware name failed (%d)\n", err);
--		goto done;
--	}
--
--	/* generate CLM blob file name */
--	ptr = strrchr(fw_name, '.');
--	if (!ptr) {
--		err = -ENOENT;
--		goto done;
--	}
--
--	len = ptr - fw_name + 1;
--	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
--		err = -E2BIG;
--	} else {
--		strlcpy(clm_name, fw_name, len);
--		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
--	}
--done:
--	return err;
--}
--
- static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
- {
--	struct device *dev = ifp->drvr->bus_if->dev;
-+	struct brcmf_bus *bus = ifp->drvr->bus_if;
- 	struct brcmf_dload_data_le *chunk_buf;
- 	const struct firmware *clm = NULL;
- 	u8 clm_name[BRCMF_FW_NAME_LEN];
-@@ -177,16 +144,16 @@ static int brcmf_c_process_clm_blob(stru
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
--	err = brcmf_c_get_clm_name(ifp, clm_name);
-+	memset(clm_name, 0, sizeof(clm_name));
-+	err = brcmf_bus_get_fwname(bus, ".clm_blob", clm_name);
- 	if (err) {
- 		brcmf_err("get CLM blob file name failed (%d)\n", err);
- 		return err;
- 	}
- 
--	err = request_firmware(&clm, clm_name, dev);
-+	err = request_firmware(&clm, clm_name, bus->dev);
- 	if (err) {
--		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
-+		brcmf_info("no clm_blob available (err=%d), device may have limited channels available\n",
- 			   err);
- 		return 0;
- 	}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1350,23 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
- 	return 0;
- }
- 
--static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
--				 u8 *fw_name)
-+static
-+int brcmf_pcie_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
--	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
--	int ret = 0;
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ext, fw_name },
-+	};
- 
--	if (devinfo->fw_name[0] != '\0')
--		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
--	else
--		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
--						brcmf_pcie_fwnames,
--						ARRAY_SIZE(brcmf_pcie_fwnames),
--						fw_name, NULL);
-+	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
-+				       brcmf_pcie_fwnames,
-+				       ARRAY_SIZE(brcmf_pcie_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return -ENOMEM;
- 
--	return ret;
-+	kfree(fwreq);
-+	return 0;
- }
- 
- static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4000,22 +4000,24 @@ brcmf_sdio_watchdog(unsigned long data)
- 	}
- }
- 
--static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
--				 u8 *fw_name)
-+static
-+int brcmf_sdio_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
--	int ret = 0;
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ext, fw_name },
-+	};
- 
--	if (sdiodev->fw_name[0] != '\0')
--		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
--	else
--		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
--						brcmf_sdio_fwnames,
--						ARRAY_SIZE(brcmf_sdio_fwnames),
--						fw_name, NULL);
-+	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
-+				       brcmf_sdio_fwnames,
-+				       ARRAY_SIZE(brcmf_sdio_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return -ENOMEM;
- 
--	return ret;
-+	kfree(fwreq);
-+	return 0;
- }
- 
- static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1128,21 +1128,24 @@ static void brcmf_usb_wowl_config(struct
- 		device_set_wakeup_enable(devinfo->dev, false);
- }
- 
--static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
--				u8 *fw_name)
-+static
-+int brcmf_usb_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
- {
--	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
--	int ret = 0;
-+	struct brcmf_bus *bus = dev_get_drvdata(dev);
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ext, fw_name },
-+	};
- 
--	if (devinfo->fw_name[0] != '\0')
--		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
--	else
--		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
--						brcmf_usb_fwnames,
--						ARRAY_SIZE(brcmf_usb_fwnames),
--						fw_name, NULL);
-+	fwreq = brcmf_fw_alloc_request(bus->chip, bus->chiprev,
-+				       brcmf_usb_fwnames,
-+				       ARRAY_SIZE(brcmf_usb_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return -ENOMEM;
- 
--	return ret;
-+	kfree(fwreq);
-+	return 0;
- }
- 
- static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
diff --git a/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch b/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
deleted file mode 100644
index becf7cf3fb..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 18c2b20e276e04476a3350b4a92c1dfad725d45d Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:29 +0100
-Subject: [PATCH] brcmfmac: get rid of brcmf_fw_map_chip_to_name()
-
-The function is no longer used so removing it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 53 ----------------------
- .../broadcom/brcm80211/brcmfmac/firmware.h         |  4 --
- 2 files changed, 57 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -635,59 +635,6 @@ static void brcmf_fw_get_full_name(char
- 	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
- }
- 
--int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
--			      struct brcmf_firmware_mapping mapping_table[],
--			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
--			      char nvram_name[BRCMF_FW_NAME_LEN])
--{
--	char chipname[12];
--	u32 i;
--	char end;
--
--	for (i = 0; i < table_size; i++) {
--		if (mapping_table[i].chipid == chip &&
--		    mapping_table[i].revmask & BIT(chiprev))
--			break;
--	}
--
--	if (i == table_size) {
--		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
--		return -ENODEV;
--	}
--
--	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
--
--	/* check if firmware path is provided by module parameter */
--	if (brcmf_mp_global.firmware_path[0] != '\0') {
--		if (fw_name)
--			strlcpy(fw_name, brcmf_mp_global.firmware_path,
--				BRCMF_FW_NAME_LEN);
--		if (nvram_name)
--			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
--				BRCMF_FW_NAME_LEN);
--
--		end = brcmf_mp_global.firmware_path[
--				strlen(brcmf_mp_global.firmware_path) - 1];
--		if (end != '/') {
--			if (fw_name)
--				strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
--			if (nvram_name)
--				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
--		}
--	}
--
--	brcmf_info("using %s for chip %s\n",
--		   mapping_table[i].fw_base, chipname);
--	if (fw_name)
--		brcmf_fw_get_full_name(fw_name,
--				       mapping_table[i].fw_base, ".bin");
--	if (nvram_name)
--		brcmf_fw_get_full_name(nvram_name,
--				       mapping_table[i].fw_base, ".txt");
--
--	return 0;
--}
--
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
- 		       struct brcmf_firmware_mapping mapping_table[],
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -46,10 +46,6 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw
- #define BRCMF_FW_ENTRY(chipid, mask, name) \
- 	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_BASENAME }
- 
--int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
--			      struct brcmf_firmware_mapping mapping_table[],
--			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
--			      char nvram_name[BRCMF_FW_NAME_LEN]);
- void brcmf_fw_nvram_free(void *nvram);
- 
- enum brcmf_fw_type {
diff --git a/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch b/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
deleted file mode 100644
index d831f44fcd..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From bf291b7247e53f52a4236c0b55a5df046d6177df Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:30 +0100
-Subject: [PATCH] brcmfmac: get rid of brcmf_fw_get_full_name()
-
-The function was pretty minimal and now it is called only from one
-place so just get rid of it.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c    | 14 ++++----------
- 1 file changed, 4 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -628,13 +628,6 @@ int brcmf_fw_get_firmwares(struct device
- 	return 0;
- }
- 
--static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
--				   const char *fw_base, const char *extension)
--{
--	strlcat(fw_name, fw_base, BRCMF_FW_NAME_LEN);
--	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
--}
--
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
- 		       struct brcmf_firmware_mapping mapping_table[],
-@@ -685,9 +678,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
- 					BRCMF_FW_NAME_LEN);
- 			}
- 		}
--		brcmf_fw_get_full_name(fwnames[j].path,
--				       mapping_table[i].fw_base,
--				       fwnames[j].extension);
-+		strlcat(fwnames[j].path, mapping_table[i].fw_base,
-+			BRCMF_FW_NAME_LEN);
-+		strlcat(fwnames[j].path, fwnames[j].extension,
-+			BRCMF_FW_NAME_LEN);
- 		fwreq->items[j].path = fwnames[j].path;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch b/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
deleted file mode 100644
index 1c9c99599f..0000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 48eaee3f272a5bfe6986d07c51f6975d3c2f74d1 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:31 +0100
-Subject: [PATCH] brcmfmac: add kerneldoc for struct brcmf_bus::msgbuf
-
-This field did not have kerneldoc description so adding it now.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -140,6 +140,7 @@ struct brcmf_bus_stats {
-  * @always_use_fws_queue: bus wants use queue also when fwsignal is inactive.
-  * @wowl_supported: is wowl supported by bus driver.
-  * @chiprev: revision of the dongle chip.
-+ * @msgbuf: msgbuf protocol parameters provided by bus layer.
-  */
- struct brcmf_bus {
- 	union {
diff --git a/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch b/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
deleted file mode 100644
index cd2279dd65..0000000000
--- a/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 0b5c0305e57ca940713bcb2b202fd2b412c62f31 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 3 Apr 2018 10:18:15 +0200
-Subject: [PATCH] brcmfmac: fix firmware request processing if nvram load fails
-
-When nvram loading fails a double free occurred. Fix this and reorg the
-code a little.
-
-Fixes: d09ae51a4b67 ("brcmfmac: pass struct in brcmf_fw_get_firmwares()")
-Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 36 ++++++++++++----------
- 1 file changed, 20 insertions(+), 16 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -459,7 +459,7 @@ static void brcmf_fw_free_request(struct
- 	kfree(req);
- }
- 
--static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
-+static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
- {
- 	struct brcmf_fw *fwctx = ctx;
- 	struct brcmf_fw_item *cur;
-@@ -498,13 +498,10 @@ static void brcmf_fw_request_nvram_done(
- 	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
- 	cur->nv_data.data = nvram;
- 	cur->nv_data.len = nvram_length;
--	return;
-+	return 0;
- 
- fail:
--	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
--	fwctx->done(fwctx->dev, -ENOENT, NULL);
--	brcmf_fw_free_request(fwctx->req);
--	kfree(fwctx);
-+	return -ENOENT;
- }
- 
- static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
-@@ -553,20 +550,27 @@ static void brcmf_fw_request_done(const
- 	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
- 		  fw ? "" : "not ");
- 
--	if (fw) {
--		if (cur->type == BRCMF_FW_TYPE_BINARY)
--			cur->binary = fw;
--		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
--			brcmf_fw_request_nvram_done(fw, fwctx);
--		else
--			release_firmware(fw);
--	} else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
--		brcmf_fw_request_nvram_done(NULL, fwctx);
--	} else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
-+	if (!fw)
- 		ret = -ENOENT;
-+
-+	switch (cur->type) {
-+	case BRCMF_FW_TYPE_NVRAM:
-+		ret = brcmf_fw_request_nvram_done(fw, fwctx);
-+		break;
-+	case BRCMF_FW_TYPE_BINARY:
-+		cur->binary = fw;
-+		break;
-+	default:
-+		/* something fishy here so bail out early */
-+		brcmf_err("unknown fw type: %d\n", cur->type);
-+		release_firmware(fw);
-+		ret = -EINVAL;
- 		goto fail;
- 	}
- 
-+	if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
-+		goto fail;
-+
- 	do {
- 		if (++fwctx->curpos == fwctx->req->n_items) {
- 			ret = 0;
diff --git a/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch b/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
deleted file mode 100644
index e31d69826d..0000000000
--- a/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 1f589e2510d5df1192dca7c089103a2cbd028101 Mon Sep 17 00:00:00 2001
-From: Dan Haab <dhaab@luxul.com>
-Date: Tue, 3 Apr 2018 10:21:56 +0200
-Subject: [PATCH] brcmfmac: add support for BCM4366E chipset
-
-BCM4366E is a wireless chipset with a BCM43664 ChipCommon. It's
-supported by the same firmware as 4366c0.
-
-Signed-off-by: Dan Haab <dan.haab@luxul.com>
-[arend: rebase patch and remove unnecessary definition]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c       | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c       | 1 +
- drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
- 3 files changed, 3 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -689,6 +689,7 @@ static u32 brcmf_chip_tcm_rambase(struct
- 	case BRCM_CC_43525_CHIP_ID:
- 	case BRCM_CC_4365_CHIP_ID:
- 	case BRCM_CC_4366_CHIP_ID:
-+	case BRCM_CC_43664_CHIP_ID:
- 		return 0x200000;
- 	case CY_CC_4373_CHIP_ID:
- 		return 0x160000;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -75,6 +75,7 @@ static struct brcmf_firmware_mapping brc
- 	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
- 	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
- 	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
-+	BRCMF_FW_ENTRY(BRCM_CC_43664_CHIP_ID, 0xFFFFFFF0, 4366C),
- 	BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
- };
- 
---- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
-@@ -57,6 +57,7 @@
- #define BRCM_CC_43602_CHIP_ID		43602
- #define BRCM_CC_4365_CHIP_ID		0x4365
- #define BRCM_CC_4366_CHIP_ID		0x4366
-+#define BRCM_CC_43664_CHIP_ID		43664
- #define BRCM_CC_4371_CHIP_ID		0x4371
- #define CY_CC_4373_CHIP_ID		0x4373
- 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch b/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
deleted file mode 100644
index 909000cc59..0000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From cb746e47837ad0f35c8ae28e9aacc8eb07916d2a Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:47 +0200
-Subject: [PATCH] brcmfmac: check p2pdev mac address uniqueness
-
-The mac address for p2pdev must be different from the primary interface
-due to firmware requirement. Add an explicit check for this requirement
-if user-space provides a mac address.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2073,6 +2073,13 @@ static struct wireless_dev *brcmf_p2p_cr
- 	}
- 
- 	pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
-+
-+	/* firmware requires unique mac address for p2pdev interface */
-+	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
-+		brcmf_err("discovery vif must be different from primary interface\n");
-+		return ERR_PTR(-EINVAL);
-+	}
-+
- 	brcmf_p2p_generate_bss_mac(p2p, addr);
- 	brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
- 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch b/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
deleted file mode 100644
index 4f59507cab..0000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 7742fce4c007141617dab9bcb90034b3c0fe2347 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:18:35 +0200
-Subject: [PATCH] brcmfmac: reports boottime_ns while informing bss
-
-Provides a timestamp in bss information so user space can see when the
-bss info was updated. Since tsf is not available from the dongle events
-boottime is reported instead.
-
-Reported-by: Dmitry Shmidt <dimitrysh@google.com>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 26 +++++++++++-----------
- 1 file changed, 13 insertions(+), 13 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2728,7 +2728,6 @@ static s32 brcmf_inform_single_bss(struc
- 				   struct brcmf_bss_info_le *bi)
- {
- 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
--	struct ieee80211_channel *notify_channel;
- 	struct cfg80211_bss *bss;
- 	struct ieee80211_supported_band *band;
- 	struct brcmu_chan ch;
-@@ -2738,7 +2737,7 @@ static s32 brcmf_inform_single_bss(struc
- 	u16 notify_interval;
- 	u8 *notify_ie;
- 	size_t notify_ielen;
--	s32 notify_signal;
-+	struct cfg80211_inform_bss bss_data = { 0 };
- 
- 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
- 		brcmf_err("Bss info is larger than buffer. Discarding\n");
-@@ -2758,27 +2757,28 @@ static s32 brcmf_inform_single_bss(struc
- 		band = wiphy->bands[NL80211_BAND_5GHZ];
- 
- 	freq = ieee80211_channel_to_frequency(channel, band->band);
--	notify_channel = ieee80211_get_channel(wiphy, freq);
-+	bss_data.chan = ieee80211_get_channel(wiphy, freq);
-+	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
-+	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
- 
- 	notify_capability = le16_to_cpu(bi->capability);
- 	notify_interval = le16_to_cpu(bi->beacon_period);
- 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
- 	notify_ielen = le32_to_cpu(bi->ie_length);
--	notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
-+	bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
- 
- 	brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
- 	brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
- 	brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
- 	brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
--	brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
-+	brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
- 
--	bss = cfg80211_inform_bss(wiphy, notify_channel,
--				  CFG80211_BSS_FTYPE_UNKNOWN,
--				  (const u8 *)bi->BSSID,
--				  0, notify_capability,
--				  notify_interval, notify_ie,
--				  notify_ielen, notify_signal,
--				  GFP_KERNEL);
-+	bss = cfg80211_inform_bss_data(wiphy, &bss_data,
-+				       CFG80211_BSS_FTYPE_UNKNOWN,
-+				       (const u8 *)bi->BSSID,
-+				       0, notify_capability,
-+				       notify_interval, notify_ie,
-+				       notify_ielen, GFP_KERNEL);
- 
- 	if (!bss)
- 		return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch b/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
deleted file mode 100644
index 2d60c0d9ee..0000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From aed14219067ab96e5eeb7730e9bceed10d9be989 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:48 +0200
-Subject: [PATCH] brcmfmac: use nl80211_band directly to get ieee80211 channel
-
-The enum nl80211_band used to retrieve wiphy->bands is the same as
-wiphy->bands->band which is checked by wiphy_register(). So it can be used
-directly as parameter of ieee80211_channel_to_frequency().
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2729,7 +2729,7 @@ static s32 brcmf_inform_single_bss(struc
- {
- 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
- 	struct cfg80211_bss *bss;
--	struct ieee80211_supported_band *band;
-+	enum nl80211_band band;
- 	struct brcmu_chan ch;
- 	u16 channel;
- 	u32 freq;
-@@ -2752,11 +2752,11 @@ static s32 brcmf_inform_single_bss(struc
- 	channel = bi->ctl_ch;
- 
- 	if (channel <= CH_MAX_2G_CHANNEL)
--		band = wiphy->bands[NL80211_BAND_2GHZ];
-+		band = NL80211_BAND_2GHZ;
- 	else
--		band = wiphy->bands[NL80211_BAND_5GHZ];
-+		band = NL80211_BAND_5GHZ;
- 
--	freq = ieee80211_channel_to_frequency(channel, band->band);
-+	freq = ieee80211_channel_to_frequency(channel, band);
- 	bss_data.chan = ieee80211_get_channel(wiphy, freq);
- 	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
- 	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
diff --git a/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch b/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
deleted file mode 100644
index df2648374a..0000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From ff68c9f9c06d1fd437c8f90fc05ca28c47f7d85e Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:49 +0200
-Subject: [PATCH] brcmfmac: constify firmware mapping tables
-
-The information in the firmware mapping does not need to be modified
-so it can be static const.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c     | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c     | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c      | 2 +-
- 5 files changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -634,7 +634,7 @@ int brcmf_fw_get_firmwares(struct device
- 
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
--		       struct brcmf_firmware_mapping mapping_table[],
-+		       const struct brcmf_firmware_mapping mapping_table[],
- 		       u32 table_size, struct brcmf_fw_name *fwnames,
- 		       u32 n_fwnames)
- {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -80,7 +80,7 @@ struct brcmf_fw_name {
- 
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
--		       struct brcmf_firmware_mapping mapping_table[],
-+		       const struct brcmf_firmware_mapping mapping_table[],
- 		       u32 table_size, struct brcmf_fw_name *fwnames,
- 		       u32 n_fwnames);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -59,7 +59,7 @@ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"
- BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
- BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
- 
--static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
-+static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
- 	BRCMF_FW_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
- 	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -619,7 +619,7 @@ BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
- BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
- BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
- 
--static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
-+static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
- 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
- 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -52,7 +52,7 @@ BRCMF_FW_DEF(43242A, "brcmfmac43242a");
- BRCMF_FW_DEF(43569, "brcmfmac43569");
- BRCMF_FW_DEF(4373, "brcmfmac4373");
- 
--static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
-+static const struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
- 	BRCMF_FW_ENTRY(BRCM_CC_43235_CHIP_ID, 0x00000008, 43236B),
- 	BRCMF_FW_ENTRY(BRCM_CC_43236_CHIP_ID, 0x00000008, 43236B),
diff --git a/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch b/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
deleted file mode 100644
index e3d4441f7f..0000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 84ad327d18debe19b8d509059b61db445d048b02 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:50 +0200
-Subject: [PATCH] brcmfmac: add hostready indication
-
-A hostready signal is introduced to inform firmware through mailbox
-doorbell1 when common ring initialized or D3 exited.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -105,7 +105,8 @@ static const struct brcmf_firmware_mappi
- #define BRCMF_PCIE_PCIE2REG_MAILBOXMASK		0x4C
- #define BRCMF_PCIE_PCIE2REG_CONFIGADDR		0x120
- #define BRCMF_PCIE_PCIE2REG_CONFIGDATA		0x124
--#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX		0x140
-+#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_0	0x140
-+#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_1	0x144
- 
- #define BRCMF_PCIE2_INTA			0x01
- #define BRCMF_PCIE2_INTB			0x02
-@@ -140,6 +141,7 @@ static const struct brcmf_firmware_mappi
- #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
- #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
- #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
-+#define BRCMF_PCIE_SHARED_HOSTRDY_DB1		0x10000000
- 
- #define BRCMF_PCIE_FLAGS_HTOD_SPLIT		0x4000
- #define BRCMF_PCIE_FLAGS_DTOH_SPLIT		0x8000
-@@ -782,6 +784,12 @@ static void brcmf_pcie_intr_enable(struc
- 			       BRCMF_PCIE_MB_INT_FN0_1);
- }
- 
-+static void brcmf_pcie_hostready(struct brcmf_pciedev_info *devinfo)
-+{
-+	if (devinfo->shared.flags & BRCMF_PCIE_SHARED_HOSTRDY_DB1)
-+		brcmf_pcie_write_reg32(devinfo,
-+				       BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_1, 1);
-+}
- 
- static irqreturn_t brcmf_pcie_quick_check_isr(int irq, void *arg)
- {
-@@ -924,7 +932,7 @@ static int brcmf_pcie_ring_mb_ring_bell(
- 
- 	brcmf_dbg(PCIE, "RING !\n");
- 	/* Any arbitrary value will do, lets use 1 */
--	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
-+	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_0, 1);
- 
- 	return 0;
- }
-@@ -1728,6 +1736,7 @@ static void brcmf_pcie_setup(struct devi
- 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
- 
- 	brcmf_pcie_intr_enable(devinfo);
-+	brcmf_pcie_hostready(devinfo);
- 	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
- 		return;
- 
-@@ -1950,6 +1959,7 @@ static int brcmf_pcie_pm_leave_D3(struct
- 		brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
- 		brcmf_bus_change_state(bus, BRCMF_BUS_UP);
- 		brcmf_pcie_intr_enable(devinfo);
-+		brcmf_pcie_hostready(devinfo);
- 		return 0;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch b/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
deleted file mode 100644
index 8750037d85..0000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From f56324baf329bc9362a52ad77a4a1a0f3356d1bc Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:51 +0200
-Subject: [PATCH] brcmfmac: coarse support for PCIe shared structure rev7
-
-Revision 7 of PCIe dongle interface increases the item size of tx and rx
-complete rings to accommodate extra payload for new feature. This patch
-simply bump up the size of these two rings without adding the support
-for utilizing the new space. This makes brcmfmac compatible with rev7
-firmware.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h  |  6 ++++--
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 23 ++++++++++++++++++----
- 2 files changed, 23 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-@@ -27,8 +27,10 @@
- #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE	40
- #define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE	32
- #define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE	24
--#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE		16
--#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		32
-+#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7	16
-+#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE		24
-+#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7	32
-+#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		40
- #define BRCMF_H2D_TXFLOWRING_ITEMSIZE			48
- 
- struct msgbuf_buf_addr {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -136,8 +136,9 @@ static const struct brcmf_firmware_mappi
- 						 BRCMF_PCIE_MB_INT_D2H3_DB0 | \
- 						 BRCMF_PCIE_MB_INT_D2H3_DB1)
- 
-+#define BRCMF_PCIE_SHARED_VERSION_7		7
- #define BRCMF_PCIE_MIN_SHARED_VERSION		5
--#define BRCMF_PCIE_MAX_SHARED_VERSION		6
-+#define BRCMF_PCIE_MAX_SHARED_VERSION		BRCMF_PCIE_SHARED_VERSION_7
- #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
- #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
- #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
-@@ -318,6 +319,14 @@ static const u32 brcmf_ring_max_item[BRC
- 	BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM
- };
- 
-+static const u32 brcmf_ring_itemsize_pre_v7[BRCMF_NROF_COMMON_MSGRINGS] = {
-+	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
-+	BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
-+	BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE,
-+	BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7,
-+	BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7
-+};
-+
- static const u32 brcmf_ring_itemsize[BRCMF_NROF_COMMON_MSGRINGS] = {
- 	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
- 	BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
-@@ -1007,8 +1016,14 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
- 	struct brcmf_pcie_ringbuf *ring;
- 	u32 size;
- 	u32 addr;
-+	const u32 *ring_itemsize_array;
-+
-+	if (devinfo->shared.version < BRCMF_PCIE_SHARED_VERSION_7)
-+		ring_itemsize_array = brcmf_ring_itemsize_pre_v7;
-+	else
-+		ring_itemsize_array = brcmf_ring_itemsize;
- 
--	size = brcmf_ring_max_item[ring_id] * brcmf_ring_itemsize[ring_id];
-+	size = brcmf_ring_max_item[ring_id] * ring_itemsize_array[ring_id];
- 	dma_buf = brcmf_pcie_init_dmabuffer_for_device(devinfo, size,
- 			tcm_ring_phys_addr + BRCMF_RING_MEM_BASE_ADDR_OFFSET,
- 			&dma_handle);
-@@ -1018,7 +1033,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
- 	addr = tcm_ring_phys_addr + BRCMF_RING_MAX_ITEM_OFFSET;
- 	brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_max_item[ring_id]);
- 	addr = tcm_ring_phys_addr + BRCMF_RING_LEN_ITEMS_OFFSET;
--	brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_itemsize[ring_id]);
-+	brcmf_pcie_write_tcm16(devinfo, addr, ring_itemsize_array[ring_id]);
- 
- 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
- 	if (!ring) {
-@@ -1027,7 +1042,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
- 		return NULL;
- 	}
- 	brcmf_commonring_config(&ring->commonring, brcmf_ring_max_item[ring_id],
--				brcmf_ring_itemsize[ring_id], dma_buf);
-+				ring_itemsize_array[ring_id], dma_buf);
- 	ring->dma_handle = dma_handle;
- 	ring->devinfo = devinfo;
- 	brcmf_commonring_register_cb(&ring->commonring,
diff --git a/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch b/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
deleted file mode 100644
index 13f169be9f..0000000000
--- a/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 9c4a121e82634aa000a702c98cd6f05b27d6e186 Mon Sep 17 00:00:00 2001
-From: Sean Lanigan <sean@lano.id.au>
-Date: Fri, 4 May 2018 16:48:23 +1000
-Subject: [PATCH] brcmfmac: Add support for bcm43364 wireless chipset
-
-Add support for the BCM43364 chipset via an SDIO interface, as used in
-e.g. the Murata 1FX module.
-
-The BCM43364 uses the same firmware as the BCM43430 (which is already
-included), the only difference is the omission of Bluetooth.
-
-However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS
-of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't
-load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place
-triggers the brcmfmac driver to load, and then correctly use the
-firmware file 'brcmfmac43430-sdio.bin'.
-
-Signed-off-by: Sean Lanigan <sean@lano.id.au>
-Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
- include/linux/mmc/sdio_ids.h                              | 1 +
- 2 files changed, 2 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -963,6 +963,7 @@ static const struct sdio_device_id brcmf
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
-+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
---- a/include/linux/mmc/sdio_ids.h
-+++ b/include/linux/mmc/sdio_ids.h
-@@ -34,6 +34,7 @@
- #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
- #define SDIO_DEVICE_ID_BROADCOM_4339		0x4339
- #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
-+#define SDIO_DEVICE_ID_BROADCOM_43364		0xa9a4
- #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
- #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
- #define SDIO_DEVICE_ID_BROADCOM_43455		0xa9bf
diff --git a/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch b/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
deleted file mode 100644
index de41e1c453..0000000000
--- a/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 1204aa17f3b4f63e67ac9b7c9afa9496485969c5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 10 May 2018 15:21:39 +0200
-Subject: [PATCH] brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-brcmfmac is a FullMAC driver and it implements/uses cfg80211 interface
-for stations management. At the same time it doesn't receive or pass up
-management frames.
-
-This flag indicates that authenticator doesn't have to subscribe to or
-handle management frames. Some authenticators (e.g. hostapd) were
-working with brcmfmac thanks to some extra assumptions. This commit
-clears up the situation.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6513,6 +6513,7 @@ static int brcmf_setup_wiphy(struct wiph
- 
- 	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
- 			WIPHY_FLAG_PS_ON_BY_DEFAULT |
-+			WIPHY_FLAG_HAVE_AP_SME |
- 			WIPHY_FLAG_OFFCHAN_TX |
- 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
- 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
diff --git a/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch b/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
deleted file mode 100644
index 2436bb8a8a..0000000000
--- a/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 763ece85f45a6b93268e25a0abf02922f911dab4 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Tue, 15 May 2018 11:14:44 +0200
-Subject: [PATCH] brcmfmac: fix initialization of struct cfg80211_inform_bss
- variable
-
-This patch fixes a sparse warning "Using plain integer as NULL pointer"
-about cfg80211_inform_bss structure initialization.
-
-Reported-by: kbuild test robot <lkp@intel.com>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2737,7 +2737,7 @@ static s32 brcmf_inform_single_bss(struc
- 	u16 notify_interval;
- 	u8 *notify_ie;
- 	size_t notify_ielen;
--	struct cfg80211_inform_bss bss_data = { 0 };
-+	struct cfg80211_inform_bss bss_data = {};
- 
- 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
- 		brcmf_err("Bss info is larger than buffer. Discarding\n");
diff --git a/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch b/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
deleted file mode 100644
index f350d1e819..0000000000
--- a/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 88001968245c42c26416476bf0ef960442371605 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 14 May 2018 08:48:20 +0200
-Subject: [PATCH] brcmfmac: add debugfs entry for reading firmware capabilities
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows reading all capabilities as reported by a firmware. They are
-printed using native (raw) names, just like developers like it the most.
-It's how firmware reports support for various features, e.g. supported
-modes, supported standards, power saving details, max BSS-es.
-
-Access to all that info is useful for trying new firmwares, comparing
-them and debugging features AKA bugs.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 36 ++++++++++++++++++++++
- 1 file changed, 36 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -165,6 +165,41 @@ static void brcmf_feat_firmware_capabili
- 	}
- }
- 
-+/**
-+ * brcmf_feat_fwcap_debugfs_read() - expose firmware capabilities to debugfs.
-+ *
-+ * @seq: sequence for debugfs entry.
-+ * @data: raw data pointer.
-+ */
-+static int brcmf_feat_fwcap_debugfs_read(struct seq_file *seq, void *data)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
-+	struct brcmf_if *ifp = brcmf_get_ifp(bus_if->drvr, 0);
-+	char caps[MAX_CAPS_BUFFER_SIZE + 1] = { };
-+	char *tmp;
-+	int err;
-+
-+	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
-+	if (err) {
-+		brcmf_err("could not get firmware cap (%d)\n", err);
-+		return err;
-+	}
-+
-+	/* Put every capability in a new line */
-+	for (tmp = caps; *tmp; tmp++) {
-+		if (*tmp == ' ')
-+			*tmp = '\n';
-+	}
-+
-+	/* Usually there is a space at the end of capabilities string */
-+	seq_printf(seq, "%s", caps);
-+	/* So make sure we don't print two line breaks */
-+	if (tmp > caps && *(tmp - 1) != '\n')
-+		seq_printf(seq, "\n");
-+
-+	return 0;
-+}
-+
- void brcmf_feat_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
-@@ -233,6 +268,7 @@ void brcmf_feat_attach(struct brcmf_pub
- void brcmf_feat_debugfs_create(struct brcmf_pub *drvr)
- {
- 	brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
-+	brcmf_debugfs_add_entry(drvr, "fwcap", brcmf_feat_fwcap_debugfs_read);
- }
- 
- bool brcmf_feat_is_enabled(struct brcmf_if *ifp, enum brcmf_feat_id id)
diff --git a/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch b/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
deleted file mode 100644
index f353a60b87..0000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From f8793c26fe586659d6da3fa277e63961a69d314b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 16 May 2018 14:11:58 +0200
-Subject: [PATCH] brcmfmac: move ALLFFMAC variable in flowring module
-
-The only user of ALLFFMAC is the flowring module so no need to
-expose it in a header file.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c   | 2 --
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h   | 2 --
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 2 ++
- 3 files changed, 2 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -36,8 +36,6 @@ MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
- MODULE_LICENSE("Dual BSD/GPL");
- 
--const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
--
- #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME	40
- #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME	40
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -19,8 +19,6 @@
- #include <linux/platform_data/brcmfmac.h>
- #include "fwil_types.h"
- 
--extern const u8 ALLFFMAC[ETH_ALEN];
--
- #define BRCMF_FW_ALTPATH_LEN			256
- 
- /* Definitions for the module global and device specific settings are defined
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -46,6 +46,8 @@ static const u8 brcmf_flowring_prio2fifo
- 	3
- };
- 
-+static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-+
- 
- static bool
- brcmf_flowring_is_tdls_mac(struct brcmf_flowring *flow, u8 mac[ETH_ALEN])
diff --git a/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch b/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
deleted file mode 100644
index 86533b95b6..0000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 8e072168f75ebce85b96cbcefea2b10ddbd5913f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 16 May 2018 14:11:59 +0200
-Subject: [PATCH] brcmfmac: add support for sysfs initiated coredump
-
-The driver already supports device coredump initiated by firmware
-event. Since commit 3c47d19ff4dc ("drivers: base: add coredump driver
-ops") it is also possible to initiate it from user-space through
-sysfs. This patch adds support for SDIO and PCIe devices.
-
-[rafal@milecki.pl: use LINUX_VERSION_CODE]
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h    | 2 ++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 8 ++++++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c   | 1 +
- 4 files changed, 12 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -1165,6 +1165,9 @@ static struct sdio_driver brcmf_sdmmc_dr
- #ifdef CONFIG_PM_SLEEP
- 		.pm = &brcmf_sdio_pm_ops,
- #endif	/* CONFIG_PM_SLEEP */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
-+		.coredump = brcmf_dev_coredump,
-+#endif
- 	},
- };
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -250,6 +250,8 @@ int brcmf_attach(struct device *dev, str
- void brcmf_detach(struct device *dev);
- /* Indication from bus module that dongle should be reset */
- void brcmf_dev_reset(struct device *dev);
-+/* Request from bus module to initiate a coredump */
-+void brcmf_dev_coredump(struct device *dev);
- 
- /* Configure the "global" bus state used by upper layers */
- void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1201,6 +1201,14 @@ void brcmf_dev_reset(struct device *dev)
- 		brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
- }
- 
-+void brcmf_dev_coredump(struct device *dev)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+
-+	if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0)
-+		brcmf_dbg(TRACE, "failed to create coredump\n");
-+}
-+
- void brcmf_detach(struct device *dev)
- {
- 	s32 i;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -2044,6 +2044,9 @@ static struct pci_driver brcmf_pciedrvr
- #ifdef CONFIG_PM
- 	.driver.pm = &brcmf_pciedrvr_pm,
- #endif
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
-+	.driver.coredump = brcmf_dev_coredump,
-+#endif
- };
- 
- 
diff --git a/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch b/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
deleted file mode 100644
index 455009ef1d..0000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From d2af9b566554e01f9ad67b330ce569dbc130e5d3 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 16 May 2018 14:12:01 +0200
-Subject: [PATCH] brcmfmac: validate user provided data for memdump before
- copying
-
-In patch "brcmfmac: add support for sysfs initiated coredump", a new
-scenario of brcmf_debug_create_memdump was added in which the user of
-the function might not necessarily provide prefix data. Hence the
-function should not assume the data is always valid and should perform a
-check before copying.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-@@ -40,7 +40,8 @@ int brcmf_debug_create_memdump(struct br
- 	if (!dump)
- 		return -ENOMEM;
- 
--	memcpy(dump, data, len);
-+	if (data && len > 0)
-+		memcpy(dump, data, len);
- 	err = brcmf_bus_get_memdump(bus, dump + len, ramsize);
- 	if (err) {
- 		vfree(dump);
diff --git a/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch b/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
deleted file mode 100644
index b94e06fa44..0000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8a3ab2f38f1669e3be6433a1f6b82a077b38c4c7 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 16 May 2018 14:12:02 +0200
-Subject: [PATCH] brcmfmac: trigger memory dump upon firmware halt signal
-
-PCIe dongle firmware signals a halt/trap through mailbox interrupt.
-Trigger a memory dump upon receiving such signal could help to provide
-useful information for issue debug.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -182,6 +182,7 @@ static const struct brcmf_firmware_mappi
- #define BRCMF_D2H_DEV_D3_ACK			0x00000001
- #define BRCMF_D2H_DEV_DS_ENTER_REQ		0x00000002
- #define BRCMF_D2H_DEV_DS_EXIT_NOTE		0x00000004
-+#define BRCMF_D2H_DEV_FWHALT			0x10000000
- 
- #define BRCMF_H2D_HOST_D3_INFORM		0x00000001
- #define BRCMF_H2D_HOST_DS_ACK			0x00000002
-@@ -717,6 +718,10 @@ static void brcmf_pcie_handle_mb_data(st
- 		devinfo->mbdata_completed = true;
- 		wake_up(&devinfo->mbdata_resp_wait);
- 	}
-+	if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) {
-+		brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n");
-+		brcmf_dev_coredump(&devinfo->pdev->dev);
-+	}
- }
- 
- 
diff --git a/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch b/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
deleted file mode 100644
index 045e20acfb..0000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From b8248236e92790ac635caeb4156e46ea2417e037 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 16 May 2018 14:12:03 +0200
-Subject: [PATCH] brcmfmac: trigger memory dump on SDIO firmware halt message
-
-Attempt to dump dongle memory for debug upon receiving firmware halt
-message through dongle to host mail box interrupt.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1072,8 +1072,10 @@ static u32 brcmf_sdio_hostmail(struct br
- 	bus->sdcnt.f1regdata += 2;
- 
- 	/* dongle indicates the firmware has halted/crashed */
--	if (hmb_data & HMB_DATA_FWHALT)
-+	if (hmb_data & HMB_DATA_FWHALT) {
- 		brcmf_err("mailbox indicates firmware halted\n");
-+		brcmf_dev_coredump(&sdiod->func1->dev);
-+	}
- 
- 	/* Dongle recomposed rx frames, accept them again */
- 	if (hmb_data & HMB_DATA_NAKHANDLED) {
diff --git a/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch b/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
deleted file mode 100644
index a478b675cc..0000000000
--- a/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 373c83a801f15b1e3d02d855fad89112bd4ccbe0 Mon Sep 17 00:00:00 2001
-From: Michael Trimarchi <michael@amarulasolutions.com>
-Date: Wed, 30 May 2018 11:06:34 +0200
-Subject: [PATCH] brcmfmac: stop watchdog before detach and free everything
-
-Using built-in in kernel image without a firmware in filesystem
-or in the kernel image can lead to a kernel NULL pointer deference.
-Watchdog need to be stopped in brcmf_sdio_remove
-
-The system is going down NOW!
-[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
-Sent SIGTERM to all processes
-[ 1348.121412] Mem abort info:
-[ 1348.126962]   ESR = 0x96000004
-[ 1348.130023]   Exception class = DABT (current EL), IL = 32 bits
-[ 1348.135948]   SET = 0, FnV = 0
-[ 1348.138997]   EA = 0, S1PTW = 0
-[ 1348.142154] Data abort info:
-[ 1348.145045]   ISV = 0, ISS = 0x00000004
-[ 1348.148884]   CM = 0, WnR = 0
-[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
-[ 1348.158475] [00000000000002f8] pgd=0000000000000000
-[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
-[ 1348.168927] Modules linked in: ipv6
-[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
-[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
-[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
-[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
-[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
-[ 1348.200253] sp : ffff00000b85be30
-[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
-[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
-[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
-[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
-[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
-[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
-[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
-[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
-[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
-[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
-[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
-[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
-[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
-[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
-[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
-
-Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4297,6 +4297,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 	brcmf_dbg(TRACE, "Enter\n");
- 
- 	if (bus) {
-+		/* Stop watchdog task */
-+		if (bus->watchdog_tsk) {
-+			send_sig(SIGTERM, bus->watchdog_tsk, 1);
-+			kthread_stop(bus->watchdog_tsk);
-+			bus->watchdog_tsk = NULL;
-+		}
-+
- 		/* De-register interrupt handler */
- 		brcmf_sdiod_intr_unregister(bus->sdiodev);
- 
diff --git a/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch b/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
deleted file mode 100644
index 2e265a2f37..0000000000
--- a/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 299b6365a3b7cf7f5ea1c945a420e9ee4841d6f7 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 22 Jul 2018 23:46:25 +0200
-Subject: [PATCH] brcmfmac: fix regression in parsing NVRAM for multiple
- devices
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-NVRAM is designed to work with Broadcom's SDK Linux kernel which fakes
-PCI domain 0 for all internal MMIO devices. Since official Linux kernel
-uses platform devices for that purpose there is a mismatch in numbering
-PCI domains.
-
-There used to be a fix for that problem but it was accidentally dropped
-during the last firmware loading rework. That resulted in brcmfmac not
-being able to extract device specific NVRAM content and all kind of
-calibration problems.
-
-Reported-by: Aditya Xavier <adityaxavier@gmail.com>
-Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function")
-Cc: stable@vger.kernel.org # v4.17+
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brc
- 	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
- 	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
- 	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
--	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
-+	/* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
-+	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
- 	fwreq->bus_nr = devinfo->pdev->bus->number;
- 
- 	return fwreq;
diff --git a/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch b/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
deleted file mode 100644
index b0eec163f1..0000000000
--- a/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 01f69dfafdbe7deff58b58053bc3a4a75c6a570c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 24 Jun 2018 21:44:35 +0200
-Subject: [PATCH] brcmfmac: detect firmware support for monitor interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Many/most of firmwares support creating monitor interface but only the
-most recent ones explicitly /announce/ it using a "monitor" entry in the
-list of capabilities.
-
-Check for that entry and store internally info about monitor mode
-support using a new feature flag. Once we sort out all details of
-handling monitor interface it will be used when reporting available
-interfaces to the cfg80211.
-
-Later some fallback detecion method may be added for older firmwares.
-For now just stick to the "monitor" capability which should be 100%
-reliable.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h | 4 +++-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -48,6 +48,7 @@ static const struct brcmf_feat_fwcap brc
- 	{ BRCMF_FEAT_MBSS, "mbss" },
- 	{ BRCMF_FEAT_MCHAN, "mchan" },
- 	{ BRCMF_FEAT_P2P, "p2p" },
-+	{ BRCMF_FEAT_MONITOR, "monitor" },
- };
- 
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -33,6 +33,7 @@
-  * MFP: 802.11w Management Frame Protection.
-  * GSCAN: enhanced scan offload feature.
-  * FWSUP: Firmware supplicant.
-+ * MONITOR: firmware can pass monitor packets to host.
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -48,7 +49,8 @@
- 	BRCMF_FEAT_DEF(WOWL_ARP_ND) \
- 	BRCMF_FEAT_DEF(MFP) \
- 	BRCMF_FEAT_DEF(GSCAN) \
--	BRCMF_FEAT_DEF(FWSUP)
-+	BRCMF_FEAT_DEF(FWSUP) \
-+	BRCMF_FEAT_DEF(MONITOR)
- 
- /*
-  * Quirks:
diff --git a/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch b/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
deleted file mode 100644
index e733468bc3..0000000000
--- a/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From e63410ac65e0ead2040bbd3927c116889edf87e4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 24 Jun 2018 21:44:36 +0200
-Subject: [PATCH] brcmfmac: detect firmware support for radiotap monitor frames
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Depending on used build-time options some firmwares may already include
-radiotap header in passed monitor frames. Add a new feature flag to
-store info about it. It's needed for proper handling of received frames
-before passing them up.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h | 4 +++-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -49,6 +49,7 @@ static const struct brcmf_feat_fwcap brc
- 	{ BRCMF_FEAT_MCHAN, "mchan" },
- 	{ BRCMF_FEAT_P2P, "p2p" },
- 	{ BRCMF_FEAT_MONITOR, "monitor" },
-+	{ BRCMF_FEAT_MONITOR_FMT_RADIOTAP, "rtap" },
- };
- 
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -34,6 +34,7 @@
-  * GSCAN: enhanced scan offload feature.
-  * FWSUP: Firmware supplicant.
-  * MONITOR: firmware can pass monitor packets to host.
-+ * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -50,7 +51,8 @@
- 	BRCMF_FEAT_DEF(MFP) \
- 	BRCMF_FEAT_DEF(GSCAN) \
- 	BRCMF_FEAT_DEF(FWSUP) \
--	BRCMF_FEAT_DEF(MONITOR)
-+	BRCMF_FEAT_DEF(MONITOR) \
-+	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP)
- 
- /*
-  * Quirks:
diff --git a/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch b/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
deleted file mode 100644
index d640bcfecc..0000000000
--- a/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From a8d7631858aff156b72f807ee7cc062048e63836 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 24 Jun 2018 21:44:37 +0200
-Subject: [PATCH] brcmfmac: handle msgbuf packets marked with monitor mode flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-New Broadcom firmwares mark monitor mode packets using a newly defined
-bit in the flags field. Use it to filter them out and pass to the
-monitor interface. These defines were found in bcmmsgbuf.h from SDK.
-
-As not every firmware generates radiotap header this commit introduces
-BRCMF_FEAT_MONITOR_FMT_RADIOTAP flag. It has to be has based on firmware
-capabilities. If not present brcmf_netif_mon_rx() will assume packet is
-a raw 802.11 frame and will prepend it with an empty radiotap header.
-
-This new code is limited to the msgbuf protocol at this point. Adding
-support for SDIO/USB devices will require some extra work (possibly a
-new firmware release).
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 25 ++++++++++++++++++++++
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  | 18 ++++++++++++++++
- 3 files changed, 45 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -21,6 +21,7 @@
- #include <net/cfg80211.h>
- #include <net/rtnetlink.h>
- #include <net/addrconf.h>
-+#include <net/ieee80211_radiotap.h>
- #include <net/ipv6.h>
- #include <brcmu_utils.h>
- #include <brcmu_wifi.h>
-@@ -404,6 +405,30 @@ void brcmf_netif_rx(struct brcmf_if *ifp
- 		netif_rx_ni(skb);
- }
- 
-+void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb)
-+{
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
-+		/* Do nothing */
-+	} else {
-+		struct ieee80211_radiotap_header *radiotap;
-+
-+		/* TODO: use RX status to fill some radiotap data */
-+		radiotap = skb_push(skb, sizeof(*radiotap));
-+		memset(radiotap, 0, sizeof(*radiotap));
-+		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
-+
-+		/* TODO: 4 bytes with receive status? */
-+		skb->len -= 4;
-+	}
-+
-+	skb->dev = ifp->ndev;
-+	skb_reset_mac_header(skb);
-+	skb->pkt_type = PACKET_OTHERHOST;
-+	skb->protocol = htons(ETH_P_802_2);
-+
-+	brcmf_netif_rx(ifp, skb);
-+}
-+
- static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
- 			    struct brcmf_if **ifp)
- {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -121,6 +121,7 @@ struct brcmf_pub {
- 
- 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
- 	s32 if2bss[BRCMF_MAX_IFS];
-+	struct brcmf_if *mon_if;
- 
- 	struct mutex proto_block;
- 	unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
-@@ -216,6 +217,7 @@ void brcmf_txflowblock_if(struct brcmf_i
- 			  enum brcmf_netif_stop_reason reason, bool state);
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
-+void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb);
- void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
- int __init brcmf_core_init(void);
- void __exit brcmf_core_exit(void);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -69,6 +69,8 @@
- #define BRCMF_MSGBUF_MAX_EVENTBUF_POST		8
- 
- #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3	0x01
-+#define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11	0x02
-+#define BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK	0x07
- #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT	5
- 
- #define BRCMF_MSGBUF_TX_FLUSH_CNT1		32
-@@ -1128,6 +1130,7 @@ brcmf_msgbuf_process_rx_complete(struct
- 	struct sk_buff *skb;
- 	u16 data_offset;
- 	u16 buflen;
-+	u16 flags;
- 	u32 idx;
- 	struct brcmf_if *ifp;
- 
-@@ -1137,6 +1140,7 @@ brcmf_msgbuf_process_rx_complete(struct
- 	data_offset = le16_to_cpu(rx_complete->data_offset);
- 	buflen = le16_to_cpu(rx_complete->data_len);
- 	idx = le32_to_cpu(rx_complete->msg.request_id);
-+	flags = le16_to_cpu(rx_complete->flags);
- 
- 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
- 				     msgbuf->rx_pktids, idx);
-@@ -1150,6 +1154,20 @@ brcmf_msgbuf_process_rx_complete(struct
- 
- 	skb_trim(skb, buflen);
- 
-+	if ((flags & BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK) ==
-+	    BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11) {
-+		ifp = msgbuf->drvr->mon_if;
-+
-+		if (!ifp) {
-+			brcmf_err("Received unexpected monitor pkt\n");
-+			brcmu_pkt_buf_free_skb(skb);
-+			return;
-+		}
-+
-+		brcmf_netif_mon_rx(ifp, skb);
-+		return;
-+	}
-+
- 	ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
- 	if (!ifp || !ifp->ndev) {
- 		brcmf_err("Received pkt for invalid ifidx %d\n",
diff --git a/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch b/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
deleted file mode 100644
index 050370de46..0000000000
--- a/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 4b4a8d808c58fc0defc32a26b2fea35d66692c45 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 28 Jun 2018 08:16:13 +0200
-Subject: [PATCH] brcmfmac: define more bits for the flags of struct
- brcmf_sta_info_le
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-That struct is passed by a firmware when querying for STA info. Flags
-are used to indicate what info could be obtained.
-
-These new defines may allow passing more info to the cfg80211 in the
-future. They had been obtained from Broadcom's SDK file wlioctl_defs.h
-used by DD-WRT.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 29 ++++++++++++++++++----
- 1 file changed, 24 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -32,11 +32,30 @@
- #define	BRCMF_BSS_INFO_VERSION	109 /* curr ver of brcmf_bss_info_le struct */
- #define BRCMF_BSS_RSSI_ON_CHANNEL	0x0002
- 
--#define BRCMF_STA_WME              0x00000002      /* WMM association */
--#define BRCMF_STA_AUTHE            0x00000008      /* Authenticated */
--#define BRCMF_STA_ASSOC            0x00000010      /* Associated */
--#define BRCMF_STA_AUTHO            0x00000020      /* Authorized */
--#define BRCMF_STA_SCBSTATS         0x00004000      /* Per STA debug stats */
-+#define BRCMF_STA_BRCM			0x00000001	/* Running a Broadcom driver */
-+#define BRCMF_STA_WME			0x00000002	/* WMM association */
-+#define BRCMF_STA_NONERP		0x00000004	/* No ERP */
-+#define BRCMF_STA_AUTHE			0x00000008	/* Authenticated */
-+#define BRCMF_STA_ASSOC			0x00000010	/* Associated */
-+#define BRCMF_STA_AUTHO			0x00000020	/* Authorized */
-+#define BRCMF_STA_WDS			0x00000040	/* Wireless Distribution System */
-+#define BRCMF_STA_WDS_LINKUP		0x00000080	/* WDS traffic/probes flowing properly */
-+#define BRCMF_STA_PS			0x00000100	/* STA is in power save mode from AP's viewpoint */
-+#define BRCMF_STA_APSD_BE		0x00000200	/* APSD delv/trigger for AC_BE is default enabled */
-+#define BRCMF_STA_APSD_BK		0x00000400	/* APSD delv/trigger for AC_BK is default enabled */
-+#define BRCMF_STA_APSD_VI		0x00000800	/* APSD delv/trigger for AC_VI is default enabled */
-+#define BRCMF_STA_APSD_VO		0x00001000	/* APSD delv/trigger for AC_VO is default enabled */
-+#define BRCMF_STA_N_CAP			0x00002000	/* STA 802.11n capable */
-+#define BRCMF_STA_SCBSTATS		0x00004000	/* Per STA debug stats */
-+#define BRCMF_STA_AMPDU_CAP		0x00008000	/* STA AMPDU capable */
-+#define BRCMF_STA_AMSDU_CAP		0x00010000	/* STA AMSDU capable */
-+#define BRCMF_STA_MIMO_PS		0x00020000	/* mimo ps mode is enabled */
-+#define BRCMF_STA_MIMO_RTS		0x00040000	/* send rts in mimo ps mode */
-+#define BRCMF_STA_RIFS_CAP		0x00080000	/* rifs enabled */
-+#define BRCMF_STA_VHT_CAP		0x00100000	/* STA VHT(11ac) capable */
-+#define BRCMF_STA_WPS			0x00200000	/* WPS state */
-+#define BRCMF_STA_DWDS_CAP		0x01000000	/* DWDS CAP */
-+#define BRCMF_STA_DWDS			0x02000000	/* DWDS active */
- 
- /* size of brcmf_scan_params not including variable length array */
- #define BRCMF_SCAN_PARAMS_FIXED_SIZE	64
diff --git a/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch b/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
deleted file mode 100644
index e0fd8d9ea5..0000000000
--- a/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 07b1ae46874949252625c96f309f96ca0f337020 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 28 Jun 2018 12:36:23 +0200
-Subject: [PATCH] brcmfmac: update STA info struct to the v5
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-That struct is used when querying firmware for the STA. It seem is has
-been changing during the time. Luckily its format seems to be backward
-compatible starting with v2 (the only breakage was v1 -> v2).
-
-The version that was supported by brcmfmac so far was v4. It was what
-43602a1 and 4366b1 firmwares (7.35.177.56 and 10.10.69.3309 accordingly)
-were using. It also seems to be used by early 4366c0 firmwares
-(10.10.69.6908 and 10.10.69.69017).
-
-The problem appears when switching to the 10.10.122.20 firmware. It uses
-v5 and instead of falling back to v4 when submitted buffer isn't big
-enough it fallbacks to the v3.
-
-To receive all v4 specific info with the newest firmware we have to
-submit a struct (buffer) that matches v5.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h  | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -174,6 +174,8 @@
- #define BRCMF_MFP_CAPABLE		1
- #define BRCMF_MFP_REQUIRED		2
- 
-+#define BRCMF_VHT_CAP_MCS_MAP_NSS_MAX	8
-+
- /* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
-  * ioctl. It is relatively small because firmware has small maximum size input
-  * playload restriction for ioctls.
-@@ -550,6 +552,8 @@ struct brcmf_sta_info_le {
- 						/* w/hi bit set if basic */
- 	__le32 in;		/* seconds elapsed since associated */
- 	__le32 listen_interval_inms; /* Min Listen interval in ms for STA */
-+
-+	/* Fields valid for ver >= 3 */
- 	__le32 tx_pkts;	/* # of packets transmitted */
- 	__le32 tx_failures;	/* # of packets failed */
- 	__le32 rx_ucast_pkts;	/* # of unicast packets received */
-@@ -558,6 +562,8 @@ struct brcmf_sta_info_le {
- 	__le32 rx_rate;	/* Rate of last successful rx frame */
- 	__le32 rx_decrypt_succeeds;	/* # of packet decrypted successfully */
- 	__le32 rx_decrypt_failures;	/* # of packet decrypted failed */
-+
-+	/* Fields valid for ver >= 4 */
- 	__le32 tx_tot_pkts;    /* # of tx pkts (ucast + mcast) */
- 	__le32 rx_tot_pkts;    /* # of data packets recvd (uni + mcast) */
- 	__le32 tx_mcast_pkts;  /* # of mcast pkts txed */
-@@ -594,6 +600,14 @@ struct brcmf_sta_info_le {
- 						*/
- 	__le32 rx_pkts_retried;        /* # rx with retry bit set */
- 	__le32 tx_rate_fallback;       /* lowest fallback TX rate */
-+
-+	/* Fields valid for ver >= 5 */
-+	struct {
-+		__le32 count;					/* # rates in this set */
-+		u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
-+		u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
-+		__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
-+	} rateset_adv;
- };
- 
- struct brcmf_chanspec_list {
diff --git a/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch b/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
deleted file mode 100644
index 6ebcdfdf29..0000000000
--- a/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 1e591c56a65fbbcd5754a4210a0ef0402d5e5f33 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 9 Jul 2018 06:55:43 +0200
-Subject: [PATCH] brcmfmac: specify some features per firmware version
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Some features supported by firmware aren't advertised and there is no
-way for a driver to query them. This includes e.g. monitor mode details.
-
-Most firmwares support monitor interface but only the latest ones
-/announce/ it with a "monitor" flag in the "cap" iovar. There isn't any
-reliable detection method for older firmwares (BRCMF_C_MONITOR was tried
-but "it only indicates the core part of the stack supports").
-
-Similarly support for tagging monitor frames and building radiotap
-headers can't be reliably detected for all firmwares.
-
-This commit adds table that allows mapping features to firmware version.
-It adds mappings for 43602a1 and 4366b1 firmwares from
-linux-firmware.git. Both were confirmed to be passing monitor frames.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 38 ++++++++++++++++++++++
- 1 file changed, 38 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -93,6 +93,42 @@ static int brcmf_feat_debugfs_read(struc
- }
- #endif /* DEBUG */
- 
-+struct brcmf_feat_fwfeat {
-+	const char * const fwid;
-+	u32 feat_flags;
-+};
-+
-+static const struct brcmf_feat_fwfeat brcmf_feat_fwfeat_map[] = {
-+	/* brcmfmac43602-pcie.ap.bin from linux-firmware.git commit ea1178515b88 */
-+	{ "01-6cb8e269", BIT(BRCMF_FEAT_MONITOR) },
-+	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 52442afee990 */
-+	{ "01-c47a91a4", BIT(BRCMF_FEAT_MONITOR) },
-+};
-+
-+static void brcmf_feat_firmware_overrides(struct brcmf_pub *drv)
-+{
-+	const struct brcmf_feat_fwfeat *e;
-+	u32 feat_flags = 0;
-+	int i;
-+
-+	for (i = 0; i < ARRAY_SIZE(brcmf_feat_fwfeat_map); i++) {
-+		e = &brcmf_feat_fwfeat_map[i];
-+		if (!strcmp(e->fwid, drv->fwver)) {
-+			feat_flags = e->feat_flags;
-+			break;
-+		}
-+	}
-+
-+	if (!feat_flags)
-+		return;
-+
-+	for (i = 0; i < BRCMF_FEAT_LAST; i++)
-+		if (feat_flags & BIT(i))
-+			brcmf_dbg(INFO, "enabling firmware feature: %s\n",
-+				  brcmf_feat_names[i]);
-+	drv->feat_flags |= feat_flags;
-+}
-+
- /**
-  * brcmf_feat_iovar_int_get() - determine feature through iovar query.
-  *
-@@ -253,6 +289,8 @@ void brcmf_feat_attach(struct brcmf_pub
- 	}
- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa");
- 
-+	brcmf_feat_firmware_overrides(drvr);
-+
- 	/* set chip related quirks */
- 	switch (drvr->bus_if->chip) {
- 	case BRCM_CC_43236_CHIP_ID:
diff --git a/package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch b/package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
deleted file mode 100644
index 6e96578990..0000000000
--- a/package/kernel/mac80211/patches/345-v4.20-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 5 Sep 2018 09:48:58 +0200
-Subject: [PATCH] brcmfmac: fix for proper support of 160MHz bandwidth
-
-Decoding of firmware channel information was not complete for 160MHz
-support. This resulted in the following warning:
-
-  WARNING: CPU: 2 PID: 2222 at .../broadcom/brcm80211/brcmutil/d11.c:196
-	brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
-  Modules linked in: brcmfmac(O) brcmutil(O) sha256_generic cfg80211 ...
-  CPU: 2 PID: 2222 Comm: kworker/2:0 Tainted: G           O
-  4.17.0-wt-testing-x64-00002-gf1bed50 #1
-  Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
-  Workqueue: events request_firmware_work_func
-  RIP: 0010:brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
-  RSP: 0018:ffffc90000047bd0 EFLAGS: 00010206
-  RAX: 000000000000e832 RBX: ffff8801146fe910 RCX: ffff8801146fd3c0
-  RDX: 0000000000002800 RSI: 0000000000000070 RDI: ffffc90000047c30
-  RBP: ffffc90000047bd0 R08: 0000000000000000 R09: ffffffffa0798c80
-  R10: ffff88012bca55e0 R11: ffff880110a4ea00 R12: ffff8801146f8000
-  R13: ffffc90000047c30 R14: ffff8801146fe930 R15: ffff8801138e02e0
-  FS:  0000000000000000(0000) GS:ffff88012bc80000(0000) knlGS:0000000000000000
-  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-  CR2: 00007f18ce8b8070 CR3: 000000000200a003 CR4: 00000000000206e0
-  Call Trace:
-   brcmf_setup_wiphybands+0x212/0x780 [brcmfmac]
-   brcmf_cfg80211_attach+0xae2/0x11a0 [brcmfmac]
-   brcmf_attach+0x1fc/0x4b0 [brcmfmac]
-   ? __kmalloc+0x13c/0x1c0
-   brcmf_pcie_setup+0x99b/0xe00 [brcmfmac]
-   brcmf_fw_request_done+0x16a/0x1f0 [brcmfmac]
-   request_firmware_work_func+0x36/0x60
-   process_one_work+0x146/0x350
-   worker_thread+0x4a/0x3b0
-   kthread+0x102/0x140
-   ? process_one_work+0x350/0x350
-   ? kthread_bind+0x20/0x20
-   ret_from_fork+0x35/0x40
-  Code: 66 90 0f b7 07 55 48 89 e5 89 c2 88 47 02 88 47 03 66 81 e2 00 38
-	66 81 fa 00 18 74 6e 66 81 fa 00 20 74 39 66 81 fa 00 10 74 14 <0f>
-	0b 66 25 00 c0 74 20 66 3d 00 c0 75 20 c6 47 04 01 5d c3 66
-  ---[ end trace 550c46682415b26d ]---
-  brcmfmac: brcmf_construct_chaninfo: Ignoring unexpected firmware channel 50
-
-This patch adds the missing stuff to properly handle this.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
----
- .../net/wireless/broadcom/brcm80211/brcmutil/d11.c | 34 +++++++++++++++++++++-
- .../broadcom/brcm80211/include/brcmu_wifi.h        |  2 ++
- 2 files changed, 35 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw b
- 		return BRCMU_CHSPEC_D11AC_BW_40;
- 	case BRCMU_CHAN_BW_80:
- 		return BRCMU_CHSPEC_D11AC_BW_80;
-+	case BRCMU_CHAN_BW_160:
-+		return BRCMU_CHSPEC_D11AC_BW_160;
- 	default:
- 		WARN_ON(1);
- 	}
-@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct
- 			break;
- 		}
- 		break;
--	case BRCMU_CHSPEC_D11AC_BW_8080:
- 	case BRCMU_CHSPEC_D11AC_BW_160:
-+		switch (ch->sb) {
-+		case BRCMU_CHAN_SB_LLL:
-+			ch->control_ch_num -= CH_70MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_LLU:
-+			ch->control_ch_num -= CH_50MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_LUL:
-+			ch->control_ch_num -= CH_30MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_LUU:
-+			ch->control_ch_num -= CH_10MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_ULL:
-+			ch->control_ch_num += CH_10MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_ULU:
-+			ch->control_ch_num += CH_30MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_UUL:
-+			ch->control_ch_num += CH_50MHZ_APART;
-+			break;
-+		case BRCMU_CHAN_SB_UUU:
-+			ch->control_ch_num += CH_70MHZ_APART;
-+			break;
-+		default:
-+			WARN_ON_ONCE(1);
-+			break;
-+		}
-+		break;
-+	case BRCMU_CHSPEC_D11AC_BW_8080:
- 	default:
- 		WARN_ON_ONCE(1);
- 		break;
---- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
-@@ -29,6 +29,8 @@
- #define CH_UPPER_SB			0x01
- #define CH_LOWER_SB			0x02
- #define CH_EWA_VALID			0x04
-+#define CH_70MHZ_APART			14
-+#define CH_50MHZ_APART			10
- #define CH_30MHZ_APART			6
- #define CH_20MHZ_APART			4
- #define CH_10MHZ_APART			2
diff --git a/package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch b/package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
deleted file mode 100644
index 154664c854..0000000000
--- a/package/kernel/mac80211/patches/348-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 3401d42c7ea2d064d15c66698ff8eb96553179ce Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Fri, 26 Oct 2018 12:50:39 +0200
-Subject: [PATCH] brcmutil: really fix decoding channel info for 160 MHz
- bandwidth
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Previous commit /adding/ support for 160 MHz chanspecs was incomplete.
-It didn't set bandwidth info and didn't extract control channel info. As
-the result it was also using uninitialized "sb" var.
-
-This change has been tested for two chanspecs found to be reported by
-some devices/firmwares:
-1) 60/160 (0xee32)
-   Before: chnum:50 control_ch_num:36
-    After: chnum:50 control_ch_num:60
-2) 120/160 (0xed72)
-   Before: chnum:114 control_ch_num:100
-    After: chnum:114 control_ch_num:120
-
-Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct
- 		}
- 		break;
- 	case BRCMU_CHSPEC_D11AC_BW_160:
-+		ch->bw = BRCMU_CHAN_BW_160;
-+		ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
-+					 BRCMU_CHSPEC_D11AC_SB_SHIFT);
- 		switch (ch->sb) {
- 		case BRCMU_CHAN_SB_LLL:
- 			ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch b/package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch
deleted file mode 100644
index 699ea6e481..0000000000
--- a/package/kernel/mac80211/patches/349-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 8eefb59de817125eeedde2a2cc1e4ac3660062f9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 8 Nov 2018 16:08:29 +0100
-Subject: [PATCH] brcmfmac: fix reporting support for 160 MHz channels
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Driver can report IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ so it's
-important to provide valid & complete info about supported bands for
-each channel. By default no support for 160 MHz should be assumed unless
-firmware reports it for a given channel later.
-
-This fixes info passed to the userspace. Without that change userspace
-could try to use invalid channel and fail to start an interface.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Cc: stable@vger.kernel.org
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5992,7 +5992,8 @@ static int brcmf_construct_chaninfo(stru
- 			 * for subsequent chanspecs.
- 			 */
- 			channel->flags = IEEE80211_CHAN_NO_HT40 |
--					 IEEE80211_CHAN_NO_80MHZ;
-+					 IEEE80211_CHAN_NO_80MHZ |
-+					 IEEE80211_CHAN_NO_160MHZ;
- 			ch.bw = BRCMU_CHAN_BW_20;
- 			cfg->d11inf.encchspec(&ch);
- 			chaninfo = ch.chspec;
diff --git a/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch b/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
deleted file mode 100644
index dfe9aae268..0000000000
--- a/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 12:07:40 +0200
-Subject: [PATCH] ath9k_hw: set spectral scan enable bit on trigger for
- AR9003+
-
-AR9002 code and QCA AR9003+ code do the same.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1800,6 +1800,8 @@ static void ar9003_hw_spectral_scan_conf
- 
- static void ar9003_hw_spectral_scan_trigger(struct ath_hw *ah)
- {
-+	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
-+		    AR_PHY_SPECTRAL_SCAN_ENABLE);
- 	/* Activate spectral scan */
- 	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
- 		    AR_PHY_SPECTRAL_SCAN_ACTIVE);
diff --git a/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch b/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
deleted file mode 100644
index 22f5154146..0000000000
--- a/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 27 Dec 2016 23:16:23 +0100
-Subject: [PATCH] ath9k: don't run periodic and nf calibation at the same
- time
-
-The checks already prevents periodic cal from being started while noise
-floor calibration runs. It is missing checks for the other way around.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-@@ -676,10 +676,10 @@ static int ar9002_hw_calibrate(struct at
- 			return 0;
- 
- 		ah->cal_list_curr = currCal = currCal->calNext;
--		if (currCal->calState == CAL_WAITING) {
-+		if (currCal->calState == CAL_WAITING)
- 			ath9k_hw_reset_calibration(ah, currCal);
--			return 0;
--		}
-+
-+		return 0;
- 	}
- 
- 	/* Do NF cal only at longer intervals */
diff --git a/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
deleted file mode 100644
index a9f01b368d..0000000000
--- a/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
+++ /dev/null
@@ -1,233 +0,0 @@
-From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
-Date: Fri, 19 Feb 2016 11:01:50 +0100
-Subject: [PATCH] mac80211: add NEED_ALIGNED4_SKBS hw flag
-
-HW/driver should set NEED_ALIGNED4_SKBS flag in case
-require aligned skbs to four-byte boundaries.
-This affect only TX direction.
-
-Padding is added after ieee80211_hdr, before IV/LLC.
-
-Before we have to do memmove(hdrlen) twice in the
-dirver. Once before we pass this to HW and next
-in tx completion (to be sure monitor will report
-this tx frame correctly).
-
-With this patch we can skip this memmove() and save CPU.
-
-Currently this was tested with ath9k, both hw/sw crypt for
-wep/tkip/ccmp.
-
-Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -2059,6 +2059,9 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA: Hardware supports buffer STA on
-  *	TDLS links.
-  *
-+ * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
-+ *	Padding will be added after ieee80211_hdr, before IV/LLC.
-+ *
-  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-  */
- enum ieee80211_hw_flags {
-@@ -2102,6 +2105,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_REPORTS_LOW_ACK,
- 	IEEE80211_HW_SUPPORTS_TX_FRAG,
- 	IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA,
-+	IEEE80211_HW_NEEDS_ALIGNED4_SKBS,
- 
- 	/* keep last, obviously */
- 	NUM_IEEE80211_HW_FLAGS
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -212,6 +212,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(REPORTS_LOW_ACK),
- 	FLAG(SUPPORTS_TX_FRAG),
- 	FLAG(SUPPORTS_TDLS_BUFFER_STA),
-+	FLAG(NEEDS_ALIGNED4_SKBS),
- #undef FLAG
- };
- 
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1548,6 +1548,29 @@ ieee80211_vif_get_num_mcast_if(struct ie
- 	return -1;
- }
- 
-+static inline unsigned int
-+ieee80211_hdr_padsize(struct ieee80211_hw *hw, unsigned int hdrlen)
-+{
-+	/*
-+	 * While hdrlen is already aligned to two-byte boundaries,
-+	 * simple check with & 2 will return correct padsize.
-+	 */
-+	if (ieee80211_hw_check(hw, NEEDS_ALIGNED4_SKBS))
-+		return hdrlen & 2;
-+	return 0;
-+}
-+
-+static inline unsigned int
-+ieee80211_padded_hdrlen(struct ieee80211_hw *hw, __le16 fc)
-+{
-+	unsigned int hdrlen;
-+
-+	hdrlen = ieee80211_hdrlen(fc);
-+	hdrlen += ieee80211_hdr_padsize(hw, hdrlen);
-+
-+	return hdrlen;
-+}
-+
- u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
- 				     struct ieee80211_rx_status *status,
- 				     unsigned int mpdu_len,
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -300,7 +300,7 @@ struct ieee80211_fast_tx {
- 	u8 hdr_len;
- 	u8 sa_offs, da_offs, pn_offs;
- 	u8 band;
--	u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
-+	u8 hdr[30 + 2 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
- 	       sizeof(rfc1042_header)] __aligned(2);
- 
- 	struct rcu_head rcu_head;
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -642,9 +642,22 @@ void ieee80211_tx_monitor(struct ieee802
- 	struct sk_buff *skb2;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_hdr *hdr = (void *)skb->data;
- 	struct net_device *prev_dev = NULL;
-+	unsigned int hdrlen, padsize;
- 	int rtap_len;
- 
-+	/* Remove padding if was added */
-+	if (ieee80211_hw_check(&local->hw, NEEDS_ALIGNED4_SKBS)) {
-+		hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+		padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
-+
-+		if (padsize && skb->len > hdrlen + padsize) {
-+			memmove(skb->data + padsize, skb->data, hdrlen);
-+			skb_pull(skb, padsize);
-+		}
-+	}
-+
- 	/* send frame to monitor interfaces now */
- 	rtap_len = ieee80211_tx_radiotap_len(info);
- 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
---- a/net/mac80211/tkip.c
-+++ b/net/mac80211/tkip.c
-@@ -201,10 +201,12 @@ void ieee80211_get_tkip_p2k(struct ieee8
- {
- 	struct ieee80211_key *key = (struct ieee80211_key *)
- 			container_of(keyconf, struct ieee80211_key, conf);
-+	struct ieee80211_hw *hw = &key->local->hw;
- 	const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
- 	struct tkip_ctx *ctx = &key->u.tkip.tx;
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
--	const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
-+	const u8 *data = (u8 *)hdr + ieee80211_padded_hdrlen(hw,
-+							hdr->frame_control);
- 	u32 iv32 = get_unaligned_le32(&data[4]);
- 	u16 iv16 = data[2] | (data[0] << 8);
- 
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1172,8 +1172,7 @@ ieee80211_tx_prepare(struct ieee80211_su
- 	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
- 
- 	hdr = (struct ieee80211_hdr *) skb->data;
--
--	tx->hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	tx->hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
- 
- 	if (likely(sta)) {
- 		if (!IS_ERR(sta))
-@@ -2184,7 +2183,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
- 		goto fail;
- 
- 	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
--	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
- 
- 	if (skb->len < len_rthdr + hdrlen)
- 		goto fail;
-@@ -2402,7 +2401,7 @@ static struct sk_buff *ieee80211_build_h
- 	struct ieee80211_chanctx_conf *chanctx_conf;
- 	struct ieee80211_sub_if_data *ap_sdata;
- 	enum nl80211_band band;
--	int ret;
-+	int padsize, ret;
- 
- 	if (IS_ERR(sta))
- 		sta = NULL;
-@@ -2622,6 +2621,9 @@ static struct sk_buff *ieee80211_build_h
- 		hdrlen += 2;
- 	}
- 
-+	/* Check aligned4 skb required */
-+	padsize = ieee80211_hdr_padsize(&sdata->local->hw, hdrlen);
-+
- 	/*
- 	 * Drop unicast frames to unauthorised stations unless they are
- 	 * EAPOL frames from the local station.
-@@ -2702,6 +2704,7 @@ static struct sk_buff *ieee80211_build_h
- 
- 	skb_pull(skb, skip_header_bytes);
- 	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
-+	head_need += padsize;
- 
- 	/*
- 	 * So we need to modify the skb header and hence need a copy of
-@@ -2734,6 +2737,9 @@ static struct sk_buff *ieee80211_build_h
- 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
- #endif
- 
-+	if (padsize)
-+		memset(skb_push(skb, padsize), 0, padsize);
-+
- 	if (ieee80211_is_data_qos(fc)) {
- 		__le16 *qos_control;
- 
-@@ -2909,6 +2915,9 @@ void ieee80211_check_fast_xmit(struct st
- 		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
- 	}
- 
-+	/* Check aligned4 skb required */
-+	build.hdr_len += ieee80211_hdr_padsize(&local->hw, build.hdr_len);
-+
- 	/* We store the key here so there's no point in using rcu_dereference()
- 	 * but that's fine because the code that changes the pointers will call
- 	 * this function after doing so. For a single CPU that would be enough,
-@@ -3495,7 +3504,7 @@ begin:
- 
- 		if (tx.key &&
- 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
--			pn_offs = ieee80211_hdrlen(hdr->frame_control);
-+			pn_offs = tx.hdrlen;
- 
- 		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
- 					   tx.key, skb);
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -1230,6 +1230,7 @@ void ieee80211_send_auth(struct ieee8021
- 			 u32 tx_flags)
- {
- 	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_hw *hw = &local->hw;
- 	struct sk_buff *skb;
- 	struct ieee80211_mgmt *mgmt;
- 	unsigned int hdrlen;
-@@ -1256,7 +1257,7 @@ void ieee80211_send_auth(struct ieee8021
- 		skb_put_data(skb, extra, extra_len);
- 
- 	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
--		hdrlen = ieee80211_hdrlen(mgmt->frame_control);
-+		hdrlen = ieee80211_padded_hdrlen(hw, mgmt->frame_control);
- 		mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
- 		err = ieee80211_wep_encrypt(local, skb, hdrlen, key,
- 					    key_len, key_idx);
diff --git a/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch b/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
deleted file mode 100644
index d651e6ce30..0000000000
--- a/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 28 Aug 2016 13:13:01 +0200
-Subject: [PATCH] ath9k: fix moredata bit in PS buffered frame release
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -1659,6 +1659,22 @@ void ath_tx_aggr_wakeup(struct ath_softc
- 	}
- }
- 
-+
-+static void
-+ath9k_set_moredata(struct ath_softc *sc, struct ath_buf *bf, bool val)
-+{
-+	struct ieee80211_hdr *hdr;
-+	u16 mask = cpu_to_le16(IEEE80211_FCTL_MOREDATA);
-+	u16 mask_val = mask * val;
-+
-+	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
-+	if ((hdr->frame_control & mask) != mask_val) {
-+		hdr->frame_control = (hdr->frame_control & ~mask) | mask_val;
-+		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
-+			sizeof(*hdr), DMA_TO_DEVICE);
-+	}
-+}
-+
- void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
- 				   struct ieee80211_sta *sta,
- 				   u16 tids, int nframes,
-@@ -1689,6 +1705,7 @@ void ath9k_release_buffered_frames(struc
- 			if (!bf)
- 				break;
- 
-+			ath9k_set_moredata(sc, bf, true);
- 			list_add_tail(&bf->list, &bf_q);
- 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
- 			if (bf_isampdu(bf)) {
-@@ -1712,6 +1729,9 @@ void ath9k_release_buffered_frames(struc
- 	if (list_empty(&bf_q))
- 		return;
- 
-+	if (!more_data)
-+		ath9k_set_moredata(sc, bf_tail, false);
-+
- 	info = IEEE80211_SKB_CB(bf_tail->bf_mpdu);
- 	info->flags |= IEEE80211_TX_STATUS_EOSP;
- 
diff --git a/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch b/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
deleted file mode 100644
index 319de2a767..0000000000
--- a/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 28 Aug 2016 13:13:42 +0200
-Subject: [PATCH] ath9k: clear potentially stale EOSP status bit in
- intermediate queues
-
-Prevents spurious ieee80211_sta_eosp calls.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -969,7 +969,8 @@ ath_tx_get_tid_subframe(struct ath_softc
- 		bf->bf_lastbf = bf;
- 
- 		tx_info = IEEE80211_SKB_CB(skb);
--		tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+		tx_info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
-+				    IEEE80211_TX_STATUS_EOSP);
- 
- 		/*
- 		 * No aggregation session is running, but there may be frames
diff --git a/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch b/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
deleted file mode 100644
index 80a3074a4d..0000000000
--- a/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 28 Aug 2016 13:23:27 +0200
-Subject: [PATCH] ath9k: report tx status on EOSP
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee802
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_sta *sta = info->status.status_driver_data[0];
- 
--	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
-+	if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
-+			   IEEE80211_TX_STATUS_EOSP)) {
- 		ieee80211_tx_status(hw, skb);
- 		return;
- 	}
diff --git a/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch b/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
deleted file mode 100644
index e25e92dda9..0000000000
--- a/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 30 Aug 2016 12:44:08 +0200
-Subject: [PATCH] ath9k: fix block-ack window tracking issues
-
-Ensure that a buffer gets tracked as part of the block-ack window as
-soon as it's dequeued from the tid for the first time. Ensure that
-double calls to ath_tx_addto_baw (e.g. on retransmission) don't cause
-any issues.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -62,7 +62,7 @@ static void ath_tx_rc_status(struct ath_
- 			     struct ath_tx_status *ts, int nframes, int nbad,
- 			     int txok);
- static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
--			      int seqno);
-+			      struct ath_buf *bf);
- static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
- 					   struct ath_txq *txq,
- 					   struct ath_atx_tid *tid,
-@@ -296,7 +296,7 @@ static void ath_tx_flush_tid(struct ath_
- 		}
- 
- 		if (fi->baw_tracked) {
--			ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
-+			ath_tx_update_baw(sc, tid, bf);
- 			sendbar = true;
- 		}
- 
-@@ -312,10 +312,15 @@ static void ath_tx_flush_tid(struct ath_
- }
- 
- static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
--			      int seqno)
-+			      struct ath_buf *bf)
- {
-+	struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
-+	u16 seqno = bf->bf_state.seqno;
- 	int index, cindex;
- 
-+	if (!fi->baw_tracked)
-+		return;
-+
- 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
- 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
- 
-@@ -336,6 +341,9 @@ static void ath_tx_addto_baw(struct ath_
- 	u16 seqno = bf->bf_state.seqno;
- 	int index, cindex;
- 
-+	if (fi->baw_tracked)
-+		return;
-+
- 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
- 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
- 	__set_bit(cindex, tid->tx_buf);
-@@ -612,7 +620,7 @@ static void ath_tx_complete_aggr(struct
- 			 * complete the acked-ones/xretried ones; update
- 			 * block-ack window
- 			 */
--			ath_tx_update_baw(sc, tid, seqno);
-+			ath_tx_update_baw(sc, tid, bf);
- 
- 			if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
- 				memcpy(tx_info->control.rates, rates, sizeof(rates));
-@@ -642,7 +650,7 @@ static void ath_tx_complete_aggr(struct
- 				 * run out of tx buf.
- 				 */
- 				if (!tbf) {
--					ath_tx_update_baw(sc, tid, seqno);
-+					ath_tx_update_baw(sc, tid, bf);
- 
- 					ath_tx_complete_buf(sc, bf, txq,
- 							    &bf_head, NULL, ts,
-@@ -1011,11 +1019,14 @@ ath_tx_get_tid_subframe(struct ath_softc
- 
- 			INIT_LIST_HEAD(&bf_head);
- 			list_add(&bf->list, &bf_head);
--			ath_tx_update_baw(sc, tid, seqno);
-+			ath_tx_update_baw(sc, tid, bf);
- 			ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
- 			continue;
- 		}
- 
-+		if (bf_isampdu(bf))
-+			ath_tx_addto_baw(sc, tid, bf);
-+
- 		return bf;
- 	}
- 
-@@ -1073,8 +1084,6 @@ ath_tx_form_aggr(struct ath_softc *sc, s
- 		bf->bf_next = NULL;
- 
- 		/* link buffers of this frame to the aggregate */
--		if (!fi->baw_tracked)
--			ath_tx_addto_baw(sc, tid, bf);
- 		bf->bf_state.ndelim = ndelim;
- 
- 		list_add_tail(&bf->list, bf_q);
-@@ -1710,10 +1719,8 @@ void ath9k_release_buffered_frames(struc
- 			ath9k_set_moredata(sc, bf, true);
- 			list_add_tail(&bf->list, &bf_q);
- 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
--			if (bf_isampdu(bf)) {
--				ath_tx_addto_baw(sc, tid, bf);
-+			if (bf_isampdu(bf))
- 				bf->bf_state.bf_type &= ~BUF_AGGR;
--			}
- 			if (bf_tail)
- 				bf_tail->bf_next = bf;
- 
diff --git a/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch b/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
deleted file mode 100644
index 67cbe92e59..0000000000
--- a/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 22 Mar 2017 20:37:04 +0100
-Subject: [PATCH] ath9k_hw: fix channel maximum power level test
-
-The tx power applied by set_txpower is limited by the CTL (conformance
-test limit) entries in the EEPROM. These can change based on the user
-configured regulatory domain.
-Depending on the EEPROM data this can cause the tx power to become too
-limited, if the original regdomain CTLs impose lowr limits than the CTLs
-of the user configured regdomain.
-
-To fix this issue, set the initial channel limits without any CTL
-restrictions and only apply the CTL at run time when setting the channel
-and the real tx power.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2937,10 +2937,14 @@ void ath9k_hw_apply_txpower(struct ath_h
- 	struct ieee80211_channel *channel;
- 	int chan_pwr, new_pwr, max_gain;
- 	int ant_gain, ant_reduction = 0;
-+	u16 ctl = NO_CTL;
- 
- 	if (!chan)
- 		return;
- 
-+	if (!test)
-+		ctl = ath9k_regd_get_ctl(reg, chan);
-+
- 	channel = chan->chan;
- 	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
- 	new_pwr = min_t(int, chan_pwr, reg->power_limit);
-@@ -2950,9 +2954,7 @@ void ath9k_hw_apply_txpower(struct ath_h
- 	if (ant_gain > max_gain)
- 		ant_reduction = ant_gain - max_gain;
- 
--	ah->eep_ops->set_txpower(ah, chan,
--				 ath9k_regd_get_ctl(reg, chan),
--				 ant_reduction, new_pwr, test);
-+	ah->eep_ops->set_txpower(ah, chan, ctl, ant_reduction, new_pwr, test);
- }
- 
- void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
diff --git a/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch b/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
deleted file mode 100644
index 0f3120d671..0000000000
--- a/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 23 Jul 2017 14:58:22 +0200
-Subject: [PATCH] ath9k: fix more-data flag for buffered multicast
- packets
-
-The flag needs to be cleared for the last packet in the list, not the
-first one. Fixes some issues with multicast packet loss for powersave
-clients connected to an ath9k AP.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -2436,7 +2436,6 @@ void ath_tx_cabq(struct ieee80211_hw *hw
- 		.txq = sc->beacon.cabq
- 	};
- 	struct ath_tx_info info = {};
--	struct ieee80211_hdr *hdr;
- 	struct ath_buf *bf_tail = NULL;
- 	struct ath_buf *bf;
- 	LIST_HEAD(bf_q);
-@@ -2480,15 +2479,10 @@ void ath_tx_cabq(struct ieee80211_hw *hw
- 	if (list_empty(&bf_q))
- 		return;
- 
--	bf = list_first_entry(&bf_q, struct ath_buf, list);
--	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
--
--	if (hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_MOREDATA)) {
--		hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_MOREDATA);
--		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
--			sizeof(*hdr), DMA_TO_DEVICE);
--	}
-+	bf = list_last_entry(&bf_q, struct ath_buf, list);
-+	ath9k_set_moredata(sc, bf, false);
- 
-+	bf = list_first_entry(&bf_q, struct ath_buf, list);
- 	ath_txq_lock(sc, txctl.txq);
- 	ath_tx_fill_desc(sc, bf, txctl.txq, 0);
- 	ath_tx_txqaddbuf(sc, txctl.txq, &bf_q, false);
diff --git a/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch b/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
deleted file mode 100644
index 56d86c1525..0000000000
--- a/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: dave taht <dave@taht.net>
-Date: Wed, 5 Oct 2016 20:09:15 -0700
-Subject: [PATCH] Revert "ath10k: disable wake_tx_queue for older
- devices"
-
-This reverts commit 4ca1807815aa6801aaced7fdefa9edacc2521767
-in the hope that we've fixed all the performance problems now.
----
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8319,15 +8319,6 @@ int ath10k_mac_register(struct ath10k *a
- 			ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
- 	}
- 
--	/* Current wake_tx_queue implementation imposes a significant
--	 * performance penalty in some setups. The tx scheduling code needs
--	 * more work anyway so disable the wake_tx_queue unless firmware
--	 * supports the pull-push mechanism.
--	 */
--	if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL,
--		      ar->running_fw->fw_file.fw_features))
--		ar->ops->wake_tx_queue = NULL;
--
- 	ret = ath10k_mac_init_rd(ar);
- 	if (ret) {
- 		ath10k_err(ar, "failed to derive regdom: %d\n", ret);
diff --git a/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch b/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
deleted file mode 100644
index 5d5329f27e..0000000000
--- a/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From: Christian Lamparter <chunkeey@gmail.com>
-Date: Wed, 1 Nov 2017 21:01:57 +0100
-Subject: [PATCH] ath10k: fix recent bandwidth conversion bug
-
-The commit "cfg80211: make RATE_INFO_BW_20 the default" changed
-the index of RATE_INFO_BW_20, but the updates to ath10k missed
-the special bandwidth calculation case in
-ath10k_update_per_peer_tx_stats().
-
-Fixes: 842be75c77cb ("cfg80211: make RATE_INFO_BW_20 the default")
-Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
-Patchwork-Id: 10037035
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -592,6 +592,9 @@ struct amsdu_subframe_hdr {
- 
- #define GROUP_ID_IS_SU_MIMO(x) ((x) == 0 || (x) == 63)
- 
-+static const u8 ath10k_bw_to_mac80211[] = { RATE_INFO_BW_20, RATE_INFO_BW_40,
-+	RATE_INFO_BW_80, RATE_INFO_BW_160 };
-+
- static void ath10k_htt_rx_h_rates(struct ath10k *ar,
- 				  struct ieee80211_rx_status *status,
- 				  struct htt_rx_desc *rxd)
-@@ -694,23 +697,7 @@ static void ath10k_htt_rx_h_rates(struct
- 		if (sgi)
- 			status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
- 
--		switch (bw) {
--		/* 20MHZ */
--		case 0:
--			break;
--		/* 40MHZ */
--		case 1:
--			status->bw = RATE_INFO_BW_40;
--			break;
--		/* 80MHZ */
--		case 2:
--			status->bw = RATE_INFO_BW_80;
--			break;
--		case 3:
--			status->bw = RATE_INFO_BW_160;
--			break;
--		}
--
-+		status->bw = ath10k_bw_to_mac80211[bw];
- 		status->encoding = RX_ENC_VHT;
- 		break;
- 	default:
-@@ -2297,7 +2284,7 @@ ath10k_update_per_peer_tx_stats(struct a
- 		arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
- 
- 	arsta->txrate.nss = txrate.nss;
--	arsta->txrate.bw = txrate.bw + RATE_INFO_BW_20;
-+	arsta->txrate.bw = ath10k_bw_to_mac80211[txrate.bw];
- }
- 
- static void ath10k_htt_fetch_peer_stats(struct ath10k *ar,
diff --git a/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch b/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
deleted file mode 100644
index bc4174e4c2..0000000000
--- a/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Tue, 30 Jan 2018 13:17:38 +0100
-Subject: [PATCH] cfg80211: use only 1Mbps for basic rates in mesh
-
-Mesh used to use the mandatory rates as basic rates, but we got
-the calculation of mandatory rates wrong until some time ago.
-Fix this this broke interoperability with older versions since
-now more basic rates are required, and thus the MBSS isn't the
-same and the network stops working.
-
-Fix this by simply using only 1Mbps as the basic rate in 2.4GHz.
-Since the changed mandatory rates only affected 2.4GHz, this is
-all we need to make it work again.
-
-Reported-and-tested-by: Matthias Schiffer <mschiffer@universe-factory.net>
-Fixes: 1bd773c077de ("wireless: set correct mandatory rate flags")
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- net/wireless/mesh.c | 25 ++++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
---- a/net/wireless/mesh.c
-+++ b/net/wireless/mesh.c
-@@ -169,9 +169,28 @@ int __cfg80211_join_mesh(struct cfg80211
- 		enum nl80211_bss_scan_width scan_width;
- 		struct ieee80211_supported_band *sband =
- 				rdev->wiphy.bands[setup->chandef.chan->band];
--		scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
--		setup->basic_rates = ieee80211_mandatory_rates(sband,
--							       scan_width);
-+
-+		if (setup->chandef.chan->band == NL80211_BAND_2GHZ) {
-+			int i;
-+
-+			/*
-+			 * Older versions selected the mandatory rates for
-+			 * 2.4 GHz as well, but were broken in that only
-+			 * 1 Mbps was regarded as a mandatory rate. Keep
-+			 * using just 1 Mbps as the default basic rate for
-+			 * mesh to be interoperable with older versions.
-+			 */
-+			for (i = 0; i < sband->n_bitrates; i++) {
-+				if (sband->bitrates[i].bitrate == 10) {
-+					setup->basic_rates = BIT(i);
-+					break;
-+				}
-+			}
-+		} else {
-+			scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
-+			setup->basic_rates = ieee80211_mandatory_rates(sband,
-+								       scan_width);
-+		}
- 	}
- 
- 	err = cfg80211_chandef_dfs_required(&rdev->wiphy,
diff --git a/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch b/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
deleted file mode 100644
index 0b599b73ac..0000000000
--- a/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
-Date: Fri, 2 Feb 2018 11:36:45 +0100
-Subject: [PATCH] ath9k: Protect queue draining by rcu_read_lock()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When ath9k was switched over to use the mac80211 intermediate queues,
-node cleanup now drains the mac80211 queues. However, this call path is
-not protected by rcu_read_lock() as it was previously entirely internal
-to the driver which uses its own locking.
-
-This leads to a possible rcu_dereference() without holding
-rcu_read_lock(); but only if a station is cleaned up while having
-packets queued on the TXQ. Fix this by adding the rcu_read_lock() to the
-caller in ath9k.
-
-Fixes: 50f08edf9809 ("ath9k: Switch to using mac80211 intermediate software queues.")
-Cc: stable@vger.kernel.org
-Reported-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -2915,6 +2915,8 @@ void ath_tx_node_cleanup(struct ath_soft
- 	struct ath_txq *txq;
- 	int tidno;
- 
-+	rcu_read_lock();
-+
- 	for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
- 		tid = ath_node_to_tid(an, tidno);
- 		txq = tid->txq;
-@@ -2932,6 +2934,8 @@ void ath_tx_node_cleanup(struct ath_soft
- 		if (!an->sta)
- 			break; /* just one multicast ath_atx_tid */
- 	}
-+
-+	rcu_read_unlock();
- }
- 
- #ifdef CPTCFG_ATH9K_TX99
diff --git a/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch b/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
deleted file mode 100644
index 37323c1f7d..0000000000
--- a/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 4f717a2589be649afddbbd3ac58b67ebfa7426f7 Mon Sep 17 00:00:00 2001
-From: Sven Eckelmann <sven@narfation.org>
-Date: Wed, 6 Jun 2018 10:18:31 +0200
-Subject: [PATCH v2] cfg80211: initialize sinfo in cfg80211_get_station
-
-Most of the implementations behind cfg80211_get_station will not initialize
-sinfo to zero before manipulating it. For example, the member "filled",
-which indicates the filled in parts of this struct, is often only modified
-by enabling certain bits in the bitfield while keeping the remaining bits
-in their original state. A caller without a preinitialized sinfo.filled can
-then no longer decide which parts of sinfo were filled in by
-cfg80211_get_station (or actually the underlying implementations).
-
-cfg80211_get_station must therefore take care that sinfo is initialized to
-zero. Otherwise, the caller may tries to read information which was not
-filled in and which must therefore also be considered uninitialized. In
-batadv_v_elp_get_throughput's case, an invalid "random" expected throughput
-may be stored for this neighbor and thus the B.A.T.M.A.N V algorithm may
-switch to non-optimal neighbors for certain destinations.
-
-Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
-Reported-by: Thomas Lauer <holminateur@gmail.com>
-Reported-by: Marcel Schmidt <ff.z-casparistrasse@mailbox.org>
-Cc: b.a.t.m.a.n@lists.open-mesh.org
-Signed-off-by: Sven Eckelmann <sven@narfation.org>
-
-Forwarded: https://patchwork.kernel.org/patch/10449857/
----
- net/wireless/util.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -1749,6 +1749,8 @@ int cfg80211_get_station(struct net_devi
- 	if (!rdev->ops->get_station)
- 		return -EOPNOTSUPP;
- 
-+	memset(sinfo, 0, sizeof(*sinfo));
-+
- 	return rdev_get_station(rdev, dev, mac_addr, sinfo);
- }
- EXPORT_SYMBOL(cfg80211_get_station);
diff --git a/package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch b/package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
deleted file mode 100644
index 26347e6e0e..0000000000
--- a/package/kernel/mac80211/patches/380-v5.0-0004-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From b72c51a58e6d63ef673ac96b8ab5bc98799c5f7b Mon Sep 17 00:00:00 2001
-From: Lyude Paul <lyude@redhat.com>
-Date: Sat, 24 Nov 2018 17:57:05 -0500
-Subject: [PATCH] brcmfmac: Fix out of bounds memory access during fw load
-
-I ended up tracking down some rather nasty issues with f2fs (and other
-filesystem modules) constantly crashing on my kernel down to a
-combination of out of bounds memory accesses, one of which was coming
-from brcmfmac during module load:
-
-[   30.891382] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2
-[   30.894437] ==================================================================
-[   30.901581] BUG: KASAN: global-out-of-bounds in brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac]
-[   30.909935] Read of size 1 at addr ffff2000024865df by task kworker/6:2/387
-[   30.916805]
-[   30.918261] CPU: 6 PID: 387 Comm: kworker/6:2 Tainted: G           O      4.20.0-rc3Lyude-Test+ #19
-[   30.927251] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018
-[   30.935964] Workqueue: events brcmf_driver_register [brcmfmac]
-[   30.941641] Call trace:
-[   30.944058]  dump_backtrace+0x0/0x3e8
-[   30.947676]  show_stack+0x14/0x20
-[   30.950968]  dump_stack+0x130/0x1c4
-[   30.954406]  print_address_description+0x60/0x25c
-[   30.959066]  kasan_report+0x1b4/0x368
-[   30.962683]  __asan_report_load1_noabort+0x18/0x20
-[   30.967547]  brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac]
-[   30.967639]  brcmf_sdio_probe+0x163c/0x2050 [brcmfmac]
-[   30.978035]  brcmf_ops_sdio_probe+0x598/0xa08 [brcmfmac]
-[   30.983254]  sdio_bus_probe+0x190/0x398
-[   30.983270]  really_probe+0x2a0/0xa70
-[   30.983296]  driver_probe_device+0x1b4/0x2d8
-[   30.994901]  __driver_attach+0x200/0x280
-[   30.994914]  bus_for_each_dev+0x10c/0x1a8
-[   30.994925]  driver_attach+0x38/0x50
-[   30.994935]  bus_add_driver+0x330/0x608
-[   30.994953]  driver_register+0x140/0x388
-[   31.013965]  sdio_register_driver+0x74/0xa0
-[   31.014076]  brcmf_sdio_register+0x14/0x60 [brcmfmac]
-[   31.023177]  brcmf_driver_register+0xc/0x18 [brcmfmac]
-[   31.023209]  process_one_work+0x654/0x1080
-[   31.032266]  worker_thread+0x4f0/0x1308
-[   31.032286]  kthread+0x2a8/0x320
-[   31.039254]  ret_from_fork+0x10/0x1c
-[   31.039269]
-[   31.044226] The buggy address belongs to the variable:
-[   31.044351]  brcmf_firmware_path+0x11f/0xfffffffffffd3b40 [brcmfmac]
-[   31.055601]
-[   31.057031] Memory state around the buggy address:
-[   31.061800]  ffff200002486480: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
-[   31.068983]  ffff200002486500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-[   31.068993] >ffff200002486580: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
-[   31.068999]                                                     ^
-[   31.069017]  ffff200002486600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-[   31.096521]  ffff200002486680: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
-[   31.096528] ==================================================================
-[   31.096533] Disabling lock debugging due to kernel taint
-
-It appears that when trying to determine the length of the string in the
-alternate firmware path, we make the mistake of not handling the case
-where the firmware path is empty correctly. Since strlen(mp_path) can
-return 0, we'll end up accessing mp_path[-1] when the firmware_path
-isn't provided through the module arguments.
-
-So, fix this by just setting the end char to '\0' by default, and only
-changing it if we have a non-zero length. Additionally, use strnlen()
-with BRCMF_FW_ALTPATH_LEN instead of strlen() just to be extra safe.
-
-Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function")
-Cc: Hante Meuleman <hante.meuleman@broadcom.com>
-Cc: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Cc: Franky Lin <franky.lin@broadcom.com>
-Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
-Cc: Kalle Valo <kvalo@codeaurora.org>
-Cc: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Cc: Himanshu Jha <himanshujha199640@gmail.com>
-Cc: Dan Haab <dhaab@luxul.com>
-Cc: Jia-Shyr Chuang <saint.chuang@cypress.com>
-Cc: Ian Molton <ian@mnementh.co.uk>
-Cc: <stable@vger.kernel.org> # v4.17+
-Signed-off-by: Lyude Paul <lyude@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c   | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -633,8 +633,9 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
- 	struct brcmf_fw_request *fwreq;
- 	char chipname[12];
- 	const char *mp_path;
-+	size_t mp_path_len;
- 	u32 i, j;
--	char end;
-+	char end = '\0';
- 	size_t reqsz;
- 
- 	for (i = 0; i < table_size; i++) {
-@@ -659,7 +660,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
- 		   mapping_table[i].fw_base, chipname);
- 
- 	mp_path = brcmf_mp_global.firmware_path;
--	end = mp_path[strlen(mp_path) - 1];
-+	mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
-+	if (mp_path_len)
-+		end = mp_path[mp_path_len - 1];
-+
- 	fwreq->n_items = n_fwnames;
- 
- 	for (j = 0; j < n_fwnames; j++) {
diff --git a/package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch b/package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch
deleted file mode 100644
index b6a1a17b93..0000000000
--- a/package/kernel/mac80211/patches/380-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 8c892df41500469729e0d662816300196e4f463d Mon Sep 17 00:00:00 2001
-From: Stijn Tintel <stijn@linux-ipv6.be>
-Date: Tue, 4 Dec 2018 20:29:05 +0200
-Subject: [PATCH] brcmfmac: fix roamoff=1 modparam
-
-When the update_connect_param callback is set, nl80211 expects the flag
-WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is
-only set when modparam roamoff=0, while the callback is set
-unconditionally. Since commit 7f9a3e150ec7 this causes a warning in
-wiphy_register, which breaks brcmfmac.
-
-Disable the update_connect_param callback when roamoff=0 to fix this.
-
-Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS")
-Cc: Stable <stable@vger.kernel.org> # 4.19+
-Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
-Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   | 11 +++++++++--
- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h   |  2 +-
- .../net/wireless/broadcom/brcm80211/brcmfmac/core.c   |  2 +-
- 3 files changed, 11 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5189,10 +5189,17 @@ static struct cfg80211_ops brcmf_cfg8021
- 	.del_pmk = brcmf_cfg80211_del_pmk,
- };
- 
--struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
- {
--	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
-+	struct cfg80211_ops *ops;
-+
-+	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
- 		       GFP_KERNEL);
-+
-+	if (ops && settings->roamoff)
-+		ops->update_connect_params = NULL;
-+
-+	return ops;
- }
- 
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -404,7 +404,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
- s32 brcmf_cfg80211_up(struct net_device *ndev);
- s32 brcmf_cfg80211_down(struct net_device *ndev);
--struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings);
- enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
- 
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1151,7 +1151,7 @@ int brcmf_attach(struct device *dev, str
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	ops = brcmf_cfg80211_get_ops();
-+	ops = brcmf_cfg80211_get_ops(settings);
- 	if (!ops)
- 		return -ENOMEM;
- 
diff --git a/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch b/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
deleted file mode 100644
index ad282f9892..0000000000
--- a/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
-Date: Mon, 13 Aug 2018 14:16:25 +0200
-Subject: [PATCH] mac80211: Run TXQ teardown code before de-registering
- interfaces
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The TXQ teardown code can reference the vif data structures that are
-stored in the netdev private memory area if there are still packets on
-the queue when it is being freed. Since the TXQ teardown code is run
-after the netdevs are freed, this can lead to a use-after-free. Fix this
-by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
-
-Reported-by: Ben Greear <greearb@candelatech.com>
-Tested-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -1172,6 +1172,7 @@ void ieee80211_unregister_hw(struct ieee
- #if IS_ENABLED(__disabled__CONFIG_IPV6)
- 	unregister_inet6addr_notifier(&local->ifa6_notifier);
- #endif
-+	ieee80211_txq_teardown_flows(local);
- 
- 	rtnl_lock();
- 
-@@ -1200,7 +1201,6 @@ void ieee80211_unregister_hw(struct ieee
- 	skb_queue_purge(&local->skb_queue);
- 	skb_queue_purge(&local->skb_queue_unreliable);
- 	skb_queue_purge(&local->skb_queue_tdls_chsw);
--	ieee80211_txq_teardown_flows(local);
- 
- 	destroy_workqueue(local->workqueue);
- 	wiphy_unregister(local->hw.wiphy);
diff --git a/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch b/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
deleted file mode 100644
index e7b279af55..0000000000
--- a/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From: Yuan-Chi Pang <fu3mo6goo@gmail.com>
-Date: Wed, 29 Aug 2018 09:30:08 +0800
-Subject: [PATCH] mac80211: mesh: fix HWMP sequence numbering to follow
- standard
-
-IEEE 802.11-2016 14.10.8.3 HWMP sequence numbering says:
-If it is a target mesh STA, it shall update its own HWMP SN to
-maximum (current HWMP SN, target HWMP SN in the PREQ element) + 1
-immediately before it generates a PREP element in response to a
-PREQ element.
-
-Signed-off-by: Yuan-Chi Pang <fu3mo6goo@gmail.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mesh_hwmp.c
-+++ b/net/mac80211/mesh_hwmp.c
-@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(stru
- 		forward = false;
- 		reply = true;
- 		target_metric = 0;
-+
-+		if (SN_GT(target_sn, ifmsh->sn))
-+			ifmsh->sn = target_sn;
-+
- 		if (time_after(jiffies, ifmsh->last_sn_update +
- 					net_traversal_jiffies(sdata)) ||
- 		    time_before(jiffies, ifmsh->last_sn_update)) {
diff --git a/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch b/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
deleted file mode 100644
index 66993839ee..0000000000
--- a/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From: Sara Sharon <sara.sharon@intel.com>
-Date: Wed, 29 Aug 2018 08:57:02 +0200
-Subject: [PATCH] mac80211: avoid kernel panic when building AMSDU from
- non-linear SKB
-
-When building building AMSDU from non-linear SKB, we hit a
-kernel panic when trying to push the padding to the tail.
-Instead, put the padding at the head of the next subframe.
-This also fixes the A-MSDU subframes to not have the padding
-accounted in the length field and not have pad at all for
-the last subframe, both required by the spec.
-
-Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
-Signed-off-by: Sara Sharon <sara.sharon@intel.com>
-Reviewed-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3064,27 +3064,18 @@ void ieee80211_clear_fast_xmit(struct st
- }
- 
- static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
--					struct sk_buff *skb, int headroom,
--					int *subframe_len)
-+					struct sk_buff *skb, int headroom)
- {
--	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
--	int padding = (4 - amsdu_len) & 3;
--
--	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
-+	if (skb_headroom(skb) < headroom) {
- 		I802_DEBUG_INC(local->tx_expand_skb_head);
- 
--		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
-+		if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
- 			wiphy_debug(local->hw.wiphy,
- 				    "failed to reallocate TX buffer\n");
- 			return false;
- 		}
- 	}
- 
--	if (padding) {
--		*subframe_len += padding;
--		skb_put_zero(skb, padding);
--	}
--
- 	return true;
- }
- 
-@@ -3108,8 +3099,7 @@ static bool ieee80211_amsdu_prepare_head
- 	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
- 		return true;
- 
--	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
--					 &subframe_len))
-+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
- 		return false;
- 
- 	data = skb_push(skb, sizeof(*amsdu_hdr));
-@@ -3176,7 +3166,8 @@ static bool ieee80211_amsdu_aggregate(st
- 	void *data;
- 	bool ret = false;
- 	unsigned int orig_len;
--	int n = 1, nfrags;
-+	int n = 1, nfrags, pad = 0;
-+	u16 hdrlen;
- 
- 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
- 		return false;
-@@ -3228,8 +3219,19 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (max_frags && nfrags > max_frags)
- 		goto out;
- 
--	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
--					 &subframe_len))
-+	/*
-+	 * Pad out the previous subframe to a multiple of 4 by adding the
-+	 * padding to the next one, that's being added. Note that head->len
-+	 * is the length of the full A-MSDU, but that works since each time
-+	 * we add a new subframe we pad out the previous one to a multiple
-+	 * of 4 and thus it no longer matters in the next round.
-+	 */
-+	hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
-+	if ((head->len - hdrlen) & 3)
-+		pad = 4 - ((head->len - hdrlen) & 3);
-+
-+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
-+						     2 + pad))
- 		goto out;
- 
- 	ret = true;
-@@ -3241,6 +3243,8 @@ static bool ieee80211_amsdu_aggregate(st
- 	memcpy(data, &len, 2);
- 	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
- 
-+	memset(skb_push(skb, pad), 0, pad);
-+
- 	head->len += skb->len;
- 	head->data_len += skb->len;
- 	*frag_tail = skb;
diff --git a/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch b/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
deleted file mode 100644
index f4b14506a6..0000000000
--- a/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Arunk Khandavalli <akhandav@codeaurora.org>
-Date: Thu, 30 Aug 2018 00:40:16 +0300
-Subject: [PATCH] cfg80211: nl80211_update_ft_ies() to validate
- NL80211_ATTR_IE
-
-nl80211_update_ft_ies() tried to validate NL80211_ATTR_IE with
-is_valid_ie_attr() before dereferencing it, but that helper function
-returns true in case of NULL pointer (i.e., attribute not included).
-This can result to dereferencing a NULL pointer. Fix that by explicitly
-checking that NL80211_ATTR_IE is included.
-
-Fixes: 355199e02b83 ("cfg80211: Extend support for IEEE 802.11r Fast BSS Transition")
-Signed-off-by: Arunk Khandavalli <akhandav@codeaurora.org>
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -11763,6 +11763,7 @@ static int nl80211_update_ft_ies(struct
- 		return -EOPNOTSUPP;
- 
- 	if (!info->attrs[NL80211_ATTR_MDID] ||
-+	    !info->attrs[NL80211_ATTR_IE] ||
- 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
- 		return -EINVAL;
- 
diff --git a/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch b/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
deleted file mode 100644
index 1d88902251..0000000000
--- a/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Wed, 29 Aug 2018 21:03:25 +0200
-Subject: [PATCH] mac80211: do not convert to A-MSDU if frag/subframe
- limited
-
-Do not start to aggregate packets in a A-MSDU frame (converting the
-first subframe to A-MSDU, adding the header) if max_tx_fragments or
-max_amsdu_subframes limits are already exceeded by it. In particular,
-this happens when drivers set the limit to 1 to avoid A-MSDUs at all.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-[reword commit message to be more precise]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3201,9 +3201,6 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (skb->len + head->len > max_amsdu_len)
- 		goto unlock;
- 
--	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
--		goto out;
--
- 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
- 	nfrags += 1 + skb_shinfo(head)->nr_frags;
- 	frag_tail = &skb_shinfo(head)->frag_list;
-@@ -3219,6 +3216,9 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (max_frags && nfrags > max_frags)
- 		goto out;
- 
-+	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-+		goto out;
-+
- 	/*
- 	 * Pad out the previous subframe to a multiple of 4 by adding the
- 	 * padding to the next one, that's being added. Note that head->len
diff --git a/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch b/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
deleted file mode 100644
index 47942116bc..0000000000
--- a/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 30 Aug 2018 10:55:49 +0200
-Subject: [PATCH] mac80211: always account for A-MSDU header changes
-
-In the error path of changing the SKB headroom of the second
-A-MSDU subframe, we would not account for the already-changed
-length of the first frame that just got converted to be in
-A-MSDU format and thus is a bit longer now.
-
-Fix this by doing the necessary accounting.
-
-It would be possible to reorder the operations, but that would
-make the code more complex (to calculate the necessary pad),
-and the headroom expansion should not fail frequently enough
-to make that worthwhile.
-
-Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3232,7 +3232,7 @@ static bool ieee80211_amsdu_aggregate(st
- 
- 	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
- 						     2 + pad))
--		goto out;
-+		goto out_recalc;
- 
- 	ret = true;
- 	data = skb_push(skb, ETH_ALEN + 2);
-@@ -3249,11 +3249,13 @@ static bool ieee80211_amsdu_aggregate(st
- 	head->data_len += skb->len;
- 	*frag_tail = skb;
- 
--	flow->backlog += head->len - orig_len;
--	tin->backlog_bytes += head->len - orig_len;
--
--	fq_recalc_backlog(fq, tin, flow);
-+out_recalc:
-+	if (head->len != orig_len) {
-+		flow->backlog += head->len - orig_len;
-+		tin->backlog_bytes += head->len - orig_len;
- 
-+		fq_recalc_backlog(fq, tin, flow);
-+	}
- out:
- 	fq->memory_usage += head->truesize - orig_truesize;
- 
diff --git a/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch b/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
deleted file mode 100644
index 455fa29831..0000000000
--- a/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Fri, 31 Aug 2018 01:04:13 +0200
-Subject: [PATCH] mac80211: fix an off-by-one issue in A-MSDU
- max_subframe computation
-
-Initialize 'n' to 2 in order to take into account also the first
-packet in the estimation of max_subframe limit for a given A-MSDU
-since frag_tail pointer is NULL when ieee80211_amsdu_aggregate
-routine analyzes the second frame.
-
-Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3166,7 +3166,7 @@ static bool ieee80211_amsdu_aggregate(st
- 	void *data;
- 	bool ret = false;
- 	unsigned int orig_len;
--	int n = 1, nfrags, pad = 0;
-+	int n = 2, nfrags, pad = 0;
- 	u16 hdrlen;
- 
- 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
diff --git a/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch b/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
deleted file mode 100644
index 8437aad6a6..0000000000
--- a/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Fri, 31 Aug 2018 11:10:55 +0300
-Subject: [PATCH] cfg80211: fix a type issue in
- ieee80211_chandef_to_operating_class()
-
-The "chandef->center_freq1" variable is a u32 but "freq" is a u16 so we
-are truncating away the high bits.  I noticed this bug because in commit
-9cf0a0b4b64a ("cfg80211: Add support for 60GHz band channels 5 and 6")
-we made "freq <= 56160 + 2160 * 6" a valid requency when before it was
-only "freq <= 56160 + 2160 * 4" that was valid.  It introduces a static
-checker warning:
-
-    net/wireless/util.c:1571 ieee80211_chandef_to_operating_class()
-    warn: always true condition '(freq <= 56160 + 2160 * 6) => (0-u16max <= 69120)'
-
-But really we probably shouldn't have been truncating the high bits
-away to begin with.
-
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -1377,7 +1377,7 @@ bool ieee80211_chandef_to_operating_clas
- 					  u8 *op_class)
- {
- 	u8 vht_opclass;
--	u16 freq = chandef->center_freq1;
-+	u32 freq = chandef->center_freq1;
- 
- 	if (freq >= 2412 && freq <= 2472) {
- 		if (chandef->width > NL80211_CHAN_WIDTH_40)
diff --git a/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch b/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
deleted file mode 100644
index db2aa0443f..0000000000
--- a/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Fri, 31 Aug 2018 11:31:06 +0300
-Subject: [PATCH] mac80211: fix a race between restart and CSA flows
-
-We hit a problem with iwlwifi that was caused by a bug in
-mac80211. A bug in iwlwifi caused the firwmare to crash in
-certain cases in channel switch. Because of that bug,
-drv_pre_channel_switch would fail and trigger the restart
-flow.
-Now we had the hw restart worker which runs on the system's
-workqueue and the csa_connection_drop_work worker that runs
-on mac80211's workqueue that can run together. This is
-obviously problematic since the restart work wants to
-reconfigure the connection, while the csa_connection_drop_work
-worker does the exact opposite: it tries to disconnect.
-
-Fix this by cancelling the csa_connection_drop_work worker
-in the restart worker.
-
-Note that this can sound racy: we could have:
-
-driver   iface_work   CSA_work   restart_work
-+++++++++++++++++++++++++++++++++++++++++++++
-              |
- <--drv_cs ---|
-<FW CRASH!>
--CS FAILED-->
-              |                       |
-              |                 cancel_work(CSA)
-           schedule                   |
-           CSA work                   |
-                         |            |
-                        Race between those 2
-
-But this is not possible because we flush the workqueue
-in the restart worker before we cancel the CSA worker.
-That would be bullet proof if we could guarantee that
-we schedule the CSA worker only from the iface_work
-which runs on the workqueue (and not on the system's
-workqueue), but unfortunately we do have an instance
-in which we schedule the CSA work outside the context
-of the workqueue (ieee80211_chswitch_done).
-
-Note also that we should probably cancel other workers
-like beacon_connection_loss_work and possibly others
-for different types of interfaces, at the very least,
-IBSS should suffer from the exact same problem, but for
-now, do the minimum to fix the actual bug that was actually
-experienced and reproduced.
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -255,8 +255,27 @@ static void ieee80211_restart_work(struc
- 
- 	flush_work(&local->radar_detected_work);
- 	rtnl_lock();
--	list_for_each_entry(sdata, &local->interfaces, list)
-+	list_for_each_entry(sdata, &local->interfaces, list) {
-+		/*
-+		 * XXX: there may be more work for other vif types and even
-+		 * for station mode: a good thing would be to run most of
-+		 * the iface type's dependent _stop (ieee80211_mg_stop,
-+		 * ieee80211_ibss_stop) etc...
-+		 * For now, fix only the specific bug that was seen: race
-+		 * between csa_connection_drop_work and us.
-+		 */
-+		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-+			/*
-+			 * This worker is scheduled from the iface worker that
-+			 * runs on mac80211's workqueue, so we can't be
-+			 * scheduling this worker after the cancel right here.
-+			 * The exception is ieee80211_chswitch_done.
-+			 * Then we can have a race...
-+			 */
-+			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
-+		}
- 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
-+	}
- 	ieee80211_scan_cancel(local);
- 
- 	/* make sure any new ROC will consider local->in_reconfig */
diff --git a/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch b/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
deleted file mode 100644
index aa8db32e72..0000000000
--- a/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From: Ilan Peer <ilan.peer@intel.com>
-Date: Fri, 31 Aug 2018 11:31:10 +0300
-Subject: [PATCH] mac80211: Fix station bandwidth setting after channel
- switch
-
-When performing a channel switch flow for a managed interface, the
-flow did not update the bandwidth of the AP station and the rate
-scale algorithm. In case of a channel width downgrade, this would
-result with the rate scale algorithm using a bandwidth that does not
-match the interface channel configuration.
-
-Fix this by updating the AP station bandwidth and rate scaling algorithm
-before the actual channel change in case of a bandwidth downgrade, or
-after the actual channel change in case of a bandwidth upgrade.
-
-Signed-off-by: Ilan Peer <ilan.peer@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -975,6 +975,10 @@ static void ieee80211_chswitch_work(stru
- 	 */
- 
- 	if (sdata->reserved_chanctx) {
-+		struct ieee80211_supported_band *sband = NULL;
-+		struct sta_info *mgd_sta = NULL;
-+		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
-+
- 		/*
- 		 * with multi-vif csa driver may call ieee80211_csa_finish()
- 		 * many times while waiting for other interfaces to use their
-@@ -983,6 +987,48 @@ static void ieee80211_chswitch_work(stru
- 		if (sdata->reserved_ready)
- 			goto out;
- 
-+		if (sdata->vif.bss_conf.chandef.width !=
-+		    sdata->csa_chandef.width) {
-+			/*
-+			 * For managed interface, we need to also update the AP
-+			 * station bandwidth and align the rate scale algorithm
-+			 * on the bandwidth change. Here we only consider the
-+			 * bandwidth of the new channel definition (as channel
-+			 * switch flow does not have the full HT/VHT/HE
-+			 * information), assuming that if additional changes are
-+			 * required they would be done as part of the processing
-+			 * of the next beacon from the AP.
-+			 */
-+			switch (sdata->csa_chandef.width) {
-+			case NL80211_CHAN_WIDTH_20_NOHT:
-+			case NL80211_CHAN_WIDTH_20:
-+			default:
-+				bw = IEEE80211_STA_RX_BW_20;
-+				break;
-+			case NL80211_CHAN_WIDTH_40:
-+				bw = IEEE80211_STA_RX_BW_40;
-+				break;
-+			case NL80211_CHAN_WIDTH_80:
-+				bw = IEEE80211_STA_RX_BW_80;
-+				break;
-+			case NL80211_CHAN_WIDTH_80P80:
-+			case NL80211_CHAN_WIDTH_160:
-+				bw = IEEE80211_STA_RX_BW_160;
-+				break;
-+			}
-+
-+			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
-+			sband =
-+				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
-+		}
-+
-+		if (sdata->vif.bss_conf.chandef.width >
-+		    sdata->csa_chandef.width) {
-+			mgd_sta->sta.bandwidth = bw;
-+			rate_control_rate_update(local, sband, mgd_sta,
-+						 IEEE80211_RC_BW_CHANGED);
-+		}
-+
- 		ret = ieee80211_vif_use_reserved_context(sdata);
- 		if (ret) {
- 			sdata_info(sdata,
-@@ -993,6 +1039,13 @@ static void ieee80211_chswitch_work(stru
- 			goto out;
- 		}
- 
-+		if (sdata->vif.bss_conf.chandef.width <
-+		    sdata->csa_chandef.width) {
-+			mgd_sta->sta.bandwidth = bw;
-+			rate_control_rate_update(local, sband, mgd_sta,
-+						 IEEE80211_RC_BW_CHANGED);
-+		}
-+
- 		goto out;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch b/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
deleted file mode 100644
index 74dd3d3775..0000000000
--- a/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Fri, 31 Aug 2018 11:31:12 +0300
-Subject: [PATCH] mac80211: don't Tx a deauth frame if the AP forbade Tx
-
-If the driver fails to properly prepare for the channel
-switch, mac80211 will disconnect. If the CSA IE had mode
-set to 1, it means that the clients are not allowed to send
-any Tx on the current channel, and that includes the
-deauthentication frame.
-
-Make sure that we don't send the deauthentication frame in
-this case.
-
-In iwlwifi, this caused a failure to flush queues since the
-firmware already closed the queues after having parsed the
-CSA IE. Then mac80211 would wait until the deauthentication
-frame would go out (drv_flush(drop=false)) and that would
-never happen.
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1267,6 +1267,16 @@ ieee80211_sta_process_chanswitch(struct
- 					 cbss->beacon_interval));
- 	return;
-  drop_connection:
-+	/*
-+	 * This is just so that the disconnect flow will know that
-+	 * we were trying to switch channel and failed. In case the
-+	 * mode is 1 (we are not allowed to Tx), we will know not to
-+	 * send a deauthentication frame. Those two fields will be
-+	 * reset when the disconnection worker runs.
-+	 */
-+	sdata->vif.csa_active = true;
-+	sdata->csa_block_tx = csa_ie.mode;
-+
- 	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
- 	mutex_unlock(&local->chanctx_mtx);
- 	mutex_unlock(&local->mtx);
-@@ -2437,6 +2447,7 @@ static void __ieee80211_disconnect(struc
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
- 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
-+	bool tx;
- 
- 	sdata_lock(sdata);
- 	if (!ifmgd->associated) {
-@@ -2444,6 +2455,8 @@ static void __ieee80211_disconnect(struc
- 		return;
- 	}
- 
-+	tx = !sdata->csa_block_tx;
-+
- 	/* AP is probably out of range (or not reachable for another reason) so
- 	 * remove the bss struct for that AP.
- 	 */
-@@ -2451,7 +2464,7 @@ static void __ieee80211_disconnect(struc
- 
- 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
- 			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
--			       true, frame_buf);
-+			       tx, frame_buf);
- 	mutex_lock(&local->mtx);
- 	sdata->vif.csa_active = false;
- 	ifmgd->csa_waiting_bcn = false;
-@@ -2462,7 +2475,7 @@ static void __ieee80211_disconnect(struc
- 	}
- 	mutex_unlock(&local->mtx);
- 
--	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
-+	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
- 				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
- 
- 	sdata_unlock(sdata);
diff --git a/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch b/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
deleted file mode 100644
index fb5b282d1d..0000000000
--- a/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Fri, 31 Aug 2018 11:31:13 +0300
-Subject: [PATCH] mac80211: shorten the IBSS debug messages
-
-When tracing is enabled, all the debug messages are recorded and must
-not exceed MAX_MSG_LEN (100) columns. Longer debug messages grant the
-user with:
-
-WARNING: CPU: 3 PID: 32642 at /tmp/wifi-core-20180806094828/src/iwlwifi-stack-dev/net/mac80211/./trace_msg.h:32 trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
-Workqueue: phy1 ieee80211_iface_work [mac80211]
- RIP: 0010:trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
- Call Trace:
-  __sdata_dbg+0xbd/0x120 [mac80211]
-  ieee80211_ibss_rx_queued_mgmt+0x15f/0x510 [mac80211]
-  ieee80211_iface_work+0x21d/0x320 [mac80211]
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibs
- 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
- 		return;
- 
--	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
--		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
-+	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
-+	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
- 	sta_info_destroy_addr(sdata, mgmt->sa);
- }
- 
-@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(
- 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
- 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
- 
--	ibss_dbg(sdata,
--		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
--		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
-+	ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
-+	ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
-+		 mgmt->bssid, auth_transaction);
- 
- 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
- 		return;
-@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct
- 		rx_timestamp = drv_get_tsf(local, sdata);
- 	}
- 
--	ibss_dbg(sdata,
--		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-+	ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
- 		 mgmt->sa, mgmt->bssid,
--		 (unsigned long long)rx_timestamp,
-+		 (unsigned long long)rx_timestamp);
-+	ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
- 		 (unsigned long long)beacon_timestamp,
- 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
- 		 jiffies);
-@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(
- 
- 	tx_last_beacon = drv_tx_last_beacon(local);
- 
--	ibss_dbg(sdata,
--		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
--		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
-+	ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
-+	ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
-+		 mgmt->bssid, tx_last_beacon);
- 
- 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
- 		return;
diff --git a/package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch b/package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
deleted file mode 100644
index c5c6586652..0000000000
--- a/package/kernel/mac80211/patches/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 22 Sep 2018 15:05:59 +0200
-Subject: [PATCH] mac80211: allocate TXQs for active monitor interfaces
-
-Monitor mode interfaces with the active flag are passed down to the driver.
-Drivers using TXQ expect that all interfaces have allocated TXQs before
-they get added.
-
-Fixes: 79af1f866193d ("mac80211: avoid allocating TXQs that won't be used")
-Cc: stable@vger.kernel.org
-Reported-by: Catrinel Catrinescu <cc@80211.de>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -1816,7 +1816,8 @@ int ieee80211_if_add(struct ieee80211_lo
- 
- 		if (local->ops->wake_tx_queue &&
- 		    type != NL80211_IFTYPE_AP_VLAN &&
--		    type != NL80211_IFTYPE_MONITOR)
-+		    (type != NL80211_IFTYPE_MONITOR ||
-+		     (params->flags & MONITOR_FLAG_ACTIVE)))
- 			txq_size += sizeof(struct txq_info) +
- 				    local->hw.txq_data_size;
- 
diff --git a/package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch b/package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
deleted file mode 100644
index a42668d069..0000000000
--- a/package/kernel/mac80211/patches/395-mac80211-fix-setting-IEEE80211_KEY_FLAG_RX_MGMT-for-.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 29 Sep 2018 15:55:44 +0200
-Subject: [PATCH] mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode
- keys
-
-key->sta is only valid after ieee80211_key_link, which is called later
-in this function. Because of that, the IEEE80211_KEY_FLAG_RX_MGMT is
-never set when management frame protection is enabled.
-
-Fixes: e548c49e6dc6b ("mac80211: add key flag for management keys")
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -426,7 +426,7 @@ static int ieee80211_add_key(struct wiph
- 	case NL80211_IFTYPE_AP:
- 	case NL80211_IFTYPE_AP_VLAN:
- 		/* Keys without a station are used for TX only */
--		if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))
-+		if (sta && test_sta_flag(sta, WLAN_STA_MFP))
- 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
- 		break;
- 	case NL80211_IFTYPE_ADHOC:
diff --git a/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch b/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
deleted file mode 100644
index 4819dfc648..0000000000
--- a/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Sara Sharon <sara.sharon@intel.com>
-Date: Thu, 11 Oct 2018 14:21:21 +0200
-Subject: [PATCH] mac80211: free skb fraglist before freeing the skb
-
-mac80211 uses the frag list to build AMSDU. When freeing
-the skb, it may not be really freed, since someone is still
-holding a reference to it.
-In that case, when TCP skb is being retransmitted, the
-pointer to the frag list is being reused, while the data
-in there is no longer valid.
-Since we will never get frag list from the network stack,
-as mac80211 doesn't advertise the capability, we can safely
-free and nullify it before releasing the SKB.
-
-Signed-off-by: Sara Sharon <sara.sharon@intel.com>
----
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -550,6 +550,11 @@ static void ieee80211_report_used_skb(st
- 	}
- 
- 	ieee80211_led_tx(local);
-+
-+	if (skb_has_frag_list(skb)) {
-+		kfree_skb_list(skb_shinfo(skb)->frag_list);
-+		skb_shinfo(skb)->frag_list = NULL;
-+	}
- }
- 
- /*
diff --git a/package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch b/package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch
deleted file mode 100644
index 0269da126d..0000000000
--- a/package/kernel/mac80211/patches/397-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 13 Nov 2018 20:29:03 +0100
-Subject: [PATCH] mac80211: ignore tx status for PS stations in
- ieee80211_tx_status_ext
-
-Make it behave like regular ieee80211_tx_status calls, except for the lack of
-filtered frame processing.
-This fixes spurious low-ack triggered disconnections with powersave clients
-connected to an AP.
-
-Fixes: f027c2aca0cf4 ("mac80211: add ieee80211_tx_status_noskb")
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -976,6 +976,8 @@ void ieee80211_tx_status_ext(struct ieee
- 			/* Track when last TDLS packet was ACKed */
- 			if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
- 				sta->status_stats.last_tdls_pkt_time = jiffies;
-+		} else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
-+			return;
- 		} else {
- 			ieee80211_lost_packet(sta, info);
- 		}
diff --git a/package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch b/package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
deleted file mode 100644
index 7865606f94..0000000000
--- a/package/kernel/mac80211/patches/457-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Mon, 22 Apr 2019 22:41:23 +0200
-Subject: [PATCH] brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11
- mini PCs
-
-The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
-and product_name DMI strings, without this patch brcmfmac will try to load:
-"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
-is way too generic.
-
-The DMI strings on which we are matching are somewhat generic too, but
-"To be filled by O.E.M." is less common then "Default string" and the
-system-sku and bios-version strings are pretty unique. Beside the DMI
-strings we also check the wifi-module chip-id and revision. I'm confident
-that the combination of all this is unique.
-
-Both the T8 and T11 use the same wifi-module, this commit adds DMI
-quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
-
-BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
-Cc: stable@vger.kernel.org
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/dmi.c         | 26 +++++++++++++++++++
- 1 file changed, 26 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
-@@ -31,6 +31,10 @@ struct brcmf_dmi_data {
- 
- /* NOTE: Please keep all entries sorted alphabetically */
- 
-+static const struct brcmf_dmi_data acepc_t8_data = {
-+	BRCM_CC_4345_CHIP_ID, 6, "acepc-t8"
-+};
-+
- static const struct brcmf_dmi_data gpd_win_pocket_data = {
- 	BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
- };
-@@ -45,6 +49,28 @@ static const struct brcmf_dmi_data meego
- 
- static const struct dmi_system_id dmi_platform_data[] = {
- 	{
-+		/* ACEPC T8 Cherry Trail Z8350 mini PC */
-+		.matches = {
-+			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
-+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
-+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
-+			/* also match on somewhat unique bios-version */
-+			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
-+		},
-+		.driver_data = (void *)&acepc_t8_data,
-+	},
-+	{
-+		/* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */
-+		.matches = {
-+			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
-+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
-+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
-+			/* also match on somewhat unique bios-version */
-+			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
-+		},
-+		.driver_data = (void *)&acepc_t8_data,
-+	},
-+	{
- 		/* Match for the GPDwin which unfortunately uses somewhat
- 		 * generic dmi strings, which is why we test for 4 strings.
- 		 * Comparing against 23 other byt/cht boards, board_vendor
diff --git a/package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch b/package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
deleted file mode 100644
index 1fcf8c70c7..0000000000
--- a/package/kernel/mac80211/patches/458-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc Mon Sep 17 00:00:00 2001
-From: Wright Feng <Wright.Feng@cypress.com>
-Date: Fri, 26 Apr 2019 03:12:32 +0000
-Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware
- device
-
-For PCIE wireless device with core revision less than 14, device may miss
-PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
-mail box interrupt twice as a hardware workaround.
-
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -675,6 +675,7 @@ static int
- brcmf_pcie_send_mb_data(struct brcmf_pciedev_info *devinfo, u32 htod_mb_data)
- {
- 	struct brcmf_pcie_shared_info *shared;
-+	struct brcmf_core *core;
- 	u32 addr;
- 	u32 cur_htod_mb_data;
- 	u32 i;
-@@ -698,7 +699,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci
- 
- 	brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data);
- 	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
--	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
-+
-+	/* Send mailbox interrupt twice as a hardware workaround */
-+	core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
-+	if (core->rev <= 13)
-+		pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
- 
- 	return 0;
- }
diff --git a/package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch b/package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
deleted file mode 100644
index b4d56c34bc..0000000000
--- a/package/kernel/mac80211/patches/459-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d Mon Sep 17 00:00:00 2001
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Wed, 24 Apr 2019 12:52:18 +0300
-Subject: [PATCH] brcm80211: potential NULL dereference in
- brcmf_cfg80211_vndr_cmds_dcmd_handler()
-
-If "ret_len" is negative then it could lead to a NULL dereference.
-
-The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative
-then we don't allocate the "dcmd_buf" buffer.  Then we pass "ret_len" to
-brcmf_fil_cmd_data_set() where it is cast to a very high u32 value.
-Most of the functions in that call tree check whether the buffer we pass
-is NULL but there are at least a couple places which don't such as
-brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd().  We memcpy() to and
-from the buffer so it would result in a NULL dereference.
-
-The fix is to change the types so that "ret_len" can't be negative.  (If
-we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an
-issue).
-
-Fixes: 1bacb0487d0e ("brcmfmac: replace cfg80211 testmode with vendor command")
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
-@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
- 	struct brcmf_if *ifp;
- 	const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
- 	struct sk_buff *reply;
--	int ret, payload, ret_len;
-+	unsigned int payload, ret_len;
- 	void *dcmd_buf = NULL, *wr_pointer;
- 	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
-+	int ret;
- 
- 	if (len < sizeof(*cmdhdr)) {
- 		brcmf_err("vendor command too short: %d\n", len);
-@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
- 			brcmf_err("oversize return buffer %d\n", ret_len);
- 			ret_len = BRCMF_DCMD_MAXLEN;
- 		}
--		payload = max(ret_len, len) + 1;
-+		payload = max_t(unsigned int, ret_len, len) + 1;
- 		dcmd_buf = vzalloc(payload);
- 		if (NULL == dcmd_buf)
- 			return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch b/package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
deleted file mode 100644
index 6702dd57b6..0000000000
--- a/package/kernel/mac80211/patches/460-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 2d91c8ad068a5cad4d9e7ece8dc811a697c7176a Mon Sep 17 00:00:00 2001
-From: Wright Feng <Wright.Feng@cypress.com>
-Date: Fri, 26 Apr 2019 03:41:46 +0000
-Subject: [PATCH] brcmfmac: set txflow request id from 1 to pktids array size
-
-Some PCIE firmwares drop txstatus if pktid is 0 and make packet held in
-host side and never be released. If that packet type is 802.1x, the
-pend_8021x_cnt value will be always greater than 0 and show "Timed out
-waiting for no pending 802.1x packets" error message when sending key to
-dongle every time.
-
-To be compatible with all firmwares, host should set txflow request id
-from 1 instead of from 0.
-
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -375,7 +375,7 @@ brcmf_msgbuf_get_pktid(struct device *de
- 	struct brcmf_msgbuf_pktid *pktid;
- 	struct sk_buff *skb;
- 
--	if (idx >= pktids->array_size) {
-+	if (idx < 0 || idx >= pktids->array_size) {
- 		brcmf_err("Invalid packet id %d (max %d)\n", idx,
- 			  pktids->array_size);
- 		return NULL;
-@@ -747,7 +747,7 @@ static void brcmf_msgbuf_txflow(struct b
- 		tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
- 
- 		tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
--		tx_msghdr->msg.request_id = cpu_to_le32(pktid);
-+		tx_msghdr->msg.request_id = cpu_to_le32(pktid + 1);
- 		tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
- 		tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
- 		tx_msghdr->flags |= (skb->priority & 0x07) <<
-@@ -884,7 +884,7 @@ brcmf_msgbuf_process_txstatus(struct brc
- 	u16 flowid;
- 
- 	tx_status = (struct msgbuf_tx_status *)buf;
--	idx = le32_to_cpu(tx_status->msg.request_id);
-+	idx = le32_to_cpu(tx_status->msg.request_id) - 1;
- 	flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
- 	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
- 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
diff --git a/package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch b/package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
deleted file mode 100644
index ceb85055d5..0000000000
--- a/package/kernel/mac80211/patches/461-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 47dd82e3d25e85a7c7c4e4b0eac9d297d1e5e2d4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 28 Apr 2019 23:38:26 +0200
-Subject: [PATCH] brcmfmac: print firmware messages after a firmware crash
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Normally firmware messages are printed with debugging enabled only. It's
-a good idea as firmware may print a lot of messages that normal users
-don't need to care about.
-
-However, on firmware crash, it may be very helpful to log all recent
-messages. There is almost always a backtrace available as well as rought
-info on the latest actions/state.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/pcie.c        | 24 ++++++++++++++-----
- 1 file changed, 18 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -764,15 +764,22 @@ static void brcmf_pcie_bus_console_init(
- 		  console->base_addr, console->buf_addr, console->bufsize);
- }
- 
--
--static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo)
-+/**
-+ * brcmf_pcie_bus_console_read - reads firmware messages
-+ *
-+ * @error: specifies if error has occurred (prints messages unconditionally)
-+ */
-+static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo,
-+					bool error)
- {
-+	struct pci_dev *pdev = devinfo->pdev;
-+	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
- 	struct brcmf_pcie_console *console;
- 	u32 addr;
- 	u8 ch;
- 	u32 newidx;
- 
--	if (!BRCMF_FWCON_ON())
-+	if (!error && !BRCMF_FWCON_ON())
- 		return;
- 
- 	console = &devinfo->shared.console;
-@@ -796,7 +803,10 @@ static void brcmf_pcie_bus_console_read(
- 		}
- 		if (ch == '\n') {
- 			console->log_str[console->log_idx] = 0;
--			pr_debug("CONSOLE: %s", console->log_str);
-+			if (error)
-+				brcmf_err(bus, "CONSOLE: %s", console->log_str);
-+			else
-+				pr_debug("CONSOLE: %s", console->log_str);
- 			console->log_idx = 0;
- 		}
- 	}
-@@ -857,7 +867,7 @@ static irqreturn_t brcmf_pcie_isr_thread
- 							&devinfo->pdev->dev);
- 		}
- 	}
--	brcmf_pcie_bus_console_read(devinfo);
-+	brcmf_pcie_bus_console_read(devinfo, false);
- 	if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
- 		brcmf_pcie_intr_enable(devinfo);
- 	devinfo->in_irq = false;
-@@ -1426,6 +1436,8 @@ static int brcmf_pcie_reset(struct devic
- 	struct brcmf_fw_request *fwreq;
- 	int err;
- 
-+	brcmf_pcie_bus_console_read(devinfo, true);
-+
- 	brcmf_detach(dev);
- 
- 	brcmf_pcie_release_irq(devinfo);
-@@ -1818,7 +1830,7 @@ static void brcmf_pcie_setup(struct devi
- 	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
- 		return;
- 
--	brcmf_pcie_bus_console_read(devinfo);
-+	brcmf_pcie_bus_console_read(devinfo, false);
- 
- fail:
- 	device_release_driver(dev);
diff --git a/package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch b/package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
deleted file mode 100644
index 8731a99fd7..0000000000
--- a/package/kernel/mac80211/patches/467-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From bbfab331e3abd9fa8767eea6bf5c4684cdd4b934 Mon Sep 17 00:00:00 2001
-From: Neo Jou <neojou@gmail.com>
-Date: Tue, 21 May 2019 17:12:20 +0800
-Subject: [PATCH] brcmfmac: use strlcpy() instead of strcpy()
-
-The function strcpy() is inherently not safe. Though the function
-works without problems here, it would be better to use other safer
-function, e.g. strlcpy(), to replace strcpy() still.
-
-Signed-off-by: Neo Jou <neojou@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -269,7 +269,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 
- 	/* query for 'ver' to get version info from firmware */
- 	memset(buf, 0, sizeof(buf));
--	strcpy(buf, "ver");
-+	strlcpy(buf, "ver", sizeof(buf));
- 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
- 	if (err < 0) {
- 		bphy_err(drvr, "Retrieving version information failed, %d\n",
diff --git a/package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch b/package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
deleted file mode 100644
index d7dce12d93..0000000000
--- a/package/kernel/mac80211/patches/468-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From f491645f039420fb7e14283e21b90772571c807c Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 10:45:30 +0200
-Subject: [PATCH] brcmfmac: add 160MHz in chandef_to_chanspec()
-
-The function chandef_to_chanspec() was not handling 160MHz bandwidth
-resulting in wrong encoding of the channel. That resulting in firmware
-rejecting the provided channel specification.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 21 ++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -287,8 +287,26 @@ static u16 chandef_to_chanspec(struct br
- 		else
- 			ch_inf.sb = BRCMU_CHAN_SB_UU;
- 		break;
--	case NL80211_CHAN_WIDTH_80P80:
- 	case NL80211_CHAN_WIDTH_160:
-+		ch_inf.bw = BRCMU_CHAN_BW_160;
-+		if (primary_offset == -70)
-+			ch_inf.sb = BRCMU_CHAN_SB_LLL;
-+		else if (primary_offset == -50)
-+			ch_inf.sb = BRCMU_CHAN_SB_LLU;
-+		else if (primary_offset == -30)
-+			ch_inf.sb = BRCMU_CHAN_SB_LUL;
-+		else if (primary_offset == -10)
-+			ch_inf.sb = BRCMU_CHAN_SB_LUU;
-+		else if (primary_offset == 10)
-+			ch_inf.sb = BRCMU_CHAN_SB_ULL;
-+		else if (primary_offset == 30)
-+			ch_inf.sb = BRCMU_CHAN_SB_ULU;
-+		else if (primary_offset == 50)
-+			ch_inf.sb = BRCMU_CHAN_SB_UUL;
-+		else
-+			ch_inf.sb = BRCMU_CHAN_SB_UUU;
-+		break;
-+	case NL80211_CHAN_WIDTH_80P80:
- 	case NL80211_CHAN_WIDTH_5:
- 	case NL80211_CHAN_WIDTH_10:
- 	default:
-@@ -307,6 +325,7 @@ static u16 chandef_to_chanspec(struct br
- 	}
- 	d11inf->encchspec(&ch_inf);
- 
-+	brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
- 	return ch_inf.chspec;
- }
- 
diff --git a/package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch b/package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
deleted file mode 100644
index 2b06acfbab..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-From a84a60ccdd65278485fb495f468a5ab91a75c649 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:06 +0200
-Subject: [PATCH] Revert "brcmfmac: fix NULL pointer derefence during USB
- disconnect"
-
-This reverts commit 5cdb0ef6144f47440850553579aa923c20a63f23. Subsequent
-changes make rework the driver code fixing the issue differently.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++---------
- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  |  6 ++----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  4 +---
- .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++------------
- .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 +--
- .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++--------
- .../wireless/broadcom/brcm80211/brcmfmac/proto.h |  3 +--
- 7 files changed, 13 insertions(+), 40 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -490,18 +490,11 @@ fail:
- 	return -ENOMEM;
- }
- 
--void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
--{
--	struct brcmf_bcdc *bcdc = drvr->proto->pd;
--
--	brcmf_fws_detach_pre_delif(bcdc->fws);
--}
--
--void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
-+void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_bcdc *bcdc = drvr->proto->pd;
- 
- 	drvr->proto->pd = NULL;
--	brcmf_fws_detach_post_delif(bcdc->fws);
-+	brcmf_fws_detach(bcdc->fws);
- 	kfree(bcdc);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
-@@ -18,16 +18,14 @@
- 
- #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
- int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
--void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
--void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
-+void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
- void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
- void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
- 				 bool success);
- struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
- #else
- static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
--static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
--static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
-+static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
- #endif
- 
- #endif /* BRCMFMAC_BCDC_H */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1344,8 +1344,6 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
- 
--	brcmf_proto_detach_pre_delif(drvr);
--
- 	/* make sure primary interface removed last */
- 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
- 		brcmf_remove_interface(drvr->iflist[i], false);
-@@ -1355,7 +1353,7 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_bus_stop(drvr->bus_if);
- 
--	brcmf_proto_detach_post_delif(drvr);
-+	brcmf_proto_detach(drvr);
- 
- 	bus_if->drvr = NULL;
- 	wiphy_free(drvr->wiphy);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2416,25 +2416,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
- 	return fws;
- 
- fail:
--	brcmf_fws_detach_pre_delif(fws);
--	brcmf_fws_detach_post_delif(fws);
-+	brcmf_fws_detach(fws);
- 	return ERR_PTR(rc);
- }
- 
--void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
-+void brcmf_fws_detach(struct brcmf_fws_info *fws)
- {
- 	if (!fws)
- 		return;
--	if (fws->fws_wq) {
--		destroy_workqueue(fws->fws_wq);
--		fws->fws_wq = NULL;
--	}
--}
- 
--void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
--{
--	if (!fws)
--		return;
-+	if (fws->fws_wq)
-+		destroy_workqueue(fws->fws_wq);
- 
- 	/* cleanup */
- 	brcmf_fws_lock(fws);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-@@ -19,8 +19,7 @@
- #define FWSIGNAL_H_
- 
- struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
--void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
--void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
-+void brcmf_fws_detach(struct brcmf_fws_info *fws);
- void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
- bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
- bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-@@ -67,22 +67,16 @@ fail:
- 	return -ENOMEM;
- }
- 
--void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
-+void brcmf_proto_detach(struct brcmf_pub *drvr)
- {
- 	brcmf_dbg(TRACE, "Enter\n");
- 
- 	if (drvr->proto) {
- 		if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
--			brcmf_proto_bcdc_detach_post_delif(drvr);
-+			brcmf_proto_bcdc_detach(drvr);
- 		else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
- 			brcmf_proto_msgbuf_detach(drvr);
- 		kfree(drvr->proto);
- 		drvr->proto = NULL;
- 	}
- }
--
--void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
--{
--	if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
--		brcmf_proto_bcdc_detach_pre_delif(drvr);
--}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -54,8 +54,7 @@ struct brcmf_proto {
- 
- 
- int brcmf_proto_attach(struct brcmf_pub *drvr);
--void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
--void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
-+void brcmf_proto_detach(struct brcmf_pub *drvr);
- 
- static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
- 				      struct sk_buff *skb,
diff --git a/package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch b/package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
deleted file mode 100644
index 52657c3288..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 14fcfd1cc0c05ea58f47dd693fdd13f25dfe995e Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:07 +0200
-Subject: [PATCH] brcmfmac: change the order of things in brcmf_detach()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When brcmf_detach() from the bus layer upon rmmod we can no longer
-communicate. Hence we will set the bus state to DOWN and cleanup
-the event and protocol layer. The network interfaces need to be
-deleted before brcmf_cfg80211_detach() because the latter does the
-wiphy_unregister() which issues a warning if there are still network
-devices linked to the wiphy instance.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Tested-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/core.c        | 27 ++++++++++---------
- 1 file changed, 14 insertions(+), 13 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1337,25 +1337,26 @@ void brcmf_detach(struct device *dev)
- 	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
- #endif
- 
--	/* stop firmware event handling */
--	brcmf_fweh_detach(drvr);
--	if (drvr->config)
--		brcmf_p2p_detach(&drvr->config->p2p);
--
- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
--
--	/* make sure primary interface removed last */
--	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
--		brcmf_remove_interface(drvr->iflist[i], false);
--
--	brcmf_cfg80211_detach(drvr->config);
--	drvr->config = NULL;
--
- 	brcmf_bus_stop(drvr->bus_if);
- 
-+	brcmf_fweh_detach(drvr);
- 	brcmf_proto_detach(drvr);
- 
-+	/* make sure primary interface removed last */
-+	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
-+		if (drvr->iflist[i])
-+			brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
-+	}
-+
-+	if (drvr->config) {
-+		brcmf_p2p_detach(&drvr->config->p2p);
-+		brcmf_cfg80211_detach(drvr->config);
-+		drvr->config = NULL;
-+	}
-+
- 	bus_if->drvr = NULL;
-+
- 	wiphy_free(drvr->wiphy);
- }
- 
diff --git a/package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch b/package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
deleted file mode 100644
index 2b2f37b558..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From c613085b74941024194e41b200601b9aa6ee388f Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:08 +0200
-Subject: [PATCH] brcmfmac: avoid firmware command in brcmf_netdev_open() when
- bus is down
-
-No point in sending a firmware command when bus is down so make it
-conditional checking the state.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -589,7 +589,8 @@ static int brcmf_netdev_stop(struct net_
- 
- 	brcmf_cfg80211_down(ndev);
- 
--	brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear", NULL, 0);
-+	if (ifp->drvr->bus_if->state == BRCMF_BUS_UP)
-+		brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear", NULL, 0);
- 
- 	brcmf_net_setcarrier(ifp, false);
- 
diff --git a/package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch b/package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
deleted file mode 100644
index 1bb6c4b21d..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From c33330ac06fe863289643e7a13ecdb6a2502dad7 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:09 +0200
-Subject: [PATCH] brcmfmac: clear events in brcmf_fweh_detach() will always
- fail
-
-Clearing firmware events in brcmf_fweh_detach() is always failing
-because it is called only upon driver remove and communication
-with firmware is no longer possible.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 9 ---------
- 1 file changed, 9 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -314,16 +314,7 @@ void brcmf_fweh_attach(struct brcmf_pub
- void brcmf_fweh_detach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_fweh_info *fweh = &drvr->fweh;
--	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
--	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
- 
--	if (ifp) {
--		/* clear all events */
--		memset(eventmask, 0, BRCMF_EVENTING_MASK_LEN);
--		(void)brcmf_fil_iovar_data_set(ifp, "event_msgs",
--					       eventmask,
--					       BRCMF_EVENTING_MASK_LEN);
--	}
- 	/* cancel the worker */
- 	cancel_work_sync(&fweh->event_work);
- 	WARN_ON(!list_empty(&fweh->event_q));
diff --git a/package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch b/package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
deleted file mode 100644
index 0a418433dd..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 1ac11ae949dd883854f4523ef8e3a32aabfd6256 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:10 +0200
-Subject: [PATCH] brcmfmac: avoid firmware commands when bus is down
-
-Upon rmmod a few attempts are made to inform firmware, but there is
-no point as the bus is down and these will fail. Avoid them to keep
-the logs clean.
-
-Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 23 +++++++++++--------
- 1 file changed, 13 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1297,17 +1297,21 @@ static void brcmf_link_down(struct brcmf
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
- 	struct brcmf_pub *drvr = cfg->pub;
-+	bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
- 	s32 err = 0;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
- 	if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
--		brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
--		err = brcmf_fil_cmd_data_set(vif->ifp,
--					     BRCMF_C_DISASSOC, NULL, 0);
--		if (err) {
--			bphy_err(drvr, "WLC_DISASSOC failed (%d)\n", err);
-+		if (bus_up) {
-+			brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
-+			err = brcmf_fil_cmd_data_set(vif->ifp,
-+						     BRCMF_C_DISASSOC, NULL, 0);
-+			if (err)
-+				bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
-+					 err);
- 		}
-+
- 		if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
- 		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
- 			cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
-@@ -1317,7 +1321,8 @@ static void brcmf_link_down(struct brcmf
- 	clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
- 	brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
- 	if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
--		brcmf_set_pmk(vif->ifp, NULL, 0);
-+		if (bus_up)
-+			brcmf_set_pmk(vif->ifp, NULL, 0);
- 		vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
- 	}
- 	brcmf_dbg(TRACE, "Exit\n");
-@@ -5006,18 +5011,16 @@ static int brcmf_cfg80211_get_channel(st
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct net_device *ndev = wdev->netdev;
- 	struct brcmf_pub *drvr = cfg->pub;
--	struct brcmf_if *ifp;
- 	struct brcmu_chan ch;
- 	enum nl80211_band band = 0;
- 	enum nl80211_chan_width width = 0;
- 	u32 chanspec;
- 	int freq, err;
- 
--	if (!ndev)
-+	if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
- 		return -ENODEV;
--	ifp = netdev_priv(ndev);
- 
--	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
-+	err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
- 	if (err) {
- 		bphy_err(drvr, "chanspec failed (%d)\n", err);
- 		return err;
diff --git a/package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch b/package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
deleted file mode 100644
index c9bb1e82e9..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From e0bfb9601d4812719167cc4124a0d6db1e2f55e4 Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:11 +0200
-Subject: [PATCH] brcmfmac: simply remove flowring if bus is down
-
-When the bus is down, eg. due to rmmod, there is no need to
-attempt to inform firmware about it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1408,6 +1408,13 @@ void brcmf_msgbuf_delete_flowring(struct
- 	u8 ifidx;
- 	int err;
- 
-+	/* no need to submit if firmware can not be reached */
-+	if (drvr->bus_if->state != BRCMF_BUS_UP) {
-+		brcmf_dbg(MSGBUF, "bus down, flowring will be removed\n");
-+		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
-+		return;
-+	}
-+
- 	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
- 	brcmf_commonring_lock(commonring);
- 	ret_ptr = brcmf_commonring_reserve_for_write(commonring);
diff --git a/package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch b/package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
deleted file mode 100644
index d9f129c273..0000000000
--- a/package/kernel/mac80211/patches/469-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 4b11c915f00caeef3292ed0429acc579b9da762a Mon Sep 17 00:00:00 2001
-From: Arend van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 11 Jul 2019 11:05:12 +0200
-Subject: [PATCH] brcmfmac: remove unnecessary strlcpy() upon obtaining "ver"
- iovar
-
-Recently a strcpy() was replaced by strlcpy(). However, the strcpy()
-was not needed in the first place. So removing that line of code.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 -
- 1 file changed, 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -269,7 +269,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 
- 	/* query for 'ver' to get version info from firmware */
- 	memset(buf, 0, sizeof(buf));
--	strlcpy(buf, "ver", sizeof(buf));
- 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
- 	if (err < 0) {
- 		bphy_err(drvr, "Retrieving version information failed, %d\n",
diff --git a/package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch b/package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
deleted file mode 100644
index 76ab29a6a0..0000000000
--- a/package/kernel/mac80211/patches/470-v5.4-brcmfmac-don-t-net_ratelimit-CONSOLE-messages-on-fir.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From e3b1d879ccda9ffd5332777bb1beeb2cc913faa8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 21 Jul 2019 21:52:17 +0200
-Subject: [PATCH] brcmfmac: don't net_ratelimit() CONSOLE messages on firmware
- crash
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Firmware crash is a pretty rare event and can't happen too frequently as
-it has to be followed by a hardware reinitialization and config reload.
-It should be safe to don't use net_ratelimit() when it happens.
-
-For reporting & debugging purposes it's important to provide a complete
-log as the last lines are actually the most important. This change
-modifies brcmfmac to print all messages in an unlimited way in that
-specific case. With this change there should be finally a backtrace of
-firmware finally visible after a crash.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -804,7 +804,8 @@ static void brcmf_pcie_bus_console_read(
- 		if (ch == '\n') {
- 			console->log_str[console->log_idx] = 0;
- 			if (error)
--				brcmf_err(bus, "CONSOLE: %s", console->log_str);
-+				__brcmf_err(bus, __func__, "CONSOLE: %s",
-+					    console->log_str);
- 			else
- 				pr_debug("CONSOLE: %s", console->log_str);
- 			console->log_idx = 0;
diff --git a/package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch b/package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch
deleted file mode 100644
index 831c534762..0000000000
--- a/package/kernel/mac80211/patches/552-ath9k-dynack-use-authentication-messages-for-late-ac.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Fri, 2 Nov 2018 21:49:55 +0100
-Subject: [PATCH] ath9k: dynack: use authentication messages for 'late' ack
-
-In order to properly support dynack in ad-hoc mode running
-wpa_supplicant, take into account authentication frames for
-'late ack' detection. This patch has been tested on devices
-mounted on offshore high-voltage stations connected through
-~24Km link
-
-Reported-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
-Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/dynack.c
-+++ b/drivers/net/wireless/ath/ath9k/dynack.c
-@@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_
- 	/* late ACK */
- 	if (ts->ts_status & ATH9K_TXERR_XRETRY) {
- 		if (ieee80211_is_assoc_req(hdr->frame_control) ||
--		    ieee80211_is_assoc_resp(hdr->frame_control)) {
-+		    ieee80211_is_assoc_resp(hdr->frame_control) ||
-+		    ieee80211_is_auth(hdr->frame_control)) {
- 			ath_dbg(common, DYNACK, "late ack\n");
- 			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
- 			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
diff --git a/package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch b/package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch
deleted file mode 100644
index cc5cdf9233..0000000000
--- a/package/kernel/mac80211/patches/554-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Fri, 2 Nov 2018 21:49:57 +0100
-Subject: [PATCH] ath9k: dynack: check da->enabled first in sampling
- routines
-
-Check da->enabled flag first in ath_dynack_sample_tx_ts and
-ath_dynack_sample_ack_ts routines in order to avoid useless
-processing
-
-Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/dynack.c
-+++ b/drivers/net/wireless/ath/ath9k/dynack.c
-@@ -178,7 +178,7 @@ void ath_dynack_sample_tx_ts(struct ath_
- 	u32 dur = ts->duration;
- 	u8 ridx;
- 
--	if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled)
-+	if (!da->enabled || (info->flags & IEEE80211_TX_CTL_NO_ACK))
- 		return;
- 
- 	spin_lock_bh(&da->qlock);
-@@ -251,7 +251,7 @@ void ath_dynack_sample_ack_ts(struct ath
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- 
--	if (!ath_dynack_bssidmask(ah, hdr->addr1) || !da->enabled)
-+	if (!da->enabled || !ath_dynack_bssidmask(ah, hdr->addr1))
- 		return;
- 
- 	spin_lock_bh(&da->qlock);
diff --git a/package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch b/package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch
deleted file mode 100644
index 7735c9782d..0000000000
--- a/package/kernel/mac80211/patches/555-ath9k-dynack-make-ewma-estimation-faster.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Fri, 2 Nov 2018 21:49:58 +0100
-Subject: [PATCH] ath9k: dynack: make ewma estimation faster
-
-In order to make propagation time estimation faster,
-use current sample as ewma output value during 'late ack'
-tracking
-
-Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -273,7 +273,7 @@ struct ath_node {
- #endif
- 	u8 key_idx[4];
- 
--	u32 ackto;
-+	int ackto;
- 	struct list_head list;
- };
- 
---- a/drivers/net/wireless/ath/ath9k/dynack.c
-+++ b/drivers/net/wireless/ath/ath9k/dynack.c
-@@ -29,9 +29,13 @@
-  * ath_dynack_ewma - EWMA (Exponentially Weighted Moving Average) calculation
-  *
-  */
--static inline u32 ath_dynack_ewma(u32 old, u32 new)
-+static inline int ath_dynack_ewma(int old, int new)
- {
--	return (new * (EWMA_DIV - EWMA_LEVEL) + old * EWMA_LEVEL) / EWMA_DIV;
-+	if (old > 0)
-+		return (new * (EWMA_DIV - EWMA_LEVEL) +
-+			old * EWMA_LEVEL) / EWMA_DIV;
-+	else
-+		return new;
- }
- 
- /**
-@@ -82,10 +86,10 @@ static inline bool ath_dynack_bssidmask(
-  */
- static void ath_dynack_compute_ackto(struct ath_hw *ah)
- {
--	struct ath_node *an;
--	u32 to = 0;
--	struct ath_dynack *da = &ah->dynack;
- 	struct ath_common *common = ath9k_hw_common(ah);
-+	struct ath_dynack *da = &ah->dynack;
-+	struct ath_node *an;
-+	int to = 0;
- 
- 	list_for_each_entry(an, &da->nodes, list)
- 		if (an->ackto > to)
-@@ -144,7 +148,8 @@ static void ath_dynack_compute_to(struct
- 					an->ackto = ath_dynack_ewma(an->ackto,
- 								    ackto);
- 					ath_dbg(ath9k_hw_common(ah), DYNACK,
--						"%pM to %u\n", dst, an->ackto);
-+						"%pM to %d [%u]\n", dst,
-+						an->ackto, ackto);
- 					if (time_is_before_jiffies(da->lto)) {
- 						ath_dynack_compute_ackto(ah);
- 						da->lto = jiffies + COMPUTE_TO;
-@@ -166,10 +171,12 @@ static void ath_dynack_compute_to(struct
-  * @ah: ath hw
-  * @skb: socket buffer
-  * @ts: tx status info
-+ * @sta: station pointer
-  *
-  */
- void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
--			     struct ath_tx_status *ts)
-+			     struct ath_tx_status *ts,
-+			     struct ieee80211_sta *sta)
- {
- 	struct ieee80211_hdr *hdr;
- 	struct ath_dynack *da = &ah->dynack;
-@@ -191,9 +198,16 @@ void ath_dynack_sample_tx_ts(struct ath_
- 		    ieee80211_is_assoc_resp(hdr->frame_control) ||
- 		    ieee80211_is_auth(hdr->frame_control)) {
- 			ath_dbg(common, DYNACK, "late ack\n");
-+
- 			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
- 			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
- 			ath9k_hw_set_cts_timeout(ah, LATEACK_TO);
-+			if (sta) {
-+				struct ath_node *an;
-+
-+				an = (struct ath_node *)sta->drv_priv;
-+				an->ackto = -1;
-+			}
- 			da->lto = jiffies + LATEACK_DELAY;
- 		}
- 
---- a/drivers/net/wireless/ath/ath9k/dynack.h
-+++ b/drivers/net/wireless/ath/ath9k/dynack.h
-@@ -86,7 +86,8 @@ void ath_dynack_node_deinit(struct ath_h
- void ath_dynack_init(struct ath_hw *ah);
- void ath_dynack_sample_ack_ts(struct ath_hw *ah, struct sk_buff *skb, u32 ts);
- void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
--			     struct ath_tx_status *ts);
-+			     struct ath_tx_status *ts,
-+			     struct ieee80211_sta *sta);
- #else
- static inline void ath_dynack_init(struct ath_hw *ah) {}
- static inline void ath_dynack_node_init(struct ath_hw *ah,
-@@ -97,7 +98,8 @@ static inline void ath_dynack_sample_ack
- 					    struct sk_buff *skb, u32 ts) {}
- static inline void ath_dynack_sample_tx_ts(struct ath_hw *ah,
- 					   struct sk_buff *skb,
--					   struct ath_tx_status *ts) {}
-+					   struct ath_tx_status *ts,
-+					   struct ieee80211_sta *sta) {}
- #endif
- 
- #endif /* DYNACK_H */
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -629,7 +629,7 @@ static void ath_tx_complete_aggr(struct
- 				if (bf == bf->bf_lastbf)
- 					ath_dynack_sample_tx_ts(sc->sc_ah,
- 								bf->bf_mpdu,
--								ts);
-+								ts, sta);
- 			}
- 
- 			ath_tx_complete_buf(sc, bf, txq, &bf_head, sta, ts,
-@@ -773,7 +773,8 @@ static void ath_tx_process_buffer(struct
- 			memcpy(info->control.rates, bf->rates,
- 			       sizeof(info->control.rates));
- 			ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
--			ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts);
-+			ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts,
-+						sta);
- 		}
- 		ath_tx_complete_buf(sc, bf, txq, bf_head, sta, ts, txok);
- 	} else
diff --git a/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch b/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
deleted file mode 100644
index 5127c5cfe4..0000000000
--- a/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From 4f16582c93a71eba9d389e0f0a8aa9099a9587cd Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:26 +0100
-Subject: [PATCH] rt2x00: rt2800lib: enable support for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9403,6 +9403,7 @@ static int rt2800_probe_rt(struct rt2x00
- 	case RT3390:
- 	case RT3572:
- 	case RT3593:
-+	case RT3883:
- 	case RT5350:
- 	case RT5390:
- 	case RT5392:
diff --git a/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch b/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
deleted file mode 100644
index 60e57c1bae..0000000000
--- a/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From ecb394ccf248d8652c463133c4f404458a57a9c1 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:26 +0100
-Subject: [PATCH] rt2x00: rt2800lib: add rf_vals for RF3853
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800.h    |    4 +-
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   65 +++++++++++++++++++++++++++++++
- 2 files changed, 68 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -48,7 +48,8 @@
-  * RF2853 2.4G/5G 3T3R
-  * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
-  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
-- * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
-+ * RF3053 2.4G/5G 3T3R(RT3563/RT3573/RT3593)
-+ * RF3853 2.4G/5G 3T3R(RT3883/RT3662)
-  * RF5592 2.4G/5G 2T2R
-  * RF3070 2.4G 1T1R
-  * RF5360 2.4G 1T1R
-@@ -72,6 +73,7 @@
- #define RF5592				0x000f
- #define RF3070				0x3070
- #define RF3290				0x3290
-+#define RF3853				0x3853
- #define RF5350				0x5350
- #define RF5360				0x5360
- #define RF5362				0x5362
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8981,6 +8981,66 @@ static const struct rf_channel rf_vals_3
- 	{14,   0xF0,	 2,  0x18},
- };
- 
-+static const struct rf_channel rf_vals_3853[] = {
-+	{1,  241, 6, 2},
-+	{2,  241, 6, 7},
-+	{3,  242, 6, 2},
-+	{4,  242, 6, 7},
-+	{5,  243, 6, 2},
-+	{6,  243, 6, 7},
-+	{7,  244, 6, 2},
-+	{8,  244, 6, 7},
-+	{9,  245, 6, 2},
-+	{10, 245, 6, 7},
-+	{11, 246, 6, 2},
-+	{12, 246, 6, 7},
-+	{13, 247, 6, 2},
-+	{14, 248, 6, 4},
-+
-+	{36, 0x56, 8, 4},
-+	{38, 0x56, 8, 6},
-+	{40, 0x56, 8, 8},
-+	{44, 0x57, 8, 0},
-+	{46, 0x57, 8, 2},
-+	{48, 0x57, 8, 4},
-+	{52, 0x57, 8, 8},
-+	{54, 0x57, 8, 10},
-+	{56, 0x58, 8, 0},
-+	{60, 0x58, 8, 4},
-+	{62, 0x58, 8, 6},
-+	{64, 0x58, 8, 8},
-+
-+	{100, 0x5b, 8, 8},
-+	{102, 0x5b, 8, 10},
-+	{104, 0x5c, 8, 0},
-+	{108, 0x5c, 8, 4},
-+	{110, 0x5c, 8, 6},
-+	{112, 0x5c, 8, 8},
-+	{114, 0x5c, 8, 10},
-+	{116, 0x5d, 8, 0},
-+	{118, 0x5d, 8, 2},
-+	{120, 0x5d, 8, 4},
-+	{124, 0x5d, 8, 8},
-+	{126, 0x5d, 8, 10},
-+	{128, 0x5e, 8, 0},
-+	{132, 0x5e, 8, 4},
-+	{134, 0x5e, 8, 6},
-+	{136, 0x5e, 8, 8},
-+	{140, 0x5f, 8, 0},
-+
-+	{149, 0x5f, 8, 9},
-+	{151, 0x5f, 8, 11},
-+	{153, 0x60, 8, 1},
-+	{157, 0x60, 8, 5},
-+	{159, 0x60, 8, 7},
-+	{161, 0x60, 8, 9},
-+	{165, 0x61, 8, 1},
-+	{167, 0x61, 8, 3},
-+	{169, 0x61, 8, 5},
-+	{171, 0x61, 8, 7},
-+	{173, 0x61, 8, 9},
-+};
-+
- static const struct rf_channel rf_vals_5592_xtal20[] = {
- 	/* Channel, N, K, mod, R */
- 	{1, 482, 4, 10, 3},
-@@ -9244,6 +9304,11 @@ static int rt2800_probe_hw_mode(struct r
- 		spec->channels = rf_vals_3x;
- 		break;
- 
-+	case RF3853:
-+		spec->num_channels = ARRAY_SIZE(rf_vals_3853);
-+		spec->channels = rf_vals_3853;
-+		break;
-+
- 	case RF5592:
- 		reg = rt2800_register_read(rt2x00dev, MAC_DEBUG_INDEX);
- 		if (rt2x00_get_field32(reg, MAC_DEBUG_INDEX_XTAL)) {
diff --git a/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch b/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
deleted file mode 100644
index def2c397fd..0000000000
--- a/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From f8e3fcf18e1f2d7f9e6a9680c5452da090f33d88 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Thu, 1 Aug 2013 14:40:44 +0200
-Subject: [PATCH] rt2x00: rt2800lib: enable VCO calibration for RF3853
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4881,6 +4881,7 @@ void rt2800_vco_calibration(struct rt2x0
- 	case RF3053:
- 	case RF3070:
- 	case RF3290:
-+	case RF3853:
- 	case RF5350:
- 	case RF5360:
- 	case RF5362:
-@@ -9426,6 +9427,7 @@ static int rt2800_probe_hw_mode(struct r
- 	case RF3053:
- 	case RF3070:
- 	case RF3290:
-+	case RF3853:
- 	case RF5350:
- 	case RF5360:
- 	case RF5362:
diff --git a/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch b/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
deleted file mode 100644
index 1d6e312037..0000000000
--- a/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
+++ /dev/null
@@ -1,235 +0,0 @@
-From 6e3a17190815c6aa4dc53c2cfe9125fb1154f187 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:27 +0100
-Subject: [PATCH] rt2x00: rt2800lib: add channel configuration function for
- RF3853
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  208 +++++++++++++++++++++++++++++++
- 1 file changed, 208 insertions(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -2713,6 +2713,211 @@ static void rt2800_config_channel_rf3053
- 	}
- }
- 
-+static void rt2800_config_channel_rf3853(struct rt2x00_dev *rt2x00dev,
-+					 struct ieee80211_conf *conf,
-+					 struct rf_channel *rf,
-+					 struct channel_info *info)
-+{
-+	u8 rfcsr;
-+	u8 bbp;
-+	u8 pwr1, pwr2, pwr3;
-+
-+	const bool txbf_enabled = false; /* TODO */
-+
-+	/* TODO: add band selection */
-+
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
-+	else if (rf->channel < 132)
-+		rt2800_rfcsr_write(rt2x00dev, 6, 0x80);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
-+
-+	rt2800_rfcsr_write(rt2x00dev, 8, rf->rf1);
-+	rt2800_rfcsr_write(rt2x00dev, 9, rf->rf3);
-+
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 11, 0x46);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 11, 0x48);
-+
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 12, 0x1a);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 12, 0x52);
-+
-+	rt2800_rfcsr_write(rt2x00dev, 13, 0x12);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_PLL_PD, 1);
-+
-+	switch (rt2x00dev->default_ant.tx_chain_num) {
-+	case 3:
-+		rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 1);
-+		/* fallthrough */
-+	case 2:
-+		rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 1);
-+		/* fallthrough */
-+	case 1:
-+		rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
-+		break;
-+	}
-+
-+	switch (rt2x00dev->default_ant.rx_chain_num) {
-+	case 3:
-+		rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 1);
-+		/* fallthrough */
-+	case 2:
-+		rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 1);
-+		/* fallthrough */
-+	case 1:
-+		rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
-+		break;
-+	}
-+	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
-+
-+	rt2800_freq_cal_mode1(rt2x00dev);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 30);
-+	if (!conf_is_ht40(conf))
-+		rfcsr &= ~(0x06);
-+	else
-+		rfcsr |= 0x06;
-+	rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-+
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 31, 0xa0);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-+
-+	if (conf_is_ht40(conf))
-+		rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 32, 0xd8);
-+
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 34, 0x3c);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 34, 0x20);
-+
-+	/* loopback RF_BS */
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 36);
-+	if (rf->channel <= 14)
-+		rt2x00_set_field8(&rfcsr, RFCSR36_RF_BS, 1);
-+	else
-+		rt2x00_set_field8(&rfcsr, RFCSR36_RF_BS, 0);
-+	rt2800_rfcsr_write(rt2x00dev, 36, rfcsr);
-+
-+	if (rf->channel <= 14)
-+		rfcsr = 0x23;
-+	else if (rf->channel < 100)
-+		rfcsr = 0x36;
-+	else if (rf->channel < 132)
-+		rfcsr = 0x32;
-+	else
-+		rfcsr = 0x30;
-+
-+	if (txbf_enabled)
-+		rfcsr |= 0x40;
-+
-+	rt2800_rfcsr_write(rt2x00dev, 39, rfcsr);
-+
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 44, 0x93);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 44, 0x9b);
-+
-+	if (rf->channel <= 14)
-+		rfcsr = 0xbb;
-+	else if (rf->channel < 100)
-+		rfcsr = 0xeb;
-+	else if (rf->channel < 132)
-+		rfcsr = 0xb3;
-+	else
-+		rfcsr = 0x9b;
-+	rt2800_rfcsr_write(rt2x00dev, 45, rfcsr);
-+
-+	if (rf->channel <= 14)
-+		rfcsr = 0x8e;
-+	else
-+		rfcsr = 0x8a;
-+
-+	if (txbf_enabled)
-+		rfcsr |= 0x20;
-+
-+	rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
-+
-+	rt2800_rfcsr_write(rt2x00dev, 50, 0x86);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 51);
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 51, 0x75);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 51, 0x51);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 52);
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 52, 0x45);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 52, 0x05);
-+
-+	if (rf->channel <= 14) {
-+		pwr1 = info->default_power1 & 0x1f;
-+		pwr2 = info->default_power2 & 0x1f;
-+		pwr3 = info->default_power3 & 0x1f;
-+	} else {
-+		pwr1 = 0x48 | ((info->default_power1 & 0x18) << 1) |
-+			(info->default_power1 & 0x7);
-+		pwr2 = 0x48 | ((info->default_power2 & 0x18) << 1) |
-+			(info->default_power2 & 0x7);
-+		pwr3 = 0x48 | ((info->default_power3 & 0x18) << 1) |
-+			(info->default_power3 & 0x7);
-+	}
-+
-+	rt2800_rfcsr_write(rt2x00dev, 53, pwr1);
-+	rt2800_rfcsr_write(rt2x00dev, 54, pwr2);
-+	rt2800_rfcsr_write(rt2x00dev, 55, pwr3);
-+
-+	rt2x00_dbg(rt2x00dev, "Channel:%d, pwr1:%02x, pwr2:%02x, pwr3:%02x\n",
-+		   rf->channel, pwr1, pwr2, pwr3);
-+
-+	bbp = (info->default_power1 >> 5) |
-+	      ((info->default_power2 & 0xe0) >> 1);
-+	rt2800_bbp_write(rt2x00dev, 109, bbp);
-+
-+	bbp = rt2800_bbp_read(rt2x00dev, 110);
-+	bbp &= 0x0f;
-+	bbp |= (info->default_power3 & 0xe0) >> 1;
-+	rt2800_bbp_write(rt2x00dev, 110, bbp);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 57);
-+	if (rf->channel <= 14)
-+		rt2800_rfcsr_write(rt2x00dev, 57, 0x6e);
-+	else
-+		rt2800_rfcsr_write(rt2x00dev, 57, 0x3e);
-+
-+	/* Enable RF tuning */
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 3);
-+	rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
-+	rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
-+
-+	udelay(2000);
-+
-+	bbp = rt2800_bbp_read(rt2x00dev, 49);
-+	/* clear update flag */
-+	rt2800_bbp_write(rt2x00dev, 49, bbp & 0xfe);
-+	rt2800_bbp_write(rt2x00dev, 49, bbp);
-+
-+	/* TODO: add calibration for TxBF */
-+}
-+
- #define POWER_BOUND		0x27
- #define POWER_BOUND_5G		0x2b
- 
-@@ -3570,6 +3775,9 @@ static void rt2800_config_channel(struct
- 	case RF3322:
- 		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
- 		break;
-+	case RF3853:
-+		rt2800_config_channel_rf3853(rt2x00dev, conf, rf, info);
-+		break;
- 	case RF3070:
- 	case RF5350:
- 	case RF5360:
diff --git a/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch b/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
deleted file mode 100644
index 6476dc107b..0000000000
--- a/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From afd38ae82226551bf879b6c7c4b620c271fee9d2 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Thu, 1 Aug 2013 14:42:05 +0200
-Subject: [PATCH] rt2x00: rt2800lib: enable RF3853 support
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8906,6 +8906,7 @@ static int rt2800_init_eeprom(struct rt2
- 	case RF3290:
- 	case RF3320:
- 	case RF3322:
-+	case RF3853:
- 	case RF5350:
- 	case RF5360:
- 	case RF5362:
diff --git a/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch b/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
deleted file mode 100644
index 0a931e2026..0000000000
--- a/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 0094872a5e8e4664c6ea1b2dfa487063d39ae363 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:26 +0100
-Subject: [PATCH] rt2x00: rt2800lib: add MAC register initialization for
- RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800.h    |   14 ++++++++++++++
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   19 ++++++++++++++++---
- 2 files changed, 30 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -1727,6 +1727,20 @@
- #define TX_PWR_CFG_9B_STBC_MCS7		FIELD32(0x000000ff)
- 
- /*
-+ * TX_TXBF_CFG:
-+ */
-+#define TX_TXBF_CFG_0			0x138c
-+#define TX_TXBF_CFG_1			0x13a4
-+#define TX_TXBF_CFG_2			0x13a8
-+#define TX_TXBF_CFG_3			0x13ac
-+
-+/*
-+ * TX_FBK_CFG_3S:
-+ */
-+#define TX_FBK_CFG_3S_0			0x13c4
-+#define TX_FBK_CFG_3S_1			0x13c8
-+
-+/*
-  * RX_FILTER_CFG: RX configuration register.
-  */
- #define RX_FILTER_CFG			0x1400
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -5509,6 +5509,12 @@ static int rt2800_init_registers(struct
- 			rt2800_register_write(rt2x00dev, TX_SW_CFG2,
- 					      0x00000000);
- 		}
-+	} else if (rt2x00_rt(rt2x00dev, RT3883)) {
-+		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000402);
-+		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
-+		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00040000);
-+		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_0, 0x8000fc21);
-+		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_3, 0x00009c40);
- 	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
- 		   rt2x00_rt(rt2x00dev, RT5392) ||
- 		   rt2x00_rt(rt2x00dev, RT6352)) {
-@@ -5722,6 +5728,11 @@ static int rt2800_init_registers(struct
- 	reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
- 	rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
- 
-+	if (rt2x00_rt(rt2x00dev, RT3883)) {
-+		rt2800_register_write(rt2x00dev, TX_FBK_CFG_3S_0, 0x12111008);
-+		rt2800_register_write(rt2x00dev, TX_FBK_CFG_3S_1, 0x16151413);
-+	}
-+
- 	reg = rt2800_register_read(rt2x00dev, TX_RTS_CFG);
- 	rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 7);
- 	rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
diff --git a/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch b/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
deleted file mode 100644
index d68ad50447..0000000000
--- a/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 6c2d32478159fffff0b85abb6817a21bb2338231 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:27 +0100
-Subject: [PATCH] rt2x00: rt2800soc: fix rt2800soc_disable_radio for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800soc.c |    9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -51,9 +51,16 @@ static bool rt2800soc_hwcrypt_disabled(s
- 
- static void rt2800soc_disable_radio(struct rt2x00_dev *rt2x00dev)
- {
-+	u32 reg;
-+
- 	rt2800_disable_radio(rt2x00dev);
- 	rt2x00mmio_register_write(rt2x00dev, PWR_PIN_CFG, 0);
--	rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, 0);
-+
-+	reg = 0;
-+	if (rt2x00_rt(rt2x00dev, RT3883))
-+		rt2x00_set_field32(&reg, TX_PIN_CFG_RFTR_EN, 1);
-+
-+	rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, reg);
- }
- 
- static int rt2800soc_set_device_state(struct rt2x00_dev *rt2x00dev,
diff --git a/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch b/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
deleted file mode 100644
index 99f57bcd33..0000000000
--- a/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 84833056aa7dd25f5b097e31c78f2a0914c5160c Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:26 +0100
-Subject: [PATCH] rt2x00: rt2800lib: add BBP register initialization for
- RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   44 +++++++++++++++++++++++++++++++
- 1 file changed, 44 insertions(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -6349,6 +6349,47 @@ static void rt2800_init_bbp_3593(struct
- 		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
- }
- 
-+static void rt2800_init_bbp_3883(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_init_bbp_early(rt2x00dev);
-+
-+	rt2800_bbp_write(rt2x00dev, 4, 0x50);
-+	rt2800_bbp_write(rt2x00dev, 47, 0x48);
-+
-+	rt2800_bbp_write(rt2x00dev, 86, 0x46);
-+	rt2800_bbp_write(rt2x00dev, 88, 0x90);
-+
-+	rt2800_bbp_write(rt2x00dev, 92, 0x02);
-+
-+	rt2800_bbp_write(rt2x00dev, 103, 0xc0);
-+	rt2800_bbp_write(rt2x00dev, 104, 0x92);
-+	rt2800_bbp_write(rt2x00dev, 105, 0x34);
-+	rt2800_bbp_write(rt2x00dev, 106, 0x12);
-+	rt2800_bbp_write(rt2x00dev, 120, 0x50);
-+	rt2800_bbp_write(rt2x00dev, 137, 0x0f);
-+	rt2800_bbp_write(rt2x00dev, 163, 0x9d);
-+
-+	/* Set ITxBF timeout to 0x9C40=1000msec */
-+	rt2800_bbp_write(rt2x00dev, 179, 0x02);
-+	rt2800_bbp_write(rt2x00dev, 180, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 182, 0x40);
-+	rt2800_bbp_write(rt2x00dev, 180, 0x01);
-+	rt2800_bbp_write(rt2x00dev, 182, 0x9c);
-+
-+	rt2800_bbp_write(rt2x00dev, 179, 0x00);
-+
-+	/* Reprogram the inband interface to put right values in RXWI */
-+	rt2800_bbp_write(rt2x00dev, 142, 0x04);
-+	rt2800_bbp_write(rt2x00dev, 143, 0x3b);
-+	rt2800_bbp_write(rt2x00dev, 142, 0x06);
-+	rt2800_bbp_write(rt2x00dev, 143, 0xa0);
-+	rt2800_bbp_write(rt2x00dev, 142, 0x07);
-+	rt2800_bbp_write(rt2x00dev, 143, 0xa1);
-+	rt2800_bbp_write(rt2x00dev, 142, 0x08);
-+	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
-+	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
-+}
-+
- static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
- {
- 	int ant, div_mode;
-@@ -6792,6 +6833,9 @@ static void rt2800_init_bbp(struct rt2x0
- 	case RT3593:
- 		rt2800_init_bbp_3593(rt2x00dev);
- 		return;
-+	case RT3883:
-+		rt2800_init_bbp_3883(rt2x00dev);
-+		return;
- 	case RT5390:
- 	case RT5392:
- 		rt2800_init_bbp_53xx(rt2x00dev);
diff --git a/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch b/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
deleted file mode 100644
index c0f1f5863b..0000000000
--- a/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
+++ /dev/null
@@ -1,178 +0,0 @@
-From 99c659cf345640fd0f733cbcaf4583cc2c868ec0 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Mon, 29 Apr 2013 13:21:48 +0200
-Subject: [PATCH] rt2x00: rt2800lib: add RFCSR initialization for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800.h    |    1 +
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |  141 +++++++++++++++++++++++++++++++
- 2 files changed, 142 insertions(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -2311,6 +2311,7 @@ struct mac_iveiv_entry {
- /*
-  * RFCSR 2:
-  */
-+#define RFCSR2_RESCAL_BP		FIELD8(0x40)
- #define RFCSR2_RESCAL_EN		FIELD8(0x80)
- #define RFCSR2_RX2_EN_MT7620		FIELD8(0x02)
- #define RFCSR2_TX2_EN_MT7620		FIELD8(0x20)
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -7707,6 +7707,144 @@ static void rt2800_init_rfcsr_5350(struc
- 	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
- }
- 
-+static void rt2800_init_rfcsr_3883(struct rt2x00_dev *rt2x00dev)
-+{
-+	u8 rfcsr;
-+
-+	/* TODO: get the actual ECO value from the SoC */
-+	const unsigned int eco = 5;
-+
-+	rt2800_rf_init_calibration(rt2x00dev, 2);
-+
-+	rt2800_rfcsr_write(rt2x00dev, 0, 0xe0);
-+	rt2800_rfcsr_write(rt2x00dev, 1, 0x03);
-+	rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
-+	rt2800_rfcsr_write(rt2x00dev, 3, 0x20);
-+	rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 5, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
-+	rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 8, 0x5b);
-+	rt2800_rfcsr_write(rt2x00dev, 9, 0x08);
-+	rt2800_rfcsr_write(rt2x00dev, 10, 0xd3);
-+	rt2800_rfcsr_write(rt2x00dev, 11, 0x48);
-+	rt2800_rfcsr_write(rt2x00dev, 12, 0x1a);
-+	rt2800_rfcsr_write(rt2x00dev, 13, 0x12);
-+	rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
-+
-+	/* RFCSR 17 will be initialized later based on the
-+	 * frequency offset stored in the EEPROM
-+	 */
-+
-+	rt2800_rfcsr_write(rt2x00dev, 18, 0x40);
-+	rt2800_rfcsr_write(rt2x00dev, 19, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
-+	rt2800_rfcsr_write(rt2x00dev, 23, 0xc0);
-+	rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 25, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 29, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
-+	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-+	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
-+	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 34, 0x20);
-+	rt2800_rfcsr_write(rt2x00dev, 35, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 37, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 38, 0x86);
-+	rt2800_rfcsr_write(rt2x00dev, 39, 0x23);
-+	rt2800_rfcsr_write(rt2x00dev, 40, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 41, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 42, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 44, 0x93);
-+	rt2800_rfcsr_write(rt2x00dev, 45, 0xbb);
-+	rt2800_rfcsr_write(rt2x00dev, 46, 0x60);
-+	rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 48, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 49, 0x8e);
-+	rt2800_rfcsr_write(rt2x00dev, 50, 0x86);
-+	rt2800_rfcsr_write(rt2x00dev, 51, 0x51);
-+	rt2800_rfcsr_write(rt2x00dev, 52, 0x05);
-+	rt2800_rfcsr_write(rt2x00dev, 53, 0x76);
-+	rt2800_rfcsr_write(rt2x00dev, 54, 0x76);
-+	rt2800_rfcsr_write(rt2x00dev, 55, 0x76);
-+	rt2800_rfcsr_write(rt2x00dev, 56, 0xdb);
-+	rt2800_rfcsr_write(rt2x00dev, 57, 0x3e);
-+	rt2800_rfcsr_write(rt2x00dev, 58, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
-+	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
-+
-+	/* TODO: rx filter calibration? */
-+
-+	rt2800_bbp_write(rt2x00dev, 137, 0x0f);
-+
-+	rt2800_bbp_write(rt2x00dev, 163, 0x9d);
-+
-+	rt2800_bbp_write(rt2x00dev, 105, 0x05);
-+
-+	rt2800_bbp_write(rt2x00dev, 179, 0x02);
-+	rt2800_bbp_write(rt2x00dev, 180, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 182, 0x40);
-+	rt2800_bbp_write(rt2x00dev, 180, 0x01);
-+	rt2800_bbp_write(rt2x00dev, 182, 0x9c);
-+
-+	rt2800_bbp_write(rt2x00dev, 179, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 142, 0x04);
-+	rt2800_bbp_write(rt2x00dev, 143, 0x3b);
-+	rt2800_bbp_write(rt2x00dev, 142, 0x06);
-+	rt2800_bbp_write(rt2x00dev, 143, 0xa0);
-+	rt2800_bbp_write(rt2x00dev, 142, 0x07);
-+	rt2800_bbp_write(rt2x00dev, 143, 0xa1);
-+	rt2800_bbp_write(rt2x00dev, 142, 0x08);
-+	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
-+	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
-+
-+	if (eco == 5) {
-+		rt2800_rfcsr_write(rt2x00dev, 32, 0xd8);
-+		rt2800_rfcsr_write(rt2x00dev, 33, 0x32);
-+	}
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 2);
-+	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_BP, 0);
-+	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_EN, 1);
-+	rt2800_rfcsr_write(rt2x00dev, 2, rfcsr);
-+	msleep(1);
-+	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_EN, 0);
-+	rt2800_rfcsr_write(rt2x00dev, 2, rfcsr);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
-+	rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
-+	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 6);
-+	rfcsr |= 0xc0;
-+	rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 22);
-+	rfcsr |= 0x20;
-+	rt2800_rfcsr_write(rt2x00dev, 22, rfcsr);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 46);
-+	rfcsr |= 0x20;
-+	rt2800_rfcsr_write(rt2x00dev, 46, rfcsr);
-+
-+	rfcsr = rt2800_rfcsr_read(rt2x00dev, 20);
-+	rfcsr &= ~0xee;
-+	rt2800_rfcsr_write(rt2x00dev, 20, rfcsr);
-+}
-+
- static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
- {
- 	rt2800_rf_init_calibration(rt2x00dev, 2);
-@@ -8549,6 +8687,9 @@ static void rt2800_init_rfcsr(struct rt2
- 	case RT3390:
- 		rt2800_init_rfcsr_3390(rt2x00dev);
- 		break;
-+	case RT3883:
-+		rt2800_init_rfcsr_3883(rt2x00dev);
-+		break;
- 	case RT3572:
- 		rt2800_init_rfcsr_3572(rt2x00dev);
- 		break;
diff --git a/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch b/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
deleted file mode 100644
index e74f399e65..0000000000
--- a/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 86022438ffeb1b87dfcd018bf477fdbb43076691 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Wed, 8 May 2013 19:35:33 +0200
-Subject: [PATCH] rt2x00: rt2800lib: use the extended EEPROM map for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -381,7 +381,8 @@ static unsigned int rt2800_eeprom_word_i
- 		      wiphy_name(rt2x00dev->hw->wiphy), word))
- 		return 0;
- 
--	if (rt2x00_rt(rt2x00dev, RT3593))
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883))
- 		map = rt2800_eeprom_map_ext;
- 	else
- 		map = rt2800_eeprom_map;
diff --git a/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch b/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
deleted file mode 100644
index 2e917c8ebf..0000000000
--- a/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From 4cf5403f02fa65dc2207f61d223cffa9ae50e907 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Thu, 1 Aug 2013 14:48:21 +0200
-Subject: [PATCH] rt2x00: rt2800lib: force rf type to RF3853 on RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9083,6 +9083,8 @@ static int rt2800_init_eeprom(struct rt2
- 		rf = rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID);
- 	else if (rt2x00_rt(rt2x00dev, RT3352))
- 		rf = RF3322;
-+	else if (rt2x00_rt(rt2x00dev, RT3883))
-+		rf = RF3853;
- 	else if (rt2x00_rt(rt2x00dev, RT5350))
- 		rf = RF5350;
- 	else
diff --git a/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch b/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
deleted file mode 100644
index 0bb2d33577..0000000000
--- a/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
+++ /dev/null
@@ -1,136 +0,0 @@
-From 269f19c848a2380db03a3f207cafb88e28d71c53 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:28 +0100
-Subject: [PATCH] rt2x00: rt2800lib: add channel configuration code for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   72 +++++++++++++++++++++++++++++--
- 1 file changed, 69 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3738,6 +3738,36 @@ static char rt2800_txpower_to_dev(struct
- 		return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER);
- }
- 
-+static void rt3883_bbp_adjust(struct rt2x00_dev *rt2x00dev,
-+			      struct rf_channel *rf)
-+{
-+	u8 bbp;
-+
-+	bbp = (rf->channel > 14) ? 0x48 : 0x38;
-+	rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 69, 0x12);
-+
-+	if (rf->channel <= 14) {
-+		rt2800_bbp_write(rt2x00dev, 70, 0x0a);
-+	} else {
-+		/* Disable CCK packet detection */
-+		rt2800_bbp_write(rt2x00dev, 70, 0x00);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 73, 0x10);
-+
-+	if (rf->channel > 14) {
-+		rt2800_bbp_write(rt2x00dev, 62, 0x1d);
-+		rt2800_bbp_write(rt2x00dev, 63, 0x1d);
-+		rt2800_bbp_write(rt2x00dev, 64, 0x1d);
-+	} else {
-+		rt2800_bbp_write(rt2x00dev, 62, 0x2d);
-+		rt2800_bbp_write(rt2x00dev, 63, 0x2d);
-+		rt2800_bbp_write(rt2x00dev, 64, 0x2d);
-+	}
-+}
-+
- static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
- 				  struct ieee80211_conf *conf,
- 				  struct rf_channel *rf,
-@@ -3756,6 +3786,12 @@ static void rt2800_config_channel(struct
- 			rt2800_txpower_to_dev(rt2x00dev, rf->channel,
- 					      info->default_power3);
- 
-+	switch (rt2x00dev->chip.rt) {
-+	case RT3883:
-+		rt3883_bbp_adjust(rt2x00dev, rf);
-+		break;
-+	}
-+
- 	switch (rt2x00dev->chip.rf) {
- 	case RF2020:
- 	case RF3020:
-@@ -3860,6 +3896,15 @@ static void rt2800_config_channel(struct
- 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
- 		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
- 		rt2800_bbp_write(rt2x00dev, 77, 0x98);
-+	} else if (rt2x00_rt(rt2x00dev, RT3883)) {
-+		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
-+		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
-+		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
-+
-+		if (rt2x00dev->default_ant.rx_chain_num > 1)
-+			rt2800_bbp_write(rt2x00dev, 86, 0x46);
-+		else
-+			rt2800_bbp_write(rt2x00dev, 86, 0);
- 	} else {
- 		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
- 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
-@@ -3873,6 +3918,7 @@ static void rt2800_config_channel(struct
- 		    !rt2x00_rt(rt2x00dev, RT6352)) {
- 			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
- 				rt2800_bbp_write(rt2x00dev, 82, 0x62);
-+				rt2800_bbp_write(rt2x00dev, 82, 0x62);
- 				rt2800_bbp_write(rt2x00dev, 75, 0x46);
- 			} else {
- 				if (rt2x00_rt(rt2x00dev, RT3593))
-@@ -3881,19 +3927,22 @@ static void rt2800_config_channel(struct
- 					rt2800_bbp_write(rt2x00dev, 82, 0x84);
- 				rt2800_bbp_write(rt2x00dev, 75, 0x50);
- 			}
--			if (rt2x00_rt(rt2x00dev, RT3593))
-+			if (rt2x00_rt(rt2x00dev, RT3593) ||
-+			    rt2x00_rt(rt2x00dev, RT3883))
- 				rt2800_bbp_write(rt2x00dev, 83, 0x8a);
- 		}
- 
- 	} else {
- 		if (rt2x00_rt(rt2x00dev, RT3572))
- 			rt2800_bbp_write(rt2x00dev, 82, 0x94);
--		else if (rt2x00_rt(rt2x00dev, RT3593))
-+		else if (rt2x00_rt(rt2x00dev, RT3593) ||
-+			 rt2x00_rt(rt2x00dev, RT3883))
- 			rt2800_bbp_write(rt2x00dev, 82, 0x82);
- 		else if (!rt2x00_rt(rt2x00dev, RT6352))
- 			rt2800_bbp_write(rt2x00dev, 82, 0xf2);
- 
--		if (rt2x00_rt(rt2x00dev, RT3593))
-+		if (rt2x00_rt(rt2x00dev, RT3593) ||
-+		    rt2x00_rt(rt2x00dev, RT3883))
- 			rt2800_bbp_write(rt2x00dev, 83, 0x9a);
- 
- 		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
-@@ -4019,6 +4068,23 @@ static void rt2800_config_channel(struct
- 
- 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
- 
-+		usleep_range(1000, 1500);
-+	}
-+
-+	if (rt2x00_rt(rt2x00dev, RT3883)) {
-+		if (!conf_is_ht40(conf))
-+			rt2800_bbp_write(rt2x00dev, 105, 0x34);
-+		else
-+			rt2800_bbp_write(rt2x00dev, 105, 0x04);
-+
-+		/* AGC init */
-+		if (rf->channel <= 14)
-+			reg = 0x2e + rt2x00dev->lna_gain;
-+		else
-+			reg = 0x20 + ((rt2x00dev->lna_gain * 5) / 3);
-+
-+		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
-+
- 		usleep_range(1000, 1500);
- 	}
- 
diff --git a/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch b/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
deleted file mode 100644
index 56157510eb..0000000000
--- a/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From e37d93abaabe3ab72b0332a18092acc162307274 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Mon, 30 Sep 2013 13:57:26 +0200
-Subject: [PATCH] rt2x00: rt2800lib: fix txpower_to_dev function for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3725,13 +3725,15 @@ static char rt2800_txpower_to_dev(struct
- 				  unsigned int channel,
- 				  char txpower)
- {
--	if (rt2x00_rt(rt2x00dev, RT3593))
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883))
- 		txpower = rt2x00_get_field8(txpower, EEPROM_TXPOWER_ALC);
- 
- 	if (channel <= 14)
- 		return clamp_t(char, txpower, MIN_G_TXPOWER, MAX_G_TXPOWER);
- 
--	if (rt2x00_rt(rt2x00dev, RT3593))
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883))
- 		return clamp_t(char, txpower, MIN_A_TXPOWER_3593,
- 			       MAX_A_TXPOWER_3593);
- 	else
diff --git a/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch b/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
deleted file mode 100644
index c1409bcfa3..0000000000
--- a/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From c4d79e344bd580d85821390d49f92dced7d8e125 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:29 +0100
-Subject: [PATCH] rt2x00: rt2800lib: use correct txpower calculation function
- for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -5111,7 +5111,8 @@ static void rt2800_config_txpower(struct
- 				  struct ieee80211_channel *chan,
- 				  int power_level)
- {
--	if (rt2x00_rt(rt2x00dev, RT3593))
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883))
- 		rt2800_config_txpower_rt3593(rt2x00dev, chan, power_level);
- 	else if (rt2x00_rt(rt2x00dev, RT6352))
- 		rt2800_config_txpower_rt6352(rt2x00dev, chan, power_level);
diff --git a/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch b/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
deleted file mode 100644
index a4ccb28518..0000000000
--- a/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From caea0671cd8fd9ade4f5969cbe0ee545e94ae105 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sat, 24 Aug 2013 11:49:55 +0200
-Subject: [PATCH] rt2x00: rt2800lib: hardcode txmixer gain values to zero for
- RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8965,7 +8965,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
- {
- 	u16 word;
- 
--	if (rt2x00_rt(rt2x00dev, RT3593))
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883))
- 		return 0;
- 
- 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG);
-@@ -8979,7 +8980,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
- {
- 	u16 word;
- 
--	if (rt2x00_rt(rt2x00dev, RT3593))
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883))
- 		return 0;
- 
- 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_A);
diff --git a/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch b/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
deleted file mode 100644
index 197aabd7bc..0000000000
--- a/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From 11c40fb47c4a4dd6ad060c2ae127ced89ffb9fe1 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Thu, 18 Apr 2013 14:33:33 +0200
-Subject: [PATCH] rt2x00: rt2800lib: use correct [RT]XWI size for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -591,6 +591,7 @@ void rt2800_get_txwi_rxwi_size(struct rt
- {
- 	switch (rt2x00dev->chip.rt) {
- 	case RT3593:
-+	case RT3883:
- 		*txwi_size = TXWI_DESC_SIZE_4WORDS;
- 		*rxwi_size = RXWI_DESC_SIZE_5WORDS;
- 		break;
diff --git a/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch b/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
deleted file mode 100644
index 24c0ef91b0..0000000000
--- a/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From fa5ad9c025610c22048add2f0ad03f62b6ca1e74 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Mon, 30 Sep 2013 16:53:33 +0200
-Subject: [PATCH] rt2x00: rt2800lib: fix antenna configuration for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -2017,7 +2017,8 @@ void rt2800_config_ant(struct rt2x00_dev
- 	rt2800_bbp_write(rt2x00dev, 3, r3);
- 	rt2800_bbp_write(rt2x00dev, 1, r1);
- 
--	if (rt2x00_rt(rt2x00dev, RT3593)) {
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883)) {
- 		if (ant->rx_chain_num == 1)
- 			rt2800_bbp_write(rt2x00dev, 86, 0x00);
- 		else
diff --git a/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch b/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
deleted file mode 100644
index 52733ffeb9..0000000000
--- a/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 6d668fef3a1baa60bdd715ee062ddb6333d2647c Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Mon, 30 Sep 2013 16:58:23 +0200
-Subject: [PATCH] rt2x00: rt2800lib: fix LNA gain configuration for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -2040,7 +2040,8 @@ static void rt2800_config_lna_gain(struc
- 		eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_LNA);
- 		lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
- 	} else if (libconf->rf.channel <= 128) {
--		if (rt2x00_rt(rt2x00dev, RT3593)) {
-+		if (rt2x00_rt(rt2x00dev, RT3593) ||
-+		    rt2x00_rt(rt2x00dev, RT3883)) {
- 			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
- 			lna_gain = rt2x00_get_field16(eeprom,
- 						      EEPROM_EXT_LNA2_A1);
-@@ -2050,7 +2051,8 @@ static void rt2800_config_lna_gain(struc
- 						      EEPROM_RSSI_BG2_LNA_A1);
- 		}
- 	} else {
--		if (rt2x00_rt(rt2x00dev, RT3593)) {
-+		if (rt2x00_rt(rt2x00dev, RT3593) ||
-+		    rt2x00_rt(rt2x00dev, RT3883)) {
- 			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
- 			lna_gain = rt2x00_get_field16(eeprom,
- 						      EEPROM_EXT_LNA2_A2);
diff --git a/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch b/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
deleted file mode 100644
index 301928d283..0000000000
--- a/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From c49b2d829aa1c816a46a577cdec6d2ff14d9f06e Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Tue, 1 Oct 2013 15:40:08 +0200
-Subject: [PATCH] rt2x00: rt2800lib: fix VGC setup for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |   11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -5364,7 +5364,8 @@ static u8 rt2800_get_default_vgc(struct
- 		else
- 			vgc = 0x2e + rt2x00dev->lna_gain;
- 	} else { /* 5GHZ band */
--		if (rt2x00_rt(rt2x00dev, RT3593))
-+		if (rt2x00_rt(rt2x00dev, RT3593) ||
-+		    rt2x00_rt(rt2x00dev, RT3883))
- 			vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
- 		else if (rt2x00_rt(rt2x00dev, RT5592))
- 			vgc = 0x24 + (2 * rt2x00dev->lna_gain);
-@@ -5384,7 +5385,8 @@ static inline void rt2800_set_vgc(struct
- {
- 	if (qual->vgc_level != vgc_level) {
- 		if (rt2x00_rt(rt2x00dev, RT3572) ||
--		    rt2x00_rt(rt2x00dev, RT3593)) {
-+		    rt2x00_rt(rt2x00dev, RT3593) ||
-+		    rt2x00_rt(rt2x00dev, RT3883)) {
- 			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
- 						       vgc_level);
- 		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
-@@ -5431,6 +5433,11 @@ void rt2800_link_tuner(struct rt2x00_dev
- 		}
- 		break;
- 
-+	case RT3883:
-+		if (qual->rssi > -65)
-+			vgc += 0x10;
-+		break;
-+
- 	case RT5592:
- 		if (qual->rssi > -65)
- 			vgc += 0x20;
diff --git a/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch b/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
deleted file mode 100644
index 4bbc7ae44e..0000000000
--- a/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 1616650aea676541d4dc8adc6f4219856d193c8b Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Tue, 1 Oct 2013 17:27:57 +0200
-Subject: [PATCH] rt2x00: rt2800lib: fix EEPROM LNA validation for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9098,7 +9098,8 @@ static int rt2800_validate_eeprom(struct
- 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2);
- 	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
- 		rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
--	if (!rt2x00_rt(rt2x00dev, RT3593)) {
-+	if (!rt2x00_rt(rt2x00dev, RT3593) &&
-+	    !rt2x00_rt(rt2x00dev, RT3883)) {
- 		if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
- 		    rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
- 			rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
-@@ -9118,7 +9119,8 @@ static int rt2800_validate_eeprom(struct
- 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_A2);
- 	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
- 		rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
--	if (!rt2x00_rt(rt2x00dev, RT3593)) {
-+	if (!rt2x00_rt(rt2x00dev, RT3593) &&
-+	    !rt2x00_rt(rt2x00dev, RT3883)) {
- 		if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
- 		    rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
- 			rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
-@@ -9126,7 +9128,8 @@ static int rt2800_validate_eeprom(struct
- 	}
- 	rt2800_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
- 
--	if (rt2x00_rt(rt2x00dev, RT3593)) {
-+	if (rt2x00_rt(rt2x00dev, RT3593) ||
-+	    rt2x00_rt(rt2x00dev, RT3883)) {
- 		word = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
- 		if (rt2x00_get_field16(word, EEPROM_EXT_LNA2_A1) == 0x00 ||
- 		    rt2x00_get_field16(word, EEPROM_EXT_LNA2_A1) == 0xff)
diff --git a/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch b/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
deleted file mode 100644
index e752efd0ea..0000000000
--- a/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From e3871034a0e7c8a95152dc3eafbcc4535398cbdc Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Wed, 2 Oct 2013 10:11:59 +0200
-Subject: [PATCH] rt2x00: rt2800lib: fix txpower compensation for RT3883
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4354,6 +4354,9 @@ static u8 rt2800_compensate_txpower(stru
- 	if (rt2x00_rt(rt2x00dev, RT3593))
- 		return min_t(u8, txpower, 0xc);
- 
-+	if (rt2x00_rt(rt2x00dev, RT3883))
-+		return min_t(u8, txpower, 0xf);
-+
- 	if (rt2x00_has_cap_power_limit(rt2x00dev)) {
- 		/*
- 		 * Check if eirp txpower exceed txpower_limit.
diff --git a/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch b/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
deleted file mode 100644
index 342174f8d5..0000000000
--- a/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
+++ /dev/null
@@ -1,136 +0,0 @@
-From 5e67d4f8a46d19748b501c2ef86de3f50d3cfd51 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:27 +0100
-Subject: [PATCH] rt2x00: rt2800mmio: add a workaround for spurious
- TX_FIFO_STATUS interrupts
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
- drivers/net/wireless/ralink/rt2x00/rt2x00.h     |    5 +++
- 2 files changed, 65 insertions(+), 12 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
-@@ -424,9 +424,9 @@ void rt2800mmio_autowake_tasklet(unsigne
- }
- EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
- 
--static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
-+static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev,
-+					  u32 status)
- {
--	u32 status;
- 	int i;
- 
- 	/*
-@@ -447,29 +447,77 @@ static void rt2800mmio_txstatus_interrup
- 	 * Since we have only one producer and one consumer we don't
- 	 * need to lock the kfifo.
- 	 */
--	for (i = 0; i < rt2x00dev->tx->limit; i++) {
--		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
--
--		if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
--			break;
--
-+	i = 0;
-+	do {
- 		if (!kfifo_put(&rt2x00dev->txstatus_fifo, status)) {
--			rt2x00_warn(rt2x00dev, "TX status FIFO overrun, drop tx status report\n");
-+			rt2x00_warn(rt2x00dev,
-+				    "TX status FIFO overrun, drop TX status report\n");
- 			break;
- 		}
--	}
-+
-+		if (++i >= rt2x00dev->tx->limit)
-+			break;
-+
-+		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
-+	} while (rt2x00_get_field32(status, TX_STA_FIFO_VALID));
- 
- 	/* Schedule the tasklet for processing the tx status. */
- 	tasklet_schedule(&rt2x00dev->txstatus_tasklet);
- }
- 
-+#define RT2800MMIO_TXSTATUS_IRQ_MAX_RETRIES	4
-+
-+static bool rt2800mmio_txstatus_is_spurious(struct rt2x00_dev *rt2x00dev,
-+					   u32 txstatus)
-+{
-+	if (likely(rt2x00_get_field32(txstatus, TX_STA_FIFO_VALID))) {
-+		rt2x00dev->txstatus_irq_retries = 0;
-+		return false;
-+	}
-+
-+	rt2x00dev->txstatus_irq_retries++;
-+
-+	/* Ensure that we don't go into an infinite IRQ loop. */
-+	if (rt2x00dev->txstatus_irq_retries >=
-+	    RT2800MMIO_TXSTATUS_IRQ_MAX_RETRIES) {
-+		rt2x00_warn(rt2x00dev,
-+			    "%u spurious TX_FIFO_STATUS interrupt(s)\n",
-+			    rt2x00dev->txstatus_irq_retries);
-+		rt2x00dev->txstatus_irq_retries = 0;
-+		return false;
-+	}
-+
-+	return true;
-+}
-+
- irqreturn_t rt2800mmio_interrupt(int irq, void *dev_instance)
- {
- 	struct rt2x00_dev *rt2x00dev = dev_instance;
- 	u32 reg, mask;
-+	u32 txstatus = 0;
- 
--	/* Read status and ACK all interrupts */
-+	/* Read status */
- 	reg = rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR);
-+
-+	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
-+		/* Due to unknown reason the hardware generates a
-+		 * TX_FIFO_STATUS interrupt before the TX_STA_FIFO
-+		 * register contain valid data. Read the TX status
-+		 * here to see if we have to process the actual
-+		 * request.
-+		 */
-+		txstatus = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
-+		if (rt2800mmio_txstatus_is_spurious(rt2x00dev, txstatus)) {
-+			/* Remove the TX_FIFO_STATUS bit so it won't be
-+			 * processed in this turn. The hardware will
-+			 * generate another IRQ for us.
-+			 */
-+			rt2x00_set_field32(&reg,
-+					   INT_SOURCE_CSR_TX_FIFO_STATUS, 0);
-+		}
-+	}
-+
-+	/* ACK interrupts */
- 	rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
- 
- 	if (!reg)
-@@ -486,7 +534,7 @@ irqreturn_t rt2800mmio_interrupt(int irq
- 	mask = ~reg;
- 
- 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
--		rt2800mmio_txstatus_interrupt(rt2x00dev);
-+		rt2800mmio_txstatus_interrupt(rt2x00dev, txstatus);
- 		/*
- 		 * Never disable the TX_FIFO_STATUS interrupt.
- 		 */
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -1000,6 +1000,11 @@ struct rt2x00_dev {
- 	int rf_channel;
- 
- 	/*
-+	 * Counter for tx status irq retries (rt2800pci).
-+	 */
-+	unsigned int txstatus_irq_retries;
-+
-+	/*
- 	 * Protect the interrupt mask register.
- 	 */
- 	spinlock_t irqmask_lock;
diff --git a/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch b/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
deleted file mode 100644
index 475fcbc223..0000000000
--- a/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From pozega.tomislav@gmail.com Thu May 18 12:42:27 2017
-Return-path: <pozega.tomislav@gmail.com>
-Envelope-to: daniel@makrotopia.org
-Delivery-date: Thu, 18 May 2017 12:42:27 +0200
-Received: from mail by fudo.makrotopia.org with sa-checked (Exim 4.88)
-	(envelope-from <pozega.tomislav@gmail.com>)
-	id 1dBIsy-00088b-PU
-	for daniel@makrotopia.org; Thu, 18 May 2017 12:42:27 +0200
-X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on fudo.makrotopia.org
-X-Spam-Level: 
-X-Spam-Status: No, score=-0.8 required=2.5 tests=DKIM_SIGNED,DKIM_VALID,
-	DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW shortcircuit=no
-	autolearn=ham autolearn_force=no version=3.4.1
-Received: from mail-oi0-x22a.google.com ([2607:f8b0:4003:c06::22a])
-	by fudo.makrotopia.org with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
-	 (Exim 4.88)
-	(envelope-from <pozega.tomislav@gmail.com>)
-	id 1dBIsv-00088Q-Dq
-	for daniel@makrotopia.org; Thu, 18 May 2017 12:42:24 +0200
-Received: by mail-oi0-x22a.google.com with SMTP id w10so48782189oif.0
-        for <daniel@makrotopia.org>; Thu, 18 May 2017 03:42:21 -0700 (PDT)
-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
-        d=gmail.com; s=20161025;
-        h=mime-version:from:date:message-id:subject:to;
-        bh=9dF7PHDassYY74+N6dAhmsL/B9i5oG3SEuMzHuazhJo=;
-        b=cBGJ44v+o4ASyCPmHCBRMmRYnJCv4Gx6lzDiScKn0XqYmNHYpZTPg5cAY1GZFUhHdz
-         9QT5fzhJKFikBliSuJc/7/pI8KzvyEAdvawiWA7/5fbeiTZ+zjJnzRVGezqkYDKxjR6u
-         7TsoJxR2/oFwo7bOFlThhee+Nwf7qaX8AVal7JdkqovekX79JQ5vsKAa4LapDp7Cl0wr
-         KCh0WRUHGEgpTLJFyQ3ThPmLqc8bhmu+6/V/LJ53VOY7uksZHMhvaKkk9vDCoOuPnBMK
-         Cj2/c7z9RTErz/xlHg6HxnBe/pPc31XUsuPJUleOEdZASczPsreEEKacKCONVlP1wjAB
-         iOkA==
-X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
-        d=1e100.net; s=20161025;
-        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
-        bh=9dF7PHDassYY74+N6dAhmsL/B9i5oG3SEuMzHuazhJo=;
-        b=LJAe4ZwS9aNJypROW7j+I9aNfRBWyDYy0c8ABnDbLrIoF9P2AA/Vs/Cli5f7GjaAxr
-         1JCx602ach+7R7QjQq/nqNmLuhRCfSvB0TGrq4R4v+CJ4ADO541+PddnFiU1dlIXQRP2
-         TE2FOydSO0FGJBMg+kY0eFiidBtYj1T5x7IHAhQzufiuiF6/1xZS8h61CYJjLzt/aR5y
-         JxOxsVvu3W2YQ0T5wKmAPlKtarFH6ZZgs446bRYt1MX5KAWzIoBM1+IPMMv7lSCpCaDR
-         fwH05aDyaJW2IzXH5R9Tq7gGYycYjx/SnO7JupJXJVvOzKgBJxp60JwJhCfqCwESDuuD
-         8nNA==
-X-Gm-Message-State: AODbwcDOpdFZgbxAxFsVsqFdCBN3pRGDvEclZ1heVg2byNZ9BuG5kqJg
-	GvZ9x4NGt0v8lVGa3esDw0N1KiJENg==
-X-Received: by 10.157.17.217 with SMTP id y25mr1310632oty.137.1495104134863;
- Thu, 18 May 2017 03:42:14 -0700 (PDT)
-MIME-Version: 1.0
-Received: by 10.157.0.105 with HTTP; Thu, 18 May 2017 03:42:14 -0700 (PDT)
-From: Tom Psyborg <pozega.tomislav@gmail.com>
-Date: Thu, 18 May 2017 12:42:14 +0200
-Message-ID: <CAKR_QVJBSKw2uCY4RbHZPvbGkMcvnBh+j6F+9t93mG3BakjX3Q@mail.gmail.com>
-Subject: [PATCH] rt2x00: remove unneccesary code
-To: linux-wireless <linux-wireless@vger.kernel.org>, 
-	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Arnd Bergmann <arnd@arndb.de>, 
-	Jes Sorensen <jes.sorensen@gmail.com>, Stanislaw Gruszka <sgruszka@redhat.com>, 
-	David Miller <davem@davemloft.net>, Helmut Schaa <helmut.schaa@googlemail.com>, 
-	Kalle Valo <kvalo@codeaurora.org>, Daniel Golle <daniel@makrotopia.org>, 
-	Mathias Kresin <dev@kresin.me>, Johannes Berg <johannes.berg@intel.com>, 
-	Serge Vasilugin <vasilugin@yandex.ru>, Roman Yeryomin <roman@advem.lv>, 
-	Networking <netdev@vger.kernel.org>
-Content-Type: multipart/alternative; boundary="94eb2c1905d2dc6361054fca0e62"
-Status: RO
-Content-Length: 11079
-Lines: 178
-
---94eb2c1905d2dc6361054fca0e62
-Content-Type: text/plain; charset="UTF-8"
-Content-Transfer-Encoding: quoted-printable
-
-Use chanreg and dccal helpers to reduce the size of ePA code.
-
-Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
-[daniel@makrotopia.org: fixed white-space so patch applies]
----
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4133,38 +4133,22 @@ static void rt2800_config_channel(struct
- 			reg |= 0x00000101;
- 			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
- 
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 43, 0x73);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 43, 0x73);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 44, 0x73);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 44, 0x73);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 45, 0x73);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0x73);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 46, 0x27);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 46, 0x27);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0xC8);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0xC8);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 48, 0xA4);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 48, 0xA4);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 49, 0x05);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 49, 0x05);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 54, 0x27);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 54, 0x27);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 55, 0xC8);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 55, 0xC8);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 56, 0xA4);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 56, 0xA4);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 57, 0x05);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 57, 0x05);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 58, 0x27);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 58, 0x27);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 59, 0xC8);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 59, 0xC8);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 60, 0xA4);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 60, 0xA4);
--			rt2800_rfcsr_write_bank(rt2x00dev, 4, 61, 0x05);
--			rt2800_rfcsr_write_bank(rt2x00dev, 6, 61, 0x05);
--			rt2800_rfcsr_write_bank(rt2x00dev, 5, 05, 0x00);
--			rt2800_rfcsr_write_bank(rt2x00dev, 7, 05, 0x00);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
- 
- 			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
- 					      0x36303636);
diff --git a/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch b/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
deleted file mode 100644
index ea30a9dfd6..0000000000
--- a/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -770,7 +770,7 @@ static int ath10k_core_get_board_id_from
- 	if (ret) {
- 		ath10k_err(ar, "could not execute otp for board id check: %d\n",
- 			   ret);
--		return ret;
-+		return -EOPNOTSUPP;
- 	}
- 
- 	board_id = MS(result, ATH10K_BMI_BOARD_ID_FROM_OTP);
diff --git a/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch b/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
deleted file mode 100644
index e82db4d67e..0000000000
--- a/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 4628257bf3006c18e0037459922624f02a138aed Mon Sep 17 00:00:00 2001
-From: Weixiao Zhang <waveletboy@gmail.com>
-Date: Thu, 16 Nov 2017 01:59:55 -0600
-Subject: [PATCH] mwl8k: Expand non-DFS 5G channels
-
-Add non-DFS 5G upper channels (149-165) besides existed 4 lower channels
-(36, 40, 44, 48).
-
-Signed-off-by: Weixiao Zhang <waveletboy@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/marvell/mwl8k.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/marvell/mwl8k.c
-+++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -199,7 +199,7 @@ struct mwl8k_priv {
- 	struct ieee80211_channel channels_24[14];
- 	struct ieee80211_rate rates_24[13];
- 	struct ieee80211_supported_band band_50;
--	struct ieee80211_channel channels_50[4];
-+	struct ieee80211_channel channels_50[9];
- 	struct ieee80211_rate rates_50[8];
- 	u32 ap_macids_supported;
- 	u32 sta_macids_supported;
-@@ -383,6 +383,11 @@ static const struct ieee80211_channel mw
- 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
- 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
- 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5745, .hw_value = 149, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5765, .hw_value = 153, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5785, .hw_value = 157, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5805, .hw_value = 161, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5825, .hw_value = 165, },
- };
- 
- static const struct ieee80211_rate mwl8k_rates_50[] = {
diff --git a/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
deleted file mode 100644
index 914472aab9..0000000000
--- a/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/ath10k/htt.h
-+++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -200,7 +200,7 @@ enum htt_rx_ring_flags {
- };
- 
- #define HTT_RX_RING_SIZE_MIN 128
--#define HTT_RX_RING_SIZE_MAX 2048
-+#define HTT_RX_RING_SIZE_MAX 512
- 
- struct htt_rx_ring_setup_ring {
- 	__le32 fw_idx_shadow_reg_paddr;
diff --git a/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off b/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
deleted file mode 100644
index 3b139ee326..0000000000
--- a/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
+++ /dev/null
@@ -1,93 +0,0 @@
-From e6b3b2ed3d270b3c7080c9cf7d28636dc74b0387 Mon Sep 17 00:00:00 2001
-From: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Date: Wed, 1 Nov 2017 17:42:45 +0530
-Subject: rsi: fix kbuild reported build errors with CONFIG_PM off
-
-Some wowlan related code was outside CONFIG_PM flag which caused these
-build errors. They are fixed by moving that code under CONFIG_PM flag.
-
-Reported-by: kbuild test robot <fengguang.wu@intel.com>
-Fixes: ef71ed0608c ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
-Fixes: a24e35fcee0 ("rsi: sdio: Add WOWLAN support for S4 hibernate state")
-Fixes: e1ced6422a3 ("rsi: sdio: add WOWLAN support for S3 suspend state")
-Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 5 ++++-
- drivers/net/wireless/rsi/rsi_91x_mgmt.c     | 2 ++
- drivers/net/wireless/rsi/rsi_common.h       | 2 ++
- drivers/net/wireless/rsi/rsi_mgmt.h         | 2 ++
- 4 files changed, 10 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
-+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
-@@ -1752,6 +1752,7 @@ static int rsi_mac80211_cancel_roc(struc
- 	return 0;
- }
- 
-+#ifdef CONFIG_PM
- static const struct wiphy_wowlan_support rsi_wowlan_support = {
- 	.flags = WIPHY_WOWLAN_ANY |
- 		 WIPHY_WOWLAN_MAGIC_PKT |
-@@ -1824,7 +1825,6 @@ int rsi_config_wowlan(struct rsi_hw *ada
- }
- EXPORT_SYMBOL(rsi_config_wowlan);
- 
--#ifdef CONFIG_PM
- static int rsi_mac80211_suspend(struct ieee80211_hw *hw,
- 				struct cfg80211_wowlan *wowlan)
- {
-@@ -1977,7 +1977,10 @@ int rsi_mac80211_attach(struct rsi_commo
- 	wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER;
- 	wiphy->reg_notifier = rsi_reg_notify;
- 
-+#ifdef CONFIG_PM
- 	wiphy->wowlan = &rsi_wowlan_support;
-+#endif
-+
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
- 
- 	/* Wi-Fi direct parameters */
---- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
-+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
-@@ -1597,6 +1597,7 @@ static int rsi_send_beacon(struct rsi_co
- 	return 0;
- }
- 
-+#ifdef CONFIG_PM
- int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
- 			    u16 sleep_status)
- {
-@@ -1630,6 +1631,7 @@ int rsi_send_wowlan_request(struct rsi_c
- 
- 	return rsi_send_internal_mgmt_frame(common, skb);
- }
-+#endif
- 
- /**
-  * rsi_handle_ta_confirm_type() - This function handles the confirm frames.
---- a/drivers/net/wireless/rsi/rsi_common.h
-+++ b/drivers/net/wireless/rsi/rsi_common.h
-@@ -83,7 +83,9 @@ u16 rsi_get_connected_channel(struct iee
- struct rsi_hw *rsi_91x_init(void);
- void rsi_91x_deinit(struct rsi_hw *adapter);
- int rsi_read_pkt(struct rsi_common *common, s32 rcv_pkt_len);
-+#ifdef CONFIG_PM
- int rsi_config_wowlan(struct rsi_hw *adapter, struct cfg80211_wowlan *wowlan);
-+#endif
- struct rsi_sta *rsi_find_sta(struct rsi_common *common, u8 *mac_addr);
- struct ieee80211_vif *rsi_get_vif(struct rsi_hw *adapter, u8 *mac);
- void rsi_roc_timeout(struct timer_list *t);
---- a/drivers/net/wireless/rsi/rsi_mgmt.h
-+++ b/drivers/net/wireless/rsi/rsi_mgmt.h
-@@ -668,8 +668,10 @@ int rsi_band_check(struct rsi_common *co
- int rsi_send_rx_filter_frame(struct rsi_common *common, u16 rx_filter_word);
- int rsi_send_radio_params_update(struct rsi_common *common);
- int rsi_set_antenna(struct rsi_common *common, u8 antenna);
-+#ifdef CONFIG_PM
- int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
- 			    u16 sleep_status);
-+#endif
- int rsi_send_ps_request(struct rsi_hw *adapter, bool enable,
- 			struct ieee80211_vif *vif);
- #endif
diff --git a/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch b/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
deleted file mode 100644
index 499b4ee7fc..0000000000
--- a/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 39f1332c526cd9d6de59a72520e8334e54b62cda Mon Sep 17 00:00:00 2001
-From: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Date: Wed, 1 Nov 2017 17:42:44 +0530
-Subject: rsi: move rsi_sdio_reinit_device() out of CONFIG_PM
-
-This function is generic. It doesn't contain wowlan specific code.
-It should not be under CONFIG_PM. This patch resolves compilation
-errors observed when CONFIG_PM flag is disabled.
-
-Reported-by: kbuild test robot <fengguang.wu@intel.com>
-Fixes: ef71ed0608c ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
-Fixes: a24e35fcee0 ("rsi: sdio: Add WOWLAN support for S4 hibernate state")
-Fixes: e1ced6422a3 ("rsi: sdio: add WOWLAN support for S3 suspend state")
-Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/rsi/rsi_91x_sdio.c | 52 ++++++++++++++++-----------------
- drivers/net/wireless/rsi/rsi_sdio.h     |  1 -
- 2 files changed, 26 insertions(+), 27 deletions(-)
-
---- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
-+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
-@@ -871,6 +871,32 @@ fail:
- 	return status;
- }
- 
-+static int rsi_sdio_reinit_device(struct rsi_hw *adapter)
-+{
-+	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
-+	struct sdio_func *pfunction = sdev->pfunction;
-+	int ii;
-+
-+	for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
-+		skb_queue_purge(&adapter->priv->tx_queue[ii]);
-+
-+	/* Initialize device again */
-+	sdio_claim_host(pfunction);
-+
-+	sdio_release_irq(pfunction);
-+	rsi_reset_card(pfunction);
-+
-+	sdio_enable_func(pfunction);
-+	rsi_setupcard(adapter);
-+	rsi_init_sdio_slave_regs(adapter);
-+	sdio_claim_irq(pfunction, rsi_handle_interrupt);
-+	rsi_hal_device_init(adapter);
-+
-+	sdio_release_host(pfunction);
-+
-+	return 0;
-+}
-+
- static struct rsi_host_intf_ops sdio_host_intf_ops = {
- 	.write_pkt		= rsi_sdio_host_intf_write_pkt,
- 	.read_pkt		= rsi_sdio_host_intf_read_pkt,
-@@ -1281,32 +1307,6 @@ static void rsi_shutdown(struct device *
- 	rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n");
- }
- 
--int rsi_sdio_reinit_device(struct rsi_hw *adapter)
--{
--	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
--	struct sdio_func *pfunction = sdev->pfunction;
--	int ii;
--
--	for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
--		skb_queue_purge(&adapter->priv->tx_queue[ii]);
--
--	/* Initialize device again */
--	sdio_claim_host(pfunction);
--
--	sdio_release_irq(pfunction);
--	rsi_reset_card(pfunction);
--
--	sdio_enable_func(pfunction);
--	rsi_setupcard(adapter);
--	rsi_init_sdio_slave_regs(adapter);
--	sdio_claim_irq(pfunction, rsi_handle_interrupt);
--	rsi_hal_device_init(adapter);
--
--	sdio_release_host(pfunction);
--
--	return 0;
--}
--
- static int rsi_restore(struct device *dev)
- {
- 	struct sdio_func *pfunction = dev_to_sdio_func(dev);
---- a/drivers/net/wireless/rsi/rsi_sdio.h
-+++ b/drivers/net/wireless/rsi/rsi_sdio.h
-@@ -131,5 +131,4 @@ int rsi_sdio_master_access_msword(struct
- void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit);
- int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter);
- int rsi_sdio_check_buffer_status(struct rsi_hw *adapter, u8 q_num);
--int rsi_sdio_reinit_device(struct rsi_hw *adapter);
- #endif
diff --git a/package/kernel/mac80211/patches/070-ath_common_config.patch b/package/kernel/mac80211/patches/ath/070-ath_common_config.patch
similarity index 100%
rename from package/kernel/mac80211/patches/070-ath_common_config.patch
rename to package/kernel/mac80211/patches/ath/070-ath_common_config.patch
diff --git a/package/kernel/mac80211/patches/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
similarity index 77%
rename from package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
rename to package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
index 796615b03c..a86cbc6e54 100644
--- a/package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -65,6 +65,12 @@ config ATH10K_TRACING
+@@ -85,6 +85,12 @@ config ATH10K_TRACING
  	---help---
  	  Select this to ath10k use tracing infrastructure.
  
