diff --git a/package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch b/package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch
new file mode 100644
index 0000000000..b6f48680b7
--- /dev/null
+++ b/package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch
@@ -0,0 +1,86 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 11 Jul 2016 10:34:37 +0200
+Subject: [PATCH] ath9k_hw: fix spectral scan on AR9285 and newer
+
+The register layout of AR_PHY_SPECTRAL_SCAN has changed, only AR9280
+uses the old layout
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+@@ -476,6 +476,7 @@ static void ar9002_hw_set_bt_ant_diversi
+ static void ar9002_hw_spectral_scan_config(struct ath_hw *ah,
+ 				    struct ath_spec_scan *param)
+ {
++	u32 repeat_bit;
+ 	u8 count;
+ 
+ 	if (!param->enabled) {
+@@ -486,12 +487,15 @@ static void ar9002_hw_spectral_scan_conf
+ 	REG_SET_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_FFT_ENA);
+ 	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, AR_PHY_SPECTRAL_SCAN_ENABLE);
+ 
++	if (AR_SREV_9280(ah))
++		repeat_bit = AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT;
++	else
++		repeat_bit = AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_KIWI;
++
+ 	if (param->short_repeat)
+-		REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+-			    AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
++		REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, repeat_bit);
+ 	else
+-		REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+-			    AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
++		REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN, repeat_bit);
+ 
+ 	/* on AR92xx, the highest bit of count will make the the chip send
+ 	 * spectral samples endlessly. Check if this really was intended,
+@@ -499,15 +503,25 @@ static void ar9002_hw_spectral_scan_conf
+ 	 */
+ 	count = param->count;
+ 	if (param->endless) {
+-		if (AR_SREV_9271(ah))
+-			count = 0;
+-		else
++		if (AR_SREV_9280(ah))
+ 			count = 0x80;
++		else
++			count = 0;
+ 	} else if (count & 0x80)
+ 		count = 0x7f;
++	else if (!count)
++		count = 1;
++
++	if (AR_SREV_9280(ah)) {
++		REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
++			      AR_PHY_SPECTRAL_SCAN_COUNT, count);
++	} else {
++		REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
++			      AR_PHY_SPECTRAL_SCAN_COUNT_KIWI, count);
++		REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
++			    AR_PHY_SPECTRAL_SCAN_PHYERR_MASK_SELECT);
++	}
+ 
+-	REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+-		      AR_PHY_SPECTRAL_SCAN_COUNT, count);
+ 	REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+ 		      AR_PHY_SPECTRAL_SCAN_PERIOD, param->period);
+ 	REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
++++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
+@@ -177,8 +177,11 @@
+ #define AR_PHY_SPECTRAL_SCAN_PERIOD_S		8
+ #define AR_PHY_SPECTRAL_SCAN_COUNT		0x00FF0000  /* Number of reports, reg 68, bits 16-23*/
+ #define AR_PHY_SPECTRAL_SCAN_COUNT_S		16
++#define AR_PHY_SPECTRAL_SCAN_COUNT_KIWI		0x0FFF0000  /* Number of reports, reg 68, bits 16-27*/
++#define AR_PHY_SPECTRAL_SCAN_COUNT_KIWI_S	16
+ #define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT	0x01000000  /* Short repeat, reg 68, bit 24*/
+-#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S	24  /* Short repeat, reg 68, bit 24*/
++#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_KIWI	0x10000000  /* Short repeat, reg 68, bit 28*/
++#define AR_PHY_SPECTRAL_SCAN_PHYERR_MASK_SELECT	0x40000000
+ 
+ #define AR_PHY_RX_DELAY           0x9914
+ #define AR_PHY_SEARCH_START_DELAY 0x9918
diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
index 7da71653a9..413df7ef06 100644
--- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
@@ -175,7 +175,7 @@
  #define AR_PHY_TIMING2           0x9810
  #define AR_PHY_TIMING3           0x9814
  #define AR_PHY_TIMING3_DSC_MAN   0xFFFE0000
-@@ -390,6 +399,8 @@
+@@ -393,6 +402,8 @@
  #define AR_PHY_RFBUS_GRANT       0x9C20
  #define AR_PHY_RFBUS_GRANT_EN    0x00000001