@@ -15,15 +15,15 @@
  	depends on ATH10K && CFG80211_CERTIFICATION_ONUS
 --- a/drivers/net/wireless/ath/ath10k/Makefile
 +++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -17,7 +17,7 @@ ath10k_core-y += mac.o \
- ath10k_core-$(CPTCFG_ATH10K_DEBUGFS) += spectral.o
+@@ -18,7 +18,7 @@ ath10k_core-y += mac.o \
+ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) += spectral.o
  ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
 -ath10k_core-$(CONFIG_THERMAL) += thermal.o
 +ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
  ath10k_core-$(CPTCFG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
- 
+ ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/drivers/net/wireless/ath/ath10k/thermal.h
 +++ b/drivers/net/wireless/ath/ath10k/thermal.h
 @@ -36,7 +36,7 @@ struct ath10k_thermal {
@@ -35,3 +35,13 @@
  int ath10k_thermal_register(struct ath10k *ar);
  void ath10k_thermal_unregister(struct ath10k *ar);
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
+--- a/local-symbols
++++ b/local-symbols
+@@ -139,6 +139,7 @@ ATH10K_SNOC=
+ ATH10K_DEBUG=
+ ATH10K_DEBUGFS=
+ ATH10K_SPECTRAL=
++ATH10K_THERMAL=
+ ATH10K_TRACING=
+ ATH10K_DFS_CERTIFIED=
+ WCN36XX=
diff --git a/package/kernel/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
similarity index 100%
rename from package/kernel/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
rename to package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
diff --git a/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 89%
rename from package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
index a7bcfa549b..cadbf6809c 100644
--- a/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
+++ b/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1394,8 +1394,12 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1421,8 +1421,12 @@ static bool ath9k_hw_set_reset(struct at
  	if (!AR_SREV_9100(ah))
  		REG_WRITE(ah, AR_RC, 0);
  
diff --git a/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch b/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 95%
rename from package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
rename to package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
index 5eb69b898d..ac9e112f51 100644
--- a/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
+++ b/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1271,39 +1271,56 @@ void ath9k_hw_get_delta_slope_vals(struc
+@@ -1298,39 +1298,56 @@ void ath9k_hw_get_delta_slope_vals(struc
  	*coef_exponent = coef_exp - 16;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -1356,24 +1373,24 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1383,24 +1400,24 @@ static bool ath9k_hw_set_reset(struct at
  			rst_flags |= AR_RTC_RC_MAC_COLD;
  	}
  
diff --git a/package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 82%
rename from package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 35d07430eb..3adcb8b796 100644
--- a/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,17 +8,17 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2935,7 +2935,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2962,7 +2962,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
 -	int chan_pwr, new_pwr;
 +	int chan_pwr, new_pwr, max_gain;
 +	int ant_gain, ant_reduction = 0;
+ 	u16 ctl = NO_CTL;
  
  	if (!chan)
- 		return;
-@@ -2943,10 +2944,15 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2974,9 +2975,14 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
@@ -28,8 +28,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 +	if (ant_gain > max_gain)
 +		ant_reduction = ant_gain - max_gain;
  
- 	ah->eep_ops->set_txpower(ah, chan,
- 				 ath9k_regd_get_ctl(reg, chan),
+ 	ah->eep_ops->set_txpower(ah, chan, ctl,
 -				 get_antenna_gain(ah, chan), new_pwr, test);
 +				 ant_reduction, new_pwr, test);
  }
diff --git a/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
similarity index 59%
rename from package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
rename to package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
index 78083517bc..363e9aa9a3 100644
--- a/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
+++ b/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
@@ -3,7 +3,7 @@ Date: Wed, 19 Jul 2017 08:49:31 +0200
 Subject: [PATCH] ath9k: adjust tx power reduction for US regulatory
  domain
 
-FCC regulatory rules allow for up to 3 dBi antenna gain. Account for
+FCC regulatory rules allow for up to 6 dBi antenna gain. Account for
 this in the EEPROM based tx power reduction code.
 
 Signed-off-by: Felix Fietkau <nbd@nbd.name>
@@ -11,14 +11,14 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2954,6 +2954,10 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2981,6 +2981,10 @@ void ath9k_hw_apply_txpower(struct ath_h
  	if (ant_gain > max_gain)
  		ant_reduction = ant_gain - max_gain;
  
-+	/* FCC allows maximum antenna gain of 3 dBi */
++	/* FCC allows maximum antenna gain of 6 dBi */
 +	if (reg->region == NL80211_DFS_FCC)
-+		ant_reduction = max_t(int, ant_reduction - 6, 0);
++		ant_reduction = max_t(int, ant_reduction - 12, 0);
 +
- 	ah->eep_ops->set_txpower(ah, chan, ctl, ant_reduction, new_pwr, test);
+ 	ah->eep_ops->set_txpower(ah, chan, ctl,
+ 				 ant_reduction, new_pwr, test);
  }
- 
diff --git a/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch b/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch
new file mode 100644
index 0000000000..d5c37825fd
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch
@@ -0,0 +1,92 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Aug 2018 11:35:05 +0200
+Subject: [PATCH] ath9k: fix tx99 with monitor mode interface
+
+Tx99 is typically configured via a monitor mode interface, which does
+not get added to the driver as a vif. Since the code currently expects
+a configured virtual interface for tx99, enabling tx99 via debugfs fails.
+Since the vif is not needed anyway, remove all checks for it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,7 +1074,6 @@ struct ath_softc {
+ 
+ 	struct ath_spec_scan_priv spec_priv;
+ 
+-	struct ieee80211_vif *tx99_vif;
+ 	struct sk_buff *tx99_skb;
+ 	bool tx99_state;
+ 	s16 tx99_power;
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1251,15 +1251,10 @@ static int ath9k_add_interface(struct ie
+ 	struct ath_vif *avp = (void *)vif->drv_priv;
+ 	struct ath_node *an = &avp->mcast_node;
+ 
+-	mutex_lock(&sc->mutex);
++	if (IS_ENABLED(CPTCFG_ATH9K_TX99))
++		return -EOPNOTSUPP;
+ 
+-	if (IS_ENABLED(CPTCFG_ATH9K_TX99)) {
+-		if (sc->cur_chan->nvifs >= 1) {
+-			mutex_unlock(&sc->mutex);
+-			return -EOPNOTSUPP;
+-		}
+-		sc->tx99_vif = vif;
+-	}
++	mutex_lock(&sc->mutex);
+ 
+ 	ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ 	sc->cur_chan->nvifs++;
+@@ -1342,7 +1337,6 @@ static void ath9k_remove_interface(struc
+ 	ath9k_p2p_remove_vif(sc, vif);
+ 
+ 	sc->cur_chan->nvifs--;
+-	sc->tx99_vif = NULL;
+ 	if (!ath9k_is_chanctx_enabled())
+ 		list_del(&avp->list);
+ 
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,12 +54,6 @@ static struct sk_buff *ath9k_build_tx99_
+ 	struct ieee80211_hdr *hdr;
+ 	struct ieee80211_tx_info *tx_info;
+ 	struct sk_buff *skb;
+-	struct ath_vif *avp;
+-
+-	if (!sc->tx99_vif)
+-		return NULL;
+-
+-	avp = (struct ath_vif *)sc->tx99_vif->drv_priv;
+ 
+ 	skb = alloc_skb(len, GFP_KERNEL);
+ 	if (!skb)
+@@ -77,14 +71,11 @@ static struct sk_buff *ath9k_build_tx99_
+ 	memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ 	memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+ 
+-	hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
+-
+ 	tx_info = IEEE80211_SKB_CB(skb);
+ 	memset(tx_info, 0, sizeof(*tx_info));
+ 	rate = &tx_info->control.rates[0];
+ 	tx_info->band = sc->cur_chan->chandef.chan->band;
+ 	tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
+-	tx_info->control.vif = sc->tx99_vif;
+ 	rate->count = 1;
+ 	if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ 		rate->flags |= IEEE80211_TX_RC_MCS;
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2974,7 +2974,7 @@ int ath9k_tx99_send(struct ath_softc *sc
+ 		return -EINVAL;
+ 	}
+ 
+-	ath_set_rates(sc->tx99_vif, NULL, bf);
++	ath_set_rates(NULL, NULL, bf);
+ 
+ 	ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ 	ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
diff --git a/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch b/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch
new file mode 100644
index 0000000000..7f30de9862
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch
@@ -0,0 +1,96 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 22 Sep 2018 15:20:50 +0200
+Subject: [PATCH] ath9k: add back support for using active monitor interfaces
+ for tx99
+
+Various documented examples on how to set up tx99 with ath9k rely
+on setting up a regular monitor interface for setting the channel.
+My previous patch "ath9k: fix tx99 with monitor mode interface" made
+it possible to set it up this way again. However, it was removing support
+for using an active monitor interface, which is required for controlling
+the bitrate as well, since the bitrate is not passed down with a regular
+monitor interface.
+
+This patch partially reverts the previous one, but keeps support for using
+a regular monitor interface to keep documented steps working in cases
+where the bitrate does not matter
+
+Fixes: d9c52fd17cb48 ("ath9k: fix tx99 with monitor mode interface")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,6 +1074,7 @@ struct ath_softc {
+ 
+ 	struct ath_spec_scan_priv spec_priv;
+ 
++	struct ieee80211_vif *tx99_vif;
+ 	struct sk_buff *tx99_skb;
+ 	bool tx99_state;
+ 	s16 tx99_power;
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1251,8 +1251,13 @@ static int ath9k_add_interface(struct ie
+ 	struct ath_vif *avp = (void *)vif->drv_priv;
+ 	struct ath_node *an = &avp->mcast_node;
+ 
+-	if (IS_ENABLED(CPTCFG_ATH9K_TX99))
+-		return -EOPNOTSUPP;
++	if (IS_ENABLED(CPTCFG_ATH9K_TX99)) {
++		if (sc->cur_chan->nvifs >= 1) {
++			mutex_unlock(&sc->mutex);
++			return -EOPNOTSUPP;
++		}
++		sc->tx99_vif = vif;
++	}
+ 
+ 	mutex_lock(&sc->mutex);
+ 
+@@ -1337,6 +1342,7 @@ static void ath9k_remove_interface(struc
+ 	ath9k_p2p_remove_vif(sc, vif);
+ 
+ 	sc->cur_chan->nvifs--;
++	sc->tx99_vif = NULL;
+ 	if (!ath9k_is_chanctx_enabled())
+ 		list_del(&avp->list);
+ 
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,6 +54,7 @@ static struct sk_buff *ath9k_build_tx99_
+ 	struct ieee80211_hdr *hdr;
+ 	struct ieee80211_tx_info *tx_info;
+ 	struct sk_buff *skb;
++	struct ath_vif *avp;
+ 
+ 	skb = alloc_skb(len, GFP_KERNEL);
+ 	if (!skb)
+@@ -71,11 +72,17 @@ static struct sk_buff *ath9k_build_tx99_
+ 	memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ 	memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+ 
++	if (sc->tx99_vif) {
++		avp = (struct ath_vif *) sc->tx99_vif->drv_priv;
++		hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++	}
++
+ 	tx_info = IEEE80211_SKB_CB(skb);
+ 	memset(tx_info, 0, sizeof(*tx_info));
+ 	rate = &tx_info->control.rates[0];
+ 	tx_info->band = sc->cur_chan->chandef.chan->band;
+ 	tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
++	tx_info->control.vif = sc->tx99_vif;
+ 	rate->count = 1;
+ 	if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ 		rate->flags |= IEEE80211_TX_RC_MCS;
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2974,7 +2974,7 @@ int ath9k_tx99_send(struct ath_softc *sc
+ 		return -EINVAL;
+ 	}
+ 
+-	ath_set_rates(NULL, NULL, bf);
++	ath_set_rates(sc->tx99_vif, NULL, bf);
+ 
+ 	ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ 	ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
diff --git a/package/kernel/mac80211/patches/400-ath_move_debug_code.patch b/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
similarity index 88%
rename from package/kernel/mac80211/patches/400-ath_move_debug_code.patch
rename to package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
index ed65053d77..e7df0e14be 100644
--- a/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
+++ b/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/Makefile
 +++ b/drivers/net/wireless/ath/Makefile
-@@ -13,10 +13,10 @@ ath-objs :=	main.o \
+@@ -14,10 +14,10 @@ ath-objs :=	main.o \
  		regd.o \
  		hw.o \
  		key.o \
@@ -14,7 +14,7 @@
  CFLAGS_trace.o := -I$(src)
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -318,14 +318,7 @@ void _ath_dbg(struct ath_common *common,
+@@ -316,14 +316,7 @@ void _ath_dbg(struct ath_common *common,
  #endif /* CPTCFG_ATH_DEBUG */
  
  /** Returns string describing opmode, or NULL if unknown mode. */
diff --git a/package/kernel/mac80211/patches/401-ath9k_blink_default.patch b/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
similarity index 88%
rename from package/kernel/mac80211/patches/401-ath9k_blink_default.patch
rename to package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
index 7405e594fe..3eb57bb1cf 100644
--- a/package/kernel/mac80211/patches/401-ath9k_blink_default.patch
+++ b/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -47,7 +47,7 @@ int ath9k_modparam_nohwcrypt;
+@@ -48,7 +48,7 @@ int ath9k_modparam_nohwcrypt;
  module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
  MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
  
diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
similarity index 98%
rename from package/kernel/mac80211/patches/402-ath_regd_optional.patch
rename to package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
index 8fa56f40a4..03c12df1a8 100644
--- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
@@ -82,7 +82,7 @@
  	---help---
 --- a/local-symbols
 +++ b/local-symbols
-@@ -87,6 +87,7 @@ ADM8211=
+@@ -83,6 +83,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/403-world_regd_fixup.patch b/package/kernel/mac80211/patches/ath/403-world_regd_fixup.patch
similarity index 100%
rename from package/kernel/mac80211/patches/403-world_regd_fixup.patch
rename to package/kernel/mac80211/patches/ath/403-world_regd_fixup.patch
diff --git a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
similarity index 76%
rename from package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
rename to package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
index 00be2ef98d..ec95206acb 100644
--- a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -2860,6 +2860,8 @@ void regulatory_hint_country_ie(struct w
+@@ -2982,6 +2982,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3066,6 +3068,7 @@ static void restore_regulatory_settings(
+@@ -3188,6 +3190,7 @@ static void restore_regulatory_settings(
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/kernel/mac80211/patches/405-ath_regd_us.patch b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
similarity index 83%
rename from package/kernel/mac80211/patches/405-ath_regd_us.patch
rename to package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
index cc55877809..8cb7f00ff9 100644
--- a/package/kernel/mac80211/patches/405-ath_regd_us.patch
+++ b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
@@ -8,15 +8,15 @@
  	FRANCE_RES = 0x31,
  	FCC3_FCCA = 0x3A,
  	FCC3_WORLD = 0x3B,
-@@ -167,6 +168,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
  	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC3_FCCA, CTL_FCC, CTL_FCC},
 +	{FCC3_FCCA_2, CTL_FCC, CTL_FCC},
  	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
+ 	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC4_FCCA, CTL_FCC, CTL_FCC},
- 	{FCC5_FCCA, CTL_FCC, CTL_FCC},
-@@ -463,6 +465,7 @@ static struct country_code_to_enum_rd al
+@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
  	{CTRY_UAE, NULL1_WORLD, "AE"},
  	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
  	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
diff --git a/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
similarity index 100%
rename from package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
rename to package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
diff --git a/package/kernel/mac80211/patches/ath/407-regd_add_extra_country_codes.patch b/package/kernel/mac80211/patches/ath/407-regd_add_extra_country_codes.patch
new file mode 100644
index 0000000000..8f621002fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/407-regd_add_extra_country_codes.patch
@@ -0,0 +1,35 @@
+From: Oever Gonzalez <notengobattery@gmail.com>
+Date: Mon, 7 Jan 2019 01:07:12 +0200
+Subject: [PATCH] ath: regd: add extra coutry codes
+
+This patch adds several country codes to the regd.h and regd_common.h
+files in order to support devices whose country codes are not present in
+the original list. Without this patch, all devices whose manufacturer
+programmed any of these code in their EEPROM will not work.
+
+Signed-off-by: Oever Gonzalez <notengobattery@gmail.com>
+---
+
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -185,7 +185,9 @@ enum CountryCode {
+ 	CTRY_UKRAINE = 804,
+ 	CTRY_UNITED_KINGDOM = 826,
+ 	CTRY_UNITED_STATES = 840,
++	CTRY_UNITED_STATES2 = 841,
+ 	CTRY_UNITED_STATES_FCC49 = 842,
++	CTRY_UNITED_STATES3 = 843,
+ 	CTRY_URUGUAY = 858,
+ 	CTRY_UZBEKISTAN = 860,
+ 	CTRY_VENEZUELA = 862,
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -486,6 +486,8 @@ static struct country_code_to_enum_rd al
+ 	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
+ 	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
+ 	{CTRY_UNITED_STATES, FCC3_FCCA_2, "US"},
++	{CTRY_UNITED_STATES2, FCC3_FCCA, "US"},
++	{CTRY_UNITED_STATES3, FCC3_FCCA, "US"},
+ 	/* This "PS" is for US public safety actually... to support this we
+ 	 * would need to assign new special alpha2 to CRDA db as with the world
+ 	 * regdomain and use another alpha2 */
diff --git a/package/kernel/mac80211/patches/ath/408-ath_phy_regd.patch b/package/kernel/mac80211/patches/ath/408-ath_phy_regd.patch
new file mode 100644
index 0000000000..6d1dabf8ab
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/408-ath_phy_regd.patch
@@ -0,0 +1,13 @@
+--- a/drivers/net/wireless/ath/regd.c
++++ b/drivers/net/wireless/ath/regd.c
+@@ -511,6 +511,10 @@ static int __ath_reg_dyn_country(struct
+ 
+ 	ath_reg_apply_world_flags(wiphy, request->initiator, reg);
+ 
++	// apply regulatory to phy devices
++	if (regulatory_hint(wiphy, reg->alpha2))
++		printk(KERN_DEBUG "ath: regulatory_hint error!\n");
++
+ 	return 0;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
similarity index 83%
rename from package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
index 86f96e8e97..25c236b12c 100644
--- a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -777,6 +777,7 @@ static const struct ieee80211_iface_limi
+@@ -833,6 +833,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
similarity index 100%
rename from package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
diff --git a/package/kernel/mac80211/patches/420-ath5k_disable_fast_cc.patch b/package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/420-ath5k_disable_fast_cc.patch
rename to package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
diff --git a/package/kernel/mac80211/patches/430-add_ath5k_platform.patch b/package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
similarity index 100%
rename from package/kernel/mac80211/patches/430-add_ath5k_platform.patch
rename to package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
diff --git a/package/kernel/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch b/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
similarity index 100%
rename from package/kernel/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
rename to package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
diff --git a/package/kernel/mac80211/patches/432-ath5k_add_pciids.patch b/package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
similarity index 100%
rename from package/kernel/mac80211/patches/432-ath5k_add_pciids.patch
rename to package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
diff --git a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
similarity index 92%
rename from package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
rename to package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
index 3ae01a5c35..57d3363274 100644
--- a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
@@ -109,16 +109,15 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
  
  /* debugfs: queues etc */
  
-@@ -1012,6 +1103,9 @@ ath5k_debug_init_device(struct ath5k_hw
- 	debugfs_create_file("beacon", S_IWUSR | S_IRUSR, phydir, ah,
- 			    &fops_beacon);
- 
+@@ -1016,6 +1107,8 @@ ath5k_debug_init_device(struct ath5k_hw
+ 	debugfs_create_file("queue", 0600, phydir, ah, &fops_queue);
+ 	debugfs_create_bool("32khz_clock", 0600, phydir,
+ 			    &ah->ah_use_32khz_clock);
 +	debugfs_create_file("bwmode", S_IWUSR | S_IRUSR, phydir, ah,
 +			    &fops_bwmode);
-+
- 	debugfs_create_file("reset", S_IWUSR, phydir, ah, &fops_reset);
+ }
  
- 	debugfs_create_file("antenna", S_IWUSR | S_IRUSR, phydir, ah,
+ /* functions used in other places */
 --- a/drivers/net/wireless/ath/ath5k/ath5k.h
 +++ b/drivers/net/wireless/ath/ath5k/ath5k.h
 @@ -1372,6 +1372,7 @@ struct ath5k_hw {
diff --git a/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
similarity index 100%
rename from package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
rename to package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
diff --git a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
similarity index 86%
rename from package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
rename to package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
index 53225dbc36..5fc60dd0ae 100644
--- a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1088,23 +1088,23 @@ static int __init ath9k_init(void)
+@@ -1144,25 +1144,25 @@ static int __init ath9k_init(void)
  {
  	int error;
  
@@ -21,6 +21,8 @@
 +		goto err_ahb_exit;
  	}
  
+ 	dmi_check_system(ath9k_quirks);
+ 
  	return 0;
  
 - err_pci_exit:
diff --git a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
similarity index 87%
rename from package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
rename to package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
index d2a3b96570..356939a354 100644
--- a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -390,13 +390,8 @@ static void ath9k_hw_init_config(struct
+@@ -392,13 +392,8 @@ static void ath9k_hw_init_config(struct
  
  	ah->config.rx_intr_mitigation = true;
  
diff --git a/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch b/package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
rename to package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
diff --git a/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
similarity index 98%
rename from package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
rename to package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
index 2ebb73d689..2d4a5688c8 100644
--- a/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
@@ -64,7 +64,7 @@
  	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -151,6 +151,7 @@ struct ath_common {
+@@ -149,6 +149,7 @@ struct ath_common {
  	int debug_mask;
  	enum ath_device_state state;
  	unsigned long op_flags;
diff --git a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
similarity index 87%
rename from package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
rename to package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
index fdeaed05e8..e536e60794 100644
--- a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -647,6 +647,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+@@ -649,6 +649,7 @@ int ath9k_hw_init(struct ath_hw *ah)
  
  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
  	switch (ah->hw_version.devid) {
@@ -20,7 +20,7 @@
  #define AR9160_DEVID_PCI	0x0027
 --- a/drivers/net/wireless/ath/ath9k/pci.c
 +++ b/drivers/net/wireless/ath/ath9k/pci.c
-@@ -773,6 +773,7 @@ static const struct pci_device_id ath_pc
+@@ -774,6 +774,7 @@ static const struct pci_device_id ath_pc
  	  .driver_data = ATH9K_PCI_BT_ANT_DIV },
  #endif
  
diff --git a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
similarity index 99%
rename from package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
rename to package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
index 8ea2f79a20..c13a72cbb0 100644
--- a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1000,7 +1000,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1056,7 +1056,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
diff --git a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
similarity index 100%
rename from package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
rename to package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
diff --git a/package/kernel/mac80211/patches/540-ath9k_reduce_ani_interval.patch b/package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
similarity index 100%
rename from package/kernel/mac80211/patches/540-ath9k_reduce_ani_interval.patch
rename to package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
similarity index 94%
rename from package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
rename to package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
index 6dd03fd28a..55896c834b 100644
--- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
@@ -75,7 +75,7 @@
  struct ath9k_hw_version {
  	u32 magic;
  	u16 devid;
-@@ -806,6 +812,8 @@ struct ath_hw {
+@@ -808,6 +814,8 @@ struct ath_hw {
  	u32 ah_flags;
  	s16 nf_override;
  
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1068,6 +1076,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
+@@ -1073,6 +1081,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1842,6 +1842,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1869,6 +1869,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2050,6 +2064,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2077,6 +2091,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
similarity index 94%
rename from package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
rename to package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
index f9d3251c22..b0a027564a 100644
--- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -765,7 +765,8 @@ static void ath9k_init_txpower_limits(st
+@@ -821,7 +821,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -960,6 +961,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -1016,6 +1017,18 @@ static void ath9k_set_hw_capab(struct at
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  }
  
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1005,6 +1018,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -1061,6 +1074,8 @@ int ath9k_init_device(u16 devid, struct
  		ARRAY_SIZE(ath9k_tpt_blink));
  #endif
  
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1322,9 +1322,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1324,9 +1324,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1339,6 +1360,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1341,6 +1362,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
similarity index 84%
rename from package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
rename to package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
index 680bb6d590..ba8f1e5d61 100644
--- a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -246,6 +246,19 @@ void ath9k_hw_get_channel_centers(struct
+@@ -248,6 +248,19 @@ void ath9k_hw_get_channel_centers(struct
  		centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
  }
  
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1414,6 +1427,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1441,6 +1454,9 @@ static bool ath9k_hw_set_reset(struct at
  		udelay(50);
  	}
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1513,6 +1529,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1540,6 +1556,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1820,8 +1839,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1847,8 +1866,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2075,6 +2100,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2102,6 +2127,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
similarity index 98%
rename from package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
rename to package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
index 22a2308a0b..3a3f244b9d 100644
--- a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -951,55 +951,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -953,55 +953,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
diff --git a/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch b/package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
rename to package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
diff --git a/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch b/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
similarity index 100%
rename from package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
rename to package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
diff --git a/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch b/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
similarity index 100%
rename from package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
rename to package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
diff --git a/package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch b/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
similarity index 88%
rename from package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
rename to package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
index 55f040f170..7d3a334c42 100644
--- a/package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
+++ b/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -571,6 +571,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -627,6 +627,12 @@ static int ath9k_of_init(struct ath_soft
  
  	ath_dbg(common, CONFIG, "parsing configuration from OF node\n");
  
diff --git a/package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
similarity index 99%
rename from package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
rename to package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
index 82b8109e06..30eba27137 100644
--- a/package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
+++ b/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -365,7 +365,7 @@
  	 * semi-random values after suspend/resume.
 --- a/drivers/net/wireless/ath/ath9k/Makefile
 +++ b/drivers/net/wireless/ath/ath9k/Makefile
-@@ -16,6 +16,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
+@@ -17,6 +17,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
  ath9k-$(CPTCFG_ATH9K_TX99) += tx99.o
  ath9k-$(CPTCFG_ATH9K_WOW) += wow.o
  ath9k-$(CPTCFG_ATH9K_HWRNG) += rng.o
@@ -386,7 +386,7 @@
  #endif /* _LINUX_ATH9K_PLATFORM_H */
 --- a/local-symbols
 +++ b/local-symbols
-@@ -114,6 +114,7 @@ ATH9K_WOW=
+@@ -110,6 +110,7 @@ ATH9K_WOW=
  ATH9K_RFKILL=
  ATH9K_CHANNEL_CONTEXT=
  ATH9K_PCOEM=
diff --git a/package/kernel/mac80211/patches/ath/552-ahb_of.patch b/package/kernel/mac80211/patches/ath/552-ahb_of.patch
new file mode 100644
index 0000000000..08735d2871
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/552-ahb_of.patch
@@ -0,0 +1,330 @@
+--- a/drivers/net/wireless/ath/ath9k/ahb.c
++++ b/drivers/net/wireless/ath/ath9k/ahb.c
+@@ -20,7 +20,15 @@
+ #include <linux/platform_device.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
++#include <linux/of_device.h>
+ #include "ath9k.h"
++#include <linux/ath9k_platform.h>
++
++#ifdef CONFIG_OF
++#include <asm/mach-ath79/ath79.h>
++#include <asm/mach-ath79/ar71xx_regs.h>
++#include <linux/mtd/mtd.h>
++#endif
+ 
+ static const struct platform_device_id ath9k_platform_id_table[] = {
+ 	{
+@@ -69,6 +77,235 @@ static const struct ath_bus_ops ath_ahb_
+ 	.eeprom_read = ath_ahb_eeprom_read,
+ };
+ 
++#ifdef CONFIG_OF
++
++#define QCA955X_DDR_CTL_CONFIG          0x108
++#define QCA955X_DDR_CTL_CONFIG_ACT_WMAC BIT(23)
++
++static int of_get_wifi_cal(struct device_node *np, struct ath9k_platform_data *pdata)
++{
++#ifdef CONFIG_MTD
++	struct device_node *mtd_np = NULL;
++	size_t retlen;
++	int size, ret;
++	struct mtd_info *mtd;
++	const char *part;
++	const __be32 *list;
++	phandle phandle;
++
++	list = of_get_property(np, "mtd-cal-data", &size);
++	if (!list)
++		return 0;
++
++	if (size != (2 * sizeof(*list)))
++		return 1;
++
++	phandle = be32_to_cpup(list++);
++	if (phandle)
++		mtd_np = of_find_node_by_phandle(phandle);
++
++	if (!mtd_np)
++		return 1;
++
++	part = of_get_property(mtd_np, "label", NULL);
++	if (!part)
++		part = mtd_np->name;
++
++	mtd = get_mtd_device_nm(part);
++	if (IS_ERR(mtd))
++		return 1;
++
++	ret = mtd_read(mtd, be32_to_cpup(list), sizeof(pdata->eeprom_data),
++			&retlen, (u8*)pdata->eeprom_data);
++	put_mtd_device(mtd);
++
++#endif
++	return 0;
++}
++
++static int ar913x_wmac_reset(void)
++{
++	ath79_device_reset_set(AR913X_RESET_AMBA2WMAC);
++	mdelay(10);
++
++	ath79_device_reset_clear(AR913X_RESET_AMBA2WMAC);
++	mdelay(10);
++
++	return 0;
++}
++
++static int ar933x_wmac_reset(void)
++{
++	int retries = 20;
++
++	ath79_device_reset_set(AR933X_RESET_WMAC);
++	ath79_device_reset_clear(AR933X_RESET_WMAC);
++
++	while (1) {
++		u32 bootstrap;
++
++		bootstrap = ath79_reset_rr(AR933X_RESET_REG_BOOTSTRAP);
++		if ((bootstrap & AR933X_BOOTSTRAP_EEPBUSY) == 0)
++			return 0;
++
++		if (retries-- == 0)
++			break;
++
++		udelay(10000);
++	}
++
++	pr_err("ar933x: WMAC reset timed out");
++	return -ETIMEDOUT;
++}
++
++static int qca955x_wmac_reset(void)
++{
++	int i;
++
++	/* Try to wait for WMAC DDR activity to stop */
++	for (i = 0; i < 10; i++) {
++		if (!(__raw_readl(ath79_ddr_base + QCA955X_DDR_CTL_CONFIG) &
++		    QCA955X_DDR_CTL_CONFIG_ACT_WMAC))
++			break;
++
++		udelay(10);
++	}
++
++	ath79_device_reset_set(QCA955X_RESET_RTC);
++	udelay(10);
++	ath79_device_reset_clear(QCA955X_RESET_RTC);
++	udelay(10);
++
++	return 0;
++}
++
++enum {
++	AR913X_WMAC = 0,
++	AR933X_WMAC,
++	AR934X_WMAC,
++	QCA953X_WMAC,
++	QCA955X_WMAC,
++	QCA956X_WMAC,
++};
++
++static int ar9330_get_soc_revision(void)
++{
++	if (ath79_soc_rev == 1)
++		return ath79_soc_rev;
++
++	return 0;
++}
++
++static int ath79_get_soc_revision(void)
++{
++	return ath79_soc_rev;
++}
++
++static const struct of_ath_ahb_data {
++	u16 dev_id;
++	u32 bootstrap_reg;
++	u32 bootstrap_ref;
++
++	int (*soc_revision)(void);
++	int (*wmac_reset)(void);
++} of_ath_ahb_data[] = {
++	[AR913X_WMAC] = {
++		.dev_id = AR5416_AR9100_DEVID,
++		.wmac_reset = ar913x_wmac_reset,
++
++	},
++	[AR933X_WMAC] = {
++		.dev_id = AR9300_DEVID_AR9330,
++		.bootstrap_reg = AR933X_RESET_REG_BOOTSTRAP,
++		.bootstrap_ref = AR933X_BOOTSTRAP_REF_CLK_40,
++		.soc_revision = ar9330_get_soc_revision,
++		.wmac_reset = ar933x_wmac_reset,
++	},
++	[AR934X_WMAC] = {
++		.dev_id = AR9300_DEVID_AR9340,
++		.bootstrap_reg = AR934X_RESET_REG_BOOTSTRAP,
++		.bootstrap_ref = AR934X_BOOTSTRAP_REF_CLK_40,
++		.soc_revision = ath79_get_soc_revision,
++	},
++	[QCA953X_WMAC] = {
++		.dev_id = AR9300_DEVID_AR953X,
++		.bootstrap_reg = QCA953X_RESET_REG_BOOTSTRAP,
++		.bootstrap_ref = QCA953X_BOOTSTRAP_REF_CLK_40,
++		.soc_revision = ath79_get_soc_revision,
++	},
++	[QCA955X_WMAC] = {
++		.dev_id = AR9300_DEVID_QCA955X,
++		.bootstrap_reg = QCA955X_RESET_REG_BOOTSTRAP,
++		.bootstrap_ref = QCA955X_BOOTSTRAP_REF_CLK_40,
++		.wmac_reset = qca955x_wmac_reset,
++	},
++	[QCA956X_WMAC] = {
++		.dev_id = AR9300_DEVID_QCA956X,
++		.bootstrap_reg = QCA956X_RESET_REG_BOOTSTRAP,
++		.bootstrap_ref = QCA956X_BOOTSTRAP_REF_CLK_40,
++		.soc_revision = ath79_get_soc_revision,
++	},
++};
++
++const struct of_device_id of_ath_ahb_match[] = {
++	{ .compatible = "qca,ar9130-wmac", .data = &of_ath_ahb_data[AR913X_WMAC] },
++	{ .compatible = "qca,ar9330-wmac", .data = &of_ath_ahb_data[AR933X_WMAC] },
++	{ .compatible = "qca,ar9340-wmac", .data = &of_ath_ahb_data[AR934X_WMAC] },
++	{ .compatible = "qca,qca9530-wmac", .data = &of_ath_ahb_data[QCA953X_WMAC] },
++	{ .compatible = "qca,qca9550-wmac", .data = &of_ath_ahb_data[QCA955X_WMAC] },
++	{ .compatible = "qca,qca9560-wmac", .data = &of_ath_ahb_data[QCA956X_WMAC] },
++	{},
++};
++MODULE_DEVICE_TABLE(of, of_ath_ahb_match);
++
++static int of_ath_ahb_probe(struct platform_device *pdev)
++{
++	struct ath9k_platform_data *pdata;
++	const struct of_device_id *match;
++	const struct of_ath_ahb_data *data;
++	u8 led_pin;
++
++	match = of_match_device(of_ath_ahb_match, &pdev->dev);
++	data = (const struct of_ath_ahb_data *)match->data;
++
++	pdata = dev_get_platdata(&pdev->dev);
++
++	if (!of_property_read_u8(pdev->dev.of_node, "qca,led-pin", &led_pin))
++		pdata->led_pin = led_pin;
++	else
++		pdata->led_pin = -1;
++
++	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-2ghz"))
++		pdata->disable_2ghz = true;
++
++	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-5ghz"))
++		pdata->disable_5ghz = true;
++
++	if (of_property_read_bool(pdev->dev.of_node, "qca,tx-gain-buffalo"))
++		pdata->tx_gain_buffalo = true;
++
++	if (data->wmac_reset) {
++		data->wmac_reset();
++		pdata->external_reset = data->wmac_reset;
++	}
++
++	if (data->bootstrap_reg && data->bootstrap_ref) {
++		u32 t = ath79_reset_rr(data->bootstrap_reg);
++		if (t & data->bootstrap_ref)
++			pdata->is_clk_25mhz = false;
++		else
++			pdata->is_clk_25mhz = true;
++	}
++
++	pdata->get_mac_revision = data->soc_revision;
++
++	if (of_get_wifi_cal(pdev->dev.of_node, pdata))
++		dev_err(&pdev->dev, "failed to load calibration data from mtd device\n");
++
++	return data->dev_id;
++}
++#endif
++
+ static int ath_ahb_probe(struct platform_device *pdev)
+ {
+ 	void __iomem *mem;
+@@ -80,6 +317,17 @@ static int ath_ahb_probe(struct platform
+ 	int ret = 0;
+ 	struct ath_hw *ah;
+ 	char hw_name[64];
++	u16 dev_id;
++
++	if (id)
++		dev_id = id->driver_data;
++
++#ifdef CONFIG_OF
++	if (pdev->dev.of_node)
++		pdev->dev.platform_data = devm_kzalloc(&pdev->dev,
++					sizeof(struct ath9k_platform_data),
++					GFP_KERNEL);
++#endif
+ 
+ 	if (!dev_get_platdata(&pdev->dev)) {
+ 		dev_err(&pdev->dev, "no platform data specified\n");
+@@ -122,13 +370,16 @@ static int ath_ahb_probe(struct platform
+ 	sc->mem = mem;
+ 	sc->irq = irq;
+ 
++#ifdef CONFIG_OF
++	dev_id = of_ath_ahb_probe(pdev);
++#endif
+ 	ret = request_irq(irq, ath_isr, IRQF_SHARED, "ath9k", sc);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "request_irq failed\n");
+ 		goto err_free_hw;
+ 	}
+ 
+-	ret = ath9k_init_device(id->driver_data, sc, &ath_ahb_bus_ops);
++	ret = ath9k_init_device(dev_id, sc, &ath_ahb_bus_ops);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to initialize device\n");
+ 		goto err_irq;
+@@ -159,6 +410,9 @@ static int ath_ahb_remove(struct platfor
+ 		free_irq(sc->irq, sc);
+ 		ieee80211_free_hw(sc->hw);
+ 	}
++#ifdef CONFIG_OF
++	pdev->dev.platform_data = NULL;
++#endif
+ 
+ 	return 0;
+ }
+@@ -168,6 +422,9 @@ static struct platform_driver ath_ahb_dr
+ 	.remove     = ath_ahb_remove,
+ 	.driver		= {
+ 		.name	= "ath9k",
++#ifdef CONFIG_OF
++		.of_match_table = of_ath_ahb_match,
++#endif
+ 	},
+ 	.id_table    = ath9k_platform_id_table,
+ };
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -25,6 +25,7 @@
+ #include <linux/time.h>
+ #include <linux/hw_random.h>
+ #include <linux/gpio/driver.h>
++#include <linux/reset.h>
+ 
+ #include "common.h"
+ #include "debug.h"
+@@ -1023,6 +1024,9 @@ struct ath_softc {
+ 	struct ath_hw *sc_ah;
+ 	void __iomem *mem;
+ 	int irq;
++#ifdef CONFIG_OF
++	struct reset_control *reset;
++#endif
+ 	spinlock_t sc_serial_rw;
+ 	spinlock_t sc_pm_lock;
+ 	spinlock_t sc_pcu_lock;
diff --git a/package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch b/package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch
similarity index 86%
rename from package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch
rename to package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch
index a1d612660b..607722cc3d 100644
--- a/package/kernel/mac80211/patches/553-ath9k-dynack-move-debug-log-after-buffer-increments.patch
+++ b/package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch
@@ -12,9 +12,9 @@ Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
 
 --- a/drivers/net/wireless/ath/ath9k/dynack.c
 +++ b/drivers/net/wireless/ath/ath9k/dynack.c
-@@ -171,11 +171,12 @@ static void ath_dynack_compute_to(struct
- void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
- 			     struct ath_tx_status *ts)
+@@ -178,11 +178,12 @@ void ath_dynack_sample_tx_ts(struct ath_
+ 			     struct ath_tx_status *ts,
+ 			     struct ieee80211_sta *sta)
  {
 -	u8 ridx;
  	struct ieee80211_hdr *hdr;
@@ -24,9 +24,9 @@ Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
 +	u32 dur = ts->duration;
 +	u8 ridx;
  
- 	if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled)
+ 	if (!da->enabled || (info->flags & IEEE80211_TX_CTL_NO_ACK))
  		return;
-@@ -203,14 +204,13 @@ void ath_dynack_sample_tx_ts(struct ath_
+@@ -217,14 +218,13 @@ void ath_dynack_sample_tx_ts(struct ath_
  	ridx = ts->ts_rateindex;
  
  	da->st_rbf.ts[da->st_rbf.t_rb].tstamp = ts->ts_tstamp;
@@ -42,7 +42,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
  
  		rate = &common->sbands[info->band].bitrates[rates[ridx].idx];
  		if (info->band == NL80211_BAND_2GHZ &&
-@@ -219,19 +219,18 @@ void ath_dynack_sample_tx_ts(struct ath_
+@@ -233,19 +233,18 @@ void ath_dynack_sample_tx_ts(struct ath_
  		else
  			phy = WLAN_RC_PHY_OFDM;
  
@@ -68,7 +68,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
  	ath_dynack_compute_to(ah);
  
  	spin_unlock_bh(&da->qlock);
-@@ -258,14 +257,13 @@ void ath_dynack_sample_ack_ts(struct ath
+@@ -272,14 +271,13 @@ void ath_dynack_sample_ack_ts(struct ath
  	spin_lock_bh(&da->qlock);
  	da->ack_rbf.tstamp[da->ack_rbf.t_rb] = ts;
  
diff --git a/package/kernel/mac80211/patches/556-ath9k-dynack-remove-experimental-tag.patch b/package/kernel/mac80211/patches/ath/557-ath9k-dynack-remove-experimental-tag.patch
similarity index 100%
rename from package/kernel/mac80211/patches/556-ath9k-dynack-remove-experimental-tag.patch
rename to package/kernel/mac80211/patches/ath/557-ath9k-dynack-remove-experimental-tag.patch
diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
similarity index 94%
rename from package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
index 2c466a300c..47ecc9c655 100644
--- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -2494,6 +2494,16 @@ int ath10k_core_register(struct ath10k *
+@@ -2720,6 +2720,16 @@ int ath10k_core_register(struct ath10k *
  	ar->chip_id = chip_id;
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
similarity index 90%
rename from package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
rename to package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
index 21e7359bc9..3fd6bca819 100644
--- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8080,6 +8080,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -8282,6 +8282,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -8352,6 +8367,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8571,6 +8586,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
diff --git a/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
new file mode 100644
index 0000000000..810e97a783
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath10k/htt.h
++++ b/drivers/net/wireless/ath/ath10k/htt.h
+@@ -238,7 +238,7 @@ enum htt_rx_ring_flags {
+ };
+ 
+ #define HTT_RX_RING_SIZE_MIN 128
+-#define HTT_RX_RING_SIZE_MAX 2048
++#define HTT_RX_RING_SIZE_MAX 512
+ #define HTT_RX_RING_SIZE HTT_RX_RING_SIZE_MAX
+ #define HTT_RX_RING_FILL_LEVEL (((HTT_RX_RING_SIZE) / 2) - 1)
+ #define HTT_RX_RING_FILL_LEVEL_DUAL_MAC (HTT_RX_RING_SIZE - 1)
diff --git a/package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch b/package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
similarity index 75%
rename from package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
rename to package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
index a101282d07..283f4d819f 100644
--- a/package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
+++ b/package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/pci.c
 +++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -128,7 +128,7 @@ static struct ce_attr host_ce_config_wla
+@@ -142,7 +142,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
@@ -9,7 +9,7 @@
  		.recv_cb = ath10k_pci_htt_htc_rx_cb,
  	},
  
-@@ -137,7 +137,7 @@ static struct ce_attr host_ce_config_wla
+@@ -151,7 +151,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
@@ -18,7 +18,7 @@
  		.recv_cb = ath10k_pci_htc_rx_cb,
  	},
  
-@@ -164,7 +164,7 @@ static struct ce_attr host_ce_config_wla
+@@ -178,7 +178,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 512,
@@ -27,7 +27,7 @@
  		.recv_cb = ath10k_pci_htt_rx_cb,
  	},
  
-@@ -189,7 +189,7 @@ static struct ce_attr host_ce_config_wla
+@@ -203,7 +203,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
diff --git a/package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch b/package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
similarity index 55%
rename from package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
rename to package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
index 9dceea8f41..d8f6887cd0 100644
--- a/package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
+++ b/package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
@@ -1,34 +1,29 @@
-From: Sebastian Gottschall <s.gottsch...@dd-wrt.com>
+From: Sebastian Gottschall <s.gottschall@dd-wrt.com>
 
-current handling of peer_bw_rxnss_override parameter is based on guessing the 
-VHT160/8080 capability by rx rate. this is wrong and may lead
-to a non initialized peer_bw_rxnss_override parameter which is required since 
-VHT160 operation mode only supports 2x2 chainmasks in addition the original code
+current handling of peer_bw_rxnss_override parameter is based on guessing the VHT160/8080 capability by rx rate. this is wrong and may lead
+to a non initialized peer_bw_rxnss_override parameter which is required since VHT160 operation mode only supports 2x2 chainmasks in addition the original code
 initialized the parameter with wrong masked values.
-This patch uses the peer phymode and peer nss information for correct 
-initialisation of the peer_bw_rxnss_override parameter.
-if this peer information is not available, we initialize the parameter by 
-minimum nss which is suggested by QCA as temporary workaround according
+This patch uses the peer phymode and peer nss information for correct initialisation of the peer_bw_rxnss_override parameter.
+if this peer information is not available, we initialize the parameter by minimum nss which is suggested by QCA as temporary workaround according
 to the QCA sourcecodes.
 
-Signed-off-by: Sebastian Gottschall <s.gottsch...@dd-wrt.com>
+Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
 
 v2: remove debug messages
 v3: apply some cosmetics, update documentation
-v4: fix compile warning and truncate nss to maximum of 2x2 since current 
-chipsets only support 2x2 at vht160
+v4: fix compile warning and truncate nss to maximum of 2x2 since current chipsets only support 2x2 at vht160
 v5: handle maximum nss for chipsets supportig vht160 with 1x1 only
-v7: use more simple code variant and take care about hw/sw chainmask 
-configuration
+v7: use more simple code variant and take care about hw/sw chainmask configuration
+v8: fix some code style issues
+v9: use SM/MS macros from code.h to simplify shift/mask handling
 ---
- drivers/net/wireless/ath/ath10k/mac.c | 40 +++++++++++++++------------
- drivers/net/wireless/ath/ath10k/wmi.c |  7 +----
- drivers/net/wireless/ath/ath10k/wmi.h | 14 +++++++++-
- 3 files changed, 36 insertions(+), 25 deletions(-)
-
+ drivers/net/wireless/ath/ath10k/mac.c | 54 +++++++++++++++++++--------
+ drivers/net/wireless/ath/ath10k/wmi.c |  7 +---
+ drivers/net/wireless/ath/ath10k/wmi.h | 14 ++++++-
+ 3 files changed, 52 insertions(+), 23 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -2466,7 +2466,7 @@ static void ath10k_peer_assoc_h_vht(stru
+@@ -2469,7 +2469,7 @@ static void ath10k_peer_assoc_h_vht(stru
  	const u16 *vht_mcs_mask;
  	u8 ampdu_factor;
  	u8 max_nss, vht_mcs;
@@ -37,7 +32,7 @@ configuration
  
  	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
  		return;
-@@ -2526,23 +2526,27 @@ static void ath10k_peer_assoc_h_vht(stru
+@@ -2529,23 +2529,45 @@ static void ath10k_peer_assoc_h_vht(stru
  		__le16_to_cpu(vht_cap->vht_mcs.tx_highest);
  	arg->peer_vht_rates.tx_mcs_set = ath10k_peer_assoc_h_vht_limit(
  		__le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
@@ -46,7 +41,10 @@ configuration
  
 -	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
 -		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
--
++	/* only local 4x4 configuration do support 2x2 for VHT160,
++	 * everything else must use 1x1 
++	 */
+ 
 -	if (arg->peer_vht_rates.rx_max_rate &&
 -	    (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK)) {
 -		switch (arg->peer_vht_rates.rx_max_rate) {
@@ -59,28 +57,42 @@ configuration
 -			arg->peer_bw_rxnss_override = 1;
 -			break;
 -		}
-+	/* only 4x4 configuration do support 2x2 for VHT160, everything else must use 1x1 */
 +	if (ar->cfg_rx_chainmask == 15)
-+		nss160 = arg->peer_num_spatial_streams <= 2 ? arg->peer_num_spatial_streams : 2;
++		nss160 = arg->peer_num_spatial_streams <= 2 ? 1 : 2;
 +
-+	/* in case if peer is connected with vht160 or vht80+80, we need to properly adjust rxnss parameters otherwise firmware will raise a assert */
-+	switch(arg->peer_phymode) {
++	/* if peer provides 1x1 nss160 information using max rate
++	 * vht information, we reduce local nss160 to 1x1.
++	 * consider that it has been observed that some client
++	 * devices provide zero here, no matter which transmission
++	 * rate is possible. in that case the local nss configuration 
++	 * will be used at maxmimum configuration possible. (see above)
++	 */
++
++	if (arg->peer_vht_rates.rx_max_rate == 780)
++		nss160 = 1;
++
++	/* in case if peer is connected with vht160 or vht80+80,
++         * we need to properly adjust rxnss parameters otherwise 
++	 * firmware will raise a assert 
++	 */
++	switch (arg->peer_phymode) {
 +	case MODE_11AC_VHT80_80:
 +		arg->peer_bw_rxnss_override = BW_NSS_FWCONF_80_80(nss160);
 +	/* fall through */
 +	case MODE_11AC_VHT160:
 +		arg->peer_bw_rxnss_override |= BW_NSS_FWCONF_160(nss160);
-+	break;
++		break;
 +	default:
-+	break;
++		break;
  	}
 +
 +	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x peer_bw_rxnss_override 0x%x\n",
-+		   sta->addr, arg->peer_max_mpdu, arg->peer_flags, arg->peer_bw_rxnss_override);
++		   sta->addr, arg->peer_max_mpdu, arg->peer_flags, 
++		   arg->peer_bw_rxnss_override);
  }
  
  static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
-@@ -2694,9 +2698,9 @@ static int ath10k_peer_assoc_prepare(str
+@@ -2697,9 +2719,9 @@ static int ath10k_peer_assoc_prepare(str
  	ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
  	ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
  	ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
@@ -93,7 +105,7 @@ configuration
  }
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -6760,12 +6760,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
+@@ -7357,12 +7357,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
  	struct wmi_10_4_peer_assoc_complete_cmd *cmd = buf;
  
  	ath10k_wmi_peer_assoc_fill_10_2(ar, buf, arg);
@@ -109,24 +121,24 @@ configuration
  static int
 --- a/drivers/net/wireless/ath/ath10k/wmi.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -6209,7 +6209,19 @@ struct wmi_10_2_peer_assoc_complete_cmd
+@@ -6357,7 +6357,19 @@ struct wmi_10_2_peer_assoc_complete_cmd
  	__le32 info0; /* WMI_PEER_ASSOC_INFO0_ */
  } __packed;
  
 -#define PEER_BW_RXNSS_OVERRIDE_OFFSET  31
-+#define BW_NSS_FWCONF_MAP_ENABLE             (1 << 31)
-+#define BW_NSS_FWCONF_MAP_160MHZ_S           (0)
-+#define BW_NSS_FWCONF_MAP_160MHZ_M           (0x00000007)
-+#define BW_NSS_FWCONF_MAP_80_80MHZ_S         (3)
-+#define BW_NSS_FWCONF_MAP_80_80MHZ_M         (0x00000038)
-+#define BW_NSS_FWCONF_MAP_M                  (0x0000003F)
++#define BW_NSS_FWCONF_MAP_ENABLE	BIT(31)
++#define BW_NSS_FWCONF_MAP_160MHZ_LSB	(0)
++#define BW_NSS_FWCONF_MAP_160MHZ_MASK	(0x00000007)
++#define BW_NSS_FWCONF_MAP_80_80MHZ_LSB	(3)
++#define BW_NSS_FWCONF_MAP_80_80MHZ_MASK (0x00000038)
++#define BW_NSS_FWCONF_MAP_MASK		(0x0000003F)
 +
-+#define GET_BW_NSS_FWCONF_160(x)             ((((x) & BW_NSS_FWCONF_MAP_160MHZ_M) >> BW_NSS_FWCONF_MAP_160MHZ_S) + 1)
-+#define GET_BW_NSS_FWCONF_80_80(x)           ((((x) & BW_NSS_FWCONF_MAP_80_80MHZ_M) >> BW_NSS_FWCONF_MAP_80_80MHZ_S) + 1)
++#define GET_BW_NSS_FWCONF_160(x)	(MS(x, BW_NSS_FWCONF_MAP_160MHZ) + 1)
++#define GET_BW_NSS_FWCONF_80_80(x)	(MS(x, BW_NSS_FWCONF_MAP_80_80MHZ) + 1)
 +
 +/* Values defined to set 160 MHz Bandwidth NSS Mapping into FW*/
-+#define BW_NSS_FWCONF_160(x)          (BW_NSS_FWCONF_MAP_ENABLE | (((x - 1) << BW_NSS_FWCONF_MAP_160MHZ_S) & BW_NSS_FWCONF_MAP_160MHZ_M))
-+#define BW_NSS_FWCONF_80_80(x)        (BW_NSS_FWCONF_MAP_ENABLE | (((x - 1) << BW_NSS_FWCONF_MAP_80_80MHZ_S) & BW_NSS_FWCONF_MAP_80_80MHZ_M))
++#define BW_NSS_FWCONF_160(x)		(BW_NSS_FWCONF_MAP_ENABLE | SM(x - 1, BW_NSS_FWCONF_MAP_160MHZ))
++#define BW_NSS_FWCONF_80_80(x)		(BW_NSS_FWCONF_MAP_ENABLE | SM(x - 1, BW_NSS_FWCONF_MAP_80_80MHZ))
  
  struct wmi_10_4_peer_assoc_complete_cmd {
  	struct wmi_10_2_peer_assoc_complete_cmd cmd;
diff --git a/package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch b/package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
similarity index 88%
rename from package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
rename to package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
index 657b31f5a8..9a7c749cb1 100644
--- a/package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
+++ b/package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
@@ -4,13 +4,16 @@ starting with firmware 10.4.3.4.x series QCA changed the handling of the channel
 likelly for backward compatiblity with vht80 only capable clients.
 this patch adjusts the handling to get vht160 to work again with official qca firmwares newer than 3.3
 consider that this patch will not work with older firmwares anymore. to avoid undefined behaviour this we disable vht160 capability for outdated firmwares
+Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
+
+v2: fix trailing whitespace issue and fix some typos within the commit note
 ---
  drivers/net/wireless/ath/ath10k/mac.c |  7 -------
  drivers/net/wireless/ath/ath10k/wmi.c | 11 ++++++++---
  2 files changed, 8 insertions(+), 10 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -4415,13 +4415,6 @@ static struct ieee80211_sta_vht_cap ath1
+@@ -4473,13 +4473,6 @@ static struct ieee80211_sta_vht_cap ath1
  		vht_cap.cap |= val;
  	}
  
@@ -26,7 +29,7 @@ consider that this patch will not work with older firmwares anymore. to avoid un
  		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -1660,13 +1660,18 @@ void ath10k_wmi_put_wmi_channel(struct w
+@@ -1677,13 +1677,18 @@ void ath10k_wmi_put_wmi_channel(struct w
  		flags |= WMI_CHAN_FLAG_HT40_PLUS;
  	if (arg->chan_radar)
  		flags |= WMI_CHAN_FLAG_DFS;
@@ -42,7 +45,7 @@ consider that this patch will not work with older firmwares anymore. to avoid un
 +		if (arg->freq < arg->band_center_freq1)
 +			ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1 - 40);
 +		else
-+			ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1 + 40);		
++			ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1 + 40);
 +		ch->band_center_freq2 = __cpu_to_le32(arg->band_center_freq1);
 +	}
  	ch->min_power = arg->min_power;
diff --git a/package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
similarity index 92%
rename from package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
rename to package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index fc7fe1edb0..50ed63b065 100644
--- a/package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -85,7 +85,7 @@ v13:
  create mode 100644 drivers/net/wireless/ath/ath10k/leds.h
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -56,6 +56,16 @@ config ATH10K_DEBUGFS
+@@ -69,6 +69,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -104,35 +104,35 @@ v13:
  	depends on ATH10K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath10k/Makefile
 +++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -18,6 +18,7 @@ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) +=
+@@ -19,6 +19,7 @@ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) +=
  ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
  ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
 +ath10k_core-$(CPTCFG_ATH10K_LEDS) += leds.o
  ath10k_core-$(CPTCFG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
- 
+ ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -143,6 +143,7 @@ ATH10K_USB=
- ATH10K_DEBUG=
+@@ -142,6 +142,7 @@ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
+ ATH10K_THERMAL=
 +ATH10K_LEDS=
  ATH10K_TRACING=
  ATH10K_DFS_CERTIFIED=
  WCN36XX=
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -32,6 +32,7 @@
- #include "htt.h"
+@@ -34,6 +34,7 @@
  #include "testmode.h"
  #include "wmi-ops.h"
+ #include "coredump.h"
 +#include "leds.h"
  
  unsigned int ath10k_debug_mask;
  static unsigned int ath10k_cryptmode_param;
-@@ -56,6 +57,7 @@ static const struct ath10k_hw_params ath
+@@ -64,6 +65,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA988X_HW_2_0_VERSION,
  		.dev_id = QCA988X_2_0_DEVICE_ID,
  		.name = "qca988x hw2.0",
@@ -140,7 +140,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -80,6 +82,7 @@ static const struct ath10k_hw_params ath
+@@ -129,6 +131,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA9887_HW_1_0_VERSION,
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.name = "qca9887 hw1.0",
@@ -148,7 +148,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -199,6 +202,7 @@ static const struct ath10k_hw_params ath
+@@ -293,6 +296,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA99X0_HW_2_0_DEV_VERSION,
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.name = "qca99x0 hw2.0",
@@ -156,7 +156,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -228,6 +232,7 @@ static const struct ath10k_hw_params ath
+@@ -331,6 +335,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA9984_HW_1_0_DEV_VERSION,
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.name = "qca9984/qca9994 hw1.0",
@@ -164,7 +164,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -262,6 +267,7 @@ static const struct ath10k_hw_params ath
+@@ -374,6 +379,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA9888_HW_2_0_DEV_VERSION,
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.name = "qca9888 hw2.0",
@@ -172,7 +172,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -2254,6 +2260,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -2441,6 +2447,10 @@ int ath10k_core_start(struct ath10k *ar,
  	if (status)
  		goto err_hif_stop;
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -2471,9 +2481,18 @@ static void ath10k_core_register_work(st
+@@ -2695,9 +2705,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -2515,6 +2534,8 @@ void ath10k_core_unregister(struct ath10
+@@ -2741,6 +2760,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -213,7 +213,7 @@ v13:
  	 * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -24,6 +24,7 @@
+@@ -25,6 +25,7 @@
  #include <linux/pci.h>
  #include <linux/uuid.h>
  #include <linux/time.h>
@@ -221,7 +221,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -789,7 +790,6 @@ struct ath10k {
+@@ -908,7 +909,6 @@ struct ath10k {
  	u32 low_5ghz_chan;
  	u32 high_5ghz_chan;
  	bool ani_enabled;
@@ -229,7 +229,7 @@ v13:
  	bool p2p;
  
  	struct {
-@@ -972,6 +972,13 @@ struct ath10k {
+@@ -1099,6 +1099,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -245,7 +245,7 @@ v13:
  		u32 fw_warm_reset_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -490,6 +490,7 @@ struct ath10k_hw_params {
+@@ -504,6 +504,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;
@@ -405,7 +405,7 @@ v13:
 +#endif /* _LEDS_H_ */
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -32,6 +32,7 @@
+@@ -33,6 +33,7 @@
  #include "wmi-tlv.h"
  #include "wmi-ops.h"
  #include "wow.h"
@@ -415,18 +415,18 @@ v13:
  /* Rates */
 --- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
-@@ -197,6 +197,10 @@ struct wmi_ops {
- 					(struct ath10k *ar,
- 					 enum wmi_bss_survey_req_type type);
+@@ -216,7 +216,10 @@ struct wmi_ops {
  	struct sk_buff *(*gen_echo)(struct ath10k *ar, u32 value);
+ 	struct sk_buff *(*gen_pdev_get_tpc_table_cmdid)(struct ath10k *ar,
+ 							u32 param);
 +	struct sk_buff *(*gen_gpio_config)(struct ath10k *ar, u32 gpio_num,
 +					   u32 input, u32 pull_type, u32 intr_mode);
-+ 
+ 
 +	struct sk_buff *(*gen_gpio_output)(struct ath10k *ar, u32 gpio_num, u32 set);
  };
  
  int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-@@ -951,6 +955,35 @@ ath10k_wmi_force_fw_hang(struct ath10k *
+@@ -1054,6 +1057,35 @@ ath10k_wmi_force_fw_hang(struct ath10k *
  	return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
  }
  
@@ -464,7 +464,7 @@ v13:
  {
 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
-@@ -3619,6 +3619,8 @@ static const struct wmi_ops wmi_tlv_ops
+@@ -3976,6 +3976,8 @@ static const struct wmi_ops wmi_tlv_ops
  	.gen_echo = ath10k_wmi_tlv_op_gen_echo,
  	.gen_vdev_spectral_conf = ath10k_wmi_tlv_op_gen_vdev_spectral_conf,
  	.gen_vdev_spectral_enable = ath10k_wmi_tlv_op_gen_vdev_spectral_enable,
@@ -475,7 +475,7 @@ v13:
  static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -6580,6 +6580,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
+@@ -7177,6 +7177,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
  	return skb;
  }
  
@@ -525,7 +525,7 @@ v13:
  static struct sk_buff *
  ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
  			     enum wmi_sta_ps_mode psmode)
-@@ -8081,6 +8124,9 @@ static const struct wmi_ops wmi_ops = {
+@@ -8788,6 +8831,9 @@ static const struct wmi_ops wmi_ops = {
  	.fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -535,7 +535,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8151,6 +8197,8 @@ static const struct wmi_ops wmi_10_1_ops
+@@ -8858,6 +8904,8 @@ static const struct wmi_ops wmi_10_1_ops
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -544,7 +544,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8222,6 +8270,8 @@ static const struct wmi_ops wmi_10_2_ops
+@@ -8929,6 +8977,8 @@ static const struct wmi_ops wmi_10_2_ops
  	.gen_delba_send = ath10k_wmi_op_gen_delba_send,
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
@@ -553,7 +553,7 @@ v13:
  	/* .gen_pdev_enable_adaptive_cca not implemented */
  };
  
-@@ -8292,6 +8342,8 @@ static const struct wmi_ops wmi_10_2_4_o
+@@ -8999,6 +9049,8 @@ static const struct wmi_ops wmi_10_2_4_o
  	.gen_pdev_enable_adaptive_cca =
  		ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
  	.get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
@@ -562,7 +562,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8367,6 +8419,8 @@ static const struct wmi_ops wmi_10_4_ops
+@@ -9078,6 +9130,8 @@ static const struct wmi_ops wmi_10_4_ops
  	.gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
  	.gen_echo = ath10k_wmi_op_gen_echo,
  	.gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,
@@ -573,7 +573,7 @@ v13:
  int ath10k_wmi_attach(struct ath10k *ar)
 --- a/drivers/net/wireless/ath/ath10k/wmi.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -2899,6 +2899,41 @@ enum wmi_10_4_feature_mask {
+@@ -2942,6 +2942,41 @@ enum wmi_10_4_feature_mask {
  
  };
  
diff --git a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
new file mode 100644
index 0000000000..dfe2829468
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
@@ -0,0 +1,53 @@
+From 79c9d7aabae1d1da9eea97d83b61e1517a8a2221 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Fri, 22 Jun 2018 18:59:44 +0200
+Subject: [PATCH] ath10k: use tpt LED trigger by default
+
+Use the tpt LED trigger for each created phy led. Ths way LEDs attached
+to the ath10k GPIO pins are indicating the phy status and blink on
+traffic.
+
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+---
+ drivers/net/wireless/ath/ath10k/core.h | 4 ++++
+ drivers/net/wireless/ath/ath10k/leds.c | 4 +---
+ drivers/net/wireless/ath/ath10k/mac.c  | 2 +-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -1144,6 +1144,10 @@ struct ath10k {
+ 	struct ath10k_radar_found_info last_radar_info;
+ 	struct work_struct radar_confirmation_work;
+ 
++#ifdef CPTCFG_MAC80211_LEDS
++	const char *led_default_trigger;
++#endif
++
+ 	/* must be last */
+ 	u8 drv_priv[0] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath10k/leds.c
++++ b/drivers/net/wireless/ath/ath10k/leds.c
+@@ -81,9 +81,7 @@ int ath10k_leds_register(struct ath10k *
+ 
+ 	ar->leds.cdev.name = ar->leds.label;
+ 	ar->leds.cdev.brightness_set_blocking = ath10k_leds_set_brightness_blocking;
+-
+-	/* FIXME: this assignment doesn't make sense as it's NULL, remove it? */
+-	ar->leds.cdev.default_trigger = ar->leds.wifi_led.default_trigger;
++	ar->leds.cdev.default_trigger = ar->led_default_trigger;
+ 
+ 	ret = led_classdev_register(wiphy_dev(ar->hw->wiphy), &ar->leds.cdev);
+ 	if (ret)
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -8603,7 +8603,7 @@ int ath10k_mac_register(struct ath10k *a
+ 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
+ 
+ #ifdef CPTCFG_MAC80211_LEDS
+-	ieee80211_create_tpt_led_trigger(ar->hw,
++	ar->led_default_trigger = ieee80211_create_tpt_led_trigger(ar->hw,
+ 		IEEE80211_TPT_LEDTRIG_FL_RADIO, ath10k_tpt_blink,
+ 		ARRAY_SIZE(ath10k_tpt_blink));
+ #endif
diff --git a/package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch b/package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
new file mode 100644
index 0000000000..260c0c7867
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
@@ -0,0 +1,39 @@
+From bbf0a8af2261bc7ae39b227ff6a1e9f45a008c27 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Mon, 30 Jul 2018 17:31:41 +0200
+Subject: [PATCH] ath10k: Limit available channels via DT ieee80211-freq-limit
+
+Tri-band devices (1x 2.4GHz + 2x 5GHz) often incorporate special filters in
+the RX and TX path. These filtered channel can in theory still be used by
+the hardware but the signal strength is reduced so much that it makes no
+sense.
+
+There is already a DT property to limit the available channels but ath10k
+has to manually call this functionality to limit the currrently set wiphy
+channels further.
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+Forwarded: https://patchwork.kernel.org/patch/10549245/
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -18,6 +18,7 @@
+ 
+ #include "mac.h"
+ 
++#include <net/cfg80211.h>
+ #include <net/mac80211.h>
+ #include <linux/etherdevice.h>
+ #include <linux/acpi.h>
+@@ -8390,6 +8391,7 @@ int ath10k_mac_register(struct ath10k *a
+ 		ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
+ 	}
+ 
++	wiphy_read_of_freq_limits(ar->hw->wiphy);
+ 	ath10k_mac_setup_ht_vht_cap(ar);
+ 
+ 	ar->hw->wiphy->interface_modes =
diff --git a/package/kernel/mac80211/patches/ath/977-ath10k-add-support-for-configuring-management-packet.patch b/package/kernel/mac80211/patches/ath/977-ath10k-add-support-for-configuring-management-packet.patch
new file mode 100644
index 0000000000..4f2f64a60a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/977-ath10k-add-support-for-configuring-management-packet.patch
@@ -0,0 +1,89 @@
+From: Sriram R <srirrama@codeaurora.org>
+Date: Mon, 10 Sep 2018 11:09:40 +0530
+Subject: [PATCH] ath10k: add support for configuring management packet rate
+
+By default the firmware uses 1Mbps and 6Mbps rate for management packets
+in 2G and 5G bands respectively. But when the user selects different
+basic rates from the userspace, we need to send the management
+packets at the lowest basic rate selected by the user.
+
+This change makes use of WMI_VDEV_PARAM_MGMT_RATE param for configuring the
+management packets rate to the firmware.
+
+Chipsets Tested : QCA988X, QCA9887, QCA9984
+FW Tested 	: 10.2.4-1.0-41, 10.4-3.6.104
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+
+Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f279294e9ee22a8f306fdc8e4181cf555e6f0f70
+---
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -158,6 +158,22 @@ u8 ath10k_mac_bitrate_to_idx(const struc
+ 	return 0;
+ }
+ 
++static int ath10k_mac_get_rate_hw_value(int bitrate)
++{
++	int i;
++	u8 hw_value_prefix = 0;
++
++	if (ath10k_mac_bitrate_is_cck(bitrate))
++		hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
++
++	for (i = 0; i < sizeof(ath10k_rates); i++) {
++		if (ath10k_rates[i].bitrate == bitrate)
++			return hw_value_prefix | ath10k_rates[i].hw_value;
++	}
++
++	return -EINVAL;
++}
++
+ static int ath10k_mac_get_max_vht_mcs_map(u16 mcs_map, int nss)
+ {
+ 	switch ((mcs_map >> (2 * nss)) & 0x3) {
+@@ -5468,9 +5484,10 @@ static void ath10k_bss_info_changed(stru
+ 	struct cfg80211_chan_def def;
+ 	u32 vdev_param, pdev_param, slottime, preamble;
+ 	u16 bitrate, hw_value;
+-	u8 rate;
+-	int rateidx, ret = 0;
++	u8 rate, basic_rate_idx;
++	int rateidx, ret = 0, hw_rate_code;
+ 	enum nl80211_band band;
++	const struct ieee80211_supported_band *sband;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -5676,6 +5693,30 @@ static void ath10k_bss_info_changed(stru
+ 				    arvif->vdev_id,  ret);
+ 	}
+ 
++	if (changed & BSS_CHANGED_BASIC_RATES) {
++		if (WARN_ON(ath10k_mac_vif_chan(vif, &def))) {
++			mutex_unlock(&ar->conf_mutex);
++			return;
++		}
++
++	sband = ar->hw->wiphy->bands[def.chan->band];
++	basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
++	bitrate = sband->bitrates[basic_rate_idx].bitrate;
++
++	hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
++	if (hw_rate_code < 0) {
++		ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
++		mutex_unlock(&ar->conf_mutex);
++		return;
++	}
++
++	vdev_param = ar->wmi.vdev_param->mgmt_rate;
++	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
++					hw_rate_code);
++	if (ret)
++		ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
++	}
++
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
diff --git a/package/kernel/mac80211/patches/ath/978-ath10k-fix-possible-out-of-bound-access-of-ath10k_ra.patch b/package/kernel/mac80211/patches/ath/978-ath10k-fix-possible-out-of-bound-access-of-ath10k_ra.patch
new file mode 100644
index 0000000000..b82b16a92b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/978-ath10k-fix-possible-out-of-bound-access-of-ath10k_ra.patch
@@ -0,0 +1,66 @@
+From: Sriram R <srirrama@codeaurora.org>
+Date: Wed, 3 Oct 2018 08:43:50 +0530
+Subject: [PATCH] ath10k: fix possible out of bound access of ath10k_rates array
+
+While using 'ath10k_mac_get_rate_hw_value()' to obtain the hw value
+from the passed bitrate, there is a chance of out of bound array access
+when wrong bitrate is passed. This is fixed by comparing the bitrates
+within the correct size of the ath10k_rates array.
+
+Fixes commit f279294e9ee2 ("ath10k: add support for configuring management
+packet rate"). Also correction made to some indents used in the above commit.
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+
+Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34e141eea7dd8525dd1ef7a925459e455b4d307f
+---
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -166,7 +166,7 @@ static int ath10k_mac_get_rate_hw_value(
+ 	if (ath10k_mac_bitrate_is_cck(bitrate))
+ 		hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
+ 
+-	for (i = 0; i < sizeof(ath10k_rates); i++) {
++	for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
+ 		if (ath10k_rates[i].bitrate == bitrate)
+ 			return hw_value_prefix | ath10k_rates[i].hw_value;
+ 	}
+@@ -5699,22 +5699,22 @@ static void ath10k_bss_info_changed(stru
+ 			return;
+ 		}
+ 
+-	sband = ar->hw->wiphy->bands[def.chan->band];
+-	basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
+-	bitrate = sband->bitrates[basic_rate_idx].bitrate;
+-
+-	hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
+-	if (hw_rate_code < 0) {
+-		ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
+-		mutex_unlock(&ar->conf_mutex);
+-		return;
+-	}
++		sband = ar->hw->wiphy->bands[def.chan->band];
++		basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
++		bitrate = sband->bitrates[basic_rate_idx].bitrate;
++
++		hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
++		if (hw_rate_code < 0) {
++			ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
++			mutex_unlock(&ar->conf_mutex);
++			return;
++		}
+ 
+-	vdev_param = ar->wmi.vdev_param->mgmt_rate;
+-	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+-					hw_rate_code);
+-	if (ret)
+-		ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
++		vdev_param = ar->wmi.vdev_param->mgmt_rate;
++		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
++						hw_rate_code);
++		if (ret)
++			ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
+ 	}
+ 
+ 	mutex_unlock(&ar->conf_mutex);
diff --git a/package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch b/package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
new file mode 100644
index 0000000000..8695b7e094
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
@@ -0,0 +1,43 @@
+From: Pradeep kumar Chitrapu <pradeepc@codeaurora.org>
+Date: Mon, 10 Dec 2018 20:56:11 -0800
+Subject: ath10k: fix incorrect multicast/broadcast rate setting
+
+Invalid rate code is sent to firmware when multicast rate value of 0 is
+sent to driver indicating disabled case, causing broken mesh path.
+so fix that.
+
+Tested on QCA9984 with firmware 10.4-3.6.1-00827
+
+Fixes: cd93b83ad92 ("ath10k: support for multicast rate control")
+Co-developed-by: Zhi Chen <zhichen@codeaurora.org>
+Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+
+Origin: other, https://patchwork.kernel.org/patch/10723033/
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -5484,8 +5484,8 @@ static void ath10k_bss_info_changed(stru
+ 	struct cfg80211_chan_def def;
+ 	u32 vdev_param, pdev_param, slottime, preamble;
+ 	u16 bitrate, hw_value;
+-	u8 rate, basic_rate_idx;
+-	int rateidx, ret = 0, hw_rate_code;
++	u8 rate, basic_rate_idx, rateidx;
++	int ret = 0, hw_rate_code, mcast_rate;
+ 	enum nl80211_band band;
+ 	const struct ieee80211_supported_band *sband;
+ 
+@@ -5658,7 +5658,11 @@ static void ath10k_bss_info_changed(stru
+ 	if (changed & BSS_CHANGED_MCAST_RATE &&
+ 	    !WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def))) {
+ 		band = def.chan->band;
+-		rateidx = vif->bss_conf.mcast_rate[band] - 1;
++		mcast_rate = vif->bss_conf.mcast_rate[band];
++		if (mcast_rate > 0)
++			rateidx = mcast_rate - 1;
++		else
++			rateidx = ffs(vif->bss_conf.basic_rates) - 1;
+ 
+ 		if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY)
+ 			rateidx += ATH10K_MAC_FIRST_OFDM_RATE_IDX;
diff --git a/package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch b/package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch
new file mode 100644
index 0000000000..9cd23ce1b7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/980-ath10k-fix-max-antenna-gain-unit.patch
@@ -0,0 +1,49 @@
+From: Sven Eckelmann <seckelmann@datto.com>
+Date: Tue, 11 Jun 2019 13:58:35 +0200
+Subject: ath10k: fix max antenna gain unit
+
+Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB
+steps). This isn't the case for max_antenna_gain - which is still expected
+by the firmware as dB.
+
+The firmware is converting it from dB to the internal (twicepower)
+representation when it calculates the limits of a channel. This can be seen
+in tpc_stats when configuring "12" as max_antenna_gain. Instead of the
+expected 12 (6 dB), the tpc_stats shows 24 (12 dB).
+
+Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057.
+
+Fixes: 02256930d9b8 ("ath10k: use proper tx power unit")
+Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
+
+Forwarded: https://patchwork.kernel.org/patch/10986723/
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1020,7 +1020,7 @@ static int ath10k_monitor_vdev_start(str
+ 	arg.channel.min_power = 0;
+ 	arg.channel.max_power = channel->max_power * 2;
+ 	arg.channel.max_reg_power = channel->max_reg_power * 2;
+-	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
++	arg.channel.max_antenna_gain = channel->max_antenna_gain;
+ 
+ 	reinit_completion(&ar->vdev_setup_done);
+ 
+@@ -1462,7 +1462,7 @@ static int ath10k_vdev_start_restart(str
+ 	arg.channel.min_power = 0;
+ 	arg.channel.max_power = chandef->chan->max_power * 2;
+ 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
+-	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
++	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
+ 
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+ 		arg.ssid = arvif->u.ap.ssid;
+@@ -3139,7 +3139,7 @@ static int ath10k_update_channel_list(st
+ 			ch->min_power = 0;
+ 			ch->max_power = channel->max_power * 2;
+ 			ch->max_reg_power = channel->max_reg_power * 2;
+-			ch->max_antenna_gain = channel->max_antenna_gain * 2;
++			ch->max_antenna_gain = channel->max_antenna_gain;
+ 			ch->reg_class_id = 0; /* FIXME */
+ 
+ 			/* FIXME: why use only legacy modes, why not any
diff --git a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch b/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
new file mode 100644
index 0000000000..07247a0577
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@@ -0,0 +1,101 @@
+From: Sven Eckelmann <seckelmann@datto.com>
+Date: Wed, 28 Nov 2018 16:16:27 +0100
+Subject: ath10k: adjust tx power reduction for US regulatory domain
+
+FCC allows maximum antenna gain of 6 dBi. 15.247(b)(4):
+
+> (4) The conducted output power limit
+> specified in paragraph (b) of this section
+> is based on the use of antennas
+> with directional gains that do not exceed
+> 6 dBi. Except as shown in paragraph
+> (c) of this section, if transmitting
+> antennas of directional gain greater
+> than 6 dBi are used, the conducted
+> output power from the intentional radiator
+> shall be reduced below the stated
+> values in paragraphs (b)(1), (b)(2),
+> and (b)(3) of this section, as appropriate,
+> by the amount in dB that the
+> directional gain of the antenna exceeds
+> 6 dBi.
+
+https://www.gpo.gov/fdsys/pkg/CFR-2013-title47-vol1/pdf/CFR-2013-title47-vol1-sec15-247.pdf
+
+Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
+
+Forwarded: no
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -988,6 +988,40 @@ static inline int ath10k_vdev_setup_sync
+ 	return 0;
+ }
+ 
++static u32 ath10k_get_max_antenna_gain(struct ath10k *ar,
++				       u32 ch_max_antenna_gain)
++{
++	u32 max_antenna_gain;
++
++	if (ar->dfs_detector && ar->dfs_detector->region == NL80211_DFS_FCC) {
++		/* FCC allows maximum antenna gain of 6 dBi. 15.247(b)(4):
++		 *
++		 * > (4) The conducted output power limit
++		 * > specified in paragraph (b) of this section
++		 * > is based on the use of antennas
++		 * > with directional gains that do not exceed
++		 * > 6 dBi. Except as shown in paragraph
++		 * > (c) of this section, if transmitting
++		 * > antennas of directional gain greater
++		 * > than 6 dBi are used, the conducted
++		 * > output power from the intentional radiator
++		 * > shall be reduced below the stated
++		 * > values in paragraphs (b)(1), (b)(2),
++		 * > and (b)(3) of this section, as appropriate,
++		 * > by the amount in dB that the
++		 * > directional gain of the antenna exceeds
++		 * > 6 dBi.
++		 *
++		 * https://www.gpo.gov/fdsys/pkg/CFR-2013-title47-vol1/pdf/CFR-2013-title47-vol1-sec15-247.pdf
++		 */
++		max_antenna_gain = 6;
++	} else {
++		max_antenna_gain = 0;
++	}
++
++	return max(ch_max_antenna_gain, max_antenna_gain);
++}
++
+ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
+ {
+ 	struct cfg80211_chan_def *chandef = NULL;
+@@ -1020,7 +1054,8 @@ static int ath10k_monitor_vdev_start(str
+ 	arg.channel.min_power = 0;
+ 	arg.channel.max_power = channel->max_power * 2;
+ 	arg.channel.max_reg_power = channel->max_reg_power * 2;
+-	arg.channel.max_antenna_gain = channel->max_antenna_gain;
++	arg.channel.max_antenna_gain = ath10k_get_max_antenna_gain(ar,
++						channel->max_antenna_gain);
+ 
+ 	reinit_completion(&ar->vdev_setup_done);
+ 
+@@ -1462,7 +1497,8 @@ static int ath10k_vdev_start_restart(str
+ 	arg.channel.min_power = 0;
+ 	arg.channel.max_power = chandef->chan->max_power * 2;
+ 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
+-	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
++	arg.channel.max_antenna_gain = ath10k_get_max_antenna_gain(ar,
++					chandef->chan->max_antenna_gain);
+ 
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+ 		arg.ssid = arvif->u.ap.ssid;
+@@ -3139,7 +3175,8 @@ static int ath10k_update_channel_list(st
+ 			ch->min_power = 0;
+ 			ch->max_power = channel->max_power * 2;
+ 			ch->max_reg_power = channel->max_reg_power * 2;
+-			ch->max_antenna_gain = channel->max_antenna_gain;
++			ch->max_antenna_gain = ath10k_get_max_antenna_gain(ar,
++						channel->max_antenna_gain);
+ 			ch->reg_class_id = 0; /* FIXME */
+ 
+ 			/* FIXME: why use only legacy modes, why not any
diff --git a/package/kernel/mac80211/patches/040-brcmutil_option.patch b/package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch
similarity index 100%
rename from package/kernel/mac80211/patches/040-brcmutil_option.patch
rename to package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch
diff --git a/package/kernel/mac80211/patches/342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch b/package/kernel/mac80211/patches/brcm/300-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
similarity index 100%
rename from package/kernel/mac80211/patches/342-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
rename to package/kernel/mac80211/patches/brcm/300-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
diff --git a/package/kernel/mac80211/patches/344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch b/package/kernel/mac80211/patches/brcm/302-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch
similarity index 100%
rename from package/kernel/mac80211/patches/344-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch
rename to package/kernel/mac80211/patches/brcm/302-v4.20-0001-brcmfmac-fix-wrong-strnchr-usage.patch
diff --git a/package/kernel/mac80211/patches/345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch b/package/kernel/mac80211/patches/brcm/304-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
similarity index 100%
rename from package/kernel/mac80211/patches/345-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
rename to package/kernel/mac80211/patches/brcm/304-v4.20-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
diff --git a/package/kernel/mac80211/patches/346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch b/package/kernel/mac80211/patches/brcm/305-v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch
similarity index 100%
rename from package/kernel/mac80211/patches/346--v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch
rename to package/kernel/mac80211/patches/brcm/305-v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch
diff --git a/package/kernel/mac80211/patches/347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch b/package/kernel/mac80211/patches/brcm/306-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch
similarity index 100%
rename from package/kernel/mac80211/patches/347-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch
rename to package/kernel/mac80211/patches/brcm/306-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch
diff --git a/package/kernel/mac80211/patches/347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch b/package/kernel/mac80211/patches/brcm/306-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
similarity index 100%
rename from package/kernel/mac80211/patches/347-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
rename to package/kernel/mac80211/patches/brcm/306-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch b/package/kernel/mac80211/patches/brcm/320-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
similarity index 100%
rename from package/kernel/mac80211/patches/355-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
rename to package/kernel/mac80211/patches/brcm/320-v5.0-0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch b/package/kernel/mac80211/patches/brcm/320-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch
similarity index 100%
rename from package/kernel/mac80211/patches/355-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch
rename to package/kernel/mac80211/patches/brcm/320-v5.0-0002-brcmfmac-Remove-recursion-from-firmware-load-error-h.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch b/package/kernel/mac80211/patches/brcm/320-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch
similarity index 100%
rename from package/kernel/mac80211/patches/355-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch
rename to package/kernel/mac80211/patches/brcm/320-v5.0-0003-brcmfmac-Add-support-for-first-trying-to-get-a-board.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch b/package/kernel/mac80211/patches/brcm/320-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch
similarity index 100%
rename from package/kernel/mac80211/patches/355-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch
rename to package/kernel/mac80211/patches/brcm/320-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch b/package/kernel/mac80211/patches/brcm/320-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch
similarity index 100%
rename from package/kernel/mac80211/patches/355-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch
rename to package/kernel/mac80211/patches/brcm/320-v5.0-0005-brcmfmac-Set-board_type-from-DMI-on-x86-based-machin.patch
diff --git a/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch b/package/kernel/mac80211/patches/brcm/320-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
similarity index 100%
rename from package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
rename to package/kernel/mac80211/patches/brcm/320-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
diff --git a/package/kernel/mac80211/patches/brcm/321-v5.0-0001-brcmfmac-Add-support-for-getting-nvram-contents-from.patch b/package/kernel/mac80211/patches/brcm/321-v5.0-0001-brcmfmac-Add-support-for-getting-nvram-contents-from.patch
new file mode 100644
index 0000000000..88e5c67735
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/321-v5.0-0001-brcmfmac-Add-support-for-getting-nvram-contents-from.patch
@@ -0,0 +1,132 @@
+From ce2e6db554fad444fa0b3904fc3015336e0ef765 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 11 Oct 2018 11:51:06 +0200
+Subject: [PATCH] brcmfmac: Add support for getting nvram contents from EFI
+ variables
+
+Various X86 laptops with a SDIO attached brcmfmac wifi chip, store the
+nvram contents in a special EFI variable. This commit adds support for
+getting nvram directly from this EFI variable, without the user needing
+to manually copy it.
+
+This makes Wifi / Bluetooth work out of the box on these devices instead of
+requiring manual setup.
+
+This has been tested on the following models: Acer Iconia Tab8 w1-810,
+Acer One 10, Asus T100CHI, Asus T100HA, Asus T100TA, Asus T200TA and a
+Lenovo Mixx 2 8.
+
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 63 +++++++++++++++++++---
+ 1 file changed, 57 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -14,6 +14,7 @@
+  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <linux/efi.h>
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/device.h>
+@@ -445,6 +446,51 @@ struct brcmf_fw {
+ 
+ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
+ 
++#ifdef CONFIG_EFI
++static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
++{
++	const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
++	struct efivar_entry *nvram_efivar;
++	unsigned long data_len = 0;
++	u8 *data = NULL;
++	int err;
++
++	nvram_efivar = kzalloc(sizeof(*nvram_efivar), GFP_KERNEL);
++	if (!nvram_efivar)
++		return NULL;
++
++	memcpy(&nvram_efivar->var.VariableName, name, sizeof(name));
++	nvram_efivar->var.VendorGuid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61,
++						0xb5, 0x1f, 0x43, 0x26,
++						0x81, 0x23, 0xd1, 0x13);
++
++	err = efivar_entry_size(nvram_efivar, &data_len);
++	if (err)
++		goto fail;
++
++	data = kmalloc(data_len, GFP_KERNEL);
++	if (!data)
++		goto fail;
++
++	err = efivar_entry_get(nvram_efivar, NULL, &data_len, data);
++	if (err)
++		goto fail;
++
++	brcmf_info("Using nvram EFI variable\n");
++
++	kfree(nvram_efivar);
++	*data_len_ret = data_len;
++	return data;
++
++fail:
++	kfree(data);
++	kfree(nvram_efivar);
++	return NULL;
++}
++#else
++static u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
++#endif
++
+ static void brcmf_fw_free_request(struct brcmf_fw_request *req)
+ {
+ 	struct brcmf_fw_item *item;
+@@ -463,11 +509,12 @@ static int brcmf_fw_request_nvram_done(c
+ {
+ 	struct brcmf_fw *fwctx = ctx;
+ 	struct brcmf_fw_item *cur;
++	bool free_bcm47xx_nvram = false;
++	bool kfree_nvram = false;
+ 	u32 nvram_length = 0;
+ 	void *nvram = NULL;
+ 	u8 *data = NULL;
+ 	size_t data_len;
+-	bool raw_nvram;
+ 
+ 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
+ 
+@@ -476,12 +523,13 @@ static int brcmf_fw_request_nvram_done(c
+ 	if (fw && fw->data) {
+ 		data = (u8 *)fw->data;
+ 		data_len = fw->size;
+-		raw_nvram = false;
+ 	} else {
+-		data = bcm47xx_nvram_get_contents(&data_len);
+-		if (!data && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
++		if ((data = bcm47xx_nvram_get_contents(&data_len)))
++			free_bcm47xx_nvram = true;
++		else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
++			kfree_nvram = true;
++		else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+ 			goto fail;
+-		raw_nvram = true;
+ 	}
+ 
+ 	if (data)
+@@ -489,8 +537,11 @@ static int brcmf_fw_request_nvram_done(c
+ 					     fwctx->req->domain_nr,
+ 					     fwctx->req->bus_nr);
+ 
+-	if (raw_nvram)
++	if (free_bcm47xx_nvram)
+ 		bcm47xx_nvram_release_contents(data);
++	if (kfree_nvram)
++		kfree(data);
++
+ 	release_firmware(fw);
+ 	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+ 		goto fail;
diff --git a/package/kernel/mac80211/patches/brcm/321-v5.0-0002-brcmfmac-Fix-ccode-from-EFI-nvram-when-necessary.patch b/package/kernel/mac80211/patches/brcm/321-v5.0-0002-brcmfmac-Fix-ccode-from-EFI-nvram-when-necessary.patch
new file mode 100644
index 0000000000..c2fd620d6c
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/321-v5.0-0002-brcmfmac-Fix-ccode-from-EFI-nvram-when-necessary.patch
@@ -0,0 +1,97 @@
+From 29ec3394f0bd85c22674ab6693d92da5e2324610 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 11 Oct 2018 11:51:07 +0200
+Subject: [PATCH] brcmfmac: Fix ccode from EFI nvram when necessary
+
+In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
+to specify "worldwide" compatible settings, but these 2 ccode-s do not work
+properly.
+
+I've tested the different known "worldwide" ccode-s used in various nvram
+sources with the latest firmwares from linux-firmware for various brcmfmac
+models, here is a simplified (*) table with what each setting results in:
+
+ALL: 12-14 disab, U-NII-1, U-NII-2 no-IR/radar, U-NII-3
+XV:  12-14 no-IR, disables all 5G channels
+XY:  12-13 enab, 14 disab, U-NII-1 enab, U-NII-2 no-IR/radar, U-NII-3 disab
+X2:  12-13 no-IR, 14 dis, U-NII-1 no-IR, U-NII-2 no-IR/radar, U-NII-3 no-IR
+
+Where 12,13,14 are 2.4G channels 12-14 and U-NII-1/2/3 are the 3 different
+5G channel groups. no-IR is no-Initiate-Radiation, we will never send on
+these channels without first having received valid wifi traffic there.
+
+This immediately shows that both ALL and XV are not as worldwide as we want
+them to be. ALL causes channels 12 and 13 to not be available and XV causes
+all 5GHz channels to not be available. Also ALL unconditionally enables the
+U-NII-1 and U-NII-3 5G groups, while we really should be using no-IR for
+these.
+
+This commit replace XV and ALL with X2, which allows usage of chan 12-13
+and 5G channels, but only after receiving valid wifi traffic there first.
+
+Note that this configure the firmware's channel limits, the kernels own
+regulatory restrictions based on e.g. regulatory info received from the
+access-point, will be applied on top of this.
+
+This fixes channels 12+13 not working on the Asus T200TA and the Lenovo
+Mixx 2 8 and 5G channels not working on the Asus T100HA.
+
+This has been tested on the following models: Acer Iconia Tab8 w1-810,
+Acer One 10, Asus T100CHI, Asus T100HA, Asus T100TA, Asus T200TA and a
+Lenovo Mixx 2 8.
+
+*) There are some exceptions to this table:
+1) On really old firmware e.g. linux-firmware's 2011 brcmfmac4330-sdio.bin
+   ALL really means all, unconditionally enabling everything
+2) The exact meaning might be influenced by setting the regrev nvram var.
+   Specifically using ccode=XV + regrev=1 on brcmfmac43241b4 leads to:
+   12-14 no-ir, U-NII-1 no-ir, U-NII-2 no-ir/radar, U-NII-3 no-ir
+   But only on the brcmfmac43241b4 and not on e.g. the brcmfmac43340
+
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/firmware.c         | 24 ++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -447,6 +447,29 @@ struct brcmf_fw {
+ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
+ 
+ #ifdef CONFIG_EFI
++/* In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
++ * to specify "worldwide" compatible settings, but these 2 ccode-s do not work
++ * properly. "ccode=ALL" causes channels 12 and 13 to not be available,
++ * "ccode=XV" causes all 5GHz channels to not be available. So we replace both
++ * with "ccode=X2" which allows channels 12+13 and 5Ghz channels in
++ * no-Initiate-Radiation mode. This means that we will never send on these
++ * channels without first having received valid wifi traffic on the channel.
++ */
++static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
++{
++	char *ccode;
++
++	ccode = strnstr((char *)data, "ccode=ALL", data_len);
++	if (!ccode)
++		ccode = strnstr((char *)data, "ccode=XV\r", data_len);
++	if (!ccode)
++		return;
++
++	ccode[6] = 'X';
++	ccode[7] = '2';
++	ccode[8] = '\r';
++}
++
+ static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
+ {
+ 	const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
+@@ -476,6 +499,7 @@ static u8 *brcmf_fw_nvram_from_efi(size_
+ 	if (err)
+ 		goto fail;
+ 
++	brcmf_fw_fix_efi_nvram_ccode(data, data_len);
+ 	brcmf_info("Using nvram EFI variable\n");
+ 
+ 	kfree(nvram_efivar);
diff --git a/package/kernel/mac80211/patches/380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch b/package/kernel/mac80211/patches/brcm/322-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch
similarity index 100%
rename from package/kernel/mac80211/patches/380-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch
rename to package/kernel/mac80211/patches/brcm/322-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch
diff --git a/package/kernel/mac80211/patches/380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch b/package/kernel/mac80211/patches/brcm/323-v5.0-0001-brcmutil-print-invalid-chanspec-when-WARN-ing.patch
similarity index 100%
rename from package/kernel/mac80211/patches/380-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch
rename to package/kernel/mac80211/patches/brcm/323-v5.0-0001-brcmutil-print-invalid-chanspec-when-WARN-ing.patch
diff --git a/package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch b/package/kernel/mac80211/patches/brcm/325-v5.0-brcmfmac-support-STA-info-struct-v7.patch
similarity index 92%
rename from package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch
rename to package/kernel/mac80211/patches/brcm/325-v5.0-brcmfmac-support-STA-info-struct-v7.patch
index 271994dae6..8ff42462b0 100644
--- a/package/kernel/mac80211/patches/380-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch
+++ b/package/kernel/mac80211/patches/brcm/325-v5.0-brcmfmac-support-STA-info-struct-v7.patch
@@ -1,4 +1,4 @@
-From a4dad0334732f62c67058037d9edb17945bec598 Mon Sep 17 00:00:00 2001
+From 4282ff17e557d319e1b988fa4f582792cfaf6fff Mon Sep 17 00:00:00 2001
 From: Dan Haab <riproute@gmail.com>
 Date: Fri, 9 Nov 2018 09:38:55 -0700
 Subject: [PATCH] brcmfmac: support STA info struct v7
@@ -16,8 +16,10 @@ v4.
 
 Signed-off-by: Dan Haab <dan.haab@luxul.com>
 Reviewed-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 ---
- .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 40 ++++++++++++++++++----
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h  | 40 +++++++++++++++----
  1 file changed, 33 insertions(+), 7 deletions(-)
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
diff --git a/package/kernel/mac80211/patches/brcm/326-v5.0-brcmfmac-Call-brcmf_dmi_probe-before-brcmf_of_probe.patch b/package/kernel/mac80211/patches/brcm/326-v5.0-brcmfmac-Call-brcmf_dmi_probe-before-brcmf_of_probe.patch
new file mode 100644
index 0000000000..01621561c1
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/326-v5.0-brcmfmac-Call-brcmf_dmi_probe-before-brcmf_of_probe.patch
@@ -0,0 +1,39 @@
+From 554da3868eb1d7174710c18b4ddd6ff01f6d612c Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 23 Nov 2018 10:11:48 +0100
+Subject: [PATCH] brcmfmac: Call brcmf_dmi_probe before brcmf_of_probe
+
+ARM systems with UEFI may have both devicetree (of) and DMI data in this
+case we end up setting brcmf_mp_device.board_type twice.
+
+In this case we should prefer the devicetree data, because:
+1) The devicerree data is more reliable
+2) Some ARM systems (e.g. the Raspberry Pi 3 models) support both UEFI and
+   classic uboot booting, the devicetree data is always there, so using it
+   makes sure we ask for the same nvram file independent of how we booted.
+
+This commit moves the brcmf_dmi_probe call to before the brcmf_of_probe
+call, so that the latter can override the value of the first if both are
+set.
+
+Fixes: bd1e82bb420a ("brcmfmac: Set board_type from DMI on x86 based ...")
+Cc: Peter Robinson <pbrobinson@gmail.com>
+Tested-and-reported-by: Peter Robinson <pbrobinson@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -449,8 +449,8 @@ struct brcmf_mp_device *brcmf_get_module
+ 	}
+ 	if (!found) {
+ 		/* No platform data for this device, try OF and DMI data */
+-		brcmf_of_probe(dev, bus_type, settings);
+ 		brcmf_dmi_probe(settings, chip, chiprev);
++		brcmf_of_probe(dev, bus_type, settings);
+ 	}
+ 	return settings;
+ }
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch
new file mode 100644
index 0000000000..dd40ee2b1f
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch
@@ -0,0 +1,95 @@
+From 153e22c0ff1260035cd7fe72c8aeead1f5fac757 Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Mon, 5 Nov 2018 05:51:54 +0000
+Subject: [PATCH] brcmfmac: add credit numbers updating support
+
+The credit numbers are static and tunable per chip in firmware side.
+However the credit number may be changed that is based on packet pool
+length and will send BRCMF_E_FIFO_CREDIT_MAP event to notify host driver
+updates the credit numbers during interface up.
+The purpose of this patch is making host driver has ability of updating
+the credit numbers when receiving the BRCMF_E_FIFO_CREDIT_MAP event.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 23 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -511,6 +511,7 @@ struct brcmf_fws_info {
+ 	struct work_struct fws_dequeue_work;
+ 	u32 fifo_enqpkt[BRCMF_FWS_FIFO_COUNT];
+ 	int fifo_credit[BRCMF_FWS_FIFO_COUNT];
++	int init_fifo_credit[BRCMF_FWS_FIFO_COUNT];
+ 	int credits_borrowed[BRCMF_FWS_FIFO_AC_VO + 1];
+ 	int deq_node_pos[BRCMF_FWS_FIFO_COUNT];
+ 	u32 fifo_credit_map;
+@@ -1237,6 +1238,9 @@ static void brcmf_fws_return_credits(str
+ 	}
+ 
+ 	fws->fifo_credit[fifo] += credits;
++	if (fws->fifo_credit[fifo] > fws->init_fifo_credit[fifo])
++		fws->fifo_credit[fifo] = fws->init_fifo_credit[fifo];
++
+ }
+ 
+ static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
+@@ -1595,19 +1599,21 @@ static int brcmf_fws_notify_credit_map(s
+ 		brcmf_err("event payload too small (%d)\n", e->datalen);
+ 		return -EINVAL;
+ 	}
+-	if (fws->creditmap_received)
+-		return 0;
+ 
+ 	fws->creditmap_received = true;
+ 
+ 	brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
+ 	brcmf_fws_lock(fws);
+ 	for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
+-		if (*credits)
++		fws->fifo_credit[i] += credits[i] - fws->init_fifo_credit[i];
++		fws->init_fifo_credit[i] = credits[i];
++		if (fws->fifo_credit[i] > 0)
+ 			fws->fifo_credit_map |= 1 << i;
+ 		else
+ 			fws->fifo_credit_map &= ~(1 << i);
+-		fws->fifo_credit[i] = *credits++;
++		WARN_ONCE(fws->fifo_credit[i] < 0,
++			  "fifo_credit[%d] is negative(%d)\n", i,
++			  fws->fifo_credit[i]);
+ 	}
+ 	brcmf_fws_schedule_deq(fws);
+ 	brcmf_fws_unlock(fws);
+@@ -2013,7 +2019,7 @@ static int brcmf_fws_borrow_credit(struc
+ 	}
+ 
+ 	for (lender_ac = 0; lender_ac <= BRCMF_FWS_FIFO_AC_VO; lender_ac++) {
+-		if (fws->fifo_credit[lender_ac]) {
++		if (fws->fifo_credit[lender_ac] > 0) {
+ 			fws->credits_borrowed[lender_ac]++;
+ 			fws->fifo_credit[lender_ac]--;
+ 			if (fws->fifo_credit[lender_ac] == 0)
+@@ -2210,8 +2216,9 @@ static void brcmf_fws_dequeue_worker(str
+ 			}
+ 			continue;
+ 		}
+-		while ((fws->fifo_credit[fifo]) || ((!fws->bcmc_credit_check) &&
+-		       (fifo == BRCMF_FWS_FIFO_BCMC))) {
++		while ((fws->fifo_credit[fifo] > 0) ||
++		       ((!fws->bcmc_credit_check) &&
++			(fifo == BRCMF_FWS_FIFO_BCMC))) {
+ 			skb = brcmf_fws_deq(fws, fifo);
+ 			if (!skb)
+ 				break;
+@@ -2222,7 +2229,7 @@ static void brcmf_fws_dequeue_worker(str
+ 				break;
+ 		}
+ 		if ((fifo == BRCMF_FWS_FIFO_AC_BE) &&
+-		    (fws->fifo_credit[fifo] == 0) &&
++		    (fws->fifo_credit[fifo] <= 0) &&
+ 		    (!fws->bus_flow_blocked)) {
+ 			while (brcmf_fws_borrow_credit(fws) == 0) {
+ 				skb = brcmf_fws_deq(fws, fifo);
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
new file mode 100644
index 0000000000..9602792d4f
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
@@ -0,0 +1,42 @@
+From a3bdc6deb60bf6be4405058ca49a686c4db08c39 Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Mon, 5 Nov 2018 05:51:59 +0000
+Subject: [PATCH] brcmfmac: enable frameburst mode in default firmware setting
+
+The frameburst feature can enable per-packet framebursting in firmware
+side and get higher TX throughput in High Throughput(HT) mode. To enhance
+TX throughput, we enable frameburst mode in default firmware setting.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h     | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6638,6 +6638,12 @@ static s32 brcmf_config_dongle(struct br
+ 
+ 	brcmf_configure_arp_nd_offload(ifp, true);
+ 
++	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
++	if (err) {
++		brcmf_err("failed to set frameburst mode\n");
++		goto default_conf_out;
++	}
++
+ 	cfg->dongle_up = true;
+ default_conf_out:
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
+@@ -80,6 +80,7 @@
+ #define BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON	201
+ #define BRCMF_C_SET_ASSOC_PREFER		205
+ #define BRCMF_C_GET_VALID_CHANNELS		217
++#define BRCMF_C_SET_FAKEFRAG			219
+ #define BRCMF_C_GET_KEY_PRIMARY			235
+ #define BRCMF_C_SET_KEY_PRIMARY			236
+ #define BRCMF_C_SET_SCAN_PASSIVE_TIME		258
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
new file mode 100644
index 0000000000..d44c8737ad
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
@@ -0,0 +1,229 @@
+From e4af3ffb43d50f070134aa1b40d5c3573f57deb1 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Mon, 5 Nov 2018 05:52:05 +0000
+Subject: [PATCH] brcmfmac: handle compressed tx status signal
+
+Firmware inform the driver about tx status by normal tx status signal
+or compressed tx status signal. This patch adds support to handle the
+compressed tx status signal.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 121 ++++++++++--------
+ 1 file changed, 71 insertions(+), 50 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -1455,9 +1455,10 @@ static int brcmf_fws_txstatus_suppressed
+ 
+ static int
+ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
+-		      u32 genbit, u16 seq)
++		      u32 genbit, u16 seq, u8 compcnt)
+ {
+ 	u32 fifo;
++	u8 cnt = 0;
+ 	int ret;
+ 	bool remove_from_hanger = true;
+ 	struct sk_buff *skb;
+@@ -1468,60 +1469,71 @@ brcmf_fws_txs_process(struct brcmf_fws_i
+ 	brcmf_dbg(DATA, "flags %d\n", flags);
+ 
+ 	if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
+-		fws->stats.txs_discard++;
++		fws->stats.txs_discard += compcnt;
+ 	else if (flags == BRCMF_FWS_TXSTATUS_CORE_SUPPRESS) {
+-		fws->stats.txs_supp_core++;
++		fws->stats.txs_supp_core += compcnt;
+ 		remove_from_hanger = false;
+ 	} else if (flags == BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS) {
+-		fws->stats.txs_supp_ps++;
++		fws->stats.txs_supp_ps += compcnt;
+ 		remove_from_hanger = false;
+ 	} else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
+-		fws->stats.txs_tossed++;
++		fws->stats.txs_tossed += compcnt;
+ 	else if (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)
+-		fws->stats.txs_host_tossed++;
++		fws->stats.txs_host_tossed += compcnt;
+ 	else
+ 		brcmf_err("unexpected txstatus\n");
+ 
+-	ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+-				      remove_from_hanger);
+-	if (ret != 0) {
+-		brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
+-		return ret;
+-	}
++	while (cnt < compcnt) {
++		ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
++					      remove_from_hanger);
++		if (ret != 0) {
++			brcmf_err("no packet in hanger slot: hslot=%d\n",
++				  hslot);
++			goto cont;
++		}
+ 
+-	skcb = brcmf_skbcb(skb);
+-	entry = skcb->mac;
+-	if (WARN_ON(!entry)) {
+-		brcmu_pkt_buf_free_skb(skb);
+-		return -EINVAL;
+-	}
+-	entry->transit_count--;
+-	if (entry->suppressed && entry->suppr_transit_count)
+-		entry->suppr_transit_count--;
+-
+-	brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags,
+-		  skcb->htod, seq);
+-
+-	/* pick up the implicit credit from this packet */
+-	fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
+-	if ((fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT) ||
+-	    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
+-	    (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)) {
+-		brcmf_fws_return_credits(fws, fifo, 1);
+-		brcmf_fws_schedule_deq(fws);
+-	}
+-	brcmf_fws_macdesc_return_req_credit(skb);
++		skcb = brcmf_skbcb(skb);
++		entry = skcb->mac;
++		if (WARN_ON(!entry)) {
++			brcmu_pkt_buf_free_skb(skb);
++			goto cont;
++		}
++		entry->transit_count--;
++		if (entry->suppressed && entry->suppr_transit_count)
++			entry->suppr_transit_count--;
+ 
+-	ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
+-	if (ret) {
+-		brcmu_pkt_buf_free_skb(skb);
+-		return -EINVAL;
++		brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name,
++			  flags, skcb->htod, seq);
++
++		/* pick up the implicit credit from this packet */
++		fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
++		if (fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT ||
++		    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
++		    flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED) {
++			brcmf_fws_return_credits(fws, fifo, 1);
++			brcmf_fws_schedule_deq(fws);
++		}
++		brcmf_fws_macdesc_return_req_credit(skb);
++
++		ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
++		if (ret) {
++			brcmu_pkt_buf_free_skb(skb);
++			goto cont;
++		}
++		if (!remove_from_hanger)
++			ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
++							    genbit, seq);
++		if (remove_from_hanger || ret)
++			brcmf_txfinalize(ifp, skb, true);
++
++cont:
++		hslot = (hslot + 1) & (BRCMF_FWS_TXSTAT_HSLOT_MASK >>
++				       BRCMF_FWS_TXSTAT_HSLOT_SHIFT);
++		if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
++			seq = (seq + 1) & BRCMF_SKB_HTOD_SEQ_NR_MASK;
++
++		cnt++;
+ 	}
+-	if (!remove_from_hanger)
+-		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
+-						    genbit, seq);
+-	if (remove_from_hanger || ret)
+-		brcmf_txfinalize(ifp, skb, true);
+ 
+ 	return 0;
+ }
+@@ -1547,7 +1559,8 @@ static int brcmf_fws_fifocreditback_indi
+ 	return BRCMF_FWS_RET_OK_SCHEDULE;
+ }
+ 
+-static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
++static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 type,
++				       u8 *data)
+ {
+ 	__le32 status_le;
+ 	__le16 seq_le;
+@@ -1556,23 +1569,31 @@ static int brcmf_fws_txstatus_indicate(s
+ 	u32 genbit;
+ 	u8 flags;
+ 	u16 seq;
++	u8 compcnt;
++	u8 compcnt_offset = BRCMF_FWS_TYPE_TXSTATUS_LEN;
+ 
+-	fws->stats.txs_indicate++;
+ 	memcpy(&status_le, data, sizeof(status_le));
+ 	status = le32_to_cpu(status_le);
+ 	flags = brcmf_txstatus_get_field(status, FLAGS);
+ 	hslot = brcmf_txstatus_get_field(status, HSLOT);
+ 	genbit = brcmf_txstatus_get_field(status, GENERATION);
+ 	if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
+-		memcpy(&seq_le, &data[BRCMF_FWS_TYPE_PKTTAG_LEN],
++		memcpy(&seq_le, &data[BRCMF_FWS_TYPE_TXSTATUS_LEN],
+ 		       sizeof(seq_le));
+ 		seq = le16_to_cpu(seq_le);
++		compcnt_offset += BRCMF_FWS_TYPE_SEQ_LEN;
+ 	} else {
+ 		seq = 0;
+ 	}
+ 
++	if (type == BRCMF_FWS_TYPE_COMP_TXSTATUS)
++		compcnt = data[compcnt_offset];
++	else
++		compcnt = 1;
++	fws->stats.txs_indicate += compcnt;
++
+ 	brcmf_fws_lock(fws);
+-	brcmf_fws_txs_process(fws, flags, hslot, genbit, seq);
++	brcmf_fws_txs_process(fws, flags, hslot, genbit, seq, compcnt);
+ 	brcmf_fws_unlock(fws);
+ 	return BRCMF_FWS_RET_OK_NOSCHEDULE;
+ }
+@@ -1888,8 +1909,6 @@ void brcmf_fws_hdrpull(struct brcmf_if *
+ 
+ 		err = BRCMF_FWS_RET_OK_NOSCHEDULE;
+ 		switch (type) {
+-		case BRCMF_FWS_TYPE_COMP_TXSTATUS:
+-			break;
+ 		case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
+ 			rd = (struct brcmf_skb_reorder_data *)skb->cb;
+ 			rd->reorder = data;
+@@ -1912,7 +1931,8 @@ void brcmf_fws_hdrpull(struct brcmf_if *
+ 			err = brcmf_fws_request_indicate(fws, type, data);
+ 			break;
+ 		case BRCMF_FWS_TYPE_TXSTATUS:
+-			brcmf_fws_txstatus_indicate(fws, data);
++		case BRCMF_FWS_TYPE_COMP_TXSTATUS:
++			brcmf_fws_txstatus_indicate(fws, type, data);
+ 			break;
+ 		case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
+ 			err = brcmf_fws_fifocreditback_indicate(fws, data);
+@@ -2001,7 +2021,7 @@ static void brcmf_fws_rollback_toq(struc
+ 		fws->stats.rollback_failed++;
+ 		hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+ 		brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED,
+-				      hslot, 0, 0);
++				      hslot, 0, 0, 1);
+ 	} else {
+ 		fws->stats.rollback_success++;
+ 		brcmf_fws_return_credits(fws, fifo, 1);
+@@ -2462,7 +2482,8 @@ void brcmf_fws_bustxfail(struct brcmf_fw
+ 	}
+ 	brcmf_fws_lock(fws);
+ 	hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+-	brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0);
++	brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0,
++			      1);
+ 	brcmf_fws_unlock(fws);
+ }
+ 
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch
new file mode 100644
index 0000000000..ead33db0d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch
@@ -0,0 +1,36 @@
+From eb6b33bfb8f56859df7264dccc2ca8ab7c57342a Mon Sep 17 00:00:00 2001
+From: Winnie Chang <winnie.chang@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:42 +0000
+Subject: [PATCH] brcmfmac: add 4354 raw pcie device id
+
+Add the raw 4354 PCIe device ID for unprogrammed Cypress boards.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Signed-off-by: Winnie Chang <winnie.chang@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c       | 1 +
+ drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2019,6 +2019,7 @@ static const struct dev_pm_ops brcmf_pci
+ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355),
++	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -74,6 +74,7 @@
+ /* PCIE Device IDs */
+ #define BRCM_PCIE_4350_DEVICE_ID	0x43a3
+ #define BRCM_PCIE_4354_DEVICE_ID	0x43df
++#define BRCM_PCIE_4354_RAW_DEVICE_ID	0x4354
+ #define BRCM_PCIE_4356_DEVICE_ID	0x43ec
+ #define BRCM_PCIE_43567_DEVICE_ID	0x43d3
+ #define BRCM_PCIE_43570_DEVICE_ID	0x43d9
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch
new file mode 100644
index 0000000000..a915473b8c
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch
@@ -0,0 +1,73 @@
+From e1a08730eeb0bad4d82c3bc40e74854872de618d Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:44 +0000
+Subject: [PATCH] brcmfmac: set F2 watermark to 256 for 4373
+
+We got SDIO_CRC_ERROR with 4373 on SDR104 when doing bi-directional
+throughput test. Enable watermark to 256 to guarantee the operation
+stability.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 26 +++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -49,6 +49,10 @@
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
+ 
++/* watermark expressed in number of words */
++#define DEFAULT_F2_WATERMARK    0x8
++#define CY_4373_F2_WATERMARK    0x40
++
+ #ifdef DEBUG
+ 
+ #define BRCMF_TRAP_INFO_SIZE	80
+@@ -138,6 +142,8 @@ struct rte_console {
+ /* 1: isolate internal sdio signals, put external pads in tri-state; requires
+  * sdio bus power cycle to clear (rev 9) */
+ #define SBSDIO_DEVCTL_PADS_ISO		0x08
++/* 1: enable F2 Watermark */
++#define SBSDIO_DEVCTL_F2WM_ENAB		0x10
+ /* Force SD->SB reset mapping (rev 11) */
+ #define SBSDIO_DEVCTL_SB_RST_CTL	0x30
+ /*   Determined by CoreControl bit */
+@@ -4046,6 +4052,7 @@ static void brcmf_sdio_firmware_callback
+ 	void *nvram;
+ 	u32 nvram_len;
+ 	u8 saveclk;
++	u8 devctl;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
+@@ -4101,8 +4108,23 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
+ 				   bus->hostintmask, NULL);
+ 
+-
+-		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
++		switch (sdiod->func1->device) {
++		case SDIO_DEVICE_ID_CYPRESS_4373:
++			brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++				  CY_4373_F2_WATERMARK);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   CY_4373_F2_WATERMARK, &err);
++			devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++						   &err);
++			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++					   &err);
++			break;
++		default:
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   DEFAULT_F2_WATERMARK, &err);
++			break;
++		}
+ 	} else {
+ 		/* Disable F2 again */
+ 		sdio_disable_func(sdiod->func2);
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch
new file mode 100644
index 0000000000..0e22a1545e
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch
@@ -0,0 +1,55 @@
+From 58e4bbea0c1d9b5ace11df968c5dc096ce052a73 Mon Sep 17 00:00:00 2001
+From: Madhan Mohan R <MadhanMohan.R@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:45 +0000
+Subject: [PATCH] brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373
+
+Along with F2 watermark (existing) configuration, F1 MesBusyCtrl
+should be enabled & sdio device RX FIFO watermark should be
+configured to avoid overflow errors.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 9 ++++++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4119,6 +4119,9 @@ static void brcmf_sdio_firmware_callback
+ 			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
+ 					   &err);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
++					   CY_4373_F2_WATERMARK |
++					   SBSDIO_MESBUSYCTRL_ENAB, &err);
+ 			break;
+ 		default:
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -77,7 +77,7 @@
+ #define SBSDIO_GPIO_OUT			0x10006
+ /* gpio enable */
+ #define SBSDIO_GPIO_EN			0x10007
+-/* rev < 7, watermark for sdio device */
++/* rev < 7, watermark for sdio device TX path */
+ #define SBSDIO_WATERMARK		0x10008
+ /* control busy signal generation */
+ #define SBSDIO_DEVICE_CTL		0x10009
+@@ -104,6 +104,13 @@
+ #define SBSDIO_FUNC1_RFRAMEBCHI		0x1001C
+ /* MesBusyCtl (rev 11) */
+ #define SBSDIO_FUNC1_MESBUSYCTRL	0x1001D
++/* Watermark for sdio device RX path */
++#define SBSDIO_MESBUSY_RXFIFO_WM_MASK	0x7F
++#define SBSDIO_MESBUSY_RXFIFO_WM_SHIFT	0
++/* Enable busy capability for MES access */
++#define SBSDIO_MESBUSYCTRL_ENAB		0x80
++#define SBSDIO_MESBUSYCTRL_ENAB_SHIFT	7
++
+ /* Sdio Core Rev 12 */
+ #define SBSDIO_FUNC1_WAKEUPCTRL		0x1001E
+ #define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK		0x1
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch
new file mode 100644
index 0000000000..e53d4bafa0
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch
@@ -0,0 +1,253 @@
+From 35cb51b2162a1a7c5cd977f92595e60ab14d3b22 Mon Sep 17 00:00:00 2001
+From: Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:47 +0000
+Subject: [PATCH] brcmfmac: add support for CYW43012 SDIO chipset
+
+CYW43012 is a 1x1 802.11a/b/g/n Dual-Band HT20, 256-QAM/Turbo QAM. It
+is an Ultra Low Power WLAN+BT combo chip.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Praveen Babu C <praveen.chandran@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bcmsdh.c      |  1 +
+ .../broadcom/brcm80211/brcmfmac/chip.c        | 14 +++-
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 74 ++++++++++++++++---
+ .../broadcom/brcm80211/include/brcm_hw_ids.h  |  1 +
+ include/linux/mmc/sdio_ids.h                  |  1 +
+ 5 files changed, 78 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -972,6 +972,7 @@ static const struct sdio_device_id brcmf
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_4373),
++	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_43012),
+ 	{ /* end: all zeroes */ }
+ };
+ MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -165,6 +165,7 @@ struct sbconfig {
+ #define SRCI_LSS_MASK		0x00f00000
+ #define SRCI_LSS_SHIFT		20
+ #define	SRCI_SRNB_MASK		0xf0
++#define	SRCI_SRNB_MASK_EXT	0x100
+ #define	SRCI_SRNB_SHIFT		4
+ #define	SRCI_SRBSZ_MASK		0xf
+ #define	SRCI_SRBSZ_SHIFT	0
+@@ -592,7 +593,13 @@ static void brcmf_chip_socram_ramsize(st
+ 		if (lss != 0)
+ 			*ramsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+ 	} else {
+-		nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
++		/* length of SRAM Banks increased for corerev greater than 23 */
++		if (sr->pub.rev >= 23) {
++			nb = (coreinfo & (SRCI_SRNB_MASK | SRCI_SRNB_MASK_EXT))
++				>> SRCI_SRNB_SHIFT;
++		} else {
++			nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
++		}
+ 		for (i = 0; i < nb; i++) {
+ 			retent = brcmf_chip_socram_banksize(sr, i, &banksize);
+ 			*ramsize += banksize;
+@@ -1356,6 +1363,11 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 		addr = CORE_CC_REG(base, sr_control1);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+ 		return reg != 0;
++	case CY_CC_43012_CHIP_ID:
++		addr = CORE_CC_REG(pmu->base, retention_ctl);
++		reg = chip->ops->read32(chip->ctx, addr);
++		return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
++			       PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
+ 	default:
+ 		addr = CORE_CC_REG(pmu->base, pmucapabilities_ext);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -624,6 +624,7 @@ BRCMF_FW_DEF(43455, "brcmfmac43455-sdio"
+ BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
+ BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
+ BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
++BRCMF_FW_DEF(43012, "brcmfmac43012-sdio");
+ 
+ static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+@@ -643,7 +644,8 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+-	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
++	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373),
++	BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012)
+ };
+ 
+ static void pkt_align(struct sk_buff *p, int len, int align)
+@@ -677,6 +679,14 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 	/* 1st KSO write goes to AOS wake up core if device is asleep  */
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+ 
++	/* In case of 43012 chip, the chip could go down immediately after
++	 * KSO bit is cleared. So the further reads of KSO register could
++	 * fail. Thereby just bailing out immediately after clearing KSO
++	 * bit, to avoid polling of KSO bit.
++	 */
++	if (!on && bus->ci->chip == CY_CC_43012_CHIP_ID)
++		return err;
++
+ 	if (on) {
+ 		/* device WAKEUP through KSO:
+ 		 * write bit 0 & read back until
+@@ -2402,6 +2412,14 @@ static int brcmf_sdio_tx_ctrlframe(struc
+ 	return ret;
+ }
+ 
++static bool brcmf_chip_is_ulp(struct brcmf_chip *ci)
++{
++	if (ci->chip == CY_CC_43012_CHIP_ID)
++		return true;
++	else
++		return false;
++}
++
+ static void brcmf_sdio_bus_stop(struct device *dev)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+@@ -2409,7 +2427,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 	struct brcmf_sdio *bus = sdiodev->bus;
+ 	struct brcmf_core *core = bus->sdio_core;
+ 	u32 local_hostintmask;
+-	u8 saveclk;
++	u8 saveclk, bpreq;
+ 	int err;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+@@ -2436,9 +2454,14 @@ static void brcmf_sdio_bus_stop(struct d
+ 		/* Force backplane clocks to assure F2 interrupt propagates */
+ 		saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+ 					    &err);
+-		if (!err)
+-			brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-					   (saveclk | SBSDIO_FORCE_HT), &err);
++		if (!err) {
++			bpreq = saveclk;
++			bpreq |= brcmf_chip_is_ulp(bus->ci) ?
++				SBSDIO_HT_AVAIL_REQ : SBSDIO_FORCE_HT;
++			brcmf_sdiod_writeb(sdiodev,
++					   SBSDIO_FUNC1_CHIPCLKCSR,
++					   bpreq, &err);
++		}
+ 		if (err)
+ 			brcmf_err("Failed to force clock for F2: err %d\n",
+ 				  err);
+@@ -3328,20 +3351,45 @@ err:
+ 	return bcmerror;
+ }
+ 
++static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
++{
++	if (bus->ci->chip == CY_CC_43012_CHIP_ID)
++		return true;
++	else
++		return false;
++}
++
+ static void brcmf_sdio_sr_init(struct brcmf_sdio *bus)
+ {
+ 	int err = 0;
+ 	u8 val;
++	u8 wakeupctrl;
++	u8 cardcap;
++	u8 chipclkcsr;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
++	if (brcmf_chip_is_ulp(bus->ci)) {
++		wakeupctrl = SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT;
++		chipclkcsr = SBSDIO_HT_AVAIL_REQ;
++	} else {
++		wakeupctrl = SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
++		chipclkcsr = SBSDIO_FORCE_HT;
++	}
++
++	if (brcmf_sdio_aos_no_decode(bus)) {
++		cardcap = SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC;
++	} else {
++		cardcap = (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
++			   SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT);
++	}
++
+ 	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
+ 	if (err) {
+ 		brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
+ 		return;
+ 	}
+-
+-	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
++	val |= 1 << wakeupctrl;
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
+@@ -3350,8 +3398,7 @@ static void brcmf_sdio_sr_init(struct br
+ 
+ 	/* Add CMD14 Support */
+ 	brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
+-			     (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
+-			      SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
++			     cardcap,
+ 			     &err);
+ 	if (err) {
+ 		brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
+@@ -3359,7 +3406,7 @@ static void brcmf_sdio_sr_init(struct br
+ 	}
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-			   SBSDIO_FORCE_HT, &err);
++			   chipclkcsr, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
+ 		return;
+@@ -4051,7 +4098,7 @@ static void brcmf_sdio_firmware_callback
+ 	const struct firmware *code;
+ 	void *nvram;
+ 	u32 nvram_len;
+-	u8 saveclk;
++	u8 saveclk, bpreq;
+ 	u8 devctl;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+@@ -4085,8 +4132,11 @@ static void brcmf_sdio_firmware_callback
+ 	/* Force clocks on backplane to be sure F2 interrupt propagates */
+ 	saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 	if (!err) {
++		bpreq = saveclk;
++		bpreq |= brcmf_chip_is_ulp(bus->ci) ?
++			SBSDIO_HT_AVAIL_REQ : SBSDIO_FORCE_HT;
+ 		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
+-				   (saveclk | SBSDIO_FORCE_HT), &err);
++				   bpreq, &err);
+ 	}
+ 	if (err) {
+ 		brcmf_err("Failed to force clock for F2: err %d\n", err);
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -60,6 +60,7 @@
+ #define BRCM_CC_43664_CHIP_ID		43664
+ #define BRCM_CC_4371_CHIP_ID		0x4371
+ #define CY_CC_4373_CHIP_ID		0x4373
++#define CY_CC_43012_CHIP_ID		43012
+ 
+ /* USB Device IDs */
+ #define BRCM_USB_43143_DEVICE_ID	0xbd1e
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -42,6 +42,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
+ #define SDIO_DEVICE_ID_BROADCOM_4356		0x4356
+ #define SDIO_DEVICE_ID_CYPRESS_4373		0x4373
++#define SDIO_DEVICE_ID_CYPRESS_43012		43012
+ 
+ #define SDIO_VENDOR_ID_INTEL			0x0089
+ #define SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX	0x1402
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch
new file mode 100644
index 0000000000..809ee9a516
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch
@@ -0,0 +1,60 @@
+From b021a6bc1175442609af0b66d64f850883e155fb Mon Sep 17 00:00:00 2001
+From: Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:48 +0000
+Subject: [PATCH] brcmfmac: allow GCI core enumuration
+
+GCI core is needed for ULP operation. Allow GCI core enumuration with
+below changes:
+ - Allow GCI to be added to core list even when it doesn't have a wrapper.
+ - Allow 8K address space size.
+ - Don't overwrite the address value when an additional size descriptor
+   is in place.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/chip.c    | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -786,7 +786,7 @@ static int brcmf_chip_dmp_get_regaddr(st
+ 				      u32 *regbase, u32 *wrapbase)
+ {
+ 	u8 desc;
+-	u32 val;
++	u32 val, szdesc;
+ 	u8 mpnum = 0;
+ 	u8 stype, sztype, wraptype;
+ 
+@@ -832,14 +832,15 @@ static int brcmf_chip_dmp_get_regaddr(st
+ 
+ 		/* next size descriptor can be skipped */
+ 		if (sztype == DMP_SLAVE_SIZE_DESC) {
+-			val = brcmf_chip_dmp_get_desc(ci, eromaddr, NULL);
++			szdesc = brcmf_chip_dmp_get_desc(ci, eromaddr, NULL);
+ 			/* skip upper size descriptor if present */
+-			if (val & DMP_DESC_ADDRSIZE_GT32)
++			if (szdesc & DMP_DESC_ADDRSIZE_GT32)
+ 				brcmf_chip_dmp_get_desc(ci, eromaddr, NULL);
+ 		}
+ 
+-		/* only look for 4K register regions */
+-		if (sztype != DMP_SLAVE_SIZE_4K)
++		/* look for 4K or 8K register regions */
++		if (sztype != DMP_SLAVE_SIZE_4K &&
++		    sztype != DMP_SLAVE_SIZE_8K)
+ 			continue;
+ 
+ 		stype = (val & DMP_SLAVE_TYPE) >> DMP_SLAVE_TYPE_S;
+@@ -896,7 +897,8 @@ int brcmf_chip_dmp_erom_scan(struct brcm
+ 
+ 		/* need core with ports */
+ 		if (nmw + nsw == 0 &&
+-		    id != BCMA_CORE_PMU)
++		    id != BCMA_CORE_PMU &&
++		    id != BCMA_CORE_GCI)
+ 			continue;
+ 
+ 		/* try to obtain register address info */
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch
new file mode 100644
index 0000000000..3b44952af4
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch
@@ -0,0 +1,49 @@
+From f95a8d9c6aca196f1ace5b2e53a3dd3bc491b1b3 Mon Sep 17 00:00:00 2001
+From: Naveen Gupta <naveen.gupta@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:49 +0000
+Subject: [PATCH] brcmfmac: update 43012 F2 watermark setting to fix DMA Error
+ during UDP RX Traffic
+
+The number of words that the read FIFO has to contain except
+the end of frame before sends data back to the host.
+Max watermark = (512B - 2* (BurstLength))/4 =
+(512 - 128)/4 = 384/4 = 0x60
+so if burst length (i.e. BurstLength = 64) is increased,
+watermark has to be reduced. This is the optimal setting for this chip.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Naveen Gupta <naveen.gupta@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -52,6 +52,7 @@
+ /* watermark expressed in number of words */
+ #define DEFAULT_F2_WATERMARK    0x8
+ #define CY_4373_F2_WATERMARK    0x40
++#define CY_43012_F2_WATERMARK    0x60
+ 
+ #ifdef DEBUG
+ 
+@@ -4173,6 +4174,17 @@ static void brcmf_sdio_firmware_callback
+ 					   CY_4373_F2_WATERMARK |
+ 					   SBSDIO_MESBUSYCTRL_ENAB, &err);
+ 			break;
++		case SDIO_DEVICE_ID_CYPRESS_43012:
++			brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++				  CY_43012_F2_WATERMARK);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   CY_43012_F2_WATERMARK, &err);
++			devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++						   &err);
++			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++					   &err);
++			break;
+ 		default:
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+ 					   DEFAULT_F2_WATERMARK, &err);
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch
new file mode 100644
index 0000000000..61c65692de
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch
@@ -0,0 +1,57 @@
+From 2f2d389efda4caa4c1b69cb4fa2ab217f0fe6d6f Mon Sep 17 00:00:00 2001
+From: Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:50 +0000
+Subject: [PATCH] brcmfmac: 4373 save-restore support
+
+Use chipcommon sr_control0 register to check 4373 sr support.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/chip.c        |  5 +++++
+ .../broadcom/brcm80211/include/chipcommon.h   | 19 +++++++++++++++++++
+ 2 files changed, 24 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -1365,6 +1365,11 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 		addr = CORE_CC_REG(base, sr_control1);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+ 		return reg != 0;
++	case CY_CC_4373_CHIP_ID:
++		/* explicitly check SR engine enable bit */
++		addr = CORE_CC_REG(base, sr_control0);
++		reg = chip->ops->read32(chip->ctx, addr);
++		return (reg & CC_SR_CTL0_ENABLE_MASK) != 0;
+ 	case CY_CC_43012_CHIP_ID:
+ 		addr = CORE_CC_REG(pmu->base, retention_ctl);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+--- a/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
+@@ -269,6 +269,25 @@ struct chipcregs {
+ /* GSIO (spi/i2c) present, rev >= 37 */
+ #define	CC_CAP2_GSIO		0x00000002
+ 
++/* sr_control0, rev >= 48 */
++#define CC_SR_CTL0_ENABLE_MASK			BIT(0)
++#define CC_SR_CTL0_ENABLE_SHIFT		0
++#define CC_SR_CTL0_EN_SR_ENG_CLK_SHIFT	1 /* sr_clk to sr_memory enable */
++#define CC_SR_CTL0_RSRC_TRIGGER_SHIFT	2 /* Rising edge resource trigger 0 to
++					   * sr_engine
++					   */
++#define CC_SR_CTL0_MIN_DIV_SHIFT	6 /* Min division value for fast clk
++					   * in sr_engine
++					   */
++#define CC_SR_CTL0_EN_SBC_STBY_SHIFT		16
++#define CC_SR_CTL0_EN_SR_ALP_CLK_MASK_SHIFT	18
++#define CC_SR_CTL0_EN_SR_HT_CLK_SHIFT		19
++#define CC_SR_CTL0_ALLOW_PIC_SHIFT	20 /* Allow pic to separate power
++					    * domains
++					    */
++#define CC_SR_CTL0_MAX_SR_LQ_CLK_CNT_SHIFT	25
++#define CC_SR_CTL0_EN_MEM_DISABLE_FOR_SLEEP	30
++
+ /* pmucapabilities */
+ #define PCAP_REV_MASK	0x000000ff
+ #define PCAP_RC_MASK	0x00001f00
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch
new file mode 100644
index 0000000000..a1125e588d
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch
@@ -0,0 +1,45 @@
+From 29f6589140a10ece8c1d73f58043ea5b3473ab3e Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:52 +0000
+Subject: [PATCH] brcmfmac: disable command decode in sdio_aos
+
+AOS is a part of the SDIOD core that becomes active when the rest of
+SDIOD is sleeping to keep SDIO bus alive responding to reduced set of
+commands.
+
+Transaction between AOS and SDIOD is not protected, and if cmd 52 is
+received in AOS and in the middle of response state changed from AOS to
+SDIOD, response is corrupted and it causes to SDIO Host controller to
+hang.
+
+Command decode for below chips are disabled in this commit:
+ - 4339
+ - 4345
+ - 4354
+ - 4373
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3354,7 +3354,11 @@ err:
+ 
+ static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
+ {
+-	if (bus->ci->chip == CY_CC_43012_CHIP_ID)
++	if (bus->ci->chip == CY_CC_43012_CHIP_ID ||
++	    bus->ci->chip == CY_CC_4373_CHIP_ID ||
++	    bus->ci->chip == BRCM_CC_4339_CHIP_ID ||
++	    bus->ci->chip == BRCM_CC_4345_CHIP_ID ||
++	    bus->ci->chip == BRCM_CC_4354_CHIP_ID)
+ 		return true;
+ 	else
+ 		return false;
diff --git a/package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch b/package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch
new file mode 100644
index 0000000000..5d454fd3ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch
@@ -0,0 +1,34 @@
+From 412dd15c8177d93abe0c8787b83b31c5eb061405 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 10 Dec 2018 21:55:37 +0100
+Subject: [PATCH] brcmfmac: fix false-positive -Wmaybe-unintialized warning
+
+When CONFIG_NO_AUTO_INLINE is set, we get a false-postive warning
+for the brcmf_fw_request_nvram_done() function, after gcc figures
+out that brcmf_fw_nvram_from_efi() might not set the 'data_len'
+variable, but fails to notice that it always returns NULL:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c: In function 'brcmf_fw_request_nvram_done':
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c:560:11: error: 'data_len' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+Mark it 'inline' to force gcc to understand this.
+
+Fixes: ce2e6db554fa ("brcmfmac: Add support for getting nvram contents from EFI variables")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -512,7 +512,7 @@ fail:
+ 	return NULL;
+ }
+ #else
+-static u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
++static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
+ #endif
+ 
+ static void brcmf_fw_free_request(struct brcmf_fw_request *req)
diff --git a/package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch b/package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch
similarity index 95%
rename from package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch
rename to package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch
index ceb12c17d3..acf587676e 100644
--- a/package/kernel/mac80211/patches/380-v5.0-0006-brcmfmac-Fix-access-point-mode.patch
+++ b/package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch
@@ -22,7 +22,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6303,6 +6303,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
+@@ -6308,6 +6308,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
  		.tx = 0xffff,
  		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
  		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
diff --git a/package/kernel/mac80211/patches/brcm/340-v5.1-brcmfmac-Add-DMI-nvram-filename-quirk-for-PoV-TAB-P1.patch b/package/kernel/mac80211/patches/brcm/340-v5.1-brcmfmac-Add-DMI-nvram-filename-quirk-for-PoV-TAB-P1.patch
new file mode 100644
index 0000000000..4cb3a4243a
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/340-v5.1-brcmfmac-Add-DMI-nvram-filename-quirk-for-PoV-TAB-P1.patch
@@ -0,0 +1,51 @@
+From 4d95f99c59b8b814bcf09ba86020d937ec7caa86 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 20 Dec 2018 17:40:58 +0100
+Subject: [PATCH] brcmfmac: Add DMI nvram filename quirk for PoV TAB-P1006W-232
+ tablet
+
+The Point of View TAB-P1006W-232 tablet contains quite generic names in
+the sys_vendor and product_name DMI strings, without this patch brcmfmac
+will try to load: brcmfmac43340-sdio.Insyde-BayTrail.txt as nvram file
+which is a bit too generic.
+
+Add a DMI quirk so that a unique and clearly identifiable nvram file
+name is used on the PoV TAB-P1006W-232 tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/dmi.c    | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -43,6 +43,10 @@ static const struct brcmf_dmi_data meego
+ 	BRCM_CC_43340_CHIP_ID, 2, "meegopad-t08"
+ };
+ 
++static const struct brcmf_dmi_data pov_tab_p1006w_data = {
++	BRCM_CC_43340_CHIP_ID, 2, "pov-tab-p1006w-data"
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ 	{
+ 		/* Match for the GPDwin which unfortunately uses somewhat
+@@ -81,6 +85,17 @@ static const struct dmi_system_id dmi_pl
+ 		},
+ 		.driver_data = (void *)&meegopad_t08_data,
+ 	},
++	{
++		/* Point of View TAB-P1006W-232 */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Insyde"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "BayTrail"),
++			/* Note 105b is Foxcon's USB/PCI vendor id */
++			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "105B"),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "0E57"),
++		},
++		.driver_data = (void *)&pov_tab_p1006w_data,
++	},
+ 	{}
+ };
+ 
diff --git a/package/kernel/mac80211/patches/brcm/341-v5.1-brcmfmac-add-a-check-for-the-status-of-usb_register.patch b/package/kernel/mac80211/patches/brcm/341-v5.1-brcmfmac-add-a-check-for-the-status-of-usb_register.patch
new file mode 100644
index 0000000000..3568910678
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/341-v5.1-brcmfmac-add-a-check-for-the-status-of-usb_register.patch
@@ -0,0 +1,28 @@
+From 42daad3343be4a4e1ee03e30a5f5cc731dadfef5 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Tue, 25 Dec 2018 19:22:24 -0600
+Subject: [PATCH] brcmfmac: add a check for the status of usb_register
+
+usb_register() may fail, so let's check its status and issue an error
+message if it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1552,6 +1552,10 @@ void brcmf_usb_exit(void)
+ 
+ void brcmf_usb_register(void)
+ {
++	int ret;
++
+ 	brcmf_dbg(USB, "Enter\n");
+-	usb_register(&brcmf_usbdrvr);
++	ret = usb_register(&brcmf_usbdrvr);
++	if (ret)
++		brcmf_err("usb_register failed %d\n", ret);
+ }
diff --git a/package/kernel/mac80211/patches/brcm/342-v5.1-brcmfmac-fix-system-warning-message-during-wowl-susp.patch b/package/kernel/mac80211/patches/brcm/342-v5.1-brcmfmac-fix-system-warning-message-during-wowl-susp.patch
new file mode 100644
index 0000000000..9115373add
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/342-v5.1-brcmfmac-fix-system-warning-message-during-wowl-susp.patch
@@ -0,0 +1,33 @@
+From 3a33bd840523aaa06f4429fbfd38922bf0dc2e8d Mon Sep 17 00:00:00 2001
+From: Lo-Hsiang Lo <double.lo@cypress.com>
+Date: Mon, 7 Jan 2019 08:46:16 +0000
+Subject: [PATCH] brcmfmac: fix system warning message during wowl suspend
+
+There is a system warning message, warn_slowpath-fmt, during suspend
+while using supplicant join AP and enable wowl feature by IW command.
+It's caused by brcmf_pno_remove_request path can't find the reqid.
+This fix will not go to remove pno request function if there is no
+pno scan.
+
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Lo-Hsiang Lo <double.lo@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -496,6 +496,11 @@ int brcmf_pno_stop_sched_scan(struct brc
+ 	brcmf_dbg(TRACE, "reqid=%llu\n", reqid);
+ 
+ 	pi = ifp_to_pno(ifp);
++
++	/* No PNO request */
++	if (!pi->n_reqs)
++		return 0;
++
+ 	err = brcmf_pno_remove_request(pi, reqid);
+ 	if (err)
+ 		return err;
diff --git a/package/kernel/mac80211/patches/381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch b/package/kernel/mac80211/patches/brcm/344-v5.1-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch
rename to package/kernel/mac80211/patches/brcm/344-v5.1-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch
diff --git a/package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch b/package/kernel/mac80211/patches/brcm/345-v5.1-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
similarity index 99%
rename from package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
rename to package/kernel/mac80211/patches/brcm/345-v5.1-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
index da529a5bb9..8eceee6859 100644
--- a/package/kernel/mac80211/patches/381-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
+++ b/package/kernel/mac80211/patches/brcm/345-v5.1-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch
@@ -254,7 +254,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return err;
  }
-@@ -2065,7 +2077,8 @@ void brcmf_pcie_register(void)
+@@ -2066,7 +2078,8 @@ void brcmf_pcie_register(void)
  	brcmf_dbg(PCIE, "Enter\n");
  	err = pci_register_driver(&brcmf_pciedrvr);
  	if (err)
diff --git a/package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch b/package/kernel/mac80211/patches/brcm/346-v5.1-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
similarity index 90%
rename from package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
rename to package/kernel/mac80211/patches/brcm/346-v5.1-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
index d767fbb65e..efd77d4c00 100644
--- a/package/kernel/mac80211/patches/381-v5.1-0003-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
+++ b/package/kernel/mac80211/patches/brcm/346-v5.1-brcmfmac-add-bphy_err-and-use-it-in-the-cfg80211.c.patch
@@ -800,7 +800,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(wiphy, "Failed to get bss info (%d)\n", err);
  		goto out_kfree;
  	}
- 	si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
+ 	si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
 @@ -2489,6 +2514,7 @@ static s32
  brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
  				struct station_info *sinfo)
@@ -817,7 +817,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(wiphy, "BRCMF_C_GET_RATE error (%d)\n", err);
  		return err;
  	}
- 	sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
 @@ -2508,7 +2534,7 @@ brcmf_cfg80211_get_station_ibss(struct b
  	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
  				     sizeof(scbval));
@@ -835,7 +835,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(wiphy, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
  		return err;
  	}
- 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
 @@ -2566,7 +2592,7 @@ brcmf_cfg80211_get_station(struct wiphy
  					       &sta_info_le,
  					       sizeof(sta_info_le));
@@ -941,10 +941,10 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto update_bss_info_out;
  		}
  		dtim_period = (u8)var;
-@@ -2985,9 +3014,10 @@ static void brcmf_escan_timeout(unsigned
+@@ -2985,9 +3014,10 @@ static void brcmf_escan_timeout(struct t
  {
  	struct brcmf_cfg80211_info *cfg =
- 			(struct brcmf_cfg80211_info *)data;
+ 			from_timer(cfg, t, escan_timeout);
 +	struct wiphy *wiphy = cfg_to_wiphy(cfg);
  
  	if (cfg->int_escan_map || cfg->scan_request) {
@@ -1031,7 +1031,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  
-@@ -3302,14 +3334,14 @@ brcmf_notify_sched_scan_results(struct b
+@@ -3301,14 +3333,14 @@ brcmf_notify_sched_scan_results(struct b
  	WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
  	brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
  	if (!result_count) {
@@ -1048,7 +1048,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto out_err;
  	}
  
-@@ -3363,8 +3395,8 @@ brcmf_cfg80211_sched_scan_start(struct w
+@@ -3362,8 +3394,8 @@ brcmf_cfg80211_sched_scan_start(struct w
  		  req->n_match_sets, req->n_ssids);
  
  	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
@@ -1059,7 +1059,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EAGAIN;
  	}
  
-@@ -3443,6 +3475,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+@@ -3442,6 +3474,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
  		      void *data)
  {
  	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
@@ -1067,7 +1067,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_pno_scanresults_le *pfn_result;
  	struct brcmf_pno_net_info_le *netinfo;
  
-@@ -3461,8 +3494,8 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+@@ -3460,8 +3493,8 @@ brcmf_wowl_nd_results(struct brcmf_if *i
  	}
  
  	if (le32_to_cpu(pfn_result->count) < 1) {
@@ -1078,7 +1078,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EINVAL;
  	}
  
-@@ -3499,7 +3532,7 @@ static void brcmf_report_wowl_wakeind(st
+@@ -3498,7 +3531,7 @@ static void brcmf_report_wowl_wakeind(st
  	err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
  				       sizeof(wake_ind_le));
  	if (err) {
@@ -1087,7 +1087,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  
-@@ -3540,7 +3573,7 @@ static void brcmf_report_wowl_wakeind(st
+@@ -3539,7 +3572,7 @@ static void brcmf_report_wowl_wakeind(st
  				cfg->wowl.nd_data_completed,
  				BRCMF_ND_INFO_TIMEOUT);
  			if (!timeout)
@@ -1096,7 +1096,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			else
  				wakeup_data.net_detect = cfg->wowl.nd_info;
  		}
-@@ -3748,7 +3781,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
+@@ -3747,7 +3780,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
  			cfg->pmk_list.npmk = cpu_to_le32(npmk);
  		}
  	} else {
@@ -1105,7 +1105,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EINVAL;
  	}
  
-@@ -3794,7 +3827,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
+@@ -3793,7 +3826,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
  		memset(&pmk[i], 0, sizeof(*pmk));
  		cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
  	} else {
@@ -1114,7 +1114,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EINVAL;
  	}
  
-@@ -3826,19 +3859,20 @@ brcmf_cfg80211_flush_pmksa(struct wiphy
+@@ -3825,19 +3858,20 @@ brcmf_cfg80211_flush_pmksa(struct wiphy
  
  static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
  {
@@ -1137,7 +1137,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	/* set upper-layer auth */
-@@ -3848,7 +3882,7 @@ static s32 brcmf_configure_opensecurity(
+@@ -3847,7 +3881,7 @@ static s32 brcmf_configure_opensecurity(
  		wpa_val = WPA_AUTH_DISABLED;
  	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
  	if (err < 0) {
@@ -1146,7 +1146,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  
-@@ -3868,6 +3902,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3867,6 +3901,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  		      const struct brcmf_vs_tlv *wpa_ie,
  		      bool is_rsn_ie)
  {
@@ -1154,7 +1154,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 auth = 0; /* d11 open authentication */
  	u16 count;
  	s32 err = 0;
-@@ -3898,13 +3933,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3897,13 +3932,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* check for multicast cipher suite */
  	if (offset + WPA_IE_MIN_OUI_LEN > len) {
  		err = -EINVAL;
@@ -1170,7 +1170,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  	offset += TLV_OUI_LEN;
-@@ -3926,7 +3961,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3925,7 +3960,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  		break;
  	default:
  		err = -EINVAL;
@@ -1179,7 +1179,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  
-@@ -3937,13 +3972,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3936,13 +3971,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* Check for unicast suite(s) */
  	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
  		err = -EINVAL;
@@ -1195,7 +1195,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		offset += TLV_OUI_LEN;
-@@ -3961,7 +3996,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3960,7 +3995,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  			pval |= AES_ENABLED;
  			break;
  		default:
@@ -1204,7 +1204,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		}
  		offset++;
  	}
-@@ -3971,13 +4006,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3970,13 +4005,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* Check for auth key management suite(s) */
  	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
  		err = -EINVAL;
@@ -1220,7 +1220,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		offset += TLV_OUI_LEN;
-@@ -4005,7 +4040,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4004,7 +4039,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  			wpa_auth |= WPA2_AUTH_1X_SHA256;
  			break;
  		default:
@@ -1229,7 +1229,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		}
  		offset++;
  	}
-@@ -4047,7 +4082,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4046,7 +4081,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  		err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
  					       wme_bss_disable);
  		if (err < 0) {
@@ -1238,7 +1238,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  
-@@ -4061,7 +4096,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4060,7 +4095,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  							&data[offset],
  							WPA_IE_MIN_OUI_LEN);
  			if (err < 0) {
@@ -1247,7 +1247,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4072,13 +4107,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4071,13 +4106,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* set auth */
  	err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
  	if (err < 0) {
@@ -1263,7 +1263,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  	/* Configure MFP, this needs to go after wsec otherwise the wsec command
-@@ -4087,14 +4122,14 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4086,14 +4121,14 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
  		err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
  		if (err < 0) {
@@ -1280,7 +1280,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  
-@@ -4181,6 +4216,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4180,6 +4215,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  			  const u8 *vndr_ie_buf, u32 vndr_ie_len)
  {
  	struct brcmf_if *ifp;
@@ -1288,7 +1288,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct vif_saved_ie *saved_ie;
  	s32 err = 0;
  	u8  *iovar_ie_buf;
-@@ -4201,6 +4237,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4200,6 +4236,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  	if (!vif)
  		return -ENODEV;
  	ifp = vif->ifp;
@@ -1296,7 +1296,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	saved_ie = &vif->saved_ie;
  
  	brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
-@@ -4232,13 +4269,13 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4231,13 +4268,13 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  		break;
  	default:
  		err = -EPERM;
@@ -1312,7 +1312,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  
-@@ -4299,8 +4336,8 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4298,8 +4335,8 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  			/* verify remained buf size before copy data */
  			if (remained_buf_len < (vndrie_info->vndrie.len +
  							VNDR_IE_VSIE_OFFSET)) {
@@ -1323,7 +1323,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				break;
  			}
  			remained_buf_len -= (vndrie_info->ie_len +
-@@ -4331,7 +4368,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4330,7 +4367,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  		err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
  						 total_ie_buf_len);
  		if (err)
@@ -1332,7 +1332,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  
  exit:
-@@ -4359,13 +4396,14 @@ static s32
+@@ -4358,13 +4395,14 @@ static s32
  brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
  			struct cfg80211_beacon_data *beacon)
  {
@@ -1348,7 +1348,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
-@@ -4375,7 +4413,7 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg
+@@ -4374,7 +4412,7 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg
  				    beacon->proberesp_ies,
  				    beacon->proberesp_ies_len);
  	if (err)
@@ -1357,7 +1357,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	else
  		brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
  
-@@ -4484,7 +4522,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4483,7 +4521,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
  						    is_11d);
  			if (err < 0) {
@@ -1367,7 +1367,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4492,8 +4531,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4491,8 +4530,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
  						    settings->beacon_interval);
  			if (err < 0) {
@@ -1378,7 +1378,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4501,7 +4540,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4500,7 +4539,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
  						    settings->dtim_period);
  			if (err < 0) {
@@ -1388,7 +1388,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4511,7 +4551,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4510,7 +4550,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  		     !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
  			if (err < 0) {
@@ -1398,7 +1398,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  			brcmf_fil_iovar_int_set(ifp, "apsta", 0);
-@@ -4519,7 +4560,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4518,7 +4559,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  
  		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
  		if (err < 0) {
@@ -1407,7 +1407,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  	} else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
-@@ -4535,7 +4576,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4534,7 +4575,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  
  		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
  		if (err < 0) {
@@ -1417,7 +1417,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		if (!mbss) {
-@@ -4544,14 +4586,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4543,14 +4585,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			 */
  			err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
  			if (err < 0) {
@@ -1435,7 +1435,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		/* On DOWN the firmware removes the WEP keys, reconfigure
-@@ -4566,14 +4608,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4565,14 +4607,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
  					     &join_params, sizeof(join_params));
  		if (err < 0) {
@@ -1452,7 +1452,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4582,14 +4624,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4581,14 +4623,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  	} else if (dev_role == NL80211_IFTYPE_P2P_GO) {
  		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
  		if (err < 0) {
@@ -1470,7 +1470,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
-@@ -4597,7 +4639,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4596,7 +4638,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
  					       sizeof(bss_enable));
  		if (err < 0) {
@@ -1479,7 +1479,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  
-@@ -4645,13 +4687,13 @@ static int brcmf_cfg80211_stop_ap(struct
+@@ -4644,13 +4686,13 @@ static int brcmf_cfg80211_stop_ap(struct
  		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
  					     &join_params, sizeof(join_params));
  		if (err < 0)
@@ -1496,7 +1496,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
  			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
  		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
-@@ -4659,7 +4701,7 @@ static int brcmf_cfg80211_stop_ap(struct
+@@ -4658,7 +4700,7 @@ static int brcmf_cfg80211_stop_ap(struct
  		/* Bring device back up so it can be used again */
  		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
  		if (err < 0)
@@ -1505,7 +1505,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  		brcmf_vif_clear_mgmt_ies(ifp->vif);
  	} else {
-@@ -4668,7 +4710,7 @@ static int brcmf_cfg80211_stop_ap(struct
+@@ -4667,7 +4709,7 @@ static int brcmf_cfg80211_stop_ap(struct
  		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
  					       sizeof(bss_enable));
  		if (err < 0)
@@ -1514,7 +1514,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  	brcmf_set_mpc(ifp, 1);
  	brcmf_configure_arp_nd_offload(ifp, true);
-@@ -4716,7 +4758,8 @@ brcmf_cfg80211_del_station(struct wiphy
+@@ -4715,7 +4757,8 @@ brcmf_cfg80211_del_station(struct wiphy
  	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
  				     &scbval, sizeof(scbval));
  	if (err)
@@ -1524,7 +1524,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	brcmf_dbg(TRACE, "Exit\n");
  	return err;
-@@ -4746,7 +4789,7 @@ brcmf_cfg80211_change_station(struct wip
+@@ -4745,7 +4788,7 @@ brcmf_cfg80211_change_station(struct wip
  		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
  					     (void *)mac, ETH_ALEN);
  	if (err < 0)
@@ -1533,7 +1533,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return err;
  }
-@@ -4796,7 +4839,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+@@ -4795,7 +4838,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
  	mgmt = (const struct ieee80211_mgmt *)buf;
  
  	if (!ieee80211_is_mgmt(mgmt->frame_control)) {
@@ -1542,7 +1542,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EPERM;
  	}
  
-@@ -4827,13 +4870,13 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+@@ -4826,13 +4869,13 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
  					GFP_KERNEL);
  	} else if (ieee80211_is_action(mgmt->frame_control)) {
  		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
@@ -1558,7 +1558,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			err = -ENOMEM;
  			goto exit;
  		}
-@@ -4891,7 +4934,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
+@@ -4890,7 +4933,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
  
  	vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
  	if (vif == NULL) {
@@ -1567,7 +1567,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		err = -ENODEV;
  		goto exit;
  	}
-@@ -4919,7 +4962,7 @@ static int brcmf_cfg80211_get_channel(st
+@@ -4918,7 +4961,7 @@ static int brcmf_cfg80211_get_channel(st
  
  	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
  	if (err) {
@@ -1576,7 +1576,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  
-@@ -5058,7 +5101,7 @@ static int brcmf_cfg80211_tdls_oper(stru
+@@ -5057,7 +5100,7 @@ static int brcmf_cfg80211_tdls_oper(stru
  	ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
  				       &info, sizeof(info));
  	if (ret < 0)
@@ -1585,7 +1585,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return ret;
  }
-@@ -5079,7 +5122,7 @@ brcmf_cfg80211_update_conn_params(struct
+@@ -5078,7 +5121,7 @@ brcmf_cfg80211_update_conn_params(struct
  	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
  				    sme->ie, sme->ie_len);
  	if (err)
@@ -1594,7 +1594,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	else
  		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
  
-@@ -5105,7 +5148,7 @@ brcmf_cfg80211_set_rekey_data(struct wip
+@@ -5104,7 +5147,7 @@ brcmf_cfg80211_set_rekey_data(struct wip
  	ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
  				       sizeof(gtk_le));
  	if (ret < 0)
@@ -1603,7 +1603,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return ret;
  }
-@@ -5337,6 +5380,7 @@ static void brcmf_clear_assoc_ies(struct
+@@ -5336,6 +5379,7 @@ static void brcmf_clear_assoc_ies(struct
  static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
  			       struct brcmf_if *ifp)
  {
@@ -1611,7 +1611,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
  	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
  	u32 req_len;
-@@ -5348,7 +5392,7 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5347,7 +5391,7 @@ static s32 brcmf_get_assoc_ies(struct br
  	err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
  				       cfg->extra_buf, WL_ASSOC_INFO_MAX);
  	if (err) {
@@ -1620,7 +1620,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	assoc_info =
-@@ -5360,7 +5404,7 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5359,7 +5403,7 @@ static s32 brcmf_get_assoc_ies(struct br
  					       cfg->extra_buf,
  					       WL_ASSOC_INFO_MAX);
  		if (err) {
@@ -1629,7 +1629,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			return err;
  		}
  		conn_info->req_ie_len = req_len;
-@@ -5376,7 +5420,7 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5375,7 +5419,7 @@ static s32 brcmf_get_assoc_ies(struct br
  					       cfg->extra_buf,
  					       WL_ASSOC_INFO_MAX);
  		if (err) {
@@ -1638,7 +1638,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			return err;
  		}
  		conn_info->resp_ie_len = resp_len;
-@@ -5503,6 +5547,7 @@ brcmf_notify_connect_status_ap(struct br
+@@ -5502,6 +5546,7 @@ brcmf_notify_connect_status_ap(struct br
  			       struct net_device *ndev,
  			       const struct brcmf_event_msg *e, void *data)
  {
@@ -1646,16 +1646,16 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	static int generation;
  	u32 event = e->event_code;
  	u32 reason = e->reason;
-@@ -5521,7 +5566,7 @@ brcmf_notify_connect_status_ap(struct br
+@@ -5519,7 +5564,7 @@ brcmf_notify_connect_status_ap(struct br
+ 	if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
  	    (reason == BRCMF_E_STATUS_SUCCESS)) {
- 		memset(&sinfo, 0, sizeof(sinfo));
  		if (!data) {
 -			brcmf_err("No IEs present in ASSOC/REASSOC_IND");
 +			bphy_err(wiphy, "No IEs present in ASSOC/REASSOC_IND\n");
  			return -EINVAL;
  		}
- 		sinfo.assoc_req_ies = data;
-@@ -5806,6 +5851,7 @@ static void init_vif_event(struct brcmf_
+ 
+@@ -5811,6 +5856,7 @@ static void init_vif_event(struct brcmf_
  
  static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
  {
@@ -1663,7 +1663,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	s32 err;
  	u32 bcn_timeout;
  	__le32 roamtrigger[2];
-@@ -5818,7 +5864,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5823,7 +5869,7 @@ static s32 brcmf_dongle_roam(struct brcm
  		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
  	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
  	if (err) {
@@ -1672,7 +1672,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5830,7 +5876,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5835,7 +5881,7 @@ static s32 brcmf_dongle_roam(struct brcm
  	err = brcmf_fil_iovar_int_set(ifp, "roam_off",
  				      ifp->drvr->settings->roamoff);
  	if (err) {
@@ -1681,7 +1681,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5839,7 +5885,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5844,7 +5890,7 @@ static s32 brcmf_dongle_roam(struct brcm
  	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
  				     (void *)roamtrigger, sizeof(roamtrigger));
  	if (err) {
@@ -1690,7 +1690,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5848,7 +5894,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5853,7 +5899,7 @@ static s32 brcmf_dongle_roam(struct brcm
  	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
  				     (void *)roam_delta, sizeof(roam_delta));
  	if (err) {
@@ -1699,7 +1699,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5859,25 +5905,26 @@ roam_setup_done:
+@@ -5864,25 +5910,26 @@ roam_setup_done:
  static s32
  brcmf_dongle_scantime(struct brcmf_if *ifp)
  {
@@ -1729,7 +1729,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto dongle_scantime_out;
  	}
  
-@@ -5909,10 +5956,10 @@ static void brcmf_update_bw40_channel_fl
+@@ -5914,10 +5961,10 @@ static void brcmf_update_bw40_channel_fl
  static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
  				    u32 bw_cap[])
  {
@@ -1741,7 +1741,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_chanspec_list *list;
  	struct brcmu_chan ch;
  	int err;
-@@ -5931,11 +5978,10 @@ static int brcmf_construct_chaninfo(stru
+@@ -5936,11 +5983,10 @@ static int brcmf_construct_chaninfo(stru
  	err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
  				       BRCMF_DCMD_MEDLEN);
  	if (err) {
@@ -1754,7 +1754,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	band = wiphy->bands[NL80211_BAND_2GHZ];
  	if (band)
  		for (i = 0; i < band->n_channels; i++)
-@@ -5955,7 +6001,8 @@ static int brcmf_construct_chaninfo(stru
+@@ -5960,7 +6006,8 @@ static int brcmf_construct_chaninfo(stru
  		} else if (ch.band == BRCMU_CHAN_BAND_5G) {
  			band = wiphy->bands[NL80211_BAND_5GHZ];
  		} else {
@@ -1764,7 +1764,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			continue;
  		}
  		if (!band)
-@@ -5978,8 +6025,8 @@ static int brcmf_construct_chaninfo(stru
+@@ -5983,8 +6030,8 @@ static int brcmf_construct_chaninfo(stru
  			/* It seems firmware supports some channel we never
  			 * considered. Something new in IEEE standard?
  			 */
@@ -1775,7 +1775,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			continue;
  		}
  
-@@ -6025,6 +6072,7 @@ fail_pbuf:
+@@ -6030,6 +6077,7 @@ fail_pbuf:
  
  static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
  {
@@ -1783,7 +1783,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
  	struct ieee80211_supported_band *band;
  	struct brcmf_fil_bwcap_le band_bwcap;
-@@ -6071,7 +6119,7 @@ static int brcmf_enable_bw40_2g(struct b
+@@ -6076,7 +6124,7 @@ static int brcmf_enable_bw40_2g(struct b
  		err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
  					       BRCMF_DCMD_MEDLEN);
  		if (err) {
@@ -1792,7 +1792,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			kfree(pbuf);
  			return err;
  		}
-@@ -6102,6 +6150,7 @@ static int brcmf_enable_bw40_2g(struct b
+@@ -6107,6 +6155,7 @@ static int brcmf_enable_bw40_2g(struct b
  
  static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
  {
@@ -1800,7 +1800,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 band, mimo_bwcap;
  	int err;
  
-@@ -6137,7 +6186,7 @@ static void brcmf_get_bwcap(struct brcmf
+@@ -6142,7 +6191,7 @@ static void brcmf_get_bwcap(struct brcmf
  		bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
  		break;
  	default:
@@ -1809,7 +1809,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  }
  
-@@ -6213,7 +6262,7 @@ static void brcmf_update_vht_cap(struct
+@@ -6218,7 +6267,7 @@ static void brcmf_update_vht_cap(struct
  static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
  {
  	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
@@ -1818,7 +1818,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 nmode = 0;
  	u32 vhtmode = 0;
  	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
-@@ -6229,7 +6278,7 @@ static int brcmf_setup_wiphybands(struct
+@@ -6234,7 +6283,7 @@ static int brcmf_setup_wiphybands(struct
  	(void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
  	err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
  	if (err) {
@@ -1827,7 +1827,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	} else {
  		brcmf_get_bwcap(ifp, bw_cap);
  	}
-@@ -6239,7 +6288,7 @@ static int brcmf_setup_wiphybands(struct
+@@ -6244,7 +6293,7 @@ static int brcmf_setup_wiphybands(struct
  
  	err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
  	if (err) {
@@ -1836,7 +1836,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		nchain = 1;
  	} else {
  		for (nchain = 0; rxchain; nchain++)
-@@ -6249,7 +6298,7 @@ static int brcmf_setup_wiphybands(struct
+@@ -6254,7 +6303,7 @@ static int brcmf_setup_wiphybands(struct
  
  	err = brcmf_construct_chaninfo(cfg, bw_cap);
  	if (err) {
@@ -1845,7 +1845,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  
-@@ -6261,7 +6310,6 @@ static int brcmf_setup_wiphybands(struct
+@@ -6266,7 +6315,6 @@ static int brcmf_setup_wiphybands(struct
  					      &txbf_bfr_cap);
  	}
  
@@ -1853,7 +1853,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
  		band = wiphy->bands[i];
  		if (band == NULL)
-@@ -6462,7 +6510,7 @@ static void brcmf_wiphy_wowl_params(stru
+@@ -6467,7 +6515,7 @@ static void brcmf_wiphy_wowl_params(stru
  	wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
  		       GFP_KERNEL);
  	if (!wowl) {
@@ -1862,7 +1862,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		wiphy->wowlan = &brcmf_wowlan_support;
  		return;
  	}
-@@ -6559,7 +6607,7 @@ static int brcmf_setup_wiphy(struct wiph
+@@ -6564,7 +6612,7 @@ static int brcmf_setup_wiphy(struct wiph
  	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
  				     sizeof(bandlist));
  	if (err) {
@@ -1871,7 +1871,24 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	/* first entry in bandlist is number of bands */
-@@ -6831,8 +6879,8 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6613,6 +6661,7 @@ static int brcmf_setup_wiphy(struct wiph
+ 
+ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
+ {
++	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+ 	struct net_device *ndev;
+ 	struct wireless_dev *wdev;
+ 	struct brcmf_if *ifp;
+@@ -6650,7 +6699,7 @@ static s32 brcmf_config_dongle(struct br
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
+ 	if (err) {
+-		brcmf_err("failed to set frameburst mode\n");
++		bphy_err(wiphy, "failed to set frameburst mode\n");
+ 		goto default_conf_out;
+ 	}
+ 
+@@ -6842,8 +6891,8 @@ static void brcmf_cfg80211_reg_notifier(
  	/* ignore non-ISO3166 country codes */
  	for (i = 0; i < 2; i++)
  		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
@@ -1882,7 +1899,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			return;
  		}
  
-@@ -6841,7 +6889,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6852,7 +6901,7 @@ static void brcmf_cfg80211_reg_notifier(
  
  	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
  	if (err) {
@@ -1891,7 +1908,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  
-@@ -6851,7 +6899,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6862,7 +6911,7 @@ static void brcmf_cfg80211_reg_notifier(
  
  	err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
  	if (err) {
@@ -1900,7 +1917,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  	brcmf_setup_wiphybands(cfg);
-@@ -6897,13 +6945,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6908,13 +6957,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	u16 *cap = NULL;
  
  	if (!ndev) {
@@ -1916,7 +1933,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return NULL;
  	}
  
-@@ -6924,7 +6972,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6935,7 +6984,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  
  	err = wl_init_priv(cfg);
  	if (err) {
@@ -1925,7 +1942,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_free_vif(vif);
  		goto wiphy_out;
  	}
-@@ -6933,7 +6981,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6944,7 +6993,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	/* determine d11 io type before wiphy setup */
  	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
  	if (err) {
@@ -1934,7 +1951,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto priv_out;
  	}
  	cfg->d11inf.io_type = (u8)io_type;
-@@ -6967,13 +7015,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6978,13 +7027,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  #endif
  	err = wiphy_register(wiphy);
  	if (err < 0) {
@@ -1950,7 +1967,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto wiphy_unreg_out;
  	}
  
-@@ -6991,24 +7039,24 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -7002,24 +7051,24 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  
  	err = brcmf_fweh_activate_events(ifp);
  	if (err) {
@@ -1979,7 +1996,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_btcoex_detach(cfg);
  		brcmf_p2p_detach(&cfg->p2p);
  		goto wiphy_unreg_out;
-@@ -7028,7 +7076,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -7039,7 +7088,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	/* (re-) activate FWEH event handling */
  	err = brcmf_fweh_activate_events(ifp);
  	if (err) {
diff --git a/package/kernel/mac80211/patches/brcm/347-v5.1-brcmfmac-fix-typos.patch b/package/kernel/mac80211/patches/brcm/347-v5.1-brcmfmac-fix-typos.patch
new file mode 100644
index 0000000000..e21c1ee60a
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/347-v5.1-brcmfmac-fix-typos.patch
@@ -0,0 +1,62 @@
+From 2359dd09f9819c7d57d81e05173541f0f9f820c7 Mon Sep 17 00:00:00 2001
+From: Matteo Croce <mcroce@redhat.com>
+Date: Tue, 29 Jan 2019 18:47:17 +0100
+Subject: [PATCH] brcmfmac: fix typos
+
+Fix spelling mistakes in brcmfmac: "lenght" -> "length".
+The typos are also in the special comment blocks which
+translates to documentation.
+
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h     | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h     | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c      | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -36,7 +36,7 @@
+ #define BRCMF_DCMD_MEDLEN	1536
+ #define BRCMF_DCMD_MAXLEN	8192
+ 
+-/* IOCTL from host to device are limited in lenght. A device can only handle
++/* IOCTL from host to device are limited in length. A device can only handle
+  * ethernet frame size. This limitation is to be applied by protocol layer.
+  */
+ #define BRCMF_TX_IOCTL_MAX_MSG_SIZE	(ETH_FRAME_LEN+ETH_FCS_LEN)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -47,7 +47,7 @@ enum nvram_parser_state {
+  * @state: current parser state.
+  * @data: input buffer being parsed.
+  * @nvram: output buffer with parse result.
+- * @nvram_len: lenght of parse result.
++ * @nvram_len: length of parse result.
+  * @line: current line.
+  * @column: current column in line.
+  * @pos: byte offset in input buffer.
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -266,7 +266,7 @@ struct brcmf_event {
+  * @status: status information.
+  * @reason: reason code.
+  * @auth_type: authentication type.
+- * @datalen: lenght of event data buffer.
++ * @datalen: length of event data buffer.
+  * @addr: ether address.
+  * @ifname: interface name.
+  * @ifidx: interface index.
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -508,7 +508,7 @@ static void brcmf_usb_rx_complete(struct
+ 	skb = req->skb;
+ 	req->skb = NULL;
+ 
+-	/* zero lenght packets indicate usb "failure". Do not refill */
++	/* zero length packets indicate usb "failure". Do not refill */
+ 	if (urb->status != 0 || !urb->actual_length) {
+ 		brcmu_pkt_buf_free_skb(skb);
+ 		brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
diff --git a/package/kernel/mac80211/patches/381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch b/package/kernel/mac80211/patches/brcm/348-v5.1-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch
rename to package/kernel/mac80211/patches/brcm/348-v5.1-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch
diff --git a/package/kernel/mac80211/patches/brcm/349-v5.1-0001-brcmfmac-assure-SSID-length-from-firmware-is-limited.patch b/package/kernel/mac80211/patches/brcm/349-v5.1-0001-brcmfmac-assure-SSID-length-from-firmware-is-limited.patch
new file mode 100644
index 0000000000..78db26870b
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/349-v5.1-0001-brcmfmac-assure-SSID-length-from-firmware-is-limited.patch
@@ -0,0 +1,28 @@
+From 1b5e2423164b3670e8bc9174e4762d297990deff Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 14 Feb 2019 13:43:47 +0100
+Subject: [PATCH] brcmfmac: assure SSID length from firmware is limited
+
+The SSID length as received from firmware should not exceed
+IEEE80211_MAX_SSID_LEN as that would result in heap overflow.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3499,6 +3499,8 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+ 	}
+ 
+ 	netinfo = brcmf_get_netinfo_array(pfn_result);
++	if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
++		netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
+ 	memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
+ 	cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
+ 	cfg->wowl.nd->n_channels = 1;
diff --git a/package/kernel/mac80211/patches/brcm/349-v5.1-0002-brcmfmac-add-subtype-check-for-event-handling-in-dat.patch b/package/kernel/mac80211/patches/brcm/349-v5.1-0002-brcmfmac-add-subtype-check-for-event-handling-in-dat.patch
new file mode 100644
index 0000000000..57946dabed
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/349-v5.1-0002-brcmfmac-add-subtype-check-for-event-handling-in-dat.patch
@@ -0,0 +1,96 @@
+From a4176ec356c73a46c07c181c6d04039fafa34a9f Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 14 Feb 2019 13:43:48 +0100
+Subject: [PATCH] brcmfmac: add subtype check for event handling in data path
+
+For USB there is no separate channel being used to pass events
+from firmware to the host driver and as such are passed over the
+data path. In order to detect mock event messages an additional
+check is needed on event subtype. This check is added conditionally
+using unlikely() keyword.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  5 +++--
+ .../wireless/broadcom/brcm80211/brcmfmac/fweh.h  | 16 ++++++++++++----
+ .../broadcom/brcm80211/brcmfmac/msgbuf.c         |  2 +-
+ 3 files changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -519,7 +519,8 @@ void brcmf_rx_frame(struct device *dev,
+ 	} else {
+ 		/* Process special event packets */
+ 		if (handle_event)
+-			brcmf_fweh_process_skb(ifp->drvr, skb);
++			brcmf_fweh_process_skb(ifp->drvr, skb,
++					       BCMILCP_SUBTYPE_VENDOR_LONG);
+ 
+ 		brcmf_netif_rx(ifp, skb);
+ 	}
+@@ -536,7 +537,7 @@ void brcmf_rx_event(struct device *dev,
+ 	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
+ 		return;
+ 
+-	brcmf_fweh_process_skb(ifp->drvr, skb);
++	brcmf_fweh_process_skb(ifp->drvr, skb, 0);
+ 	brcmu_pkt_buf_free_skb(skb);
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -211,7 +211,7 @@ enum brcmf_fweh_event_code {
+  */
+ #define BRCM_OUI				"\x00\x10\x18"
+ #define BCMILCP_BCM_SUBTYPE_EVENT		1
+-
++#define BCMILCP_SUBTYPE_VENDOR_LONG		32769
+ 
+ /**
+  * struct brcm_ethhdr - broadcom specific ether header.
+@@ -334,10 +334,10 @@ void brcmf_fweh_process_event(struct brc
+ void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing);
+ 
+ static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
+-					  struct sk_buff *skb)
++					  struct sk_buff *skb, u16 stype)
+ {
+ 	struct brcmf_event *event_packet;
+-	u16 usr_stype;
++	u16 subtype, usr_stype;
+ 
+ 	/* only process events when protocol matches */
+ 	if (skb->protocol != cpu_to_be16(ETH_P_LINK_CTL))
+@@ -346,8 +346,16 @@ static inline void brcmf_fweh_process_sk
+ 	if ((skb->len + ETH_HLEN) < sizeof(*event_packet))
+ 		return;
+ 
+-	/* check for BRCM oui match */
+ 	event_packet = (struct brcmf_event *)skb_mac_header(skb);
++
++	/* check subtype if needed */
++	if (unlikely(stype)) {
++		subtype = get_unaligned_be16(&event_packet->hdr.subtype);
++		if (subtype != stype)
++			return;
++	}
++
++	/* check for BRCM oui match */
+ 	if (memcmp(BRCM_OUI, &event_packet->hdr.oui[0],
+ 		   sizeof(event_packet->hdr.oui)))
+ 		return;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1116,7 +1116,7 @@ static void brcmf_msgbuf_process_event(s
+ 
+ 	skb->protocol = eth_type_trans(skb, ifp->ndev);
+ 
+-	brcmf_fweh_process_skb(ifp->drvr, skb);
++	brcmf_fweh_process_skb(ifp->drvr, skb, 0);
+ 
+ exit:
+ 	brcmu_pkt_buf_free_skb(skb);
diff --git a/package/kernel/mac80211/patches/brcm/349-v5.1-0003-brcmfmac-create-debugfs-files-for-bus-specific-layer.patch b/package/kernel/mac80211/patches/brcm/349-v5.1-0003-brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
new file mode 100644
index 0000000000..b58ec4b7e9
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/349-v5.1-0003-brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
@@ -0,0 +1,101 @@
+From aaf6a5e86e36766abbeedf220462bde8031f9a72 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 14 Feb 2019 13:43:49 +0100
+Subject: [PATCH] brcmfmac: create debugfs files for bus-specific layer
+
+Since we moved the drivers debugfs directory under ieee80211 debugfs the
+debugfs entries need to be added after wiphy_register() has been called.
+For most part that has been done accordingly, but for the debugfs entries
+added by SDIO it was not and failed silently. This patch fixes that by
+adding a bus-layer callback for it.
+
+Fixes: 856d5a011c86 ("brcmfmac: allocate struct brcmf_pub instance using wiphy_new()")
+Reported-by: Russel King <linux@armlinux.org.uk>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h   | 10 ++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c  |  1 +
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 +++++++-----
+ 3 files changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
+ 	int (*get_fwname)(struct device *dev, const char *ext,
+ 			  unsigned char *fw_name);
++	void (*debugfs_create)(struct device *dev);
+ };
+ 
+ 
+@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bu
+ 	return bus->ops->get_fwname(bus->dev, ext, fw_name);
+ }
+ 
++static inline
++void brcmf_bus_debugfs_create(struct brcmf_bus *bus)
++{
++	if (!bus->ops->debugfs_create)
++		return;
++
++	return bus->ops->debugfs_create(bus->dev);
++}
++
+ /*
+  * interface functions from common layer
+  */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1177,6 +1177,7 @@ static int brcmf_bus_started(struct brcm
+ 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
+ 	brcmf_feat_debugfs_create(drvr);
+ 	brcmf_proto_debugfs_create(drvr);
++	brcmf_bus_debugfs_create(bus_if);
+ 
+ 	return 0;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3143,9 +3143,12 @@ static int brcmf_debugfs_sdio_count_read
+ 	return 0;
+ }
+ 
+-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
++static void brcmf_sdio_debugfs_create(struct device *dev)
+ {
+-	struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
+ 	struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
+ 
+ 	if (IS_ERR_OR_NULL(dentry))
+@@ -3165,7 +3168,7 @@ static int brcmf_sdio_checkdied(struct b
+ 	return 0;
+ }
+ 
+-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
++static void brcmf_sdio_debugfs_create(struct device *dev)
+ {
+ }
+ #endif /* DEBUG */
+@@ -3477,8 +3480,6 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (bus->rxbuf)
+ 		bus->rxblen = value;
+ 
+-	brcmf_sdio_debugfs_create(bus);
+-
+ 	/* the commands below use the terms tx and rx from
+ 	 * a device perspective, ie. bus:txglom affects the
+ 	 * bus transfers from device to host.
+@@ -4088,6 +4089,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
+ 	.get_memdump = brcmf_sdio_bus_get_memdump,
+ 	.get_fwname = brcmf_sdio_get_fwname,
++	.debugfs_create = brcmf_sdio_debugfs_create
+ };
+ 
+ #define BRCMF_SDIO_FW_CODE	0
diff --git a/package/kernel/mac80211/patches/brcm/349-v5.1-0004-brcmfmac-disable-MBSS-feature-for-bcm4330-device.patch b/package/kernel/mac80211/patches/brcm/349-v5.1-0004-brcmfmac-disable-MBSS-feature-for-bcm4330-device.patch
new file mode 100644
index 0000000000..e6602d7900
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/349-v5.1-0004-brcmfmac-disable-MBSS-feature-for-bcm4330-device.patch
@@ -0,0 +1,41 @@
+From 92d3b88b1029c46f9bf27302c502dc0e3541805b Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 14 Feb 2019 13:43:50 +0100
+Subject: [PATCH] brcmfmac: disable MBSS feature for bcm4330 device
+
+The MBSS feature was already disabled for bcm43362 as it resulted in a
+beacon with BRCM_TEST_SSID regardless user configuration in hostapd. Now
+the same has been reported for bcm4330 so disable the feature for this
+device as well.
+
+Reported-by: Russell King <linux@armlinux.org.uk>
+Tested-by: Christopher Martin <chrsmrtn@gmail.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -272,9 +272,15 @@ void brcmf_feat_attach(struct brcmf_pub
+ 					BIT(BRCMF_FEAT_WOWL_GTK);
+ 		}
+ 	}
+-	/* MBSS does not work for 43362 */
+-	if (drvr->bus_if->chip == BRCM_CC_43362_CHIP_ID)
++	/* MBSS does not work for all chips */
++	switch (drvr->bus_if->chip) {
++	case BRCM_CC_4330_CHIP_ID:
++	case BRCM_CC_43362_CHIP_ID:
+ 		ifp->drvr->feat_flags &= ~BIT(BRCMF_FEAT_MBSS);
++		break;
++	default:
++		break;
++	}
+ 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_RSDB, "rsdb_mode");
+ 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_TDLS, "tdls_enable");
+ 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MFP, "mfp");
diff --git a/package/kernel/mac80211/patches/brcm/349-v5.1-0005-brcmfmac-check-and-dump-trap-info-during-sdio-probe.patch b/package/kernel/mac80211/patches/brcm/349-v5.1-0005-brcmfmac-check-and-dump-trap-info-during-sdio-probe.patch
new file mode 100644
index 0000000000..dce4331585
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/349-v5.1-0005-brcmfmac-check-and-dump-trap-info-during-sdio-probe.patch
@@ -0,0 +1,121 @@
+From 4ab2cf03da91785f2c34d79a302e53da06928bc1 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 14 Feb 2019 13:43:51 +0100
+Subject: [PATCH] brcmfmac: check and dump trap info during sdio probe
+
+When the firmware crashes during the probe sequence we provide little
+information on what really failed. This patch checks the sdpcm shared
+location and show the trap information if a firmware trap has happened.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 59 +++++++++++++------
+ 1 file changed, 40 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2999,21 +2999,35 @@ static int brcmf_sdio_trap_info(struct s
+ 	if (error < 0)
+ 		return error;
+ 
+-	seq_printf(seq,
+-		   "dongle trap info: type 0x%x @ epc 0x%08x\n"
+-		   "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
+-		   "  lr   0x%08x pc   0x%08x offset 0x%x\n"
+-		   "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
+-		   "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
+-		   le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
+-		   le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
+-		   le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
+-		   le32_to_cpu(tr.pc), sh->trap_addr,
+-		   le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
+-		   le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
+-		   le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
+-		   le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
+-
++	if (seq)
++		seq_printf(seq,
++			   "dongle trap info: type 0x%x @ epc 0x%08x\n"
++			   "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
++			   "  lr   0x%08x pc   0x%08x offset 0x%x\n"
++			   "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
++			   "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
++			   le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
++			   le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
++			   le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
++			   le32_to_cpu(tr.pc), sh->trap_addr,
++			   le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
++			   le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
++			   le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
++			   le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
++	else
++		pr_debug("dongle trap info: type 0x%x @ epc 0x%08x\n"
++			 "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
++			 "  lr   0x%08x pc   0x%08x offset 0x%x\n"
++			 "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
++			 "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
++			 le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
++			 le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
++			 le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
++			 le32_to_cpu(tr.pc), sh->trap_addr,
++			 le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
++			 le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
++			 le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
++			 le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
+ 	return 0;
+ }
+ 
+@@ -3067,8 +3081,10 @@ static int brcmf_sdio_checkdied(struct b
+ 	else if (sh.flags & SDPCM_SHARED_ASSERT)
+ 		brcmf_err("assertion in dongle\n");
+ 
+-	if (sh.flags & SDPCM_SHARED_TRAP)
++	if (sh.flags & SDPCM_SHARED_TRAP) {
+ 		brcmf_err("firmware trap in dongle\n");
++		brcmf_sdio_trap_info(NULL, bus, &sh);
++	}
+ 
+ 	return 0;
+ }
+@@ -4199,7 +4215,7 @@ static void brcmf_sdio_firmware_callback
+ 	} else {
+ 		/* Disable F2 again */
+ 		sdio_disable_func(sdiod->func2);
+-		goto release;
++		goto checkdied;
+ 	}
+ 
+ 	if (brcmf_chip_sr_capable(bus->ci)) {
+@@ -4220,8 +4236,10 @@ static void brcmf_sdio_firmware_callback
+ 	}
+ 
+ 	/* If we didn't come up, turn off backplane clock */
+-	if (err != 0)
++	if (err != 0) {
+ 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
++		goto checkdied;
++	}
+ 
+ 	sdio_release_host(sdiod->func1);
+ 
+@@ -4235,12 +4253,15 @@ static void brcmf_sdio_firmware_callback
+ 	err = brcmf_attach(sdiod->dev, sdiod->settings);
+ 	if (err != 0) {
+ 		brcmf_err("brcmf_attach failed\n");
+-		goto fail;
++		sdio_claim_host(sdiod->func1);
++		goto checkdied;
+ 	}
+ 
+ 	/* ready */
+ 	return;
+ 
++checkdied:
++	brcmf_sdio_checkdied(bus);
+ release:
+ 	sdio_release_host(sdiod->func1);
+ fail:
diff --git a/package/kernel/mac80211/patches/brcm/349-v5.1-0006-brcmfmac-use-chipname-in-brcmf_fw_alloc_request-for-.patch b/package/kernel/mac80211/patches/brcm/349-v5.1-0006-brcmfmac-use-chipname-in-brcmf_fw_alloc_request-for-.patch
new file mode 100644
index 0000000000..23180c7236
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/349-v5.1-0006-brcmfmac-use-chipname-in-brcmf_fw_alloc_request-for-.patch
@@ -0,0 +1,42 @@
+From a250c91c1762e85c736e67cb4a9a95ebae72e62d Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 14 Feb 2019 13:43:52 +0100
+Subject: [PATCH] brcmfmac: use chipname in brcmf_fw_alloc_request() for error
+ path as well
+
+The local variable chipname is string representation of chip id and revision
+which is printed in the good flow of brcmf_fw_alloc_request(). Also use it
+for the error path, ie. for unknown/unsupported devices.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -719,8 +719,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 			break;
+ 	}
+ 
++	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
++
+ 	if (i == table_size) {
+-		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
++		brcmf_err("Unknown chip %s\n", chipname);
+ 		return NULL;
+ 	}
+ 
+@@ -729,8 +731,6 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 	if (!fwreq)
+ 		return NULL;
+ 
+-	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
+-
+ 	brcmf_info("using %s for chip %s\n",
+ 		   mapping_table[i].fw_base, chipname);
+ 
diff --git a/package/kernel/mac80211/patches/381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch b/package/kernel/mac80211/patches/brcm/350-v5.1-brcmfmac-print-firmware-reported-ring-status-errors.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch
rename to package/kernel/mac80211/patches/brcm/350-v5.1-brcmfmac-print-firmware-reported-ring-status-errors.patch
diff --git a/package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch b/package/kernel/mac80211/patches/brcm/351-v5.1-0001-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
similarity index 95%
rename from package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
rename to package/kernel/mac80211/patches/brcm/351-v5.1-0001-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
index dd4fa742be..4e49246554 100644
--- a/package/kernel/mac80211/patches/381-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
+++ b/package/kernel/mac80211/patches/brcm/351-v5.1-0001-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch
@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6036,11 +6036,18 @@ static int brcmf_construct_chaninfo(stru
+@@ -6043,11 +6043,18 @@ static int brcmf_construct_chaninfo(stru
  		/* assuming the chanspecs order is HT20,
  		 * HT40 upper, HT40 lower, and VHT80.
  		 */
diff --git a/package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch b/package/kernel/mac80211/patches/brcm/351-v5.1-0002-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
similarity index 94%
rename from package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
rename to package/kernel/mac80211/patches/brcm/351-v5.1-0002-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
index 92a7567b16..a809378d13 100644
--- a/package/kernel/mac80211/patches/381-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
+++ b/package/kernel/mac80211/patches/brcm/351-v5.1-0002-brcmfmac-support-firmware-reporting-160-MHz-channels.patch
@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6037,6 +6037,9 @@ static int brcmf_construct_chaninfo(stru
+@@ -6044,6 +6044,9 @@ static int brcmf_construct_chaninfo(stru
  		 * HT40 upper, HT40 lower, and VHT80.
  		 */
  		switch (ch.bw) {
diff --git a/package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch b/package/kernel/mac80211/patches/brcm/352-v5.1-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
similarity index 91%
rename from package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
rename to package/kernel/mac80211/patches/brcm/352-v5.1-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
index 9e5cb07e6b..27931db840 100644
--- a/package/kernel/mac80211/patches/381-v5.1-0008-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
+++ b/package/kernel/mac80211/patches/brcm/352-v5.1-brcmfmac-rework-bphy_err-to-take-struct-brcmf_pub-ar.patch
@@ -899,7 +899,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(drvr, "Failed to get bss info (%d)\n", err);
  		goto out_kfree;
  	}
- 	si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
+ 	si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
 @@ -2514,7 +2532,7 @@ static s32
  brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
  				struct station_info *sinfo)
@@ -917,7 +917,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
  		return err;
  	}
- 	sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
 @@ -2534,7 +2552,7 @@ brcmf_cfg80211_get_station_ibss(struct b
  	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
  				     sizeof(scbval));
@@ -935,7 +935,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
  		return err;
  	}
- 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
 @@ -2563,7 +2581,9 @@ static s32
  brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
  			   const u8 *mac, struct station_info *sinfo)
@@ -1080,10 +1080,10 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto update_bss_info_out;
  		}
  		dtim_period = (u8)var;
-@@ -3014,10 +3038,10 @@ static void brcmf_escan_timeout(unsigned
+@@ -3014,10 +3038,10 @@ static void brcmf_escan_timeout(struct t
  {
  	struct brcmf_cfg80211_info *cfg =
- 			(struct brcmf_cfg80211_info *)data;
+ 			from_timer(cfg, t, escan_timeout);
 -	struct wiphy *wiphy = cfg_to_wiphy(cfg);
 +	struct brcmf_pub *drvr = cfg->pub;
  
@@ -1169,7 +1169,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  
-@@ -3301,7 +3325,8 @@ static s32
+@@ -3300,7 +3324,8 @@ static s32
  brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
  				const struct brcmf_event_msg *e, void *data)
  {
@@ -1179,7 +1179,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
  	struct cfg80211_scan_request *request = NULL;
  	struct wiphy *wiphy = cfg_to_wiphy(cfg);
-@@ -3334,14 +3359,14 @@ brcmf_notify_sched_scan_results(struct b
+@@ -3333,14 +3358,14 @@ brcmf_notify_sched_scan_results(struct b
  	WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
  	brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
  	if (!result_count) {
@@ -1196,7 +1196,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto out_err;
  	}
  
-@@ -3388,14 +3413,15 @@ brcmf_cfg80211_sched_scan_start(struct w
+@@ -3387,14 +3412,15 @@ brcmf_cfg80211_sched_scan_start(struct w
  				struct net_device *ndev,
  				struct cfg80211_sched_scan_request *req)
  {
@@ -1214,7 +1214,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			 cfg->scan_status);
  		return -EAGAIN;
  	}
-@@ -3474,8 +3500,8 @@ static s32
+@@ -3473,8 +3499,8 @@ static s32
  brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
  		      void *data)
  {
@@ -1225,7 +1225,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_pno_scanresults_le *pfn_result;
  	struct brcmf_pno_net_info_le *netinfo;
  
-@@ -3494,7 +3520,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+@@ -3493,7 +3519,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
  	}
  
  	if (le32_to_cpu(pfn_result->count) < 1) {
@@ -1234,7 +1234,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			 le32_to_cpu(pfn_result->count));
  		return -EINVAL;
  	}
-@@ -3522,6 +3548,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+@@ -3523,6 +3549,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
  static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -1242,7 +1242,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_wowl_wakeind_le wake_ind_le;
  	struct cfg80211_wowlan_wakeup wakeup_data;
  	struct cfg80211_wowlan_wakeup *wakeup;
-@@ -3532,7 +3559,7 @@ static void brcmf_report_wowl_wakeind(st
+@@ -3533,7 +3560,7 @@ static void brcmf_report_wowl_wakeind(st
  	err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
  				       sizeof(wake_ind_le));
  	if (err) {
@@ -1251,7 +1251,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  
-@@ -3573,7 +3600,7 @@ static void brcmf_report_wowl_wakeind(st
+@@ -3574,7 +3601,7 @@ static void brcmf_report_wowl_wakeind(st
  				cfg->wowl.nd_data_completed,
  				BRCMF_ND_INFO_TIMEOUT);
  			if (!timeout)
@@ -1260,7 +1260,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			else
  				wakeup_data.net_detect = cfg->wowl.nd_info;
  		}
-@@ -3762,6 +3789,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
+@@ -3763,6 +3790,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_if *ifp = netdev_priv(ndev);
  	struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
@@ -1268,7 +1268,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	s32 err;
  	u32 npmk, i;
  
-@@ -3781,7 +3809,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
+@@ -3782,7 +3810,7 @@ brcmf_cfg80211_set_pmksa(struct wiphy *w
  			cfg->pmk_list.npmk = cpu_to_le32(npmk);
  		}
  	} else {
@@ -1277,7 +1277,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EINVAL;
  	}
  
-@@ -3804,6 +3832,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
+@@ -3805,6 +3833,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_if *ifp = netdev_priv(ndev);
  	struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
@@ -1285,7 +1285,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	s32 err;
  	u32 npmk, i;
  
-@@ -3827,7 +3856,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
+@@ -3828,7 +3857,7 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
  		memset(&pmk[i], 0, sizeof(*pmk));
  		cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
  	} else {
@@ -1294,7 +1294,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EINVAL;
  	}
  
-@@ -3859,20 +3888,20 @@ brcmf_cfg80211_flush_pmksa(struct wiphy
+@@ -3860,20 +3889,20 @@ brcmf_cfg80211_flush_pmksa(struct wiphy
  
  static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
  {
@@ -1318,7 +1318,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	/* set upper-layer auth */
-@@ -3882,7 +3911,7 @@ static s32 brcmf_configure_opensecurity(
+@@ -3883,7 +3912,7 @@ static s32 brcmf_configure_opensecurity(
  		wpa_val = WPA_AUTH_DISABLED;
  	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
  	if (err < 0) {
@@ -1327,7 +1327,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  
-@@ -3902,7 +3931,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3903,7 +3932,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  		      const struct brcmf_vs_tlv *wpa_ie,
  		      bool is_rsn_ie)
  {
@@ -1336,7 +1336,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 auth = 0; /* d11 open authentication */
  	u16 count;
  	s32 err = 0;
-@@ -3933,13 +3962,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3934,13 +3963,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* check for multicast cipher suite */
  	if (offset + WPA_IE_MIN_OUI_LEN > len) {
  		err = -EINVAL;
@@ -1352,7 +1352,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  	offset += TLV_OUI_LEN;
-@@ -3961,7 +3990,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3962,7 +3991,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  		break;
  	default:
  		err = -EINVAL;
@@ -1361,7 +1361,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  
-@@ -3972,13 +4001,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3973,13 +4002,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* Check for unicast suite(s) */
  	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
  		err = -EINVAL;
@@ -1377,7 +1377,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		offset += TLV_OUI_LEN;
-@@ -3996,7 +4025,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -3997,7 +4026,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  			pval |= AES_ENABLED;
  			break;
  		default:
@@ -1386,7 +1386,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		}
  		offset++;
  	}
-@@ -4006,13 +4035,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4007,13 +4036,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* Check for auth key management suite(s) */
  	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
  		err = -EINVAL;
@@ -1402,7 +1402,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		offset += TLV_OUI_LEN;
-@@ -4040,7 +4069,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4041,7 +4070,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  			wpa_auth |= WPA2_AUTH_1X_SHA256;
  			break;
  		default:
@@ -1411,7 +1411,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		}
  		offset++;
  	}
-@@ -4082,7 +4111,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4083,7 +4112,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  		err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
  					       wme_bss_disable);
  		if (err < 0) {
@@ -1420,7 +1420,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  
-@@ -4096,7 +4125,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4097,7 +4126,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
  							&data[offset],
  							WPA_IE_MIN_OUI_LEN);
  			if (err < 0) {
@@ -1429,7 +1429,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4107,13 +4136,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4108,13 +4137,13 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	/* set auth */
  	err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
  	if (err < 0) {
@@ -1445,7 +1445,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  	/* Configure MFP, this needs to go after wsec otherwise the wsec command
-@@ -4122,14 +4151,14 @@ brcmf_configure_wpaie(struct brcmf_if *i
+@@ -4123,14 +4152,14 @@ brcmf_configure_wpaie(struct brcmf_if *i
  	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
  		err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
  		if (err < 0) {
@@ -1462,7 +1462,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  
-@@ -4215,8 +4244,8 @@ brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8
+@@ -4216,8 +4245,8 @@ brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8
  s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
  			  const u8 *vndr_ie_buf, u32 vndr_ie_len)
  {
@@ -1472,7 +1472,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct vif_saved_ie *saved_ie;
  	s32 err = 0;
  	u8  *iovar_ie_buf;
-@@ -4237,7 +4266,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4238,7 +4267,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  	if (!vif)
  		return -ENODEV;
  	ifp = vif->ifp;
@@ -1481,7 +1481,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	saved_ie = &vif->saved_ie;
  
  	brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
-@@ -4269,13 +4298,13 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4270,13 +4299,13 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  		break;
  	default:
  		err = -EPERM;
@@ -1497,7 +1497,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto exit;
  	}
  
-@@ -4336,7 +4365,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4337,7 +4366,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  			/* verify remained buf size before copy data */
  			if (remained_buf_len < (vndrie_info->vndrie.len +
  							VNDR_IE_VSIE_OFFSET)) {
@@ -1506,7 +1506,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  					 remained_buf_len);
  				break;
  			}
-@@ -4368,7 +4397,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
+@@ -4369,7 +4398,7 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_c
  		err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
  						 total_ie_buf_len);
  		if (err)
@@ -1515,7 +1515,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  
  exit:
-@@ -4396,14 +4425,14 @@ static s32
+@@ -4397,14 +4426,14 @@ static s32
  brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
  			struct cfg80211_beacon_data *beacon)
  {
@@ -1532,7 +1532,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
-@@ -4413,7 +4442,7 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg
+@@ -4414,7 +4443,7 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg
  				    beacon->proberesp_ies,
  				    beacon->proberesp_ies_len);
  	if (err)
@@ -1541,7 +1541,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	else
  		brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
  
-@@ -4427,6 +4456,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4428,6 +4457,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  	s32 ie_offset;
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_if *ifp = netdev_priv(ndev);
@@ -1549,7 +1549,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	const struct brcmf_tlv *ssid_ie;
  	const struct brcmf_tlv *country_ie;
  	struct brcmf_ssid_le ssid_le;
-@@ -4522,7 +4552,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4523,7 +4553,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
  						    is_11d);
  			if (err < 0) {
@@ -1558,7 +1558,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  					 err);
  				goto exit;
  			}
-@@ -4531,7 +4561,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4532,7 +4562,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
  						    settings->beacon_interval);
  			if (err < 0) {
@@ -1567,7 +1567,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  					 err);
  				goto exit;
  			}
-@@ -4540,7 +4570,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4541,7 +4571,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
  						    settings->dtim_period);
  			if (err < 0) {
@@ -1576,7 +1576,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  					 err);
  				goto exit;
  			}
-@@ -4551,7 +4581,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4552,7 +4582,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  		     !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
  			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
  			if (err < 0) {
@@ -1585,7 +1585,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  					 err);
  				goto exit;
  			}
-@@ -4560,7 +4590,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4561,7 +4591,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  
  		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
  		if (err < 0) {
@@ -1594,7 +1594,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  	} else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
-@@ -4576,7 +4606,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4577,7 +4607,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  
  		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
  		if (err < 0) {
@@ -1603,7 +1603,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				 err);
  			goto exit;
  		}
-@@ -4586,14 +4616,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4587,14 +4617,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  			 */
  			err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
  			if (err < 0) {
@@ -1620,7 +1620,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		/* On DOWN the firmware removes the WEP keys, reconfigure
-@@ -4608,14 +4638,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4609,14 +4639,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
  					     &join_params, sizeof(join_params));
  		if (err < 0) {
@@ -1637,7 +1637,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				goto exit;
  			}
  		}
-@@ -4624,14 +4654,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4625,14 +4655,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  	} else if (dev_role == NL80211_IFTYPE_P2P_GO) {
  		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
  		if (err < 0) {
@@ -1654,7 +1654,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
-@@ -4639,7 +4669,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+@@ -4640,7 +4670,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
  		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
  					       sizeof(bss_enable));
  		if (err < 0) {
@@ -1663,7 +1663,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			goto exit;
  		}
  
-@@ -4662,7 +4692,9 @@ exit:
+@@ -4663,7 +4693,9 @@ exit:
  
  static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
  {
@@ -1673,7 +1673,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	s32 err;
  	struct brcmf_fil_bss_enable_le bss_enable;
  	struct brcmf_join_params join_params;
-@@ -4687,13 +4719,13 @@ static int brcmf_cfg80211_stop_ap(struct
+@@ -4688,13 +4720,13 @@ static int brcmf_cfg80211_stop_ap(struct
  		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
  					     &join_params, sizeof(join_params));
  		if (err < 0)
@@ -1690,7 +1690,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
  			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
  		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
-@@ -4701,7 +4733,7 @@ static int brcmf_cfg80211_stop_ap(struct
+@@ -4702,7 +4734,7 @@ static int brcmf_cfg80211_stop_ap(struct
  		/* Bring device back up so it can be used again */
  		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
  		if (err < 0)
@@ -1699,7 +1699,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  		brcmf_vif_clear_mgmt_ies(ifp->vif);
  	} else {
-@@ -4710,7 +4742,7 @@ static int brcmf_cfg80211_stop_ap(struct
+@@ -4711,7 +4743,7 @@ static int brcmf_cfg80211_stop_ap(struct
  		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
  					       sizeof(bss_enable));
  		if (err < 0)
@@ -1708,7 +1708,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  	brcmf_set_mpc(ifp, 1);
  	brcmf_configure_arp_nd_offload(ifp, true);
-@@ -4739,6 +4771,7 @@ brcmf_cfg80211_del_station(struct wiphy
+@@ -4740,6 +4772,7 @@ brcmf_cfg80211_del_station(struct wiphy
  			   struct station_del_parameters *params)
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -1716,7 +1716,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_scb_val_le scbval;
  	struct brcmf_if *ifp = netdev_priv(ndev);
  	s32 err;
-@@ -4758,7 +4791,7 @@ brcmf_cfg80211_del_station(struct wiphy
+@@ -4759,7 +4792,7 @@ brcmf_cfg80211_del_station(struct wiphy
  	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
  				     &scbval, sizeof(scbval));
  	if (err)
@@ -1725,7 +1725,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			 err);
  
  	brcmf_dbg(TRACE, "Exit\n");
-@@ -4769,6 +4802,8 @@ static int
+@@ -4770,6 +4803,8 @@ static int
  brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
  			      const u8 *mac, struct station_parameters *params)
  {
@@ -1734,7 +1734,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_if *ifp = netdev_priv(ndev);
  	s32 err;
  
-@@ -4789,7 +4824,7 @@ brcmf_cfg80211_change_station(struct wip
+@@ -4790,7 +4825,7 @@ brcmf_cfg80211_change_station(struct wip
  		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
  					     (void *)mac, ETH_ALEN);
  	if (err < 0)
@@ -1743,7 +1743,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return err;
  }
-@@ -4819,6 +4854,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+@@ -4820,6 +4855,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct ieee80211_channel *chan = params->chan;
@@ -1751,7 +1751,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	const u8 *buf = params->buf;
  	size_t len = params->len;
  	const struct ieee80211_mgmt *mgmt;
-@@ -4839,7 +4875,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+@@ -4840,7 +4876,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
  	mgmt = (const struct ieee80211_mgmt *)buf;
  
  	if (!ieee80211_is_mgmt(mgmt->frame_control)) {
@@ -1760,7 +1760,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EPERM;
  	}
  
-@@ -4870,13 +4906,13 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
+@@ -4871,13 +4907,13 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
  					GFP_KERNEL);
  	} else if (ieee80211_is_action(mgmt->frame_control)) {
  		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
@@ -1776,7 +1776,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			err = -ENOMEM;
  			goto exit;
  		}
-@@ -4927,6 +4963,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
+@@ -4928,6 +4964,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
  					u64 cookie)
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -1784,7 +1784,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_cfg80211_vif *vif;
  	int err = 0;
  
-@@ -4934,7 +4971,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
+@@ -4935,7 +4972,7 @@ brcmf_cfg80211_cancel_remain_on_channel(
  
  	vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
  	if (vif == NULL) {
@@ -1793,7 +1793,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		err = -ENODEV;
  		goto exit;
  	}
-@@ -4949,6 +4986,7 @@ static int brcmf_cfg80211_get_channel(st
+@@ -4950,6 +4987,7 @@ static int brcmf_cfg80211_get_channel(st
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct net_device *ndev = wdev->netdev;
@@ -1801,7 +1801,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_if *ifp;
  	struct brcmu_chan ch;
  	enum nl80211_band band = 0;
-@@ -4962,7 +5000,7 @@ static int brcmf_cfg80211_get_channel(st
+@@ -4963,7 +5001,7 @@ static int brcmf_cfg80211_get_channel(st
  
  	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
  	if (err) {
@@ -1810,7 +1810,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  
-@@ -5084,6 +5122,8 @@ static int brcmf_cfg80211_tdls_oper(stru
+@@ -5085,6 +5123,8 @@ static int brcmf_cfg80211_tdls_oper(stru
  				    struct net_device *ndev, const u8 *peer,
  				    enum nl80211_tdls_operation oper)
  {
@@ -1819,7 +1819,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_if *ifp;
  	struct brcmf_tdls_iovar_le info;
  	int ret = 0;
-@@ -5101,7 +5141,7 @@ static int brcmf_cfg80211_tdls_oper(stru
+@@ -5102,7 +5142,7 @@ static int brcmf_cfg80211_tdls_oper(stru
  	ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
  				       &info, sizeof(info));
  	if (ret < 0)
@@ -1828,7 +1828,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return ret;
  }
-@@ -5112,6 +5152,8 @@ brcmf_cfg80211_update_conn_params(struct
+@@ -5113,6 +5153,8 @@ brcmf_cfg80211_update_conn_params(struct
  				  struct cfg80211_connect_params *sme,
  				  u32 changed)
  {
@@ -1837,7 +1837,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_if *ifp;
  	int err;
  
-@@ -5122,7 +5164,7 @@ brcmf_cfg80211_update_conn_params(struct
+@@ -5123,7 +5165,7 @@ brcmf_cfg80211_update_conn_params(struct
  	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
  				    sme->ie, sme->ie_len);
  	if (err)
@@ -1846,7 +1846,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	else
  		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
  
-@@ -5134,6 +5176,8 @@ static int
+@@ -5135,6 +5177,8 @@ static int
  brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
  			      struct cfg80211_gtk_rekey_data *gtk)
  {
@@ -1855,7 +1855,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_if *ifp = netdev_priv(ndev);
  	struct brcmf_gtk_keyinfo_le gtk_le;
  	int ret;
-@@ -5148,7 +5192,7 @@ brcmf_cfg80211_set_rekey_data(struct wip
+@@ -5149,7 +5193,7 @@ brcmf_cfg80211_set_rekey_data(struct wip
  	ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
  				       sizeof(gtk_le));
  	if (ret < 0)
@@ -1864,7 +1864,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return ret;
  }
-@@ -5380,7 +5424,7 @@ static void brcmf_clear_assoc_ies(struct
+@@ -5381,7 +5425,7 @@ static void brcmf_clear_assoc_ies(struct
  static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
  			       struct brcmf_if *ifp)
  {
@@ -1873,7 +1873,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
  	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
  	u32 req_len;
-@@ -5392,7 +5436,7 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5393,7 +5437,7 @@ static s32 brcmf_get_assoc_ies(struct br
  	err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
  				       cfg->extra_buf, WL_ASSOC_INFO_MAX);
  	if (err) {
@@ -1882,7 +1882,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	assoc_info =
-@@ -5404,7 +5448,7 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5405,7 +5449,7 @@ static s32 brcmf_get_assoc_ies(struct br
  					       cfg->extra_buf,
  					       WL_ASSOC_INFO_MAX);
  		if (err) {
@@ -1891,7 +1891,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			return err;
  		}
  		conn_info->req_ie_len = req_len;
-@@ -5420,7 +5464,7 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5421,7 +5465,7 @@ static s32 brcmf_get_assoc_ies(struct br
  					       cfg->extra_buf,
  					       WL_ASSOC_INFO_MAX);
  		if (err) {
@@ -1900,7 +1900,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			return err;
  		}
  		conn_info->resp_ie_len = resp_len;
-@@ -5547,7 +5591,7 @@ brcmf_notify_connect_status_ap(struct br
+@@ -5548,7 +5592,7 @@ brcmf_notify_connect_status_ap(struct br
  			       struct net_device *ndev,
  			       const struct brcmf_event_msg *e, void *data)
  {
@@ -1910,15 +1910,15 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 event = e->event_code;
  	u32 reason = e->reason;
 @@ -5566,7 +5610,7 @@ brcmf_notify_connect_status_ap(struct br
+ 	if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
  	    (reason == BRCMF_E_STATUS_SUCCESS)) {
- 		memset(&sinfo, 0, sizeof(sinfo));
  		if (!data) {
 -			bphy_err(wiphy, "No IEs present in ASSOC/REASSOC_IND\n");
 +			bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
  			return -EINVAL;
  		}
- 		sinfo.assoc_req_ies = data;
-@@ -5851,7 +5895,7 @@ static void init_vif_event(struct brcmf_
+ 
+@@ -5858,7 +5902,7 @@ static void init_vif_event(struct brcmf_
  
  static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
  {
@@ -1927,7 +1927,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	s32 err;
  	u32 bcn_timeout;
  	__le32 roamtrigger[2];
-@@ -5864,7 +5908,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5871,7 +5915,7 @@ static s32 brcmf_dongle_roam(struct brcm
  		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
  	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
  	if (err) {
@@ -1936,7 +1936,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5876,7 +5920,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5883,7 +5927,7 @@ static s32 brcmf_dongle_roam(struct brcm
  	err = brcmf_fil_iovar_int_set(ifp, "roam_off",
  				      ifp->drvr->settings->roamoff);
  	if (err) {
@@ -1945,7 +1945,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5885,7 +5929,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5892,7 +5936,7 @@ static s32 brcmf_dongle_roam(struct brcm
  	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
  				     (void *)roamtrigger, sizeof(roamtrigger));
  	if (err) {
@@ -1954,7 +1954,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5894,7 +5938,7 @@ static s32 brcmf_dongle_roam(struct brcm
+@@ -5901,7 +5945,7 @@ static s32 brcmf_dongle_roam(struct brcm
  	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
  				     (void *)roam_delta, sizeof(roam_delta));
  	if (err) {
@@ -1963,7 +1963,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto roam_setup_done;
  	}
  
-@@ -5905,26 +5949,26 @@ roam_setup_done:
+@@ -5912,26 +5956,26 @@ roam_setup_done:
  static s32
  brcmf_dongle_scantime(struct brcmf_if *ifp)
  {
@@ -1994,7 +1994,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto dongle_scantime_out;
  	}
  
-@@ -5957,7 +6001,8 @@ static int brcmf_construct_chaninfo(stru
+@@ -5964,7 +6008,8 @@ static int brcmf_construct_chaninfo(stru
  				    u32 bw_cap[])
  {
  	struct wiphy *wiphy = cfg_to_wiphy(cfg);
@@ -2004,7 +2004,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct ieee80211_supported_band *band;
  	struct ieee80211_channel *channel;
  	struct brcmf_chanspec_list *list;
-@@ -5978,7 +6023,7 @@ static int brcmf_construct_chaninfo(stru
+@@ -5985,7 +6030,7 @@ static int brcmf_construct_chaninfo(stru
  	err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
  				       BRCMF_DCMD_MEDLEN);
  	if (err) {
@@ -2013,7 +2013,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto fail_pbuf;
  	}
  
-@@ -6001,7 +6046,7 @@ static int brcmf_construct_chaninfo(stru
+@@ -6008,7 +6053,7 @@ static int brcmf_construct_chaninfo(stru
  		} else if (ch.band == BRCMU_CHAN_BAND_5G) {
  			band = wiphy->bands[NL80211_BAND_5GHZ];
  		} else {
@@ -2022,7 +2022,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				 ch.chspec);
  			continue;
  		}
-@@ -6025,7 +6070,7 @@ static int brcmf_construct_chaninfo(stru
+@@ -6032,7 +6077,7 @@ static int brcmf_construct_chaninfo(stru
  			/* It seems firmware supports some channel we never
  			 * considered. Something new in IEEE standard?
  			 */
@@ -2031,7 +2031,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				 ch.control_ch_num);
  			continue;
  		}
-@@ -6082,8 +6127,8 @@ fail_pbuf:
+@@ -6089,8 +6134,8 @@ fail_pbuf:
  
  static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
  {
@@ -2042,7 +2042,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct ieee80211_supported_band *band;
  	struct brcmf_fil_bwcap_le band_bwcap;
  	struct brcmf_chanspec_list *list;
-@@ -6129,7 +6174,7 @@ static int brcmf_enable_bw40_2g(struct b
+@@ -6136,7 +6181,7 @@ static int brcmf_enable_bw40_2g(struct b
  		err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
  					       BRCMF_DCMD_MEDLEN);
  		if (err) {
@@ -2051,7 +2051,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			kfree(pbuf);
  			return err;
  		}
-@@ -6160,7 +6205,7 @@ static int brcmf_enable_bw40_2g(struct b
+@@ -6167,7 +6212,7 @@ static int brcmf_enable_bw40_2g(struct b
  
  static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
  {
@@ -2060,7 +2060,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 band, mimo_bwcap;
  	int err;
  
-@@ -6196,7 +6241,7 @@ static void brcmf_get_bwcap(struct brcmf
+@@ -6203,7 +6248,7 @@ static void brcmf_get_bwcap(struct brcmf
  		bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
  		break;
  	default:
@@ -2069,7 +2069,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  }
  
-@@ -6271,7 +6316,8 @@ static void brcmf_update_vht_cap(struct
+@@ -6278,7 +6323,8 @@ static void brcmf_update_vht_cap(struct
  
  static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
  {
@@ -2079,7 +2079,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct wiphy *wiphy = cfg_to_wiphy(cfg);
  	u32 nmode = 0;
  	u32 vhtmode = 0;
-@@ -6288,7 +6334,7 @@ static int brcmf_setup_wiphybands(struct
+@@ -6295,7 +6341,7 @@ static int brcmf_setup_wiphybands(struct
  	(void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
  	err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
  	if (err) {
@@ -2088,7 +2088,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	} else {
  		brcmf_get_bwcap(ifp, bw_cap);
  	}
-@@ -6298,7 +6344,7 @@ static int brcmf_setup_wiphybands(struct
+@@ -6305,7 +6351,7 @@ static int brcmf_setup_wiphybands(struct
  
  	err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
  	if (err) {
@@ -2097,7 +2097,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		nchain = 1;
  	} else {
  		for (nchain = 0; rxchain; nchain++)
-@@ -6308,7 +6354,7 @@ static int brcmf_setup_wiphybands(struct
+@@ -6315,7 +6361,7 @@ static int brcmf_setup_wiphybands(struct
  
  	err = brcmf_construct_chaninfo(cfg, bw_cap);
  	if (err) {
@@ -2106,7 +2106,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  
-@@ -6515,12 +6561,13 @@ static void brcmf_wiphy_wowl_params(stru
+@@ -6522,12 +6568,13 @@ static void brcmf_wiphy_wowl_params(stru
  {
  #ifdef CONFIG_PM
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -2121,7 +2121,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		wiphy->wowlan = &brcmf_wowlan_support;
  		return;
  	}
-@@ -6617,7 +6664,7 @@ static int brcmf_setup_wiphy(struct wiph
+@@ -6624,7 +6671,7 @@ static int brcmf_setup_wiphy(struct wiph
  	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
  				     sizeof(bandlist));
  	if (err) {
@@ -2130,7 +2130,25 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return err;
  	}
  	/* first entry in bandlist is number of bands */
-@@ -6878,6 +6925,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6673,7 +6720,7 @@ static int brcmf_setup_wiphy(struct wiph
+ 
+ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct wiphy *wiphy = cfg_to_wiphy(cfg);
++	struct brcmf_pub *drvr = cfg->pub;
+ 	struct net_device *ndev;
+ 	struct wireless_dev *wdev;
+ 	struct brcmf_if *ifp;
+@@ -6711,7 +6758,7 @@ static s32 brcmf_config_dongle(struct br
+ 
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
+ 	if (err) {
+-		bphy_err(wiphy, "failed to set frameburst mode\n");
++		bphy_err(drvr, "failed to set frameburst mode\n");
+ 		goto default_conf_out;
+ 	}
+ 
+@@ -6892,6 +6939,7 @@ static void brcmf_cfg80211_reg_notifier(
  {
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
@@ -2138,7 +2156,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_fil_country_le ccreq;
  	s32 err;
  	int i;
-@@ -6889,7 +6937,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6903,7 +6951,7 @@ static void brcmf_cfg80211_reg_notifier(
  	/* ignore non-ISO3166 country codes */
  	for (i = 0; i < 2; i++)
  		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
@@ -2147,7 +2165,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				 req->alpha2[0], req->alpha2[1]);
  			return;
  		}
-@@ -6899,7 +6947,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6913,7 +6961,7 @@ static void brcmf_cfg80211_reg_notifier(
  
  	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
  	if (err) {
@@ -2156,7 +2174,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  
-@@ -6909,7 +6957,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6923,7 +6971,7 @@ static void brcmf_cfg80211_reg_notifier(
  
  	err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
  	if (err) {
@@ -2165,7 +2183,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  	brcmf_setup_wiphybands(cfg);
-@@ -6955,13 +7003,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6969,13 +7017,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	u16 *cap = NULL;
  
  	if (!ndev) {
@@ -2181,7 +2199,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return NULL;
  	}
  
-@@ -6982,7 +7030,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6996,7 +7044,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  
  	err = wl_init_priv(cfg);
  	if (err) {
@@ -2190,7 +2208,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_free_vif(vif);
  		goto wiphy_out;
  	}
-@@ -6991,7 +7039,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -7005,7 +7053,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	/* determine d11 io type before wiphy setup */
  	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
  	if (err) {
@@ -2199,7 +2217,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto priv_out;
  	}
  	cfg->d11inf.io_type = (u8)io_type;
-@@ -7025,13 +7073,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -7039,13 +7087,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  #endif
  	err = wiphy_register(wiphy);
  	if (err < 0) {
@@ -2215,7 +2233,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto wiphy_unreg_out;
  	}
  
-@@ -7049,24 +7097,24 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -7063,24 +7111,24 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  
  	err = brcmf_fweh_activate_events(ifp);
  	if (err) {
@@ -2244,7 +2262,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_btcoex_detach(cfg);
  		brcmf_p2p_detach(&cfg->p2p);
  		goto wiphy_unreg_out;
-@@ -7086,7 +7134,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -7100,7 +7148,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	/* (re-) activate FWEH event handling */
  	err = brcmf_fweh_activate_events(ifp);
  	if (err) {
diff --git a/package/kernel/mac80211/patches/brcm/353-v5.1-brcmfmac-remove-set-but-not-used-variable-old_state.patch b/package/kernel/mac80211/patches/brcm/353-v5.1-brcmfmac-remove-set-but-not-used-variable-old_state.patch
new file mode 100644
index 0000000000..2a46378e73
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/353-v5.1-brcmfmac-remove-set-but-not-used-variable-old_state.patch
@@ -0,0 +1,38 @@
+From e4d1b2716b8859199c28f2ac5f984bd05a146a6b Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Mon, 18 Feb 2019 08:08:46 +0000
+Subject: [PATCH] brcmfmac: remove set but not used variable 'old_state'
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c: In function 'brcmf_usb_state_change':
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c:578:6: warning:
+ variable 'old_state' set but not used [-Wunused-but-set-variable]
+
+It's never used and can be removed.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -575,7 +575,6 @@ static void
+ brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
+ {
+ 	struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
+-	int old_state;
+ 
+ 	brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
+ 		  devinfo->bus_pub.state, state);
+@@ -583,7 +582,6 @@ brcmf_usb_state_change(struct brcmf_usbd
+ 	if (devinfo->bus_pub.state == state)
+ 		return;
+ 
+-	old_state = devinfo->bus_pub.state;
+ 	devinfo->bus_pub.state = state;
+ 
+ 	/* update state of upper layer */
diff --git a/package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch b/package/kernel/mac80211/patches/brcm/354-v5.1-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
similarity index 95%
rename from package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
rename to package/kernel/mac80211/patches/brcm/354-v5.1-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
index 2841b2cffb..5836f6ab87 100644
--- a/package/kernel/mac80211/patches/381-v5.1-0009-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
+++ b/package/kernel/mac80211/patches/brcm/354-v5.1-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch
@@ -352,7 +352,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
  			goto done;
  		}
-@@ -606,7 +607,7 @@ static int brcmf_netdev_open(struct net_
+@@ -607,7 +608,7 @@ static int brcmf_netdev_open(struct net_
  
  	/* If bus is not ready, can't continue */
  	if (bus_if->state != BRCMF_BUS_UP) {
@@ -361,7 +361,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EAGAIN;
  	}
  
-@@ -620,7 +621,7 @@ static int brcmf_netdev_open(struct net_
+@@ -621,7 +622,7 @@ static int brcmf_netdev_open(struct net_
  		ndev->features &= ~NETIF_F_IP_CSUM;
  
  	if (brcmf_cfg80211_up(ndev)) {
@@ -370,7 +370,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -EIO;
  	}
  
-@@ -682,7 +683,7 @@ int brcmf_net_attach(struct brcmf_if *if
+@@ -683,7 +684,7 @@ int brcmf_net_attach(struct brcmf_if *if
  	else
  		err = register_netdev(ndev);
  	if (err != 0) {
@@ -379,7 +379,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto fail;
  	}
  
-@@ -759,6 +760,7 @@ static const struct net_device_ops brcmf
+@@ -760,6 +761,7 @@ static const struct net_device_ops brcmf
  
  static int brcmf_net_p2p_attach(struct brcmf_if *ifp)
  {
@@ -387,7 +387,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct net_device *ndev;
  
  	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
-@@ -771,7 +773,7 @@ static int brcmf_net_p2p_attach(struct b
+@@ -772,7 +774,7 @@ static int brcmf_net_p2p_attach(struct b
  	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
  
  	if (register_netdev(ndev) != 0) {
@@ -396,7 +396,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto fail;
  	}
  
-@@ -800,8 +802,8 @@ struct brcmf_if *brcmf_add_if(struct brc
+@@ -801,8 +803,8 @@ struct brcmf_if *brcmf_add_if(struct brc
  	 */
  	if (ifp) {
  		if (ifidx) {
@@ -407,7 +407,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			netif_stop_queue(ifp->ndev);
  			brcmf_net_detach(ifp->ndev, false);
  			drvr->iflist[bsscfgidx] = NULL;
-@@ -863,7 +865,7 @@ static void brcmf_del_if(struct brcmf_pu
+@@ -864,7 +866,7 @@ static void brcmf_del_if(struct brcmf_pu
  	ifp = drvr->iflist[bsscfgidx];
  	drvr->iflist[bsscfgidx] = NULL;
  	if (!ifp) {
@@ -416,7 +416,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return;
  	}
  	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
-@@ -913,16 +915,17 @@ static int brcmf_psm_watchdog_notify(str
+@@ -914,16 +916,17 @@ static int brcmf_psm_watchdog_notify(str
  				     const struct brcmf_event_msg *evtmsg,
  				     void *data)
  {
@@ -436,7 +436,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return err;
  }
-@@ -966,7 +969,7 @@ static int brcmf_inetaddr_changed(struct
+@@ -967,7 +970,7 @@ static int brcmf_inetaddr_changed(struct
  	ret = brcmf_fil_iovar_data_get(ifp, "arp_hostip", addr_table,
  				       sizeof(addr_table));
  	if (ret) {
@@ -445,7 +445,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return NOTIFY_OK;
  	}
  
-@@ -983,7 +986,7 @@ static int brcmf_inetaddr_changed(struct
+@@ -984,7 +987,7 @@ static int brcmf_inetaddr_changed(struct
  			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
  				&ifa->ifa_address, sizeof(ifa->ifa_address));
  			if (ret)
@@ -454,7 +454,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		}
  		break;
  	case NETDEV_DOWN:
-@@ -995,8 +998,8 @@ static int brcmf_inetaddr_changed(struct
+@@ -996,8 +999,8 @@ static int brcmf_inetaddr_changed(struct
  			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear",
  						       NULL, 0);
  			if (ret) {
@@ -465,7 +465,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  				return NOTIFY_OK;
  			}
  			for (i = 0; i < ARPOL_MAX_ENTRIES; i++) {
-@@ -1006,8 +1009,8 @@ static int brcmf_inetaddr_changed(struct
+@@ -1007,8 +1010,8 @@ static int brcmf_inetaddr_changed(struct
  							       &addr_table[i],
  							       sizeof(addr_table[i]));
  				if (ret)
@@ -476,7 +476,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			}
  		}
  		break;
-@@ -1180,7 +1183,7 @@ static int brcmf_bus_started(struct brcm
+@@ -1182,7 +1185,7 @@ static int brcmf_bus_started(struct brcm
  	return 0;
  
  fail:
@@ -485,7 +485,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	if (drvr->config) {
  		brcmf_cfg80211_detach(drvr->config);
  		drvr->config = NULL;
-@@ -1232,7 +1235,7 @@ int brcmf_attach(struct device *dev, str
+@@ -1234,7 +1237,7 @@ int brcmf_attach(struct device *dev, str
  	/* Attach and link in the protocol */
  	ret = brcmf_proto_attach(drvr);
  	if (ret != 0) {
@@ -494,7 +494,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto fail;
  	}
  
-@@ -1245,7 +1248,7 @@ int brcmf_attach(struct device *dev, str
+@@ -1247,7 +1250,7 @@ int brcmf_attach(struct device *dev, str
  
  	ret = brcmf_bus_started(drvr, ops);
  	if (ret != 0) {
@@ -503,7 +503,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto fail;
  	}
  
-@@ -1345,6 +1348,7 @@ static int brcmf_get_pend_8021x_cnt(stru
+@@ -1347,6 +1350,7 @@ static int brcmf_get_pend_8021x_cnt(stru
  
  int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
  {
@@ -511,7 +511,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	int err;
  
  	err = wait_event_timeout(ifp->pend_8021x_wait,
-@@ -1352,7 +1356,7 @@ int brcmf_netdev_wait_pend8021x(struct b
+@@ -1354,7 +1358,7 @@ int brcmf_netdev_wait_pend8021x(struct b
  				 MAX_WAIT_FOR_8021X_TX);
  
  	if (!err)
@@ -690,7 +690,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		  ifp->bsscfgidx, name, len);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -1251,6 +1251,7 @@ static int brcmf_fws_enq(struct brcmf_fw
+@@ -1255,6 +1255,7 @@ static int brcmf_fws_enq(struct brcmf_fw
  			 enum brcmf_fws_skb_state state, int fifo,
  			 struct sk_buff *p)
  {
@@ -698,7 +698,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	int prec = 2 * fifo;
  	u32 *qfull_stat = &fws->stats.delayq_full_error;
  	struct brcmf_fws_mac_descriptor *entry;
-@@ -1263,7 +1264,7 @@ static int brcmf_fws_enq(struct brcmf_fw
+@@ -1267,7 +1268,7 @@ static int brcmf_fws_enq(struct brcmf_fw
  
  	entry = brcmf_skbcb(p)->mac;
  	if (entry == NULL) {
@@ -707,30 +707,33 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		return -ENOENT;
  	}
  
-@@ -1453,6 +1454,7 @@ static int
+@@ -1457,6 +1458,7 @@ static int
  brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
- 		      u32 genbit, u16 seq)
+ 		      u32 genbit, u16 seq, u8 compcnt)
  {
 +	struct brcmf_pub *drvr = fws->drvr;
  	u32 fifo;
+ 	u8 cnt = 0;
  	int ret;
- 	bool remove_from_hanger = true;
-@@ -1476,12 +1478,12 @@ brcmf_fws_txs_process(struct brcmf_fws_i
+@@ -1481,14 +1483,14 @@ brcmf_fws_txs_process(struct brcmf_fws_i
  	else if (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)
- 		fws->stats.txs_host_tossed++;
+ 		fws->stats.txs_host_tossed += compcnt;
  	else
 -		brcmf_err("unexpected txstatus\n");
 +		bphy_err(drvr, "unexpected txstatus\n");
  
- 	ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
- 				      remove_from_hanger);
- 	if (ret != 0) {
--		brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
-+		bphy_err(drvr, "no packet in hanger slot: hslot=%d\n", hslot);
- 		return ret;
- 	}
+ 	while (cnt < compcnt) {
+ 		ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+ 					      remove_from_hanger);
+ 		if (ret != 0) {
+-			brcmf_err("no packet in hanger slot: hslot=%d\n",
+-				  hslot);
++			bphy_err(drvr, "no packet in hanger slot: hslot=%d\n",
++				 hslot);
+ 			goto cont;
+ 		}
  
-@@ -1587,12 +1589,13 @@ static int brcmf_fws_notify_credit_map(s
+@@ -1612,12 +1614,13 @@ static int brcmf_fws_notify_credit_map(s
  				       const struct brcmf_event_msg *e,
  				       void *data)
  {
@@ -745,8 +748,8 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		bphy_err(drvr, "event payload too small (%d)\n", e->datalen);
  		return -EINVAL;
  	}
- 	if (fws->creditmap_received)
-@@ -1654,6 +1657,7 @@ static void brcmf_rxreorder_get_skb_list
+ 
+@@ -1681,6 +1684,7 @@ static void brcmf_rxreorder_get_skb_list
  
  void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *pkt)
  {
@@ -754,7 +757,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u8 *reorder_data;
  	u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
  	struct brcmf_ampdu_rx_reorder *rfi;
-@@ -1668,7 +1672,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
+@@ -1695,7 +1699,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
  
  	/* validate flags and flow id */
  	if (flags == 0xFF) {
@@ -763,7 +766,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_netif_rx(ifp, pkt);
  		return;
  	}
-@@ -1705,7 +1709,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
+@@ -1732,7 +1736,7 @@ void brcmf_fws_rxreorder(struct brcmf_if
  			  flow_id, max_idx);
  		rfi = kzalloc(buf_size, GFP_ATOMIC);
  		if (rfi == NULL) {
@@ -772,7 +775,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			brcmf_netif_rx(ifp, pkt);
  			return;
  		}
-@@ -1970,6 +1974,7 @@ static u8 brcmf_fws_precommit_skb(struct
+@@ -1996,6 +2000,7 @@ static u8 brcmf_fws_precommit_skb(struct
  static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
  				   struct sk_buff *skb, int fifo)
  {
@@ -780,7 +783,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_fws_mac_descriptor *entry;
  	struct sk_buff *pktout;
  	int qidx, hslot;
-@@ -1983,11 +1988,11 @@ static void brcmf_fws_rollback_toq(struc
+@@ -2009,11 +2014,11 @@ static void brcmf_fws_rollback_toq(struc
  
  		pktout = brcmu_pktq_penq_head(&entry->psq, qidx, skb);
  		if (pktout == NULL) {
@@ -794,7 +797,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		rc = -ENOENT;
  	}
  
-@@ -2092,7 +2097,8 @@ static int brcmf_fws_assign_htod(struct
+@@ -2118,7 +2123,8 @@ static int brcmf_fws_assign_htod(struct
  
  int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
  {
@@ -804,7 +807,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
  	struct ethhdr *eh = (struct ethhdr *)(skb->data);
  	int fifo = BRCMF_FWS_FIFO_BCMC;
-@@ -2120,7 +2126,7 @@ int brcmf_fws_process_skb(struct brcmf_i
+@@ -2146,7 +2152,7 @@ int brcmf_fws_process_skb(struct brcmf_i
  		brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb);
  		brcmf_fws_schedule_deq(fws);
  	} else {
@@ -813,7 +816,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_txfinalize(ifp, skb, false);
  		rc = -ENOMEM;
  	}
-@@ -2338,7 +2344,7 @@ struct brcmf_fws_info *brcmf_fws_attach(
+@@ -2365,7 +2371,7 @@ struct brcmf_fws_info *brcmf_fws_attach(
  
  	fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
  	if (fws->fws_wq == NULL) {
@@ -822,7 +825,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		rc = -EBADF;
  		goto fail;
  	}
-@@ -2354,13 +2360,13 @@ struct brcmf_fws_info *brcmf_fws_attach(
+@@ -2381,13 +2387,13 @@ struct brcmf_fws_info *brcmf_fws_attach(
  	rc = brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
  				 brcmf_fws_notify_credit_map);
  	if (rc < 0) {
@@ -838,7 +841,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		brcmf_fweh_unregister(drvr, BRCMF_E_FIFO_CREDIT_MAP);
  		goto fail;
  	}
-@@ -2372,7 +2378,7 @@ struct brcmf_fws_info *brcmf_fws_attach(
+@@ -2399,7 +2405,7 @@ struct brcmf_fws_info *brcmf_fws_attach(
  	fws->fw_signals = true;
  	ifp = brcmf_get_ifp(drvr, 0);
  	if (brcmf_fil_iovar_int_set(ifp, "tlv", tlv)) {
@@ -1279,7 +1282,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 channel_cnt;
  	u16 *default_chan_list;
 @@ -1061,7 +1067,7 @@ static s32 brcmf_p2p_act_frm_search(stru
- 	default_chan_list = kzalloc(channel_cnt * sizeof(*default_chan_list),
+ 	default_chan_list = kcalloc(channel_cnt, sizeof(*default_chan_list),
  				    GFP_KERNEL);
  	if (default_chan_list == NULL) {
 -		brcmf_err("channel list allocation failed\n");
diff --git a/package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch b/package/kernel/mac80211/patches/brcm/355-v5.1-brcmfmac-add-basic-validation-of-shared-RAM-address.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch
rename to package/kernel/mac80211/patches/brcm/355-v5.1-brcmfmac-add-basic-validation-of-shared-RAM-address.patch
diff --git a/package/kernel/mac80211/patches/381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch b/package/kernel/mac80211/patches/brcm/356-v5.1-0001-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch
rename to package/kernel/mac80211/patches/brcm/356-v5.1-0001-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch
diff --git a/package/kernel/mac80211/patches/381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch b/package/kernel/mac80211/patches/brcm/356-v5.1-0002-brcmfmac-print-firmware-reported-general-status-erro.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch
rename to package/kernel/mac80211/patches/brcm/356-v5.1-0002-brcmfmac-print-firmware-reported-general-status-erro.patch
diff --git a/package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch b/package/kernel/mac80211/patches/brcm/360-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
similarity index 95%
rename from package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
rename to package/kernel/mac80211/patches/brcm/360-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
index 9efe00c9b5..ef694f079f 100644
--- a/package/kernel/mac80211/patches/450-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
+++ b/package/kernel/mac80211/patches/brcm/360-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch
@@ -22,7 +22,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -668,6 +668,7 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+@@ -743,6 +743,7 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
  
  	for (j = 0; j < n_fwnames; j++) {
  		fwreq->items[j].path = fwnames[j].path;
diff --git a/package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch b/package/kernel/mac80211/patches/brcm/360-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
similarity index 93%
rename from package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
rename to package/kernel/mac80211/patches/brcm/360-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
index d29a767b5f..595b8948c7 100644
--- a/package/kernel/mac80211/patches/450-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
+++ b/package/kernel/mac80211/patches/brcm/360-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch
@@ -25,7 +25,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -252,6 +252,8 @@ void brcmf_detach(struct device *dev);
+@@ -262,6 +262,8 @@ void brcmf_detach(struct device *dev);
  void brcmf_dev_reset(struct device *dev);
  /* Request from bus module to initiate a coredump */
  void brcmf_dev_coredump(struct device *dev);
@@ -36,7 +36,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1292,6 +1292,16 @@ void brcmf_dev_coredump(struct device *d
+@@ -1294,6 +1294,16 @@ void brcmf_dev_coredump(struct device *d
  		brcmf_dbg(TRACE, "failed to create coredump\n");
  }
  
@@ -66,7 +66,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1073,8 +1073,8 @@ static u32 brcmf_sdio_hostmail(struct br
+@@ -1090,8 +1090,8 @@ static u32 brcmf_sdio_hostmail(struct br
  
  	/* dongle indicates the firmware has halted/crashed */
  	if (hmb_data & HMB_DATA_FWHALT) {
diff --git a/package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch b/package/kernel/mac80211/patches/brcm/360-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
similarity index 91%
rename from package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
rename to package/kernel/mac80211/patches/brcm/360-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
index 0f2fc42954..5617d141b3 100644
--- a/package/kernel/mac80211/patches/450-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
+++ b/package/kernel/mac80211/patches/brcm/360-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch
@@ -23,16 +23,16 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
- 	int (*get_memdump)(struct device *dev, void *data, size_t len);
+@@ -91,6 +91,7 @@ struct brcmf_bus_ops {
  	int (*get_fwname)(struct device *dev, const char *ext,
  			  unsigned char *fw_name);
+ 	void (*debugfs_create)(struct device *dev);
 +	int (*reset)(struct device *dev);
  };
  
  
-@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bu
- 	return bus->ops->get_fwname(bus->dev, ext, fw_name);
+@@ -245,6 +246,15 @@ void brcmf_bus_debugfs_create(struct brc
+ 	return bus->ops->debugfs_create(bus->dev);
  }
  
 +static inline
@@ -49,7 +49,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
   */
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1104,6 +1104,14 @@ static int brcmf_revinfo_read(struct seq
+@@ -1105,6 +1105,14 @@ static int brcmf_revinfo_read(struct seq
  	return 0;
  }
  
@@ -64,7 +64,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
  {
  	int ret = -1;
-@@ -1175,6 +1183,8 @@ static int brcmf_bus_started(struct brcm
+@@ -1176,6 +1184,8 @@ static int brcmf_bus_started(struct brcm
  #endif
  #endif /* CONFIG_INET */
  
@@ -73,7 +73,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	/* populate debugfs */
  	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
  	brcmf_feat_debugfs_create(drvr);
-@@ -1300,6 +1310,8 @@ void brcmf_fw_crashed(struct device *dev
+@@ -1302,6 +1312,8 @@ void brcmf_fw_crashed(struct device *dev
  	bphy_err(drvr, "Firmware has halted or crashed\n");
  
  	brcmf_dev_coredump(dev);
diff --git a/package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch b/package/kernel/mac80211/patches/brcm/361-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
similarity index 96%
rename from package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
rename to package/kernel/mac80211/patches/brcm/361-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
index 620a58533c..cb4b5c924f 100644
--- a/package/kernel/mac80211/patches/451-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
+++ b/package/kernel/mac80211/patches/brcm/361-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch
@@ -59,7 +59,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -579,24 +579,6 @@ static bool brcmf_fws_ifidx_match(struct
+@@ -580,24 +580,6 @@ static bool brcmf_fws_ifidx_match(struct
  	return ifidx == *(int *)arg;
  }
  
@@ -84,7 +84,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
  {
  	int i;
-@@ -668,6 +650,28 @@ static inline int brcmf_fws_hanger_poppk
+@@ -669,6 +651,28 @@ static inline int brcmf_fws_hanger_poppk
  	return 0;
  }
  
@@ -113,7 +113,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
  					    u32 slot_id)
  {
-@@ -2174,6 +2178,8 @@ void brcmf_fws_del_interface(struct brcm
+@@ -2200,6 +2204,8 @@ void brcmf_fws_del_interface(struct brcm
  	brcmf_fws_lock(fws);
  	ifp->fws_desc = NULL;
  	brcmf_dbg(TRACE, "deleting %s\n", entry->name);
diff --git a/package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch b/package/kernel/mac80211/patches/brcm/361-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
similarity index 97%
rename from package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
rename to package/kernel/mac80211/patches/brcm/361-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
index 71b9487892..e45288b63b 100644
--- a/package/kernel/mac80211/patches/451-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
+++ b/package/kernel/mac80211/patches/brcm/361-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch
@@ -114,7 +114,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  #endif /* BRCMFMAC_BCDC_H */
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1340,6 +1340,8 @@ void brcmf_detach(struct device *dev)
+@@ -1342,6 +1342,8 @@ void brcmf_detach(struct device *dev)
  
  	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
  
@@ -123,7 +123,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	/* make sure primary interface removed last */
  	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
  		brcmf_remove_interface(drvr->iflist[i], false);
-@@ -1349,7 +1351,7 @@ void brcmf_detach(struct device *dev)
+@@ -1351,7 +1353,7 @@ void brcmf_detach(struct device *dev)
  
  	brcmf_bus_stop(drvr->bus_if);
  
@@ -134,7 +134,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	wiphy_free(drvr->wiphy);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2416,17 +2416,25 @@ struct brcmf_fws_info *brcmf_fws_attach(
+@@ -2443,17 +2443,25 @@ struct brcmf_fws_info *brcmf_fws_attach(
  	return fws;
  
  fail:
diff --git a/package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch b/package/kernel/mac80211/patches/brcm/362-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
similarity index 98%
rename from package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
rename to package/kernel/mac80211/patches/brcm/362-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
index a6d5c34007..b6a11d6793 100644
--- a/package/kernel/mac80211/patches/452-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
+++ b/package/kernel/mac80211/patches/brcm/362-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch
@@ -61,7 +61,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -684,12 +684,18 @@ static int brcmf_usb_up(struct device *d
+@@ -682,12 +682,18 @@ static int brcmf_usb_up(struct device *d
  
  static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
  {
diff --git a/package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch b/package/kernel/mac80211/patches/brcm/362-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
similarity index 96%
rename from package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
rename to package/kernel/mac80211/patches/brcm/362-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
index 80ad31ece6..088e731322 100644
--- a/package/kernel/mac80211/patches/452-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
+++ b/package/kernel/mac80211/patches/brcm/362-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch
@@ -41,7 +41,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  }
  
-@@ -1031,8 +1028,8 @@ static void brcmf_usb_detach(struct brcm
+@@ -1029,8 +1026,8 @@ static void brcmf_usb_detach(struct brcm
  	brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
  
  	/* free the URBS */
diff --git a/package/kernel/mac80211/patches/452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch b/package/kernel/mac80211/patches/brcm/362-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch
similarity index 100%
rename from package/kernel/mac80211/patches/452-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch
rename to package/kernel/mac80211/patches/brcm/362-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch
diff --git a/package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch b/package/kernel/mac80211/patches/brcm/363-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
similarity index 98%
rename from package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
rename to package/kernel/mac80211/patches/brcm/363-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
index 5e34e1aca3..01e9bf076d 100644
--- a/package/kernel/mac80211/patches/453-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
+++ b/package/kernel/mac80211/patches/brcm/363-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch
@@ -89,7 +89,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -861,17 +861,17 @@ static void brcmf_del_if(struct brcmf_pu
+@@ -862,17 +862,17 @@ static void brcmf_del_if(struct brcmf_pu
  			 bool rtnl_locked)
  {
  	struct brcmf_if *ifp;
@@ -110,7 +110,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	if (ifp->ndev) {
  		if (bsscfgidx == 0) {
  			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
-@@ -899,6 +899,10 @@ static void brcmf_del_if(struct brcmf_pu
+@@ -900,6 +900,10 @@ static void brcmf_del_if(struct brcmf_pu
  		brcmf_p2p_ifp_removed(ifp, rtnl_locked);
  		kfree(ifp);
  	}
diff --git a/package/kernel/mac80211/patches/brcm/364-v5.2-brcmfmac-convert-dev_init_lock-mutex-to-completion.patch b/package/kernel/mac80211/patches/brcm/364-v5.2-brcmfmac-convert-dev_init_lock-mutex-to-completion.patch
new file mode 100644
index 0000000000..e6ecd2215f
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/364-v5.2-brcmfmac-convert-dev_init_lock-mutex-to-completion.patch
@@ -0,0 +1,182 @@
+From a9fd0953fa4a62887306be28641b4b0809f3b2fd Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Wed, 13 Mar 2019 09:52:42 +0000
+Subject: [PATCH] brcmfmac: convert dev_init_lock mutex to completion
+
+Leaving dev_init_lock mutex locked in probe causes BUG and a WARNING when
+kernel is compiled with CONFIG_PROVE_LOCKING. Convert mutex to completion
+which silences those warnings and improves code readability.
+
+Fix below errors when connecting the USB WiFi dongle:
+
+brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43143 for chip BCM43143/2
+BUG: workqueue leaked lock or atomic: kworker/0:2/0x00000000/434
+     last function: hub_event
+1 lock held by kworker/0:2/434:
+ #0: 18d5dcdf (&devinfo->dev_init_lock){+.+.}, at: brcmf_usb_probe+0x78/0x550 [brcmfmac]
+CPU: 0 PID: 434 Comm: kworker/0:2 Not tainted 4.19.23-00084-g454a789-dirty #123
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Workqueue: usb_hub_wq hub_event
+[<8011237c>] (unwind_backtrace) from [<8010d74c>] (show_stack+0x10/0x14)
+[<8010d74c>] (show_stack) from [<809c4324>] (dump_stack+0xa8/0xd4)
+[<809c4324>] (dump_stack) from [<8014195c>] (process_one_work+0x710/0x808)
+[<8014195c>] (process_one_work) from [<80141a80>] (worker_thread+0x2c/0x564)
+[<80141a80>] (worker_thread) from [<80147bcc>] (kthread+0x13c/0x16c)
+[<80147bcc>] (kthread) from [<801010b4>] (ret_from_fork+0x14/0x20)
+Exception stack(0xed1d9fb0 to 0xed1d9ff8)
+9fa0:                                     00000000 00000000 00000000 00000000
+9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
+
+======================================================
+WARNING: possible circular locking dependency detected
+4.19.23-00084-g454a789-dirty #123 Not tainted
+------------------------------------------------------
+kworker/0:2/434 is trying to acquire lock:
+e29cf799 ((wq_completion)"events"){+.+.}, at: process_one_work+0x174/0x808
+
+but task is already holding lock:
+18d5dcdf (&devinfo->dev_init_lock){+.+.}, at: brcmf_usb_probe+0x78/0x550 [brcmfmac]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&devinfo->dev_init_lock){+.+.}:
+       mutex_lock_nested+0x1c/0x24
+       brcmf_usb_probe+0x78/0x550 [brcmfmac]
+       usb_probe_interface+0xc0/0x1bc
+       really_probe+0x228/0x2c0
+       __driver_attach+0xe4/0xe8
+       bus_for_each_dev+0x68/0xb4
+       bus_add_driver+0x19c/0x214
+       driver_register+0x78/0x110
+       usb_register_driver+0x84/0x148
+       process_one_work+0x228/0x808
+       worker_thread+0x2c/0x564
+       kthread+0x13c/0x16c
+       ret_from_fork+0x14/0x20
+         (null)
+
+-> #1 (brcmf_driver_work){+.+.}:
+       worker_thread+0x2c/0x564
+       kthread+0x13c/0x16c
+       ret_from_fork+0x14/0x20
+         (null)
+
+-> #0 ((wq_completion)"events"){+.+.}:
+       process_one_work+0x1b8/0x808
+       worker_thread+0x2c/0x564
+       kthread+0x13c/0x16c
+       ret_from_fork+0x14/0x20
+         (null)
+
+other info that might help us debug this:
+
+Chain exists of:
+  (wq_completion)"events" --> brcmf_driver_work --> &devinfo->dev_init_lock
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(&devinfo->dev_init_lock);
+                               lock(brcmf_driver_work);
+                               lock(&devinfo->dev_init_lock);
+  lock((wq_completion)"events");
+
+ *** DEADLOCK ***
+
+1 lock held by kworker/0:2/434:
+ #0: 18d5dcdf (&devinfo->dev_init_lock){+.+.}, at: brcmf_usb_probe+0x78/0x550 [brcmfmac]
+
+stack backtrace:
+CPU: 0 PID: 434 Comm: kworker/0:2 Not tainted 4.19.23-00084-g454a789-dirty #123
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Workqueue: events request_firmware_work_func
+[<8011237c>] (unwind_backtrace) from [<8010d74c>] (show_stack+0x10/0x14)
+[<8010d74c>] (show_stack) from [<809c4324>] (dump_stack+0xa8/0xd4)
+[<809c4324>] (dump_stack) from [<80172838>] (print_circular_bug+0x210/0x330)
+[<80172838>] (print_circular_bug) from [<80175940>] (__lock_acquire+0x160c/0x1a30)
+[<80175940>] (__lock_acquire) from [<8017671c>] (lock_acquire+0xe0/0x268)
+[<8017671c>] (lock_acquire) from [<80141404>] (process_one_work+0x1b8/0x808)
+[<80141404>] (process_one_work) from [<80141a80>] (worker_thread+0x2c/0x564)
+[<80141a80>] (worker_thread) from [<80147bcc>] (kthread+0x13c/0x16c)
+[<80147bcc>] (kthread) from [<801010b4>] (ret_from_fork+0x14/0x20)
+Exception stack(0xed1d9fb0 to 0xed1d9ff8)
+9fa0:                                     00000000 00000000 00000000 00000000
+9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/usb.c  | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -160,7 +160,7 @@ struct brcmf_usbdev_info {
+ 
+ 	struct usb_device *usbdev;
+ 	struct device *dev;
+-	struct mutex dev_init_lock;
++	struct completion dev_init_done;
+ 
+ 	int ctl_in_pipe, ctl_out_pipe;
+ 	struct urb *ctl_urb; /* URB for control endpoint */
+@@ -1194,11 +1194,11 @@ static void brcmf_usb_probe_phase2(struc
+ 	if (ret)
+ 		goto error;
+ 
+-	mutex_unlock(&devinfo->dev_init_lock);
++	complete(&devinfo->dev_init_done);
+ 	return;
+ error:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret);
+-	mutex_unlock(&devinfo->dev_init_lock);
++	complete(&devinfo->dev_init_done);
+ 	device_release_driver(dev);
+ }
+ 
+@@ -1266,7 +1266,7 @@ static int brcmf_usb_probe_cb(struct brc
+ 		if (ret)
+ 			goto fail;
+ 		/* we are done */
+-		mutex_unlock(&devinfo->dev_init_lock);
++		complete(&devinfo->dev_init_done);
+ 		return 0;
+ 	}
+ 	bus->chip = bus_pub->devid;
+@@ -1326,11 +1326,10 @@ brcmf_usb_probe(struct usb_interface *in
+ 
+ 	devinfo->usbdev = usb;
+ 	devinfo->dev = &usb->dev;
+-	/* Take an init lock, to protect for disconnect while still loading.
++	/* Init completion, to protect for disconnect while still loading.
+ 	 * Necessary because of the asynchronous firmware load construction
+ 	 */
+-	mutex_init(&devinfo->dev_init_lock);
+-	mutex_lock(&devinfo->dev_init_lock);
++	init_completion(&devinfo->dev_init_done);
+ 
+ 	usb_set_intfdata(intf, devinfo);
+ 
+@@ -1408,7 +1407,7 @@ brcmf_usb_probe(struct usb_interface *in
+ 	return 0;
+ 
+ fail:
+-	mutex_unlock(&devinfo->dev_init_lock);
++	complete(&devinfo->dev_init_done);
+ 	kfree(devinfo);
+ 	usb_set_intfdata(intf, NULL);
+ 	return ret;
+@@ -1423,7 +1422,7 @@ brcmf_usb_disconnect(struct usb_interfac
+ 	devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
+ 
+ 	if (devinfo) {
+-		mutex_lock(&devinfo->dev_init_lock);
++		wait_for_completion(&devinfo->dev_init_done);
+ 		/* Make sure that devinfo still exists. Firmware probe routines
+ 		 * may have released the device and cleared the intfdata.
+ 		 */
diff --git a/package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch b/package/kernel/mac80211/patches/brcm/365-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
similarity index 90%
rename from package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
rename to package/kernel/mac80211/patches/brcm/365-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
index 2f72b72cc2..87974dcc6f 100644
--- a/package/kernel/mac80211/patches/454-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
+++ b/package/kernel/mac80211/patches/brcm/365-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch
@@ -15,7 +15,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5455,6 +5455,8 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5456,6 +5456,8 @@ static s32 brcmf_get_assoc_ies(struct br
  		conn_info->req_ie =
  		    kmemdup(cfg->extra_buf, conn_info->req_ie_len,
  			    GFP_KERNEL);
@@ -24,7 +24,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	} else {
  		conn_info->req_ie_len = 0;
  		conn_info->req_ie = NULL;
-@@ -5471,6 +5473,8 @@ static s32 brcmf_get_assoc_ies(struct br
+@@ -5472,6 +5474,8 @@ static s32 brcmf_get_assoc_ies(struct br
  		conn_info->resp_ie =
  		    kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
  			    GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/brcm/366-v5.2-brcmfmac-Use-struct_size-in-kzalloc.patch b/package/kernel/mac80211/patches/brcm/366-v5.2-brcmfmac-Use-struct_size-in-kzalloc.patch
new file mode 100644
index 0000000000..d00a9d7964
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/366-v5.2-brcmfmac-Use-struct_size-in-kzalloc.patch
@@ -0,0 +1,53 @@
+From 0cf83903aad03dc7f444a47990def48c4a9d3276 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 3 Apr 2019 11:46:11 -0500
+Subject: [PATCH] brcmfmac: Use struct_size() in kzalloc()
+
+One of the more common cases of allocation size calculations is finding
+the size of a structure that has a zero-sized array at the end, along
+with memory for some number of elements for that array. For example:
+
+struct foo {
+    int stuff;
+    struct boo entry[];
+};
+
+size = sizeof(struct foo) + count * sizeof(struct boo);
+instance = kzalloc(size, GFP_KERNEL)
+
+Instead of leaving these open-coded and prone to type mistakes, we can
+now use the new struct_size() helper:
+
+instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL)
+
+Notice that, in this case, variable reqsz is not necessary,
+hence it is removed.
+
+This code was detected with the help of Coccinelle.
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -711,7 +711,6 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 	size_t mp_path_len;
+ 	u32 i, j;
+ 	char end = '\0';
+-	size_t reqsz;
+ 
+ 	for (i = 0; i < table_size; i++) {
+ 		if (mapping_table[i].chipid == chip &&
+@@ -726,8 +725,7 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
+ 		return NULL;
+ 	}
+ 
+-	reqsz = sizeof(*fwreq) + n_fwnames * sizeof(struct brcmf_fw_item);
+-	fwreq = kzalloc(reqsz, GFP_KERNEL);
++	fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
+ 	if (!fwreq)
+ 		return NULL;
+ 
diff --git a/package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch b/package/kernel/mac80211/patches/brcm/367-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
similarity index 89%
rename from package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
rename to package/kernel/mac80211/patches/brcm/367-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
index f7ca327517..d19284e672 100644
--- a/package/kernel/mac80211/patches/455-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
+++ b/package/kernel/mac80211/patches/brcm/367-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch
@@ -15,7 +15,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -615,6 +615,7 @@ BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-s
+@@ -622,6 +622,7 @@ BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-s
  /* Note the names are not postfixed with a1 for backward compatibility */
  BRCMF_FW_DEF(43430A1, "brcmfmac43430-sdio");
  BRCMF_FW_DEF(43455, "brcmfmac43455-sdio");
@@ -23,7 +23,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
  BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
  BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
-@@ -634,7 +635,8 @@ static const struct brcmf_firmware_mappi
+@@ -642,7 +643,8 @@ static const struct brcmf_firmware_mappi
  	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
  	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
  	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
@@ -32,4 +32,4 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFDC0, 43455),
  	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
  	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
- 	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
+ 	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373),
diff --git a/package/kernel/mac80211/patches/456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch b/package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
similarity index 100%
rename from package/kernel/mac80211/patches/456-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
rename to package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
diff --git a/package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch b/package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
similarity index 97%
rename from package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
rename to package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
index 5ce49d3a07..6861667b2b 100644
--- a/package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
+++ b/package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/b43.h
 +++ b/drivers/net/wireless/broadcom/b43/b43.h
-@@ -839,6 +839,7 @@ struct b43_wldev {
+@@ -840,6 +840,7 @@ struct b43_wldev {
  	bool qos_enabled;		/* TRUE, if QoS is used. */
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
diff --git a/package/kernel/mac80211/patches/811-b43_no_pio.patch b/package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
similarity index 91%
rename from package/kernel/mac80211/patches/811-b43_no_pio.patch
rename to package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
index d23387c8cd..5eb1dc550a 100644
--- a/package/kernel/mac80211/patches/811-b43_no_pio.patch
+++ b/package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/Makefile
 +++ b/drivers/net/wireless/broadcom/b43/Makefile
-@@ -17,7 +17,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
+@@ -18,7 +18,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
  b43-y				+= sysfs.o
  b43-y				+= xmit.o
  b43-y				+= dma.o
@@ -26,7 +26,7 @@
  	}
 --- a/drivers/net/wireless/broadcom/b43/pio.h
 +++ b/drivers/net/wireless/broadcom/b43/pio.h
-@@ -150,7 +150,7 @@ static inline void b43_piorx_write32(str
+@@ -151,7 +151,7 @@ static inline void b43_piorx_write32(str
  	b43_write32(q->dev, q->mmio_base + offset, value);
  }
  
@@ -35,7 +35,7 @@
  int b43_pio_init(struct b43_wldev *dev);
  void b43_pio_free(struct b43_wldev *dev);
  
-@@ -161,5 +161,37 @@ void b43_pio_rx(struct b43_pio_rxqueue *
+@@ -162,5 +162,37 @@ void b43_pio_rx(struct b43_pio_rxqueue *
  
  void b43_pio_tx_suspend(struct b43_wldev *dev);
  void b43_pio_tx_resume(struct b43_wldev *dev);
@@ -82,5 +82,5 @@
 -	bool
 +	bool "Broadcom 43xx PIO support"
  	depends on B43 && B43_SSB
- 	select SSB_BLOCKIO
+ 	depends on SSB_BLOCKIO
  	default y
diff --git a/package/kernel/mac80211/patches/812-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
similarity index 99%
rename from package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
rename to package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
index 932c83b48e..d643d2f82c 100644
--- a/package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
@@ -120,7 +120,7 @@
  	SET_IEEE80211_DEV(hw, dev->dev);
 --- a/drivers/net/wireless/broadcom/b43/b43.h
 +++ b/drivers/net/wireless/broadcom/b43/b43.h
-@@ -840,6 +840,8 @@ struct b43_wldev {
+@@ -841,6 +841,8 @@ struct b43_wldev {
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
  	int gpiomask;			/* GPIO LED mask as a module parameter */
diff --git a/package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch b/package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
similarity index 88%
rename from package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
rename to package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
index 5899706896..85c52c0282 100644
--- a/package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
+++ b/package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/dma.h
 +++ b/drivers/net/wireless/broadcom/b43/dma.h
-@@ -169,7 +169,7 @@ struct b43_dmadesc_generic {
+@@ -170,7 +170,7 @@ struct b43_dmadesc_generic {
  
  /* DMA engine tuning knobs */
  #define B43_TXRING_SLOTS		256
diff --git a/package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch b/package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch
similarity index 100%
rename from package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch
rename to package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch
diff --git a/package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
similarity index 100%
rename from package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch
rename to package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
diff --git a/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch b/package/kernel/mac80211/patches/brcm/850-brcmsmac-remove-extra-regulation-restriction.patch
similarity index 100%
rename from package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
rename to package/kernel/mac80211/patches/brcm/850-brcmsmac-remove-extra-regulation-restriction.patch
diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
similarity index 83%
rename from package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
rename to package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
index e7385513db..d431d7e700 100644
--- a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
+++ b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1434,6 +1434,7 @@ int __init brcmf_core_init(void)
+@@ -1436,6 +1436,7 @@ int __init brcmf_core_init(void)
  {
  	if (!schedule_work(&brcmf_driver_work))
  		return -EBUSY;
@@ -23,7 +23,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  }
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -441,6 +441,7 @@ struct brcmf_fw {
+@@ -442,6 +442,7 @@ struct brcmf_fw {
  	struct brcmf_fw_request *req;
  	u32 curpos;
  	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
@@ -31,7 +31,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  };
  
  static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
-@@ -574,6 +575,8 @@ static void brcmf_fw_request_done(const
+@@ -649,6 +650,8 @@ static void brcmf_fw_request_done(const
  		fwctx->req = NULL;
  	}
  	fwctx->done(fwctx->dev, ret, fwctx->req);
@@ -40,7 +40,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  	kfree(fwctx);
  }
  
-@@ -598,6 +601,8 @@ int brcmf_fw_get_firmwares(struct device
+@@ -673,6 +676,8 @@ int brcmf_fw_get_firmwares(struct device
  {
  	struct brcmf_fw_item *first = &req->items[0];
  	struct brcmf_fw *fwctx;
@@ -49,19 +49,21 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  	int ret;
  
  	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
-@@ -615,12 +620,20 @@ int brcmf_fw_get_firmwares(struct device
+@@ -689,6 +694,9 @@ int brcmf_fw_get_firmwares(struct device
+ 	fwctx->dev = dev;
  	fwctx->req = req;
  	fwctx->done = fw_cb;
- 
++ 
 +	init_completion(&completion);
 +	fwctx->completion = &completion;
-+
+ 
  	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
  				      fwctx->dev, GFP_KERNEL, fwctx,
- 				      brcmf_fw_request_done);
+@@ -696,6 +704,12 @@ int brcmf_fw_get_firmwares(struct device
  	if (ret < 0)
  		brcmf_fw_request_done(NULL, fwctx);
  
++
 +	time_left = wait_for_completion_timeout(&completion,
 +						msecs_to_jiffies(5000));
 +	if (!time_left && fwctx)
diff --git a/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
similarity index 96%
rename from package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
rename to package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
index 912fe8ca14..45cfb1ddbf 100644
--- a/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
+++ b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -639,8 +639,36 @@ static struct wireless_dev *brcmf_cfg802
+@@ -620,8 +620,36 @@ static struct wireless_dev *brcmf_cfg802
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_pub *drvr = cfg->pub;
  	struct wireless_dev *wdev;
diff --git a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
similarity index 93%
rename from package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
rename to package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
index 578b3e0399..5cbc48f76a 100644
--- a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2798,6 +2798,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2774,6 +2774,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
similarity index 100%
rename from package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
rename to package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
diff --git a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch b/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
similarity index 92%
rename from package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
rename to package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
index 417b6ec869..249c3036be 100644
--- a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
+++ b/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
@@ -18,6 +18,6 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 +#else
  static int brcmf_roamoff;
 +#endif
- module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
+ module_param_named(roamoff, brcmf_roamoff, int, 0400);
  MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
  
diff --git a/package/kernel/mac80211/patches/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch b/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
similarity index 93%
rename from package/kernel/mac80211/patches/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
rename to package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
index c7b25714fb..88b9807311 100644
--- a/package/kernel/mac80211/patches/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
+++ b/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch
@@ -22,7 +22,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -700,8 +700,10 @@ static u32 brcmf_chip_tcm_rambase(struct
+@@ -707,8 +707,10 @@ static u32 brcmf_chip_tcm_rambase(struct
  	return 0;
  }
  
@@ -34,7 +34,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  	struct brcmf_core_priv *mem_core;
  	struct brcmf_core *mem;
  
-@@ -981,7 +983,7 @@ static int brcmf_chip_recognition(struct
+@@ -990,7 +992,7 @@ static int brcmf_chip_recognition(struct
  		brcmf_chip_set_passive(&ci->pub);
  	}
  
@@ -55,7 +55,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_chip_detach(struct brcmf_chip *chip);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1780,6 +1780,12 @@ static void brcmf_pcie_setup(struct devi
+@@ -1762,6 +1762,12 @@ static void brcmf_pcie_setup(struct devi
  	nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len;
  	kfree(fwreq);
  
diff --git a/package/kernel/mac80211/patches/000-fix_kconfig.patch b/package/kernel/mac80211/patches/build/000-fix_kconfig.patch
similarity index 100%
rename from package/kernel/mac80211/patches/000-fix_kconfig.patch
rename to package/kernel/mac80211/patches/build/000-fix_kconfig.patch
diff --git a/package/kernel/mac80211/patches/001-fix_build.patch b/package/kernel/mac80211/patches/build/001-fix_build.patch
similarity index 93%
rename from package/kernel/mac80211/patches/001-fix_build.patch
rename to package/kernel/mac80211/patches/build/001-fix_build.patch
index 9e272e90af..e57ca190e4 100644
--- a/package/kernel/mac80211/patches/001-fix_build.patch
+++ b/package/kernel/mac80211/patches/build/001-fix_build.patch
@@ -27,7 +27,7 @@
  	@set -e ; test -f local-symbols || (						\
  	echo "/--------------"								;\
  	echo "| You shouldn't run make in the backports tree, but only in"		;\
-@@ -60,57 +62,61 @@ mrproper:
+@@ -60,58 +62,62 @@ mrproper:
  	echo "| (that isn't currently running.)"					;\
  	echo "\\--"									;\
  	false)
@@ -56,12 +56,13 @@
 -			done								\
 -		) > Kconfig.kernel							;\
 -		kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
--			sed 's/^\(\([3-4]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
+-			sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
 -		test "$$kver" != "" || echo "Kernel version parse failed!"		;\
 -		test "$$kver" != ""							;\
 -		kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
 -		kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')"				;\
--		kvers="$$kvers $$(seq 0 99 | sed 's/^/4./')"				;\
+-		kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')"				;\
+-		kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')"				;\
 -		print=0									;\
 -		for v in $$kvers ; do							\
 -			if [ "$$print" = "1" ] ; then					\
@@ -112,12 +113,13 @@
 +
 +Kconfig.versions: Kconfig.kernel
 +	@kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
-+		sed 's/^\(\([3-4]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
++		sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d')		;\
 +	test "$$kver" != "" || echo "Kernel version parse failed!"		;\
 +	test "$$kver" != ""							;\
 +	kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
 +	kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')"				;\
-+	kvers="$$kvers $$(seq 0 99 | sed 's/^/4./')"				;\
++	kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')"				;\
++	kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')"				;\
 +	print=0									;\
 +	for v in $$kvers ; do							\
 +		if [ "$$print" = "1" ] ; then					\
diff --git a/package/kernel/mac80211/patches/002-change_allconfig.patch b/package/kernel/mac80211/patches/build/002-change_allconfig.patch
similarity index 100%
rename from package/kernel/mac80211/patches/002-change_allconfig.patch
rename to package/kernel/mac80211/patches/build/002-change_allconfig.patch
diff --git a/package/kernel/mac80211/patches/003-remove_bogus_modparams.patch b/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
similarity index 100%
rename from package/kernel/mac80211/patches/003-remove_bogus_modparams.patch
rename to package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
diff --git a/package/kernel/mac80211/patches/004-kconfig_backport_fix.patch b/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/004-kconfig_backport_fix.patch
rename to package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
diff --git a/package/kernel/mac80211/patches/010-disable_rfkill.patch b/package/kernel/mac80211/patches/build/010-disable_rfkill.patch
similarity index 100%
rename from package/kernel/mac80211/patches/010-disable_rfkill.patch
rename to package/kernel/mac80211/patches/build/010-disable_rfkill.patch
diff --git a/package/kernel/mac80211/patches/012-kernel_build_check.patch b/package/kernel/mac80211/patches/build/012-kernel_build_check.patch
similarity index 100%
rename from package/kernel/mac80211/patches/012-kernel_build_check.patch
rename to package/kernel/mac80211/patches/build/012-kernel_build_check.patch
diff --git a/package/kernel/mac80211/patches/015-ipw200-mtu.patch b/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
similarity index 86%
rename from package/kernel/mac80211/patches/015-ipw200-mtu.patch
rename to package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
index 8d273a095b..d57d821fea 100644
--- a/package/kernel/mac80211/patches/015-ipw200-mtu.patch
+++ b/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
 +++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-@@ -11506,6 +11506,15 @@ static const struct attribute_group ipw_
+@@ -11498,6 +11498,15 @@ static const struct attribute_group ipw_
  	.attrs = ipw_sysfs_entries,
  };
  
@@ -16,7 +16,7 @@
  #ifdef CPTCFG_IPW2200_PROMISCUOUS
  static int ipw_prom_open(struct net_device *dev)
  {
-@@ -11554,15 +11563,6 @@ static netdev_tx_t ipw_prom_hard_start_x
+@@ -11546,15 +11555,6 @@ static netdev_tx_t ipw_prom_hard_start_x
  	return NETDEV_TX_OK;
  }
  
diff --git a/package/kernel/mac80211/patches/050-lib80211_option.patch b/package/kernel/mac80211/patches/build/050-lib80211_option.patch
similarity index 78%
rename from package/kernel/mac80211/patches/050-lib80211_option.patch
rename to package/kernel/mac80211/patches/build/050-lib80211_option.patch
index 28a0d905b7..6282cdab5f 100644
--- a/package/kernel/mac80211/patches/050-lib80211_option.patch
+++ b/package/kernel/mac80211/patches/build/050-lib80211_option.patch
@@ -1,7 +1,7 @@
 --- a/net/wireless/Kconfig
 +++ b/net/wireless/Kconfig
-@@ -181,7 +181,7 @@ config CFG80211_WEXT_EXPORT
- 	  wext compatibility symbols to be exported.
+@@ -185,7 +185,7 @@ config CFG80211_WEXT_EXPORT
+ endif # CFG80211
  
  config LIB80211
 -	tristate
@@ -9,7 +9,7 @@
  	depends on m
  	default n
  	help
-@@ -191,15 +191,15 @@ config LIB80211
+@@ -195,15 +195,15 @@ config LIB80211
  	  Drivers should select this themselves if needed.
  
  config LIB80211_CRYPT_WEP
diff --git a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
new file mode 100644
index 0000000000..06636060f7
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
@@ -0,0 +1,335 @@
+--- a/local-symbols
++++ b/local-symbols
+@@ -396,43 +396,6 @@ USB_IPHETH=
+ USB_SIERRA_NET=
+ USB_VL600=
+ USB_NET_CH9200=
+-SSB_POSSIBLE=
+-SSB=
+-SSB_SPROM=
+-SSB_BLOCKIO=
+-SSB_PCIHOST_POSSIBLE=
+-SSB_PCIHOST=
+-SSB_B43_PCI_BRIDGE=
+-SSB_PCMCIAHOST_POSSIBLE=
+-SSB_PCMCIAHOST=
+-SSB_SDIOHOST_POSSIBLE=
+-SSB_SDIOHOST=
+-SSB_HOST_SOC=
+-SSB_SERIAL=
+-SSB_DRIVER_PCICORE_POSSIBLE=
+-SSB_DRIVER_PCICORE=
+-SSB_PCICORE_HOSTMODE=
+-SSB_DRIVER_MIPS=
+-SSB_SFLASH=
+-SSB_EMBEDDED=
+-SSB_DRIVER_EXTIF=
+-SSB_DRIVER_GIGE=
+-SSB_DRIVER_GPIO=
+-BCMA_POSSIBLE=
+-BCMA=
+-BCMA_BLOCKIO=
+-BCMA_HOST_PCI_POSSIBLE=
+-BCMA_HOST_PCI=
+-BCMA_HOST_SOC=
+-BCMA_DRIVER_PCI=
+-BCMA_DRIVER_PCI_HOSTMODE=
+-BCMA_DRIVER_MIPS=
+-BCMA_PFLASH=
+-BCMA_SFLASH=
+-BCMA_NFLASH=
+-BCMA_DRIVER_GMAC_CMN=
+-BCMA_DRIVER_GPIO=
+-BCMA_DEBUG=
+ USB_ACM=
+ USB_PRINTER=
+ USB_WDM=
+--- a/drivers/net/wireless/broadcom/b43/Kconfig
++++ b/drivers/net/wireless/broadcom/b43/Kconfig
+@@ -61,21 +61,21 @@ endchoice
+ config B43_PCI_AUTOSELECT
+ 	bool
+ 	depends on B43 && SSB_PCIHOST_POSSIBLE
+-	select SSB_PCIHOST
+-	select SSB_B43_PCI_BRIDGE
++	depends on SSB_PCIHOST
++	depends on SSB_B43_PCI_BRIDGE
+ 	default y
+ 
+ # Auto-select SSB PCICORE driver, if possible
+ config B43_PCICORE_AUTOSELECT
+ 	bool
+ 	depends on B43 && SSB_DRIVER_PCICORE_POSSIBLE
+-	select SSB_DRIVER_PCICORE
++	depends on SSB_DRIVER_PCICORE
+ 	default y
+ 
+ config B43_SDIO
+ 	bool "Broadcom 43xx SDIO device support"
+ 	depends on B43 && B43_SSB && SSB_SDIOHOST_POSSIBLE
+-	select SSB_SDIOHOST
++	depends on SSB_SDIOHOST
+ 	---help---
+ 	  Broadcom 43xx device support for Soft-MAC SDIO devices.
+ 
+@@ -94,13 +94,13 @@ config B43_SDIO
+ config B43_BCMA_PIO
+ 	bool
+ 	depends on B43 && B43_BCMA
+-	select BCMA_BLOCKIO
++	depends on BCMA_BLOCKIO
+ 	default y
+ 
+ config B43_PIO
+ 	bool
+ 	depends on B43 && B43_SSB
+-	select SSB_BLOCKIO
++	depends on SSB_BLOCKIO
+ 	default y
+ 
+ config B43_PHY_G
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -2876,7 +2876,7 @@ static struct ssb_device *b43_ssb_gpio_d
+ {
+ 	struct ssb_bus *bus = dev->dev->sdev->bus;
+ 
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
+ #else
+ 	return bus->chipco.dev;
+@@ -4893,7 +4893,7 @@ static int b43_wireless_core_init(struct
+ 	}
+ 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
+ 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
+-#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
++#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
+ 	if (dev->dev->bus_type == B43_BUS_SSB &&
+ 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
+ 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
+--- a/drivers/net/wireless/broadcom/b43legacy/Kconfig
++++ b/drivers/net/wireless/broadcom/b43legacy/Kconfig
+@@ -2,7 +2,7 @@ config B43LEGACY
+ 	tristate "Broadcom 43xx-legacy wireless support (mac80211 stack)"
+ 	depends on m
+ 	depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
+-	select SSB
++	depends on SSB
+ 	depends on FW_LOADER
+ 	---help---
+ 	  b43legacy is a driver for 802.11b devices from Broadcom (BCM4301 and
+@@ -24,15 +24,15 @@ config B43LEGACY
+ config B43LEGACY_PCI_AUTOSELECT
+ 	bool
+ 	depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
+-	select SSB_PCIHOST
+-	select SSB_B43_PCI_BRIDGE
++	depends on SSB_PCIHOST
++	depends on SSB_B43_PCI_BRIDGE
+ 	default y
+ 
+ # Auto-select SSB PCICORE driver, if possible
+ config B43LEGACY_PCICORE_AUTOSELECT
+ 	bool
+ 	depends on B43LEGACY && SSB_DRIVER_PCICORE_POSSIBLE
+-	select SSB_DRIVER_PCICORE
++	depends on SSB_DRIVER_PCICORE
+ 	default y
+ 
+ # LED support
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
+ 	if (dev->dev->id.revision >= 2)
+ 		mask  |= 0x0010; /* FIXME: This is redundant. */
+ 
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ 	pcidev = bus->pcicore.dev;
+ #endif
+ 	gpiodev = bus->chipco.dev ? : pcidev;
+@@ -1956,7 +1956,7 @@ static void b43legacy_gpio_cleanup(struc
+ 	struct ssb_bus *bus = dev->dev->bus;
+ 	struct ssb_device *gpiodev, *pcidev = NULL;
+ 
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ 	pcidev = bus->pcicore.dev;
+ #endif
+ 	gpiodev = bus->chipco.dev ? : pcidev;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
+@@ -22,7 +22,7 @@ struct brcms_led {
+ 	bool active_low;
+ };
+ 
+-#ifdef CPTCFG_BCMA_DRIVER_GPIO
++#ifdef CONFIG_BCMA_DRIVER_GPIO
+ void brcms_led_unregister(struct brcms_info *wl);
+ int brcms_led_register(struct brcms_info *wl);
+ #else
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
+@@ -42,6 +42,6 @@ brcmsmac-y := \
+ 	brcms_trace_events.o \
+ 	debug.o
+ 
+-brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
++brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
+ 
+ obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
+--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
++++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
+@@ -7,7 +7,7 @@ config BRCMSMAC
+ 	depends on m
+ 	depends on MAC80211
+ 	depends on BCMA_POSSIBLE
+-	select BCMA
++	depends on BCMA
+ 	select NEW_LEDS if BCMA_DRIVER_GPIO
+ 	select LEDS_CLASS if BCMA_DRIVER_GPIO
+ 	select BRCMUTIL
+--- a/Kconfig.local
++++ b/Kconfig.local
+@@ -1192,117 +1192,6 @@ config BACKPORTED_USB_VL600
+ config BACKPORTED_USB_NET_CH9200
+ 	tristate
+ 	default USB_NET_CH9200
+-config BACKPORTED_SSB_POSSIBLE
+-	tristate
+-	default SSB_POSSIBLE
+-config BACKPORTED_SSB
+-	tristate
+-	default SSB
+-config BACKPORTED_SSB_SPROM
+-	tristate
+-	default SSB_SPROM
+-config BACKPORTED_SSB_BLOCKIO
+-	tristate
+-	default SSB_BLOCKIO
+-config BACKPORTED_SSB_PCIHOST_POSSIBLE
+-	tristate
+-	default SSB_PCIHOST_POSSIBLE
+-config BACKPORTED_SSB_PCIHOST
+-	tristate
+-	default SSB_PCIHOST
+-config BACKPORTED_SSB_B43_PCI_BRIDGE
+-	tristate
+-	default SSB_B43_PCI_BRIDGE
+-config BACKPORTED_SSB_PCMCIAHOST_POSSIBLE
+-	tristate
+-	default SSB_PCMCIAHOST_POSSIBLE
+-config BACKPORTED_SSB_PCMCIAHOST
+-	tristate
+-	default SSB_PCMCIAHOST
+-config BACKPORTED_SSB_SDIOHOST_POSSIBLE
+-	tristate
+-	default SSB_SDIOHOST_POSSIBLE
+-config BACKPORTED_SSB_SDIOHOST
+-	tristate
+-	default SSB_SDIOHOST
+-config BACKPORTED_SSB_HOST_SOC
+-	tristate
+-	default SSB_HOST_SOC
+-config BACKPORTED_SSB_SERIAL
+-	tristate
+-	default SSB_SERIAL
+-config BACKPORTED_SSB_DRIVER_PCICORE_POSSIBLE
+-	tristate
+-	default SSB_DRIVER_PCICORE_POSSIBLE
+-config BACKPORTED_SSB_DRIVER_PCICORE
+-	tristate
+-	default SSB_DRIVER_PCICORE
+-config BACKPORTED_SSB_PCICORE_HOSTMODE
+-	tristate
+-	default SSB_PCICORE_HOSTMODE
+-config BACKPORTED_SSB_DRIVER_MIPS
+-	tristate
+-	default SSB_DRIVER_MIPS
+-config BACKPORTED_SSB_SFLASH
+-	tristate
+-	default SSB_SFLASH
+-config BACKPORTED_SSB_EMBEDDED
+-	tristate
+-	default SSB_EMBEDDED
+-config BACKPORTED_SSB_DRIVER_EXTIF
+-	tristate
+-	default SSB_DRIVER_EXTIF
+-config BACKPORTED_SSB_DRIVER_GIGE
+-	tristate
+-	default SSB_DRIVER_GIGE
+-config BACKPORTED_SSB_DRIVER_GPIO
+-	tristate
+-	default SSB_DRIVER_GPIO
+-config BACKPORTED_BCMA_POSSIBLE
+-	tristate
+-	default BCMA_POSSIBLE
+-config BACKPORTED_BCMA
+-	tristate
+-	default BCMA
+-config BACKPORTED_BCMA_BLOCKIO
+-	tristate
+-	default BCMA_BLOCKIO
+-config BACKPORTED_BCMA_HOST_PCI_POSSIBLE
+-	tristate
+-	default BCMA_HOST_PCI_POSSIBLE
+-config BACKPORTED_BCMA_HOST_PCI
+-	tristate
+-	default BCMA_HOST_PCI
+-config BACKPORTED_BCMA_HOST_SOC
+-	tristate
+-	default BCMA_HOST_SOC
+-config BACKPORTED_BCMA_DRIVER_PCI
+-	tristate
+-	default BCMA_DRIVER_PCI
+-config BACKPORTED_BCMA_DRIVER_PCI_HOSTMODE
+-	tristate
+-	default BCMA_DRIVER_PCI_HOSTMODE
+-config BACKPORTED_BCMA_DRIVER_MIPS
+-	tristate
+-	default BCMA_DRIVER_MIPS
+-config BACKPORTED_BCMA_PFLASH
+-	tristate
+-	default BCMA_PFLASH
+-config BACKPORTED_BCMA_SFLASH
+-	tristate
+-	default BCMA_SFLASH
+-config BACKPORTED_BCMA_NFLASH
+-	tristate
+-	default BCMA_NFLASH
+-config BACKPORTED_BCMA_DRIVER_GMAC_CMN
+-	tristate
+-	default BCMA_DRIVER_GMAC_CMN
+-config BACKPORTED_BCMA_DRIVER_GPIO
+-	tristate
+-	default BCMA_DRIVER_GPIO
+-config BACKPORTED_BCMA_DEBUG
+-	tristate
+-	default BCMA_DEBUG
+ config BACKPORTED_USB_ACM
+ 	tristate
+ 	default USB_ACM
+--- a/Kconfig.sources
++++ b/Kconfig.sources
+@@ -7,9 +7,6 @@ source "$BACKPORT_DIR/net/mac80211/Kconf
+ source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
+ 
+-source "$BACKPORT_DIR/drivers/ssb/Kconfig"
+-source "$BACKPORT_DIR/drivers/bcma/Kconfig"
+-
+ source "$BACKPORT_DIR/drivers/usb/class/Kconfig"
+ 
+ source "$BACKPORT_DIR/drivers/staging/Kconfig"
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -40,8 +40,6 @@ obj-y += compat/
+ obj-$(CPTCFG_CFG80211) += net/wireless/
+ obj-$(CPTCFG_MAC80211) += net/mac80211/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+-obj-$(CPTCFG_SSB) += drivers/ssb/
+-obj-$(CPTCFG_BCMA) += drivers/bcma/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+ 
+ obj-$(CPTCFG_USB_WDM) += drivers/usb/class/
diff --git a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
similarity index 87%
rename from package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
rename to package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
index a901a44ba4..f3e311a2e9 100644
--- a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5681,6 +5681,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5686,6 +5686,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
similarity index 89%
rename from package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
rename to package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
index 885bc246ba..c3e6db8f05 100644
--- a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2040,6 +2040,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2041,6 +2041,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
diff --git a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
similarity index 85%
rename from package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
rename to package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
index 089ad2fe78..f1966d88e6 100644
--- a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2116,6 +2116,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2117,6 +2117,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
similarity index 75%
rename from package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
index a958c78b43..61a6c4c70f 100644
--- a/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6266,6 +6266,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6271,6 +6271,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6299,8 +6301,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6304,8 +6306,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/mwl/941-mwl8k-Fix-rate_idx-underflow.patch b/package/kernel/mac80211/patches/mwl/941-mwl8k-Fix-rate_idx-underflow.patch
new file mode 100644
index 0000000000..4f4812be80
--- /dev/null
+++ b/package/kernel/mac80211/patches/mwl/941-mwl8k-Fix-rate_idx-underflow.patch
@@ -0,0 +1,80 @@
+From b897577af85bb5e5638efa780bc3716fae5212d3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 8 Apr 2019 09:45:56 +0200
+Subject: [PATCH] mwl8k: Fix rate_idx underflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It was reported on OpenWrt bug tracking system[1], that several users
+are affected by the endless reboot of their routers if they configure
+5GHz interface with channel 44 or 48.
+
+The reboot loop is caused by the following excessive number of WARN_ON
+messages:
+
+ WARNING: CPU: 0 PID: 0 at backports-4.19.23-1/net/mac80211/rx.c:4516
+                             ieee80211_rx_napi+0x1fc/0xa54 [mac80211]
+
+as the messages are being correctly emitted by the following guard:
+
+ case RX_ENC_LEGACY:
+      if (WARN_ON(status->rate_idx >= sband->n_bitrates))
+
+as the rate_idx is in this case erroneously set to 251 (0xfb). This fix
+simply converts previously used magic number to proper constant and
+guards against substraction which is leading to the currently observed
+underflow.
+
+1. https://bugs.openwrt.org/index.php?do=details&task_id=2218
+
+Fixes: 854783444bab ("mwl8k: properly set receive status rate index on 5 GHz receive")
+Cc: <stable@vger.kernel.org>
+Tested-by: Eubert Bao <bunnier@gmail.com>
+Reported-by: Eubert Bao <bunnier@gmail.com>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ drivers/net/wireless/marvell/mwl8k.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index 8e4e9b6..ffc565a 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -441,6 +441,9 @@ struct mwl8k_sta {
+ #define MWL8K_CMD_UPDATE_STADB		0x1123
+ #define MWL8K_CMD_BASTREAM		0x1125
+ 
++#define MWL8K_LEGACY_5G_RATE_OFFSET \
++	(ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
++
+ static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
+ {
+ 	u16 command = le16_to_cpu(cmd);
+@@ -1016,8 +1019,9 @@ static void mwl8k_rxd_ap_refill(void *_rxd, dma_addr_t addr, int len)
+ 
+ 	if (rxd->channel > 14) {
+ 		status->band = NL80211_BAND_5GHZ;
+-		if (!(status->encoding == RX_ENC_HT))
+-			status->rate_idx -= 5;
++		if (!(status->encoding == RX_ENC_HT) &&
++		    status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++			status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ 	} else {
+ 		status->band = NL80211_BAND_2GHZ;
+ 	}
+@@ -1124,8 +1128,9 @@ static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
+ 
+ 	if (rxd->channel > 14) {
+ 		status->band = NL80211_BAND_5GHZ;
+-		if (!(status->encoding == RX_ENC_HT))
+-			status->rate_idx -= 5;
++		if (!(status->encoding == RX_ENC_HT) &&
++		    status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++			status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ 	} else {
+ 		status->band = NL80211_BAND_2GHZ;
+ 	}
+-- 
+1.9.1
+
diff --git a/package/kernel/mac80211/patches/rt2x00/001-rt2x00-use-simple_read_from_buffer.patch b/package/kernel/mac80211/patches/rt2x00/001-rt2x00-use-simple_read_from_buffer.patch
new file mode 100644
index 0000000000..1319cc244c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/001-rt2x00-use-simple_read_from_buffer.patch
@@ -0,0 +1,59 @@
+From f483039cf51acf30494cd754194562c22cf98764 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 22 Aug 2018 13:41:26 +0300
+Subject: [PATCH 01/28] rt2x00: use simple_read_from_buffer()
+
+The problem with this copy_to_user() calls is that they don't ensure
+that "size" is less than the "length" which the user provided.
+
+Obviously, this is debugfs and "size" is normally going to be very small
+so it probably doesn't matter, but this is the correct thing to do.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2x00debug.c   | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
+@@ -464,11 +464,7 @@ static ssize_t rt2x00debug_read_##__name
+ 								\
+ 	size = sprintf(line, __format, value);			\
+ 								\
+-	if (copy_to_user(buf, line, size))			\
+-		return -EFAULT;					\
+-								\
+-	*offset += size;					\
+-	return size;						\
++	return simple_read_from_buffer(buf, length, offset, line, size); \
+ }
+ 
+ #define RT2X00DEBUGFS_OPS_WRITE(__name, __type)			\
+@@ -545,11 +541,7 @@ static ssize_t rt2x00debug_read_dev_flag
+ 
+ 	size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->flags);
+ 
+-	if (copy_to_user(buf, line, size))
+-		return -EFAULT;
+-
+-	*offset += size;
+-	return size;
++	return simple_read_from_buffer(buf, length, offset, line, size);
+ }
+ 
+ static const struct file_operations rt2x00debug_fop_dev_flags = {
+@@ -574,11 +566,7 @@ static ssize_t rt2x00debug_read_cap_flag
+ 
+ 	size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->cap_flags);
+ 
+-	if (copy_to_user(buf, line, size))
+-		return -EFAULT;
+-
+-	*offset += size;
+-	return size;
++	return simple_read_from_buffer(buf, length, offset, line, size);
+ }
+ 
+ static const struct file_operations rt2x00debug_fop_cap_flags = {
diff --git a/package/kernel/mac80211/patches/rt2x00/002-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch b/package/kernel/mac80211/patches/rt2x00/002-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch
new file mode 100644
index 0000000000..a883258a4c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/002-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch
@@ -0,0 +1,357 @@
+From 5c656c71b1bf5611ce8262bab338104e04d10b8d Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 26 Sep 2018 12:24:53 +0200
+Subject: [PATCH 02/28] rt2800: move usb specific txdone/txstatus routines to
+ rt2800lib
+
+In order to reuse usb txdone/txstatus routines for mmio, move them
+to common rt2800lib.c file.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 138 +++++++++++++++++
+ .../net/wireless/ralink/rt2x00/rt2800lib.h    |   3 +
+ .../net/wireless/ralink/rt2x00/rt2800usb.c    | 143 +-----------------
+ 3 files changed, 145 insertions(+), 139 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -957,6 +957,47 @@ static void rt2800_rate_from_status(stru
+ 	skbdesc->tx_rate_flags = flags;
+ }
+ 
++static bool rt2800_txdone_entry_check(struct queue_entry *entry, u32 reg)
++{
++	__le32 *txwi;
++	u32 word;
++	int wcid, ack, pid;
++	int tx_wcid, tx_ack, tx_pid, is_agg;
++
++	/*
++	 * This frames has returned with an IO error,
++	 * so the status report is not intended for this
++	 * frame.
++	 */
++	if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
++		return false;
++
++	wcid	= rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
++	ack	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
++	pid	= rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
++	is_agg	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_AGGRE);
++
++	/*
++	 * Validate if this TX status report is intended for
++	 * this entry by comparing the WCID/ACK/PID fields.
++	 */
++	txwi = rt2800_drv_get_txwi(entry);
++
++	word = rt2x00_desc_read(txwi, 1);
++	tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
++	tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
++	tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
++
++	if (wcid != tx_wcid || ack != tx_ack || (!is_agg && pid != tx_pid)) {
++		rt2x00_dbg(entry->queue->rt2x00dev,
++			   "TX status report missed for queue %d entry %d\n",
++			   entry->queue->qid, entry->entry_idx);
++		return false;
++	}
++
++	return true;
++}
++
+ void rt2800_txdone_entry(struct queue_entry *entry, u32 status, __le32 *txwi,
+ 			 bool match)
+ {
+@@ -1059,6 +1100,103 @@ void rt2800_txdone_entry(struct queue_en
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
+ 
++void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++	struct queue_entry *entry;
++	u32 reg;
++	u8 qid;
++	bool match;
++
++	while (kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
++		/*
++		 * TX_STA_FIFO_PID_QUEUE is a 2-bit field, thus qid is
++		 * guaranteed to be one of the TX QIDs .
++		 */
++		qid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_QUEUE);
++		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
++
++		if (unlikely(rt2x00queue_empty(queue))) {
++			rt2x00_dbg(rt2x00dev, "Got TX status for an empty queue %u, dropping\n",
++				   qid);
++			break;
++		}
++
++		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
++
++		if (unlikely(test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
++			     !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))) {
++			rt2x00_warn(rt2x00dev, "Data pending for entry %u in queue %u\n",
++				    entry->entry_idx, qid);
++			break;
++		}
++
++		match = rt2800_txdone_entry_check(entry, reg);
++		rt2800_txdone_entry(entry, reg, rt2800_drv_get_txwi(entry), match);
++	}
++}
++EXPORT_SYMBOL_GPL(rt2800_txdone);
++
++static inline bool rt2800_entry_txstatus_timeout(struct queue_entry *entry)
++{
++	bool tout;
++
++	if (!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
++		return false;
++
++	tout = time_after(jiffies, entry->last_action + msecs_to_jiffies(500));
++	if (unlikely(tout))
++		rt2x00_dbg(entry->queue->rt2x00dev,
++			   "TX status timeout for entry %d in queue %d\n",
++			   entry->entry_idx, entry->queue->qid);
++	return tout;
++
++}
++
++bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++	struct queue_entry *entry;
++
++	tx_queue_for_each(rt2x00dev, queue) {
++		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
++		if (rt2800_entry_txstatus_timeout(entry))
++			return true;
++	}
++	return false;
++}
++EXPORT_SYMBOL_GPL(rt2800_txstatus_timeout);
++
++void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++	struct queue_entry *entry;
++
++	/*
++	 * Process any trailing TX status reports for IO failures,
++	 * we loop until we find the first non-IO error entry. This
++	 * can either be a frame which is free, is being uploaded,
++	 * or has completed the upload but didn't have an entry
++	 * in the TX_STAT_FIFO register yet.
++	 */
++	tx_queue_for_each(rt2x00dev, queue) {
++		while (!rt2x00queue_empty(queue)) {
++			entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
++
++			if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
++			    !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
++				break;
++
++			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
++			    rt2800_entry_txstatus_timeout(entry))
++				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
++			else
++				break;
++		}
++	}
++}
++EXPORT_SYMBOL_GPL(rt2800_txdone_nostatus);
++
+ static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
+ 					  unsigned int index)
+ {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -195,6 +195,9 @@ void rt2800_process_rxwi(struct queue_en
+ 
+ void rt2800_txdone_entry(struct queue_entry *entry, u32 status, __le32 *txwi,
+ 			 bool match);
++void rt2800_txdone(struct rt2x00_dev *rt2x00dev);
++void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev);
++bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev);
+ 
+ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
+ void rt2800_clear_beacon(struct queue_entry *entry);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -116,35 +116,6 @@ static bool rt2800usb_txstatus_pending(s
+ 	return false;
+ }
+ 
+-static inline bool rt2800usb_entry_txstatus_timeout(struct queue_entry *entry)
+-{
+-	bool tout;
+-
+-	if (!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+-		return false;
+-
+-	tout = time_after(jiffies, entry->last_action + msecs_to_jiffies(500));
+-	if (unlikely(tout))
+-		rt2x00_dbg(entry->queue->rt2x00dev,
+-			   "TX status timeout for entry %d in queue %d\n",
+-			   entry->entry_idx, entry->queue->qid);
+-	return tout;
+-
+-}
+-
+-static bool rt2800usb_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	struct queue_entry *entry;
+-
+-	tx_queue_for_each(rt2x00dev, queue) {
+-		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-		if (rt2800usb_entry_txstatus_timeout(entry))
+-			return true;
+-	}
+-	return false;
+-}
+-
+ #define TXSTATUS_READ_INTERVAL 1000000
+ 
+ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+@@ -171,7 +142,7 @@ static bool rt2800usb_tx_sta_fifo_read_c
+ 	}
+ 
+ 	/* Check if there is any entry that timedout waiting on TX status */
+-	if (rt2800usb_txstatus_timeout(rt2x00dev))
++	if (rt2800_txstatus_timeout(rt2x00dev))
+ 		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+ 	if (rt2800usb_txstatus_pending(rt2x00dev)) {
+@@ -501,123 +472,17 @@ static int rt2800usb_get_tx_data_len(str
+ /*
+  * TX control handlers
+  */
+-static bool rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
+-{
+-	__le32 *txwi;
+-	u32 word;
+-	int wcid, ack, pid;
+-	int tx_wcid, tx_ack, tx_pid, is_agg;
+-
+-	/*
+-	 * This frames has returned with an IO error,
+-	 * so the status report is not intended for this
+-	 * frame.
+-	 */
+-	if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+-		return false;
+-
+-	wcid	= rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
+-	ack	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
+-	pid	= rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
+-	is_agg	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_AGGRE);
+-
+-	/*
+-	 * Validate if this TX status report is intended for
+-	 * this entry by comparing the WCID/ACK/PID fields.
+-	 */
+-	txwi = rt2800usb_get_txwi(entry);
+-
+-	word = rt2x00_desc_read(txwi, 1);
+-	tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+-	tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
+-	tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
+-
+-	if (wcid != tx_wcid || ack != tx_ack || (!is_agg && pid != tx_pid)) {
+-		rt2x00_dbg(entry->queue->rt2x00dev,
+-			   "TX status report missed for queue %d entry %d\n",
+-			   entry->queue->qid, entry->entry_idx);
+-		return false;
+-	}
+-
+-	return true;
+-}
+-
+-static void rt2800usb_txdone(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	struct queue_entry *entry;
+-	u32 reg;
+-	u8 qid;
+-	bool match;
+-
+-	while (kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
+-		/*
+-		 * TX_STA_FIFO_PID_QUEUE is a 2-bit field, thus qid is
+-		 * guaranteed to be one of the TX QIDs .
+-		 */
+-		qid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_QUEUE);
+-		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
+-
+-		if (unlikely(rt2x00queue_empty(queue))) {
+-			rt2x00_dbg(rt2x00dev, "Got TX status for an empty queue %u, dropping\n",
+-				   qid);
+-			break;
+-		}
+-
+-		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-
+-		if (unlikely(test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+-			     !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))) {
+-			rt2x00_warn(rt2x00dev, "Data pending for entry %u in queue %u\n",
+-				    entry->entry_idx, qid);
+-			break;
+-		}
+-
+-		match = rt2800usb_txdone_entry_check(entry, reg);
+-		rt2800_txdone_entry(entry, reg, rt2800usb_get_txwi(entry), match);
+-	}
+-}
+-
+-static void rt2800usb_txdone_nostatus(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	struct queue_entry *entry;
+-
+-	/*
+-	 * Process any trailing TX status reports for IO failures,
+-	 * we loop until we find the first non-IO error entry. This
+-	 * can either be a frame which is free, is being uploaded,
+-	 * or has completed the upload but didn't have an entry
+-	 * in the TX_STAT_FIFO register yet.
+-	 */
+-	tx_queue_for_each(rt2x00dev, queue) {
+-		while (!rt2x00queue_empty(queue)) {
+-			entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-
+-			if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+-			    !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+-				break;
+-
+-			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
+-			    rt2800usb_entry_txstatus_timeout(entry))
+-				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+-			else
+-				break;
+-		}
+-	}
+-}
+-
+ static void rt2800usb_work_txdone(struct work_struct *work)
+ {
+ 	struct rt2x00_dev *rt2x00dev =
+ 	    container_of(work, struct rt2x00_dev, txdone_work);
+ 
+ 	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
+-	       rt2800usb_txstatus_timeout(rt2x00dev)) {
++	       rt2800_txstatus_timeout(rt2x00dev)) {
+ 
+-		rt2800usb_txdone(rt2x00dev);
++		rt2800_txdone(rt2x00dev);
+ 
+-		rt2800usb_txdone_nostatus(rt2x00dev);
++		rt2800_txdone_nostatus(rt2x00dev);
+ 
+ 		/*
+ 		 * The hw may delay sending the packet after DMA complete
diff --git a/package/kernel/mac80211/patches/rt2x00/003-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch b/package/kernel/mac80211/patches/rt2x00/003-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch
new file mode 100644
index 0000000000..48f0c27011
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/003-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch
@@ -0,0 +1,244 @@
+From 0b0d556e0ebb6c966bc993e21a22a156812d8fdf Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 26 Sep 2018 12:24:54 +0200
+Subject: [PATCH 03/28] rt2800mmio: use txdone/txstatus routines from lib
+
+Use usb txdone/txstatus routines (now in rt2800libc) for mmio devices.
+
+Note this also change how we handle INT_SOURCE_CSR_TX_FIFO_STATUS
+interrupt. Now it is disabled since IRQ routine till end of the txstatus
+tasklet (the same behaviour like others interrupts). Reason to do not
+disable this interrupt was not to miss any tx status from 16 entries
+FIFO register. Now, since we check for tx status timeout, we can
+allow to miss some tx statuses. However this will be improved in further
+patch where I also implement read status FIFO register in the tasklet.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 180 +-----------------
+ .../net/wireless/ralink/rt2x00/rt2x00queue.c  |   1 +
+ 2 files changed, 9 insertions(+), 172 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -175,161 +175,6 @@ static void rt2800mmio_wakeup(struct rt2
+ 	rt2800_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
+ }
+ 
+-static bool rt2800mmio_txdone_entry_check(struct queue_entry *entry, u32 status)
+-{
+-	__le32 *txwi;
+-	u32 word;
+-	int wcid, tx_wcid;
+-
+-	wcid = rt2x00_get_field32(status, TX_STA_FIFO_WCID);
+-
+-	txwi = rt2800_drv_get_txwi(entry);
+-	word = rt2x00_desc_read(txwi, 1);
+-	tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+-
+-	return (tx_wcid == wcid);
+-}
+-
+-static bool rt2800mmio_txdone_find_entry(struct queue_entry *entry, void *data)
+-{
+-	u32 status = *(u32 *)data;
+-
+-	/*
+-	 * rt2800pci hardware might reorder frames when exchanging traffic
+-	 * with multiple BA enabled STAs.
+-	 *
+-	 * For example, a tx queue
+-	 *    [ STA1 | STA2 | STA1 | STA2 ]
+-	 * can result in tx status reports
+-	 *    [ STA1 | STA1 | STA2 | STA2 ]
+-	 * when the hw decides to aggregate the frames for STA1 into one AMPDU.
+-	 *
+-	 * To mitigate this effect, associate the tx status to the first frame
+-	 * in the tx queue with a matching wcid.
+-	 */
+-	if (rt2800mmio_txdone_entry_check(entry, status) &&
+-	    !test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+-		/*
+-		 * Got a matching frame, associate the tx status with
+-		 * the frame
+-		 */
+-		entry->status = status;
+-		set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+-		return true;
+-	}
+-
+-	/* Check the next frame */
+-	return false;
+-}
+-
+-static bool rt2800mmio_txdone_match_first(struct queue_entry *entry, void *data)
+-{
+-	u32 status = *(u32 *)data;
+-
+-	/*
+-	 * Find the first frame without tx status and assign this status to it
+-	 * regardless if it matches or not.
+-	 */
+-	if (!test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+-		/*
+-		 * Got a matching frame, associate the tx status with
+-		 * the frame
+-		 */
+-		entry->status = status;
+-		set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+-		return true;
+-	}
+-
+-	/* Check the next frame */
+-	return false;
+-}
+-static bool rt2800mmio_txdone_release_entries(struct queue_entry *entry,
+-					      void *data)
+-{
+-	if (test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+-		rt2800_txdone_entry(entry, entry->status,
+-				    rt2800mmio_get_txwi(entry), true);
+-		return false;
+-	}
+-
+-	/* No more frames to release */
+-	return true;
+-}
+-
+-static bool rt2800mmio_txdone(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	u32 status;
+-	u8 qid;
+-	int max_tx_done = 16;
+-
+-	while (kfifo_get(&rt2x00dev->txstatus_fifo, &status)) {
+-		qid = rt2x00_get_field32(status, TX_STA_FIFO_PID_QUEUE);
+-		if (unlikely(qid >= QID_RX)) {
+-			/*
+-			 * Unknown queue, this shouldn't happen. Just drop
+-			 * this tx status.
+-			 */
+-			rt2x00_warn(rt2x00dev, "Got TX status report with unexpected pid %u, dropping\n",
+-				    qid);
+-			break;
+-		}
+-
+-		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
+-		if (unlikely(queue == NULL)) {
+-			/*
+-			 * The queue is NULL, this shouldn't happen. Stop
+-			 * processing here and drop the tx status
+-			 */
+-			rt2x00_warn(rt2x00dev, "Got TX status for an unavailable queue %u, dropping\n",
+-				    qid);
+-			break;
+-		}
+-
+-		if (unlikely(rt2x00queue_empty(queue))) {
+-			/*
+-			 * The queue is empty. Stop processing here
+-			 * and drop the tx status.
+-			 */
+-			rt2x00_warn(rt2x00dev, "Got TX status for an empty queue %u, dropping\n",
+-				    qid);
+-			break;
+-		}
+-
+-		/*
+-		 * Let's associate this tx status with the first
+-		 * matching frame.
+-		 */
+-		if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+-						Q_INDEX, &status,
+-						rt2800mmio_txdone_find_entry)) {
+-			/*
+-			 * We cannot match the tx status to any frame, so just
+-			 * use the first one.
+-			 */
+-			if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+-							Q_INDEX, &status,
+-							rt2800mmio_txdone_match_first)) {
+-				rt2x00_warn(rt2x00dev, "No frame found for TX status on queue %u, dropping\n",
+-					    qid);
+-				break;
+-			}
+-		}
+-
+-		/*
+-		 * Release all frames with a valid tx status.
+-		 */
+-		rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+-					   Q_INDEX, NULL,
+-					   rt2800mmio_txdone_release_entries);
+-
+-		if (--max_tx_done == 0)
+-			break;
+-	}
+-
+-	return !max_tx_done;
+-}
+-
+ static inline void rt2800mmio_enable_interrupt(struct rt2x00_dev *rt2x00dev,
+ 					       struct rt2x00_field32 irq_field)
+ {
+@@ -349,14 +194,14 @@ static inline void rt2800mmio_enable_int
+ void rt2800mmio_txstatus_tasklet(unsigned long data)
+ {
+ 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+-	if (rt2800mmio_txdone(rt2x00dev))
+-		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
+ 
+-	/*
+-	 * No need to enable the tx status interrupt here as we always
+-	 * leave it enabled to minimize the possibility of a tx status
+-	 * register overflow. See comment in interrupt handler.
+-	 */
++	rt2800_txdone(rt2x00dev);
++
++	rt2800_txdone_nostatus(rt2x00dev);
++
++	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++		rt2800mmio_enable_interrupt(rt2x00dev,
++					    INT_SOURCE_CSR_TX_FIFO_STATUS);
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
+ 
+@@ -440,10 +285,6 @@ static void rt2800mmio_txstatus_interrup
+ 	 * because we can schedule the tasklet multiple times (when the
+ 	 * interrupt fires again during tx status processing).
+ 	 *
+-	 * Furthermore we don't disable the TX_FIFO_STATUS
+-	 * interrupt here but leave it enabled so that the TX_STA_FIFO
+-	 * can also be read while the tx status tasklet gets executed.
+-	 *
+ 	 * Since we have only one producer and one consumer we don't
+ 	 * need to lock the kfifo.
+ 	 */
+@@ -485,13 +326,8 @@ irqreturn_t rt2800mmio_interrupt(int irq
+ 	 */
+ 	mask = ~reg;
+ 
+-	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
++	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+ 		rt2800mmio_txstatus_interrupt(rt2x00dev);
+-		/*
+-		 * Never disable the TX_FIFO_STATUS interrupt.
+-		 */
+-		rt2x00_set_field32(&mask, INT_MASK_CSR_TX_FIFO_STATUS, 1);
+-	}
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_PRE_TBTT))
+ 		tasklet_hi_schedule(&rt2x00dev->pretbtt_tasklet);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -113,6 +113,7 @@ int rt2x00queue_map_txskb(struct queue_e
+ 		return -ENOMEM;
+ 
+ 	skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
++	rt2x00lib_dmadone(entry);
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);
diff --git a/package/kernel/mac80211/patches/rt2x00/004-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch b/package/kernel/mac80211/patches/rt2x00/004-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch
new file mode 100644
index 0000000000..832768d042
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/004-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch
@@ -0,0 +1,72 @@
+From 5022efb50f625d11fdf18b1fee0f64ebb1863664 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 26 Sep 2018 12:24:55 +0200
+Subject: [PATCH 04/28] rt2x00: do not check for txstatus timeout every time on
+ tasklet
+
+Do not check for tx status timeout everytime we perform txstatus tasklet.
+Perform check once per half a second.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c   | 7 +++++++
+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c  | 3 ++-
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h      | 2 ++
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 1 +
+ 4 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1158,11 +1158,18 @@ bool rt2800_txstatus_timeout(struct rt2x
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
+ 
++	if (time_before(jiffies,
++			rt2x00dev->last_nostatus_check + msecs_to_jiffies(500)))
++		return false;
++
++	rt2x00dev->last_nostatus_check = jiffies;
++
+ 	tx_queue_for_each(rt2x00dev, queue) {
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+ 		if (rt2800_entry_txstatus_timeout(entry))
+ 			return true;
+ 	}
++
+ 	return false;
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txstatus_timeout);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -197,7 +197,8 @@ void rt2800mmio_txstatus_tasklet(unsigne
+ 
+ 	rt2800_txdone(rt2x00dev);
+ 
+-	rt2800_txdone_nostatus(rt2x00dev);
++	if (rt2800_txstatus_timeout(rt2x00dev))
++		rt2800_txdone_nostatus(rt2x00dev);
+ 
+ 	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+ 		rt2800mmio_enable_interrupt(rt2x00dev,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -980,6 +980,8 @@ struct rt2x00_dev {
+ 	 */
+ 	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
+ 
++	unsigned long last_nostatus_check;
++
+ 	/*
+ 	 * Timer to ensure tx status reports are read (rt2800usb).
+ 	 */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -1039,6 +1039,7 @@ void rt2x00queue_start_queues(struct rt2
+ 	 */
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_start_queue(queue);
++	rt2x00dev->last_nostatus_check = jiffies;
+ 
+ 	rt2x00queue_start_queue(rt2x00dev->rx);
+ }
diff --git a/package/kernel/mac80211/patches/rt2x00/005-rt2x00-use-different-txstatus-timeouts-when-flushing.patch b/package/kernel/mac80211/patches/rt2x00/005-rt2x00-use-different-txstatus-timeouts-when-flushing.patch
new file mode 100644
index 0000000000..0f29026373
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/005-rt2x00-use-different-txstatus-timeouts-when-flushing.patch
@@ -0,0 +1,112 @@
+From adf26a356f132e35093585521ea3e36cd185af83 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 26 Sep 2018 12:24:56 +0200
+Subject: [PATCH 05/28] rt2x00: use different txstatus timeouts when flushing
+
+Use different tx status timeouts for normal operation and when flushing.
+This increase timeout to 2s for normal operation as when there are bad
+radio conditions and frames are reposted many times device can not provide
+the status for quite long. With new timeout we can still get valid status
+on such bad conditions.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 31 +++++++++++++------
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h   |  1 +
+ .../net/wireless/ralink/rt2x00/rt2x00mac.c    |  4 +++
+ 3 files changed, 26 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1137,36 +1137,47 @@ void rt2800_txdone(struct rt2x00_dev *rt
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txdone);
+ 
+-static inline bool rt2800_entry_txstatus_timeout(struct queue_entry *entry)
++static inline bool rt2800_entry_txstatus_timeout(struct rt2x00_dev *rt2x00dev,
++						 struct queue_entry *entry)
+ {
+-	bool tout;
++	bool ret;
++	unsigned long tout;
+ 
+ 	if (!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+ 		return false;
+ 
+-	tout = time_after(jiffies, entry->last_action + msecs_to_jiffies(500));
+-	if (unlikely(tout))
++	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
++		tout = msecs_to_jiffies(100);
++	else
++		tout = msecs_to_jiffies(2000);
++
++	ret = time_after(jiffies, entry->last_action + tout);
++	if (unlikely(ret))
+ 		rt2x00_dbg(entry->queue->rt2x00dev,
+ 			   "TX status timeout for entry %d in queue %d\n",
+ 			   entry->entry_idx, entry->queue->qid);
+-	return tout;
+-
++	return ret;
+ }
+ 
+ bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+ {
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
++	unsigned long tout;
++
++	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
++		tout = msecs_to_jiffies(50);
++	else
++		tout = msecs_to_jiffies(1000);
+ 
+-	if (time_before(jiffies,
+-			rt2x00dev->last_nostatus_check + msecs_to_jiffies(500)))
++	if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
+ 		return false;
+ 
+ 	rt2x00dev->last_nostatus_check = jiffies;
+ 
+ 	tx_queue_for_each(rt2x00dev, queue) {
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-		if (rt2800_entry_txstatus_timeout(entry))
++		if (rt2800_entry_txstatus_timeout(rt2x00dev, entry))
+ 			return true;
+ 	}
+ 
+@@ -1195,7 +1206,7 @@ void rt2800_txdone_nostatus(struct rt2x0
+ 				break;
+ 
+ 			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
+-			    rt2800_entry_txstatus_timeout(entry))
++			    rt2800_entry_txstatus_timeout(rt2x00dev, entry))
+ 				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+ 			else
+ 				break;
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -665,6 +665,7 @@ enum rt2x00_state_flags {
+ 	DEVICE_STATE_STARTED,
+ 	DEVICE_STATE_ENABLED_RADIO,
+ 	DEVICE_STATE_SCANNING,
++	DEVICE_STATE_FLUSHING,
+ 
+ 	/*
+ 	 * Driver configuration
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -720,8 +720,12 @@ void rt2x00mac_flush(struct ieee80211_hw
+ 	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+ 		return;
+ 
++	set_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags);
++
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_flush_queue(queue, drop);
++
++	clear_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags);
+ }
+ EXPORT_SYMBOL_GPL(rt2x00mac_flush);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/006-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch b/package/kernel/mac80211/patches/rt2x00/006-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch
new file mode 100644
index 0000000000..784fbb16f1
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/006-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch
@@ -0,0 +1,238 @@
+From 0240564430c0697d8fde3743d70346a922466b36 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 26 Sep 2018 12:24:57 +0200
+Subject: [PATCH 06/28] rt2800: flush and txstatus rework for rt2800mmio
+
+Implement custom rt2800mmio flush routine and change txstatus
+routine to read TX_STA_FIFO also in the tasklet.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    |  14 +--
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 118 +++++++++++++-----
+ .../net/wireless/ralink/rt2x00/rt2800mmio.h   |   1 +
+ .../net/wireless/ralink/rt2x00/rt2800pci.c    |   2 +-
+ 4 files changed, 97 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1147,7 +1147,7 @@ static inline bool rt2800_entry_txstatus
+ 		return false;
+ 
+ 	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
+-		tout = msecs_to_jiffies(100);
++		tout = msecs_to_jiffies(50);
+ 	else
+ 		tout = msecs_to_jiffies(2000);
+ 
+@@ -1163,15 +1163,13 @@ bool rt2800_txstatus_timeout(struct rt2x
+ {
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
+-	unsigned long tout;
+ 
+-	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
+-		tout = msecs_to_jiffies(50);
+-	else
+-		tout = msecs_to_jiffies(1000);
++	if (!test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags)) {
++		unsigned long tout = msecs_to_jiffies(1000);
+ 
+-	if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
+-		return false;
++		if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
++			return false;
++	}
+ 
+ 	rt2x00dev->last_nostatus_check = jiffies;
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -191,21 +191,6 @@ static inline void rt2800mmio_enable_int
+ 	spin_unlock_irq(&rt2x00dev->irqmask_lock);
+ }
+ 
+-void rt2800mmio_txstatus_tasklet(unsigned long data)
+-{
+-	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+-
+-	rt2800_txdone(rt2x00dev);
+-
+-	if (rt2800_txstatus_timeout(rt2x00dev))
+-		rt2800_txdone_nostatus(rt2x00dev);
+-
+-	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+-		rt2800mmio_enable_interrupt(rt2x00dev,
+-					    INT_SOURCE_CSR_TX_FIFO_STATUS);
+-}
+-EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
+-
+ void rt2800mmio_pretbtt_tasklet(unsigned long data)
+ {
+ 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+@@ -270,12 +255,26 @@ void rt2800mmio_autowake_tasklet(unsigne
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
+ 
+-static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
++static void rt2800mmio_txdone(struct rt2x00_dev *rt2x00dev)
++{
++	bool timeout = false;
++
++	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
++	       (timeout = rt2800_txstatus_timeout(rt2x00dev))) {
++
++		rt2800_txdone(rt2x00dev);
++
++		if (timeout)
++			rt2800_txdone_nostatus(rt2x00dev);
++	}
++}
++
++static bool rt2800mmio_fetch_txstatus(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u32 status;
+-	int i;
++	bool more = false;
+ 
+-	/*
++	/* FIXEME: rewrite this comment
+ 	 * The TX_FIFO_STATUS interrupt needs special care. We should
+ 	 * read TX_STA_FIFO but we should do it immediately as otherwise
+ 	 * the register can overflow and we would lose status reports.
+@@ -286,25 +285,37 @@ static void rt2800mmio_txstatus_interrup
+ 	 * because we can schedule the tasklet multiple times (when the
+ 	 * interrupt fires again during tx status processing).
+ 	 *
+-	 * Since we have only one producer and one consumer we don't
++	 * txstatus tasklet is called with INT_SOURCE_CSR_TX_FIFO_STATUS
++	 * disabled so have only one producer and one consumer - we don't
+ 	 * need to lock the kfifo.
+ 	 */
+-	for (i = 0; i < rt2x00dev->tx->limit; i++) {
++	while (!kfifo_is_full(&rt2x00dev->txstatus_fifo)) {
+ 		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
+-
+ 		if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
+ 			break;
+ 
+-		if (!kfifo_put(&rt2x00dev->txstatus_fifo, status)) {
+-			rt2x00_warn(rt2x00dev, "TX status FIFO overrun, drop tx status report\n");
+-			break;
+-		}
++		kfifo_put(&rt2x00dev->txstatus_fifo, status);
++		more = true;
+ 	}
+ 
+-	/* Schedule the tasklet for processing the tx status. */
+-	tasklet_schedule(&rt2x00dev->txstatus_tasklet);
++	return more;
+ }
+ 
++void rt2800mmio_txstatus_tasklet(unsigned long data)
++{
++	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
++
++	do {
++		rt2800mmio_txdone(rt2x00dev);
++
++	} while (rt2800mmio_fetch_txstatus(rt2x00dev));
++
++	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++		rt2800mmio_enable_interrupt(rt2x00dev,
++					    INT_SOURCE_CSR_TX_FIFO_STATUS);
++}
++EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
++
+ irqreturn_t rt2800mmio_interrupt(int irq, void *dev_instance)
+ {
+ 	struct rt2x00_dev *rt2x00dev = dev_instance;
+@@ -327,8 +338,10 @@ irqreturn_t rt2800mmio_interrupt(int irq
+ 	 */
+ 	mask = ~reg;
+ 
+-	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+-		rt2800mmio_txstatus_interrupt(rt2x00dev);
++	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
++		rt2800mmio_fetch_txstatus(rt2x00dev);
++		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
++	}
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_PRE_TBTT))
+ 		tasklet_hi_schedule(&rt2x00dev->pretbtt_tasklet);
+@@ -453,6 +466,53 @@ void rt2800mmio_kick_queue(struct data_q
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_kick_queue);
+ 
++void rt2800mmio_flush_queue(struct data_queue *queue, bool drop)
++{
++	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
++	bool tx_queue = false;
++	unsigned int i;
++
++	switch (queue->qid) {
++	case QID_AC_VO:
++	case QID_AC_VI:
++	case QID_AC_BE:
++	case QID_AC_BK:
++		tx_queue = true;
++		break;
++	case QID_RX:
++		break;
++	default:
++		return;
++	}
++
++	for (i = 0; i < 5; i++) {
++		/*
++		 * Check if the driver is already done, otherwise we
++		 * have to sleep a little while to give the driver/hw
++		 * the oppurtunity to complete interrupt process itself.
++		 */
++		if (rt2x00queue_empty(queue))
++			break;
++
++		/*
++		 * For TX queues schedule completion tasklet to catch
++		 * tx status timeouts, othewise just wait.
++		 */
++		if (tx_queue) {
++			tasklet_disable(&rt2x00dev->txstatus_tasklet);
++			rt2800mmio_txdone(rt2x00dev);
++			tasklet_enable(&rt2x00dev->txstatus_tasklet);
++		}
++
++		/*
++		 * Wait for a little while to give the driver
++		 * the oppurtunity to recover itself.
++		 */
++		msleep(50);
++	}
++}
++EXPORT_SYMBOL_GPL(rt2800mmio_flush_queue);
++
+ void rt2800mmio_stop_queue(struct data_queue *queue)
+ {
+ 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
+@@ -148,6 +148,7 @@ void rt2800mmio_toggle_irq(struct rt2x00
+ /* Queue handlers */
+ void rt2800mmio_start_queue(struct data_queue *queue);
+ void rt2800mmio_kick_queue(struct data_queue *queue);
++void rt2800mmio_flush_queue(struct data_queue *queue, bool drop);
+ void rt2800mmio_stop_queue(struct data_queue *queue);
+ void rt2800mmio_queue_init(struct data_queue *queue);
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -364,7 +364,7 @@ static const struct rt2x00lib_ops rt2800
+ 	.start_queue		= rt2800mmio_start_queue,
+ 	.kick_queue		= rt2800mmio_kick_queue,
+ 	.stop_queue		= rt2800mmio_stop_queue,
+-	.flush_queue		= rt2x00mmio_flush_queue,
++	.flush_queue		= rt2800mmio_flush_queue,
+ 	.write_tx_desc		= rt2800mmio_write_tx_desc,
+ 	.write_tx_data		= rt2800_write_tx_data,
+ 	.write_beacon		= rt2800_write_beacon,
diff --git a/package/kernel/mac80211/patches/rt2x00/007-rt2x00-rt2400pci-mark-expected-switch-fall-through.patch b/package/kernel/mac80211/patches/rt2x00/007-rt2x00-rt2400pci-mark-expected-switch-fall-through.patch
new file mode 100644
index 0000000000..2161ad9ef3
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/007-rt2x00-rt2400pci-mark-expected-switch-fall-through.patch
@@ -0,0 +1,25 @@
+From 6eba8fd2235237784dfd01da55c3210d493aebdb Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 22 Oct 2018 22:44:34 +0200
+Subject: [PATCH 07/28] rt2x00: rt2400pci: mark expected switch fall-through
+
+In preparation to enabling -Wimplicit-fallthrough, mark switch cases
+where we are expecting to fall through.
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
+@@ -1302,7 +1302,7 @@ static void rt2400pci_txdone(struct rt2x
+ 			break;
+ 		case 2: /* Failure, excessive retries */
+ 			__set_bit(TXDONE_EXCESSIVE_RETRY, &txdesc.flags);
+-			/* Don't break, this is a failed frame! */
++			/* Fall through - this is a failed frame! */
+ 		default: /* Failure */
+ 			__set_bit(TXDONE_FAILURE, &txdesc.flags);
+ 		}
diff --git a/package/kernel/mac80211/patches/rt2x00/008-rt2x00-rt2500pci-mark-expected-switch-fall-through.patch b/package/kernel/mac80211/patches/rt2x00/008-rt2x00-rt2500pci-mark-expected-switch-fall-through.patch
new file mode 100644
index 0000000000..d10de6b0e5
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/008-rt2x00-rt2500pci-mark-expected-switch-fall-through.patch
@@ -0,0 +1,25 @@
+From 10bb92217747c3384a01ebec005faa2f5e72bbd8 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 22 Oct 2018 22:45:19 +0200
+Subject: [PATCH 08/28] rt2x00: rt2500pci: mark expected switch fall-through
+
+In preparation to enabling -Wimplicit-fallthrough, mark switch cases
+where we are expecting to fall through.
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
+@@ -1430,7 +1430,7 @@ static void rt2500pci_txdone(struct rt2x
+ 			break;
+ 		case 2: /* Failure, excessive retries */
+ 			__set_bit(TXDONE_EXCESSIVE_RETRY, &txdesc.flags);
+-			/* Don't break, this is a failed frame! */
++			/* Fall through - this is a failed frame! */
+ 		default: /* Failure */
+ 			__set_bit(TXDONE_FAILURE, &txdesc.flags);
+ 		}
diff --git a/package/kernel/mac80211/patches/rt2x00/009-rt2x00-rt2800lib-mark-expected-switch-fall-throughs.patch b/package/kernel/mac80211/patches/rt2x00/009-rt2x00-rt2800lib-mark-expected-switch-fall-throughs.patch
new file mode 100644
index 0000000000..99f971b95f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/009-rt2x00-rt2800lib-mark-expected-switch-fall-throughs.patch
@@ -0,0 +1,44 @@
+From 916e6bbcfcff6cc5d7d33bba8557a30f3af50326 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 22 Oct 2018 22:46:03 +0200
+Subject: [PATCH 09/28] rt2x00: rt2800lib: mark expected switch fall-throughs
+
+In preparation to enabling -Wimplicit-fallthrough, mark switch cases
+where we are expecting to fall through.
+
+Addresses-Coverity-ID: 145198 ("Missing break in switch")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2482,6 +2482,7 @@ static void rt2800_config_channel_rf3052
+ 		switch (rt2x00dev->default_ant.tx_chain_num) {
+ 		case 1:
+ 			rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 1);
++			/* fall through */
+ 		case 2:
+ 			rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 1);
+ 			break;
+@@ -2490,6 +2491,7 @@ static void rt2800_config_channel_rf3052
+ 		switch (rt2x00dev->default_ant.rx_chain_num) {
+ 		case 1:
+ 			rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 1);
++			/* fall through */
+ 		case 2:
+ 			rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 1);
+ 			break;
+@@ -9457,8 +9459,10 @@ static int rt2800_probe_hw_mode(struct r
+ 	switch (rx_chains) {
+ 	case 3:
+ 		spec->ht.mcs.rx_mask[2] = 0xff;
++		/* fall through */
+ 	case 2:
+ 		spec->ht.mcs.rx_mask[1] = 0xff;
++		/* fall through */
+ 	case 1:
+ 		spec->ht.mcs.rx_mask[0] = 0xff;
+ 		spec->ht.mcs.rx_mask[4] = 0x1; /* MCS32 */
diff --git a/package/kernel/mac80211/patches/rt2x00/010-rt2x00-rt61pci-mark-expected-switch-fall-through.patch b/package/kernel/mac80211/patches/rt2x00/010-rt2x00-rt61pci-mark-expected-switch-fall-through.patch
new file mode 100644
index 0000000000..5b0f96d293
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/010-rt2x00-rt61pci-mark-expected-switch-fall-through.patch
@@ -0,0 +1,25 @@
+From 641dd8068ecb078e7d12efe465df202bc16ca5eb Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 22 Oct 2018 22:46:47 +0200
+Subject: [PATCH 10/28] rt2x00: rt61pci: mark expected switch fall-through
+
+In preparation to enabling -Wimplicit-fallthrough, mark switch cases
+where we are expecting to fall through.
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+@@ -2226,7 +2226,7 @@ static void rt61pci_txdone(struct rt2x00
+ 			break;
+ 		case 6: /* Failure, excessive retries */
+ 			__set_bit(TXDONE_EXCESSIVE_RETRY, &txdesc.flags);
+-			/* Don't break, this is a failed frame! */
++			/* Fall through - this is a failed frame! */
+ 		default: /* Failure */
+ 			__set_bit(TXDONE_FAILURE, &txdesc.flags);
+ 		}
diff --git a/package/kernel/mac80211/patches/rt2x00/011-cross-tree-phase-out-dma_zalloc_coherent.patch b/package/kernel/mac80211/patches/rt2x00/011-cross-tree-phase-out-dma_zalloc_coherent.patch
new file mode 100644
index 0000000000..8100eb063b
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/011-cross-tree-phase-out-dma_zalloc_coherent.patch
@@ -0,0 +1,40 @@
+From 750afb08ca71310fcf0c4e2cb1565c63b8235b60 Mon Sep 17 00:00:00 2001
+From: Luis Chamberlain <mcgrof@kernel.org>
+Date: Fri, 4 Jan 2019 09:23:09 +0100
+Subject: [PATCH 11/28] cross-tree: phase out dma_zalloc_coherent()
+
+We already need to zero out memory for dma_alloc_coherent(), as such
+using dma_zalloc_coherent() is superflous. Phase it out.
+
+This change was generated with the following Coccinelle SmPL patch:
+
+@ replace_dma_zalloc_coherent @
+expression dev, size, data, handle, flags;
+@@
+
+-dma_zalloc_coherent(dev, size, handle, flags)
++dma_alloc_coherent(dev, size, handle, flags)
+
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+[hch: re-ran the script on the latest tree]
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00mmio.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.c
+@@ -119,9 +119,9 @@ static int rt2x00mmio_alloc_queue_dma(st
+ 	/*
+ 	 * Allocate DMA memory for descriptor and buffer.
+ 	 */
+-	addr = dma_zalloc_coherent(rt2x00dev->dev,
+-				   queue->limit * queue->desc_size, &dma,
+-				   GFP_KERNEL);
++	addr = dma_alloc_coherent(rt2x00dev->dev,
++				  queue->limit * queue->desc_size, &dma,
++				  GFP_KERNEL);
+ 	if (!addr)
+ 		return -ENOMEM;
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/012-rt2x00-reduce-tx-power-to-nominal-level-on-RT6352.patch b/package/kernel/mac80211/patches/rt2x00/012-rt2x00-reduce-tx-power-to-nominal-level-on-RT6352.patch
new file mode 100644
index 0000000000..a07832e97c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/012-rt2x00-reduce-tx-power-to-nominal-level-on-RT6352.patch
@@ -0,0 +1,32 @@
+From c2e28ef7711ffcb083474ee5f154264c6ec1ec07 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomislav=20Po=C5=BEega?= <pozega.tomislav@gmail.com>
+Date: Thu, 27 Dec 2018 15:05:25 +0100
+Subject: [PATCH 12/28] rt2x00: reduce tx power to nominal level on RT6352
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Current implementation of RT6352 support provides too high tx power
+at least on iPA/eLNA devices. Reduce amplification of variable gain
+amplifier by 6dB to match board target power of 17dBm.
+Transmited signal strength with this patch is similar to that of
+stock firmware or pandorabox firmware. Throughput measured with iperf
+improves. Device tested: Xiaomi Miwifi Mini.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5477,7 +5477,7 @@ static int rt2800_init_registers(struct
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, MIMO_PS_CFG, 0x00000002);
+ 		rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x00150F0F);
+-		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x06060606);
++		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
+ 		rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
+ 		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN, 0x6C6C666C);
diff --git a/package/kernel/mac80211/patches/rt2x00/013-rt2x00-Work-around-a-firmware-bug-with-shared-keys.patch b/package/kernel/mac80211/patches/rt2x00/013-rt2x00-Work-around-a-firmware-bug-with-shared-keys.patch
new file mode 100644
index 0000000000..dc884c17d2
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/013-rt2x00-Work-around-a-firmware-bug-with-shared-keys.patch
@@ -0,0 +1,143 @@
+From a4296994eb8061ee3455721a296c387c639bf635 Mon Sep 17 00:00:00 2001
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Date: Tue, 15 Jan 2019 14:01:29 +0000
+Subject: [PATCH 13/28] rt2x00: Work around a firmware bug with shared keys
+
+Apparently the rt2x61 firmware fails temporarily to decode
+broadcast packets if the shared keys are not assigned
+in the "correct" sequence. At the same time unicast
+packets work fine, since they are encrypted with the
+pairwise key.
+
+At least with WPA2 CCMP mode the shared keys are
+set in the following sequence: keyidx=1, 2, 1, 2.
+After a while only keyidx 2 gets decrypted, and
+keyidx 1 is ignored, probably because there is never
+a keyidx 3.
+
+Symptoms are arping -b works for 10 minutes, since
+keyidx=2 is used for broadcast, and then it stops
+working for 10 minutes, because keyidx=1 is used.
+That failure mode repeats forever.
+
+Note, the firmware does not even know which keyidx
+corresponds to which hw_key_idx so the firmware is
+trying to be smarter than the driver, which is bound
+to fail.
+
+As workaround the function rt61pci_config_shared_key
+requests software decryption of the shared keys,
+by returning EOPNOTSUPP. However, pairwise keys are
+still handled by hardware which works just fine.
+
+Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt61pci.c | 93 +-------------------
+ 1 file changed, 4 insertions(+), 89 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+@@ -321,97 +321,12 @@ static int rt61pci_config_shared_key(str
+ 				     struct rt2x00lib_crypto *crypto,
+ 				     struct ieee80211_key_conf *key)
+ {
+-	struct hw_key_entry key_entry;
+-	struct rt2x00_field32 field;
+-	u32 mask;
+-	u32 reg;
+-
+-	if (crypto->cmd == SET_KEY) {
+-		/*
+-		 * rt2x00lib can't determine the correct free
+-		 * key_idx for shared keys. We have 1 register
+-		 * with key valid bits. The goal is simple, read
+-		 * the register, if that is full we have no slots
+-		 * left.
+-		 * Note that each BSS is allowed to have up to 4
+-		 * shared keys, so put a mask over the allowed
+-		 * entries.
+-		 */
+-		mask = (0xf << crypto->bssidx);
+-
+-		reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR0);
+-		reg &= mask;
+-
+-		if (reg && reg == mask)
+-			return -ENOSPC;
+-
+-		key->hw_key_idx += reg ? ffz(reg) : 0;
+-
+-		/*
+-		 * Upload key to hardware
+-		 */
+-		memcpy(key_entry.key, crypto->key,
+-		       sizeof(key_entry.key));
+-		memcpy(key_entry.tx_mic, crypto->tx_mic,
+-		       sizeof(key_entry.tx_mic));
+-		memcpy(key_entry.rx_mic, crypto->rx_mic,
+-		       sizeof(key_entry.rx_mic));
+-
+-		reg = SHARED_KEY_ENTRY(key->hw_key_idx);
+-		rt2x00mmio_register_multiwrite(rt2x00dev, reg,
+-					       &key_entry, sizeof(key_entry));
+-
+-		/*
+-		 * The cipher types are stored over 2 registers.
+-		 * bssidx 0 and 1 keys are stored in SEC_CSR1 and
+-		 * bssidx 1 and 2 keys are stored in SEC_CSR5.
+-		 * Using the correct defines correctly will cause overhead,
+-		 * so just calculate the correct offset.
+-		 */
+-		if (key->hw_key_idx < 8) {
+-			field.bit_offset = (3 * key->hw_key_idx);
+-			field.bit_mask = 0x7 << field.bit_offset;
+-
+-			reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR1);
+-			rt2x00_set_field32(&reg, field, crypto->cipher);
+-			rt2x00mmio_register_write(rt2x00dev, SEC_CSR1, reg);
+-		} else {
+-			field.bit_offset = (3 * (key->hw_key_idx - 8));
+-			field.bit_mask = 0x7 << field.bit_offset;
+-
+-			reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR5);
+-			rt2x00_set_field32(&reg, field, crypto->cipher);
+-			rt2x00mmio_register_write(rt2x00dev, SEC_CSR5, reg);
+-		}
+-
+-		/*
+-		 * The driver does not support the IV/EIV generation
+-		 * in hardware. However it doesn't support the IV/EIV
+-		 * inside the ieee80211 frame either, but requires it
+-		 * to be provided separately for the descriptor.
+-		 * rt2x00lib will cut the IV/EIV data out of all frames
+-		 * given to us by mac80211, but we must tell mac80211
+-		 * to generate the IV/EIV data.
+-		 */
+-		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+-	}
+-
+ 	/*
+-	 * SEC_CSR0 contains only single-bit fields to indicate
+-	 * a particular key is valid. Because using the FIELD32()
+-	 * defines directly will cause a lot of overhead, we use
+-	 * a calculation to determine the correct bit directly.
++	 * Let the software handle the shared keys,
++	 * since the hardware decryption does not work reliably,
++	 * because the firmware does not know the key's keyidx.
+ 	 */
+-	mask = 1 << key->hw_key_idx;
+-
+-	reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR0);
+-	if (crypto->cmd == SET_KEY)
+-		reg |= mask;
+-	else if (crypto->cmd == DISABLE_KEY)
+-		reg &= ~mask;
+-	rt2x00mmio_register_write(rt2x00dev, SEC_CSR0, reg);
+-
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
diff --git a/package/kernel/mac80211/patches/rt2x00/014-rt2x00-no-need-to-check-return-value-of-debugfs_crea.patch b/package/kernel/mac80211/patches/rt2x00/014-rt2x00-no-need-to-check-return-value-of-debugfs_crea.patch
new file mode 100644
index 0000000000..26f2df10e0
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/014-rt2x00-no-need-to-check-return-value-of-debugfs_crea.patch
@@ -0,0 +1,107 @@
+From 2587791d57588562c21e5ef7e678f02ab2f3eb82 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 22 Jan 2019 16:21:34 +0100
+Subject: [PATCH 14/28] rt2x00: no need to check return value of debugfs_create
+ functions
+
+When calling debugfs functions, there is no need to ever check the
+return value.  The function can work or not, but the code logic should
+never do something different based on this.
+
+Cc: Stanislaw Gruszka <sgruszka@redhat.com>
+Cc: Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: linux-wireless@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2x00debug.c  | 27 -------------------
+ 1 file changed, 27 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
+@@ -656,36 +656,24 @@ void rt2x00debug_register(struct rt2x00_
+ 	intf->driver_folder =
+ 	    debugfs_create_dir(intf->rt2x00dev->ops->name,
+ 			       rt2x00dev->hw->wiphy->debugfsdir);
+-	if (IS_ERR(intf->driver_folder) || !intf->driver_folder)
+-		goto exit;
+ 
+ 	intf->driver_entry =
+ 	    rt2x00debug_create_file_driver("driver", intf, &intf->driver_blob);
+-	if (IS_ERR(intf->driver_entry) || !intf->driver_entry)
+-		goto exit;
+ 
+ 	intf->chipset_entry =
+ 	    rt2x00debug_create_file_chipset("chipset",
+ 					    intf, &intf->chipset_blob);
+-	if (IS_ERR(intf->chipset_entry) || !intf->chipset_entry)
+-		goto exit;
+ 
+ 	intf->dev_flags = debugfs_create_file("dev_flags", 0400,
+ 					      intf->driver_folder, intf,
+ 					      &rt2x00debug_fop_dev_flags);
+-	if (IS_ERR(intf->dev_flags) || !intf->dev_flags)
+-		goto exit;
+ 
+ 	intf->cap_flags = debugfs_create_file("cap_flags", 0400,
+ 					      intf->driver_folder, intf,
+ 					      &rt2x00debug_fop_cap_flags);
+-	if (IS_ERR(intf->cap_flags) || !intf->cap_flags)
+-		goto exit;
+ 
+ 	intf->register_folder =
+ 	    debugfs_create_dir("register", intf->driver_folder);
+-	if (IS_ERR(intf->register_folder) || !intf->register_folder)
+-		goto exit;
+ 
+ #define RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(__intf, __name)		\
+ ({									\
+@@ -695,9 +683,6 @@ void rt2x00debug_register(struct rt2x00_
+ 					   0600,			\
+ 					   (__intf)->register_folder,	\
+ 					   &(__intf)->offset_##__name);	\
+-		if (IS_ERR((__intf)->__name##_off_entry) ||		\
+-		    !(__intf)->__name##_off_entry)			\
+-			goto exit;					\
+ 									\
+ 		(__intf)->__name##_val_entry =				\
+ 			debugfs_create_file(__stringify(__name) "_value", \
+@@ -705,9 +690,6 @@ void rt2x00debug_register(struct rt2x00_
+ 					    (__intf)->register_folder,	\
+ 					    (__intf),			\
+ 					    &rt2x00debug_fop_##__name); \
+-		if (IS_ERR((__intf)->__name##_val_entry) ||		\
+-		    !(__intf)->__name##_val_entry)			\
+-			goto exit;					\
+ 	}								\
+ })
+ 
+@@ -721,15 +703,10 @@ void rt2x00debug_register(struct rt2x00_
+ 
+ 	intf->queue_folder =
+ 	    debugfs_create_dir("queue", intf->driver_folder);
+-	if (IS_ERR(intf->queue_folder) || !intf->queue_folder)
+-		goto exit;
+ 
+ 	intf->queue_frame_dump_entry =
+ 		debugfs_create_file("dump", 0400, intf->queue_folder,
+ 				    intf, &rt2x00debug_fop_queue_dump);
+-	if (IS_ERR(intf->queue_frame_dump_entry)
+-		|| !intf->queue_frame_dump_entry)
+-		goto exit;
+ 
+ 	skb_queue_head_init(&intf->frame_dump_skbqueue);
+ 	init_waitqueue_head(&intf->frame_dump_waitqueue);
+@@ -747,10 +724,6 @@ void rt2x00debug_register(struct rt2x00_
+ #endif
+ 
+ 	return;
+-
+-exit:
+-	rt2x00debug_deregister(rt2x00dev);
+-	rt2x00_err(rt2x00dev, "Failed to register debug handler\n");
+ }
+ 
+ void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/015-rt2x00-remove-unneeded-check.patch b/package/kernel/mac80211/patches/rt2x00/015-rt2x00-remove-unneeded-check.patch
new file mode 100644
index 0000000000..50e7de0855
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/015-rt2x00-remove-unneeded-check.patch
@@ -0,0 +1,137 @@
+From 17ae2acd1a6f5148edd80d84194e5d7c80be360e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomislav=20Po=C5=BEega?= <pozega.tomislav@gmail.com>
+Date: Wed, 13 Feb 2019 11:09:12 +0100
+Subject: [PATCH 15/28] rt2x00: remove unneeded check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Remove band check from rf53xx channel config routine since all chips
+using it are single band.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 103 +++++++++---------
+ 1 file changed, 50 insertions(+), 53 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2966,6 +2966,7 @@ static void rt2800_config_channel_rf53xx
+ 					 struct channel_info *info)
+ {
+ 	u8 rfcsr;
++	int idx = rf->channel-1;
+ 
+ 	rt2800_rfcsr_write(rt2x00dev, 8, rf->rf1);
+ 	rt2800_rfcsr_write(rt2x00dev, 9, rf->rf3);
+@@ -3003,60 +3004,56 @@ static void rt2800_config_channel_rf53xx
+ 
+ 	rt2800_freq_cal_mode1(rt2x00dev);
+ 
+-	if (rf->channel <= 14) {
+-		int idx = rf->channel-1;
++	if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
++		if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
++			/* r55/r59 value array of channel 1~14 */
++			static const char r55_bt_rev[] = {0x83, 0x83,
++				0x83, 0x73, 0x73, 0x63, 0x53, 0x53,
++				0x53, 0x43, 0x43, 0x43, 0x43, 0x43};
++			static const char r59_bt_rev[] = {0x0e, 0x0e,
++				0x0e, 0x0e, 0x0e, 0x0b, 0x0a, 0x09,
++				0x07, 0x07, 0x07, 0x07, 0x07, 0x07};
++
++			rt2800_rfcsr_write(rt2x00dev, 55,
++					   r55_bt_rev[idx]);
++			rt2800_rfcsr_write(rt2x00dev, 59,
++					   r59_bt_rev[idx]);
++		} else {
++			static const char r59_bt[] = {0x8b, 0x8b, 0x8b,
++				0x8b, 0x8b, 0x8b, 0x8b, 0x8a, 0x89,
++				0x88, 0x88, 0x86, 0x85, 0x84};
+ 
+-		if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
+-			if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
+-				/* r55/r59 value array of channel 1~14 */
+-				static const char r55_bt_rev[] = {0x83, 0x83,
+-					0x83, 0x73, 0x73, 0x63, 0x53, 0x53,
+-					0x53, 0x43, 0x43, 0x43, 0x43, 0x43};
+-				static const char r59_bt_rev[] = {0x0e, 0x0e,
+-					0x0e, 0x0e, 0x0e, 0x0b, 0x0a, 0x09,
+-					0x07, 0x07, 0x07, 0x07, 0x07, 0x07};
+-
+-				rt2800_rfcsr_write(rt2x00dev, 55,
+-						   r55_bt_rev[idx]);
+-				rt2800_rfcsr_write(rt2x00dev, 59,
+-						   r59_bt_rev[idx]);
+-			} else {
+-				static const char r59_bt[] = {0x8b, 0x8b, 0x8b,
+-					0x8b, 0x8b, 0x8b, 0x8b, 0x8a, 0x89,
+-					0x88, 0x88, 0x86, 0x85, 0x84};
++			rt2800_rfcsr_write(rt2x00dev, 59, r59_bt[idx]);
++		}
++	} else {
++		if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
++			static const char r55_nonbt_rev[] = {0x23, 0x23,
++				0x23, 0x23, 0x13, 0x13, 0x03, 0x03,
++				0x03, 0x03, 0x03, 0x03, 0x03, 0x03};
++			static const char r59_nonbt_rev[] = {0x07, 0x07,
++				0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
++				0x07, 0x07, 0x06, 0x05, 0x04, 0x04};
++
++			rt2800_rfcsr_write(rt2x00dev, 55,
++					   r55_nonbt_rev[idx]);
++			rt2800_rfcsr_write(rt2x00dev, 59,
++					   r59_nonbt_rev[idx]);
++		} else if (rt2x00_rt(rt2x00dev, RT5390) ||
++			   rt2x00_rt(rt2x00dev, RT5392) ||
++			   rt2x00_rt(rt2x00dev, RT6352)) {
++			static const char r59_non_bt[] = {0x8f, 0x8f,
++				0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8d,
++				0x8a, 0x88, 0x88, 0x87, 0x87, 0x86};
++
++			rt2800_rfcsr_write(rt2x00dev, 59,
++					   r59_non_bt[idx]);
++		} else if (rt2x00_rt(rt2x00dev, RT5350)) {
++			static const char r59_non_bt[] = {0x0b, 0x0b,
++				0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0a,
++				0x0a, 0x09, 0x08, 0x07, 0x07, 0x06};
+ 
+-				rt2800_rfcsr_write(rt2x00dev, 59, r59_bt[idx]);
+-			}
+-		} else {
+-			if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
+-				static const char r55_nonbt_rev[] = {0x23, 0x23,
+-					0x23, 0x23, 0x13, 0x13, 0x03, 0x03,
+-					0x03, 0x03, 0x03, 0x03, 0x03, 0x03};
+-				static const char r59_nonbt_rev[] = {0x07, 0x07,
+-					0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
+-					0x07, 0x07, 0x06, 0x05, 0x04, 0x04};
+-
+-				rt2800_rfcsr_write(rt2x00dev, 55,
+-						   r55_nonbt_rev[idx]);
+-				rt2800_rfcsr_write(rt2x00dev, 59,
+-						   r59_nonbt_rev[idx]);
+-			} else if (rt2x00_rt(rt2x00dev, RT5390) ||
+-				   rt2x00_rt(rt2x00dev, RT5392) ||
+-				   rt2x00_rt(rt2x00dev, RT6352)) {
+-				static const char r59_non_bt[] = {0x8f, 0x8f,
+-					0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8d,
+-					0x8a, 0x88, 0x88, 0x87, 0x87, 0x86};
+-
+-				rt2800_rfcsr_write(rt2x00dev, 59,
+-						   r59_non_bt[idx]);
+-			} else if (rt2x00_rt(rt2x00dev, RT5350)) {
+-				static const char r59_non_bt[] = {0x0b, 0x0b,
+-					0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0a,
+-					0x0a, 0x09, 0x08, 0x07, 0x07, 0x06};
+-
+-				rt2800_rfcsr_write(rt2x00dev, 59,
+-						   r59_non_bt[idx]);
+-			}
++			rt2800_rfcsr_write(rt2x00dev, 59,
++					   r59_non_bt[idx]);
+ 		}
+ 	}
+ }
diff --git a/package/kernel/mac80211/patches/rt2x00/016-rt2x00-remove-confusing-AGC-register.patch b/package/kernel/mac80211/patches/rt2x00/016-rt2x00-remove-confusing-AGC-register.patch
new file mode 100644
index 0000000000..8f3791d2ce
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/016-rt2x00-remove-confusing-AGC-register.patch
@@ -0,0 +1,34 @@
+From 5991a2ecd070ce5ef646b4e8e0bc8d99110604ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomislav=20Po=C5=BEega?= <pozega.tomislav@gmail.com>
+Date: Wed, 13 Feb 2019 11:09:13 +0100
+Subject: [PATCH 16/28] rt2x00: remove confusing AGC register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Register 66 was causing issues on RT6352 if set to the same value as
+in MTK driver. With 1c reg value device was working fine in both HT20
+and HT40 modes.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3983,11 +3983,7 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 196, reg);
+ 
+ 		/* AGC init */
+-		if (rt2x00_rt(rt2x00dev, RT6352))
+-			reg = 0x04;
+-		else
+-			reg = rf->channel <= 14 ? 0x1c : 0x24;
+-
++		reg = rf->channel <= 14 ? 0x1c : 0x24;
+ 		reg += 2 * rt2x00dev->lna_gain;
+ 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/017-rt2800-enable-TX_PIN_CFG_LNA_PE_-bits-per-band.patch b/package/kernel/mac80211/patches/rt2x00/017-rt2800-enable-TX_PIN_CFG_LNA_PE_-bits-per-band.patch
new file mode 100644
index 0000000000..eb82d6275b
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/017-rt2800-enable-TX_PIN_CFG_LNA_PE_-bits-per-band.patch
@@ -0,0 +1,47 @@
+From 9ad3b55654455258a9463384edb40077439d879f Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 13 Feb 2019 11:09:14 +0100
+Subject: [PATCH 17/28] rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band
+
+Do not enable TX_PIN_CFG_LNA_PE_A* bits for 2.4GHz band and
+vice versa TX_PIN_CFG_LNA_PE_G* bits for 5GHz.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3893,18 +3893,24 @@ static void rt2800_config_channel(struct
+ 	switch (rt2x00dev->default_ant.rx_chain_num) {
+ 	case 3:
+ 		/* Turn on tertiary LNAs */
+-		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A2_EN, 1);
+-		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G2_EN, 1);
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A2_EN,
++				   rf->channel > 14);
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G2_EN,
++				   rf->channel <= 14);
+ 		/* fall-through */
+ 	case 2:
+ 		/* Turn on secondary LNAs */
+-		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN, 1);
+-		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN, 1);
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN,
++				   rf->channel > 14);
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN,
++				   rf->channel <= 14);
+ 		/* fall-through */
+ 	case 1:
+ 		/* Turn on primary LNAs */
+-		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
+-		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN,
++				   rf->channel > 14);
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN,
++				   rf->channel <= 14);
+ 		break;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/018-rt2800-enable-TX_PIN_CFG_RFRX_EN-only-for-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/018-rt2800-enable-TX_PIN_CFG_RFRX_EN-only-for-MT7620.patch
new file mode 100644
index 0000000000..3a4c2cd8e5
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/018-rt2800-enable-TX_PIN_CFG_RFRX_EN-only-for-MT7620.patch
@@ -0,0 +1,41 @@
+From 7aca14885edeab536a8cbe1e7cfeadd4c3310b9b Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 13 Feb 2019 11:09:15 +0100
+Subject: [PATCH 18/28] rt2800: enable TX_PIN_CFG_RFRX_EN only for MT7620
+
+The TX_PIN_CFG_RFRX_EN bit was not set on other devices than MT7620,
+restore old behavaviour since setting this bit maight not be
+correct for older devices.
+
+Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3858,10 +3858,12 @@ static void rt2800_config_channel(struct
+ 	if (rt2x00_rt(rt2x00dev, RT3572))
+ 		rt2800_rfcsr_write(rt2x00dev, 8, 0);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT6352))
++	if (rt2x00_rt(rt2x00dev, RT6352)) {
+ 		tx_pin = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
+-	else
++		rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFRX_EN, 1);
++	} else {
+ 		tx_pin = 0;
++	}
+ 
+ 	switch (rt2x00dev->default_ant.tx_chain_num) {
+ 	case 3:
+@@ -3916,7 +3918,6 @@ static void rt2800_config_channel(struct
+ 
+ 	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
+ 	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
+-	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFRX_EN, 1); /* mt7620 */
+ 
+ 	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/019-rt2800-comment-and-simplify-AGC-init-for-RT6352.patch b/package/kernel/mac80211/patches/rt2x00/019-rt2800-comment-and-simplify-AGC-init-for-RT6352.patch
new file mode 100644
index 0000000000..4d0beb263d
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/019-rt2800-comment-and-simplify-AGC-init-for-RT6352.patch
@@ -0,0 +1,33 @@
+From c7ff1bfeaf1ca69e3e401be211b55d1738d0c5fc Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 13 Feb 2019 11:09:16 +0100
+Subject: [PATCH 19/28] rt2800: comment and simplify AGC init for RT6352
+
+We do not need separate lines for calculating register values.
+Also add comment that value is different than in vendor driver.
+
+Suggested-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3989,9 +3989,12 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 195, 141);
+ 		rt2800_bbp_write(rt2x00dev, 196, reg);
+ 
+-		/* AGC init */
+-		reg = rf->channel <= 14 ? 0x1c : 0x24;
+-		reg += 2 * rt2x00dev->lna_gain;
++		/* AGC init.
++		 * Despite the vendor driver using different values here for
++		 * RT6352 chip, we use 0x1c for now. This may have to be changed
++		 * once TSSI got implemented.
++		 */
++		reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2*rt2x00dev->lna_gain;
+ 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+ 
+ 		rt2800_iq_calibrate(rt2x00dev, rf->channel);
diff --git a/package/kernel/mac80211/patches/rt2x00/020-cfg80211-add-ratelimited-variants-of-err-and-warn.patch b/package/kernel/mac80211/patches/rt2x00/020-cfg80211-add-ratelimited-variants-of-err-and-warn.patch
new file mode 100644
index 0000000000..bea1884489
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/020-cfg80211-add-ratelimited-variants-of-err-and-warn.patch
@@ -0,0 +1,39 @@
+From patchwork Tue Mar 12 09:51:40 2019
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10848957
+X-Patchwork-Delegate: johannes@sipsolutions.net
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+To: linux-wireless@vger.kernel.org
+Cc: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>,
+ Daniel Golle <daniel@makrotopia.org>, Felix Fietkau <nbd@nbd.name>,
+ Mathias Kresin <dev@kresin.me>
+Subject: [PATCH v3 1/4] cfg80211: add ratelimited variants of err and warn
+Date: Tue, 12 Mar 2019 10:51:40 +0100
+Message-Id: <1552384303-29529-2-git-send-email-sgruszka@redhat.com>
+In-Reply-To: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+References: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+
+wiphy_{err,warn}_ratelimited will be used by rt2x00
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ include/net/cfg80211.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6597,6 +6597,11 @@ int cfg80211_external_auth_request(struc
+ #define wiphy_info(wiphy, format, args...)			\
+ 	dev_info(&(wiphy)->dev, format, ##args)
+ 
++#define wiphy_err_ratelimited(wiphy, format, args...)		\
++	dev_err_ratelimited(&(wiphy)->dev, format, ##args)
++#define wiphy_warn_ratelimited(wiphy, format, args...)		\
++	dev_warn_ratelimited(&(wiphy)->dev, format, ##args)
++
+ #define wiphy_debug(wiphy, format, args...)			\
+ 	wiphy_printk(KERN_DEBUG, wiphy, format, ##args)
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/021-rt2x00-use-ratelimited-variants-dev_warn-dev_err.patch b/package/kernel/mac80211/patches/rt2x00/021-rt2x00-use-ratelimited-variants-dev_warn-dev_err.patch
new file mode 100644
index 0000000000..2d74a71e1f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/021-rt2x00-use-ratelimited-variants-dev_warn-dev_err.patch
@@ -0,0 +1,42 @@
+From patchwork Tue Mar 12 09:51:41 2019
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10848959
+X-Patchwork-Delegate: kvalo@adurom.com
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+To: linux-wireless@vger.kernel.org
+Cc: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>,
+ Daniel Golle <daniel@makrotopia.org>, Felix Fietkau <nbd@nbd.name>,
+ Mathias Kresin <dev@kresin.me>
+Subject: [PATCH v3 2/4] rt2x00: use ratelimited variants dev_warn/dev_err
+Date: Tue, 12 Mar 2019 10:51:41 +0100
+Message-Id: <1552384303-29529-3-git-send-email-sgruszka@redhat.com>
+In-Reply-To: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+References: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+
+As reported by Randy we can overwhelm logs on some USB error conditions.
+To avoid that use dev_warn_ratelimited() and dev_err_ratelimitd().
+
+Reported-and-tested-by: Randy Oostdyk <linux-kernel@oostdyk.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -69,10 +69,10 @@
+ 	printk(KERN_ERR KBUILD_MODNAME ": %s: Error - " fmt,		\
+ 	       __func__, ##__VA_ARGS__)
+ #define rt2x00_err(dev, fmt, ...)					\
+-	wiphy_err((dev)->hw->wiphy, "%s: Error - " fmt,			\
++	wiphy_err_ratelimited((dev)->hw->wiphy, "%s: Error - " fmt,	\
+ 		  __func__, ##__VA_ARGS__)
+ #define rt2x00_warn(dev, fmt, ...)					\
+-	wiphy_warn((dev)->hw->wiphy, "%s: Warning - " fmt,		\
++	wiphy_warn_ratelimited((dev)->hw->wiphy, "%s: Warning - " fmt,	\
+ 		   __func__, ##__VA_ARGS__)
+ #define rt2x00_info(dev, fmt, ...)					\
+ 	wiphy_info((dev)->hw->wiphy, "%s: Info - " fmt,			\
diff --git a/package/kernel/mac80211/patches/rt2x00/022-rt2x00-check-number-of-EPROTO-errors.patch b/package/kernel/mac80211/patches/rt2x00/022-rt2x00-check-number-of-EPROTO-errors.patch
new file mode 100644
index 0000000000..251ac287bf
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/022-rt2x00-check-number-of-EPROTO-errors.patch
@@ -0,0 +1,96 @@
+From patchwork Tue Mar 12 09:51:42 2019
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10848961
+X-Patchwork-Delegate: kvalo@adurom.com
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+To: linux-wireless@vger.kernel.org
+Cc: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>,
+ Daniel Golle <daniel@makrotopia.org>, Felix Fietkau <nbd@nbd.name>,
+ Mathias Kresin <dev@kresin.me>
+Subject: [PATCH v3 3/4] rt2x00: check number of EPROTO errors
+Date: Tue, 12 Mar 2019 10:51:42 +0100
+Message-Id: <1552384303-29529-4-git-send-email-sgruszka@redhat.com>
+In-Reply-To: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+References: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+
+Some USB host devices/drivers on some conditions can always return
+EPROTO error on submitted URBs. That can cause infinity loop in the
+rt2x00 driver.
+
+Since we can have single EPROTO errors we can not mark as device as
+removed to avoid infinity loop. However we can count consecutive
+EPROTO errors and mark device as removed if get lot of it.
+I choose number 10 as threshold.
+
+Reported-and-tested-by: Randy Oostdyk <linux-kernel@oostdyk.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h    |  1 +
+ drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 22 +++++++++++++++++++---
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -1017,6 +1017,7 @@ struct rt2x00_dev {
+ 	unsigned int extra_tx_headroom;
+ 
+ 	struct usb_anchor *anchor;
++	unsigned int num_proto_errs;
+ 
+ 	/* Clock for System On Chip devices. */
+ 	struct clk *clk;
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+@@ -31,6 +31,22 @@
+ #include "rt2x00.h"
+ #include "rt2x00usb.h"
+ 
++static bool rt2x00usb_check_usb_error(struct rt2x00_dev *rt2x00dev, int status)
++{
++	if (status == -ENODEV || status == -ENOENT)
++		return true;
++
++	if (status == -EPROTO || status == -ETIMEDOUT)
++		rt2x00dev->num_proto_errs++;
++	else
++		rt2x00dev->num_proto_errs = 0;
++
++	if (rt2x00dev->num_proto_errs > 3)
++		return true;
++
++	return false;
++}
++
+ /*
+  * Interfacing with the HW.
+  */
+@@ -57,7 +73,7 @@ int rt2x00usb_vendor_request(struct rt2x
+ 		if (status >= 0)
+ 			return 0;
+ 
+-		if (status == -ENODEV || status == -ENOENT) {
++		if (rt2x00usb_check_usb_error(rt2x00dev, status)) {
+ 			/* Device has disappeared. */
+ 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 			break;
+@@ -321,7 +337,7 @@ static bool rt2x00usb_kick_tx_entry(stru
+ 
+ 	status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+ 	if (status) {
+-		if (status == -ENODEV || status == -ENOENT)
++		if (rt2x00usb_check_usb_error(rt2x00dev, status))
+ 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+ 		rt2x00lib_dmadone(entry);
+@@ -410,7 +426,7 @@ static bool rt2x00usb_kick_rx_entry(stru
+ 
+ 	status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+ 	if (status) {
+-		if (status == -ENODEV || status == -ENOENT)
++		if (rt2x00usb_check_usb_error(rt2x00dev, status))
+ 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+ 		rt2x00lib_dmadone(entry);
diff --git a/package/kernel/mac80211/patches/rt2x00/023-rt2x00-do-not-print-error-when-queue-is-full.patch b/package/kernel/mac80211/patches/rt2x00/023-rt2x00-do-not-print-error-when-queue-is-full.patch
new file mode 100644
index 0000000000..7e2f2193be
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/023-rt2x00-do-not-print-error-when-queue-is-full.patch
@@ -0,0 +1,43 @@
+From patchwork Tue Mar 12 09:51:43 2019
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10848963
+X-Patchwork-Delegate: kvalo@adurom.com
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+To: linux-wireless@vger.kernel.org
+Cc: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>,
+ Daniel Golle <daniel@makrotopia.org>, Felix Fietkau <nbd@nbd.name>,
+ Mathias Kresin <dev@kresin.me>
+Subject: [PATCH v3 4/4] rt2x00: do not print error when queue is full
+Date: Tue, 12 Mar 2019 10:51:43 +0100
+Message-Id: <1552384303-29529-5-git-send-email-sgruszka@redhat.com>
+In-Reply-To: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+References: <1552384303-29529-1-git-send-email-sgruszka@redhat.com>
+
+For unknown reasons printk() on some context can cause CPU hung on
+embedded MT7620 AP/router MIPS platforms. What can result on wifi
+disconnects.
+
+This patch move queue full messages to debug level what is consistent
+with other mac80211 drivers which drop packet silently if tx queue is
+full. This make MT7620 OpenWRT routers more stable, what was reported
+by various users.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -671,7 +671,7 @@ int rt2x00queue_write_tx_frame(struct da
+ 	spin_lock(&queue->tx_lock);
+ 
+ 	if (unlikely(rt2x00queue_full(queue))) {
+-		rt2x00_err(queue->rt2x00dev, "Dropping frame due to full tx queue %d\n",
++		rt2x00_dbg(queue->rt2x00dev, "Dropping frame due to full tx queue %d\n",
+ 			   queue->qid);
+ 		ret = -ENOBUFS;
+ 		goto out;
diff --git a/package/kernel/mac80211/patches/rt2x00/024-rt2800-partially-restore-old-mmio-txstatus-behaviour.patch b/package/kernel/mac80211/patches/rt2x00/024-rt2800-partially-restore-old-mmio-txstatus-behaviour.patch
new file mode 100644
index 0000000000..52314a79ae
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/024-rt2800-partially-restore-old-mmio-txstatus-behaviour.patch
@@ -0,0 +1,128 @@
+From 91a5340db0526b7263bc8da14b120ea3129b5f28 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:31 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804437
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 21/28] rt2800: partially restore old mmio txstatus behaviour
+
+Do not disable txstatus interrupt and add quota of processed tx statuses in
+one tasklet. Quota is needed to allow to fed device with new frames during
+processing of tx statuses.
+
+Patch fixes about 15% performance degradation on some scenarios coused by
+0b0d556e0ebb ("rt2800mmio: use txdone/txstatus routines from lib").
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    |  4 +--
+ .../net/wireless/ralink/rt2x00/rt2800lib.h    |  2 +-
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 30 +++++--------------
+ .../net/wireless/ralink/rt2x00/rt2800usb.c    |  2 +-
+ 4 files changed, 12 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1100,7 +1100,7 @@ void rt2800_txdone_entry(struct queue_en
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
+ 
+-void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
++void rt2800_txdone(struct rt2x00_dev *rt2x00dev, unsigned int quota)
+ {
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
+@@ -1108,7 +1108,7 @@ void rt2800_txdone(struct rt2x00_dev *rt
+ 	u8 qid;
+ 	bool match;
+ 
+-	while (kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
++	while (quota-- > 0 && kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
+ 		/*
+ 		 * TX_STA_FIFO_PID_QUEUE is a 2-bit field, thus qid is
+ 		 * guaranteed to be one of the TX QIDs .
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -195,7 +195,7 @@ void rt2800_process_rxwi(struct queue_en
+ 
+ void rt2800_txdone_entry(struct queue_entry *entry, u32 status, __le32 *txwi,
+ 			 bool match);
+-void rt2800_txdone(struct rt2x00_dev *rt2x00dev);
++void rt2800_txdone(struct rt2x00_dev *rt2x00dev, unsigned int quota);
+ void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev);
+ bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev);
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -255,20 +255,6 @@ void rt2800mmio_autowake_tasklet(unsigne
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
+ 
+-static void rt2800mmio_txdone(struct rt2x00_dev *rt2x00dev)
+-{
+-	bool timeout = false;
+-
+-	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
+-	       (timeout = rt2800_txstatus_timeout(rt2x00dev))) {
+-
+-		rt2800_txdone(rt2x00dev);
+-
+-		if (timeout)
+-			rt2800_txdone_nostatus(rt2x00dev);
+-	}
+-}
+-
+ static bool rt2800mmio_fetch_txstatus(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u32 status;
+@@ -305,14 +291,11 @@ void rt2800mmio_txstatus_tasklet(unsigne
+ {
+ 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+ 
+-	do {
+-		rt2800mmio_txdone(rt2x00dev);
++	rt2800_txdone(rt2x00dev, 16);
+ 
+-	} while (rt2800mmio_fetch_txstatus(rt2x00dev));
++	if (!kfifo_is_empty(&rt2x00dev->txstatus_fifo))
++		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
+ 
+-	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+-		rt2800mmio_enable_interrupt(rt2x00dev,
+-					    INT_SOURCE_CSR_TX_FIFO_STATUS);
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
+ 
+@@ -339,8 +322,10 @@ irqreturn_t rt2800mmio_interrupt(int irq
+ 	mask = ~reg;
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
++		rt2x00_set_field32(&mask, INT_MASK_CSR_TX_FIFO_STATUS, 1);
+ 		rt2800mmio_fetch_txstatus(rt2x00dev);
+-		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
++		if (!kfifo_is_empty(&rt2x00dev->txstatus_fifo))
++			tasklet_schedule(&rt2x00dev->txstatus_tasklet);
+ 	}
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_PRE_TBTT))
+@@ -500,7 +485,8 @@ void rt2800mmio_flush_queue(struct data_
+ 		 */
+ 		if (tx_queue) {
+ 			tasklet_disable(&rt2x00dev->txstatus_tasklet);
+-			rt2800mmio_txdone(rt2x00dev);
++			rt2800_txdone(rt2x00dev, UINT_MAX);
++			rt2800_txdone_nostatus(rt2x00dev);
+ 			tasklet_enable(&rt2x00dev->txstatus_tasklet);
+ 		}
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -480,7 +480,7 @@ static void rt2800usb_work_txdone(struct
+ 	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
+ 	       rt2800_txstatus_timeout(rt2x00dev)) {
+ 
+-		rt2800_txdone(rt2x00dev);
++		rt2800_txdone(rt2x00dev, UINT_MAX);
+ 
+ 		rt2800_txdone_nostatus(rt2x00dev);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/025-rt2800-new-flush-implementation-for-SoC-devices.patch b/package/kernel/mac80211/patches/rt2x00/025-rt2800-new-flush-implementation-for-SoC-devices.patch
new file mode 100644
index 0000000000..e3a914a0fa
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/025-rt2800-new-flush-implementation-for-SoC-devices.patch
@@ -0,0 +1,27 @@
+From 11f8ad1656035176bad9d89de7ea0e7fe6d82c32 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:32 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804439
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 22/28] rt2800: new flush implementation for SoC devices
+
+Use new flush_queue() calback for SoC devices, what was already done for
+PCIe devices.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -203,7 +203,7 @@ static const struct rt2x00lib_ops rt2800
+ 	.start_queue		= rt2800mmio_start_queue,
+ 	.kick_queue		= rt2800mmio_kick_queue,
+ 	.stop_queue		= rt2800mmio_stop_queue,
+-	.flush_queue		= rt2x00mmio_flush_queue,
++	.flush_queue		= rt2800mmio_flush_queue,
+ 	.write_tx_desc		= rt2800mmio_write_tx_desc,
+ 	.write_tx_data		= rt2800_write_tx_data,
+ 	.write_beacon		= rt2800_write_beacon,
diff --git a/package/kernel/mac80211/patches/rt2x00/026-rt2800-move-txstatus-pending-routine.patch b/package/kernel/mac80211/patches/rt2x00/026-rt2800-move-txstatus-pending-routine.patch
new file mode 100644
index 0000000000..e5bfbecd1e
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/026-rt2800-move-txstatus-pending-routine.patch
@@ -0,0 +1,106 @@
+From 2bbea7645c3d095014a080db170941818650e141 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:33 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804441
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 23/28] rt2800: move txstatus pending routine
+
+Move rt2800usb_txstatus_pending routine to rt2800lib. It will be reused
+by rt2800mmio code.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 17 ++++++++++++++
+ .../net/wireless/ralink/rt2x00/rt2800lib.h    |  1 +
+ .../net/wireless/ralink/rt2x00/rt2800usb.c    | 22 +++----------------
+ 3 files changed, 21 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1183,6 +1183,23 @@ bool rt2800_txstatus_timeout(struct rt2x
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txstatus_timeout);
+ 
++/*
++ * test if there is an entry in any TX queue for which DMA is done
++ * but the TX status has not been returned yet
++ */
++bool rt2800_txstatus_pending(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++
++	tx_queue_for_each(rt2x00dev, queue) {
++		if (rt2x00queue_get_entry(queue, Q_INDEX_DMA_DONE) !=
++		    rt2x00queue_get_entry(queue, Q_INDEX_DONE))
++			return true;
++	}
++	return false;
++}
++EXPORT_SYMBOL_GPL(rt2800_txstatus_pending);
++
+ void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev)
+ {
+ 	struct data_queue *queue;
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -198,6 +198,7 @@ void rt2800_txdone_entry(struct queue_en
+ void rt2800_txdone(struct rt2x00_dev *rt2x00dev, unsigned int quota);
+ void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev);
+ bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev);
++bool rt2800_txstatus_pending(struct rt2x00_dev *rt2x00dev);
+ 
+ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
+ void rt2800_clear_beacon(struct queue_entry *entry);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -100,22 +100,6 @@ static void rt2800usb_stop_queue(struct
+ 	}
+ }
+ 
+-/*
+- * test if there is an entry in any TX queue for which DMA is done
+- * but the TX status has not been returned yet
+- */
+-static bool rt2800usb_txstatus_pending(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-
+-	tx_queue_for_each(rt2x00dev, queue) {
+-		if (rt2x00queue_get_entry(queue, Q_INDEX_DMA_DONE) !=
+-		    rt2x00queue_get_entry(queue, Q_INDEX_DONE))
+-			return true;
+-	}
+-	return false;
+-}
+-
+ #define TXSTATUS_READ_INTERVAL 1000000
+ 
+ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+@@ -145,7 +129,7 @@ static bool rt2800usb_tx_sta_fifo_read_c
+ 	if (rt2800_txstatus_timeout(rt2x00dev))
+ 		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+-	if (rt2800usb_txstatus_pending(rt2x00dev)) {
++	if (rt2800_txstatus_pending(rt2x00dev)) {
+ 		/* Read register after 1 ms */
+ 		hrtimer_start(&rt2x00dev->txstatus_timer,
+ 			      TXSTATUS_READ_INTERVAL,
+@@ -160,7 +144,7 @@ stop_reading:
+ 	 * clear_bit someone could do rt2x00usb_interrupt_txdone, so recheck
+ 	 * here again if status reading is needed.
+ 	 */
+-	if (rt2800usb_txstatus_pending(rt2x00dev) &&
++	if (rt2800_txstatus_pending(rt2x00dev) &&
+ 	    !test_and_set_bit(TX_STATUS_READING, &rt2x00dev->flags))
+ 		return true;
+ 	else
+@@ -489,7 +473,7 @@ static void rt2800usb_work_txdone(struct
+ 		 * if the medium is busy, thus the TX_STA_FIFO entry is
+ 		 * also delayed -> use a timer to retrieve it.
+ 		 */
+-		if (rt2800usb_txstatus_pending(rt2x00dev))
++		if (rt2800_txstatus_pending(rt2x00dev))
+ 			rt2800usb_async_read_tx_status(rt2x00dev);
+ 	}
+ }
diff --git a/package/kernel/mac80211/patches/rt2x00/027-rt2800mmio-fetch-tx-status-changes.patch b/package/kernel/mac80211/patches/rt2x00/027-rt2800mmio-fetch-tx-status-changes.patch
new file mode 100644
index 0000000000..4bb62c2288
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/027-rt2800mmio-fetch-tx-status-changes.patch
@@ -0,0 +1,61 @@
+From f6a9618198e190a2ba09ce3f0aa8e9ee1763bd38 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:34 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804443
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 24/28] rt2800mmio: fetch tx status changes
+
+Prepare to use rt2800mmio_fetch_txstatus() in concurrent manner and drop
+return value since is not longer needed.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -255,12 +255,12 @@ void rt2800mmio_autowake_tasklet(unsigne
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
+ 
+-static bool rt2800mmio_fetch_txstatus(struct rt2x00_dev *rt2x00dev)
++static void rt2800mmio_fetch_txstatus(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u32 status;
+-	bool more = false;
++	unsigned long flags;
+ 
+-	/* FIXEME: rewrite this comment
++	/*
+ 	 * The TX_FIFO_STATUS interrupt needs special care. We should
+ 	 * read TX_STA_FIFO but we should do it immediately as otherwise
+ 	 * the register can overflow and we would lose status reports.
+@@ -271,20 +271,21 @@ static bool rt2800mmio_fetch_txstatus(st
+ 	 * because we can schedule the tasklet multiple times (when the
+ 	 * interrupt fires again during tx status processing).
+ 	 *
+-	 * txstatus tasklet is called with INT_SOURCE_CSR_TX_FIFO_STATUS
+-	 * disabled so have only one producer and one consumer - we don't
+-	 * need to lock the kfifo.
++	 * We also read statuses from tx status timeout timer, use
++	 * lock to prevent concurent writes to fifo.
+ 	 */
++
++	spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
++
+ 	while (!kfifo_is_full(&rt2x00dev->txstatus_fifo)) {
+ 		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
+ 		if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
+ 			break;
+ 
+ 		kfifo_put(&rt2x00dev->txstatus_fifo, status);
+-		more = true;
+ 	}
+ 
+-	return more;
++	spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
+ }
+ 
+ void rt2800mmio_txstatus_tasklet(unsigned long data)
diff --git a/package/kernel/mac80211/patches/rt2x00/028-rt2800mmio-use-timer-and-work-for-handling-tx-status.patch b/package/kernel/mac80211/patches/rt2x00/028-rt2800mmio-use-timer-and-work-for-handling-tx-status.patch
new file mode 100644
index 0000000000..bf038a5991
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/028-rt2800mmio-use-timer-and-work-for-handling-tx-status.patch
@@ -0,0 +1,194 @@
+From 175c2548332b45b144af673e70fdbb1a947d7aba Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:35 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804445
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 25/28] rt2800mmio: use timer and work for handling tx statuses
+ timeouts
+
+Sometimes we can get into situation when there are pending statuses,
+but we do not get INT_SOURCE_CSR_TX_FIFO_STATUS. Handle this situation
+by arming timeout timer and read statuses (it will fix case when
+we just do not have irq) and queue work to handle case we missed
+statues from hardware FIFO.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 81 +++++++++++++++++--
+ .../net/wireless/ralink/rt2x00/rt2800mmio.h   |  1 +
+ .../net/wireless/ralink/rt2x00/rt2800pci.c    |  2 +-
+ .../net/wireless/ralink/rt2x00/rt2800soc.c    |  2 +-
+ .../net/wireless/ralink/rt2x00/rt2x00dev.c    |  4 +
+ 5 files changed, 82 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -426,6 +426,9 @@ void rt2800mmio_start_queue(struct data_
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_start_queue);
+ 
++/* 200 ms */
++#define TXSTATUS_TIMEOUT 200000000
++
+ void rt2800mmio_kick_queue(struct data_queue *queue)
+ {
+ 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+@@ -440,6 +443,8 @@ void rt2800mmio_kick_queue(struct data_q
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX);
+ 		rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX(queue->qid),
+ 					  entry->entry_idx);
++		hrtimer_start(&rt2x00dev->txstatus_timer,
++			      TXSTATUS_TIMEOUT, HRTIMER_MODE_REL);
+ 		break;
+ 	case QID_MGMT:
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX);
+@@ -484,12 +489,8 @@ void rt2800mmio_flush_queue(struct data_
+ 		 * For TX queues schedule completion tasklet to catch
+ 		 * tx status timeouts, othewise just wait.
+ 		 */
+-		if (tx_queue) {
+-			tasklet_disable(&rt2x00dev->txstatus_tasklet);
+-			rt2800_txdone(rt2x00dev, UINT_MAX);
+-			rt2800_txdone_nostatus(rt2x00dev);
+-			tasklet_enable(&rt2x00dev->txstatus_tasklet);
+-		}
++		if (tx_queue)
++			queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+ 		/*
+ 		 * Wait for a little while to give the driver
+@@ -627,6 +628,10 @@ void rt2800mmio_clear_entry(struct queue
+ 		word = rt2x00_desc_read(entry_priv->desc, 1);
+ 		rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 1);
+ 		rt2x00_desc_write(entry_priv->desc, 1, word);
++
++		/* If last entry stop txstatus timer */
++		if (entry->queue->length == 1)
++			hrtimer_cancel(&rt2x00dev->txstatus_timer);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_clear_entry);
+@@ -759,6 +764,70 @@ int rt2800mmio_enable_radio(struct rt2x0
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_enable_radio);
+ 
++static void rt2800mmio_work_txdone(struct work_struct *work)
++{
++	struct rt2x00_dev *rt2x00dev =
++	    container_of(work, struct rt2x00_dev, txdone_work);
++
++	if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++		return;
++
++	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
++	       rt2800_txstatus_timeout(rt2x00dev)) {
++
++		tasklet_disable(&rt2x00dev->txstatus_tasklet);
++		rt2800_txdone(rt2x00dev, UINT_MAX);
++		rt2800_txdone_nostatus(rt2x00dev);
++		tasklet_enable(&rt2x00dev->txstatus_tasklet);
++	}
++
++	if (rt2800_txstatus_pending(rt2x00dev))
++		hrtimer_start(&rt2x00dev->txstatus_timer,
++			      TXSTATUS_TIMEOUT, HRTIMER_MODE_REL);
++}
++
++static enum hrtimer_restart rt2800mmio_tx_sta_fifo_timeout(struct hrtimer *timer)
++{
++	struct rt2x00_dev *rt2x00dev =
++	    container_of(timer, struct rt2x00_dev, txstatus_timer);
++
++	if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++		goto out;
++
++	if (!rt2800_txstatus_pending(rt2x00dev))
++		goto out;
++
++	rt2800mmio_fetch_txstatus(rt2x00dev);
++	if (!kfifo_is_empty(&rt2x00dev->txstatus_fifo))
++		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
++	else
++		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
++out:
++	return HRTIMER_NORESTART;
++}
++
++int rt2800mmio_probe_hw(struct rt2x00_dev *rt2x00dev)
++{
++	int retval;
++
++	retval = rt2800_probe_hw(rt2x00dev);
++	if (retval)
++		return retval;
++
++	/*
++	 * Set txstatus timer function.
++	 */
++	rt2x00dev->txstatus_timer.function = rt2800mmio_tx_sta_fifo_timeout;
++
++	/*
++	 * Overwrite TX done handler
++	 */
++	INIT_WORK(&rt2x00dev->txdone_work, rt2800mmio_work_txdone);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(rt2800mmio_probe_hw);
++
+ MODULE_AUTHOR(DRV_PROJECT);
+ MODULE_VERSION(DRV_VERSION);
+ MODULE_DESCRIPTION("rt2800 MMIO library");
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
+@@ -153,6 +153,7 @@ void rt2800mmio_stop_queue(struct data_q
+ void rt2800mmio_queue_init(struct data_queue *queue);
+ 
+ /* Initialization functions */
++int rt2800mmio_probe_hw(struct rt2x00_dev *rt2x00dev);
+ bool rt2800mmio_get_entry_state(struct queue_entry *entry);
+ void rt2800mmio_clear_entry(struct queue_entry *entry);
+ int rt2800mmio_init_queues(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -346,7 +346,7 @@ static const struct rt2x00lib_ops rt2800
+ 	.tbtt_tasklet		= rt2800mmio_tbtt_tasklet,
+ 	.rxdone_tasklet		= rt2800mmio_rxdone_tasklet,
+ 	.autowake_tasklet	= rt2800mmio_autowake_tasklet,
+-	.probe_hw		= rt2800_probe_hw,
++	.probe_hw		= rt2800mmio_probe_hw,
+ 	.get_firmware_name	= rt2800pci_get_firmware_name,
+ 	.check_firmware		= rt2800_check_firmware,
+ 	.load_firmware		= rt2800_load_firmware,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -185,7 +185,7 @@ static const struct rt2x00lib_ops rt2800
+ 	.tbtt_tasklet		= rt2800mmio_tbtt_tasklet,
+ 	.rxdone_tasklet		= rt2800mmio_rxdone_tasklet,
+ 	.autowake_tasklet	= rt2800mmio_autowake_tasklet,
+-	.probe_hw		= rt2800_probe_hw,
++	.probe_hw		= rt2800mmio_probe_hw,
+ 	.get_firmware_name	= rt2800soc_get_firmware_name,
+ 	.check_firmware		= rt2800soc_check_firmware,
+ 	.load_firmware		= rt2800soc_load_firmware,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -1391,6 +1391,8 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ 	mutex_init(&rt2x00dev->conf_mutex);
+ 	INIT_LIST_HEAD(&rt2x00dev->bar_list);
+ 	spin_lock_init(&rt2x00dev->bar_list_lock);
++	hrtimer_init(&rt2x00dev->txstatus_timer, CLOCK_MONOTONIC,
++		     HRTIMER_MODE_REL);
+ 
+ 	set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 
+@@ -1515,6 +1517,8 @@ void rt2x00lib_remove_dev(struct rt2x00_
+ 	cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
+ 	cancel_work_sync(&rt2x00dev->sleep_work);
+ 
++	hrtimer_cancel(&rt2x00dev->txstatus_timer);
++
+ 	/*
+ 	 * Kill the tx status tasklet.
+ 	 */
diff --git a/package/kernel/mac80211/patches/rt2x00/029-rt2x00-remove-last_nostatus_check.patch b/package/kernel/mac80211/patches/rt2x00/029-rt2x00-remove-last_nostatus_check.patch
new file mode 100644
index 0000000000..0daaef5e8b
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/029-rt2x00-remove-last_nostatus_check.patch
@@ -0,0 +1,57 @@
+From 6013a91f15c9dabd668d5736652b9bcfb0ef0378 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:36 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804447
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 26/28] rt2x00: remove last_nostatus_check
+
+We do not any longer check txstatus timeout from tasklet, so do not need
+this optimization.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c   | 9 ---------
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h      | 2 --
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 1 -
+ 3 files changed, 12 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1164,15 +1164,6 @@ bool rt2800_txstatus_timeout(struct rt2x
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
+ 
+-	if (!test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags)) {
+-		unsigned long tout = msecs_to_jiffies(1000);
+-
+-		if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
+-			return false;
+-	}
+-
+-	rt2x00dev->last_nostatus_check = jiffies;
+-
+ 	tx_queue_for_each(rt2x00dev, queue) {
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+ 		if (rt2800_entry_txstatus_timeout(rt2x00dev, entry))
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -981,8 +981,6 @@ struct rt2x00_dev {
+ 	 */
+ 	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
+ 
+-	unsigned long last_nostatus_check;
+-
+ 	/*
+ 	 * Timer to ensure tx status reports are read (rt2800usb).
+ 	 */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -1039,7 +1039,6 @@ void rt2x00queue_start_queues(struct rt2
+ 	 */
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_start_queue(queue);
+-	rt2x00dev->last_nostatus_check = jiffies;
+ 
+ 	rt2x00queue_start_queue(rt2x00dev->rx);
+ }
diff --git a/package/kernel/mac80211/patches/rt2x00/030-rt2x00-remove-not-used-entry-field.patch b/package/kernel/mac80211/patches/rt2x00/030-rt2x00-remove-not-used-entry-field.patch
new file mode 100644
index 0000000000..53134a5bc3
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/030-rt2x00-remove-not-used-entry-field.patch
@@ -0,0 +1,34 @@
+From 2758f09b22bc08e89e0391486b2d707ad2479599 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:37 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804449
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 27/28] rt2x00: remove not used entry field
+
+Remove not used any longer queue_entry field and flag.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.h | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.h
+@@ -361,7 +361,6 @@ enum queue_entry_flags {
+ 	ENTRY_DATA_PENDING,
+ 	ENTRY_DATA_IO_FAILED,
+ 	ENTRY_DATA_STATUS_PENDING,
+-	ENTRY_DATA_STATUS_SET,
+ };
+ 
+ /**
+@@ -387,8 +386,6 @@ struct queue_entry {
+ 
+ 	unsigned int entry_idx;
+ 
+-	u32 status;
+-
+ 	void *priv_data;
+ };
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/031-rt2x00mmio-remove-legacy-comment.patch b/package/kernel/mac80211/patches/rt2x00/031-rt2x00mmio-remove-legacy-comment.patch
new file mode 100644
index 0000000000..199a6e3255
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/031-rt2x00mmio-remove-legacy-comment.patch
@@ -0,0 +1,26 @@
+From f44e145869bb517460648e4ed71b7e9001964d06 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Sat, 9 Feb 2019 12:08:38 +0100
+X-Patchwork-Submitter: Stanislaw Gruszka <sgruszka@redhat.com>
+X-Patchwork-Id: 10804451
+X-Patchwork-Delegate: kvalo@adurom.com
+Subject: [PATCH 28/28] rt2x00mmio: remove legacy comment
+
+Remove comment about fields that ware removed.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00mmio.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.h
+@@ -80,8 +80,6 @@ int rt2x00mmio_regbusy_read(struct rt2x0
+  *
+  * @desc: Pointer to device descriptor
+  * @desc_dma: DMA pointer to &desc.
+- * @data: Pointer to device's entry memory.
+- * @data_dma: DMA pointer to &data.
+  */
+ struct queue_entry_priv_mmio {
+ 	__le32 *desc;
diff --git a/package/kernel/mac80211/patches/rt2x00/032-rt2x00-do-not-increment-sequence-number-while-re-tra.patch b/package/kernel/mac80211/patches/rt2x00/032-rt2x00-do-not-increment-sequence-number-while-re-tra.patch
new file mode 100644
index 0000000000..c1f3815998
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/032-rt2x00-do-not-increment-sequence-number-while-re-tra.patch
@@ -0,0 +1,94 @@
+From 746ba11f170603bf1eaade817553a6c2e9135bbe Mon Sep 17 00:00:00 2001
+From: Vijayakumar Durai <vijayakumar.durai1@vivint.com>
+Date: Wed, 27 Mar 2019 11:03:17 +0100
+Subject: [PATCH] rt2x00: do not increment sequence number while
+ re-transmitting
+
+Currently rt2x00 devices retransmit the management frames with
+incremented sequence number if hardware is assigning the sequence.
+
+This is HW bug fixed already for non-QOS data frames, but it should
+be fixed for management frames except beacon.
+
+Without fix retransmitted frames have wrong SN:
+
+ AlphaNet_e8:fb:36 Vivotek_52:31:51 Authentication, SN=1648, FN=0, Flags=........C Frame is not being retransmitted 1648 1
+ AlphaNet_e8:fb:36 Vivotek_52:31:51 Authentication, SN=1649, FN=0, Flags=....R...C Frame is being retransmitted 1649 1
+ AlphaNet_e8:fb:36 Vivotek_52:31:51 Authentication, SN=1650, FN=0, Flags=....R...C Frame is being retransmitted 1650 1
+
+With the fix SN stays correctly the same:
+
+ 88:6a:e3:e8:f9:a2 8c:f5:a3:88:76:87 Authentication, SN=1450, FN=0, Flags=........C
+ 88:6a:e3:e8:f9:a2 8c:f5:a3:88:76:87 Authentication, SN=1450, FN=0, Flags=....R...C
+ 88:6a:e3:e8:f9:a2 8c:f5:a3:88:76:87 Authentication, SN=1450, FN=0, Flags=....R...C
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Vijayakumar Durai <vijayakumar.durai1@vivint.com>
+[sgruszka: simplify code, change comments and changelog]
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h      |  1 -
+ drivers/net/wireless/ralink/rt2x00/rt2x00mac.c   | 10 ----------
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 15 +++++++++------
+ 3 files changed, 9 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -673,7 +673,6 @@ enum rt2x00_state_flags {
+ 	CONFIG_CHANNEL_HT40,
+ 	CONFIG_POWERSAVING,
+ 	CONFIG_HT_DISABLED,
+-	CONFIG_QOS_DISABLED,
+ 	CONFIG_MONITORING,
+ 
+ 	/*
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -642,19 +642,9 @@ void rt2x00mac_bss_info_changed(struct i
+ 			rt2x00dev->intf_associated--;
+ 
+ 		rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
+-
+-		clear_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
+ 	}
+ 
+ 	/*
+-	 * Check for access point which do not support 802.11e . We have to
+-	 * generate data frames sequence number in S/W for such AP, because
+-	 * of H/W bug.
+-	 */
+-	if (changes & BSS_CHANGED_QOS && !bss_conf->qos)
+-		set_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
+-
+-	/*
+ 	 * When the erp information has changed, we should perform
+ 	 * additional configuration steps. For all other changes we are done.
+ 	 */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -201,15 +201,18 @@ static void rt2x00queue_create_tx_descri
+ 	if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
+ 		/*
+ 		 * rt2800 has a H/W (or F/W) bug, device incorrectly increase
+-		 * seqno on retransmited data (non-QOS) frames. To workaround
+-		 * the problem let's generate seqno in software if QOS is
+-		 * disabled.
++		 * seqno on retransmitted data (non-QOS) and management frames.
++		 * To workaround the problem let's generate seqno in software.
++		 * Except for beacons which are transmitted periodically by H/W
++		 * hence hardware has to assign seqno for them.
+ 		 */
+-		if (test_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags))
+-			__clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+-		else
++	    	if (ieee80211_is_beacon(hdr->frame_control)) {
++			__set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+ 			/* H/W will generate sequence number */
+ 			return;
++		}
++
++		__clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+ 	}
+ 
+ 	/*
diff --git a/package/kernel/mac80211/patches/rt2x00/050-rt2x00-add-RT3883-support.patch b/package/kernel/mac80211/patches/rt2x00/050-rt2x00-add-RT3883-support.patch
new file mode 100644
index 0000000000..162a20155d
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/050-rt2x00-add-RT3883-support.patch
@@ -0,0 +1,959 @@
+From d0e61a0f7cca51ce340a5a73595189972122ff25 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Wed, 24 Apr 2019 09:49:24 +0200
+Subject: [PATCH] rt2x00: add RT3883 support
+
+Patch add support for RT3883 chip. Code was taken direclty
+from openwrt project and merge into one patch.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h   |  19 +-
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 598 +++++++++++++++++-
+ .../net/wireless/ralink/rt2x00/rt2800soc.c    |   9 +-
+ 3 files changed, 607 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -48,7 +48,8 @@
+  * RF2853 2.4G/5G 3T3R
+  * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
+  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
+- * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
++ * RF3053 2.4G/5G 3T3R(RT3563/RT3573/RT3593)
++ * RF3853 2.4G/5G 3T3R(RT3883/RT3662)
+  * RF5592 2.4G/5G 2T2R
+  * RF3070 2.4G 1T1R
+  * RF5360 2.4G 1T1R
+@@ -72,6 +73,7 @@
+ #define RF5592				0x000f
+ #define RF3070				0x3070
+ #define RF3290				0x3290
++#define RF3853				0x3853
+ #define RF5350				0x5350
+ #define RF5360				0x5360
+ #define RF5362				0x5362
+@@ -1726,6 +1728,20 @@
+ #define TX_PWR_CFG_9B_STBC_MCS7		FIELD32(0x000000ff)
+ 
+ /*
++ * TX_TXBF_CFG:
++ */
++#define TX_TXBF_CFG_0			0x138c
++#define TX_TXBF_CFG_1			0x13a4
++#define TX_TXBF_CFG_2			0x13a8
++#define TX_TXBF_CFG_3			0x13ac
++
++/*
++ * TX_FBK_CFG_3S:
++ */
++#define TX_FBK_CFG_3S_0			0x13c4
++#define TX_FBK_CFG_3S_1			0x13c8
++
++/*
+  * RX_FILTER_CFG: RX configuration register.
+  */
+ #define RX_FILTER_CFG			0x1400
+@@ -2296,6 +2312,7 @@ struct mac_iveiv_entry {
+ /*
+  * RFCSR 2:
+  */
++#define RFCSR2_RESCAL_BP		FIELD8(0x40)
+ #define RFCSR2_RESCAL_EN		FIELD8(0x80)
+ #define RFCSR2_RX2_EN_MT7620		FIELD8(0x02)
+ #define RFCSR2_TX2_EN_MT7620		FIELD8(0x20)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -381,7 +381,8 @@ static unsigned int rt2800_eeprom_word_i
+ 		      wiphy_name(rt2x00dev->hw->wiphy), word))
+ 		return 0;
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		map = rt2800_eeprom_map_ext;
+ 	else
+ 		map = rt2800_eeprom_map;
+@@ -590,6 +591,7 @@ void rt2800_get_txwi_rxwi_size(struct rt
+ {
+ 	switch (rt2x00dev->chip.rt) {
+ 	case RT3593:
++	case RT3883:
+ 		*txwi_size = TXWI_DESC_SIZE_4WORDS;
+ 		*rxwi_size = RXWI_DESC_SIZE_5WORDS;
+ 		break;
+@@ -2180,7 +2182,8 @@ void rt2800_config_ant(struct rt2x00_dev
+ 	rt2800_bbp_write(rt2x00dev, 3, r3);
+ 	rt2800_bbp_write(rt2x00dev, 1, r1);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593)) {
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883)) {
+ 		if (ant->rx_chain_num == 1)
+ 			rt2800_bbp_write(rt2x00dev, 86, 0x00);
+ 		else
+@@ -2202,7 +2205,8 @@ static void rt2800_config_lna_gain(struc
+ 		eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_LNA);
+ 		lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
+ 	} else if (libconf->rf.channel <= 128) {
+-		if (rt2x00_rt(rt2x00dev, RT3593)) {
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883)) {
+ 			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
+ 			lna_gain = rt2x00_get_field16(eeprom,
+ 						      EEPROM_EXT_LNA2_A1);
+@@ -2212,7 +2216,8 @@ static void rt2800_config_lna_gain(struc
+ 						      EEPROM_RSSI_BG2_LNA_A1);
+ 		}
+ 	} else {
+-		if (rt2x00_rt(rt2x00dev, RT3593)) {
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883)) {
+ 			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
+ 			lna_gain = rt2x00_get_field16(eeprom,
+ 						      EEPROM_EXT_LNA2_A2);
+@@ -2880,6 +2885,211 @@ static void rt2800_config_channel_rf3053
+ 	}
+ }
+ 
++static void rt2800_config_channel_rf3853(struct rt2x00_dev *rt2x00dev,
++					 struct ieee80211_conf *conf,
++					 struct rf_channel *rf,
++					 struct channel_info *info)
++{
++	u8 rfcsr;
++	u8 bbp;
++	u8 pwr1, pwr2, pwr3;
++
++	const bool txbf_enabled = false; /* TODO */
++
++	/* TODO: add band selection */
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
++	else if (rf->channel < 132)
++		rt2800_rfcsr_write(rt2x00dev, 6, 0x80);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
++
++	rt2800_rfcsr_write(rt2x00dev, 8, rf->rf1);
++	rt2800_rfcsr_write(rt2x00dev, 9, rf->rf3);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 11, 0x46);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 11, 0x48);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 12, 0x1a);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 12, 0x52);
++
++	rt2800_rfcsr_write(rt2x00dev, 13, 0x12);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
++	rt2x00_set_field8(&rfcsr, RFCSR1_PLL_PD, 1);
++
++	switch (rt2x00dev->default_ant.tx_chain_num) {
++	case 3:
++		rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 1);
++		/* fallthrough */
++	case 2:
++		rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 1);
++		/* fallthrough */
++	case 1:
++		rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
++		break;
++	}
++
++	switch (rt2x00dev->default_ant.rx_chain_num) {
++	case 3:
++		rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 1);
++		/* fallthrough */
++	case 2:
++		rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 1);
++		/* fallthrough */
++	case 1:
++		rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
++		break;
++	}
++	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
++
++	rt2800_freq_cal_mode1(rt2x00dev);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 30);
++	if (!conf_is_ht40(conf))
++		rfcsr &= ~(0x06);
++	else
++		rfcsr |= 0x06;
++	rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 31, 0xa0);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
++
++	if (conf_is_ht40(conf))
++		rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 32, 0xd8);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 34, 0x3c);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 34, 0x20);
++
++	/* loopback RF_BS */
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 36);
++	if (rf->channel <= 14)
++		rt2x00_set_field8(&rfcsr, RFCSR36_RF_BS, 1);
++	else
++		rt2x00_set_field8(&rfcsr, RFCSR36_RF_BS, 0);
++	rt2800_rfcsr_write(rt2x00dev, 36, rfcsr);
++
++	if (rf->channel <= 14)
++		rfcsr = 0x23;
++	else if (rf->channel < 100)
++		rfcsr = 0x36;
++	else if (rf->channel < 132)
++		rfcsr = 0x32;
++	else
++		rfcsr = 0x30;
++
++	if (txbf_enabled)
++		rfcsr |= 0x40;
++
++	rt2800_rfcsr_write(rt2x00dev, 39, rfcsr);
++
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 44, 0x93);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 44, 0x9b);
++
++	if (rf->channel <= 14)
++		rfcsr = 0xbb;
++	else if (rf->channel < 100)
++		rfcsr = 0xeb;
++	else if (rf->channel < 132)
++		rfcsr = 0xb3;
++	else
++		rfcsr = 0x9b;
++	rt2800_rfcsr_write(rt2x00dev, 45, rfcsr);
++
++	if (rf->channel <= 14)
++		rfcsr = 0x8e;
++	else
++		rfcsr = 0x8a;
++
++	if (txbf_enabled)
++		rfcsr |= 0x20;
++
++	rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
++
++	rt2800_rfcsr_write(rt2x00dev, 50, 0x86);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 51);
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 51, 0x75);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 51, 0x51);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 52);
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 52, 0x45);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 52, 0x05);
++
++	if (rf->channel <= 14) {
++		pwr1 = info->default_power1 & 0x1f;
++		pwr2 = info->default_power2 & 0x1f;
++		pwr3 = info->default_power3 & 0x1f;
++	} else {
++		pwr1 = 0x48 | ((info->default_power1 & 0x18) << 1) |
++			(info->default_power1 & 0x7);
++		pwr2 = 0x48 | ((info->default_power2 & 0x18) << 1) |
++			(info->default_power2 & 0x7);
++		pwr3 = 0x48 | ((info->default_power3 & 0x18) << 1) |
++			(info->default_power3 & 0x7);
++	}
++
++	rt2800_rfcsr_write(rt2x00dev, 53, pwr1);
++	rt2800_rfcsr_write(rt2x00dev, 54, pwr2);
++	rt2800_rfcsr_write(rt2x00dev, 55, pwr3);
++
++	rt2x00_dbg(rt2x00dev, "Channel:%d, pwr1:%02x, pwr2:%02x, pwr3:%02x\n",
++		   rf->channel, pwr1, pwr2, pwr3);
++
++	bbp = (info->default_power1 >> 5) |
++	      ((info->default_power2 & 0xe0) >> 1);
++	rt2800_bbp_write(rt2x00dev, 109, bbp);
++
++	bbp = rt2800_bbp_read(rt2x00dev, 110);
++	bbp &= 0x0f;
++	bbp |= (info->default_power3 & 0xe0) >> 1;
++	rt2800_bbp_write(rt2x00dev, 110, bbp);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 57);
++	if (rf->channel <= 14)
++		rt2800_rfcsr_write(rt2x00dev, 57, 0x6e);
++	else
++		rt2800_rfcsr_write(rt2x00dev, 57, 0x3e);
++
++	/* Enable RF tuning */
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 3);
++	rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
++	rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
++
++	udelay(2000);
++
++	bbp = rt2800_bbp_read(rt2x00dev, 49);
++	/* clear update flag */
++	rt2800_bbp_write(rt2x00dev, 49, bbp & 0xfe);
++	rt2800_bbp_write(rt2x00dev, 49, bbp);
++
++	/* TODO: add calibration for TxBF */
++}
++
+ #define POWER_BOUND		0x27
+ #define POWER_BOUND_5G		0x2b
+ 
+@@ -3683,19 +3893,51 @@ static char rt2800_txpower_to_dev(struct
+ 				  unsigned int channel,
+ 				  char txpower)
+ {
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		txpower = rt2x00_get_field8(txpower, EEPROM_TXPOWER_ALC);
+ 
+ 	if (channel <= 14)
+ 		return clamp_t(char, txpower, MIN_G_TXPOWER, MAX_G_TXPOWER);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		return clamp_t(char, txpower, MIN_A_TXPOWER_3593,
+ 			       MAX_A_TXPOWER_3593);
+ 	else
+ 		return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER);
+ }
+ 
++static void rt3883_bbp_adjust(struct rt2x00_dev *rt2x00dev,
++			      struct rf_channel *rf)
++{
++	u8 bbp;
++
++	bbp = (rf->channel > 14) ? 0x48 : 0x38;
++	rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 69, 0x12);
++
++	if (rf->channel <= 14) {
++		rt2800_bbp_write(rt2x00dev, 70, 0x0a);
++	} else {
++		/* Disable CCK packet detection */
++		rt2800_bbp_write(rt2x00dev, 70, 0x00);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 73, 0x10);
++
++	if (rf->channel > 14) {
++		rt2800_bbp_write(rt2x00dev, 62, 0x1d);
++		rt2800_bbp_write(rt2x00dev, 63, 0x1d);
++		rt2800_bbp_write(rt2x00dev, 64, 0x1d);
++	} else {
++		rt2800_bbp_write(rt2x00dev, 62, 0x2d);
++		rt2800_bbp_write(rt2x00dev, 63, 0x2d);
++		rt2800_bbp_write(rt2x00dev, 64, 0x2d);
++	}
++}
++
+ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
+ 				  struct ieee80211_conf *conf,
+ 				  struct rf_channel *rf,
+@@ -3714,6 +3956,12 @@ static void rt2800_config_channel(struct
+ 			rt2800_txpower_to_dev(rt2x00dev, rf->channel,
+ 					      info->default_power3);
+ 
++	switch (rt2x00dev->chip.rt) {
++	case RT3883:
++		rt3883_bbp_adjust(rt2x00dev, rf);
++		break;
++	}
++
+ 	switch (rt2x00dev->chip.rf) {
+ 	case RF2020:
+ 	case RF3020:
+@@ -3734,6 +3982,9 @@ static void rt2800_config_channel(struct
+ 	case RF3322:
+ 		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
+ 		break;
++	case RF3853:
++		rt2800_config_channel_rf3853(rt2x00dev, conf, rf, info);
++		break;
+ 	case RF3070:
+ 	case RF5350:
+ 	case RF5360:
+@@ -3815,6 +4066,15 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 77, 0x98);
++	} else if (rt2x00_rt(rt2x00dev, RT3883)) {
++		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
++		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
++		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
++
++		if (rt2x00dev->default_ant.rx_chain_num > 1)
++			rt2800_bbp_write(rt2x00dev, 86, 0x46);
++		else
++			rt2800_bbp_write(rt2x00dev, 86, 0);
+ 	} else {
+ 		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+@@ -3828,6 +4088,7 @@ static void rt2800_config_channel(struct
+ 		    !rt2x00_rt(rt2x00dev, RT6352)) {
+ 			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+ 				rt2800_bbp_write(rt2x00dev, 82, 0x62);
++				rt2800_bbp_write(rt2x00dev, 82, 0x62);
+ 				rt2800_bbp_write(rt2x00dev, 75, 0x46);
+ 			} else {
+ 				if (rt2x00_rt(rt2x00dev, RT3593))
+@@ -3836,19 +4097,22 @@ static void rt2800_config_channel(struct
+ 					rt2800_bbp_write(rt2x00dev, 82, 0x84);
+ 				rt2800_bbp_write(rt2x00dev, 75, 0x50);
+ 			}
+-			if (rt2x00_rt(rt2x00dev, RT3593))
++			if (rt2x00_rt(rt2x00dev, RT3593) ||
++			    rt2x00_rt(rt2x00dev, RT3883))
+ 				rt2800_bbp_write(rt2x00dev, 83, 0x8a);
+ 		}
+ 
+ 	} else {
+ 		if (rt2x00_rt(rt2x00dev, RT3572))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0x94);
+-		else if (rt2x00_rt(rt2x00dev, RT3593))
++		else if (rt2x00_rt(rt2x00dev, RT3593) ||
++			 rt2x00_rt(rt2x00dev, RT3883))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0x82);
+ 		else if (!rt2x00_rt(rt2x00dev, RT6352))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0xf2);
+ 
+-		if (rt2x00_rt(rt2x00dev, RT3593))
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883))
+ 			rt2800_bbp_write(rt2x00dev, 83, 0x9a);
+ 
+ 		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
+@@ -3984,6 +4248,23 @@ static void rt2800_config_channel(struct
+ 		usleep_range(1000, 1500);
+ 	}
+ 
++	if (rt2x00_rt(rt2x00dev, RT3883)) {
++		if (!conf_is_ht40(conf))
++			rt2800_bbp_write(rt2x00dev, 105, 0x34);
++		else
++			rt2800_bbp_write(rt2x00dev, 105, 0x04);
++
++		/* AGC init */
++		if (rf->channel <= 14)
++			reg = 0x2e + rt2x00dev->lna_gain;
++		else
++			reg = 0x20 + ((rt2x00dev->lna_gain * 5) / 3);
++
++		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
++
++		usleep_range(1000, 1500);
++	}
++
+ 	if (rt2x00_rt(rt2x00dev, RT5592) || rt2x00_rt(rt2x00dev, RT6352)) {
+ 		reg = 0x10;
+ 		if (!conf_is_ht40(conf)) {
+@@ -4243,6 +4524,9 @@ static u8 rt2800_compensate_txpower(stru
+ 	if (rt2x00_rt(rt2x00dev, RT3593))
+ 		return min_t(u8, txpower, 0xc);
+ 
++	if (rt2x00_rt(rt2x00dev, RT3883))
++		return min_t(u8, txpower, 0xf);
++
+ 	if (rt2x00_has_cap_power_limit(rt2x00dev)) {
+ 		/*
+ 		 * Check if eirp txpower exceed txpower_limit.
+@@ -5004,7 +5288,8 @@ static void rt2800_config_txpower(struct
+ 				  struct ieee80211_channel *chan,
+ 				  int power_level)
+ {
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		rt2800_config_txpower_rt3593(rt2x00dev, chan, power_level);
+ 	else if (rt2x00_rt(rt2x00dev, RT6352))
+ 		rt2800_config_txpower_rt6352(rt2x00dev, chan, power_level);
+@@ -5051,6 +5336,7 @@ void rt2800_vco_calibration(struct rt2x0
+ 	case RF3053:
+ 	case RF3070:
+ 	case RF3290:
++	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
+ 	case RF5362:
+@@ -5251,7 +5537,8 @@ static u8 rt2800_get_default_vgc(struct
+ 		else
+ 			vgc = 0x2e + rt2x00dev->lna_gain;
+ 	} else { /* 5GHZ band */
+-		if (rt2x00_rt(rt2x00dev, RT3593))
++		if (rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883))
+ 			vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
+ 		else if (rt2x00_rt(rt2x00dev, RT5592))
+ 			vgc = 0x24 + (2 * rt2x00dev->lna_gain);
+@@ -5271,7 +5558,8 @@ static inline void rt2800_set_vgc(struct
+ {
+ 	if (qual->vgc_level != vgc_level) {
+ 		if (rt2x00_rt(rt2x00dev, RT3572) ||
+-		    rt2x00_rt(rt2x00dev, RT3593)) {
++		    rt2x00_rt(rt2x00dev, RT3593) ||
++		    rt2x00_rt(rt2x00dev, RT3883)) {
+ 			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+ 						       vgc_level);
+ 		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
+@@ -5318,6 +5606,11 @@ void rt2800_link_tuner(struct rt2x00_dev
+ 		}
+ 		break;
+ 
++	case RT3883:
++		if (qual->rssi > -65)
++			vgc += 0x10;
++		break;
++
+ 	case RT5592:
+ 		if (qual->rssi > -65)
+ 			vgc += 0x20;
+@@ -5470,6 +5763,12 @@ static int rt2800_init_registers(struct
+ 			rt2800_register_write(rt2x00dev, TX_SW_CFG2,
+ 					      0x00000000);
+ 		}
++	} else if (rt2x00_rt(rt2x00dev, RT3883)) {
++		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000402);
++		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00000000);
++		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00040000);
++		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_0, 0x8000fc21);
++		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_3, 0x00009c40);
+ 	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
+ 		   rt2x00_rt(rt2x00dev, RT5392) ||
+ 		   rt2x00_rt(rt2x00dev, RT6352)) {
+@@ -5683,6 +5982,11 @@ static int rt2800_init_registers(struct
+ 	reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
+ 	rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
+ 
++	if (rt2x00_rt(rt2x00dev, RT3883)) {
++		rt2800_register_write(rt2x00dev, TX_FBK_CFG_3S_0, 0x12111008);
++		rt2800_register_write(rt2x00dev, TX_FBK_CFG_3S_1, 0x16151413);
++	}
++
+ 	reg = rt2800_register_read(rt2x00dev, TX_RTS_CFG);
+ 	rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 7);
+ 	rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
+@@ -6299,6 +6603,47 @@ static void rt2800_init_bbp_3593(struct
+ 		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+ }
+ 
++static void rt2800_init_bbp_3883(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_init_bbp_early(rt2x00dev);
++
++	rt2800_bbp_write(rt2x00dev, 4, 0x50);
++	rt2800_bbp_write(rt2x00dev, 47, 0x48);
++
++	rt2800_bbp_write(rt2x00dev, 86, 0x46);
++	rt2800_bbp_write(rt2x00dev, 88, 0x90);
++
++	rt2800_bbp_write(rt2x00dev, 92, 0x02);
++
++	rt2800_bbp_write(rt2x00dev, 103, 0xc0);
++	rt2800_bbp_write(rt2x00dev, 104, 0x92);
++	rt2800_bbp_write(rt2x00dev, 105, 0x34);
++	rt2800_bbp_write(rt2x00dev, 106, 0x12);
++	rt2800_bbp_write(rt2x00dev, 120, 0x50);
++	rt2800_bbp_write(rt2x00dev, 137, 0x0f);
++	rt2800_bbp_write(rt2x00dev, 163, 0x9d);
++
++	/* Set ITxBF timeout to 0x9C40=1000msec */
++	rt2800_bbp_write(rt2x00dev, 179, 0x02);
++	rt2800_bbp_write(rt2x00dev, 180, 0x00);
++	rt2800_bbp_write(rt2x00dev, 182, 0x40);
++	rt2800_bbp_write(rt2x00dev, 180, 0x01);
++	rt2800_bbp_write(rt2x00dev, 182, 0x9c);
++
++	rt2800_bbp_write(rt2x00dev, 179, 0x00);
++
++	/* Reprogram the inband interface to put right values in RXWI */
++	rt2800_bbp_write(rt2x00dev, 142, 0x04);
++	rt2800_bbp_write(rt2x00dev, 143, 0x3b);
++	rt2800_bbp_write(rt2x00dev, 142, 0x06);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa0);
++	rt2800_bbp_write(rt2x00dev, 142, 0x07);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa1);
++	rt2800_bbp_write(rt2x00dev, 142, 0x08);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
++	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
++}
++
+ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
+ {
+ 	int ant, div_mode;
+@@ -6743,6 +7088,9 @@ static void rt2800_init_bbp(struct rt2x0
+ 	case RT3593:
+ 		rt2800_init_bbp_3593(rt2x00dev);
+ 		return;
++	case RT3883:
++		rt2800_init_bbp_3883(rt2x00dev);
++		return;
+ 	case RT5390:
+ 	case RT5392:
+ 		rt2800_init_bbp_53xx(rt2x00dev);
+@@ -7614,6 +7962,144 @@ static void rt2800_init_rfcsr_5350(struc
+ 	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
+ }
+ 
++static void rt2800_init_rfcsr_3883(struct rt2x00_dev *rt2x00dev)
++{
++	u8 rfcsr;
++
++	/* TODO: get the actual ECO value from the SoC */
++	const unsigned int eco = 5;
++
++	rt2800_rf_init_calibration(rt2x00dev, 2);
++
++	rt2800_rfcsr_write(rt2x00dev, 0, 0xe0);
++	rt2800_rfcsr_write(rt2x00dev, 1, 0x03);
++	rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
++	rt2800_rfcsr_write(rt2x00dev, 3, 0x20);
++	rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 5, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 6, 0x40);
++	rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 8, 0x5b);
++	rt2800_rfcsr_write(rt2x00dev, 9, 0x08);
++	rt2800_rfcsr_write(rt2x00dev, 10, 0xd3);
++	rt2800_rfcsr_write(rt2x00dev, 11, 0x48);
++	rt2800_rfcsr_write(rt2x00dev, 12, 0x1a);
++	rt2800_rfcsr_write(rt2x00dev, 13, 0x12);
++	rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
++
++	/* RFCSR 17 will be initialized later based on the
++	 * frequency offset stored in the EEPROM
++	 */
++
++	rt2800_rfcsr_write(rt2x00dev, 18, 0x40);
++	rt2800_rfcsr_write(rt2x00dev, 19, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
++	rt2800_rfcsr_write(rt2x00dev, 23, 0xc0);
++	rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 25, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 29, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
++	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
++	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
++	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 34, 0x20);
++	rt2800_rfcsr_write(rt2x00dev, 35, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 37, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 38, 0x86);
++	rt2800_rfcsr_write(rt2x00dev, 39, 0x23);
++	rt2800_rfcsr_write(rt2x00dev, 40, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 41, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 42, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 44, 0x93);
++	rt2800_rfcsr_write(rt2x00dev, 45, 0xbb);
++	rt2800_rfcsr_write(rt2x00dev, 46, 0x60);
++	rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 48, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 49, 0x8e);
++	rt2800_rfcsr_write(rt2x00dev, 50, 0x86);
++	rt2800_rfcsr_write(rt2x00dev, 51, 0x51);
++	rt2800_rfcsr_write(rt2x00dev, 52, 0x05);
++	rt2800_rfcsr_write(rt2x00dev, 53, 0x76);
++	rt2800_rfcsr_write(rt2x00dev, 54, 0x76);
++	rt2800_rfcsr_write(rt2x00dev, 55, 0x76);
++	rt2800_rfcsr_write(rt2x00dev, 56, 0xdb);
++	rt2800_rfcsr_write(rt2x00dev, 57, 0x3e);
++	rt2800_rfcsr_write(rt2x00dev, 58, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
++	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
++
++	/* TODO: rx filter calibration? */
++
++	rt2800_bbp_write(rt2x00dev, 137, 0x0f);
++
++	rt2800_bbp_write(rt2x00dev, 163, 0x9d);
++
++	rt2800_bbp_write(rt2x00dev, 105, 0x05);
++
++	rt2800_bbp_write(rt2x00dev, 179, 0x02);
++	rt2800_bbp_write(rt2x00dev, 180, 0x00);
++	rt2800_bbp_write(rt2x00dev, 182, 0x40);
++	rt2800_bbp_write(rt2x00dev, 180, 0x01);
++	rt2800_bbp_write(rt2x00dev, 182, 0x9c);
++
++	rt2800_bbp_write(rt2x00dev, 179, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 142, 0x04);
++	rt2800_bbp_write(rt2x00dev, 143, 0x3b);
++	rt2800_bbp_write(rt2x00dev, 142, 0x06);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa0);
++	rt2800_bbp_write(rt2x00dev, 142, 0x07);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa1);
++	rt2800_bbp_write(rt2x00dev, 142, 0x08);
++	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
++	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
++
++	if (eco == 5) {
++		rt2800_rfcsr_write(rt2x00dev, 32, 0xd8);
++		rt2800_rfcsr_write(rt2x00dev, 33, 0x32);
++	}
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 2);
++	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_BP, 0);
++	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_EN, 1);
++	rt2800_rfcsr_write(rt2x00dev, 2, rfcsr);
++	msleep(1);
++	rt2x00_set_field8(&rfcsr, RFCSR2_RESCAL_EN, 0);
++	rt2800_rfcsr_write(rt2x00dev, 2, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
++	rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
++	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 6);
++	rfcsr |= 0xc0;
++	rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 22);
++	rfcsr |= 0x20;
++	rt2800_rfcsr_write(rt2x00dev, 22, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 46);
++	rfcsr |= 0x20;
++	rt2800_rfcsr_write(rt2x00dev, 46, rfcsr);
++
++	rfcsr = rt2800_rfcsr_read(rt2x00dev, 20);
++	rfcsr &= ~0xee;
++	rt2800_rfcsr_write(rt2x00dev, 20, rfcsr);
++}
++
+ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
+ {
+ 	rt2800_rf_init_calibration(rt2x00dev, 2);
+@@ -8456,6 +8942,9 @@ static void rt2800_init_rfcsr(struct rt2
+ 	case RT3390:
+ 		rt2800_init_rfcsr_3390(rt2x00dev);
+ 		break;
++	case RT3883:
++		rt2800_init_rfcsr_3883(rt2x00dev);
++		break;
+ 	case RT3572:
+ 		rt2800_init_rfcsr_3572(rt2x00dev);
+ 		break;
+@@ -8661,7 +9150,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
+ {
+ 	u16 word;
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		return 0;
+ 
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG);
+@@ -8675,7 +9165,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
+ {
+ 	u16 word;
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593))
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883))
+ 		return 0;
+ 
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_A);
+@@ -8781,7 +9272,8 @@ static int rt2800_validate_eeprom(struct
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2);
+ 	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
+ 		rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
+-	if (!rt2x00_rt(rt2x00dev, RT3593)) {
++	if (!rt2x00_rt(rt2x00dev, RT3593) &&
++	    !rt2x00_rt(rt2x00dev, RT3883)) {
+ 		if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
+ 		    rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
+ 			rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
+@@ -8801,7 +9293,8 @@ static int rt2800_validate_eeprom(struct
+ 	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_A2);
+ 	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
+ 		rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
+-	if (!rt2x00_rt(rt2x00dev, RT3593)) {
++	if (!rt2x00_rt(rt2x00dev, RT3593) &&
++	    !rt2x00_rt(rt2x00dev, RT3883)) {
+ 		if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
+ 		    rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
+ 			rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
+@@ -8809,7 +9302,8 @@ static int rt2800_validate_eeprom(struct
+ 	}
+ 	rt2800_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+ 
+-	if (rt2x00_rt(rt2x00dev, RT3593)) {
++	if (rt2x00_rt(rt2x00dev, RT3593) ||
++	    rt2x00_rt(rt2x00dev, RT3883)) {
+ 		word = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
+ 		if (rt2x00_get_field16(word, EEPROM_EXT_LNA2_A1) == 0x00 ||
+ 		    rt2x00_get_field16(word, EEPROM_EXT_LNA2_A1) == 0xff)
+@@ -8848,6 +9342,8 @@ static int rt2800_init_eeprom(struct rt2
+ 		rf = rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID);
+ 	else if (rt2x00_rt(rt2x00dev, RT3352))
+ 		rf = RF3322;
++	else if (rt2x00_rt(rt2x00dev, RT3883))
++		rf = RF3853;
+ 	else if (rt2x00_rt(rt2x00dev, RT5350))
+ 		rf = RF5350;
+ 	else
+@@ -8868,6 +9364,7 @@ static int rt2800_init_eeprom(struct rt2
+ 	case RF3290:
+ 	case RF3320:
+ 	case RF3322:
++	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
+ 	case RF5362:
+@@ -9154,6 +9651,66 @@ static const struct rf_channel rf_vals_3
+ 	{14,   0xF0,	 2,  0x18},
+ };
+ 
++static const struct rf_channel rf_vals_3853[] = {
++	{1,  241, 6, 2},
++	{2,  241, 6, 7},
++	{3,  242, 6, 2},
++	{4,  242, 6, 7},
++	{5,  243, 6, 2},
++	{6,  243, 6, 7},
++	{7,  244, 6, 2},
++	{8,  244, 6, 7},
++	{9,  245, 6, 2},
++	{10, 245, 6, 7},
++	{11, 246, 6, 2},
++	{12, 246, 6, 7},
++	{13, 247, 6, 2},
++	{14, 248, 6, 4},
++
++	{36, 0x56, 8, 4},
++	{38, 0x56, 8, 6},
++	{40, 0x56, 8, 8},
++	{44, 0x57, 8, 0},
++	{46, 0x57, 8, 2},
++	{48, 0x57, 8, 4},
++	{52, 0x57, 8, 8},
++	{54, 0x57, 8, 10},
++	{56, 0x58, 8, 0},
++	{60, 0x58, 8, 4},
++	{62, 0x58, 8, 6},
++	{64, 0x58, 8, 8},
++
++	{100, 0x5b, 8, 8},
++	{102, 0x5b, 8, 10},
++	{104, 0x5c, 8, 0},
++	{108, 0x5c, 8, 4},
++	{110, 0x5c, 8, 6},
++	{112, 0x5c, 8, 8},
++	{114, 0x5c, 8, 10},
++	{116, 0x5d, 8, 0},
++	{118, 0x5d, 8, 2},
++	{120, 0x5d, 8, 4},
++	{124, 0x5d, 8, 8},
++	{126, 0x5d, 8, 10},
++	{128, 0x5e, 8, 0},
++	{132, 0x5e, 8, 4},
++	{134, 0x5e, 8, 6},
++	{136, 0x5e, 8, 8},
++	{140, 0x5f, 8, 0},
++
++	{149, 0x5f, 8, 9},
++	{151, 0x5f, 8, 11},
++	{153, 0x60, 8, 1},
++	{157, 0x60, 8, 5},
++	{159, 0x60, 8, 7},
++	{161, 0x60, 8, 9},
++	{165, 0x61, 8, 1},
++	{167, 0x61, 8, 3},
++	{169, 0x61, 8, 5},
++	{171, 0x61, 8, 7},
++	{173, 0x61, 8, 9},
++};
++
+ static const struct rf_channel rf_vals_5592_xtal20[] = {
+ 	/* Channel, N, K, mod, R */
+ 	{1, 482, 4, 10, 3},
+@@ -9417,6 +9974,11 @@ static int rt2800_probe_hw_mode(struct r
+ 		spec->channels = rf_vals_3x;
+ 		break;
+ 
++	case RF3853:
++		spec->num_channels = ARRAY_SIZE(rf_vals_3853);
++		spec->channels = rf_vals_3853;
++		break;
++
+ 	case RF5592:
+ 		reg = rt2800_register_read(rt2x00dev, MAC_DEBUG_INDEX);
+ 		if (rt2x00_get_field32(reg, MAC_DEBUG_INDEX_XTAL)) {
+@@ -9536,6 +10098,7 @@ static int rt2800_probe_hw_mode(struct r
+ 	case RF3053:
+ 	case RF3070:
+ 	case RF3290:
++	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
+ 	case RF5362:
+@@ -9578,6 +10141,7 @@ static int rt2800_probe_rt(struct rt2x00
+ 	case RT3390:
+ 	case RT3572:
+ 	case RT3593:
++	case RT3883:
+ 	case RT5350:
+ 	case RT5390:
+ 	case RT5392:
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -51,9 +51,16 @@ static bool rt2800soc_hwcrypt_disabled(s
+ 
+ static void rt2800soc_disable_radio(struct rt2x00_dev *rt2x00dev)
+ {
++	u32 reg;
++
+ 	rt2800_disable_radio(rt2x00dev);
+ 	rt2x00mmio_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+-	rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, 0);
++
++	reg = 0;
++	if (rt2x00_rt(rt2x00dev, RT3883))
++		rt2x00_set_field32(&reg, TX_PIN_CFG_RFTR_EN, 1);
++
++	rt2x00mmio_register_write(rt2x00dev, TX_PIN_CFG, reg);
+ }
+ 
+ static int rt2800soc_set_device_state(struct rt2x00_dev *rt2x00dev,
diff --git a/package/kernel/mac80211/patches/030-rt2x00_options.patch b/package/kernel/mac80211/patches/rt2x00/100-rt2x00_options.patch
similarity index 100%
rename from package/kernel/mac80211/patches/030-rt2x00_options.patch
rename to package/kernel/mac80211/patches/rt2x00/100-rt2x00_options.patch
diff --git a/package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
similarity index 100%
rename from package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/501-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
diff --git a/package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch b/package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch
similarity index 100%
rename from package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch
rename to package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch
diff --git a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
similarity index 95%
rename from package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
rename to package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
index f95fa9540c..697d8188f0 100644
--- a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -298,6 +298,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -305,6 +305,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -38,7 +38,7 @@
  	default y if (RT2X00_LIB=y && LEDS_CLASS=y) || (RT2X00_LIB=m && LEDS_CLASS!=n)
 --- a/drivers/net/wireless/ralink/rt2x00/Makefile
 +++ b/drivers/net/wireless/ralink/rt2x00/Makefile
-@@ -7,6 +7,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
+@@ -8,6 +8,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
  rt2x00lib-$(CPTCFG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
  rt2x00lib-$(CPTCFG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
  rt2x00lib-$(CPTCFG_RT2X00_LIB_LEDS)	+= rt2x00leds.o
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1421,6 +1421,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1423,6 +1423,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1562,6 +1566,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1566,6 +1570,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
@@ -152,7 +152,7 @@
  
 --- /dev/null
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -0,0 +1,105 @@
+@@ -0,0 +1,106 @@
 +/*
 +	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
 +	Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
@@ -255,7 +255,8 @@
 +
 +void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
 +{
-+	release_firmware(rt2x00dev->eeprom_file);
++	if (rt2x00dev->eeprom_file && rt2x00dev->eeprom_file->size)
++		release_firmware(rt2x00dev->eeprom_file);
 +	rt2x00dev->eeprom_file = NULL;
 +}
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
diff --git a/package/kernel/mac80211/patches/603-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
similarity index 100%
rename from package/kernel/mac80211/patches/603-rt2x00-of_load_eeprom_filename.patch
rename to package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
diff --git a/package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
similarity index 96%
rename from package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
rename to package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
index a98b49c541..b3e1220b60 100644
--- a/package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+++ b/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
@@ -22,7 +22,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	  Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -26,11 +26,73 @@
+@@ -26,11 +26,72 @@
  
  #include <linux/kernel.h>
  #include <linux/module.h>
@@ -84,7 +84,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +			rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
 +
 +	rt2x00dev->eeprom_file = &mtd_fw;
-+	mtd_fw.size = len;
 +	mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
 +
 +	dev_info(rt2x00dev->dev, "loaded eeprom from mtd device \"%s\"\n", part);
@@ -96,7 +95,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -58,6 +120,9 @@ static int rt2x00lib_request_eeprom_file
+@@ -58,6 +119,9 @@ static int rt2x00lib_request_eeprom_file
  	const char *ee_name;
  	int retval;
  
diff --git a/package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
similarity index 100%
rename from package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch
rename to package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
diff --git a/package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
similarity index 100%
rename from package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch
rename to package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
diff --git a/package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
similarity index 100%
rename from package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch
rename to package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
diff --git a/package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
similarity index 94%
rename from package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
rename to package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index 02b66e3bc0..ed219c801e 100644
--- a/package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -234,10 +234,17 @@ static int rt2800soc_probe(struct platfo
+@@ -232,10 +232,17 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
  }
  
diff --git a/package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
similarity index 95%
rename from package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
rename to package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
index ad70aa7826..f0c079b62b 100644
--- a/package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9285,6 +9286,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9458,6 +9459,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
diff --git a/package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
similarity index 100%
rename from package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch
rename to package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
diff --git a/package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
similarity index 58%
rename from package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
rename to package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
index 9fad80b672..2b6aa43c2d 100644
--- a/package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
+++ b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
@@ -6,8 +6,13 @@ To: Stanislaw Gruszka <sgruszka@redhat.com>
 Cc: Helmut Schaa <helmut.schaa@googlemail.com>,
     linux-wireless@vger.kernel.org,
     Kalle Valo <kvalo@codeaurora.org>
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: quoted-printable
 
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
+[pozega.tomislav@gmail.com: use chanreg and dccal helpers.]
+
 ---
  drivers/net/wireless/ralink/rt2x00/rt2800.h    |  1 +
  drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 70 +++++++++++++++++++++++++-
@@ -15,7 +20,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -2749,6 +2749,7 @@ enum rt2800_eeprom_word {
+@@ -2750,6 +2750,7 @@ enum rt2800_eeprom_word {
  #define EEPROM_NIC_CONF2_RX_STREAM	FIELD16(0x000f)
  #define EEPROM_NIC_CONF2_TX_STREAM	FIELD16(0x00f0)
  #define EEPROM_NIC_CONF2_CRYSTAL	FIELD16(0x0600)
@@ -25,7 +30,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
   * EEPROM LNA
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4120,6 +4120,61 @@ static void rt2800_config_channel(struct
+@@ -4290,6 +4290,45 @@ static void rt2800_config_channel(struct
  		rt2800_iq_calibrate(rt2x00dev, rf->channel);
  	}
  
@@ -42,38 +47,22 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +			reg |= 0x00000101;
 +			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
 +
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 43, 0x73);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 43, 0x73);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 44, 0x73);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 44, 0x73);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 45, 0x73);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0x73);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 46, 0x27);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 46, 0x27);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0xC8);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0xC8);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 48, 0xA4);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 48, 0xA4);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 49, 0x05);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 49, 0x05);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 54, 0x27);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 54, 0x27);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 55, 0xC8);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 55, 0xC8);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 56, 0xA4);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 56, 0xA4);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 57, 0x05);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 57, 0x05);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 58, 0x27);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 58, 0x27);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 59, 0xC8);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 59, 0xC8);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 60, 0xA4);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 60, 0xA4);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 4, 61, 0x05);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 6, 61, 0x05);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 5, 05, 0x00);
-+			rt2800_rfcsr_write_bank(rt2x00dev, 7, 05, 0x00);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
 +
 +			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
 +					      0x36303636);
@@ -87,7 +76,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	bbp = rt2800_bbp_read(rt2x00dev, 4);
  	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
  	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9314,7 +9369,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9487,7 +9526,8 @@ static int rt2800_init_eeprom(struct rt2
  	 */
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  
@@ -97,7 +86,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		if (rt2x00_get_field16(eeprom,
  		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
  		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9325,6 +9381,18 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9498,6 +9538,18 @@ static int rt2800_init_eeprom(struct rt2
  			      &rt2x00dev->cap_flags);
  	}
  
diff --git a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
new file mode 100644
index 0000000000..454f55b1cf
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
@@ -0,0 +1,89 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8349,6 +8349,58 @@ static void rt2800_init_rfcsr_5592(struc
+ 	rt2800_led_open_drain_enable(rt2x00dev);
+ }
+ 
++void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev)
++{
++	u8 rfb5r1_org, rfb7r1_org, rfvalue;
++	u32 mac0518, mac051c, mac0528, mac052c;
++	u8 i;
++
++	rt2x00_info(rt2x00dev, "RF Tx self calibration start\n");
++	mac0518 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	mac051c = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	mac0528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
++	mac052c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
++
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0xC);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x3306);
++	rt2800_register_write(rt2x00dev, RF_CONTROL2, 0x3330);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0xfffff);
++	rfb5r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
++	rfb7r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, 0x4);
++	for (i = 0; i < 100; i = i + 1) {
++		udelay(50);
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
++		if((rfvalue & 0x04) != 0x4)
++			break;
++	}
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, rfb5r1_org);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, 0x4);
++	for (i = 0; i < 100; i = i + 1) {
++		udelay(50);
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
++		if((rfvalue & 0x04) != 0x4)
++			break;
++	}
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, rfb7r1_org);
++
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, mac0518);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, mac051c);
++	rt2800_register_write(rt2x00dev, RF_CONTROL2, mac0528);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
++
++	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
++
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_self_txdc_cal);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -8956,6 +9008,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ }
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -243,6 +243,7 @@ void rt2800_link_tuner(struct rt2x00_dev
+ 		       const u32 count);
+ void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -572,6 +572,7 @@ struct rt2x00lib_ops {
+ 			    struct link_qual *qual, const u32 count);
+ 	void (*gain_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*vco_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
new file mode 100644
index 0000000000..6f0d5b577f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
@@ -0,0 +1,193 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8401,6 +8401,160 @@ void rt2800_rf_self_txdc_cal(struct rt2x
+ }
+ EXPORT_SYMBOL_GPL(rt2800_rf_self_txdc_cal);
+ 
++int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2)
++{
++	int calcode;
++	calcode = ((d2 - d1) * 1000) / 43;
++	if ((calcode%10) >= 5)
++		calcode += 10;
++	calcode = (calcode / 10);
++
++	return calcode;
++}
++EXPORT_SYMBOL_GPL(rt2800_calcrcalibrationcode);
++
++void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev)
++{
++	u32 savemacsysctrl;
++	u8 saverfb0r1, saverfb0r34, saverfb0r35;
++	u8 saverfb5r4, saverfb5r17, saverfb5r18;
++	u8 saverfb5r19, saverfb5r20;
++	u8 savebbpr22, savebbpr47, savebbpr49;
++	u8 bytevalue = 0;
++	int rcalcode;
++	u8 r_cal_code = 0;
++	char d1 = 0, d2 = 0;
++	u8 rfvalue;
++	u32 MAC_RF_BYPASS0, MAC_RF_CONTROL0, MAC_PWR_PIN_CFG;
++
++	saverfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++	saverfb0r34 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 34);
++	saverfb0r35 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
++	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
++	saverfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
++	saverfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
++	saverfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
++	saverfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
++
++	savebbpr22 = rt2800_bbp_read(rt2x00dev, 22);
++	savebbpr47 = rt2800_bbp_read(rt2x00dev, 47);
++	savebbpr49 = rt2800_bbp_read(rt2x00dev, 49);
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	MAC_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	MAC_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	MAC_PWR_PIN_CFG = rt2800_register_read(rt2x00dev, PWR_PIN_CFG);
++
++	{
++	u32 maccfg, macstatus;
++	int i;
++
++	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	maccfg &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
++
++	for (i = 0; i < 10000; i++) {
++		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macstatus & 0x1)
++			udelay(50);
++		else
++			break;
++		}
++
++	if (i == 10000)
++		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
++
++	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	maccfg &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
++
++	for (i = 0; i < 10000; i++) {
++		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macstatus & 0x2)
++			udelay(50);
++		else
++			break;
++		}
++
++	if (i == 10000)
++		rt2x00_warn(rt2x00dev, "Wait MAC Rx Status to MAX !!!\n");
++	}
++
++	rfvalue = (MAC_RF_BYPASS0 | 0x3004);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, rfvalue);
++	rfvalue = (MAC_RF_CONTROL0 | (~0x3002));
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, rfvalue);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x27);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0x83);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, 0x13);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
++
++	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x1);
++
++	rt2800_bbp_write(rt2x00dev, 47, 0x04);
++	rt2800_bbp_write(rt2x00dev, 22, 0x80);
++	udelay(100);
++	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
++	if (bytevalue > 128)
++		d1 = bytevalue - 256;
++	else
++		d1 = (char)bytevalue;
++	rt2800_bbp_write(rt2x00dev, 22, 0x0);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x01);
++
++	rt2800_bbp_write(rt2x00dev, 22, 0x80);
++	udelay(100);
++	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
++	if (bytevalue > 128)
++		d2 = bytevalue - 256;
++	else
++		d2 = (char)bytevalue;
++	rt2800_bbp_write(rt2x00dev, 22, 0x0);
++
++	rcalcode = rt2800_calcrcalibrationcode(rt2x00dev, d1, d2);
++	if (rcalcode < 0)
++		r_cal_code = 256 + rcalcode;
++	else
++		r_cal_code = (u8)rcalcode;
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 7, r_cal_code);
++
++	rt2800_bbp_write(rt2x00dev, 22, 0x0);
++
++	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
++	bytevalue |= 0x1;
++	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
++	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
++	bytevalue &= (~0x1);
++	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, saverfb0r1);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, saverfb0r34);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, saverfb0r35);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, saverfb5r17);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, saverfb5r18);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, saverfb5r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, saverfb5r20);
++
++	rt2800_bbp_write(rt2x00dev, 22, savebbpr22);
++	rt2800_bbp_write(rt2x00dev, 47, savebbpr47);
++	rt2800_bbp_write(rt2x00dev, 49, savebbpr49);
++
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, MAC_RF_BYPASS0);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, MAC_RF_CONTROL0);
++
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
++}
++EXPORT_SYMBOL_GPL(rt2800_r_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9008,6 +9162,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -244,6 +244,8 @@ void rt2800_link_tuner(struct rt2x00_dev
+ void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
++int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
++void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -573,6 +573,8 @@ struct rt2x00lib_ops {
+ 	void (*gain_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*vco_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
++	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
++	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
new file mode 100644
index 0000000000..fbeace27da
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
@@ -0,0 +1,102 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8555,6 +8555,71 @@ void rt2800_r_calibration(struct rt2x00_
+ }
+ EXPORT_SYMBOL_GPL(rt2800_r_calibration);
+ 
++void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
++{
++	u8 bbpreg = 0;
++	u32 macvalue = 0, macvalue1 = 0;
++	u8 saverfb0r2, saverfb5r4, saverfb7r4, rfvalue;
++	int i;
++
++	saverfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++	rfvalue = saverfb0r2;
++	rfvalue |= 0x03;
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfvalue);
++
++	rt2800_bbp_write(rt2x00dev, 158, 141);
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg |= 0x10;
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x8);
++
++	for (i = 0; i < 10000; i++) {
++		macvalue1 = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue1 & 0x1)
++			udelay(50);
++		else
++			break;
++	}
++
++	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 0);
++	saverfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
++	saverfb5r4 = saverfb5r4 & (~0x40);
++	saverfb7r4 = saverfb7r4 & (~0x40);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x64);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4);
++
++	rt2800_bbp_write(rt2x00dev, 158, 141);
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg = bbpreg & (~0x40);
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++	bbpreg |= 0x48;
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	for (i = 0; i < 10000; i++) {
++		bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++		if ((bbpreg & 0x40)==0)
++			break;
++		udelay(50);
++	}
++
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg = bbpreg & (~0x40);
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++
++	rt2800_bbp_write(rt2x00dev, 158, 141);
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg &= (~0x10);
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
++}
++EXPORT_SYMBOL_GPL(rt2800_rxdcoc_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9164,6 +9229,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 
+ 	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
++	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ }
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -246,6 +246,7 @@ void rt2800_vco_calibration(struct rt2x0
+ void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
+ int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -575,6 +575,7 @@ struct rt2x00lib_ops {
+ 	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
+ 	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
new file mode 100644
index 0000000000..f469c4ebc7
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
@@ -0,0 +1,417 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8620,6 +8620,386 @@ void rt2800_rxdcoc_calibration(struct rt
+ }
+ EXPORT_SYMBOL_GPL(rt2800_rxdcoc_calibration);
+ 
++static u32 rt2800_do_sqrt_accumulation(u32 si) {
++	u32 root, root_pre, bit;
++	char i;
++	bit = 1 << 15;
++	root = 0;
++	for (i = 15; i >= 0; i = i - 1) {
++		root_pre = root + bit;
++		if ((root_pre*root_pre) <= si)
++			root = root_pre;
++		bit = bit >> 1;
++	}
++
++	return root;
++}
++EXPORT_SYMBOL_GPL(rt2800_do_sqrt_accumulation);
++
++void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev) {
++	u8 rfb0r1, rfb0r2, rfb0r42;
++	u8 rfb4r0, rfb4r19;
++	u8 rfb5r3, rfb5r4, rfb5r17, rfb5r18, rfb5r19, rfb5r20;
++	u8 rfb6r0, rfb6r19;
++	u8 rfb7r3, rfb7r4, rfb7r17, rfb7r18, rfb7r19, rfb7r20;
++
++	u8 bbp1, bbp4;
++	u8 bbpr241, bbpr242;
++	u32 i;
++	u8 ch_idx;
++	u8 bbpval;
++	u8 rfval, vga_idx = 0;
++	int mi = 0, mq = 0, si = 0, sq = 0, riq = 0;
++	int sigma_i, sigma_q, r_iq, g_rx;
++	int g_imb;
++	int ph_rx;
++	u32 savemacsysctrl = 0;
++	u32 orig_RF_CONTROL0 = 0;
++	u32 orig_RF_BYPASS0 = 0;
++	u32 orig_RF_CONTROL1 = 0;
++	u32 orig_RF_BYPASS1 = 0;
++	u32 orig_RF_CONTROL3 = 0;
++	u32 orig_RF_BYPASS3 = 0;
++	u32 macstatus, bbpval1 = 0;
++	u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	orig_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	orig_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	orig_RF_CONTROL1 = rt2800_register_read(rt2x00dev, RF_CONTROL1);
++	orig_RF_BYPASS1 = rt2800_register_read(rt2x00dev, RF_BYPASS1);
++	orig_RF_CONTROL3 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++	orig_RF_BYPASS3 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++
++	bbp1 = rt2800_bbp_read(rt2x00dev, 1);
++	bbp4 = rt2800_bbp_read(rt2x00dev, 4);
++
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x0);
++
++	for (i = 0; i < 10000; i++) {
++		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macstatus & 0x3)
++			udelay(50);
++		else
++			break;
++	}
++
++	if (i == 10000)
++		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
++
++	bbpval = bbp4 & (~0x18);
++	bbpval = bbp4 | 0x00;
++	rt2800_bbp_write(rt2x00dev, 4, bbpval);
++
++	bbpval = rt2800_bbp_read(rt2x00dev, 21);
++	bbpval = bbpval | 1;
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++	bbpval = bbpval & 0xfe;
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL1, 0x00000202);
++	rt2800_register_write(rt2x00dev, RF_BYPASS1, 0x00000303);
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0101);
++	} else {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0000);
++	}
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, 0xf1f1);
++
++	rfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++	rfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++	rfb4r0 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
++	rfb4r19 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 19);
++	rfb5r3 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
++	rfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
++	rfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
++	rfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
++	rfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
++	rfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
++
++	rfb6r0 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
++	rfb6r19 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 19);
++	rfb7r3 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
++	rfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
++	rfb7r17 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
++	rfb7r18 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
++	rfb7r19 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
++	rfb7r20 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
++
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x87);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0x27);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x38);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x38);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x80);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 18, 0xC1);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 19, 0x60);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 20, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x0);
++	rt2800_bbp_write(rt2x00dev, 24, 0x0);
++
++	rt2800_bbp_dcoc_write(rt2x00dev, 5, 0x0);
++
++	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
++	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
++
++	rt2800_bbp_write(rt2x00dev, 241, 0x10);
++	rt2800_bbp_write(rt2x00dev, 242, 0x84);
++	rt2800_bbp_write(rt2x00dev, 244, 0x31);
++
++	bbpval = rt2800_bbp_dcoc_read(rt2x00dev, 3);
++	bbpval = bbpval & (~0x7);
++	rt2800_bbp_dcoc_write(rt2x00dev, 3, bbpval);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
++	usleep_range(1, 200);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003376);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
++	udelay(1);
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 23, 0x06);
++		rt2800_bbp_write(rt2x00dev, 24, 0x06);
++	} else {
++		rt2800_bbp_write(rt2x00dev, 23, 0x02);
++		rt2800_bbp_write(rt2x00dev, 24, 0x02);
++	}
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx = ch_idx + 1) {
++		if (ch_idx == 0) {
++			rfval = rfb0r1 & (~0x3);
++			rfval = rfb0r1 | 0x1;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
++			rfval = rfb0r2 & (~0x33);
++			rfval = rfb0r2 | 0x11;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
++			rfval = rfb0r42 & (~0x50);
++			rfval = rfb0r42 | 0x10;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
++
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
++			udelay(1);
++
++			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbpval | 0x00;
++			rt2800_bbp_write(rt2x00dev, 1, bbpval);
++
++			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x00);
++		} else {
++			rfval = rfb0r1 & (~0x3);
++			rfval = rfb0r1 | 0x2;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
++			rfval = rfb0r2 & (~0x33);
++			rfval = rfb0r2 | 0x22;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
++			rfval = rfb0r42 & (~0x50);
++			rfval = rfb0r42 | 0x40;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
++
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
++			udelay(1);
++
++			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbpval | 0x08;
++			rt2800_bbp_write(rt2x00dev, 1, bbpval);
++
++			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x01);
++		}
++		udelay(500);
++
++		vga_idx = 0;
++			while (vga_idx < 11) {
++				rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
++				rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
++
++				rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
++
++				for (i = 0; i < 10000; i++) {
++					bbpval = rt2800_bbp_read(rt2x00dev, 159);
++					if ((bbpval & 0xff) == 0x93)
++						udelay(50);
++					else
++						break;
++					}
++
++				if ((bbpval & 0xff) == 0x93) {
++					rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
++					goto restore_value;
++				}
++
++				for (i = 0; i < 5; i++) {
++					u32 bbptemp = 0;
++					u8 value = 0;
++					int result = 0;
++
++					rt2800_bbp_write(rt2x00dev, 158, 0x1e);
++					rt2800_bbp_write(rt2x00dev, 159, i);
++					rt2800_bbp_write(rt2x00dev, 158, 0x22);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + (value << 24);
++					rt2800_bbp_write(rt2x00dev, 158, 0x21);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + (value << 16);
++					rt2800_bbp_write(rt2x00dev, 158, 0x20);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + (value << 8);
++					rt2800_bbp_write(rt2x00dev, 158, 0x1f);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + value;
++
++					if ((i < 2) && (bbptemp & 0x800000))
++						result = (bbptemp & 0xffffff) - 0x1000000;
++					else if (i == 4)
++						result = bbptemp;
++					else
++						result = bbptemp;
++
++					if (i == 0)
++						mi = result/4096;
++					else if (i == 1)
++						mq = result/4096;
++					else if (i == 2)
++						si = bbptemp/4096;
++					else if (i == 3)
++						sq = bbptemp/4096;
++					else
++						riq = result/4096;
++				}
++
++				bbpval1 = si - mi*mi;
++				rt2x00_dbg(rt2x00dev, "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d", si, sq, riq, bbpval1, vga_idx);
++
++				if (bbpval1 >= (100*100))
++					break;
++
++				if (bbpval1 <= 100)
++					vga_idx = vga_idx + 9;
++				else if (bbpval1 <= 158)
++					vga_idx = vga_idx + 8;
++				else if (bbpval1 <= 251)
++					vga_idx = vga_idx + 7;
++				else if (bbpval1 <= 398)
++					vga_idx = vga_idx + 6;
++				else if (bbpval1 <= 630)
++					vga_idx = vga_idx + 5;
++				else if (bbpval1 <= 1000)
++					vga_idx = vga_idx + 4;
++				else if (bbpval1 <= 1584)
++					vga_idx = vga_idx + 3;
++				else if (bbpval1 <= 2511)
++					vga_idx = vga_idx + 2;
++				else
++					vga_idx = vga_idx + 1;
++			}
++
++		sigma_i = rt2800_do_sqrt_accumulation(100*(si - mi*mi));
++		sigma_q = rt2800_do_sqrt_accumulation(100*(sq - mq*mq));
++		r_iq = 10*(riq-(mi*mq));
++
++		rt2x00_dbg(rt2x00dev, "Sigma_i=%d, Sigma_q=%d, R_iq=%d", sigma_i, sigma_q, r_iq);
++
++		if (((sigma_i <= 1400 ) && (sigma_i >= 1000))
++			&& ((sigma_i - sigma_q) <= 112)
++			&& ((sigma_i - sigma_q) >= -112)
++			&& ((mi <= 32) && (mi >= -32))
++			&& ((mq <= 32) && (mq >= -32))) {
++				r_iq = 10*(riq-(mi*mq));
++				rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++
++				g_rx = (1000 * sigma_q) / sigma_i;
++				g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
++				ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
++				rt2x00_info(rt2x00dev, "RXIQ G_imb=%d, Ph_rx=%d\n", g_imb, ph_rx);
++
++				if ((ph_rx > 20) || (ph_rx < -20)) {
++					ph_rx = 0;
++					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++				}
++
++				if ((g_imb > 12) || (g_imb < -12)) {
++					g_imb = 0;
++					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++				}
++			}
++		else {
++			g_imb = 0;
++			ph_rx = 0;
++			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++			rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++		}
++
++		if (ch_idx == 0) {
++			rt2800_bbp_write(rt2x00dev, 158, 0x37);
++			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
++			rt2800_bbp_write(rt2x00dev, 158, 0x35);
++			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
++		} else {
++			rt2800_bbp_write(rt2x00dev, 158, 0x55);
++			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
++			rt2800_bbp_write(rt2x00dev, 158, 0x53);
++			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
++		}
++	}
++
++restore_value:
++	rt2800_bbp_write(rt2x00dev, 158, 0x3);
++	bbpval = rt2800_bbp_read(rt2x00dev, 159);
++	rt2800_bbp_write(rt2x00dev, 159, (bbpval | 0x07));
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++	rt2800_bbp_write(rt2x00dev, 1, bbp1);
++	rt2800_bbp_write(rt2x00dev, 4, bbp4);
++	rt2800_bbp_write(rt2x00dev, 241, bbpr241);
++	rt2800_bbp_write(rt2x00dev, 242, bbpr242);
++
++	rt2800_bbp_write(rt2x00dev, 244, 0x00);
++	bbpval = rt2800_bbp_read(rt2x00dev, 21);
++	bbpval = (bbpval | 0x1);
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++	usleep_range(10, 200);
++	bbpval = (bbpval & 0xfe);
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfb0r1);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfb0r2);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, rfb4r0);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 19, rfb4r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, rfb5r3);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, rfb5r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, rfb5r17);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, rfb5r18);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, rfb5r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, rfb5r20);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, rfb6r0);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 19, rfb6r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, rfb7r3);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, rfb7r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, rfb7r17);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, rfb7r18);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, rfb7r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, rfb7r20);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, orig_RF_CONTROL0);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, orig_RF_BYPASS0);
++	rt2800_register_write(rt2x00dev, RF_CONTROL1, orig_RF_CONTROL1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS1, orig_RF_BYPASS1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL3, orig_RF_CONTROL3);
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, orig_RF_BYPASS3);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++}
++EXPORT_SYMBOL_GPL(rt2800_rxiq_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9232,6 +9612,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
++	rt2800_rxiq_calibration(rt2x00dev);
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -247,6 +247,7 @@ void rt2800_rf_self_txdc_cal(struct rt2x
+ int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -576,6 +576,7 @@ struct rt2x00lib_ops {
+ 	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*rxiq_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
new file mode 100644
index 0000000000..31a860c1a7
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
@@ -0,0 +1,1002 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -9000,6 +9000,954 @@ restore_value:
+ }
+ EXPORT_SYMBOL_GPL(rt2800_rxiq_calibration);
+ 
++static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_reg_record[][13], u8 chain)
++{
++	u8 rfvalue = 0;
++
++	if (chain == CHAIN_0) {
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++		rf_reg_record[CHAIN_0][0].bank = 0;
++		rf_reg_record[CHAIN_0][0].reg = 1;
++		rf_reg_record[CHAIN_0][0].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++		rf_reg_record[CHAIN_0][1].bank = 0;
++		rf_reg_record[CHAIN_0][1].reg = 2;
++		rf_reg_record[CHAIN_0][1].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
++		rf_reg_record[CHAIN_0][2].bank = 0;
++		rf_reg_record[CHAIN_0][2].reg = 35;
++		rf_reg_record[CHAIN_0][2].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++		rf_reg_record[CHAIN_0][3].bank = 0;
++		rf_reg_record[CHAIN_0][3].reg = 42;
++		rf_reg_record[CHAIN_0][3].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
++		rf_reg_record[CHAIN_0][4].bank = 4;
++		rf_reg_record[CHAIN_0][4].reg = 0;
++		rf_reg_record[CHAIN_0][4].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 2);
++		rf_reg_record[CHAIN_0][5].bank = 4;
++		rf_reg_record[CHAIN_0][5].reg = 2;
++		rf_reg_record[CHAIN_0][5].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 34);
++		rf_reg_record[CHAIN_0][6].bank = 4;
++		rf_reg_record[CHAIN_0][6].reg = 34;
++		rf_reg_record[CHAIN_0][6].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
++		rf_reg_record[CHAIN_0][7].bank = 5;
++		rf_reg_record[CHAIN_0][7].reg = 3;
++		rf_reg_record[CHAIN_0][7].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
++		rf_reg_record[CHAIN_0][8].bank = 5;
++		rf_reg_record[CHAIN_0][8].reg = 4;
++		rf_reg_record[CHAIN_0][8].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
++		rf_reg_record[CHAIN_0][9].bank = 5;
++		rf_reg_record[CHAIN_0][9].reg = 17;
++		rf_reg_record[CHAIN_0][9].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
++		rf_reg_record[CHAIN_0][10].bank = 5;
++		rf_reg_record[CHAIN_0][10].reg = 18;
++		rf_reg_record[CHAIN_0][10].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
++		rf_reg_record[CHAIN_0][11].bank = 5;
++		rf_reg_record[CHAIN_0][11].reg = 19;
++		rf_reg_record[CHAIN_0][11].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
++		rf_reg_record[CHAIN_0][12].bank = 5;
++		rf_reg_record[CHAIN_0][12].reg = 20;
++		rf_reg_record[CHAIN_0][12].value = rfvalue;
++	} else if (chain == CHAIN_1) {
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++		rf_reg_record[CHAIN_1][0].bank = 0;
++		rf_reg_record[CHAIN_1][0].reg = 1;
++		rf_reg_record[CHAIN_1][0].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++		rf_reg_record[CHAIN_1][1].bank = 0;
++		rf_reg_record[CHAIN_1][1].reg = 2;
++		rf_reg_record[CHAIN_1][1].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
++		rf_reg_record[CHAIN_1][2].bank = 0;
++		rf_reg_record[CHAIN_1][2].reg = 35;
++		rf_reg_record[CHAIN_1][2].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++		rf_reg_record[CHAIN_1][3].bank = 0;
++		rf_reg_record[CHAIN_1][3].reg = 42;
++		rf_reg_record[CHAIN_1][3].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
++		rf_reg_record[CHAIN_1][4].bank = 6;
++		rf_reg_record[CHAIN_1][4].reg = 0;
++		rf_reg_record[CHAIN_1][4].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 2);
++		rf_reg_record[CHAIN_1][5].bank = 6;
++		rf_reg_record[CHAIN_1][5].reg = 2;
++		rf_reg_record[CHAIN_1][5].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 34);
++		rf_reg_record[CHAIN_1][6].bank = 6;
++		rf_reg_record[CHAIN_1][6].reg = 34;
++		rf_reg_record[CHAIN_1][6].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
++		rf_reg_record[CHAIN_1][7].bank = 7;
++		rf_reg_record[CHAIN_1][7].reg = 3;
++		rf_reg_record[CHAIN_1][7].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
++		rf_reg_record[CHAIN_1][8].bank = 7;
++		rf_reg_record[CHAIN_1][8].reg = 4;
++		rf_reg_record[CHAIN_1][8].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
++		rf_reg_record[CHAIN_1][9].bank = 7;
++		rf_reg_record[CHAIN_1][9].reg = 17;
++		rf_reg_record[CHAIN_1][9].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
++		rf_reg_record[CHAIN_1][10].bank = 7;
++		rf_reg_record[CHAIN_1][10].reg = 18;
++		rf_reg_record[CHAIN_1][10].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
++		rf_reg_record[CHAIN_1][11].bank = 7;
++		rf_reg_record[CHAIN_1][11].reg = 19;
++		rf_reg_record[CHAIN_1][11].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
++		rf_reg_record[CHAIN_1][12].bank = 7;
++		rf_reg_record[CHAIN_1][12].reg = 20;
++		rf_reg_record[CHAIN_1][12].value = rfvalue;
++	} else {
++		rt2x00_warn(rt2x00dev, "Unknown chain = %u\n", chain);
++		return;
++	}
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_configstore);
++
++static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_record[][13])
++{
++	u8 chain_index = 0, record_index = 0;
++	u8 bank = 0, rf_register = 0, value = 0;
++
++	for (chain_index = 0; chain_index < 2; chain_index++) {
++		for (record_index = 0; record_index < 13; record_index++) {
++			bank = rf_record[chain_index][record_index].bank;
++			rf_register = rf_record[chain_index][record_index].reg;
++			value = rf_record[chain_index][record_index].value;
++			rt2800_rfcsr_write_bank(rt2x00dev, bank, rf_register, value);
++			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n", bank, rf_register, value);
++		}
++	}
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_configrecover);
++
++static void rt2800_setbbptonegenerator(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_bbp_write(rt2x00dev, 158, 0xAA);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xAB);
++	rt2800_bbp_write(rt2x00dev, 159, 0x0A);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xAC);
++	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xAD);
++	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
++
++	rt2800_bbp_write(rt2x00dev, 244, 0x40);
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_setbbptonegenerator);
++
++u32 rt2800_do_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx, u8 read_neg)
++{
++	u32 macvalue = 0;
++	int fftout_i = 0, fftout_q = 0;
++	u32 ptmp=0, pint = 0;
++	u8 bbp = 0;
++	u8 tidxi;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x9b);
++
++	bbp = 0x9b;
++
++	while (bbp == 0x9b) {
++		udelay(10);
++		bbp = rt2800_bbp_read(rt2x00dev, 159);
++		bbp = bbp & 0xff;
++	}
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xba);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++
++	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
++
++	fftout_i = (macvalue >> 16);
++	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
++	fftout_q = (macvalue & 0xffff);
++	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
++	ptmp = (fftout_i * fftout_i);
++	ptmp = ptmp + (fftout_q * fftout_q);
++	pint = ptmp;
++	rt2x00_dbg(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
++	if (read_neg) {
++		pint = pint >> 1;
++		tidxi = 0x40 - tidx;
++		tidxi = tidxi & 0x3f;
++
++		rt2800_bbp_write(rt2x00dev, 158, 0xba);
++		rt2800_bbp_write(rt2x00dev, 159, tidxi);
++		rt2800_bbp_write(rt2x00dev, 159, tidxi);
++		rt2800_bbp_write(rt2x00dev, 159, tidxi);
++
++		macvalue = rt2800_register_read(rt2x00dev, 0x057C);
++
++		fftout_i = (macvalue >> 16);
++		fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
++		fftout_q = (macvalue & 0xffff);
++		fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
++		ptmp = (fftout_i * fftout_i);
++		ptmp = ptmp + (fftout_q * fftout_q);
++		ptmp = ptmp >> 1;
++		pint = pint + ptmp;
++	}
++
++	return pint;
++}
++EXPORT_SYMBOL_GPL(rt2800_do_fft_accumulation);
++
++u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx) {
++	u32 macvalue = 0;
++	int fftout_i = 0, fftout_q = 0;
++	u32 ptmp=0, pint = 0;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xBA);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++
++	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
++
++	fftout_i = (macvalue >> 16);
++	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
++	fftout_q = (macvalue & 0xffff);
++	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
++	ptmp = (fftout_i * fftout_i);
++	ptmp = ptmp + (fftout_q * fftout_q);
++	pint = ptmp;
++	rt2x00_info(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
++
++	return pint;
++}
++EXPORT_SYMBOL_GPL(rt2800_read_fft_accumulation);
++
++static void rt2800_write_dc(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc, u8 iorq, u8 dc)
++{
++	u8 bbp = 0;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
++	bbp = alc | 0x80;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	if (ch_idx == 0)
++		bbp = (iorq == 0) ? 0xb1: 0xb2;
++	else
++		bbp = (iorq == 0) ? 0xb8: 0xb9;
++
++	rt2800_bbp_write(rt2x00dev, 158, bbp);
++	bbp = dc;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_write_dc);
++
++static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
++{
++	u32 p0 = 0, p1 = 0, pf = 0;
++	char idx0 = 0, idx1 = 0;
++	u8 idxf[] = {0x00, 0x00};
++	u8 ibit = 0x20;
++	u8 iorq;
++	char bidx;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
++	rt2800_bbp_write(rt2x00dev, 159, 0x80);
++
++	for (bidx = 5; bidx >= 0; bidx--) {
++		for (iorq = 0; iorq <= 1; iorq++) {
++			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
++
++			if (idxf[iorq] == 0x20) {
++				idx0 = 0x20;
++				p0 = pf;
++			} else {
++				idx0 = idxf[iorq] - ibit;
++				idx0 = idx0 & 0x3F;
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx0);
++				p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++			}
++
++			idx1 = idxf[iorq] + ((bidx == 5) ? 0 : ibit);
++			idx1 = idx1 & 0x3F;
++			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx1);
++			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++
++			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n", alc_idx, iorq, idxf[iorq]);
++			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x !\n", p0, p1, pf, idx0, idx1, ibit);
++
++			if ((bidx != 5) && (pf <= p0) && (pf < p1)) {
++				pf = pf;
++				idxf[iorq] = idxf[iorq];
++			} else if (p0 < p1) {
++				pf = p0;
++				idxf[iorq] = idx0 & 0x3F;
++			} else {
++				pf = p1;
++				idxf[iorq] = idx1 & 0x3F;
++			}
++			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n", iorq, iorq, idxf[iorq], pf);
++
++			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idxf[iorq]);
++
++		}
++		ibit = ibit >> 1;
++	}
++	dc_result[ch_idx][alc_idx][0] = idxf[0];
++	dc_result[ch_idx][alc_idx][1] = idxf[1];
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_loft_search);
++
++static void rt2800_iq_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 *ges, u8 *pes)
++{
++	u32 p0 = 0, p1 = 0, pf = 0;
++	char perr = 0, gerr = 0, iq_err = 0;
++	char pef = 0, gef = 0;
++	char psta, pend;
++	char gsta, gend;
++
++	u8 ibit = 0x20;
++	u8 first_search = 0x00, touch_neg_max = 0x00;
++	char idx0 = 0, idx1 = 0;
++	u8 gop;
++	u8 bbp = 0;
++	char bidx;
++
++	rt2x00_info(rt2x00dev, "IQCalibration Start!\n");
++	for (bidx = 5; bidx >= 1; bidx--) {
++		for (gop = 0; gop < 2; gop++) {
++			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
++
++			if ((gop == 1) || (bidx < 4)) {
++				if (gop == 0)
++					iq_err = gerr;
++				else
++					iq_err = perr;
++
++				first_search = (gop == 0) ? (bidx == 3) : (bidx == 5);
++				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) : ((iq_err & 0x3F) == 0x20);
++
++				if (touch_neg_max) {
++					p0 = pf;
++					idx0 = iq_err;
++				} else {
++					idx0 = iq_err - ibit;
++					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29): ((gop == 0) ? 0x46 : 0x47);
++
++					rt2800_bbp_write(rt2x00dev, 158, bbp);
++					rt2800_bbp_write(rt2x00dev, 159, idx0);
++
++					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
++				}
++
++				idx1 = iq_err + (first_search ? 0 : ibit);
++				idx1 = (gop == 0) ? (idx1 & 0x0F) : (idx1 & 0x3F);
++
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++
++				rt2800_bbp_write(rt2x00dev, 158, bbp);
++				rt2800_bbp_write(rt2x00dev, 159, idx1);
++
++				p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
++
++				rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x !\n", p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
++
++				if ((!first_search) && (pf <= p0) && (pf < p1)) {
++					pf = pf;
++				} else if (p0 < p1) {
++					pf = p0;
++					iq_err = idx0;
++				} else {
++					pf = p1;
++					iq_err = idx1;
++				}
++
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++
++				rt2800_bbp_write(rt2x00dev, 158, bbp);
++				rt2800_bbp_write(rt2x00dev, 159, iq_err);
++
++				if (gop == 0)
++					gerr = iq_err;
++				else
++					perr = iq_err;
++
++				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n", pf, gerr & 0x0F, perr & 0x3F);
++
++			}
++		}
++
++		if (bidx > 0)
++			ibit = (ibit >> 1);
++	}
++	gerr = (gerr & 0x08) ? (gerr & 0x0F) - 0x10 : (gerr & 0x0F);
++	perr = (perr & 0x20) ? (perr & 0x3F) - 0x40 : (perr & 0x3F);
++
++	gerr = (gerr < -0x07) ? -0x07 : (gerr > 0x05) ? 0x05 : gerr;
++	gsta = gerr - 1;
++	gend = gerr + 2;
++
++	perr = (perr < -0x1f) ? -0x1f : (perr > 0x1d) ? 0x1d : perr;
++	psta = perr - 1;
++	pend = perr + 2;
++
++	for (gef = gsta; gef <= gend; gef = gef + 1)
++		for (pef = psta; pef <= pend; pef = pef + 1) {
++			bbp = (ch_idx == 0) ? 0x28 : 0x46;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, gef & 0x0F);
++
++			bbp = (ch_idx == 0) ? 0x29 : 0x47;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, pef & 0x3F);
++
++			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
++			if ((gef == gsta) && (pef == psta)) {
++				pf = p1;
++				gerr = gef;
++				perr = pef;
++			}
++			else if (pf > p1){
++				pf = p1;
++				gerr = gef;
++				perr = pef;
++			}
++			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n", p1, pf, gef & 0x0F, pef & 0x3F);
++		}
++
++	ges[ch_idx] = gerr & 0x0F;
++	pes[ch_idx] = perr & 0x3F;
++
++	rt2x00_info(rt2x00dev, "IQCalibration Done! CH = %u, (gain=%2x, phase=%2x)\n", ch_idx, gerr & 0x0F, perr & 0x3F);
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_iq_search);
++
++static void rt2800_rf_aux_tx0_loopback(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x21);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x10);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x1b);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 2, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 34, 0xee);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0xd7);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0xa2);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_aux_tx0_loopback);
++
++static void rt2800_rf_aux_tx1_loopback(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x22);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x20);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x4b);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 2, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 34, 0xee);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, 0xd7);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, 0xa2);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, 0x20);
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_aux_tx1_loopback);
++
++void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
++{
++	rf_reg_pair rf_store[CHAIN_NUM][13];
++	u32 macorg1 = 0;
++	u32 macorg2 = 0;
++	u32 macorg3 = 0;
++	u32 macorg4 = 0;
++	u32 macorg5 = 0;
++	u32 orig528 = 0;
++	u32 orig52c = 0;
++
++	u32 savemacsysctrl = 0, mtxcycle = 0;
++	u32 macvalue = 0;
++	u32 mac13b8 = 0;
++	u32 p0 = 0, p1 = 0;
++	u32 p0_idx10 = 0, p1_idx10 = 0;
++
++	u8 rfvalue;
++	u8 loft_dc_search_result[CHAIN_NUM][RF_ALC_NUM][2];
++	u8 ger[CHAIN_NUM], per[CHAIN_NUM];
++	u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
++	u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
++
++	u8 vga_gain[] = {14, 14};
++	u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
++	u8 bbp = 0, ch_idx = 0, rf_alc_idx = 0, idx = 0;
++	u8 bbpr30, rfb0r39, rfb0r42;
++	u8 bbpr1;
++	u8 bbpr4;
++	u8 bbpr241, bbpr242;
++	u8 count_step;
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
++	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
++	orig528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
++	orig52c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x01)
++			udelay(50);
++		else
++			break;
++	}
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x08);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x02)
++			udelay(50);
++		else
++			break;
++	}
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
++	}
++
++	bbpr30 = rt2800_bbp_read(rt2x00dev, 30);
++	rfb0r39 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 39);
++	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++
++	rt2800_bbp_write(rt2x00dev, 30, 0x1F);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x5B);
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++	rt2800_setbbptonegenerator(rt2x00dev);
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++		rt2800_bbp_write(rt2x00dev, 23, 0x00);
++		rt2800_bbp_write(rt2x00dev, 24, 0x00);
++		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
++		rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
++		rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++		rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
++		rt2800_register_write(rt2x00dev, 0x13b8, 0x10);
++		udelay(1);
++
++		if (ch_idx == 0) {
++			rt2800_rf_aux_tx0_loopback(rt2x00dev);
++		} else {
++			rt2800_rf_aux_tx1_loopback(rt2x00dev);
++		}
++		udelay(1);
++
++		if (ch_idx == 0) {
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
++		} else {
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
++		}
++
++		rt2800_bbp_write(rt2x00dev, 158, 0x05);
++		rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++		rt2800_bbp_write(rt2x00dev, 158, 0x01);
++		if (ch_idx == 0)
++			rt2800_bbp_write(rt2x00dev, 159, 0x00);
++		else
++			rt2800_bbp_write(rt2x00dev, 159, 0x01);
++
++		vga_gain[ch_idx] = 18;
++		for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
++			rt2800_bbp_write(rt2x00dev, 23, bbp_2324gain[rf_alc_idx]);
++			rt2800_bbp_write(rt2x00dev, 24, bbp_2324gain[rf_alc_idx]);
++
++			macvalue = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++			macvalue &= (~0x0000F1F1);
++			macvalue |= (rf_gain[rf_alc_idx] << 4);
++			macvalue |= (rf_gain[rf_alc_idx] << 12);
++			rt2800_register_write(rt2x00dev, RF_CONTROL3, macvalue);
++			macvalue = (0x0000F1F1);
++			rt2800_register_write(rt2x00dev, RF_BYPASS3, macvalue);
++
++			if (rf_alc_idx == 0) {
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x21);
++				for (;vga_gain[ch_idx] > 0;vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
++					rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
++					rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
++					rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
++					rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
++					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
++					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x21);
++					p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++					rt2x00_dbg(rt2x00dev, "LOFT AGC %d %d\n", p0, p1);
++					if ((p0 < 7000*7000) && (p1 < (7000*7000))) {
++						break;
++					}
++				}
++
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
++
++				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
++
++				if (vga_gain[ch_idx] < 0)
++					vga_gain[ch_idx] = 0;
++		 	}
++
++			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
++
++			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
++
++			rt2800_loft_search(rt2x00dev, ch_idx, rf_alc_idx, loft_dc_search_result);
++		}
++	}
++
++	for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
++		for (idx = 0; idx < 4; idx++) {
++			rt2800_bbp_write(rt2x00dev, 158, 0xB0);
++			bbp = (idx<<2) + rf_alc_idx;
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " ALC %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb1);
++			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x00];
++			bbp = bbp & 0x3F;
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " I0 %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb2);
++			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x01];
++			bbp = bbp & 0x3F;
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " Q0 %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb8);
++			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x00];
++			bbp = bbp & 0x3F;
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " I1 %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb9);
++			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x01];
++			bbp = bbp & 0x3F;
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " Q1 %2x\n", bbp);
++		}
++	}
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++	bbp = 0x00;
++	rt2800_bbp_write(rt2x00dev, 244, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 21, 0x01);
++	udelay(1);
++	rt2800_bbp_write(rt2x00dev, 21, 0x00);
++
++	rt2800_rf_configrecover(rt2x00dev, rf_store);
++
++	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
++	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++	rt2800_register_write(rt2x00dev, RF_CONTROL2, orig528);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, orig52c);
++	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
++
++	rt2x00_info(rt2x00dev, "LOFT Calibration Done!\n");
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
++	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++
++	bbpr1 = rt2800_bbp_read(rt2x00dev, 1);
++	bbpr4 = rt2800_bbp_read(rt2x00dev, 4);
++	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
++	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
++	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x01)
++			udelay(50);
++		else
++			break;
++	}
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x08);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x02)
++			udelay(50);
++		else
++			break;
++	}
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000101);
++		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 4, bbpr4 & (~0x18));
++		rt2800_bbp_write(rt2x00dev, 21, 0x01);
++		udelay(1);
++		rt2800_bbp_write(rt2x00dev, 21, 0x00);
++
++		rt2800_bbp_write(rt2x00dev, 241, 0x14);
++		rt2800_bbp_write(rt2x00dev, 242, 0x80);
++		rt2800_bbp_write(rt2x00dev, 244, 0x31);
++	} else {
++		rt2800_setbbptonegenerator(rt2x00dev);
++	}
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
++	udelay(1);
++
++	rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
++
++	if (!test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000000);
++		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
++	}
++
++	rt2800_register_write(rt2x00dev, 0x13b8, 0x00000010);
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
++	}
++
++	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x3B);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x3B);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x03);
++	rt2800_bbp_write(rt2x00dev, 159, 0x60);
++	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
++	rt2800_bbp_write(rt2x00dev, 159, 0x80);
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++		rt2800_bbp_write(rt2x00dev, 23, 0x00);
++		rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++		if (ch_idx == 0) {
++			rt2800_bbp_write(rt2x00dev, 158, 0x01);
++			rt2800_bbp_write(rt2x00dev, 159, 0x00);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++				bbp = bbpr1 & (~0x18);
++				bbp = bbp | 0x00;
++				rt2800_bbp_write(rt2x00dev, 1, bbp);
++			}
++			rt2800_rf_aux_tx0_loopback(rt2x00dev);
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
++		} else {
++			rt2800_bbp_write(rt2x00dev, 158, 0x01);
++			rt2800_bbp_write(rt2x00dev, 159, 0x01);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
++				bbp = bbpr1 & (~0x18);
++				bbp = bbp | 0x08;
++				rt2800_bbp_write(rt2x00dev, 1, bbp);
++			}
++			rt2800_rf_aux_tx1_loopback(rt2x00dev);
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
++		}
++
++		rt2800_bbp_write(rt2x00dev, 158, 0x05);
++		rt2800_bbp_write(rt2x00dev, 159, 0x04);
++
++		bbp = (ch_idx == 0) ? 0x28 : 0x46;
++		rt2800_bbp_write(rt2x00dev, 158, bbp);
++		rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++			rt2800_bbp_write(rt2x00dev, 23, 0x06);
++			rt2800_bbp_write(rt2x00dev, 24, 0x06);
++			count_step = 1;
++		} else {
++			rt2800_bbp_write(rt2x00dev, 23, 0x1F);
++			rt2800_bbp_write(rt2x00dev, 24, 0x1F);
++			count_step = 2;
++		}
++
++		for (;vga_gain[ch_idx] < 19; vga_gain[ch_idx]=(vga_gain[ch_idx] + count_step)) {
++			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
++			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
++
++			bbp = (ch_idx == 0) ? 0x29 : 0x47;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, 0x00);
++			p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++				p0_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
++			}
++
++			bbp = (ch_idx == 0) ? 0x29 : 0x47;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, 0x21);
++			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
++				p1_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
++			}
++
++			rt2x00_dbg(rt2x00dev, "IQ AGC %d %d\n", p0, p1);
++
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++				rt2x00_dbg(rt2x00dev, "IQ AGC IDX 10 %d %d\n", p0_idx10, p1_idx10);
++				if ((p0_idx10 > 7000*7000) || (p1_idx10 > 7000*7000)) {
++					if (vga_gain[ch_idx]!=0)
++						vga_gain[ch_idx] = vga_gain[ch_idx]-1;
++					break;
++				}
++			}
++
++			if ((p0 > 2500*2500) || (p1 > 2500*2500)) {
++				break;
++			}
++		}
++
++		if (vga_gain[ch_idx] > 18)
++			vga_gain[ch_idx] = 18;
++		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
++
++		bbp = (ch_idx == 0) ? 0x29 : 0x47;
++		rt2800_bbp_write(rt2x00dev, 158, bbp);
++		rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++		rt2800_iq_search(rt2x00dev, ch_idx, ger, per);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x28);
++	bbp = ger[CHAIN_0] & 0x0F;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x29);
++	bbp = per[CHAIN_0] & 0x3F;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x46);
++	bbp = ger[CHAIN_1] & 0x0F;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x47);
++	bbp = per[CHAIN_1] & 0x3F;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 1, bbpr1);
++		rt2800_bbp_write(rt2x00dev, 241, bbpr241);
++		rt2800_bbp_write(rt2x00dev, 242, bbpr242);
++	}
++	rt2800_bbp_write(rt2x00dev, 244, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 30, bbpr30);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, rfb0r39);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 4, bbpr4);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 21, 0x01);
++	udelay(1);
++	rt2800_bbp_write(rt2x00dev, 21, 0x00);
++
++	rt2800_rf_configrecover(rt2x00dev, rf_store);
++
++	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
++	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
++
++	rt2x00_info(rt2x00dev, "TX IQ Calibration Done!\n");
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_loft_iq_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9612,6 +10560,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
++	rt2800_loft_iq_calibration(rt2x00dev);
+ 	rt2800_rxiq_calibration(rt2x00dev);
+ }
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -28,6 +28,16 @@
+ #define WCID_START	33
+ #define WCID_END	222
+ #define STA_IDS_SIZE	(WCID_END - WCID_START + 2)
++#define CHAIN_0		0x0
++#define CHAIN_1		0x1
++#define RF_ALC_NUM	6
++#define CHAIN_NUM	2
++
++typedef struct rf_reg_pair {
++	u8 bank;
++	u8 reg;
++	u8 value;
++} rf_reg_pair;
+ 
+ /* RT2800 driver data structure */
+ struct rt2800_drv_data {
+@@ -248,6 +258,7 @@ int rt2800_calcrcalibrationcode(struct r
+ void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -577,6 +577,7 @@ struct rt2x00lib_ops {
+ 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rxiq_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*loft_iq_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
similarity index 96%
rename from package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
rename to package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
index 8d7a39a6df..0fe6ee196c 100644
--- a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
+++ b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/Makefile
 +++ b/net/mac80211/Makefile
-@@ -6,7 +6,6 @@ mac80211-y := \
+@@ -7,7 +7,6 @@ mac80211-y := \
  	driver-ops.o \
  	sta_info.o \
  	wep.o \
@@ -8,7 +8,7 @@
  	wpa.o \
  	scan.o offchannel.o \
  	ht.o agg-tx.o agg-rx.o \
-@@ -16,8 +15,8 @@ mac80211-y := \
+@@ -18,8 +17,8 @@ mac80211-y := \
  	rate.o \
  	michael.o \
  	tkip.o \
@@ -385,7 +385,7 @@
  #endif /* AES_GCM_H */
 --- a/net/mac80211/wpa.c
 +++ b/net/mac80211/wpa.c
-@@ -306,7 +306,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
+@@ -314,7 +314,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
  }
  
  
@@ -395,7 +395,7 @@
  {
  	__le16 mask_fc;
  	int a4_included, mgmt;
-@@ -336,14 +337,8 @@ static void ccmp_special_blocks(struct s
+@@ -344,14 +345,8 @@ static void ccmp_special_blocks(struct s
  	else
  		qos_tid = 0;
  
@@ -412,7 +412,7 @@
  
  	/* Nonce: Nonce Flags | A2 | PN
  	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-@@ -351,6 +346,8 @@ static void ccmp_special_blocks(struct s
+@@ -359,6 +354,8 @@ static void ccmp_special_blocks(struct s
  	b_0[1] = qos_tid | (mgmt << 4);
  	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
  	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
@@ -421,7 +421,7 @@
  
  	/* AAD (extra authenticate-only data) / masked 802.11 header
  	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-@@ -407,7 +404,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -415,7 +412,7 @@ static int ccmp_encrypt_skb(struct ieee8
  	u8 *pos;
  	u8 pn[6];
  	u64 pn64;
@@ -430,7 +430,7 @@
  	u8 b_0[AES_BLOCK_SIZE];
  
  	if (info->control.hw_key &&
-@@ -462,9 +459,11 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -470,9 +467,11 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  
  	pos += IEEE80211_CCMP_HDR_LEN;
@@ -445,7 +445,7 @@
  }
  
  
-@@ -537,13 +536,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
+@@ -545,13 +544,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
  			u8 aad[2 * AES_BLOCK_SIZE];
  			u8 b_0[AES_BLOCK_SIZE];
  			/* hardware didn't decrypt/verify MIC */
@@ -461,7 +461,7 @@
  				return RX_DROP_UNUSABLE;
  		}
  
-@@ -639,7 +638,7 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -646,7 +645,7 @@ static int gcmp_encrypt_skb(struct ieee8
  	u8 *pos;
  	u8 pn[6];
  	u64 pn64;
@@ -470,7 +470,7 @@
  	u8 j_0[AES_BLOCK_SIZE];
  
  	if (info->control.hw_key &&
-@@ -696,8 +695,10 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -703,8 +702,10 @@ static int gcmp_encrypt_skb(struct ieee8
  
  	pos += IEEE80211_GCMP_HDR_LEN;
  	gcmp_special_blocks(skb, pn, j_0, aad);
@@ -483,7 +483,7 @@
  }
  
  ieee80211_tx_result
-@@ -1121,9 +1122,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
+@@ -1127,9 +1128,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_mmie_16 *mmie;
  	struct ieee80211_hdr *hdr;
@@ -495,7 +495,7 @@
  
  	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
  		return TX_DROP;
-@@ -1169,7 +1170,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
+@@ -1175,7 +1176,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
  	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  	struct ieee80211_key *key = rx->key;
  	struct ieee80211_mmie_16 *mmie;
diff --git a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
similarity index 84%
rename from package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
rename to package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 3b1fcdf9c8..6775884a34 100644
--- a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1058,7 +1058,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1067,7 +1067,6 @@ static int ieee80211_stop_ap(struct wiph
  	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
  
  	__sta_info_flush(sdata, true);
diff --git a/package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
similarity index 100%
rename from package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch
rename to package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
diff --git a/package/kernel/mac80211/patches/130-disable-fils.patch b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
similarity index 91%
rename from package/kernel/mac80211/patches/130-disable-fils.patch
rename to package/kernel/mac80211/patches/subsys/130-disable-fils.patch
index 1f03589878..f1163764a0 100644
--- a/package/kernel/mac80211/patches/130-disable-fils.patch
+++ b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
@@ -21,7 +21,7 @@ Disable FILS support, since it pulls in crypto hash support
   * Copyright 2016, Qualcomm Atheros, Inc.
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -550,7 +550,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -570,7 +570,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_MAC_ON_CREATE |
  			   NL80211_FEATURE_USERSPACE_MPM |
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
@@ -29,4 +29,4 @@ Disable FILS support, since it pulls in crypto hash support
 +#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  #endif
- 
+ 	wiphy_ext_feature_set(wiphy,
diff --git a/package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch b/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
similarity index 100%
rename from package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
rename to package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
diff --git a/package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch b/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
similarity index 100%
rename from package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch
rename to package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
diff --git a/package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
similarity index 93%
rename from package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
rename to package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
index 6e9a07a927..42a6382209 100644
--- a/package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
+++ b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3750,6 +3750,12 @@ out:
+@@ -3797,6 +3797,12 @@ out:
  netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
  				       struct net_device *dev)
  {
diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
similarity index 80%
rename from package/kernel/mac80211/patches/150-disable_addr_notifier.patch
rename to package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
index 781dd3c1bc..1581b3400b 100644
--- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
+++ b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -292,7 +292,7 @@ void ieee80211_restart_hw(struct ieee802
+@@ -315,7 +315,7 @@ void ieee80211_restart_hw(struct ieee802
  }
  EXPORT_SYMBOL(ieee80211_restart_hw);
  
@@ -9,7 +9,7 @@
  static int ieee80211_ifa_changed(struct notifier_block *nb,
  				 unsigned long data, void *arg)
  {
-@@ -351,7 +351,7 @@ static int ieee80211_ifa_changed(struct
+@@ -374,7 +374,7 @@ static int ieee80211_ifa_changed(struct
  }
  #endif
  
@@ -18,9 +18,9 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1114,14 +1114,14 @@ int ieee80211_register_hw(struct ieee802
- 	if (result)
- 		goto fail_flows;
+@@ -1168,14 +1168,14 @@ int ieee80211_register_hw(struct ieee802
+ 
+ 	rtnl_unlock();
  
 -#ifdef CONFIG_INET
 +#ifdef __disabled__CONFIG_INET
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1130,13 +1130,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1184,13 +1184,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -51,8 +51,8 @@
 +#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
   fail_ifa:
  #endif
- 	ieee80211_txq_teardown_flows(local);
-@@ -1166,10 +1166,10 @@ void ieee80211_unregister_hw(struct ieee
+ 	rtnl_lock();
+@@ -1219,10 +1219,10 @@ void ieee80211_unregister_hw(struct ieee
  	tasklet_kill(&local->tx_pending_tasklet);
  	tasklet_kill(&local->tasklet);
  
diff --git a/package/kernel/mac80211/patches/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
similarity index 83%
rename from package/kernel/mac80211/patches/210-ap_scan.patch
rename to package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index 8ade963c9f..fcc173da69 100644
--- a/package/kernel/mac80211/patches/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2215,7 +2215,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2237,7 +2237,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch b/package/kernel/mac80211/patches/subsys/300-mac80211-add-stop-start-logic-for-software-TXQs.patch
similarity index 90%
rename from package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch
rename to package/kernel/mac80211/patches/subsys/300-mac80211-add-stop-start-logic-for-software-TXQs.patch
index c85e5c6612..422e9c2977 100644
--- a/package/kernel/mac80211/patches/398-mac80211-add-stop-start-logic-for-software-TXQs.patch
+++ b/package/kernel/mac80211/patches/subsys/300-mac80211-add-stop-start-logic-for-software-TXQs.patch
@@ -41,7 +41,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1453,6 +1453,8 @@ enum ieee80211_vif_flags {
+@@ -1504,6 +1504,8 @@ enum ieee80211_vif_flags {
   * @drv_priv: data area for driver use, will always be aligned to
   *	sizeof(void \*).
   * @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
@@ -50,7 +50,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
   */
  struct ieee80211_vif {
  	enum nl80211_iftype type;
-@@ -1477,6 +1479,8 @@ struct ieee80211_vif {
+@@ -1528,6 +1530,8 @@ struct ieee80211_vif {
  
  	unsigned int probe_req_reg;
  
@@ -61,7 +61,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  };
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -816,6 +816,7 @@ enum txq_info_flags {
+@@ -818,6 +818,7 @@ enum txq_info_flags {
  	IEEE80211_TXQ_STOP,
  	IEEE80211_TXQ_AMPDU,
  	IEEE80211_TXQ_NO_AMSDU,
@@ -69,7 +69,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  };
  
  /**
-@@ -1223,6 +1224,7 @@ struct ieee80211_local {
+@@ -1226,6 +1227,7 @@ struct ieee80211_local {
  
  	struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
  	struct tasklet_struct tx_pending_tasklet;
@@ -77,17 +77,17 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  	atomic_t agg_queue_stop[IEEE80211_MAX_QUEUES];
  
-@@ -2037,6 +2039,7 @@ void ieee80211_txq_purge(struct ieee8021
- 			 struct txq_info *txqi);
- void ieee80211_txq_remove_vlan(struct ieee80211_local *local,
+@@ -2039,6 +2041,7 @@ void ieee80211_txq_remove_vlan(struct ie
  			       struct ieee80211_sub_if_data *sdata);
+ void ieee80211_fill_txq_stats(struct cfg80211_txq_stats *txqstats,
+ 			      struct txq_info *txqi);
 +void ieee80211_wake_txqs(unsigned long data);
  void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
  			 u16 transaction, u16 auth_alg, u16 status,
  			 const u8 *extra, size_t extra_len, const u8 *bssid,
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -671,6 +671,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -686,6 +686,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  	tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
  		     (unsigned long)local);
  
@@ -100,7 +100,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  		     (unsigned long) local);
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3463,13 +3463,19 @@ struct sk_buff *ieee80211_tx_dequeue(str
+@@ -3482,13 +3482,19 @@ struct sk_buff *ieee80211_tx_dequeue(str
  	struct ieee80211_tx_info *info;
  	struct ieee80211_tx_data tx;
  	ieee80211_tx_result r;
@@ -122,7 +122,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	/* Make sure fragments stay together. */
  	skb = __skb_dequeue(&txqi->frags);
  	if (skb)
-@@ -3565,6 +3571,7 @@ begin:
+@@ -3583,6 +3589,7 @@ begin:
  	}
  
  	IEEE80211_SKB_CB(skb)->control.vif = vif;
@@ -132,7 +132,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -239,6 +239,99 @@ __le16 ieee80211_ctstoself_duration(stru
+@@ -240,6 +240,99 @@ __le16 ieee80211_ctstoself_duration(stru
  }
  EXPORT_SYMBOL(ieee80211_ctstoself_duration);
  
@@ -232,7 +232,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
  {
  	struct ieee80211_sub_if_data *sdata;
-@@ -307,6 +400,9 @@ static void __ieee80211_wake_queue(struc
+@@ -308,6 +401,9 @@ static void __ieee80211_wake_queue(struc
  		rcu_read_unlock();
  	} else
  		tasklet_schedule(&local->tx_pending_tasklet);
@@ -242,7 +242,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  
  void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
-@@ -350,9 +446,6 @@ static void __ieee80211_stop_queue(struc
+@@ -351,9 +447,6 @@ static void __ieee80211_stop_queue(struc
  	if (__test_and_set_bit(reason, &local->queue_stop_reasons[queue]))
  		return;
  
@@ -252,7 +252,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	if (local->hw.queues < IEEE80211_NUM_ACS)
  		n_acs = 1;
  
-@@ -365,8 +458,15 @@ static void __ieee80211_stop_queue(struc
+@@ -366,8 +459,15 @@ static void __ieee80211_stop_queue(struc
  
  		for (ac = 0; ac < n_acs; ac++) {
  			if (sdata->vif.hw_queue[ac] == queue ||
diff --git a/package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
similarity index 94%
rename from package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
rename to package/kernel/mac80211/patches/subsys/301-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
index 302646066d..5bbf4db23b 100644
--- a/package/kernel/mac80211/patches/399-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
+++ b/package/kernel/mac80211/patches/subsys/301-mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
@@ -21,7 +21,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1162,6 +1162,9 @@ static inline void drv_wake_tx_queue(str
+@@ -1166,6 +1166,9 @@ static inline void drv_wake_tx_queue(str
  {
  	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
  
diff --git a/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch b/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
similarity index 97%
rename from package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
rename to package/kernel/mac80211/patches/subsys/303-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
index 609b15b832..661fb46ea4 100644
--- a/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
+++ b/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
@@ -10,7 +10,7 @@ Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
 
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -1556,6 +1556,7 @@ struct ieee80211_vht_operation {
+@@ -1659,6 +1659,7 @@ struct ieee80211_mu_edca_param_set {
  #define IEEE80211_VHT_CAP_RXSTBC_3				0x00000300
  #define IEEE80211_VHT_CAP_RXSTBC_4				0x00000400
  #define IEEE80211_VHT_CAP_RXSTBC_MASK				0x00000700
diff --git a/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch b/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
similarity index 89%
rename from package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
rename to package/kernel/mac80211/patches/subsys/304-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
index 14cf6641d8..95d4f294aa 100644
--- a/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
+++ b/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #ifdef CPTCFG_MAC80211_DEBUGFS
  	mp->fixed_rate_idx = (u32) -1;
 -	mp->dbg_fixed_rate = debugfs_create_u32("fixed_rate_idx",
--			S_IRUGO | S_IWUGO, debugfsdir, &mp->fixed_rate_idx);
+-			0666, debugfsdir, &mp->fixed_rate_idx);
 +	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
 +			   &mp->fixed_rate_idx);
  #endif
@@ -75,11 +75,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	struct minstrel_sta_info *mi = priv_sta;
  
--	mi->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, mi,
--			&minstrel_stat_fops);
+-	mi->dbg_stats = debugfs_create_file("rc_stats", 0444, dir, mi,
+-					    &minstrel_stat_fops);
 -
--	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO, dir,
--			mi, &minstrel_stat_csv_fops);
+-	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", 0444, dir, mi,
+-						&minstrel_stat_csv_fops);
 -}
 -
 -void
@@ -130,10 +130,10 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	struct minstrel_ht_sta_priv *msp = priv_sta;
  
--	msp->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
--			&minstrel_ht_stat_fops);
--	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO,
--			     dir, msp, &minstrel_ht_stat_csv_fops);
+-	msp->dbg_stats = debugfs_create_file("rc_stats", 0444, dir, msp,
+-					     &minstrel_ht_stat_fops);
+-	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", 0444, dir, msp,
+-						 &minstrel_ht_stat_csv_fops);
 -}
 -
 -void
diff --git a/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/subsys/305-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
similarity index 97%
rename from package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
rename to package/kernel/mac80211/patches/subsys/305-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
index a2bdfd81a0..9a233753ad 100644
--- a/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
+++ b/package/kernel/mac80211/patches/subsys/305-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  endif
 --- a/net/mac80211/Makefile
 +++ b/net/mac80211/Makefile
-@@ -50,13 +50,14 @@ mac80211-$(CONFIG_PM) += pm.o
+@@ -52,13 +52,14 @@ mac80211-$(CONFIG_PM) += pm.o
  
  CFLAGS_trace.o := -I$(src)
  
@@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  ccflags-y += -DDEBUG
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -1252,18 +1252,12 @@ static int __init ieee80211_init(void)
+@@ -1308,18 +1308,12 @@ static int __init ieee80211_init(void)
  	if (ret)
  		return ret;
  
@@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	rc80211_minstrel_exit();
  
  	return ret;
-@@ -1271,7 +1265,6 @@ static int __init ieee80211_init(void)
+@@ -1327,7 +1321,6 @@ static int __init ieee80211_init(void)
  
  static void __exit ieee80211_exit(void)
  {
@@ -141,11 +141,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -			max_rates = sband->n_bitrates;
 -	}
 -
--	mi->r = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+-	mi->r = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
 -	if (!mi->r)
 -		goto error;
 -
--	mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+-	mi->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
 -	if (!mi->sample_table)
 -		goto error1;
 -
@@ -256,7 +256,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static u32 minstrel_get_expected_throughput(void *priv_sta)
  {
  	struct minstrel_sta_info *mi = priv_sta;
-@@ -722,29 +590,8 @@ static u32 minstrel_get_expected_through
+@@ -722,28 +590,8 @@ static u32 minstrel_get_expected_through
  }
  
  const struct rate_control_ops mac80211_minstrel = {
@@ -285,7 +285,6 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -{
 -	ieee80211_rate_control_unregister(&mac80211_minstrel);
 -}
--
 --- a/net/mac80211/rc80211_minstrel.h
 +++ b/net/mac80211/rc80211_minstrel.h
 @@ -158,7 +158,5 @@ int minstrel_get_tp_avg(struct minstrel_
diff --git a/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch b/package/kernel/mac80211/patches/subsys/306-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
similarity index 100%
rename from package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
rename to package/kernel/mac80211/patches/subsys/306-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
diff --git a/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch b/package/kernel/mac80211/patches/subsys/307-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
similarity index 100%
rename from package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
rename to package/kernel/mac80211/patches/subsys/307-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
diff --git a/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch b/package/kernel/mac80211/patches/subsys/308-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
similarity index 100%
rename from package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
rename to package/kernel/mac80211/patches/subsys/308-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
diff --git a/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch b/package/kernel/mac80211/patches/subsys/309-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
similarity index 100%
rename from package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
rename to package/kernel/mac80211/patches/subsys/309-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
diff --git a/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch b/package/kernel/mac80211/patches/subsys/310-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
similarity index 100%
rename from package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
rename to package/kernel/mac80211/patches/subsys/310-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
diff --git a/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/subsys/311-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
similarity index 83%
rename from package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
rename to package/kernel/mac80211/patches/subsys/311-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
index c64457a17f..1fd2b25271 100644
--- a/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
+++ b/package/kernel/mac80211/patches/subsys/311-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3171,6 +3171,7 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3185,6 +3185,7 @@ static bool ieee80211_amsdu_aggregate(st
  	u8 max_subframes = sta->sta.max_amsdu_subframes;
  	int max_frags = local->hw.max_tx_fragments;
  	int max_amsdu_len = sta->sta.max_amsdu_len;
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__be16 len;
  	void *data;
  	bool ret = false;
-@@ -3201,12 +3202,13 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3216,12 +3217,13 @@ static bool ieee80211_amsdu_aggregate(st
  	flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
  	head = skb_peek_tail(&flow->queue);
  	if (!head)
@@ -44,11 +44,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -		goto out;
 +		goto unlock;
  
- 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
- 		goto out;
-@@ -3249,6 +3251,9 @@ static bool ieee80211_amsdu_aggregate(st
- 	fq_recalc_backlog(fq, tin, flow);
- 
+ 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
+ 	nfrags += 1 + skb_shinfo(head)->nr_frags;
+@@ -3279,6 +3281,9 @@ out_recalc:
+ 		fq_recalc_backlog(fq, tin, flow);
+ 	}
  out:
 +	fq->memory_usage += head->truesize - orig_truesize;
 +
diff --git a/package/kernel/mac80211/patches/subsys/312-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch b/package/kernel/mac80211/patches/subsys/312-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch
new file mode 100644
index 0000000000..f221d36bf8
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/312-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch
@@ -0,0 +1,122 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 16 Jan 2019 22:32:12 +0100
+Subject: [PATCH] mac80211: minstrel_ht: add flag to indicate
+ missing/inaccurate tx A-MPDU length
+
+Some hardware (e.g. MediaTek MT7603) cannot report A-MPDU length in tx status
+information. Add support for a flag to indicate that, to allow minstrel_ht
+to use a fixed value in its internal calculation (which gives better results
+than just defaulting to 1).
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2131,6 +2131,9 @@ struct ieee80211_txq {
+  * @IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP: The driver (or firmware) doesn't
+  *	support QoS NDP for AP probing - that's most likely a driver bug.
+  *
++ * @IEEE80211_HW_TX_STATUS_NO_AMPDU_LEN: Driver does not report accurate A-MPDU
++ *	length in tx status information
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2176,6 +2179,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA,
+ 	IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP,
+ 	IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP,
++	IEEE80211_HW_TX_STATUS_NO_AMPDU_LEN,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -214,6 +214,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(SUPPORTS_TDLS_BUFFER_STA),
+ 	FLAG(DEAUTH_NEED_MGD_TX_PREP),
+ 	FLAG(DOESNT_SUPPORT_QOS_NDP),
++	FLAG(TX_STATUS_NO_AMPDU_LEN),
+ #undef FLAG
+ };
+ 
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -294,6 +294,15 @@ minstrel_get_ratestats(struct minstrel_h
+ 	return &mi->groups[index / MCS_GROUP_RATES].rates[index % MCS_GROUP_RATES];
+ }
+ 
++static unsigned int
++minstrel_ht_avg_ampdu_len(struct minstrel_ht_sta *mi)
++{
++	if (!mi->avg_ampdu_len)
++		return AVG_AMPDU_SIZE;
++
++	return MINSTREL_TRUNC(mi->avg_ampdu_len);
++}
++
+ /*
+  * Return current throughput based on the average A-MPDU length, taking into
+  * account the expected number of retransmissions and their expected length
+@@ -309,7 +318,7 @@ minstrel_ht_get_tp_avg(struct minstrel_h
+ 		return 0;
+ 
+ 	if (group != MINSTREL_CCK_GROUP)
+-		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
++		nsecs = 1000 * mi->overhead / minstrel_ht_avg_ampdu_len(mi);
+ 
+ 	nsecs += minstrel_mcs_groups[group].duration[rate] <<
+ 		 minstrel_mcs_groups[group].shift;
+@@ -503,8 +512,12 @@ minstrel_ht_update_stats(struct minstrel
+ 	u16 tmp_cck_tp_rate[MAX_THR_RATES], index;
+ 
+ 	if (mi->ampdu_packets > 0) {
+-		mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
+-			MINSTREL_FRAC(mi->ampdu_len, mi->ampdu_packets), EWMA_LEVEL);
++		if (!ieee80211_hw_check(mp->hw, TX_STATUS_NO_AMPDU_LEN))
++			mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
++				MINSTREL_FRAC(mi->ampdu_len, mi->ampdu_packets),
++					      EWMA_LEVEL);
++		else
++			mi->avg_ampdu_len = 0;
+ 		mi->ampdu_len = 0;
+ 		mi->ampdu_packets = 0;
+ 	}
+@@ -709,7 +722,9 @@ minstrel_ht_tx_status(void *priv, struct
+ 	mi->ampdu_len += info->status.ampdu_len;
+ 
+ 	if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
+-		mi->sample_wait = 16 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
++		int avg_ampdu_len = minstrel_ht_avg_ampdu_len(mi);
++
++		mi->sample_wait = 16 + 2 * avg_ampdu_len;
+ 		mi->sample_tries = 1;
+ 		mi->sample_count--;
+ 	}
+@@ -777,7 +792,7 @@ minstrel_calc_retransmit(struct minstrel
+ 	unsigned int cw = mp->cw_min;
+ 	unsigned int ctime = 0;
+ 	unsigned int t_slot = 9; /* FIXME */
+-	unsigned int ampdu_len = MINSTREL_TRUNC(mi->avg_ampdu_len);
++	unsigned int ampdu_len = minstrel_ht_avg_ampdu_len(mi);
+ 	unsigned int overhead = 0, overhead_rtscts = 0;
+ 
+ 	mrs = minstrel_get_ratestats(mi, index);
+--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
+@@ -163,9 +163,10 @@ minstrel_ht_stats_open(struct inode *ino
+ 			"lookaround %d\n",
+ 			max(0, (int) mi->total_packets - (int) mi->sample_packets),
+ 			mi->sample_packets);
+-	p += sprintf(p, "Average # of aggregated frames per A-MPDU: %d.%d\n",
+-		MINSTREL_TRUNC(mi->avg_ampdu_len),
+-		MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
++	if (mi->avg_ampdu_len)
++		p += sprintf(p, "Average # of aggregated frames per A-MPDU: %d.%d\n",
++			MINSTREL_TRUNC(mi->avg_ampdu_len),
++			MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
+ 	ms->len = p - ms->buf;
+ 	WARN_ON(ms->len + sizeof(*ms) > 32768);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/313-mac80211-fix-unaligned-access-in-mesh-table-hash-fun.patch b/package/kernel/mac80211/patches/subsys/313-mac80211-fix-unaligned-access-in-mesh-table-hash-fun.patch
new file mode 100644
index 0000000000..2ce23586ca
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/313-mac80211-fix-unaligned-access-in-mesh-table-hash-fun.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 13 Mar 2019 18:52:56 +0100
+Subject: [PATCH] mac80211: fix unaligned access in mesh table hash function
+
+The pointer to the last four bytes of the address is not guaranteed to be
+aligned, so we need to use __get_unaligned_cpu32 here
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -23,7 +23,7 @@ static void mesh_path_free_rcu(struct me
+ static u32 mesh_table_hash(const void *addr, u32 len, u32 seed)
+ {
+ 	/* Use last four bytes of hw addr as hash index */
+-	return jhash_1word(*(u32 *)(addr+2), seed);
++	return jhash_1word(__get_unaligned_cpu32(addr+2), seed);
+ }
+ 
+ static const struct rhashtable_params mesh_rht_params = {
diff --git a/package/kernel/mac80211/patches/subsys/320-mac80211-Add-TXQ-scheduling-API.patch b/package/kernel/mac80211/patches/subsys/320-mac80211-Add-TXQ-scheduling-API.patch
new file mode 100644
index 0000000000..0f7d9e1506
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/320-mac80211-Add-TXQ-scheduling-API.patch
@@ -0,0 +1,292 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Tue, 18 Dec 2018 17:02:06 -0800
+Subject: [PATCH] mac80211: Add TXQ scheduling API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds an API to mac80211 to handle scheduling of TXQs. The interface
+between driver and mac80211 for TXQ handling is changed by adding two new
+functions: ieee80211_next_txq(), which will return the next TXQ to schedule
+in the current round-robin rotation, and ieee80211_return_txq(), which the
+driver uses to indicate that it has finished scheduling a TXQ (which will
+then be put back in the scheduling rotation if it isn't empty).
+
+The driver must call ieee80211_txq_schedule_start() at the start of each
+scheduling session, and ieee80211_txq_schedule_end() at the end. The API
+then guarantees that the same TXQ is not returned twice in the same
+session (so a driver can loop on ieee80211_next_txq() without worrying
+about breaking the loop.
+
+Usage of the new API is optional, so drivers can be ported one at a time.
+In this patch, the actual scheduling performed by mac80211 is simple
+round-robin, but a subsequent commit adds airtime fairness awareness to the
+scheduler.
+
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+[minor kernel-doc fix, propagate sparse locking checks out]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -107,9 +107,15 @@
+  * The driver is expected to initialize its private per-queue data for stations
+  * and interfaces in the .add_interface and .sta_add ops.
+  *
+- * The driver can't access the queue directly. To dequeue a frame, it calls
+- * ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a queue, it
+- * calls the .wake_tx_queue driver op.
++ * The driver can't access the queue directly. To dequeue a frame from a
++ * txq, it calls ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a
++ * queue, it calls the .wake_tx_queue driver op.
++ *
++ * Drivers can optionally delegate responsibility for scheduling queues to
++ * mac80211, to take advantage of airtime fairness accounting. In this case, to
++ * obtain the next queue to pull frames from, the driver calls
++ * ieee80211_next_txq(). The driver is then expected to return the txq using
++ * ieee80211_return_txq().
+  *
+  * For AP powersave TIM handling, the driver only needs to indicate if it has
+  * buffered packets in the driver specific data structures by calling
+@@ -5979,7 +5985,8 @@ void ieee80211_unreserve_tid(struct ieee
+  * ieee80211_tx_dequeue - dequeue a packet from a software tx queue
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+- * @txq: pointer obtained from station or virtual interface
++ * @txq: pointer obtained from station or virtual interface, or from
++ *	ieee80211_next_txq()
+  *
+  * Returns the skb if successful, %NULL if no frame was available.
+  */
+@@ -5987,6 +5994,54 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ 				     struct ieee80211_txq *txq);
+ 
+ /**
++ * ieee80211_next_txq - get next tx queue to pull packets from
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @ac: AC number to return packets from.
++ *
++ * Should only be called between calls to ieee80211_txq_schedule_start()
++ * and ieee80211_txq_schedule_end().
++ * Returns the next txq if successful, %NULL if no queue is eligible. If a txq
++ * is returned, it should be returned with ieee80211_return_txq() after the
++ * driver has finished scheduling it.
++ */
++struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac);
++
++/**
++ * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @txq: pointer obtained from station or virtual interface
++ *
++ * Should only be called between calls to ieee80211_txq_schedule_start()
++ * and ieee80211_txq_schedule_end().
++ */
++void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
++
++/**
++ * ieee80211_txq_schedule_start - acquire locks for safe scheduling of an AC
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @ac: AC number to acquire locks for
++ *
++ * Acquire locks needed to schedule TXQs from the given AC. Should be called
++ * before ieee80211_next_txq() or ieee80211_return_txq().
++ */
++void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
++	__acquires(txq_lock);
++
++/**
++ * ieee80211_txq_schedule_end - release locks for safe scheduling of an AC
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @ac: AC number to acquire locks for
++ *
++ * Release locks previously acquired by ieee80211_txq_schedule_end().
++ */
++void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
++	__releases(txq_lock);
++
++/**
+  * ieee80211_txq_get_depth - get pending frame/byte count of given txq
+  *
+  * The values are not guaranteed to be coherent with regard to each other, i.e.
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -229,7 +229,7 @@ ieee80211_agg_start_txq(struct sta_info
+ 	clear_bit(IEEE80211_TXQ_STOP, &txqi->flags);
+ 	local_bh_disable();
+ 	rcu_read_lock();
+-	drv_wake_tx_queue(sta->sdata->local, txqi);
++	schedule_and_wake_txq(sta->sdata->local, txqi);
+ 	rcu_read_unlock();
+ 	local_bh_enable();
+ }
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1176,6 +1176,15 @@ static inline void drv_wake_tx_queue(str
+ 	local->ops->wake_tx_queue(&local->hw, &txq->txq);
+ }
+ 
++static inline void schedule_and_wake_txq(struct ieee80211_local *local,
++					 struct txq_info *txqi)
++{
++	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
++	ieee80211_return_txq(&local->hw, &txqi->txq);
++	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
++	drv_wake_tx_queue(local, txqi);
++}
++
+ static inline int drv_start_nan(struct ieee80211_local *local,
+ 				struct ieee80211_sub_if_data *sdata,
+ 				struct cfg80211_nan_conf *conf)
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -829,6 +829,8 @@ enum txq_info_flags {
+  *	a fq_flow which is already owned by a different tin
+  * @def_cvars: codel vars for @def_flow
+  * @frags: used to keep fragments created after dequeue
++ * @schedule_order: used with ieee80211_local->active_txqs
++ * @schedule_round: counter to prevent infinite loops on TXQ scheduling
+  */
+ struct txq_info {
+ 	struct fq_tin tin;
+@@ -836,6 +838,8 @@ struct txq_info {
+ 	struct codel_vars def_cvars;
+ 	struct codel_stats cstats;
+ 	struct sk_buff_head frags;
++	struct list_head schedule_order;
++	u16 schedule_round;
+ 	unsigned long flags;
+ 
+ 	/* keep last! */
+@@ -1127,6 +1131,11 @@ struct ieee80211_local {
+ 	struct codel_vars *cvars;
+ 	struct codel_params cparams;
+ 
++	/* protects active_txqs and txqi->schedule_order */
++	spinlock_t active_txq_lock[IEEE80211_NUM_ACS];
++	struct list_head active_txqs[IEEE80211_NUM_ACS];
++	u16 schedule_round[IEEE80211_NUM_ACS];
++
+ 	const struct ieee80211_ops *ops;
+ 
+ 	/*
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -652,6 +652,11 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	spin_lock_init(&local->rx_path_lock);
+ 	spin_lock_init(&local->queue_stop_reason_lock);
+ 
++	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
++		INIT_LIST_HEAD(&local->active_txqs[i]);
++		spin_lock_init(&local->active_txq_lock[i]);
++	}
++
+ 	INIT_LIST_HEAD(&local->chanctx_list);
+ 	mutex_init(&local->chanctx_mtx);
+ 
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1244,7 +1244,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
+ 			if (!txq_has_queue(sta->sta.txq[i]))
+ 				continue;
+ 
+-			drv_wake_tx_queue(local, to_txq_info(sta->sta.txq[i]));
++			schedule_and_wake_txq(local, to_txq_info(sta->sta.txq[i]));
+ 		}
+ 	}
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1441,6 +1441,7 @@ void ieee80211_txq_init(struct ieee80211
+ 	codel_vars_init(&txqi->def_cvars);
+ 	codel_stats_init(&txqi->cstats);
+ 	__skb_queue_head_init(&txqi->frags);
++	INIT_LIST_HEAD(&txqi->schedule_order);
+ 
+ 	txqi->txq.vif = &sdata->vif;
+ 
+@@ -1464,6 +1465,9 @@ void ieee80211_txq_purge(struct ieee8021
+ 
+ 	fq_tin_reset(fq, tin, fq_skb_free_func);
+ 	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
++	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
++	list_del_init(&txqi->schedule_order);
++	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
+ }
+ 
+ void ieee80211_txq_set_params(struct ieee80211_local *local)
+@@ -1580,7 +1584,7 @@ static bool ieee80211_queue_skb(struct i
+ 	ieee80211_txq_enqueue(local, txqi, skb);
+ 	spin_unlock_bh(&fq->lock);
+ 
+-	drv_wake_tx_queue(local, txqi);
++	schedule_and_wake_txq(local, txqi);
+ 
+ 	return true;
+ }
+@@ -3602,6 +3606,60 @@ out:
+ }
+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ 
++struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct txq_info *txqi = NULL;
++
++	lockdep_assert_held(&local->active_txq_lock[ac]);
++
++	txqi = list_first_entry_or_null(&local->active_txqs[ac],
++					struct txq_info,
++					schedule_order);
++
++	if (!txqi || txqi->schedule_round == local->schedule_round[ac])
++		return NULL;
++
++	list_del_init(&txqi->schedule_order);
++	txqi->schedule_round = local->schedule_round[ac];
++	return &txqi->txq;
++}
++EXPORT_SYMBOL(ieee80211_next_txq);
++
++void ieee80211_return_txq(struct ieee80211_hw *hw,
++			  struct ieee80211_txq *txq)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct txq_info *txqi = to_txq_info(txq);
++
++	lockdep_assert_held(&local->active_txq_lock[txq->ac]);
++
++	if (list_empty(&txqi->schedule_order) &&
++	    (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets))
++		list_add_tail(&txqi->schedule_order,
++			      &local->active_txqs[txq->ac]);
++}
++EXPORT_SYMBOL(ieee80211_return_txq);
++
++void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
++	__acquires(txq_lock)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++
++	spin_lock_bh(&local->active_txq_lock[ac]);
++	local->schedule_round[ac]++;
++}
++EXPORT_SYMBOL(ieee80211_txq_schedule_start);
++
++void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
++	__releases(txq_lock)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++
++	spin_unlock_bh(&local->active_txq_lock[ac]);
++}
++EXPORT_SYMBOL(ieee80211_txq_schedule_end);
++
+ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ 				  struct net_device *dev,
+ 				  u32 info_flags)
diff --git a/package/kernel/mac80211/patches/subsys/321-cfg80211-Add-airtime-statistics-and-settings.patch b/package/kernel/mac80211/patches/subsys/321-cfg80211-Add-airtime-statistics-and-settings.patch
new file mode 100644
index 0000000000..7eb64c4251
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/321-cfg80211-Add-airtime-statistics-and-settings.patch
@@ -0,0 +1,202 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Tue, 18 Dec 2018 17:02:07 -0800
+Subject: [PATCH] cfg80211: Add airtime statistics and settings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds TX airtime statistics to the cfg80211 station dump (to go along
+with the RX info already present), and adds a new parameter to set the
+airtime weight of each station. The latter allows userspace to implement
+policies for different stations by varying their weights.
+
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+[rmanohar@codeaurora.org: fixed checkpatch warnings]
+Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
+[move airtime weight != 0 check into policy]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -988,6 +988,7 @@ enum station_parameters_apply_mask {
+  * @support_p2p_ps: information if station supports P2P PS mechanism
+  * @he_capa: HE capabilities of station
+  * @he_capa_len: the length of the HE capabilities
++ * @airtime_weight: airtime scheduler weight for this station
+  */
+ struct station_parameters {
+ 	const u8 *supported_rates;
+@@ -1017,6 +1018,7 @@ struct station_parameters {
+ 	int support_p2p_ps;
+ 	const struct ieee80211_he_cap_elem *he_capa;
+ 	u8 he_capa_len;
++	u16 airtime_weight;
+ };
+ 
+ /**
+@@ -1284,6 +1286,8 @@ struct cfg80211_tid_stats {
+  * @rx_beacon_signal_avg: signal strength average (in dBm) for beacons received
+  *	from this peer
+  * @rx_duration: aggregate PPDU duration(usecs) for all the frames from a peer
++ * @tx_duration: aggregate PPDU duration(usecs) for all the frames to a peer
++ * @airtime_weight: current airtime scheduling weight
+  * @pertid: per-TID statistics, see &struct cfg80211_tid_stats, using the last
+  *	(IEEE80211_NUM_TIDS) index for MSDUs not encapsulated in QoS-MPDUs.
+  *	Note that this doesn't use the @filled bit, but is used if non-NULL.
+@@ -1330,12 +1334,15 @@ struct station_info {
+ 
+ 	u32 expected_throughput;
+ 
+-	u64 rx_beacon;
++	u64 tx_duration;
+ 	u64 rx_duration;
++	u64 rx_beacon;
+ 	u8 rx_beacon_signal_avg;
+ 	struct cfg80211_tid_stats *pertid;
+ 	s8 ack_signal;
+ 	s8 avg_ack_signal;
++
++	u16 airtime_weight;
+ };
+ 
+ #if IS_ENABLED(CPTCFG_CFG80211)
+@@ -2361,6 +2368,8 @@ enum wiphy_params_flags {
+ 	WIPHY_PARAM_TXQ_QUANTUM		= 1 << 8,
+ };
+ 
++#define IEEE80211_DEFAULT_AIRTIME_WEIGHT	256
++
+ /**
+  * struct cfg80211_pmksa - PMK Security Association
+  *
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2241,6 +2241,9 @@ enum nl80211_commands {
+  *	association request when used with NL80211_CMD_NEW_STATION). Can be set
+  *	only if %NL80211_STA_FLAG_WME is set.
+  *
++ * @NL80211_ATTR_AIRTIME_WEIGHT: Station's weight when scheduled by the airtime
++ *	scheduler.
++ *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -2682,6 +2685,14 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_HE_CAPABILITY,
+ 
++	/* not backported yet */
++	NL80211_ATTR_FTM_RESPONDER,
++	NL80211_ATTR_FTM_RESPONDER_STATS,
++	NL80211_ATTR_TIMEOUT,
++	NL80211_ATTR_PEER_MEASUREMENTS,
++
++	NL80211_ATTR_AIRTIME_WEIGHT,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -3052,6 +3063,9 @@ enum nl80211_sta_bss_param {
+  * @NL80211_STA_INFO_ACK_SIGNAL: signal strength of the last ACK frame(u8, dBm)
+  * @NL80211_STA_INFO_DATA_ACK_SIGNAL_AVG: avg signal strength of (data)
+  *	ACK frame (s8, dBm)
++ * @NL80211_STA_INFO_TX_DURATION: aggregate PPDU duration for all frames
++ *	sent to the station (u64, usec)
++ * @NL80211_STA_INFO_AIRTIME_WEIGHT: current airtime weight for station (u16)
+  * @__NL80211_STA_INFO_AFTER_LAST: internal
+  * @NL80211_STA_INFO_MAX: highest possible station info attribute
+  */
+@@ -3093,6 +3107,14 @@ enum nl80211_sta_info {
+ 	NL80211_STA_INFO_ACK_SIGNAL,
+ 	NL80211_STA_INFO_DATA_ACK_SIGNAL_AVG,
+ 
++	/* not backported yet */
++	NL80211_STA_INFO_RX_MPDUS,
++	NL80211_STA_INFO_FCS_ERROR_COUNT,
++	NL80211_STA_INFO_CONNECTED_TO_GATE,
++
++	NL80211_STA_INFO_TX_DURATION,
++	NL80211_STA_INFO_AIRTIME_WEIGHT,
++
+ 	/* keep last */
+ 	__NL80211_STA_INFO_AFTER_LAST,
+ 	NL80211_STA_INFO_MAX = __NL80211_STA_INFO_AFTER_LAST - 1
+@@ -5224,6 +5246,10 @@ enum nl80211_feature_flags {
+  *	except for supported rates from the probe request content if requested
+  *	by the %NL80211_SCAN_FLAG_MIN_PREQ_CONTENT flag.
+  *
++ * @NL80211_EXT_FEATURE_AIRTIME_FAIRNESS: Driver supports getting airtime
++ *	fairness for transmitted packets and has enabled airtime fairness
++ *	scheduling.
++ *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+@@ -5260,6 +5286,12 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SCAN_RANDOM_SN,
+ 	NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT,
+ 
++	/* --- not backported yet --- */
++	NL80211_EXT_FEATURE_CAN_REPLACE_PTK0,
++	NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER,
++
++	NL80211_EXT_FEATURE_AIRTIME_FAIRNESS,
++
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+ 	MAX_NL80211_EXT_FEATURES = NUM_NL80211_EXT_FEATURES - 1
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -430,6 +430,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
+ 					 .len = NL80211_HE_MAX_CAPABILITY_LEN },
++	[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
+ };
+ 
+ /* policy for the key attributes */
+@@ -4658,6 +4659,11 @@ static int nl80211_send_station(struct s
+ 	PUT_SINFO(PLID, plid, u16);
+ 	PUT_SINFO(PLINK_STATE, plink_state, u8);
+ 	PUT_SINFO_U64(RX_DURATION, rx_duration);
++	PUT_SINFO_U64(TX_DURATION, tx_duration);
++
++	if (wiphy_ext_feature_isset(&rdev->wiphy,
++				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
+ 
+ 	switch (rdev->wiphy.signal_type) {
+ 	case CFG80211_SIGNAL_TYPE_MBM:
+@@ -5294,6 +5300,15 @@ static int nl80211_set_station(struct sk
+ 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
+ 	}
+ 
++	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
++		params.airtime_weight =
++			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
++
++	if (params.airtime_weight &&
++	    !wiphy_ext_feature_isset(&rdev->wiphy,
++				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		return -EOPNOTSUPP;
++
+ 	/* Include parameters for TDLS peer (will check later) */
+ 	err = nl80211_set_station_tdls(info, &params);
+ 	if (err)
+@@ -5432,6 +5447,15 @@ static int nl80211_new_station(struct sk
+ 			return -EINVAL;
+ 	}
+ 
++	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
++		params.airtime_weight =
++			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
++
++	if (params.airtime_weight &&
++	    !wiphy_ext_feature_isset(&rdev->wiphy,
++				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		return -EOPNOTSUPP;
++
+ 	err = nl80211_parse_sta_channel_info(info, &params);
+ 	if (err)
+ 		return err;
diff --git a/package/kernel/mac80211/patches/subsys/322-mac80211-Add-airtime-accounting-and-scheduling-to-TX.patch b/package/kernel/mac80211/patches/subsys/322-mac80211-Add-airtime-accounting-and-scheduling-to-TX.patch
new file mode 100644
index 0000000000..d4176eb491
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/322-mac80211-Add-airtime-accounting-and-scheduling-to-TX.patch
@@ -0,0 +1,522 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Tue, 18 Dec 2018 17:02:08 -0800
+Subject: [PATCH] mac80211: Add airtime accounting and scheduling to TXQs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds airtime accounting and scheduling to the mac80211 TXQ
+scheduler. A new callback, ieee80211_sta_register_airtime(), is added
+that drivers can call to report airtime usage for stations.
+
+When airtime information is present, mac80211 will schedule TXQs
+(through ieee80211_next_txq()) in a way that enforces airtime fairness
+between active stations. This scheduling works the same way as the ath9k
+in-driver airtime fairness scheduling. If no airtime usage is reported
+by the driver, the scheduler will default to round-robin scheduling.
+
+For drivers that don't control TXQ scheduling in software, a new API
+function, ieee80211_txq_may_transmit(), is added which the driver can use
+to check if the TXQ is eligible for transmission, or should be throttled to
+enforce fairness. Calls to this function must also be enclosed in
+ieee80211_txq_schedule_{start,end}() calls to ensure proper locking.
+
+The API ieee80211_txq_may_transmit() also ensures that TXQ list will be
+aligned aginst driver's own round-robin scheduler list. i.e it rotates
+the TXQ list till it makes the requested node becomes the first entry
+in TXQ list. Thus both the TXQ list and driver's list are in sync.
+
+Co-developed-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
+Signed-off-by: Louie Lu <git@louie.lu>
+[added debugfs write op to reset airtime counter]
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2304,6 +2304,9 @@ enum ieee80211_hw_flags {
+  *	supported by HW.
+  * @max_nan_de_entries: maximum number of NAN DE functions supported by the
+  *	device.
++ *
++ * @weight_multipler: Driver specific airtime weight multiplier used while
++ *	refilling deficit of each TXQ.
+  */
+ struct ieee80211_hw {
+ 	struct ieee80211_conf conf;
+@@ -2339,6 +2342,7 @@ struct ieee80211_hw {
+ 	u8 n_cipher_schemes;
+ 	const struct ieee80211_cipher_scheme *cipher_schemes;
+ 	u8 max_nan_de_entries;
++	u8 weight_multiplier;
+ };
+ 
+ static inline bool _ieee80211_hw_check(struct ieee80211_hw *hw,
+@@ -5299,6 +5303,34 @@ void ieee80211_sta_eosp(struct ieee80211
+ void ieee80211_send_eosp_nullfunc(struct ieee80211_sta *pubsta, int tid);
+ 
+ /**
++ * ieee80211_sta_register_airtime - register airtime usage for a sta/tid
++ *
++ * Register airtime usage for a given sta on a given tid. The driver can call
++ * this function to notify mac80211 that a station used a certain amount of
++ * airtime. This information will be used by the TXQ scheduler to schedule
++ * stations in a way that ensures airtime fairness.
++ *
++ * The reported airtime should as a minimum include all time that is spent
++ * transmitting to the remote station, including overhead and padding, but not
++ * including time spent waiting for a TXOP. If the time is not reported by the
++ * hardware it can in some cases be calculated from the rate and known frame
++ * composition. When possible, the time should include any failed transmission
++ * attempts.
++ *
++ * The driver can either call this function synchronously for every packet or
++ * aggregate, or asynchronously as airtime usage information becomes available.
++ * TX and RX airtime can be reported together, or separately by setting one of
++ * them to 0.
++ *
++ * @pubsta: the station
++ * @tid: the TID to register airtime for
++ * @tx_airtime: airtime used during TX (in usec)
++ * @rx_airtime: airtime used during RX (in usec)
++ */
++void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
++				    u32 tx_airtime, u32 rx_airtime);
++
++/**
+  * ieee80211_iter_keys - iterate keys programmed into the device
+  * @hw: pointer obtained from ieee80211_alloc_hw()
+  * @vif: virtual interface to iterate, may be %NULL for all
+@@ -6042,6 +6074,33 @@ void ieee80211_txq_schedule_end(struct i
+ 	__releases(txq_lock);
+ 
+ /**
++ * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
++ *
++ * This function is used to check whether given txq is allowed to transmit by
++ * the airtime scheduler, and can be used by drivers to access the airtime
++ * fairness accounting without going using the scheduling order enfored by
++ * next_txq().
++ *
++ * Returns %true if the airtime scheduler thinks the TXQ should be allowed to
++ * transmit, and %false if it should be throttled. This function can also have
++ * the side effect of rotating the TXQ in the scheduler rotation, which will
++ * eventually bring the deficit to positive and allow the station to transmit
++ * again.
++ *
++ * The API ieee80211_txq_may_transmit() also ensures that TXQ list will be
++ * aligned aginst driver's own round-robin scheduler list. i.e it rotates
++ * the TXQ list till it makes the requested node becomes the first entry
++ * in TXQ list. Thus both the TXQ list and driver's list are in sync. If this
++ * function returns %true, the driver is expected to schedule packets
++ * for transmission, and then return the TXQ through ieee80211_return_txq().
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @txq: pointer obtained from station or virtual interface
++ */
++bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
++				struct ieee80211_txq *txq);
++
++/**
+  * ieee80211_txq_get_depth - get pending frame/byte count of given txq
+  *
+  * The values are not guaranteed to be coherent with regard to each other, i.e.
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1434,6 +1434,9 @@ static int sta_apply_parameters(struct i
+ 	if (ieee80211_vif_is_mesh(&sdata->vif))
+ 		sta_apply_mesh_params(local, sta, params);
+ 
++	if (params->airtime_weight)
++		sta->airtime_weight = params->airtime_weight;
++
+ 	/* set the STA state after all sta info from usermode has been set */
+ 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) ||
+ 	    set & BIT(NL80211_STA_FLAG_ASSOCIATED)) {
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -380,6 +380,9 @@ void debugfs_hw_add(struct ieee80211_loc
+ 	if (local->ops->wake_tx_queue)
+ 		DEBUGFS_ADD_MODE(aqm, 0600);
+ 
++	debugfs_create_u16("airtime_flags", 0600,
++			   phyd, &local->airtime_flags);
++
+ 	statsd = debugfs_create_dir("statistics", phyd);
+ 
+ 	/* if the dir failed, don't put all the other things into the root! */
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -178,9 +178,9 @@ static ssize_t sta_aqm_read(struct file
+ 			       txqi->tin.tx_bytes,
+ 			       txqi->tin.tx_packets,
+ 			       txqi->flags,
+-			       txqi->flags & (1<<IEEE80211_TXQ_STOP) ? "STOP" : "RUN",
+-			       txqi->flags & (1<<IEEE80211_TXQ_AMPDU) ? " AMPDU" : "",
+-			       txqi->flags & (1<<IEEE80211_TXQ_NO_AMSDU) ? " NO-AMSDU" : "");
++			       test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ? "STOP" : "RUN",
++			       test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags) ? " AMPDU" : "",
++			       test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags) ? " NO-AMSDU" : "");
+ 	}
+ 
+ 	rcu_read_unlock();
+@@ -192,6 +192,64 @@ static ssize_t sta_aqm_read(struct file
+ }
+ STA_OPS(aqm);
+ 
++static ssize_t sta_airtime_read(struct file *file, char __user *userbuf,
++				size_t count, loff_t *ppos)
++{
++	struct sta_info *sta = file->private_data;
++	struct ieee80211_local *local = sta->sdata->local;
++	size_t bufsz = 200;
++	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
++	u64 rx_airtime = 0, tx_airtime = 0;
++	s64 deficit[IEEE80211_NUM_ACS];
++	ssize_t rv;
++	int ac;
++
++	if (!buf)
++		return -ENOMEM;
++
++	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
++		spin_lock_bh(&local->active_txq_lock[ac]);
++		rx_airtime += sta->airtime[ac].rx_airtime;
++		tx_airtime += sta->airtime[ac].tx_airtime;
++		deficit[ac] = sta->airtime[ac].deficit;
++		spin_unlock_bh(&local->active_txq_lock[ac]);
++	}
++
++	p += scnprintf(p, bufsz + buf - p,
++		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
++		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
++		rx_airtime,
++		tx_airtime,
++		sta->airtime_weight,
++		deficit[0],
++		deficit[1],
++		deficit[2],
++		deficit[3]);
++
++	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
++	kfree(buf);
++	return rv;
++}
++
++static ssize_t sta_airtime_write(struct file *file, const char __user *userbuf,
++				 size_t count, loff_t *ppos)
++{
++	struct sta_info *sta = file->private_data;
++	struct ieee80211_local *local = sta->sdata->local;
++	int ac;
++
++	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
++		spin_lock_bh(&local->active_txq_lock[ac]);
++		sta->airtime[ac].rx_airtime = 0;
++		sta->airtime[ac].tx_airtime = 0;
++		sta->airtime[ac].deficit = sta->airtime_weight;
++		spin_unlock_bh(&local->active_txq_lock[ac]);
++	}
++
++	return count;
++}
++STA_OPS_RW(airtime);
++
+ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
+ 					size_t count, loff_t *ppos)
+ {
+@@ -546,6 +604,10 @@ void ieee80211_sta_debugfs_add(struct st
+ 	if (local->ops->wake_tx_queue)
+ 		DEBUGFS_ADD(aqm);
+ 
++	if (wiphy_ext_feature_isset(local->hw.wiphy,
++				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		DEBUGFS_ADD(airtime);
++
+ 	if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
+ 		debugfs_create_x32("driver_buffered_tids", 0400,
+ 				   sta->debugfs_dir,
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1136,6 +1136,8 @@ struct ieee80211_local {
+ 	struct list_head active_txqs[IEEE80211_NUM_ACS];
+ 	u16 schedule_round[IEEE80211_NUM_ACS];
+ 
++	u16 airtime_flags;
++
+ 	const struct ieee80211_ops *ops;
+ 
+ 	/*
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -656,6 +656,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 		INIT_LIST_HEAD(&local->active_txqs[i]);
+ 		spin_lock_init(&local->active_txq_lock[i]);
+ 	}
++	local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
+ 
+ 	INIT_LIST_HEAD(&local->chanctx_list);
+ 	mutex_init(&local->chanctx_mtx);
+@@ -1142,6 +1143,9 @@ int ieee80211_register_hw(struct ieee802
+ 	if (!local->hw.max_nan_de_entries)
+ 		local->hw.max_nan_de_entries = IEEE80211_MAX_NAN_INSTANCE_ID;
+ 
++	if (!local->hw.weight_multiplier)
++		local->hw.weight_multiplier = 1;
++
+ 	result = ieee80211_wep_init(local);
+ 	if (result < 0)
+ 		wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -90,7 +90,6 @@ static void __cleanup_single_sta(struct
+ 	struct tid_ampdu_tx *tid_tx;
+ 	struct ieee80211_sub_if_data *sdata = sta->sdata;
+ 	struct ieee80211_local *local = sdata->local;
+-	struct fq *fq = &local->fq;
+ 	struct ps_data *ps;
+ 
+ 	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
+@@ -115,9 +114,7 @@ static void __cleanup_single_sta(struct
+ 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+ 			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
+ 
+-			spin_lock_bh(&fq->lock);
+ 			ieee80211_txq_purge(local, txqi);
+-			spin_unlock_bh(&fq->lock);
+ 		}
+ 	}
+ 
+@@ -381,9 +378,12 @@ struct sta_info *sta_info_alloc(struct i
+ 	if (sta_prepare_rate_control(local, sta, gfp))
+ 		goto free_txq;
+ 
++	sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
++
+ 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+ 		skb_queue_head_init(&sta->ps_tx_buf[i]);
+ 		skb_queue_head_init(&sta->tx_filtered[i]);
++		sta->airtime[i].deficit = sta->airtime_weight;
+ 	}
+ 
+ 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
+@@ -1821,6 +1821,27 @@ void ieee80211_sta_set_buffered(struct i
+ }
+ EXPORT_SYMBOL(ieee80211_sta_set_buffered);
+ 
++void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
++				    u32 tx_airtime, u32 rx_airtime)
++{
++	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++	struct ieee80211_local *local = sta->sdata->local;
++	u8 ac = ieee80211_ac_from_tid(tid);
++	u32 airtime = 0;
++
++	if (sta->local->airtime_flags & AIRTIME_USE_TX)
++		airtime += tx_airtime;
++	if (sta->local->airtime_flags & AIRTIME_USE_RX)
++		airtime += rx_airtime;
++
++	spin_lock_bh(&local->active_txq_lock[ac]);
++	sta->airtime[ac].tx_airtime += tx_airtime;
++	sta->airtime[ac].rx_airtime += rx_airtime;
++	sta->airtime[ac].deficit -= airtime;
++	spin_unlock_bh(&local->active_txq_lock[ac]);
++}
++EXPORT_SYMBOL(ieee80211_sta_register_airtime);
++
+ int sta_info_move_state(struct sta_info *sta,
+ 			enum ieee80211_sta_state new_state)
+ {
+@@ -2183,6 +2204,23 @@ void sta_set_sinfo(struct sta_info *sta,
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
+ 	}
+ 
++	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_DURATION))) {
++		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
++			sinfo->rx_duration += sta->airtime[ac].rx_airtime;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_DURATION);
++	}
++
++	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_DURATION))) {
++		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
++			sinfo->tx_duration += sta->airtime[ac].tx_airtime;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_DURATION);
++	}
++
++	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
++		sinfo->airtime_weight = sta->airtime_weight;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
++	}
++
+ 	sinfo->rx_dropped_misc = sta->rx_stats.dropped;
+ 	if (sta->pcpu_rx_stats) {
+ 		for_each_possible_cpu(cpu) {
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -127,6 +127,16 @@ enum ieee80211_agg_stop_reason {
+ 	AGG_STOP_DESTROY_STA,
+ };
+ 
++/* Debugfs flags to enable/disable use of RX/TX airtime in scheduler */
++#define AIRTIME_USE_TX		BIT(0)
++#define AIRTIME_USE_RX		BIT(1)
++
++struct airtime_info {
++	u64 rx_airtime;
++	u64 tx_airtime;
++	s64 deficit;
++};
++
+ struct sta_info;
+ 
+ /**
+@@ -563,6 +573,9 @@ struct sta_info {
+ 	} tx_stats;
+ 	u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
+ 
++	struct airtime_info airtime[IEEE80211_NUM_ACS];
++	u16 airtime_weight;
++
+ 	/*
+ 	 * Aggregation information, locked with lock.
+ 	 */
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -825,6 +825,12 @@ static void __ieee80211_tx_status(struct
+ 			ieee80211_sta_tx_notify(sta->sdata, (void *) skb->data,
+ 						acked, info->status.tx_time);
+ 
++		if (info->status.tx_time &&
++		    wiphy_ext_feature_isset(local->hw.wiphy,
++					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++			ieee80211_sta_register_airtime(&sta->sta, tid,
++						       info->status.tx_time, 0);
++
+ 		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
+ 			if (info->flags & IEEE80211_TX_STAT_ACK) {
+ 				if (sta->status_stats.lost_packets)
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1463,8 +1463,11 @@ void ieee80211_txq_purge(struct ieee8021
+ 	struct fq *fq = &local->fq;
+ 	struct fq_tin *tin = &txqi->tin;
+ 
++	spin_lock_bh(&fq->lock);
+ 	fq_tin_reset(fq, tin, fq_skb_free_func);
+ 	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
++	spin_unlock_bh(&fq->lock);
++
+ 	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
+ 	list_del_init(&txqi->schedule_order);
+ 	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
+@@ -3613,11 +3616,28 @@ struct ieee80211_txq *ieee80211_next_txq
+ 
+ 	lockdep_assert_held(&local->active_txq_lock[ac]);
+ 
++ begin:
+ 	txqi = list_first_entry_or_null(&local->active_txqs[ac],
+ 					struct txq_info,
+ 					schedule_order);
++	if (!txqi)
++		return NULL;
++
++	if (txqi->txq.sta) {
++		struct sta_info *sta = container_of(txqi->txq.sta,
++						struct sta_info, sta);
++
++		if (sta->airtime[txqi->txq.ac].deficit < 0) {
++			sta->airtime[txqi->txq.ac].deficit +=
++				sta->airtime_weight;
++			list_move_tail(&txqi->schedule_order,
++				       &local->active_txqs[txqi->txq.ac]);
++			goto begin;
++		}
++	}
++
+ 
+-	if (!txqi || txqi->schedule_round == local->schedule_round[ac])
++	if (txqi->schedule_round == local->schedule_round[ac])
+ 		return NULL;
+ 
+ 	list_del_init(&txqi->schedule_order);
+@@ -3635,12 +3655,74 @@ void ieee80211_return_txq(struct ieee802
+ 	lockdep_assert_held(&local->active_txq_lock[txq->ac]);
+ 
+ 	if (list_empty(&txqi->schedule_order) &&
+-	    (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets))
+-		list_add_tail(&txqi->schedule_order,
+-			      &local->active_txqs[txq->ac]);
++	    (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
++		/* If airtime accounting is active, always enqueue STAs at the
++		 * head of the list to ensure that they only get moved to the
++		 * back by the airtime DRR scheduler once they have a negative
++		 * deficit. A station that already has a negative deficit will
++		 * get immediately moved to the back of the list on the next
++		 * call to ieee80211_next_txq().
++		 */
++		if (txqi->txq.sta &&
++		    wiphy_ext_feature_isset(local->hw.wiphy,
++					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++			list_add(&txqi->schedule_order,
++				 &local->active_txqs[txq->ac]);
++		else
++			list_add_tail(&txqi->schedule_order,
++				      &local->active_txqs[txq->ac]);
++	}
+ }
+ EXPORT_SYMBOL(ieee80211_return_txq);
+ 
++bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
++				struct ieee80211_txq *txq)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
++	struct sta_info *sta;
++	u8 ac = txq->ac;
++
++	lockdep_assert_held(&local->active_txq_lock[ac]);
++
++	if (!txqi->txq.sta)
++		goto out;
++
++	if (list_empty(&txqi->schedule_order))
++		goto out;
++
++	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
++				 schedule_order) {
++		if (iter == txqi)
++			break;
++
++		if (!iter->txq.sta) {
++			list_move_tail(&iter->schedule_order,
++				       &local->active_txqs[ac]);
++			continue;
++		}
++		sta = container_of(iter->txq.sta, struct sta_info, sta);
++		if (sta->airtime[ac].deficit < 0)
++			sta->airtime[ac].deficit += sta->airtime_weight;
++		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
++	}
++
++	sta = container_of(txqi->txq.sta, struct sta_info, sta);
++	if (sta->airtime[ac].deficit >= 0)
++		goto out;
++
++	sta->airtime[ac].deficit += sta->airtime_weight;
++	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
++
++	return false;
++out:
++	if (!list_empty(&txqi->schedule_order))
++		list_del_init(&txqi->schedule_order);
++
++	return true;
++}
++EXPORT_SYMBOL(ieee80211_txq_may_transmit);
++
+ void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
+ 	__acquires(txq_lock)
+ {
diff --git a/package/kernel/mac80211/patches/subsys/323-mac80211-Expose-ieee80211_schedule_txq-function.patch b/package/kernel/mac80211/patches/subsys/323-mac80211-Expose-ieee80211_schedule_txq-function.patch
new file mode 100644
index 0000000000..573f9bd135
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/323-mac80211-Expose-ieee80211_schedule_txq-function.patch
@@ -0,0 +1,73 @@
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
+Date: Tue, 22 Jan 2019 15:20:16 +0100
+Subject: [PATCH] mac80211: Expose ieee80211_schedule_txq() function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since we reworked ieee80211_return_txq() so it assumes that the caller
+takes care of logging, we need another function that can be called without
+holding any locks. Introduce ieee80211_schedule_txq() which serves this
+purpose.
+
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -6074,6 +6074,19 @@ void ieee80211_txq_schedule_end(struct i
+ 	__releases(txq_lock);
+ 
+ /**
++ * ieee80211_schedule_txq - schedule a TXQ for transmission
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @txq: pointer obtained from station or virtual interface
++ *
++ * Schedules a TXQ for transmission if it is not already scheduled. Takes a
++ * lock, which means it must *not* be called between
++ * ieee80211_txq_schedule_start() and ieee80211_txq_schedule_end()
++ */
++void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
++	__acquires(txq_lock) __releases(txq_lock);
++
++/**
+  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
+  *
+  * This function is used to check whether given txq is allowed to transmit by
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1179,9 +1179,7 @@ static inline void drv_wake_tx_queue(str
+ static inline void schedule_and_wake_txq(struct ieee80211_local *local,
+ 					 struct txq_info *txqi)
+ {
+-	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
+-	ieee80211_return_txq(&local->hw, &txqi->txq);
+-	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
++	ieee80211_schedule_txq(&local->hw, &txqi->txq);
+ 	drv_wake_tx_queue(local, txqi);
+ }
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3675,6 +3675,19 @@ void ieee80211_return_txq(struct ieee802
+ }
+ EXPORT_SYMBOL(ieee80211_return_txq);
+ 
++void ieee80211_schedule_txq(struct ieee80211_hw *hw,
++			    struct ieee80211_txq *txq)
++	__acquires(txq_lock) __releases(txq_lock)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct txq_info *txqi = to_txq_info(txq);
++
++	spin_lock_bh(&local->active_txq_lock[txq->ac]);
++	ieee80211_return_txq(hw, txq);
++	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
++}
++EXPORT_SYMBOL(ieee80211_schedule_txq);
++
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ 				struct ieee80211_txq *txq)
+ {
diff --git a/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
similarity index 82%
rename from package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
rename to package/kernel/mac80211/patches/subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
index 83c613434d..2759895c98 100644
--- a/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
+++ b/package/kernel/mac80211/patches/subsys/350-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
@@ -2,16 +2,16 @@ From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 Date: Fri, 19 Feb 2016 11:01:49 +0100
 Subject: [PATCH] mac80211: add hdrlen to ieee80211_tx_data
 
-Add hdrlen to ieee80211_tx_data and use this
-when wep/ccmd/tkip. This is preparation for
-aligned4 code.
+This is preparation for adding support for inserting padding between the
+802.11 header and LLC data
 
 Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -177,6 +177,7 @@ struct ieee80211_tx_data {
+@@ -179,6 +179,7 @@ struct ieee80211_tx_data {
  	struct ieee80211_tx_rate rate;
  
  	unsigned int flags;
@@ -21,7 +21,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -921,7 +921,7 @@ ieee80211_tx_h_fragment(struct ieee80211
+@@ -925,7 +925,7 @@ ieee80211_tx_h_fragment(struct ieee80211
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_hdr *hdr = (void *)skb->data;
  	int frag_threshold = tx->local->hw.wiphy->frag_threshold;
@@ -30,7 +30,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	int fragnum;
  
  	/* no matter what happens, tx->skb moves to tx->skbs */
-@@ -942,8 +942,6 @@ ieee80211_tx_h_fragment(struct ieee80211
+@@ -946,8 +946,6 @@ ieee80211_tx_h_fragment(struct ieee80211
  	if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
  		return TX_DROP;
  
@@ -39,7 +39,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	/* internal error, why isn't DONTFRAG set? */
  	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
  		return TX_DROP;
-@@ -1175,6 +1173,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1178,6 +1176,8 @@ ieee80211_tx_prepare(struct ieee80211_su
  
  	hdr = (struct ieee80211_hdr *) skb->data;
  
@@ -48,25 +48,34 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (likely(sta)) {
  		if (!IS_ERR(sta))
  			tx->sta = sta;
-@@ -3468,6 +3468,7 @@ begin:
+@@ -3525,6 +3525,7 @@ begin:
  	tx.local = local;
  	tx.skb = skb;
  	tx.sdata = vif_to_sdata(info->control.vif);
-+	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
++	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
  
  	if (txq->sta)
  		tx.sta = container_of(txq->sta, struct sta_info, sta);
-@@ -3796,6 +3797,7 @@ ieee80211_build_data_template(struct iee
+@@ -3551,7 +3552,7 @@ begin:
+ 
+ 		if (tx.key &&
+ 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
+-			pn_offs = ieee80211_hdrlen(hdr->frame_control);
++			pn_offs = tx.hdrlen;
+ 
+ 		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
+ 					   tx.key, skb);
+@@ -4008,6 +4009,7 @@ ieee80211_build_data_template(struct iee
  	hdr = (void *)skb->data;
  	tx.sta = sta_info_get(sdata, hdr->addr1);
  	tx.skb = skb;
-+	tx.hdrlen = ieee80211_padded_hdrlen(&tx.local->hw, hdr->frame_control);
++	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
  
  	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
  		rcu_read_unlock();
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1232,6 +1232,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1390,6 +1390,7 @@ void ieee80211_send_auth(struct ieee8021
  	struct ieee80211_local *local = sdata->local;
  	struct sk_buff *skb;
  	struct ieee80211_mgmt *mgmt;
@@ -74,7 +83,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	int err;
  
  	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
-@@ -1255,8 +1256,10 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1413,8 +1414,10 @@ void ieee80211_send_auth(struct ieee8021
  		skb_put_data(skb, extra, extra_len);
  
  	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
@@ -164,7 +173,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (skb->len < hdrlen)
  		return TX_DROP;
  
-@@ -187,7 +187,6 @@ mic_fail_no_key:
+@@ -195,7 +195,6 @@ mic_fail_no_key:
  
  static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
  {
@@ -172,7 +181,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	unsigned int hdrlen;
-@@ -202,7 +201,7 @@ static int tkip_encrypt_skb(struct ieee8
+@@ -210,7 +209,7 @@ static int tkip_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -181,7 +190,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -420,7 +419,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -428,7 +427,7 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -190,7 +199,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -653,7 +652,7 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -660,7 +659,7 @@ static int gcmp_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -199,7 +208,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -793,7 +792,6 @@ static ieee80211_tx_result
+@@ -800,7 +799,6 @@ static ieee80211_tx_result
  ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
  			    struct sk_buff *skb)
  {
@@ -207,7 +216,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	int hdrlen;
-@@ -809,8 +807,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
+@@ -816,8 +814,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
  		     pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
  		return TX_DROP;
  
diff --git a/package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch
new file mode 100644
index 0000000000..d8dbecca1b
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/351-mac80211-add-TX_NEEDS_ALIGNED4_SKBS-hw-flag.patch
@@ -0,0 +1,304 @@
+From: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+Date: Sun, 10 Mar 2019 17:22:08 +0100
+Subject: [PATCH] mac80211: add TX_NEEDS_ALIGNED4_SKBS hw flag
+
+The driver should set this flag if the hardware requires tx skb data
+(starting with the LLC header) to be aligned to 4 bytes.
+
+Padding is added after ieee80211_hdr, before IV/LLC.
+
+Before this patch, we have to do memmove(hdrlen) twice in the driver:
+Once before we pass this to HW and once again in tx completion
+(to fix up the skb for monitor mode).
+
+With this patch we can skip this memmove() and thus reduce CPU cycles in
+the data path.
+
+Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2140,6 +2140,9 @@ struct ieee80211_txq {
+  * @IEEE80211_HW_TX_STATUS_NO_AMPDU_LEN: Driver does not report accurate A-MPDU
+  *	length in tx status information
+  *
++ * @IEEE80211_HW_TX_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
++ *	Padding will be added after ieee80211_hdr, before IV/LLC.
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2186,6 +2189,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP,
+ 	IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP,
+ 	IEEE80211_HW_TX_STATUS_NO_AMPDU_LEN,
++	IEEE80211_HW_TX_NEEDS_ALIGNED4_SKBS,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+@@ -2472,6 +2476,40 @@ ieee80211_get_alt_retry_rate(const struc
+ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
+ 
+ /**
++ * ieee80211_hdr_padsize - get size of padding between 802.11 header and LLC
++ * @hw: the hardware
++ * @hdrlen: 802.11 header length
++ */
++static inline unsigned int
++ieee80211_hdr_padsize(struct ieee80211_hw *hw, unsigned int hdrlen)
++{
++	/*
++	 * While hdrlen is already aligned to two-byte boundaries,
++	 * simple check with & 2 will return correct padsize.
++	 */
++	if (ieee80211_hw_check(hw, TX_NEEDS_ALIGNED4_SKBS))
++		return hdrlen & 2;
++	return 0;
++}
++
++/**
++ * ieee80211_padded_hdrlen - get padded 802.11 header size
++ * @hw: the hardware
++ * @fc: frame control field in little-endian format
++ */
++static inline unsigned int
++ieee80211_padded_hdrlen(struct ieee80211_hw *hw, __le16 fc)
++{
++	unsigned int hdrlen;
++
++	hdrlen = ieee80211_hdrlen(fc);
++	hdrlen += ieee80211_hdr_padsize(hw, hdrlen);
++
++	return hdrlen;
++}
++
++
++/**
+  * DOC: Hardware crypto acceleration
+  *
+  * mac80211 is capable of taking advantage of many hardware
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1871,6 +1871,10 @@ int ieee80211_if_add(struct ieee80211_lo
+ 					+ 8 /* rfc1042/bridge tunnel */
+ 					- ETH_HLEN /* ethernet hard_header_len */
+ 					+ IEEE80211_ENCRYPT_HEADROOM;
++
++		if (ieee80211_hw_check(&local->hw, TX_NEEDS_ALIGNED4_SKBS))
++			ndev->needed_headroom += 2; /* padding */
++
+ 		ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
+ 
+ 		ret = dev_alloc_name(ndev, ndev->name);
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -105,13 +105,15 @@ void mesh_path_assign_nexthop(struct mes
+ static void prepare_for_gate(struct sk_buff *skb, char *dst_addr,
+ 			     struct mesh_path *gate_mpath)
+ {
++	struct ieee80211_sub_if_data *sdata = gate_mpath->sdata;
++	struct ieee80211_hw *hw = &sdata->local->hw;
+ 	struct ieee80211_hdr *hdr;
+ 	struct ieee80211s_hdr *mshdr;
+ 	int mesh_hdrlen, hdrlen;
+ 	char *next_hop;
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
+ 	mshdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
+ 	if (!(mshdr->flags & MESH_FLAGS_AE)) {
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2597,7 +2597,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	struct ieee80211_local *local = rx->local;
+ 	struct ieee80211_sub_if_data *sdata = rx->sdata;
+ 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+-	u16 ac, q, hdrlen;
++	u16 ac, q, hdrlen, padsize;
+ 	int tailroom = 0;
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+@@ -2690,7 +2690,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+ 
+-	fwd_skb = skb_copy_expand(skb, local->tx_headroom +
++	padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
++
++	fwd_skb = skb_copy_expand(skb, local->tx_headroom + padsize +
+ 				       sdata->encrypt_headroom,
+ 				  tailroom, GFP_ATOMIC);
+ 	if (!fwd_skb)
+@@ -2722,6 +2724,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 		return RX_DROP_MONITOR;
+ 	}
+ 
++	if (padsize) {
++		skb_push(fwd_skb, padsize);
++		memmove(fwd_skb->data, skb->data + padsize, hdrlen);
++		memset(fwd_skb->data + hdrlen, 0, padsize);
++	}
++
+ 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+ 	ieee80211_add_pending_skb(local, fwd_skb);
+  out:
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -311,7 +311,7 @@ struct ieee80211_fast_tx {
+ 	u8 hdr_len;
+ 	u8 sa_offs, da_offs, pn_offs;
+ 	u8 band;
+-	u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
++	u8 hdr[30 + 2 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
+ 	       sizeof(rfc1042_header)] __aligned(2);
+ 
+ 	struct rcu_head rcu_head;
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -515,6 +515,7 @@ static void ieee80211_report_used_skb(st
+ {
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
++	struct ieee80211_hw *hw = &local->hw;
+ 	bool acked = info->flags & IEEE80211_TX_STAT_ACK;
+ 
+ 	if (dropped)
+@@ -531,7 +532,7 @@ static void ieee80211_report_used_skb(st
+ 			skb->dev = NULL;
+ 		} else {
+ 			unsigned int hdr_size =
+-				ieee80211_hdrlen(hdr->frame_control);
++				ieee80211_padded_hdrlen(hw, hdr->frame_control);
+ 
+ 			/* Check to see if packet is a TDLS teardown packet */
+ 			if (ieee80211_is_data(hdr->frame_control) &&
+@@ -655,9 +656,22 @@ void ieee80211_tx_monitor(struct ieee802
+ 	struct sk_buff *skb2;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct net_device *prev_dev = NULL;
++	unsigned int hdrlen, padsize;
+ 	int rtap_len;
+ 
++	/* Remove padding if was added */
++	if (ieee80211_hw_check(&local->hw, TX_NEEDS_ALIGNED4_SKBS)) {
++		hdrlen = ieee80211_hdrlen(hdr->frame_control);
++		padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
++
++		if (padsize && skb->len > hdrlen + padsize) {
++			memmove(skb->data + padsize, skb->data, hdrlen);
++			skb_pull(skb, padsize);
++		}
++	}
++
+ 	/* send frame to monitor interfaces now */
+ 	rtap_len = ieee80211_tx_radiotap_len(info);
+ 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -201,10 +201,12 @@ void ieee80211_get_tkip_p2k(struct ieee8
+ {
+ 	struct ieee80211_key *key = (struct ieee80211_key *)
+ 			container_of(keyconf, struct ieee80211_key, conf);
++	struct ieee80211_hw *hw = &key->local->hw;
+ 	const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
+ 	struct tkip_ctx *ctx = &key->u.tkip.tx;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+-	const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
++	const u8 *data = (u8 *)hdr + ieee80211_padded_hdrlen(hw,
++							hdr->frame_control);
+ 	u32 iv32 = get_unaligned_le32(&data[4]);
+ 	u16 iv16 = data[2] | (data[0] << 8);
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1175,8 +1175,7 @@ ieee80211_tx_prepare(struct ieee80211_su
+ 	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+-
+-	tx->hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx->hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
+ 
+ 	if (likely(sta)) {
+ 		if (!IS_ERR(sta))
+@@ -2222,7 +2221,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
+ 		goto fail;
+ 
+ 	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control);
+ 
+ 	if (skb->len < len_rthdr + hdrlen)
+ 		goto fail;
+@@ -2440,7 +2439,7 @@ static struct sk_buff *ieee80211_build_h
+ 	struct ieee80211_chanctx_conf *chanctx_conf;
+ 	struct ieee80211_sub_if_data *ap_sdata;
+ 	enum nl80211_band band;
+-	int ret;
++	int padsize, ret;
+ 
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+@@ -2739,7 +2738,9 @@ static struct sk_buff *ieee80211_build_h
+ 	}
+ 
+ 	skb_pull(skb, skip_header_bytes);
++	padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
+ 	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
++	head_need += padsize;
+ 
+ 	/*
+ 	 * So we need to modify the skb header and hence need a copy of
+@@ -2772,6 +2773,9 @@ static struct sk_buff *ieee80211_build_h
+ 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
+ #endif
+ 
++	if (padsize)
++		memset(skb_push(skb, padsize), 0, padsize);
++
+ 	if (ieee80211_is_data_qos(fc)) {
+ 		__le16 *qos_control;
+ 
+@@ -2947,6 +2951,8 @@ void ieee80211_check_fast_xmit(struct st
+ 		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+ 	}
+ 
++	build.hdr_len += ieee80211_hdr_padsize(&local->hw, build.hdr_len);
++
+ 	/* We store the key here so there's no point in using rcu_dereference()
+ 	 * but that's fine because the code that changes the pointers will call
+ 	 * this function after doing so. For a single CPU that would be enough,
+@@ -3525,7 +3531,7 @@ begin:
+ 	tx.local = local;
+ 	tx.skb = skb;
+ 	tx.sdata = vif_to_sdata(info->control.vif);
+-	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
+ 
+ 	if (txq->sta)
+ 		tx.sta = container_of(txq->sta, struct sta_info, sta);
+@@ -4009,7 +4015,7 @@ ieee80211_build_data_template(struct iee
+ 	hdr = (void *)skb->data;
+ 	tx.sta = sta_info_get(sdata, hdr->addr1);
+ 	tx.skb = skb;
+-	tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
++	tx.hdrlen = ieee80211_padded_hdrlen(&tx.local->hw, hdr->frame_control);
+ 
+ 	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
+ 		rcu_read_unlock();
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -215,6 +215,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(DEAUTH_NEED_MGD_TX_PREP),
+ 	FLAG(DOESNT_SUPPORT_QOS_NDP),
+ 	FLAG(TX_STATUS_NO_AMPDU_LEN),
++	FLAG(TX_NEEDS_ALIGNED4_SKBS),
+ #undef FLAG
+ };
+ 
diff --git a/package/kernel/mac80211/patches/subsys/352-mac80211-rework-locking-for-txq-scheduling-airtime-f.patch b/package/kernel/mac80211/patches/subsys/352-mac80211-rework-locking-for-txq-scheduling-airtime-f.patch
new file mode 100644
index 0000000000..ef67dd1977
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/352-mac80211-rework-locking-for-txq-scheduling-airtime-f.patch
@@ -0,0 +1,214 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 13 Mar 2019 19:09:22 +0100
+Subject: [PATCH] mac80211: rework locking for txq scheduling / airtime
+ fairness
+
+Holding the lock around the entire duration of tx scheduling can create
+some nasty lock contention, especially when processing airtime information
+from the tx status or the rx path.
+Improve locking by only holding the active_txq_lock for lookups / scheduling
+list modifications.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -6069,8 +6069,6 @@ struct sk_buff *ieee80211_tx_dequeue(str
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+  * @ac: AC number to return packets from.
+  *
+- * Should only be called between calls to ieee80211_txq_schedule_start()
+- * and ieee80211_txq_schedule_end().
+  * Returns the next txq if successful, %NULL if no queue is eligible. If a txq
+  * is returned, it should be returned with ieee80211_return_txq() after the
+  * driver has finished scheduling it.
+@@ -6078,51 +6076,41 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac);
+ 
+ /**
+- * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
+- *
+- * @hw: pointer as obtained from ieee80211_alloc_hw()
+- * @txq: pointer obtained from station or virtual interface
+- *
+- * Should only be called between calls to ieee80211_txq_schedule_start()
+- * and ieee80211_txq_schedule_end().
+- */
+-void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
+-
+-/**
+- * ieee80211_txq_schedule_start - acquire locks for safe scheduling of an AC
++ * ieee80211_txq_schedule_start - start new scheduling round for TXQs
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+  * @ac: AC number to acquire locks for
+  *
+- * Acquire locks needed to schedule TXQs from the given AC. Should be called
+- * before ieee80211_next_txq() or ieee80211_return_txq().
++ * Should be called before ieee80211_next_txq() or ieee80211_return_txq().
+  */
+-void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
+-	__acquires(txq_lock);
++void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac);
++
++/* (deprecated) */
++static inline void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
++{
++}
+ 
+ /**
+- * ieee80211_txq_schedule_end - release locks for safe scheduling of an AC
++ * ieee80211_schedule_txq - schedule a TXQ for transmission
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+- * @ac: AC number to acquire locks for
++ * @txq: pointer obtained from station or virtual interface
+  *
+- * Release locks previously acquired by ieee80211_txq_schedule_end().
++ * Schedules a TXQ for transmission if it is not already scheduled.
+  */
+-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
+-	__releases(txq_lock);
++void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
+ 
+ /**
+- * ieee80211_schedule_txq - schedule a TXQ for transmission
++ * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+  * @txq: pointer obtained from station or virtual interface
+- *
+- * Schedules a TXQ for transmission if it is not already scheduled. Takes a
+- * lock, which means it must *not* be called between
+- * ieee80211_txq_schedule_start() and ieee80211_txq_schedule_end()
+  */
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
+-	__acquires(txq_lock) __releases(txq_lock);
++static inline void
++ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
++{
++	ieee80211_schedule_txq(hw, txq);
++}
+ 
+ /**
+  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3619,16 +3619,17 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
++	struct ieee80211_txq *ret = NULL;
+ 	struct txq_info *txqi = NULL;
+ 
+-	lockdep_assert_held(&local->active_txq_lock[ac]);
++	spin_lock_bh(&local->active_txq_lock[ac]);
+ 
+  begin:
+ 	txqi = list_first_entry_or_null(&local->active_txqs[ac],
+ 					struct txq_info,
+ 					schedule_order);
+ 	if (!txqi)
+-		return NULL;
++		goto out;
+ 
+ 	if (txqi->txq.sta) {
+ 		struct sta_info *sta = container_of(txqi->txq.sta,
+@@ -3645,21 +3646,25 @@ struct ieee80211_txq *ieee80211_next_txq
+ 
+ 
+ 	if (txqi->schedule_round == local->schedule_round[ac])
+-		return NULL;
++		goto out;
+ 
+ 	list_del_init(&txqi->schedule_order);
+ 	txqi->schedule_round = local->schedule_round[ac];
+-	return &txqi->txq;
++	ret = &txqi->txq;
++
++out:
++	spin_unlock_bh(&local->active_txq_lock[ac]);
++	return ret;
+ }
+ EXPORT_SYMBOL(ieee80211_next_txq);
+ 
+-void ieee80211_return_txq(struct ieee80211_hw *hw,
+-			  struct ieee80211_txq *txq)
++void ieee80211_schedule_txq(struct ieee80211_hw *hw,
++			    struct ieee80211_txq *txq)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
+ 
+-	lockdep_assert_held(&local->active_txq_lock[txq->ac]);
++	spin_lock_bh(&local->active_txq_lock[txq->ac]);
+ 
+ 	if (list_empty(&txqi->schedule_order) &&
+ 	    (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
+@@ -3679,18 +3684,7 @@ void ieee80211_return_txq(struct ieee802
+ 			list_add_tail(&txqi->schedule_order,
+ 				      &local->active_txqs[txq->ac]);
+ 	}
+-}
+-EXPORT_SYMBOL(ieee80211_return_txq);
+ 
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
+-			    struct ieee80211_txq *txq)
+-	__acquires(txq_lock) __releases(txq_lock)
+-{
+-	struct ieee80211_local *local = hw_to_local(hw);
+-	struct txq_info *txqi = to_txq_info(txq);
+-
+-	spin_lock_bh(&local->active_txq_lock[txq->ac]);
+-	ieee80211_return_txq(hw, txq);
+ 	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_schedule_txq);
+@@ -3703,7 +3697,7 @@ bool ieee80211_txq_may_transmit(struct i
+ 	struct sta_info *sta;
+ 	u8 ac = txq->ac;
+ 
+-	lockdep_assert_held(&local->active_txq_lock[ac]);
++	spin_lock_bh(&local->active_txq_lock[ac]);
+ 
+ 	if (!txqi->txq.sta)
+ 		goto out;
+@@ -3733,34 +3727,27 @@ bool ieee80211_txq_may_transmit(struct i
+ 
+ 	sta->airtime[ac].deficit += sta->airtime_weight;
+ 	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
++	spin_unlock_bh(&local->active_txq_lock[ac]);
+ 
+ 	return false;
+ out:
+ 	if (!list_empty(&txqi->schedule_order))
+ 		list_del_init(&txqi->schedule_order);
++	spin_unlock_bh(&local->active_txq_lock[ac]);
+ 
+ 	return true;
+ }
+ EXPORT_SYMBOL(ieee80211_txq_may_transmit);
+ 
+ void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
+-	__acquires(txq_lock)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 
+ 	spin_lock_bh(&local->active_txq_lock[ac]);
+ 	local->schedule_round[ac]++;
+-}
+-EXPORT_SYMBOL(ieee80211_txq_schedule_start);
+-
+-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
+-	__releases(txq_lock)
+-{
+-	struct ieee80211_local *local = hw_to_local(hw);
+-
+ 	spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+-EXPORT_SYMBOL(ieee80211_txq_schedule_end);
++EXPORT_SYMBOL(ieee80211_txq_schedule_start);
+ 
+ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ 				  struct net_device *dev,
diff --git a/package/kernel/mac80211/patches/subsys/353-mac80211-mesh-drop-redundant-rcu_read_lock-unlock-ca.patch b/package/kernel/mac80211/patches/subsys/353-mac80211-mesh-drop-redundant-rcu_read_lock-unlock-ca.patch
new file mode 100644
index 0000000000..86300be4ed
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/353-mac80211-mesh-drop-redundant-rcu_read_lock-unlock-ca.patch
@@ -0,0 +1,96 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 16 Mar 2019 17:43:58 +0100
+Subject: [PATCH] mac80211: mesh: drop redundant rcu_read_lock/unlock calls
+
+The callers of these functions are all within RCU locked sections
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -1112,16 +1112,13 @@ int mesh_nexthop_resolve(struct ieee8021
+ 	struct mesh_path *mpath;
+ 	struct sk_buff *skb_to_free = NULL;
+ 	u8 *target_addr = hdr->addr3;
+-	int err = 0;
+ 
+ 	/* Nulls are only sent to peers for PS and should be pre-addressed */
+ 	if (ieee80211_is_qos_nullfunc(hdr->frame_control))
+ 		return 0;
+ 
+-	rcu_read_lock();
+-	err = mesh_nexthop_lookup(sdata, skb);
+-	if (!err)
+-		goto endlookup;
++	if (!mesh_nexthop_lookup(sdata, skb))
++		return 0;
+ 
+ 	/* no nexthop found, start resolving */
+ 	mpath = mesh_path_lookup(sdata, target_addr);
+@@ -1129,8 +1126,7 @@ int mesh_nexthop_resolve(struct ieee8021
+ 		mpath = mesh_path_add(sdata, target_addr);
+ 		if (IS_ERR(mpath)) {
+ 			mesh_path_discard_frame(sdata, skb);
+-			err = PTR_ERR(mpath);
+-			goto endlookup;
++			return PTR_ERR(mpath);
+ 		}
+ 	}
+ 
+@@ -1143,13 +1139,10 @@ int mesh_nexthop_resolve(struct ieee8021
+ 	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ 	ieee80211_set_qos_hdr(sdata, skb);
+ 	skb_queue_tail(&mpath->frame_queue, skb);
+-	err = -ENOENT;
+ 	if (skb_to_free)
+ 		mesh_path_discard_frame(sdata, skb_to_free);
+ 
+-endlookup:
+-	rcu_read_unlock();
+-	return err;
++	return -ENOENT;
+ }
+ 
+ /**
+@@ -1169,13 +1162,10 @@ int mesh_nexthop_lookup(struct ieee80211
+ 	struct sta_info *next_hop;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ 	u8 *target_addr = hdr->addr3;
+-	int err = -ENOENT;
+ 
+-	rcu_read_lock();
+ 	mpath = mesh_path_lookup(sdata, target_addr);
+-
+ 	if (!mpath || !(mpath->flags & MESH_PATH_ACTIVE))
+-		goto endlookup;
++		return -ENOENT;
+ 
+ 	if (time_after(jiffies,
+ 		       mpath->exp_time -
+@@ -1190,12 +1180,10 @@ int mesh_nexthop_lookup(struct ieee80211
+ 		memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
+ 		memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+ 		ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
+-		err = 0;
++		return 0;
+ 	}
+ 
+-endlookup:
+-	rcu_read_unlock();
+-	return err;
++	return -ENOENT;
+ }
+ 
+ void mesh_path_timer(struct timer_list *t)
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -219,7 +219,7 @@ static struct mesh_path *mpath_lookup(st
+ {
+ 	struct mesh_path *mpath;
+ 
+-	mpath = rhashtable_lookup_fast(&tbl->rhead, dst, mesh_rht_params);
++	mpath = rhashtable_lookup(&tbl->rhead, dst, mesh_rht_params);
+ 
+ 	if (mpath && mpath_expired(mpath)) {
+ 		spin_lock_bh(&mpath->state_lock);
diff --git a/package/kernel/mac80211/patches/subsys/354-mac80211-calculate-hash-for-fq-without-holding-fq-lo.patch b/package/kernel/mac80211/patches/subsys/354-mac80211-calculate-hash-for-fq-without-holding-fq-lo.patch
new file mode 100644
index 0000000000..2b6d8ab525
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/354-mac80211-calculate-hash-for-fq-without-holding-fq-lo.patch
@@ -0,0 +1,124 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 16 Mar 2019 17:57:38 +0100
+Subject: [PATCH] mac80211: calculate hash for fq without holding fq->lock
+ in itxq enqueue
+
+Reduces lock contention on enqueue/dequeue of iTXQ packets
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -107,21 +107,23 @@ begin:
+ 	return skb;
+ }
+ 
++static u32 fq_flow_idx(struct fq *fq, struct sk_buff *skb)
++{
++	u32 hash = skb_get_hash_perturb(skb, fq->perturbation);
++
++	return reciprocal_scale(hash, fq->flows_cnt);
++}
++
+ static struct fq_flow *fq_flow_classify(struct fq *fq,
+-					struct fq_tin *tin,
++					struct fq_tin *tin, u32 idx,
+ 					struct sk_buff *skb,
+ 					fq_flow_get_default_t get_default_func)
+ {
+ 	struct fq_flow *flow;
+-	u32 hash;
+-	u32 idx;
+ 
+ 	lockdep_assert_held(&fq->lock);
+ 
+-	hash = skb_get_hash_perturb(skb, fq->perturbation);
+-	idx = reciprocal_scale(hash, fq->flows_cnt);
+ 	flow = &fq->flows[idx];
+-
+ 	if (flow->tin && flow->tin != tin) {
+ 		flow = get_default_func(fq, tin, idx, skb);
+ 		tin->collisions++;
+@@ -153,7 +155,7 @@ static void fq_recalc_backlog(struct fq
+ }
+ 
+ static void fq_tin_enqueue(struct fq *fq,
+-			   struct fq_tin *tin,
++			   struct fq_tin *tin, u32 idx,
+ 			   struct sk_buff *skb,
+ 			   fq_skb_free_t free_func,
+ 			   fq_flow_get_default_t get_default_func)
+@@ -163,7 +165,7 @@ static void fq_tin_enqueue(struct fq *fq
+ 
+ 	lockdep_assert_held(&fq->lock);
+ 
+-	flow = fq_flow_classify(fq, tin, skb, get_default_func);
++	flow = fq_flow_classify(fq, tin, idx, skb, get_default_func);
+ 
+ 	flow->tin = tin;
+ 	flow->backlog += skb->len;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1390,11 +1390,15 @@ static void ieee80211_txq_enqueue(struct
+ {
+ 	struct fq *fq = &local->fq;
+ 	struct fq_tin *tin = &txqi->tin;
++	u32 flow_idx = fq_flow_idx(fq, skb);
+ 
+ 	ieee80211_set_skb_enqueue_time(skb);
+-	fq_tin_enqueue(fq, tin, skb,
++
++	spin_lock_bh(&fq->lock);
++	fq_tin_enqueue(fq, tin, flow_idx, skb,
+ 		       fq_skb_free_func,
+ 		       fq_flow_get_default_func);
++	spin_unlock_bh(&fq->lock);
+ }
+ 
+ static bool fq_vlan_filter_func(struct fq *fq, struct fq_tin *tin,
+@@ -1564,7 +1568,6 @@ static bool ieee80211_queue_skb(struct i
+ 				struct sta_info *sta,
+ 				struct sk_buff *skb)
+ {
+-	struct fq *fq = &local->fq;
+ 	struct ieee80211_vif *vif;
+ 	struct txq_info *txqi;
+ 
+@@ -1582,9 +1585,7 @@ static bool ieee80211_queue_skb(struct i
+ 	if (!txqi)
+ 		return false;
+ 
+-	spin_lock_bh(&fq->lock);
+ 	ieee80211_txq_enqueue(local, txqi, skb);
+-	spin_unlock_bh(&fq->lock);
+ 
+ 	schedule_and_wake_txq(local, txqi);
+ 
+@@ -3198,6 +3199,7 @@ static bool ieee80211_amsdu_aggregate(st
+ 	u8 max_subframes = sta->sta.max_amsdu_subframes;
+ 	int max_frags = local->hw.max_tx_fragments;
+ 	int max_amsdu_len = sta->sta.max_amsdu_len;
++	u32 flow_idx;
+ 	int orig_truesize;
+ 	__be16 len;
+ 	void *data;
+@@ -3220,6 +3222,8 @@ static bool ieee80211_amsdu_aggregate(st
+ 		max_amsdu_len = min_t(int, max_amsdu_len,
+ 				      sta->sta.max_rc_amsdu_len);
+ 
++	flow_idx = fq_flow_idx(fq, skb);
++
+ 	spin_lock_bh(&fq->lock);
+ 
+ 	/* TODO: Ideally aggregation should be done on dequeue to remain
+@@ -3227,7 +3231,8 @@ static bool ieee80211_amsdu_aggregate(st
+ 	 */
+ 
+ 	tin = &txqi->tin;
+-	flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
++	flow = fq_flow_classify(fq, tin, flow_idx, skb,
++				fq_flow_get_default_func);
+ 	head = skb_peek_tail(&flow->queue);
+ 	if (!head)
+ 		goto unlock;
diff --git a/package/kernel/mac80211/patches/subsys/355-mac80211-run-late-dequeue-late-tx-handlers-without-h.patch b/package/kernel/mac80211/patches/subsys/355-mac80211-run-late-dequeue-late-tx-handlers-without-h.patch
new file mode 100644
index 0000000000..3127c86822
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/355-mac80211-run-late-dequeue-late-tx-handlers-without-h.patch
@@ -0,0 +1,55 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 16 Mar 2019 18:00:12 +0100
+Subject: [PATCH] mac80211: run late dequeue late tx handlers without
+ holding fq->lock
+
+Reduces lock contention on enqueue/dequeue of iTXQ packets
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3507,6 +3507,7 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ 	ieee80211_tx_result r;
+ 	struct ieee80211_vif *vif = txq->vif;
+ 
++begin:
+ 	spin_lock_bh(&fq->lock);
+ 
+ 	if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ||
+@@ -3523,11 +3524,12 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ 	if (skb)
+ 		goto out;
+ 
+-begin:
+ 	skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func);
+ 	if (!skb)
+ 		goto out;
+ 
++	spin_unlock_bh(&fq->lock);
++
+ 	hdr = (struct ieee80211_hdr *)skb->data;
+ 	info = IEEE80211_SKB_CB(skb);
+ 
+@@ -3573,8 +3575,11 @@ begin:
+ 
+ 		skb = __skb_dequeue(&tx.skbs);
+ 
+-		if (!skb_queue_empty(&tx.skbs))
++		if (!skb_queue_empty(&tx.skbs)) {
++			spin_lock_bh(&fq->lock);
+ 			skb_queue_splice_tail(&tx.skbs, &txqi->frags);
++			spin_unlock_bh(&fq->lock);
++		}
+ 	}
+ 
+ 	if (skb && skb_has_frag_list(skb) &&
+@@ -3613,6 +3618,7 @@ begin:
+ 	}
+ 
+ 	IEEE80211_SKB_CB(skb)->control.vif = vif;
++	return skb;
+ 
+ out:
+ 	spin_unlock_bh(&fq->lock);
diff --git a/package/kernel/mac80211/patches/subsys/356-mac80211-set-NETIF_F_LLTX-when-using-intermediate-tx.patch b/package/kernel/mac80211/patches/subsys/356-mac80211-set-NETIF_F_LLTX-when-using-intermediate-tx.patch
new file mode 100644
index 0000000000..95ab3ab9fb
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/356-mac80211-set-NETIF_F_LLTX-when-using-intermediate-tx.patch
@@ -0,0 +1,22 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 16 Mar 2019 18:01:53 +0100
+Subject: [PATCH] mac80211: set NETIF_F_LLTX when using intermediate tx
+ queues
+
+When using iTXQ, tx sequence number allocation and statistics are run at
+dequeue time. Because of that, it is safe to enable NETIF_F_LLTX, which
+allows tx handlers to run on multiple CPUs in parallel.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1301,6 +1301,7 @@ static void ieee80211_if_setup(struct ne
+ static void ieee80211_if_setup_no_queue(struct net_device *dev)
+ {
+ 	ieee80211_if_setup(dev);
++	dev->features |= NETIF_F_LLTX;
+ #if LINUX_VERSION_IS_GEQ(4,3,0)
+ 	dev->priv_flags |= IFF_NO_QUEUE;
+ #else
diff --git a/package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch b/package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch
new file mode 100644
index 0000000000..919aa36a48
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/357-mac80211-optimize-skb-resizing.patch
@@ -0,0 +1,200 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 17 Mar 2019 18:11:30 +0100
+Subject: [PATCH] mac80211: optimize skb resizing
+
+When forwarding unicast packets from ethernet to batman-adv over 802.11s
+(with forwarding disabled), the typical required headroom to transmit
+encrypted packets on mt76 is 32 (802.11) + 6 (802.11s) + 8 (CCMP) +
+2 (padding) + 6 (LLC) + 18 (batman-adv) - 14 (old ethernet header) = 58 bytes.
+
+On systems where NET_SKB_PAD is 64 this leads to a call to pskb_expand_head
+for every packet, since mac80211 also tries to allocate 16 bytes status
+headroom for radiotap headers.
+
+This patch fixes these unnecessary reallocations by only requiring the extra
+status headroom in ieee80211_tx_monitor()
+If however a reallocation happens before that call, the status headroom gets
+added there as well, in order to avoid double reallocation.
+
+The patch also cleans up the code by moving the headroom calculation to
+ieee80211_skb_resize.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1761,6 +1761,9 @@ void ieee80211_clear_fast_xmit(struct st
+ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ 			      const u8 *buf, size_t len,
+ 			      const u8 *dest, __be16 proto, bool unencrypted);
++int ieee80211_skb_resize(struct ieee80211_local *local,
++			 struct ieee80211_sub_if_data *sdata,
++			 struct sk_buff *skb, int hdrlen, int hdr_add);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -672,6 +672,11 @@ void ieee80211_tx_monitor(struct ieee802
+ 		}
+ 	}
+ 
++	if (ieee80211_skb_resize(local, NULL, skb, 0, 0)) {
++		dev_kfree_skb(skb);
++		return;
++	}
++
+ 	/* send frame to monitor interfaces now */
+ 	rtap_len = ieee80211_tx_radiotap_len(info);
+ 	if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1914,37 +1914,53 @@ static bool ieee80211_tx(struct ieee8021
+ }
+ 
+ /* device xmit handlers */
+-
+-static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+-				struct sk_buff *skb,
+-				int head_need, bool may_encrypt)
++int ieee80211_skb_resize(struct ieee80211_local *local,
++			 struct ieee80211_sub_if_data *sdata,
++			 struct sk_buff *skb, int hdr_len, int hdr_extra)
+ {
+-	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_hdr *hdr;
+-	bool enc_tailroom;
+-	int tail_need = 0;
++	int head_need, head_max;
++	int tail_need, tail_max;
++	bool enc_tailroom = false;
+ 
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	enc_tailroom = may_encrypt &&
+-		       (sdata->crypto_tx_tailroom_needed_cnt ||
+-			ieee80211_is_mgmt(hdr->frame_control));
++	if (sdata && !hdr_len &&
++	    !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
++		hdr = (struct ieee80211_hdr *) skb->data;
++		enc_tailroom = (sdata->crypto_tx_tailroom_needed_cnt ||
++				ieee80211_is_mgmt(hdr->frame_control));
++		hdr_len += sdata->encrypt_headroom;
++	}
+ 
+-	if (enc_tailroom) {
+-		tail_need = IEEE80211_ENCRYPT_TAILROOM;
+-		tail_need -= skb_tailroom(skb);
+-		tail_need = max_t(int, tail_need, 0);
++	head_need = head_max = hdr_len;
++	tail_need = tail_max = 0;
++	if (!sdata) {
++		head_need = head_max = local->tx_headroom;
++	} else {
++		head_max += hdr_extra;
++		head_max += max_t(int, local->tx_headroom,
++				  local->hw.extra_tx_headroom);
++		head_need += local->hw.extra_tx_headroom;
++
++		tail_max = IEEE80211_ENCRYPT_TAILROOM;
++		if (enc_tailroom)
++			tail_need = tail_max;
+ 	}
+ 
+ 	if (skb_cloned(skb) &&
+ 	    (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
+ 	     !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
+ 		I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+-	else if (head_need || tail_need)
++	else if (head_need > skb_headroom(skb) ||
++		 tail_need > skb_tailroom(skb))
+ 		I802_DEBUG_INC(local->tx_expand_skb_head);
+ 	else
+ 		return 0;
+ 
+-	if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
++	head_max = max_t(int, 0, head_max - skb_headroom(skb));
++	tail_max = max_t(int, 0, tail_max - skb_tailroom(skb));
++
++	if (pskb_expand_head(skb, head_max, tail_max, GFP_ATOMIC)) {
+ 		wiphy_debug(local->hw.wiphy,
+ 			    "failed to reallocate TX buffer\n");
+ 		return -ENOMEM;
+@@ -1960,18 +1976,8 @@ void ieee80211_xmit(struct ieee80211_sub
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_hdr *hdr;
+-	int headroom;
+-	bool may_encrypt;
+-
+-	may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
+-
+-	headroom = local->tx_headroom;
+-	if (may_encrypt)
+-		headroom += sdata->encrypt_headroom;
+-	headroom -= skb_headroom(skb);
+-	headroom = max_t(int, 0, headroom);
+ 
+-	if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
++	if (ieee80211_skb_resize(local, sdata, skb, 0, 0)) {
+ 		ieee80211_free_txskb(&local->hw, skb);
+ 		return;
+ 	}
+@@ -2740,30 +2746,14 @@ static struct sk_buff *ieee80211_build_h
+ 
+ 	skb_pull(skb, skip_header_bytes);
+ 	padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
+-	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
++	head_need = hdrlen + encaps_len + meshhdrlen;
+ 	head_need += padsize;
+ 
+-	/*
+-	 * So we need to modify the skb header and hence need a copy of
+-	 * that. The head_need variable above doesn't, so far, include
+-	 * the needed header space that we don't need right away. If we
+-	 * can, then we don't reallocate right now but only after the
+-	 * frame arrives at the master device (if it does...)
+-	 *
+-	 * If we cannot, however, then we will reallocate to include all
+-	 * the ever needed space. Also, if we need to reallocate it anyway,
+-	 * make it big enough for everything we may ever need.
+-	 */
+-
+-	if (head_need > 0 || skb_cloned(skb)) {
+-		head_need += sdata->encrypt_headroom;
+-		head_need += local->tx_headroom;
+-		head_need = max_t(int, 0, head_need);
+-		if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
+-			ieee80211_free_txskb(&local->hw, skb);
+-			skb = NULL;
+-			return ERR_PTR(-ENOMEM);
+-		}
++	if (ieee80211_skb_resize(local, sdata, skb, head_need,
++				 sdata->encrypt_headroom)) {
++		ieee80211_free_txskb(&local->hw, skb);
++		skb = NULL;
++		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+ 	if (encaps_data)
+@@ -3377,7 +3367,6 @@ static bool ieee80211_xmit_fast(struct i
+ 	struct ieee80211_local *local = sdata->local;
+ 	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
+ 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+-	int hw_headroom = sdata->local->hw.extra_tx_headroom;
+ 	struct ethhdr eth;
+ 	struct ieee80211_tx_info *info;
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+@@ -3429,10 +3418,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	 * as the may-encrypt argument for the resize to not account for
+ 	 * more room than we already have in 'extra_head'
+ 	 */
+-	if (unlikely(ieee80211_skb_resize(sdata, skb,
+-					  max_t(int, extra_head + hw_headroom -
+-						     skb_headroom(skb), 0),
+-					  false))) {
++	if (unlikely(ieee80211_skb_resize(local, sdata, skb, extra_head, 0))) {
+ 		kfree_skb(skb);
+ 		return true;
+ 	}
diff --git a/package/kernel/mac80211/patches/subsys/358-mac80211-make-ieee80211_schedule_txq-schedule-empty-.patch b/package/kernel/mac80211/patches/subsys/358-mac80211-make-ieee80211_schedule_txq-schedule-empty-.patch
new file mode 100644
index 0000000000..a0a65f35a8
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/358-mac80211-make-ieee80211_schedule_txq-schedule-empty-.patch
@@ -0,0 +1,105 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 17 Mar 2019 14:26:59 +0100
+Subject: [PATCH] mac80211: make ieee80211_schedule_txq schedule empty TXQs
+
+Currently there is no way for the driver to signal to mac80211 that it should
+schedule a TXQ even if there are no packets on the mac80211 part of that queue.
+This is problematic if the driver has an internal retry queue to deal with
+software A-MPDU retry.
+
+This patch changes the behavior of ieee80211_schedule_txq to always schedule
+the queue, as its only user (ath9k) seems to expect such behavior already:
+it calls this function on tx status and on powersave wakeup whenever its
+internal retry queue is not empty.
+
+Also add an extra argument to ieee80211_return_txq to get the same behavior.
+
+This fixes an issue on ath9k where tx queues with packets to retry (and no
+new packets in mac80211) would not get serviced.
+
+Fixes: 89cea7493a346 ("ath9k: Switch to mac80211 TXQ scheduling and airtime APIs")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -6090,26 +6090,42 @@ static inline void ieee80211_txq_schedul
+ {
+ }
+ 
++void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
++			      struct ieee80211_txq *txq, bool force);
++
+ /**
+  * ieee80211_schedule_txq - schedule a TXQ for transmission
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+  * @txq: pointer obtained from station or virtual interface
+  *
+- * Schedules a TXQ for transmission if it is not already scheduled.
++ * Schedules a TXQ for transmission if it is not already scheduled,
++ * even if mac80211 does not have any packets buffered.
++ *
++ * The driver may call this function if it has buffered packets for
++ * this TXQ internally.
+  */
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
++static inline void
++ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
++{
++	__ieee80211_schedule_txq(hw, txq, true);
++}
+ 
+ /**
+  * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+  * @txq: pointer obtained from station or virtual interface
++ * @force: schedule txq even if mac80211 does not have any buffered packets.
++ *
++ * The driver may set force=true if it has buffered packets for this TXQ
++ * internally.
+  */
+ static inline void
+-ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
++ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
++		     bool force)
+ {
+-	ieee80211_schedule_txq(hw, txq);
++	__ieee80211_schedule_txq(hw, txq, force);
+ }
+ 
+ /**
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3655,8 +3655,9 @@ out:
+ }
+ EXPORT_SYMBOL(ieee80211_next_txq);
+ 
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
+-			    struct ieee80211_txq *txq)
++void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
++			      struct ieee80211_txq *txq,
++			      bool force)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
+@@ -3664,7 +3665,8 @@ void ieee80211_schedule_txq(struct ieee8
+ 	spin_lock_bh(&local->active_txq_lock[txq->ac]);
+ 
+ 	if (list_empty(&txqi->schedule_order) &&
+-	    (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
++	    (force || !skb_queue_empty(&txqi->frags) ||
++	     txqi->tin.backlog_packets)) {
+ 		/* If airtime accounting is active, always enqueue STAs at the
+ 		 * head of the list to ensure that they only get moved to the
+ 		 * back by the airtime DRR scheduler once they have a negative
+@@ -3684,7 +3686,7 @@ void ieee80211_schedule_txq(struct ieee8
+ 
+ 	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
+ }
+-EXPORT_SYMBOL(ieee80211_schedule_txq);
++EXPORT_SYMBOL(__ieee80211_schedule_txq);
+ 
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ 				struct ieee80211_txq *txq)
diff --git a/package/kernel/mac80211/patches/subsys/359-mac80211-un-schedule-TXQs-on-powersave-start.patch b/package/kernel/mac80211/patches/subsys/359-mac80211-un-schedule-TXQs-on-powersave-start.patch
new file mode 100644
index 0000000000..1abb2db7c2
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/359-mac80211-un-schedule-TXQs-on-powersave-start.patch
@@ -0,0 +1,31 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 19 Mar 2019 11:36:12 +0100
+Subject: [PATCH] mac80211: un-schedule TXQs on powersave start
+
+Once a station enters powersave, its queues should not be returned by
+ieee80211_next_txq() anymore. They will be re-scheduled again after the
+station has woken up again
+
+Fixes: 1866760096bf4 ("mac80211: Add TXQ scheduling API")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1508,7 +1508,15 @@ static void sta_ps_start(struct sta_info
+ 		return;
+ 
+ 	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
+-		if (txq_has_queue(sta->sta.txq[tid]))
++		struct ieee80211_txq *txq = sta->sta.txq[tid];
++		struct txq_info *txqi = to_txq_info(txq);
++
++		spin_lock(&local->active_txq_lock[txq->ac]);
++		if (!list_empty(&txqi->schedule_order))
++			list_del_init(&txqi->schedule_order);
++		spin_unlock(&local->active_txq_lock[txq->ac]);
++
++		if (txq_has_queue(txq))
+ 			set_bit(tid, &sta->txq_buffered_tids);
+ 		else
+ 			clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/package/kernel/mac80211/patches/subsys/360-mac80211-when-using-iTXQ-select-the-queue-in-ieee802.patch b/package/kernel/mac80211/patches/subsys/360-mac80211-when-using-iTXQ-select-the-queue-in-ieee802.patch
new file mode 100644
index 0000000000..bb3af7317a
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/360-mac80211-when-using-iTXQ-select-the-queue-in-ieee802.patch
@@ -0,0 +1,183 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 22 Mar 2019 18:06:03 +0100
+Subject: [PATCH] mac80211: when using iTXQ, select the queue in
+ ieee80211_subif_start_xmit
+
+When using iTXQ, the network stack does not need the real queue number, since
+mac80211 is using its internal queues anyway. In that case we can defer
+selecting the queue and remove a redundant station lookup in the tx path to save
+some CPU cycles.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3753,6 +3753,7 @@ void __ieee80211_subif_start_xmit(struct
+ 				  u32 info_flags)
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	struct ieee80211_local *local = sdata->local;
+ 	struct sta_info *sta;
+ 	struct sk_buff *next;
+ 
+@@ -3766,7 +3767,15 @@ void __ieee80211_subif_start_xmit(struct
+ 	if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
+ 		goto out_free;
+ 
+-	if (!IS_ERR_OR_NULL(sta)) {
++	if (IS_ERR(sta))
++		sta = NULL;
++
++	if (local->ops->wake_tx_queue) {
++		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
++		skb_set_queue_mapping(skb, queue);
++	}
++
++	if (sta) {
+ 		struct ieee80211_fast_tx *fast_tx;
+ 
+ 		/* We need a bit of data queued to build aggregates properly, so
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -141,6 +141,42 @@ u16 ieee80211_select_queue_80211(struct
+ 	return ieee80211_downgrade_queue(sdata, NULL, skb);
+ }
+ 
++u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
++			     struct sta_info *sta, struct sk_buff *skb)
++{
++	struct mac80211_qos_map *qos_map;
++	bool qos;
++
++	/* all mesh/ocb stations are required to support WME */
++	if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
++	    sdata->vif.type == NL80211_IFTYPE_OCB)
++		qos = true;
++	else if (sta)
++		qos = sta->sta.wme;
++	else
++		qos = false;
++
++	if (!qos) {
++		skb->priority = 0; /* required for correct WPA/11i MIC */
++		return IEEE80211_AC_BE;
++	}
++
++	if (skb->protocol == sdata->control_port_protocol) {
++		skb->priority = 7;
++		goto downgrade;
++	}
++
++	/* use the data classifier to determine what 802.1d tag the
++	 * data frame has */
++	qos_map = rcu_dereference(sdata->qos_map);
++	skb->priority = cfg80211_classify8021d(skb, qos_map ?
++					       &qos_map->qos_map : NULL);
++
++ downgrade:
++	return ieee80211_downgrade_queue(sdata, sta, skb);
++}
++
++
+ /* Indicate which queue to use. */
+ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+ 			   struct sk_buff *skb)
+@@ -148,10 +184,12 @@ u16 ieee80211_select_queue(struct ieee80
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct sta_info *sta = NULL;
+ 	const u8 *ra = NULL;
+-	bool qos = false;
+-	struct mac80211_qos_map *qos_map;
+ 	u16 ret;
+ 
++	/* when using iTXQ, we can do this later */
++	if (local->ops->wake_tx_queue)
++		return 0;
++
+ 	if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
+ 		skb->priority = 0; /* required for correct WPA/11i MIC */
+ 		return 0;
+@@ -161,10 +199,8 @@ u16 ieee80211_select_queue(struct ieee80
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 		sta = rcu_dereference(sdata->u.vlan.sta);
+-		if (sta) {
+-			qos = sta->sta.wme;
++		if (sta)
+ 			break;
+-		}
+ 		/* fall through */
+ 	case NL80211_IFTYPE_AP:
+ 		ra = skb->data;
+@@ -172,56 +208,26 @@ u16 ieee80211_select_queue(struct ieee80
+ 	case NL80211_IFTYPE_WDS:
+ 		ra = sdata->u.wds.remote_addr;
+ 		break;
+-#ifdef CPTCFG_MAC80211_MESH
+-	case NL80211_IFTYPE_MESH_POINT:
+-		qos = true;
+-		break;
+-#endif
+ 	case NL80211_IFTYPE_STATION:
+ 		/* might be a TDLS station */
+ 		sta = sta_info_get(sdata, skb->data);
+ 		if (sta)
+-			qos = sta->sta.wme;
++			break;
+ 
+ 		ra = sdata->u.mgd.bssid;
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
+ 		ra = skb->data;
+ 		break;
+-	case NL80211_IFTYPE_OCB:
+-		/* all stations are required to support WME */
+-		qos = true;
+-		break;
+ 	default:
+ 		break;
+ 	}
+ 
+-	if (!sta && ra && !is_multicast_ether_addr(ra)) {
++	if (!sta && ra && !is_multicast_ether_addr(ra))
+ 		sta = sta_info_get(sdata, ra);
+-		if (sta)
+-			qos = sta->sta.wme;
+-	}
+ 
+-	if (!qos) {
+-		skb->priority = 0; /* required for correct WPA/11i MIC */
+-		ret = IEEE80211_AC_BE;
+-		goto out;
+-	}
++	ret = __ieee80211_select_queue(sdata, sta, skb);
+ 
+-	if (skb->protocol == sdata->control_port_protocol) {
+-		skb->priority = 7;
+-		goto downgrade;
+-	}
+-
+-	/* use the data classifier to determine what 802.1d tag the
+-	 * data frame has */
+-	qos_map = rcu_dereference(sdata->qos_map);
+-	skb->priority = cfg80211_classify8021d(skb, qos_map ?
+-					       &qos_map->qos_map : NULL);
+-
+- downgrade:
+-	ret = ieee80211_downgrade_queue(sdata, sta, skb);
+- out:
+ 	rcu_read_unlock();
+ 	return ret;
+ }
+--- a/net/mac80211/wme.h
++++ b/net/mac80211/wme.h
+@@ -16,6 +16,8 @@
+ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
+ 				 struct sk_buff *skb,
+ 				 struct ieee80211_hdr *hdr);
++u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
++			     struct sta_info *sta, struct sk_buff *skb);
+ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+ 			   struct sk_buff *skb);
+ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
diff --git a/package/kernel/mac80211/patches/subsys/390-nl-mac-80211-allow-4addr-AP-operation-on-crypto-cont.patch b/package/kernel/mac80211/patches/subsys/390-nl-mac-80211-allow-4addr-AP-operation-on-crypto-cont.patch
new file mode 100644
index 0000000000..2940615354
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/390-nl-mac-80211-allow-4addr-AP-operation-on-crypto-cont.patch
@@ -0,0 +1,107 @@
+From 3ad31f4efe9674a8bda057c79995a9468281e77f Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Wed, 21 Nov 2018 16:33:48 +0530
+Subject: [PATCH] {nl,mac}80211: allow 4addr AP operation on crypto controlled
+ devices
+
+As per the current design, for sw crypto controlled devices, it is
+the device which has to advertise the support for AP/VLAN iftype
+based on it's capability to tranmsit packets encrypted in software
+(In VLAN functionality, group traffic generated for a specific
+VLAN group is always encrypted in software). Commit db3bdcb9c3ff
+("mac80211: allow AP_VLAN operation on crypto controlled devices")
+has introduced this change.
+
+Since 4addr AP operation also uses AP/VLAN iftype, this conditional
+way of advertising AP/VLAN support has broken 4addr AP mode operation on
+crypto controlled devices which do not support VLAN functionality.
+
+For example:
+In the case of ath10k driver, not all firmwares have support for VLAN
+functionality but all can support 4addr AP operation. Because AP/VLAN
+support is not advertised for these devices, 4addr AP operations are
+also blocked.
+
+Fix this by allowing 4addr opertion on devices which do not advertise
+AP/VLAN iftype but which can support 4addr operation (the desicion is
+taken based on the wiphy flag WIPHY_FLAG_4ADDR_AP).
+
+Fixes: Commit db3bdcb9c3ff ("mac80211: allow AP_VLAN operation on
+crypto controlled devices")
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+---
+ include/net/cfg80211.h |  3 ++-
+ net/mac80211/util.c    |  4 +++-
+ net/wireless/core.c    |  9 +++++++--
+ net/wireless/nl80211.c | 10 ++++++++--
+ 4 files changed, 20 insertions(+), 6 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3457,7 +3457,8 @@ struct cfg80211_ops {
+  *	on wiphy_new(), but can be changed by the driver if it has a good
+  *	reason to override the default
+  * @WIPHY_FLAG_4ADDR_AP: supports 4addr mode even on AP (with a single station
+- *	on a VLAN interface)
++ *	on a VLAN interface). This flag also serves an extra purpose of
++ *	supporting 4ADDR AP mode on devices which do not support AP/VLAN iftype.
+  * @WIPHY_FLAG_4ADDR_STATION: supports 4addr mode even as a station
+  * @WIPHY_FLAG_CONTROL_PORT_PROTOCOL: This device supports setting the
+  *	control port protocol ethertype. The device also honours the
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3626,7 +3626,9 @@ int ieee80211_check_combinations(struct
+ 	}
+ 
+ 	/* Always allow software iftypes */
+-	if (local->hw.wiphy->software_iftypes & BIT(iftype)) {
++	if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
++	    (iftype == NL80211_IFTYPE_AP_VLAN &&
++	     local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
+ 		if (radar_detect)
+ 			return -EINVAL;
+ 		return 0;
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1351,8 +1351,13 @@ static int cfg80211_netdev_notifier_call
+ 		}
+ 		break;
+ 	case NETDEV_PRE_UP:
+-		if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
+-			return notifier_from_errno(-EOPNOTSUPP);
++		if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype))) {
++			if (!(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
++			      rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
++			      wdev->use_4addr))
++				return notifier_from_errno(-EOPNOTSUPP);
++		}
++
+ 		if (rfkill_blocked(rdev->rfkill))
+ 			return notifier_from_errno(-ERFKILL);
+ 		break;
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3194,8 +3194,7 @@ static int nl80211_new_interface(struct
+ 			return -EINVAL;
+ 	}
+ 
+-	if (!rdev->ops->add_virtual_intf ||
+-	    !(rdev->wiphy.interface_modes & (1 << type)))
++	if (!rdev->ops->add_virtual_intf)
+ 		return -EOPNOTSUPP;
+ 
+ 	if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
+@@ -3214,6 +3213,13 @@ static int nl80211_new_interface(struct
+ 			return err;
+ 	}
+ 
++	if (!(rdev->wiphy.interface_modes & (1 << type))) {
++		if (!(type == NL80211_IFTYPE_AP_VLAN &&
++		      rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
++		      params.use_4addr))
++			return -EOPNOTSUPP;
++	}
++
+ 	err = nl80211_parse_mon_options(rdev, type, info, &params);
+ 	if (err < 0)
+ 		return err;
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
similarity index 79%
rename from package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
rename to package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
index 8a149dcb83..4dcd7b5fcc 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -2750,6 +2750,7 @@ struct cfg80211_pmk_conf {
+@@ -2968,6 +2968,7 @@ struct cfg80211_external_auth_params {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -3041,6 +3042,7 @@ struct cfg80211_ops {
+@@ -3268,6 +3269,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -18,7 +18,7 @@
  				const u8 *addr);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1338,6 +1338,7 @@ enum ieee80211_smps_mode {
+@@ -1395,6 +1395,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1358,6 +1359,7 @@ enum ieee80211_smps_mode {
+@@ -1415,6 +1416,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,9 +36,9 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2153,6 +2153,9 @@ enum nl80211_commands {
-  * @NL80211_ATTR_PMKR0_NAME: PMK-R0 Name for offloaded FT.
-  * @NL80211_ATTR_PORT_AUTHORIZED: (reserved)
+@@ -2244,6 +2244,9 @@ enum nl80211_commands {
+  * @NL80211_ATTR_AIRTIME_WEIGHT: Station's weight when scheduled by the airtime
+  *	scheduler.
   *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2579,6 +2582,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_PMKR0_NAME,
- 	NL80211_ATTR_PORT_AUTHORIZED,
+@@ -2693,6 +2696,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_AIRTIME_WEIGHT,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2447,6 +2447,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2505,6 +2505,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3721,6 +3734,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3872,6 +3885,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1350,6 +1350,7 @@ struct ieee80211_local {
+@@ -1365,6 +1365,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -97,7 +97,7 @@
  
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -93,7 +93,7 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -94,7 +94,7 @@ static u32 ieee80211_hw_conf_chan(struct
  	struct ieee80211_sub_if_data *sdata;
  	struct cfg80211_chan_def chandef = {};
  	u32 changed = 0;
@@ -106,7 +106,7 @@
  	u32 offchannel_flag;
  
  	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
-@@ -150,6 +150,12 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -151,6 +151,12 @@ static u32 ieee80211_hw_conf_chan(struct
  	}
  	rcu_read_unlock();
  
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -611,6 +617,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -626,6 +632,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,15 +129,15 @@
  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -420,6 +420,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
- 	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
- 	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
+@@ -431,6 +431,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
+ 					 .len = NL80211_HE_MAX_CAPABILITY_LEN },
+ 	[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -2395,6 +2396,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -2588,6 +2589,20 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			return result;
  	}
diff --git a/package/kernel/mac80211/ralink.mk b/package/kernel/mac80211/ralink.mk
new file mode 100644
index 0000000000..6aca170773
--- /dev/null
+++ b/package/kernel/mac80211/ralink.mk
@@ -0,0 +1,172 @@
+PKG_DRIVERS += \
+	rt2x00-lib rt2x00-pci rt2x00-usb rt2x00-mmio \
+	rt2400-pci rt2500-pci rt2500-usb \
+	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
+	rt61-pci rt73-usb
+
+PKG_CONFIG_DEPENDS += \
+	CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS \
+	CONFIG_PACKAGE_RT2X00_DEBUG
+
+config-$(call config_package,rt2x00-lib) += RT2X00 RT2X00_LIB
+config-$(call config_package,rt2x00-pci) += RT2X00_LIB_PCI
+config-$(call config_package,rt2x00-mmio) += RT2X00_LIB_MMIO
+config-$(call config_package,rt2x00-usb) += RT2X00_LIB_USB
+config-$(CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS) += RT2X00_LIB_DEBUGFS
+config-$(CONFIG_PACKAGE_RT2X00_DEBUG) += RT2X00_DEBUG
+
+config-$(call config_package,rt2400-pci) += RT2400PCI
+config-$(call config_package,rt2500-pci) += RT2500PCI
+config-$(call config_package,rt2500-usb) += RT2500USB
+config-$(call config_package,rt61-pci) += RT61PCI
+config-$(call config_package,rt73-usb) += RT73USB
+
+config-$(call config_package,rt2800-lib) += RT2800_LIB
+
+config-$(call config_package,rt2800-soc) += RT2800SOC
+config-$(call config_package,rt2800-pci) += RT2800PCI
+config-y += RT2800PCI_RT33XX RT2800PCI_RT35XX RT2800PCI_RT53XX RT2800PCI_RT3290
+
+config-$(call config_package,rt2800-usb) += RT2800USB
+config-y += RT2800USB_RT33XX RT2800USB_RT35XX RT2800USB_RT3573 RT2800USB_RT53XX RT2800USB_RT55XX RT2800USB_UNKNOWN
+
+define KernelPackage/rt2x00/Default
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Ralink Drivers for RT2x00 cards
+endef
+
+define KernelPackage/rt2x00-lib
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211
+  TITLE+= (LIB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00lib.ko
+  MENU:=1
+endef
+
+define KernelPackage/rt2x00-lib/config
+  if PACKAGE_kmod-rt2x00-lib
+
+	config PACKAGE_RT2X00_LIB_DEBUGFS
+		bool "Enable rt2x00 debugfs support"
+		depends on PACKAGE_MAC80211_DEBUGFS
+		help
+		  Enable creation of debugfs files for the rt2x00 drivers.
+		  These debugfs files support both reading and writing of the
+		  most important register types of the rt2x00 hardware.
+
+	config PACKAGE_RT2X00_DEBUG
+		bool "Enable rt2x00 debug output"
+		help
+		  Enable debugging output for all rt2x00 modules
+
+  endif
+endef
+
+define KernelPackage/rt2x00-mmio
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib
+  HIDDEN:=1
+  TITLE+= (MMIO)
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko
+endef
+
+define KernelPackage/rt2x00-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-mmio +kmod-rt2x00-lib
+  HIDDEN:=1
+  TITLE+= (PCI)
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2x00pci)
+endef
+
+define KernelPackage/rt2x00-usb
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
+  HIDDEN:=1
+  TITLE+= (USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt2x00usb)
+endef
+
+define KernelPackage/rt2800-lib
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
+  HIDDEN:=1
+  TITLE+= (rt2800 LIB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
+endef
+
+define KernelPackage/rt2400-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
+  TITLE+= (RT2400 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2400pci)
+endef
+
+define KernelPackage/rt2500-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
+  TITLE+= (RT2500 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2500pci)
+endef
+
+define KernelPackage/rt2500-usb
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
+  TITLE+= (RT2500 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt2500usb)
+endef
+
+define KernelPackage/rt2800-mmio
+$(call KernelPackage/rt2x00/Default)
+  TITLE += (RT28xx/RT3xxx MMIO)
+  DEPENDS += +kmod-rt2800-lib +kmod-rt2x00-mmio
+  HIDDEN:=1
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800mmio.ko
+endef
+
+define KernelPackage/rt2800-soc
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS += @(TARGET_ramips_rt288x||TARGET_ramips_rt305x||TARGET_ramips_rt3883||TARGET_ramips_mt7620) +kmod-rt2800-mmio +kmod-rt2800-lib
+  TITLE += (RT28xx/RT3xxx SoC)
+  FILES := \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2x00soc.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800soc.ko
+  AUTOLOAD:=$(call AutoProbe,rt2800soc)
+endef
+
+define KernelPackage/rt2800-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-rt2800-mmio +kmod-eeprom-93cx6 +rt2800-pci-firmware
+  TITLE+= (RT2860 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt2800pci)
+endef
+
+define KernelPackage/rt2800-usb
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-lib-crc-ccitt +rt2800-usb-firmware
+  TITLE+= (RT2870 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt2800usb)
+endef
+
+
+define KernelPackage/rt61-pci
+$(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6 +kmod-lib-crc-itu-t +rt61-pci-firmware
+  TITLE+= (RT2x61 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
+  AUTOLOAD:=$(call AutoProbe,rt61pci)
+endef
+
+define KernelPackage/rt73-usb
+  $(call KernelPackage/rt2x00/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-lib-crc-itu-t +rt73-usb-firmware
+  TITLE+= (RT73 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
+  AUTOLOAD:=$(call AutoProbe,rt73usb)
+endef
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
new file mode 100644
index 0000000000..e7eb9e3117
--- /dev/null
+++ b/package/kernel/mac80211/realtek.mk
@@ -0,0 +1,170 @@
+PKG_DRIVERS += \
+	rtl8180 rtl8187 \
+	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
+	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8821ae \
+	rtl8xxxu
+
+config-$(call config_package,rtl8180) += RTL8180
+config-$(call config_package,rtl8187) += RTL8187
+
+config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
+config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
+config-$(call config_package,rtlwifi-btcoexist) += RTLBTCOEXIST
+config-$(call config_package,rtlwifi-usb) += RTLWIFI_USB
+config-$(call config_package,rtl8192c-common) += RTL8192C_COMMON
+config-$(call config_package,rtl8192ce) += RTL8192CE
+config-$(call config_package,rtl8192se) += RTL8192SE
+config-$(call config_package,rtl8192de) += RTL8192DE
+config-$(call config_package,rtl8192cu) += RTL8192CU
+config-$(call config_package,rtl8821ae) += RTL8821AE
+config-$(CONFIG_PACKAGE_RTLWIFI_DEBUG) += RTLWIFI_DEBUG
+
+config-$(call config_package,rtl8xxxu) += RTL8XXXU
+config-y += RTL8XXXU_UNTESTED
+
+define KernelPackage/rtl818x/Default
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek Drivers for RTL818x devices
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/rtl8187
+  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
+endef
+
+define KernelPackage/rtl8180
+  $(call KernelPackage/rtl818x/Default)
+  DEPENDS+= @PCI_SUPPORT
+  TITLE+= (RTL8180 PCI)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
+  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
+endef
+
+define KernelPackage/rtl8187
+$(call KernelPackage/rtl818x/Default)
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core
+  TITLE+= (RTL8187 USB)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8187)
+endef
+
+define KernelPackage/rtlwifi/config
+	config PACKAGE_RTLWIFI_DEBUG
+		bool "Realtek wireless debugging"
+		depends on PACKAGE_kmod-rtlwifi
+		help
+		  Say Y, if you want to debug realtek wireless drivers.
+
+endef
+
+define KernelPackage/rtlwifi
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek common driver part
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11W_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtlwifi-pci
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek common driver part (PCI support)
+  DEPENDS+= @PCI_SUPPORT +kmod-rtlwifi
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
+  AUTOLOAD:=$(call AutoProbe,rtl_pci)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtlwifi-btcoexist
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek BT coexist support
+  DEPENDS+= +kmod-rtlwifi
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/btcoexist/btcoexist.ko
+  AUTOLOAD:=$(call AutoProbe,btcoexist)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtlwifi-usb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek common driver part (USB support)
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-rtlwifi
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
+  AUTOLOAD:=$(call AutoProbe,rtl_usb)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtl8192c-common
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192CE/RTL8192CU common support module
+  DEPENDS+= +kmod-rtlwifi
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtl8192ce
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192CE/RTL8188CE support
+  DEPENDS+= +kmod-rtlwifi-pci +kmod-rtl8192c-common +rtl8192ce-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192ce)
+endef
+
+define KernelPackage/rtl8192se
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192SE/RTL8191SE support
+  DEPENDS+= +kmod-rtlwifi-pci +rtl8192se-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192se)
+endef
+
+define KernelPackage/rtl8192de
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192DE/RTL8188DE support
+  DEPENDS+= +kmod-rtlwifi-pci +rtl8192de-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192de)
+endef
+
+define KernelPackage/rtl8192cu
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8192CU/RTL8188CU support
+  DEPENDS+= +kmod-rtlwifi-usb +kmod-rtl8192c-common +rtl8192cu-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8192cu)
+endef
+
+define KernelPackage/rtl8821ae
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8821AE support
+  DEPENDS+= +kmod-rtlwifi-btcoexist +kmod-rtlwifi-pci +rtl8821ae-firmware
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/rtl8821ae.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8821ae)
+endef
+
+define KernelPackage/rtl8xxxu
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=alternative Realtek RTL8XXXU support
+  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko
+  AUTOLOAD:=$(call AutoProbe,rtl8xxxu)
+endef
+
+define KernelPackage/rtl8xxxu/description
+  This is an alternative driver for various Realtek RTL8XXX
+  parts written to utilize the Linux mac80211 stack.
+  The driver is known to work with a number of RTL8723AU,
+  RL8188CU, RTL8188RU, RTL8191CU, and RTL8192CU devices
+
+  This driver is under development and has a limited feature
+  set. In particular it does not yet support 40MHz channels
+  and power management. However it should have a smaller
+  memory footprint than the vendor drivers and benetifs
+  from the in kernel mac80211 stack.
+
+  It can coexist with drivers from drivers/staging/rtl8723au,
+  drivers/staging/rtl8192u, and drivers/net/wireless/rtlwifi,
+  but you will need to control which module you wish to load.
+
+  RTL8XXXU_UNTESTED is enabled
+  This option enables detection of Realtek 8723/8188/8191/8192 WiFi
+  USB devices which have not been tested directly by the driver
+  author or reported to be working by third parties.
+
+  Please report your results!
+endef